Merge "All Radio HALs need network access." into main
diff --git a/Android.bp b/Android.bp
index 558810c..44f064e 100644
--- a/Android.bp
+++ b/Android.bp
@@ -103,6 +103,7 @@
"plat_seapp_contexts",
"plat_sepolicy.cil",
"plat_sepolicy_genfs_202504.cil",
+ "plat_sepolicy_genfs_202604.cil",
"plat_service_contexts",
"secilc",
"plat_29.0.cil",
@@ -123,6 +124,14 @@
"plat_202404.cil",
"202404.compat.cil",
],
+ }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ // TODO(b/391513934): clean up once we can simplify complex select statements.
+ "202404": [],
+ "202504": [],
+ default: [
+ "plat_202504.cil",
+ "202504.compat.cil",
+ ],
}) + select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
true: ["plat_sepolicy_and_mapping.sha256"],
default: [],
@@ -256,9 +265,6 @@
name: "plat_sepolicy.cil",
src: ":plat_sepolicy.conf",
additional_cil_files: [":sepolicy_technical_debt{.plat_private}"],
- dist: {
- targets: ["sepolicy_finalize"],
- },
}
// userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
@@ -367,9 +373,6 @@
mapping: true,
version: "current",
relative_install_path: "mapping", // install to /system/etc/selinux/mapping
- dist: {
- targets: ["sepolicy_finalize"],
- },
}
se_versioned_policy {
@@ -672,7 +675,8 @@
":product_mapping_file",
],
device_first_srcs: select(soong_config_variable("ANDROID", "BOARD_GENFS_LABELS_VERSION"), {
- "202504": [":plat_sepolicy_genfs_202504.cil"],
+ "202404": [],
+ any @ ver: [":plat_sepolicy_genfs_" + ver + ".cil"],
default: [],
}),
// Make precompiled_sepolicy_srcs as public so that OEMs have access to them.
@@ -774,6 +778,9 @@
additional_cil_files: ["private/technical_debt.cil"],
installable: false,
secilc_check: false, // done by se_policy_binary
+ dist: {
+ targets: ["sepolicy_finalize"],
+ },
}
se_policy_binary {
@@ -835,6 +842,18 @@
},
}
+se_versioned_policy {
+ name: "base_plat_mapping_file",
+ base: ":base_plat_pub_policy.cil",
+ mapping: true,
+ version: "current",
+ relative_install_path: "mapping", // install to /system/etc/selinux/mapping
+ dist: {
+ targets: ["sepolicy_finalize"],
+ },
+ installable: false,
+}
+
se_policy_conf {
name: "base_product_pub_policy.conf",
defaults: ["se_policy_conf_flags_defaults"],
@@ -906,8 +925,32 @@
// Additional directories can be specified via Makefile variables:
// SEPOLICY_FREEZE_TEST_EXTRA_DIRS and SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS.
//////////////////////////////////
+
+FREEZE_TEST_BOARD_API_LEVEL = "202504"
+
+se_policy_conf {
+ name: "base_plat_pub_policy_for_freeze_test.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: plat_public_policy +
+ reqd_mask_policy,
+ build_variant: "user",
+ installable: false,
+ board_api_level: FREEZE_TEST_BOARD_API_LEVEL,
+}
+
+se_policy_cil {
+ name: "base_plat_pub_policy_for_freeze_test.cil",
+ src: ":base_plat_pub_policy_for_freeze_test.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
se_freeze_test {
name: "se_freeze_test",
+ board_api_level: FREEZE_TEST_BOARD_API_LEVEL,
+ current_cil: ":base_plat_pub_policy_for_freeze_test.cil",
+ prebuilt_cil: ":" + FREEZE_TEST_BOARD_API_LEVEL + "_plat_pub_policy.cil",
}
//////////////////////////////////
@@ -998,6 +1041,13 @@
default: [
"system_ext_202404.cil",
],
+ }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ // TODO(b/391513934): clean up once we can simplify complex select statements.
+ "202404": [],
+ "202504": [],
+ default: [
+ "system_ext_202504.cil",
+ ],
}) +
select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
true: ["system_ext_sepolicy_and_mapping.sha256"],
@@ -1027,6 +1077,13 @@
default: [
"system_ext_202404.compat.cil",
],
+ }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ // TODO(b/391513934): clean up once we can simplify complex select statements.
+ "202404": [],
+ "202504": [],
+ default: [
+ "system_ext_202504.compat.cil",
+ ],
}) + select(release_flag("RELEASE_AVF_ENABLE_VM_TO_TEE_SERVICES_ALLOWLIST"), {
true: ["system_ext_tee_service_contexts"],
default: [],
@@ -1066,6 +1123,13 @@
default: [
"product_202404.cil",
],
+ }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ // TODO(b/391513934): clean up once we can simplify complex select statements.
+ "202404": [],
+ "202504": [],
+ default: [
+ "product_202504.cil",
+ ],
}) + select(release_flag("RELEASE_AVF_ENABLE_VM_TO_TEE_SERVICES_ALLOWLIST"), {
true: ["product_tee_service_contexts"],
default: [],
@@ -1170,6 +1234,7 @@
"plat_seapp_contexts",
"plat_sepolicy.cil",
"plat_sepolicy_genfs_202504.cil",
+ "plat_sepolicy_genfs_202604.cil",
"plat_service_contexts",
"plat_service_contexts_test",
"searchpolicy",
@@ -1180,6 +1245,14 @@
"202404.compat.cil",
"plat_202404.cil",
],
+ }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ // TODO(b/391513934): clean up once we can simplify complex select statements.
+ "202404": [],
+ "202504": [],
+ default: [
+ "202504.compat.cil",
+ "plat_202504.cil",
+ ],
}) + select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
true: ["plat_sepolicy_and_mapping.sha256"],
default: [],
@@ -1210,6 +1283,17 @@
(default, default, default): [
"treble_sepolicy_tests_202404",
],
+ }) + select((
+ soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+ soong_config_variable("ANDROID", "ASAN_ENABLED"),
+ product_variable("selinux_ignore_neverallows"),
+ ), {
+ ("202404", default, default): [], // TODO(b/391513934): clean up once we can simplify complex select statements.
+ ("202504", true, true): [],
+ (default, true, true): [],
+ (default, default, default): [
+ "treble_sepolicy_tests_202504",
+ ],
}) + select(soong_config_variable("ANDROID", "RELEASE_BOARD_API_LEVEL_FROZEN"), {
true: ["se_freeze_test"],
default: [],
diff --git a/apex/com.android.biometrics.virtual.face-file_contexts b/apex/com.android.biometrics.virtual.face-file_contexts
index 07fc0a8..8d9b86c 100644
--- a/apex/com.android.biometrics.virtual.face-file_contexts
+++ b/apex/com.android.biometrics.virtual.face-file_contexts
@@ -1,3 +1,3 @@
-(/.*)? u:object_r:vendor_file:s0
-/etc(/.*)? u:object_r:vendor_configs_file:s0
+(/.*)? u:object_r:system_file:s0
+/lib(64)?(/.*) u:object_r:system_lib_file:s0
/bin/hw/android\.hardware\.biometrics\.face-service\.example u:object_r:virtual_face_exec:s0
diff --git a/build/soong/sepolicy_freeze.go b/build/soong/sepolicy_freeze.go
index 41d460d..21f6dba 100644
--- a/build/soong/sepolicy_freeze.go
+++ b/build/soong/sepolicy_freeze.go
@@ -20,9 +20,6 @@
"android/soong/android"
)
-var currentCilTag = dependencyTag{name: "current_cil"}
-var prebuiltCilTag = dependencyTag{name: "prebuilt_cil"}
-
func init() {
ctx := android.InitRegistrationContext
ctx.RegisterModuleType("se_freeze_test", freezeTestFactory)
@@ -33,72 +30,35 @@
// SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS.
func freezeTestFactory() android.Module {
f := &freezeTestModule{}
+ f.AddProperties(&f.properties)
android.InitAndroidArchModule(f, android.DeviceSupported, android.MultilibCommon)
- android.AddLoadHook(f, func(ctx android.LoadHookContext) {
- f.loadHook(ctx)
- })
return f
}
+type freezeTestProperties struct {
+ // Frozen SEPolicy version to compare
+ Board_api_level *string
+
+ // Path to the base platform public policy cil
+ Current_cil *string `android:"path"`
+
+ // Path to the prebuilt cil of given board API level
+ Prebuilt_cil *string `android:"path"`
+}
+
type freezeTestModule struct {
android.ModuleBase
+
+ properties freezeTestProperties
+
freezeTestTimestamp android.ModuleOutPath
}
-func (f *freezeTestModule) shouldRunTest(ctx android.EarlyModuleContext) bool {
+func (f *freezeTestModule) shouldCompareExtraDirs(ctx android.EarlyModuleContext) bool {
val, _ := ctx.Config().GetBuildFlag("RELEASE_BOARD_API_LEVEL_FROZEN")
return val == "true"
}
-func (f *freezeTestModule) loadHook(ctx android.LoadHookContext) {
- extraDirs := ctx.DeviceConfig().SepolicyFreezeTestExtraDirs()
- extraPrebuiltDirs := ctx.DeviceConfig().SepolicyFreezeTestExtraPrebuiltDirs()
-
- if !f.shouldRunTest(ctx) {
- if len(extraDirs) > 0 || len(extraPrebuiltDirs) > 0 {
- ctx.ModuleErrorf("SEPOLICY_FREEZE_TEST_EXTRA_DIRS or SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS cannot be set before system/sepolicy freezes.")
- return
- }
-
- return
- }
-
- if len(extraDirs) != len(extraPrebuiltDirs) {
- ctx.ModuleErrorf("SEPOLICY_FREEZE_TEST_EXTRA_DIRS and SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS must have the same number of directories.")
- return
- }
-}
-
-func (f *freezeTestModule) prebuiltCilModuleName(ctx android.EarlyModuleContext) string {
- return ctx.DeviceConfig().PlatformSepolicyVersion() + "_plat_pub_policy.cil"
-}
-
-func (f *freezeTestModule) DepsMutator(ctx android.BottomUpMutatorContext) {
- if !f.shouldRunTest(ctx) {
- return
- }
-
- ctx.AddDependency(f, currentCilTag, "base_plat_pub_policy.cil")
- ctx.AddDependency(f, prebuiltCilTag, f.prebuiltCilModuleName(ctx))
-}
-
-func (f *freezeTestModule) outputFileOfDep(ctx android.ModuleContext, depTag dependencyTag) android.Path {
- deps := ctx.GetDirectDepsWithTag(depTag)
- if len(deps) != 1 {
- ctx.ModuleErrorf("%d deps having tag %q; expected only one dep", len(deps), depTag)
- return nil
- }
-
- dep := deps[0]
- output := android.OutputFilesForModule(ctx, dep, "")
- if len(output) != 1 {
- ctx.ModuleErrorf("module %q produced %d outputs; expected only one output", dep.String(), len(output))
- return nil
- }
-
- return output[0]
-}
-
func (f *freezeTestModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
if ctx.ModuleName() != "se_freeze_test" || ctx.ModuleDir() != "system/sepolicy" {
// two freeze test modules don't make sense.
@@ -107,15 +67,9 @@
f.freezeTestTimestamp = android.PathForModuleOut(ctx, "freeze_test")
- if !f.shouldRunTest(ctx) {
- // we still build a rule to prevent possible regression
- android.WriteFileRule(ctx, f.freezeTestTimestamp, ";; no freeze tests needed before system/sepolicy freezes")
- return
- }
-
// Freeze test 1: compare ToT sepolicy and prebuilt sepolicy
- currentCil := f.outputFileOfDep(ctx, currentCilTag)
- prebuiltCil := f.outputFileOfDep(ctx, prebuiltCilTag)
+ currentCil := android.PathForModuleSrc(ctx, String(f.properties.Current_cil))
+ prebuiltCil := android.PathForModuleSrc(ctx, String(f.properties.Prebuilt_cil))
if ctx.Failed() {
return
}
@@ -131,23 +85,35 @@
extraPrebuiltDirs := ctx.DeviceConfig().SepolicyFreezeTestExtraPrebuiltDirs()
var implicits []string
- for _, dir := range append(extraDirs, extraPrebuiltDirs...) {
- glob, err := ctx.GlobWithDeps(dir+"/**/*", []string{"bug_map"} /* exclude */)
- if err != nil {
- ctx.ModuleErrorf("failed to glob sepolicy dir %q: %s", dir, err.Error())
+ if f.shouldCompareExtraDirs(ctx) {
+ if len(extraDirs) != len(extraPrebuiltDirs) {
+ ctx.ModuleErrorf("SEPOLICY_FREEZE_TEST_EXTRA_DIRS and SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS must have the same number of directories.")
return
}
- implicits = append(implicits, glob...)
- }
- sort.Strings(implicits)
- for idx, _ := range extraDirs {
- rule.Command().Text("diff").
- Flag("-r").
- Flag("-q").
- FlagWithArg("-x ", "bug_map"). // exclude
- Text(extraDirs[idx]).
- Text(extraPrebuiltDirs[idx])
+ for _, dir := range append(extraDirs, extraPrebuiltDirs...) {
+ glob, err := ctx.GlobWithDeps(dir+"/**/*", []string{"bug_map"} /* exclude */)
+ if err != nil {
+ ctx.ModuleErrorf("failed to glob sepolicy dir %q: %s", dir, err.Error())
+ return
+ }
+ implicits = append(implicits, glob...)
+ }
+ sort.Strings(implicits)
+
+ for idx, _ := range extraDirs {
+ rule.Command().Text("diff").
+ Flag("-r").
+ Flag("-q").
+ FlagWithArg("-x ", "bug_map"). // exclude
+ Text(extraDirs[idx]).
+ Text(extraPrebuiltDirs[idx])
+ }
+ } else {
+ if len(extraDirs) > 0 || len(extraPrebuiltDirs) > 0 {
+ ctx.ModuleErrorf("SEPOLICY_FREEZE_TEST_EXTRA_DIRS or SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS cannot be set before system/sepolicy freezes.")
+ return
+ }
}
rule.Command().Text("touch").
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 35f4e09..e6e220b 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -23,144 +23,147 @@
var (
ServiceFuzzerBindings = map[string][]string{
- "android.hardware.audio.core.IConfig/default": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/default": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/a2dp": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/bluetooth": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/hearing_aid": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/msd": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/r_submix": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/stub": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.core.IModule/usb": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.effect.IFactory/default": EXCEPTION_NO_FUZZER,
- "android.hardware.audio.sounddose.ISoundDoseFactory/default": EXCEPTION_NO_FUZZER,
- "android.hardware.authsecret.IAuthSecret/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.evs.IEvsEnumerator/hw/0": EXCEPTION_NO_FUZZER,
- "android.hardware.boot.IBootControl/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.can.ICanController/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.evs.IEvsEnumerator/hw/1": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.ivn.IIvnAndroidDevice/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.remoteaccess.IRemoteAccess/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.vehicle.IVehicle/default": EXCEPTION_NO_FUZZER,
- "android.hardware.automotive.audiocontrol.IAudioControl/default": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.face.IFace/default": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.face.IFace/virtual": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.face.virtualhal.IVirtualHal/virtual": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.fingerprint.IFingerprint/default": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.fingerprint.IFingerprint/virtual": EXCEPTION_NO_FUZZER,
- "android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual": EXCEPTION_NO_FUZZER,
- "android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default": EXCEPTION_NO_FUZZER,
- "android.hardware.broadcastradio.IBroadcastRadio/amfm": []string{"android.hardware.broadcastradio-service.default_fuzzer"},
- "android.hardware.broadcastradio.IBroadcastRadio/dab": []string{"android.hardware.broadcastradio-service.default_fuzzer"},
- "android.hardware.bluetooth.IBluetoothHci/default": EXCEPTION_NO_FUZZER,
- "android.hardware.bluetooth.finder.IBluetoothFinder/default": EXCEPTION_NO_FUZZER,
- "android.hardware.bluetooth.ranging.IBluetoothChannelSounding/default": EXCEPTION_NO_FUZZER,
- "android.hardware.bluetooth.lmp_event.IBluetoothLmpEvent/default": EXCEPTION_NO_FUZZER,
- "android.hardware.bluetooth.socket.IBluetoothSocket/default": []string{"android.hardware.bluetooth.socket-service_fuzzer"},
- "android.hardware.camera.provider.ICameraProvider/internal/0": EXCEPTION_NO_FUZZER,
- "android.hardware.camera.provider.ICameraProvider/virtual/0": EXCEPTION_NO_FUZZER,
- "android.hardware.cas.IMediaCasService/default": EXCEPTION_NO_FUZZER,
- "android.hardware.confirmationui.IConfirmationUI/default": []string{"android.hardware.confirmationui-service.trusty_fuzzer"},
- "android.hardware.contexthub.IContextHub/default": EXCEPTION_NO_FUZZER,
- "android.hardware.drm.IDrmFactory/clearkey": EXCEPTION_NO_FUZZER,
- "android.hardware.drm.ICryptoFactory/clearkey": EXCEPTION_NO_FUZZER,
- "android.hardware.dumpstate.IDumpstateDevice/default": EXCEPTION_NO_FUZZER,
- "android.hardware.fastboot.IFastboot/default": EXCEPTION_NO_FUZZER,
- "android.hardware.gatekeeper.IGatekeeper/default": EXCEPTION_NO_FUZZER,
- "android.hardware.gnss.IGnss/default": EXCEPTION_NO_FUZZER,
- "android.hardware.graphics.allocator.IAllocator/default": EXCEPTION_NO_FUZZER,
- "android.hardware.graphics.composer3.IComposer/default": EXCEPTION_NO_FUZZER,
- "android.hardware.health.storage.IStorage/default": EXCEPTION_NO_FUZZER,
- "android.hardware.health.IHealth/default": []string{"android.hardware.health-service.aidl_fuzzer"},
- "android.hardware.identity.IIdentityCredentialStore/default": EXCEPTION_NO_FUZZER,
- "android.hardware.input.processor.IInputProcessor/default": EXCEPTION_NO_FUZZER,
- "android.hardware.ir.IConsumerIr/default": EXCEPTION_NO_FUZZER,
- "android.hardware.light.ILights/default": EXCEPTION_NO_FUZZER,
- "android.hardware.macsec.IMacsecPskPlugin/default": EXCEPTION_NO_FUZZER,
- "android.hardware.media.c2.IComponentStore/default": EXCEPTION_NO_FUZZER,
- "android.hardware.media.c2.IComponentStore/default1": EXCEPTION_NO_FUZZER,
- "android.hardware.media.c2.IComponentStore/default2": EXCEPTION_NO_FUZZER,
- "android.hardware.media.c2.IComponentStore/software": []string{"libcodec2-aidl-fuzzer"},
- "android.hardware.memtrack.IMemtrack/default": EXCEPTION_NO_FUZZER,
- "android.hardware.net.nlinterceptor.IInterceptor/default": EXCEPTION_NO_FUZZER,
- "android.hardware.nfc.INfc/default": []string{"nfc_service_fuzzer"},
- "android.hardware.oemlock.IOemLock/default": EXCEPTION_NO_FUZZER,
- "android.hardware.power.IPower/default": EXCEPTION_NO_FUZZER,
- "android.hardware.power.stats.IPowerStats/default": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.config.IRadioConfig/default": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.data.IRadioData/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.data.IRadioData/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.data.IRadioData/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.ims.IRadioIms/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.ims.IRadioIms/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.ims.IRadioIms/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.ims.media.IImsMedia/default": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.messaging.IRadioMessaging/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.messaging.IRadioMessaging/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.messaging.IRadioMessaging/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.modem.IRadioModem/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.modem.IRadioModem/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.modem.IRadioModem/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.network.IRadioNetwork/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.network.IRadioNetwork/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.network.IRadioNetwork/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.satellite.IRadioSatellite/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.satellite.IRadioSatellite/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.satellite.IRadioSatellite/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sim.IRadioSim/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sim.IRadioSim/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sim.IRadioSim/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sap.ISap/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sap.ISap/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.sap.ISap/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.voice.IRadioVoice/slot1": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.voice.IRadioVoice/slot2": EXCEPTION_NO_FUZZER,
- "android.hardware.radio.voice.IRadioVoice/slot3": EXCEPTION_NO_FUZZER,
- "android.hardware.rebootescrow.IRebootEscrow/default": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/eSE1": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/eSE2": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/eSE3": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/SIM1": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/SIM2": EXCEPTION_NO_FUZZER,
- "android.hardware.secure_element.ISecureElement/SIM3": EXCEPTION_NO_FUZZER,
- "android.hardware.security.authgraph.IAuthGraphKeyExchange/nonsecure": []string{"android.hardware.authgraph-service.nonsecure_fuzzer"},
- "android.hardware.security.dice.IDiceDevice/default": EXCEPTION_NO_FUZZER,
- "android.hardware.security.keymint.IKeyMintDevice/default": EXCEPTION_NO_FUZZER,
- "android.hardware.security.keymint.IRemotelyProvisionedComponent/default": EXCEPTION_NO_FUZZER,
- "android.hardware.security.secretkeeper.ISecretkeeper/default": EXCEPTION_NO_FUZZER,
- "android.hardware.security.secretkeeper.ISecretkeeper/nonsecure": []string{"android.hardware.security.secretkeeper-service.nonsecure_fuzzer"},
- "android.hardware.security.secureclock.ISecureClock/default": EXCEPTION_NO_FUZZER,
- "android.hardware.security.sharedsecret.ISharedSecret/default": EXCEPTION_NO_FUZZER,
- "android.hardware.sensors.ISensors/default": EXCEPTION_NO_FUZZER,
- "android.hardware.soundtrigger3.ISoundTriggerHw/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tetheroffload.IOffload/default": EXCEPTION_NO_FUZZER,
- "android.hardware.thermal.IThermal/default": EXCEPTION_NO_FUZZER,
- "android.hardware.threadnetwork.IThreadChip/chip0": []string{"android.hardware.threadnetwork-service.fuzzer"},
- "android.hardware.tv.hdmi.cec.IHdmiCec/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tv.hdmi.connection.IHdmiConnection/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tv.hdmi.earc.IEArc/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tv.input.ITvInput/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tv.mediaquality.IMediaQuality/default": EXCEPTION_NO_FUZZER,
- "android.hardware.tv.tuner.ITuner/default": EXCEPTION_NO_FUZZER,
- "android.hardware.usb.IUsb/default": EXCEPTION_NO_FUZZER,
- "android.hardware.usb.gadget.IUsbGadget/default": EXCEPTION_NO_FUZZER,
- "android.hardware.uwb.IUwb/default": EXCEPTION_NO_FUZZER,
- "android.hardware.vibrator.IVibrator/default": EXCEPTION_NO_FUZZER,
- "android.hardware.vibrator.IVibratorManager/default": []string{"android.hardware.vibrator-service.example_fuzzer"},
- "android.hardware.weaver.IWeaver/default": EXCEPTION_NO_FUZZER,
- "android.hardware.wifi.IWifi/default": EXCEPTION_NO_FUZZER,
- "android.hardware.wifi.hostapd.IHostapd/default": EXCEPTION_NO_FUZZER,
- "android.hardware.wifi.supplicant.ISupplicant/default": EXCEPTION_NO_FUZZER,
- "android.frameworks.cameraservice.service.ICameraService/default": EXCEPTION_NO_FUZZER,
- "android.frameworks.devicestate.IDeviceStateService/default": EXCEPTION_NO_FUZZER,
- "android.frameworks.location.altitude.IAltitudeService/default": EXCEPTION_NO_FUZZER,
- "android.frameworks.sensorservice.ISensorManager/default": []string{"libsensorserviceaidl_fuzzer"},
- "android.frameworks.stats.IStats/default": EXCEPTION_NO_FUZZER,
- "android.frameworks.vibrator.IVibratorControlService/default": EXCEPTION_NO_FUZZER,
- "android.se.omapi.ISecureElementService/default": EXCEPTION_NO_FUZZER,
- "android.system.keystore2.IKeystoreService/default": EXCEPTION_NO_FUZZER,
- "android.system.net.netd.INetd/default": []string{"netd_hw_service_fuzzer"},
- "android.system.suspend.ISystemSuspend/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IConfig/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/a2dp": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/bluetooth": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/hearing_aid": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/msd": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/r_submix": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/stub": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.core.IModule/usb": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.effect.IFactory/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.audio.sounddose.ISoundDoseFactory/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.authsecret.IAuthSecret/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.evs.IEvsEnumerator/hw/0": EXCEPTION_NO_FUZZER,
+ "android.hardware.boot.IBootControl/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.can.ICanController/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.evs.IEvsEnumerator/hw/1": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.ivn.IIvnAndroidDevice/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.remoteaccess.IRemoteAccess/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.vehicle.IVehicle/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.automotive.audiocontrol.IAudioControl/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.face.IFace/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.face.IFace/virtual": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.face.virtualhal.IVirtualHal/virtual": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.fingerprint.IFingerprint/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.fingerprint.IFingerprint/virtual": EXCEPTION_NO_FUZZER,
+ "android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.broadcastradio.IBroadcastRadio/amfm": []string{"android.hardware.broadcastradio-service.default_fuzzer"},
+ "android.hardware.broadcastradio.IBroadcastRadio/dab": []string{"android.hardware.broadcastradio-service.default_fuzzer"},
+ "android.hardware.bluetooth.IBluetoothHci/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.offload.leaudio.IHciProxy/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.finder.IBluetoothFinder/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.ranging.IBluetoothChannelSounding/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.lmp_event.IBluetoothLmpEvent/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.bluetooth.socket.IBluetoothSocket/default": []string{"android.hardware.bluetooth.socket-service_fuzzer"},
+ "android.hardware.camera.provider.ICameraProvider/internal/0": EXCEPTION_NO_FUZZER,
+ "android.hardware.camera.provider.ICameraProvider/virtual/0": EXCEPTION_NO_FUZZER,
+ "android.hardware.cas.IMediaCasService/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.confirmationui.IConfirmationUI/default": []string{"android.hardware.confirmationui-service.trusty_fuzzer"},
+ "android.hardware.contexthub.IContextHub/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.drm.IDrmFactory/clearkey": EXCEPTION_NO_FUZZER,
+ "android.hardware.drm.ICryptoFactory/clearkey": EXCEPTION_NO_FUZZER,
+ "android.hardware.dumpstate.IDumpstateDevice/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.fastboot.IFastboot/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.gatekeeper.IGatekeeper/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.gnss.IGnss/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.graphics.allocator.IAllocator/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.graphics.composer3.IComposer/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.health.storage.IStorage/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.health.IHealth/default": []string{"android.hardware.health-service.aidl_fuzzer"},
+ "android.hardware.identity.IIdentityCredentialStore/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.input.processor.IInputProcessor/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.ir.IConsumerIr/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.light.ILights/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.macsec.IMacsecPskPlugin/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/default1": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/default2": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/software": []string{"libcodec2-aidl-fuzzer"},
+ "android.hardware.memtrack.IMemtrack/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.net.nlinterceptor.IInterceptor/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.nfc.INfc/default": []string{"nfc_service_fuzzer"},
+ "android.hardware.oemlock.IOemLock/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.power.IPower/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.power.stats.IPowerStats/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.config.IRadioConfig/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.data.IRadioData/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.data.IRadioData/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.data.IRadioData/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.ims.IRadioIms/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.ims.IRadioIms/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.ims.IRadioIms/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.ims.media.IImsMedia/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.messaging.IRadioMessaging/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.messaging.IRadioMessaging/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.messaging.IRadioMessaging/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.modem.IRadioModem/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.modem.IRadioModem/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.modem.IRadioModem/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.network.IRadioNetwork/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.network.IRadioNetwork/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.network.IRadioNetwork/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.satellite.IRadioSatellite/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.satellite.IRadioSatellite/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.satellite.IRadioSatellite/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sim.IRadioSim/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sim.IRadioSim/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sim.IRadioSim/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sap.ISap/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sap.ISap/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.sap.ISap/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.voice.IRadioVoice/slot1": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.voice.IRadioVoice/slot2": EXCEPTION_NO_FUZZER,
+ "android.hardware.radio.voice.IRadioVoice/slot3": EXCEPTION_NO_FUZZER,
+ "android.hardware.rebootescrow.IRebootEscrow/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/eSE1": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/eSE2": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/eSE3": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/SIM1": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/SIM2": EXCEPTION_NO_FUZZER,
+ "android.hardware.secure_element.ISecureElement/SIM3": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.authgraph.IAuthGraphKeyExchange/nonsecure": []string{"android.hardware.authgraph-service.nonsecure_fuzzer"},
+ "android.hardware.security.dice.IDiceDevice/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.keymint.IKeyMintDevice/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.keymint.IRemotelyProvisionedComponent/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.secretkeeper.ISecretkeeper/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.secretkeeper.ISecretkeeper/nonsecure": []string{"android.hardware.security.secretkeeper-service.nonsecure_fuzzer"},
+ "android.hardware.security.secureclock.ISecureClock/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.sharedsecret.ISharedSecret/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.sensors.ISensors/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.soundtrigger3.ISoundTriggerHw/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tetheroffload.IOffload/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.thermal.IThermal/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.threadnetwork.IThreadChip/chip0": []string{"android.hardware.threadnetwork-service.fuzzer"},
+ "android.hardware.tv.hdmi.cec.IHdmiCec/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tv.hdmi.connection.IHdmiConnection/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tv.hdmi.earc.IEArc/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tv.input.ITvInput/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tv.mediaquality.IMediaQuality/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.tv.tuner.ITuner/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.usb.IUsb/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.usb.gadget.IUsbGadget/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.uwb.IUwb/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.vibrator.IVibrator/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.vibrator.IVibratorManager/default": []string{"android.hardware.vibrator-service.example_fuzzer"},
+ "android.hardware.virtualization.capabilities.IVmCapabilitiesService/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.virtualization.capabilities.IVmCapabilitiesService/noop": EXCEPTION_NO_FUZZER,
+ "android.hardware.weaver.IWeaver/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.wifi.IWifi/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.wifi.hostapd.IHostapd/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.wifi.supplicant.ISupplicant/default": EXCEPTION_NO_FUZZER,
+ "android.frameworks.cameraservice.service.ICameraService/default": EXCEPTION_NO_FUZZER,
+ "android.frameworks.devicestate.IDeviceStateService/default": EXCEPTION_NO_FUZZER,
+ "android.frameworks.location.altitude.IAltitudeService/default": EXCEPTION_NO_FUZZER,
+ "android.frameworks.sensorservice.ISensorManager/default": []string{"libsensorserviceaidl_fuzzer"},
+ "android.frameworks.stats.IStats/default": EXCEPTION_NO_FUZZER,
+ "android.frameworks.vibrator.IVibratorControlService/default": EXCEPTION_NO_FUZZER,
+ "android.se.omapi.ISecureElementService/default": EXCEPTION_NO_FUZZER,
+ "android.system.keystore2.IKeystoreService/default": EXCEPTION_NO_FUZZER,
+ "android.system.net.netd.INetd/default": []string{"netd_hw_service_fuzzer"},
+ "android.system.suspend.ISystemSuspend/default": EXCEPTION_NO_FUZZER,
"accessibility": EXCEPTION_NO_FUZZER,
"account": EXCEPTION_NO_FUZZER,
"activity": EXCEPTION_NO_FUZZER,
@@ -197,101 +200,101 @@
"android.system.virtualizationservice_internal.IVmnic": EXCEPTION_NO_FUZZER,
"android.system.virtualizationmaintenance": EXCEPTION_NO_FUZZER,
"android.system.vmtethering.IVmTethering": EXCEPTION_NO_FUZZER,
- "ambient_context": EXCEPTION_NO_FUZZER,
- "app_binding": EXCEPTION_NO_FUZZER,
- "app_function": EXCEPTION_NO_FUZZER,
- "app_hibernation": EXCEPTION_NO_FUZZER,
- "app_integrity": EXCEPTION_NO_FUZZER,
- "app_prediction": EXCEPTION_NO_FUZZER,
- "app_search": EXCEPTION_NO_FUZZER,
- "apexservice": EXCEPTION_NO_FUZZER,
- "archive": EXCEPTION_NO_FUZZER,
- "attestation_verification": EXCEPTION_NO_FUZZER,
- "authentication_policy": EXCEPTION_NO_FUZZER,
- "blob_store": EXCEPTION_NO_FUZZER,
- "gsiservice": EXCEPTION_NO_FUZZER,
- "appops": EXCEPTION_NO_FUZZER,
- "appwidget": EXCEPTION_NO_FUZZER,
- "artd": []string{"artd_fuzzer"},
- "artd_pre_reboot": []string{"artd_fuzzer"},
- "assetatlas": EXCEPTION_NO_FUZZER,
- "attention": EXCEPTION_NO_FUZZER,
- "audio": EXCEPTION_NO_FUZZER,
- "auth": EXCEPTION_NO_FUZZER,
- "autofill": EXCEPTION_NO_FUZZER,
- "background_install_control": EXCEPTION_NO_FUZZER,
- "backup": EXCEPTION_NO_FUZZER,
- "batteryproperties": EXCEPTION_NO_FUZZER,
- "batterystats": EXCEPTION_NO_FUZZER,
- "battery": EXCEPTION_NO_FUZZER,
- "binder_calls_stats": EXCEPTION_NO_FUZZER,
- "biometric": EXCEPTION_NO_FUZZER,
- "bluetooth_manager": EXCEPTION_NO_FUZZER,
- "bluetooth": EXCEPTION_NO_FUZZER,
- "broadcastradio": EXCEPTION_NO_FUZZER,
- "bugreport": EXCEPTION_NO_FUZZER,
- "cacheinfo": EXCEPTION_NO_FUZZER,
- "carrier_config": EXCEPTION_NO_FUZZER,
- "clipboard": EXCEPTION_NO_FUZZER,
- "cloudsearch": EXCEPTION_NO_FUZZER,
- "cloudsearch_service": EXCEPTION_NO_FUZZER,
- "com.android.net.IProxyService": EXCEPTION_NO_FUZZER,
- "companiondevice": EXCEPTION_NO_FUZZER,
- "communal": EXCEPTION_NO_FUZZER,
- "platform_compat": EXCEPTION_NO_FUZZER,
- "platform_compat_native": EXCEPTION_NO_FUZZER,
- "connectivity": EXCEPTION_NO_FUZZER,
- "connectivity_native": EXCEPTION_NO_FUZZER,
- "connmetrics": EXCEPTION_NO_FUZZER,
- "consumer_ir": EXCEPTION_NO_FUZZER,
- "content": EXCEPTION_NO_FUZZER,
- "content_capture": EXCEPTION_NO_FUZZER,
- "content_suggestions": EXCEPTION_NO_FUZZER,
- "contexthub": EXCEPTION_NO_FUZZER,
- "contextual_search": EXCEPTION_NO_FUZZER,
- "country_detector": EXCEPTION_NO_FUZZER,
- "coverage": EXCEPTION_NO_FUZZER,
- "cpuinfo": EXCEPTION_NO_FUZZER,
- "cpu_monitor": EXCEPTION_NO_FUZZER,
- "credential": EXCEPTION_NO_FUZZER,
- "crossprofileapps": EXCEPTION_NO_FUZZER,
- "dataloader_manager": EXCEPTION_NO_FUZZER,
- "dbinfo": EXCEPTION_NO_FUZZER,
- "device_config": EXCEPTION_NO_FUZZER,
- "device_config_updatable": EXCEPTION_NO_FUZZER,
- "device_policy": EXCEPTION_NO_FUZZER,
- "device_identifiers": EXCEPTION_NO_FUZZER,
- "deviceidle": EXCEPTION_NO_FUZZER,
- "device_lock": EXCEPTION_NO_FUZZER,
- "device_state": EXCEPTION_NO_FUZZER,
- "devicestoragemonitor": EXCEPTION_NO_FUZZER,
- "dexopt_chroot_setup": []string{"dexopt_chroot_setup_fuzzer"},
- "diskstats": EXCEPTION_NO_FUZZER,
- "display": EXCEPTION_NO_FUZZER,
- "dnsresolver": []string{"resolv_service_fuzzer"},
- "domain_verification": EXCEPTION_NO_FUZZER,
- "color_display": EXCEPTION_NO_FUZZER,
- "netd_listener": EXCEPTION_NO_FUZZER,
- "network_watchlist": EXCEPTION_NO_FUZZER,
- "DockObserver": EXCEPTION_NO_FUZZER,
- "dreams": EXCEPTION_NO_FUZZER,
- "drm.drmManager": []string{"drmserver_fuzzer"},
- "dropbox": EXCEPTION_NO_FUZZER,
- "dumpstate": EXCEPTION_NO_FUZZER,
- "dynamic_system": EXCEPTION_NO_FUZZER,
- "dynamic_instrumentation": EXCEPTION_NO_FUZZER,
- "econtroller": EXCEPTION_NO_FUZZER,
- "ecm_enhanced_confirmation": EXCEPTION_NO_FUZZER,
- "emergency_affordance": EXCEPTION_NO_FUZZER,
- "euicc_card_controller": EXCEPTION_NO_FUZZER,
- "external_vibrator_service": EXCEPTION_NO_FUZZER,
- "ethernet": EXCEPTION_NO_FUZZER,
- "face": EXCEPTION_NO_FUZZER,
- "file_integrity": EXCEPTION_NO_FUZZER,
- "fingerprint": EXCEPTION_NO_FUZZER,
- "feature_flags": EXCEPTION_NO_FUZZER,
- "font": EXCEPTION_NO_FUZZER,
- "forensic": EXCEPTION_NO_FUZZER,
+ "android.system.vold.IVold/default": []string{"vold_native_service_fuzzer"},
+ "ambient_context": EXCEPTION_NO_FUZZER,
+ "app_binding": EXCEPTION_NO_FUZZER,
+ "app_function": EXCEPTION_NO_FUZZER,
+ "app_hibernation": EXCEPTION_NO_FUZZER,
+ "app_integrity": EXCEPTION_NO_FUZZER,
+ "app_prediction": EXCEPTION_NO_FUZZER,
+ "app_search": EXCEPTION_NO_FUZZER,
+ "apexservice": EXCEPTION_NO_FUZZER,
+ "archive": EXCEPTION_NO_FUZZER,
+ "attestation_verification": EXCEPTION_NO_FUZZER,
+ "authentication_policy": EXCEPTION_NO_FUZZER,
+ "blob_store": EXCEPTION_NO_FUZZER,
+ "gsiservice": EXCEPTION_NO_FUZZER,
+ "appops": EXCEPTION_NO_FUZZER,
+ "appwidget": EXCEPTION_NO_FUZZER,
+ "artd": []string{"artd_fuzzer"},
+ "artd_pre_reboot": []string{"artd_fuzzer"},
+ "assetatlas": EXCEPTION_NO_FUZZER,
+ "attention": EXCEPTION_NO_FUZZER,
+ "audio": EXCEPTION_NO_FUZZER,
+ "auth": EXCEPTION_NO_FUZZER,
+ "autofill": EXCEPTION_NO_FUZZER,
+ "background_install_control": EXCEPTION_NO_FUZZER,
+ "backup": EXCEPTION_NO_FUZZER,
+ "batteryproperties": EXCEPTION_NO_FUZZER,
+ "batterystats": EXCEPTION_NO_FUZZER,
+ "battery": EXCEPTION_NO_FUZZER,
+ "binder_calls_stats": EXCEPTION_NO_FUZZER,
+ "biometric": EXCEPTION_NO_FUZZER,
+ "bluetooth_manager": EXCEPTION_NO_FUZZER,
+ "bluetooth": EXCEPTION_NO_FUZZER,
+ "broadcastradio": EXCEPTION_NO_FUZZER,
+ "bugreport": EXCEPTION_NO_FUZZER,
+ "cacheinfo": EXCEPTION_NO_FUZZER,
+ "carrier_config": EXCEPTION_NO_FUZZER,
+ "clipboard": EXCEPTION_NO_FUZZER,
+ "cloudsearch": EXCEPTION_NO_FUZZER,
+ "cloudsearch_service": EXCEPTION_NO_FUZZER,
+ "com.android.net.IProxyService": EXCEPTION_NO_FUZZER,
+ "companiondevice": EXCEPTION_NO_FUZZER,
+ "communal": EXCEPTION_NO_FUZZER,
+ "platform_compat": EXCEPTION_NO_FUZZER,
+ "platform_compat_native": EXCEPTION_NO_FUZZER,
+ "connectivity": EXCEPTION_NO_FUZZER,
+ "connectivity_native": EXCEPTION_NO_FUZZER,
+ "connmetrics": EXCEPTION_NO_FUZZER,
+ "consumer_ir": EXCEPTION_NO_FUZZER,
+ "content": EXCEPTION_NO_FUZZER,
+ "content_capture": EXCEPTION_NO_FUZZER,
+ "content_suggestions": EXCEPTION_NO_FUZZER,
+ "contexthub": EXCEPTION_NO_FUZZER,
+ "contextual_search": EXCEPTION_NO_FUZZER,
+ "country_detector": EXCEPTION_NO_FUZZER,
+ "coverage": EXCEPTION_NO_FUZZER,
+ "cpuinfo": EXCEPTION_NO_FUZZER,
+ "cpu_monitor": EXCEPTION_NO_FUZZER,
+ "credential": EXCEPTION_NO_FUZZER,
+ "crossprofileapps": EXCEPTION_NO_FUZZER,
+ "dataloader_manager": EXCEPTION_NO_FUZZER,
+ "dbinfo": EXCEPTION_NO_FUZZER,
+ "device_config": EXCEPTION_NO_FUZZER,
+ "device_config_updatable": EXCEPTION_NO_FUZZER,
+ "device_policy": EXCEPTION_NO_FUZZER,
+ "device_identifiers": EXCEPTION_NO_FUZZER,
+ "deviceidle": EXCEPTION_NO_FUZZER,
+ "device_lock": EXCEPTION_NO_FUZZER,
+ "device_state": EXCEPTION_NO_FUZZER,
+ "devicestoragemonitor": EXCEPTION_NO_FUZZER,
+ "dexopt_chroot_setup": []string{"dexopt_chroot_setup_fuzzer"},
+ "diskstats": EXCEPTION_NO_FUZZER,
+ "display": EXCEPTION_NO_FUZZER,
+ "dnsresolver": []string{"resolv_service_fuzzer"},
+ "domain_verification": EXCEPTION_NO_FUZZER,
+ "color_display": EXCEPTION_NO_FUZZER,
+ "netd_listener": EXCEPTION_NO_FUZZER,
+ "network_watchlist": EXCEPTION_NO_FUZZER,
+ "DockObserver": EXCEPTION_NO_FUZZER,
+ "dreams": EXCEPTION_NO_FUZZER,
+ "drm.drmManager": []string{"drmserver_fuzzer"},
+ "dropbox": EXCEPTION_NO_FUZZER,
+ "dumpstate": EXCEPTION_NO_FUZZER,
+ "dynamic_system": EXCEPTION_NO_FUZZER,
+ "dynamic_instrumentation": EXCEPTION_NO_FUZZER,
+ "econtroller": EXCEPTION_NO_FUZZER,
+ "ecm_enhanced_confirmation": EXCEPTION_NO_FUZZER,
+ "emergency_affordance": EXCEPTION_NO_FUZZER,
+ "euicc_card_controller": EXCEPTION_NO_FUZZER,
+ "external_vibrator_service": EXCEPTION_NO_FUZZER,
+ "ethernet": EXCEPTION_NO_FUZZER,
+ "face": EXCEPTION_NO_FUZZER,
+ "file_integrity": EXCEPTION_NO_FUZZER,
+ "fingerprint": EXCEPTION_NO_FUZZER,
+ "feature_flags": EXCEPTION_NO_FUZZER,
+ "font": EXCEPTION_NO_FUZZER,
"android.hardware.fingerprint.IFingerprintDaemon": EXCEPTION_NO_FUZZER,
"game": EXCEPTION_NO_FUZZER,
"gfxinfo": EXCEPTION_NO_FUZZER,
diff --git a/compat/Android.bp b/compat/Android.bp
index 28936dd..be895d9 100644
--- a/compat/Android.bp
+++ b/compat/Android.bp
@@ -532,6 +532,7 @@
stem: "202404.cil",
bottom_half: [":202404.board.compat.map{.plat_private}"],
version: "202404",
+ top_half: "plat_202504.cil",
}
se_cil_compat_map {
@@ -540,6 +541,7 @@
bottom_half: [":202404.board.compat.map{.system_ext_private}"],
system_ext_specific: true,
version: "202404",
+ top_half: "system_ext_202504.cil",
}
se_cil_compat_map {
@@ -548,12 +550,14 @@
bottom_half: [":202404.board.compat.map{.product_private}"],
product_specific: true,
version: "202404",
+ top_half: "product_202504.cil",
}
se_cil_compat_map {
name: "202404.ignore.cil",
bottom_half: [":202404.board.ignore.map{.plat_private}"],
version: "202404",
+ top_half: "202504.ignore.cil",
}
se_cil_compat_map {
@@ -562,6 +566,7 @@
bottom_half: [":202404.board.ignore.map{.system_ext_private}"],
system_ext_specific: true,
version: "202404",
+ top_half: "system_ext_202504.ignore.cil",
}
se_cil_compat_map {
@@ -570,6 +575,7 @@
bottom_half: [":202404.board.ignore.map{.product_private}"],
product_specific: true,
version: "202404",
+ top_half: "product_202504.ignore.cil",
}
se_compat_cil {
@@ -591,3 +597,83 @@
src: "plat_sepolicy_genfs_202504.cil",
relative_install_path: "selinux",
}
+
+se_build_files {
+ name: "202504.board.compat.map",
+ srcs: ["compat/202504/202504.cil"],
+}
+
+se_build_files {
+ name: "202504.board.compat.cil",
+ srcs: ["compat/202504/202504.compat.cil"],
+}
+
+se_build_files {
+ name: "202504.board.ignore.map",
+ srcs: ["compat/202504/202504.ignore.cil"],
+}
+
+se_cil_compat_map {
+ name: "plat_202504.cil",
+ stem: "202504.cil",
+ bottom_half: [":202504.board.compat.map{.plat_private}"],
+ version: "202504",
+}
+
+se_cil_compat_map {
+ name: "system_ext_202504.cil",
+ stem: "202504.cil",
+ bottom_half: [":202504.board.compat.map{.system_ext_private}"],
+ system_ext_specific: true,
+ version: "202504",
+}
+
+se_cil_compat_map {
+ name: "product_202504.cil",
+ stem: "202504.cil",
+ bottom_half: [":202504.board.compat.map{.product_private}"],
+ product_specific: true,
+ version: "202504",
+}
+
+se_cil_compat_map {
+ name: "202504.ignore.cil",
+ bottom_half: [":202504.board.ignore.map{.plat_private}"],
+ version: "202504",
+}
+
+se_cil_compat_map {
+ name: "system_ext_202504.ignore.cil",
+ stem: "202504.ignore.cil",
+ bottom_half: [":202504.board.ignore.map{.system_ext_private}"],
+ system_ext_specific: true,
+ version: "202504",
+}
+
+se_cil_compat_map {
+ name: "product_202504.ignore.cil",
+ stem: "202504.ignore.cil",
+ bottom_half: [":202504.board.ignore.map{.product_private}"],
+ product_specific: true,
+ version: "202504",
+}
+
+se_compat_cil {
+ name: "202504.compat.cil",
+ srcs: [":202504.board.compat.cil{.plat_private}"],
+ version: "202504",
+}
+
+se_compat_cil {
+ name: "system_ext_202504.compat.cil",
+ stem: "202504.compat.cil",
+ srcs: [":202504.board.compat.cil{.system_ext_private}"],
+ system_ext_specific: true,
+ version: "202504",
+}
+
+prebuilt_etc {
+ name: "plat_sepolicy_genfs_202604.cil",
+ src: "plat_sepolicy_genfs_202604.cil",
+ relative_install_path: "selinux",
+}
diff --git a/compat/plat_sepolicy_genfs_202504.cil b/compat/plat_sepolicy_genfs_202504.cil
index 79cc732..d78194f 100644
--- a/compat/plat_sepolicy_genfs_202504.cil
+++ b/compat/plat_sepolicy_genfs_202504.cil
@@ -1 +1,2 @@
(genfscon sysfs "/class/udc" (u object_r sysfs_udc ((s0) (s0))))
+(genfscon sysfs "/power/mem_sleep" (u object_r sysfs_mem_sleep ((s0) (s0))))
diff --git a/compat/plat_sepolicy_genfs_202604.cil b/compat/plat_sepolicy_genfs_202604.cil
new file mode 100644
index 0000000..d78194f
--- /dev/null
+++ b/compat/plat_sepolicy_genfs_202604.cil
@@ -0,0 +1,2 @@
+(genfscon sysfs "/class/udc" (u object_r sysfs_udc ((s0) (s0))))
+(genfscon sysfs "/power/mem_sleep" (u object_r sysfs_mem_sleep ((s0) (s0))))
diff --git a/contexts/Android.bp b/contexts/Android.bp
index 08a4f64..638f202 100644
--- a/contexts/Android.bp
+++ b/contexts/Android.bp
@@ -242,7 +242,14 @@
defaults: ["contexts_flags_defaults"],
srcs: [":property_contexts_files{.system_ext_private}"],
system_ext_specific: true,
- recovery_available: true,
+}
+
+property_contexts {
+ name: "system_ext_property_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [":property_contexts_files{.system_ext_private}"],
+ recovery: true,
+ stem: "system_ext_property_contexts",
}
property_contexts {
@@ -250,7 +257,14 @@
defaults: ["contexts_flags_defaults"],
srcs: [":property_contexts_files{.product_private}"],
product_specific: true,
- recovery_available: true,
+}
+
+property_contexts {
+ name: "product_property_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [":property_contexts_files{.product_private}"],
+ recovery: true,
+ stem: "product_property_contexts",
}
property_contexts {
@@ -262,7 +276,18 @@
":property_contexts_files{.reqd_mask}",
],
soc_specific: true,
- recovery_available: true,
+}
+
+property_contexts {
+ name: "vendor_property_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [
+ ":property_contexts_files{.plat_vendor}",
+ ":property_contexts_files{.vendor}",
+ ":property_contexts_files{.reqd_mask}",
+ ],
+ recovery: true,
+ stem: "vendor_property_contexts",
}
property_contexts {
@@ -270,7 +295,14 @@
defaults: ["contexts_flags_defaults"],
srcs: [":property_contexts_files{.odm}"],
device_specific: true,
- recovery_available: true,
+}
+
+property_contexts {
+ name: "odm_property_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [":property_contexts_files{.odm}"],
+ recovery: true,
+ stem: "odm_property_contexts",
}
service_contexts {
@@ -292,7 +324,14 @@
defaults: ["contexts_flags_defaults"],
srcs: [":service_contexts_files{.system_ext_private}"],
system_ext_specific: true,
- recovery_available: true,
+}
+
+service_contexts {
+ name: "system_ext_service_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [":service_contexts_files{.system_ext_private}"],
+ recovery: true,
+ stem: "system_ext_service_contexts",
}
service_contexts {
@@ -300,7 +339,14 @@
defaults: ["contexts_flags_defaults"],
srcs: [":service_contexts_files{.product_private}"],
product_specific: true,
- recovery_available: true,
+}
+
+service_contexts {
+ name: "product_service_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [":service_contexts_files{.product_private}"],
+ recovery: true,
+ stem: "product_service_contexts",
}
service_contexts {
@@ -312,7 +358,18 @@
":service_contexts_files{.reqd_mask}",
],
soc_specific: true,
- recovery_available: true,
+}
+
+service_contexts {
+ name: "vendor_service_contexts.recovery",
+ defaults: ["contexts_flags_defaults"],
+ srcs: [
+ ":service_contexts_files{.plat_vendor}",
+ ":service_contexts_files{.vendor}",
+ ":service_contexts_files{.reqd_mask}",
+ ],
+ recovery: true,
+ stem: "vendor_service_contexts",
}
service_contexts {
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index fc2d7b8..fd25d0a 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -321,7 +321,6 @@
/system/bin/fsck.f2fs fsck_exec
/system/bin/init init_exec
/system/bin/mini-keyctl toolbox_exec
-/system/bin/fsverity_init fsverity_init_exec
/system/bin/sload_f2fs e2fs_exec
/system/bin/make_f2fs e2fs_exec
/system/bin/fsck_msdos fsck_exec
@@ -340,6 +339,7 @@
/system/bin/bootstat bootstat_exec
/system/bin/app_process32 zygote_exec
/system/bin/app_process64 zygote_exec
+/system/bin/pbtombstone pbtombstone_exec
/system/bin/servicemanager servicemanager_exec
/system/bin/surfaceflinger surfaceflinger_exec
/system/bin/gpuservice gpuservice_exec
@@ -436,6 +436,7 @@
/system/bin/virtual_touchpad virtual_touchpad_exec
/system/bin/hw/android.frameworks.bufferhub@1.0-service fwk_bufferhub_exec
/system/bin/hw/android.system.suspend-service system_suspend_exec
+/system/bin/memcgv2_activation_depth.sh memcgv2_activation_depth_exec
/system/etc/aconfig system_aconfig_storage_file
/system/etc/cgroups.json cgroup_desc_file
/system/etc/task_profiles/cgroups_0.json cgroup_desc_file
@@ -1298,6 +1299,8 @@
/metadata/tradeinmode/test tradeinmode_metadata_file
/metadata/prefetch prefetch_metadata_file
/metadata/prefetch/test prefetch_metadata_file
+/metadata/libprocessgroup libprocessgroup_metadata_file
+/metadata/libprocessgroup/test libprocessgroup_metadata_file
/mnt/asec asec_apk_file
/mnt/asec/test asec_apk_file
@@ -1342,3 +1345,5 @@
/tmp shell_data_file
/mnt/pre_reboot_dexopt pre_reboot_dexopt_file
+
+/second_stage_resources/overlay_remounter overlay_remounter_exec
diff --git a/microdroid/system/private/init.te b/microdroid/system/private/init.te
index 9a0345f..11e398e 100644
--- a/microdroid/system/private/init.te
+++ b/microdroid/system/private/init.te
@@ -19,6 +19,12 @@
allow init self:global_capability2_class_set perfmon;
dontaudit init self:perf_event { kernel tracepoint read write };
+# Allow opening /proc/kallsyms so that on boot, init can create and retain an
+# fd with the full address visibility (which is evaluated on open and persists
+# for the lifetime of the open file description). This fd can then be shared
+# with other privileged processes.
+allow init proc_kallsyms:file r_file_perms;
+
# Allow init to restore contexts of vd_device(/dev/block/vd[..]) when labeling
# /dev/block.
allow init vd_device:blk_file relabelto;
diff --git a/microdroid/system/private/microdroid_app.te b/microdroid/system/private/microdroid_app.te
index 77667ff..ecb21cb 100644
--- a/microdroid/system/private/microdroid_app.te
+++ b/microdroid/system/private/microdroid_app.te
@@ -12,3 +12,7 @@
# Let microdroid_manager kernel-log.
allow microdroid_app kmsg_device:chr_file w_file_perms;
allow microdroid_app kmsg_debug_device:chr_file w_file_perms;
+
+# Allow microdroid_manager to read /apex directory to learn about activated
+# APEXes. It uses this to create linker namespace links to those APEXes.
+allow microdroid_app apex_mnt_dir:dir r_dir_perms;
diff --git a/microdroid/system/private/microdroid_payload.te b/microdroid/system/private/microdroid_payload.te
index e4315a2..822797c 100644
--- a/microdroid/system/private/microdroid_payload.te
+++ b/microdroid/system/private/microdroid_payload.te
@@ -14,6 +14,10 @@
# Allow to set debug prop
set_prop(microdroid_payload, debug_prop)
+# Allow to use service manager APIs without waiting for the servicemanager
+# process because it's not installed in microdroid
+get_prop(microdroid_payload, servicemanager_prop)
+
# Allow microdroid_payload to use vsock inherited from microdroid_manager
allow microdroid_payload microdroid_manager:vsock_socket { read write };
diff --git a/microdroid/system/private/property_contexts b/microdroid/system/private/property_contexts
index 803e25e..13306dd 100644
--- a/microdroid/system/private/property_contexts
+++ b/microdroid/system/private/property_contexts
@@ -122,6 +122,9 @@
microdroid_manager.config_done u:object_r:microdroid_lifecycle_prop:s0 exact bool
microdroid_manager.init_done u:object_r:microdroid_lifecycle_prop:s0 exact bool
+# servicemanager property to avoid waiting for servicemanager process
+servicemanager.installed u:object_r:servicemanager_prop:s0 exact bool
+
init_debug_policy.adbd.enabled u:object_r:init_debug_policy_prop:s0 exact bool
dev.mnt.blk.root u:object_r:dev_mnt_prop:s0 exact string
diff --git a/microdroid/system/public/property.te b/microdroid/system/public/property.te
index 18dab10..ae1c70c 100644
--- a/microdroid/system/public/property.te
+++ b/microdroid/system/public/property.te
@@ -50,6 +50,7 @@
type usb_control_prop, property_type;
type vendor_default_prop, property_type;
type powerctl_prop, property_type;
+type servicemanager_prop, property_type;
# public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
diff --git a/prebuilts/api/202504/202504_general_sepolicy.conf b/prebuilts/api/202504/202504_general_sepolicy.conf
new file mode 100644
index 0000000..8e63174
--- /dev/null
+++ b/prebuilts/api/202504/202504_general_sepolicy.conf
@@ -0,0 +1,89578 @@
+#line 1 "system/sepolicy/flagging/flagging_macros"
+####################################
+# is_flag_enabled(flag, rules)
+# SELinux rules which apply only if given feature is turned on
+
+
+####################################
+# is_flag_disabled(flag, rules)
+# SELinux rules which apply only if given feature is turned off
+
+
+####################################
+# starting_at_board_api(api_level, rules_if_api_level)
+#
+# This macro conditionally exposes SELinux rules ensuring they are available
+# only when the board API level is at or above the specified 'api_level'.
+
+
+####################################
+# until_board_api(api_level, rules_if_lower_api_level)
+#
+# This macro conditionally exposes SELinux rules ensuring they are available
+# only when the board API level is below the specified 'api_level'.
+
+#line 1 "system/sepolicy/private/security_classes"
+# FLASK
+
+#
+# Define the security object classes
+#
+
+# Classes marked as userspace are classes
+# for userspace object managers
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class anon_inode
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related classes
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# extended netlink sockets
+class netlink_route_socket
+class netlink_tcpdiag_socket
+class netlink_nflog_socket
+class netlink_xfrm_socket
+class netlink_selinux_socket
+class netlink_audit_socket
+class netlink_dnrt_socket
+
+# IPSec association
+class association
+
+# Updated Netlink class for KOBJECT_UEVENT family.
+class netlink_kobject_uevent_socket
+
+class appletalk_socket
+
+class packet
+
+# Kernel access key retention
+class key
+
+class dccp_socket
+
+class memprotect
+
+# network peer labels
+class peer
+
+# Capabilities >= 32
+class capability2
+
+# kernel services that need to override task security, e.g. cachefiles
+class kernel_service
+
+class tun_socket
+
+class binder
+
+# Updated netlink classes for more recent netlink protocols.
+class netlink_iscsi_socket
+class netlink_fib_lookup_socket
+class netlink_connector_socket
+class netlink_netfilter_socket
+class netlink_generic_socket
+class netlink_scsitransport_socket
+class netlink_rdma_socket
+class netlink_crypto_socket
+
+# Infiniband
+class infiniband_pkey
+class infiniband_endport
+
+# Capability checks when on a non-init user namespace
+class cap_userns
+class cap2_userns
+
+# New socket classes introduced by extended_socket_class policy capability.
+# These two were previously mapped to rawip_socket.
+class sctp_socket
+class icmp_socket
+# These were previously mapped to socket.
+class ax25_socket
+class ipx_socket
+class netrom_socket
+class atmpvc_socket
+class x25_socket
+class rose_socket
+class decnet_socket
+class atmsvc_socket
+class rds_socket
+class irda_socket
+class pppox_socket
+class llc_socket
+class can_socket
+class tipc_socket
+class bluetooth_socket
+class iucv_socket
+class rxrpc_socket
+class isdn_socket
+class phonet_socket
+class ieee802154_socket
+class caif_socket
+class alg_socket
+class nfc_socket
+class vsock_socket
+class kcm_socket
+class qipcrtr_socket
+class smc_socket
+class xdp_socket
+class mctp_socket
+
+class process2
+
+class bpf
+
+class perf_event
+
+class io_uring
+
+# Introduced in https://github.com/torvalds/linux/commit/59438b46471ae6cdfb761afc8c9beaf1e428a331
+class lockdown
+
+class user_namespace
+
+# Property service
+class property_service # userspace
+
+# Service manager
+class service_manager # userspace
+
+# hardware service manager # userspace
+class hwservice_manager
+
+# Legacy Keystore key permissions
+class keystore_key # userspace
+
+# Keystore 2.0 permissions
+class keystore2 # userspace
+
+# Keystore 2.0 key permissions
+class keystore2_key # userspace
+
+# Diced permissions
+class diced # userspace
+
+class drmservice # userspace
+# FLASK
+
+# Permissions for VMs to access SMC services
+class tee_service # userspace
+#line 1 "system/sepolicy/private/initial_sids"
+# FLASK
+
+#
+# Define initial security identifiers
+#
+
+sid kernel
+sid security
+sid unlabeled
+sid fs
+sid file
+sid file_labels
+sid init
+sid any_socket
+sid port
+sid netif
+sid netmsg
+sid node
+sid igmp_packet
+sid icmp_socket
+sid tcp_socket
+sid sysctl_modprobe
+sid sysctl
+sid sysctl_fs
+sid sysctl_kernel
+sid sysctl_net
+sid sysctl_net_unix
+sid sysctl_vm
+sid sysctl_dev
+sid kmod
+sid policy
+sid scmp_packet
+sid devnull
+
+# FLASK
+#line 1 "system/sepolicy/private/access_vectors"
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+ ioctl
+ read
+ write
+ create
+ getattr
+ setattr
+ lock
+ relabelfrom
+ relabelto
+ append
+ map
+ unlink
+ link
+ rename
+ execute
+ quotaon
+ mounton
+ audit_access
+ open
+ execmod
+ watch
+ watch_mount
+ watch_sb
+ watch_with_perm
+ watch_reads
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+ ioctl
+ read
+ write
+ create
+ getattr
+ setattr
+ lock
+ relabelfrom
+ relabelto
+ append
+ map
+# socket-specific
+ bind
+ connect
+ listen
+ accept
+ getopt
+ setopt
+ shutdown
+ recvfrom
+ sendto
+ name_bind
+}
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+ create
+ destroy
+ getattr
+ setattr
+ read
+ write
+ associate
+ unix_read
+ unix_write
+}
+
+#
+# Define a common for capability access vectors.
+#
+common cap
+{
+ # The capabilities are defined in include/linux/capability.h
+ # Capabilities >= 32 are defined in the cap2 common.
+ # Care should be taken to ensure that these are consistent with
+ # those definitions. (Order matters)
+
+ chown
+ dac_override
+ dac_read_search
+ fowner
+ fsetid
+ kill
+ setgid
+ setuid
+ setpcap
+ linux_immutable
+ net_bind_service
+ net_broadcast
+ net_admin
+ net_raw
+ ipc_lock
+ ipc_owner
+ sys_module
+ sys_rawio
+ sys_chroot
+ sys_ptrace
+ sys_pacct
+ sys_admin
+ sys_boot
+ sys_nice
+ sys_resource
+ sys_time
+ sys_tty_config
+ mknod
+ lease
+ audit_write
+ audit_control
+ setfcap
+}
+
+common cap2
+{
+ mac_override # unused by SELinux
+ mac_admin
+ syslog
+ wake_alarm
+ block_suspend
+ audit_read
+ perfmon
+ checkpoint_restore
+ bpf
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+ mount
+ remount
+ unmount
+ getattr
+ relabelfrom
+ relabelto
+ associate
+ quotamod
+ quotaget
+ watch
+}
+
+class dir
+inherits file
+{
+ add_name
+ remove_name
+ reparent
+ search
+ rmdir
+}
+
+class file
+inherits file
+{
+ execute_no_trans
+ entrypoint
+}
+
+class anon_inode
+inherits file
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+{
+ execute_no_trans
+ entrypoint
+}
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+ use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+}
+
+class udp_socket
+inherits socket
+{
+ node_bind
+}
+
+class rawip_socket
+inherits socket
+{
+ node_bind
+}
+
+class node
+{
+ recvfrom
+ sendto
+}
+
+class netif
+{
+ ingress
+ egress
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+ connectto
+}
+
+class unix_dgram_socket
+inherits socket
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+ fork
+ transition
+ sigchld # commonly granted from child to parent
+ sigkill # cannot be caught or ignored
+ sigstop # cannot be caught or ignored
+ signull # for kill(pid, 0)
+ signal # all other signals
+ ptrace
+ getsched
+ setsched
+ getsession
+ getpgid
+ setpgid
+ getcap
+ setcap
+ share
+ getattr
+ setexec
+ setfscreate
+ noatsecure
+ siginh
+ setrlimit
+ rlimitinh
+ dyntransition
+ setcurrent
+ execmem
+ execstack
+ execheap
+ setkeycreate
+ setsockcreate
+ getrlimit
+}
+
+class process2
+{
+ nnp_transition
+ nosuid_transition
+}
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+ enqueue
+}
+
+class msg
+{
+ send
+ receive
+}
+
+class shm
+inherits ipc
+{
+ lock
+}
+
+
+#
+# Define the access vector interpretation for the security server.
+#
+
+class security
+{
+ compute_av
+ compute_create
+ compute_member
+ check_context
+ load_policy
+ compute_relabel
+ compute_user
+ setenforce # was avc_toggle in system class
+ setbool
+ setsecparam
+ setcheckreqprot
+ read_policy
+ validate_trans
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+ ipc_info
+ syslog_read
+ syslog_mod
+ syslog_console
+ module_request
+ module_load
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+inherits cap
+
+class capability2
+inherits cap2
+
+#
+# Extended Netlink classes
+#
+class netlink_route_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+ nlmsg_readpriv
+ nlmsg_getneigh
+}
+
+class netlink_tcpdiag_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+}
+
+class netlink_nflog_socket
+inherits socket
+
+class netlink_xfrm_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+}
+
+class netlink_selinux_socket
+inherits socket
+
+class netlink_audit_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+ nlmsg_relay
+ nlmsg_readpriv
+ nlmsg_tty_audit
+}
+
+class netlink_dnrt_socket
+inherits socket
+
+# Define the access vector interpretation for controlling
+# access to IPSec network data by association
+#
+class association
+{
+ sendto
+ recvfrom
+ setcontext
+ polmatch
+}
+
+# Updated Netlink class for KOBJECT_UEVENT family.
+class netlink_kobject_uevent_socket
+inherits socket
+
+class appletalk_socket
+inherits socket
+
+class packet
+{
+ send
+ recv
+ relabelto
+ forward_in
+ forward_out
+}
+
+class key
+{
+ view
+ read
+ write
+ search
+ link
+ setattr
+ create
+}
+
+class dccp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+}
+
+class memprotect
+{
+ mmap_zero
+}
+
+# network peer labels
+class peer
+{
+ recv
+}
+
+class kernel_service
+{
+ use_as_override
+ create_files_as
+}
+
+class tun_socket
+inherits socket
+{
+ attach_queue
+}
+
+class binder
+{
+ impersonate
+ call
+ set_context_mgr
+ transfer
+}
+
+class netlink_iscsi_socket
+inherits socket
+
+class netlink_fib_lookup_socket
+inherits socket
+
+class netlink_connector_socket
+inherits socket
+
+class netlink_netfilter_socket
+inherits socket
+
+class netlink_generic_socket
+inherits socket
+
+class netlink_scsitransport_socket
+inherits socket
+
+class netlink_rdma_socket
+inherits socket
+
+class netlink_crypto_socket
+inherits socket
+
+class infiniband_pkey
+{
+ access
+}
+
+class infiniband_endport
+{
+ manage_subnet
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+# in user namespaces
+#
+
+class cap_userns
+inherits cap
+
+class cap2_userns
+inherits cap2
+
+
+#
+# Define the access vector interpretation for the new socket classes
+# enabled by the extended_socket_class policy capability.
+#
+
+#
+# The next two classes were previously mapped to rawip_socket and therefore
+# have the same definition as rawip_socket (until further permissions
+# are defined).
+#
+class sctp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+ association
+}
+
+class icmp_socket
+inherits socket
+{
+ node_bind
+}
+
+#
+# The remaining network socket classes were previously
+# mapped to the socket class and therefore have the
+# same definition as socket.
+#
+
+class ax25_socket
+inherits socket
+
+class ipx_socket
+inherits socket
+
+class netrom_socket
+inherits socket
+
+class atmpvc_socket
+inherits socket
+
+class x25_socket
+inherits socket
+
+class rose_socket
+inherits socket
+
+class decnet_socket
+inherits socket
+
+class atmsvc_socket
+inherits socket
+
+class rds_socket
+inherits socket
+
+class irda_socket
+inherits socket
+
+class pppox_socket
+inherits socket
+
+class llc_socket
+inherits socket
+
+class can_socket
+inherits socket
+
+class tipc_socket
+inherits socket
+
+class bluetooth_socket
+inherits socket
+
+class iucv_socket
+inherits socket
+
+class rxrpc_socket
+inherits socket
+
+class isdn_socket
+inherits socket
+
+class phonet_socket
+inherits socket
+
+class ieee802154_socket
+inherits socket
+
+class caif_socket
+inherits socket
+
+class alg_socket
+inherits socket
+
+class nfc_socket
+inherits socket
+
+class vsock_socket
+inherits socket
+
+class kcm_socket
+inherits socket
+
+class qipcrtr_socket
+inherits socket
+
+class smc_socket
+inherits socket
+
+class xdp_socket
+inherits socket
+
+class mctp_socket
+inherits socket
+
+class bpf
+{
+ map_create
+ map_read
+ map_write
+ prog_load
+ prog_run
+}
+
+class property_service
+{
+ set
+}
+
+class service_manager
+{
+ add
+ find
+ list
+}
+
+class hwservice_manager
+{
+ add
+ find
+ list
+}
+
+class keystore_key # No longer used
+{
+ get_state
+ get
+ insert
+ delete
+ exist
+ list
+ reset
+ password
+ lock
+ unlock
+ is_empty
+ sign
+ verify
+ grant
+ duplicate
+ clear_uid
+ add_auth
+ user_changed
+ gen_unique_id
+}
+
+class keystore2
+{
+ add_auth
+ change_password
+ change_user
+ clear_ns
+ clear_uid
+ delete_all_keys
+ early_boot_ended
+ get_attestation_key
+ get_auth_token
+ get_last_auth_time
+ get_state # No longer used
+ list
+ lock
+ pull_metrics
+ report_off_body # No longer used
+ reset
+ unlock
+}
+
+class keystore2_key
+{
+ convert_storage_key_to_ephemeral
+ delete
+ gen_unique_id
+ get_info
+ grant
+ manage_blob
+ rebind
+ req_forced_op
+ update
+ use
+ use_dev_id
+}
+
+class diced
+{
+ demote
+ demote_self
+ derive
+ get_attestation_chain
+ use_seal
+ use_sign
+}
+
+class drmservice {
+ consumeRights
+ setPlaybackStatus
+ openDecryptSession
+ closeDecryptSession
+ initializeDecryptUnit
+ decrypt
+ finalizeDecryptUnit
+ pread
+}
+
+class perf_event
+{
+ open
+ cpu
+ kernel
+ tracepoint
+ read
+ write
+}
+
+class lockdown
+{
+ integrity
+ confidentiality
+}
+
+class io_uring
+{
+ override_creds
+ sqpoll
+ cmd
+}
+
+class user_namespace
+{
+ create
+}
+
+class tee_service
+{
+ use
+}
+#line 1 "system/sepolicy/public/global_macros"
+#####################################
+# Common groupings of object classes.
+#
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#####################################
+# Common groupings of permissions.
+#
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#####################################
+# Common socket permission sets.
+
+
+
+
+
+
+#line 1 "system/sepolicy/public/neverallow_macros"
+#
+# Common neverallow permissions
+
+
+
+
+
+#####################################
+# neverallow_establish_socket_comms(src, dst)
+# neverallow src domain establishing socket connections to dst domain.
+#
+#line 15
+
+#line 1 "system/sepolicy/private/mls_macros"
+########################################
+#
+# gen_cats(N)
+#
+# declares categores c0 to c(N-1)
+#
+#line 10
+
+
+
+
+########################################
+#
+# gen_sens(N)
+#
+# declares sensitivites s0 to s(N-1) with dominance
+# in increasing numeric order with s0 lowest, s(N-1) highest
+#
+#line 24
+
+
+
+
+#line 34
+
+
+########################################
+#
+# gen_levels(N,M)
+#
+# levels from s0 to (N-1) with categories c0 to (M-1)
+#
+#line 45
+
+
+
+
+########################################
+#
+# Basic level names for system low and high
+#
+
+
+#line 1 "system/sepolicy/private/mls_decl"
+#########################################
+# MLS declarations
+#
+
+# Generate the desired number of sensitivities and categories.
+
+#line 6
+# Each sensitivity has a name and zero or more aliases.
+#line 6
+sensitivity s0;
+#line 6
+
+#line 6
+
+#line 6
+# Define the ordering of the sensitivity levels (least to greatest)
+#line 6
+dominance { s0 }
+#line 6
+
+category c0;
+#line 7
+category c1;
+#line 7
+category c2;
+#line 7
+category c3;
+#line 7
+category c4;
+#line 7
+category c5;
+#line 7
+category c6;
+#line 7
+category c7;
+#line 7
+category c8;
+#line 7
+category c9;
+#line 7
+category c10;
+#line 7
+category c11;
+#line 7
+category c12;
+#line 7
+category c13;
+#line 7
+category c14;
+#line 7
+category c15;
+#line 7
+category c16;
+#line 7
+category c17;
+#line 7
+category c18;
+#line 7
+category c19;
+#line 7
+category c20;
+#line 7
+category c21;
+#line 7
+category c22;
+#line 7
+category c23;
+#line 7
+category c24;
+#line 7
+category c25;
+#line 7
+category c26;
+#line 7
+category c27;
+#line 7
+category c28;
+#line 7
+category c29;
+#line 7
+category c30;
+#line 7
+category c31;
+#line 7
+category c32;
+#line 7
+category c33;
+#line 7
+category c34;
+#line 7
+category c35;
+#line 7
+category c36;
+#line 7
+category c37;
+#line 7
+category c38;
+#line 7
+category c39;
+#line 7
+category c40;
+#line 7
+category c41;
+#line 7
+category c42;
+#line 7
+category c43;
+#line 7
+category c44;
+#line 7
+category c45;
+#line 7
+category c46;
+#line 7
+category c47;
+#line 7
+category c48;
+#line 7
+category c49;
+#line 7
+category c50;
+#line 7
+category c51;
+#line 7
+category c52;
+#line 7
+category c53;
+#line 7
+category c54;
+#line 7
+category c55;
+#line 7
+category c56;
+#line 7
+category c57;
+#line 7
+category c58;
+#line 7
+category c59;
+#line 7
+category c60;
+#line 7
+category c61;
+#line 7
+category c62;
+#line 7
+category c63;
+#line 7
+category c64;
+#line 7
+category c65;
+#line 7
+category c66;
+#line 7
+category c67;
+#line 7
+category c68;
+#line 7
+category c69;
+#line 7
+category c70;
+#line 7
+category c71;
+#line 7
+category c72;
+#line 7
+category c73;
+#line 7
+category c74;
+#line 7
+category c75;
+#line 7
+category c76;
+#line 7
+category c77;
+#line 7
+category c78;
+#line 7
+category c79;
+#line 7
+category c80;
+#line 7
+category c81;
+#line 7
+category c82;
+#line 7
+category c83;
+#line 7
+category c84;
+#line 7
+category c85;
+#line 7
+category c86;
+#line 7
+category c87;
+#line 7
+category c88;
+#line 7
+category c89;
+#line 7
+category c90;
+#line 7
+category c91;
+#line 7
+category c92;
+#line 7
+category c93;
+#line 7
+category c94;
+#line 7
+category c95;
+#line 7
+category c96;
+#line 7
+category c97;
+#line 7
+category c98;
+#line 7
+category c99;
+#line 7
+category c100;
+#line 7
+category c101;
+#line 7
+category c102;
+#line 7
+category c103;
+#line 7
+category c104;
+#line 7
+category c105;
+#line 7
+category c106;
+#line 7
+category c107;
+#line 7
+category c108;
+#line 7
+category c109;
+#line 7
+category c110;
+#line 7
+category c111;
+#line 7
+category c112;
+#line 7
+category c113;
+#line 7
+category c114;
+#line 7
+category c115;
+#line 7
+category c116;
+#line 7
+category c117;
+#line 7
+category c118;
+#line 7
+category c119;
+#line 7
+category c120;
+#line 7
+category c121;
+#line 7
+category c122;
+#line 7
+category c123;
+#line 7
+category c124;
+#line 7
+category c125;
+#line 7
+category c126;
+#line 7
+category c127;
+#line 7
+category c128;
+#line 7
+category c129;
+#line 7
+category c130;
+#line 7
+category c131;
+#line 7
+category c132;
+#line 7
+category c133;
+#line 7
+category c134;
+#line 7
+category c135;
+#line 7
+category c136;
+#line 7
+category c137;
+#line 7
+category c138;
+#line 7
+category c139;
+#line 7
+category c140;
+#line 7
+category c141;
+#line 7
+category c142;
+#line 7
+category c143;
+#line 7
+category c144;
+#line 7
+category c145;
+#line 7
+category c146;
+#line 7
+category c147;
+#line 7
+category c148;
+#line 7
+category c149;
+#line 7
+category c150;
+#line 7
+category c151;
+#line 7
+category c152;
+#line 7
+category c153;
+#line 7
+category c154;
+#line 7
+category c155;
+#line 7
+category c156;
+#line 7
+category c157;
+#line 7
+category c158;
+#line 7
+category c159;
+#line 7
+category c160;
+#line 7
+category c161;
+#line 7
+category c162;
+#line 7
+category c163;
+#line 7
+category c164;
+#line 7
+category c165;
+#line 7
+category c166;
+#line 7
+category c167;
+#line 7
+category c168;
+#line 7
+category c169;
+#line 7
+category c170;
+#line 7
+category c171;
+#line 7
+category c172;
+#line 7
+category c173;
+#line 7
+category c174;
+#line 7
+category c175;
+#line 7
+category c176;
+#line 7
+category c177;
+#line 7
+category c178;
+#line 7
+category c179;
+#line 7
+category c180;
+#line 7
+category c181;
+#line 7
+category c182;
+#line 7
+category c183;
+#line 7
+category c184;
+#line 7
+category c185;
+#line 7
+category c186;
+#line 7
+category c187;
+#line 7
+category c188;
+#line 7
+category c189;
+#line 7
+category c190;
+#line 7
+category c191;
+#line 7
+category c192;
+#line 7
+category c193;
+#line 7
+category c194;
+#line 7
+category c195;
+#line 7
+category c196;
+#line 7
+category c197;
+#line 7
+category c198;
+#line 7
+category c199;
+#line 7
+category c200;
+#line 7
+category c201;
+#line 7
+category c202;
+#line 7
+category c203;
+#line 7
+category c204;
+#line 7
+category c205;
+#line 7
+category c206;
+#line 7
+category c207;
+#line 7
+category c208;
+#line 7
+category c209;
+#line 7
+category c210;
+#line 7
+category c211;
+#line 7
+category c212;
+#line 7
+category c213;
+#line 7
+category c214;
+#line 7
+category c215;
+#line 7
+category c216;
+#line 7
+category c217;
+#line 7
+category c218;
+#line 7
+category c219;
+#line 7
+category c220;
+#line 7
+category c221;
+#line 7
+category c222;
+#line 7
+category c223;
+#line 7
+category c224;
+#line 7
+category c225;
+#line 7
+category c226;
+#line 7
+category c227;
+#line 7
+category c228;
+#line 7
+category c229;
+#line 7
+category c230;
+#line 7
+category c231;
+#line 7
+category c232;
+#line 7
+category c233;
+#line 7
+category c234;
+#line 7
+category c235;
+#line 7
+category c236;
+#line 7
+category c237;
+#line 7
+category c238;
+#line 7
+category c239;
+#line 7
+category c240;
+#line 7
+category c241;
+#line 7
+category c242;
+#line 7
+category c243;
+#line 7
+category c244;
+#line 7
+category c245;
+#line 7
+category c246;
+#line 7
+category c247;
+#line 7
+category c248;
+#line 7
+category c249;
+#line 7
+category c250;
+#line 7
+category c251;
+#line 7
+category c252;
+#line 7
+category c253;
+#line 7
+category c254;
+#line 7
+category c255;
+#line 7
+category c256;
+#line 7
+category c257;
+#line 7
+category c258;
+#line 7
+category c259;
+#line 7
+category c260;
+#line 7
+category c261;
+#line 7
+category c262;
+#line 7
+category c263;
+#line 7
+category c264;
+#line 7
+category c265;
+#line 7
+category c266;
+#line 7
+category c267;
+#line 7
+category c268;
+#line 7
+category c269;
+#line 7
+category c270;
+#line 7
+category c271;
+#line 7
+category c272;
+#line 7
+category c273;
+#line 7
+category c274;
+#line 7
+category c275;
+#line 7
+category c276;
+#line 7
+category c277;
+#line 7
+category c278;
+#line 7
+category c279;
+#line 7
+category c280;
+#line 7
+category c281;
+#line 7
+category c282;
+#line 7
+category c283;
+#line 7
+category c284;
+#line 7
+category c285;
+#line 7
+category c286;
+#line 7
+category c287;
+#line 7
+category c288;
+#line 7
+category c289;
+#line 7
+category c290;
+#line 7
+category c291;
+#line 7
+category c292;
+#line 7
+category c293;
+#line 7
+category c294;
+#line 7
+category c295;
+#line 7
+category c296;
+#line 7
+category c297;
+#line 7
+category c298;
+#line 7
+category c299;
+#line 7
+category c300;
+#line 7
+category c301;
+#line 7
+category c302;
+#line 7
+category c303;
+#line 7
+category c304;
+#line 7
+category c305;
+#line 7
+category c306;
+#line 7
+category c307;
+#line 7
+category c308;
+#line 7
+category c309;
+#line 7
+category c310;
+#line 7
+category c311;
+#line 7
+category c312;
+#line 7
+category c313;
+#line 7
+category c314;
+#line 7
+category c315;
+#line 7
+category c316;
+#line 7
+category c317;
+#line 7
+category c318;
+#line 7
+category c319;
+#line 7
+category c320;
+#line 7
+category c321;
+#line 7
+category c322;
+#line 7
+category c323;
+#line 7
+category c324;
+#line 7
+category c325;
+#line 7
+category c326;
+#line 7
+category c327;
+#line 7
+category c328;
+#line 7
+category c329;
+#line 7
+category c330;
+#line 7
+category c331;
+#line 7
+category c332;
+#line 7
+category c333;
+#line 7
+category c334;
+#line 7
+category c335;
+#line 7
+category c336;
+#line 7
+category c337;
+#line 7
+category c338;
+#line 7
+category c339;
+#line 7
+category c340;
+#line 7
+category c341;
+#line 7
+category c342;
+#line 7
+category c343;
+#line 7
+category c344;
+#line 7
+category c345;
+#line 7
+category c346;
+#line 7
+category c347;
+#line 7
+category c348;
+#line 7
+category c349;
+#line 7
+category c350;
+#line 7
+category c351;
+#line 7
+category c352;
+#line 7
+category c353;
+#line 7
+category c354;
+#line 7
+category c355;
+#line 7
+category c356;
+#line 7
+category c357;
+#line 7
+category c358;
+#line 7
+category c359;
+#line 7
+category c360;
+#line 7
+category c361;
+#line 7
+category c362;
+#line 7
+category c363;
+#line 7
+category c364;
+#line 7
+category c365;
+#line 7
+category c366;
+#line 7
+category c367;
+#line 7
+category c368;
+#line 7
+category c369;
+#line 7
+category c370;
+#line 7
+category c371;
+#line 7
+category c372;
+#line 7
+category c373;
+#line 7
+category c374;
+#line 7
+category c375;
+#line 7
+category c376;
+#line 7
+category c377;
+#line 7
+category c378;
+#line 7
+category c379;
+#line 7
+category c380;
+#line 7
+category c381;
+#line 7
+category c382;
+#line 7
+category c383;
+#line 7
+category c384;
+#line 7
+category c385;
+#line 7
+category c386;
+#line 7
+category c387;
+#line 7
+category c388;
+#line 7
+category c389;
+#line 7
+category c390;
+#line 7
+category c391;
+#line 7
+category c392;
+#line 7
+category c393;
+#line 7
+category c394;
+#line 7
+category c395;
+#line 7
+category c396;
+#line 7
+category c397;
+#line 7
+category c398;
+#line 7
+category c399;
+#line 7
+category c400;
+#line 7
+category c401;
+#line 7
+category c402;
+#line 7
+category c403;
+#line 7
+category c404;
+#line 7
+category c405;
+#line 7
+category c406;
+#line 7
+category c407;
+#line 7
+category c408;
+#line 7
+category c409;
+#line 7
+category c410;
+#line 7
+category c411;
+#line 7
+category c412;
+#line 7
+category c413;
+#line 7
+category c414;
+#line 7
+category c415;
+#line 7
+category c416;
+#line 7
+category c417;
+#line 7
+category c418;
+#line 7
+category c419;
+#line 7
+category c420;
+#line 7
+category c421;
+#line 7
+category c422;
+#line 7
+category c423;
+#line 7
+category c424;
+#line 7
+category c425;
+#line 7
+category c426;
+#line 7
+category c427;
+#line 7
+category c428;
+#line 7
+category c429;
+#line 7
+category c430;
+#line 7
+category c431;
+#line 7
+category c432;
+#line 7
+category c433;
+#line 7
+category c434;
+#line 7
+category c435;
+#line 7
+category c436;
+#line 7
+category c437;
+#line 7
+category c438;
+#line 7
+category c439;
+#line 7
+category c440;
+#line 7
+category c441;
+#line 7
+category c442;
+#line 7
+category c443;
+#line 7
+category c444;
+#line 7
+category c445;
+#line 7
+category c446;
+#line 7
+category c447;
+#line 7
+category c448;
+#line 7
+category c449;
+#line 7
+category c450;
+#line 7
+category c451;
+#line 7
+category c452;
+#line 7
+category c453;
+#line 7
+category c454;
+#line 7
+category c455;
+#line 7
+category c456;
+#line 7
+category c457;
+#line 7
+category c458;
+#line 7
+category c459;
+#line 7
+category c460;
+#line 7
+category c461;
+#line 7
+category c462;
+#line 7
+category c463;
+#line 7
+category c464;
+#line 7
+category c465;
+#line 7
+category c466;
+#line 7
+category c467;
+#line 7
+category c468;
+#line 7
+category c469;
+#line 7
+category c470;
+#line 7
+category c471;
+#line 7
+category c472;
+#line 7
+category c473;
+#line 7
+category c474;
+#line 7
+category c475;
+#line 7
+category c476;
+#line 7
+category c477;
+#line 7
+category c478;
+#line 7
+category c479;
+#line 7
+category c480;
+#line 7
+category c481;
+#line 7
+category c482;
+#line 7
+category c483;
+#line 7
+category c484;
+#line 7
+category c485;
+#line 7
+category c486;
+#line 7
+category c487;
+#line 7
+category c488;
+#line 7
+category c489;
+#line 7
+category c490;
+#line 7
+category c491;
+#line 7
+category c492;
+#line 7
+category c493;
+#line 7
+category c494;
+#line 7
+category c495;
+#line 7
+category c496;
+#line 7
+category c497;
+#line 7
+category c498;
+#line 7
+category c499;
+#line 7
+category c500;
+#line 7
+category c501;
+#line 7
+category c502;
+#line 7
+category c503;
+#line 7
+category c504;
+#line 7
+category c505;
+#line 7
+category c506;
+#line 7
+category c507;
+#line 7
+category c508;
+#line 7
+category c509;
+#line 7
+category c510;
+#line 7
+category c511;
+#line 7
+category c512;
+#line 7
+category c513;
+#line 7
+category c514;
+#line 7
+category c515;
+#line 7
+category c516;
+#line 7
+category c517;
+#line 7
+category c518;
+#line 7
+category c519;
+#line 7
+category c520;
+#line 7
+category c521;
+#line 7
+category c522;
+#line 7
+category c523;
+#line 7
+category c524;
+#line 7
+category c525;
+#line 7
+category c526;
+#line 7
+category c527;
+#line 7
+category c528;
+#line 7
+category c529;
+#line 7
+category c530;
+#line 7
+category c531;
+#line 7
+category c532;
+#line 7
+category c533;
+#line 7
+category c534;
+#line 7
+category c535;
+#line 7
+category c536;
+#line 7
+category c537;
+#line 7
+category c538;
+#line 7
+category c539;
+#line 7
+category c540;
+#line 7
+category c541;
+#line 7
+category c542;
+#line 7
+category c543;
+#line 7
+category c544;
+#line 7
+category c545;
+#line 7
+category c546;
+#line 7
+category c547;
+#line 7
+category c548;
+#line 7
+category c549;
+#line 7
+category c550;
+#line 7
+category c551;
+#line 7
+category c552;
+#line 7
+category c553;
+#line 7
+category c554;
+#line 7
+category c555;
+#line 7
+category c556;
+#line 7
+category c557;
+#line 7
+category c558;
+#line 7
+category c559;
+#line 7
+category c560;
+#line 7
+category c561;
+#line 7
+category c562;
+#line 7
+category c563;
+#line 7
+category c564;
+#line 7
+category c565;
+#line 7
+category c566;
+#line 7
+category c567;
+#line 7
+category c568;
+#line 7
+category c569;
+#line 7
+category c570;
+#line 7
+category c571;
+#line 7
+category c572;
+#line 7
+category c573;
+#line 7
+category c574;
+#line 7
+category c575;
+#line 7
+category c576;
+#line 7
+category c577;
+#line 7
+category c578;
+#line 7
+category c579;
+#line 7
+category c580;
+#line 7
+category c581;
+#line 7
+category c582;
+#line 7
+category c583;
+#line 7
+category c584;
+#line 7
+category c585;
+#line 7
+category c586;
+#line 7
+category c587;
+#line 7
+category c588;
+#line 7
+category c589;
+#line 7
+category c590;
+#line 7
+category c591;
+#line 7
+category c592;
+#line 7
+category c593;
+#line 7
+category c594;
+#line 7
+category c595;
+#line 7
+category c596;
+#line 7
+category c597;
+#line 7
+category c598;
+#line 7
+category c599;
+#line 7
+category c600;
+#line 7
+category c601;
+#line 7
+category c602;
+#line 7
+category c603;
+#line 7
+category c604;
+#line 7
+category c605;
+#line 7
+category c606;
+#line 7
+category c607;
+#line 7
+category c608;
+#line 7
+category c609;
+#line 7
+category c610;
+#line 7
+category c611;
+#line 7
+category c612;
+#line 7
+category c613;
+#line 7
+category c614;
+#line 7
+category c615;
+#line 7
+category c616;
+#line 7
+category c617;
+#line 7
+category c618;
+#line 7
+category c619;
+#line 7
+category c620;
+#line 7
+category c621;
+#line 7
+category c622;
+#line 7
+category c623;
+#line 7
+category c624;
+#line 7
+category c625;
+#line 7
+category c626;
+#line 7
+category c627;
+#line 7
+category c628;
+#line 7
+category c629;
+#line 7
+category c630;
+#line 7
+category c631;
+#line 7
+category c632;
+#line 7
+category c633;
+#line 7
+category c634;
+#line 7
+category c635;
+#line 7
+category c636;
+#line 7
+category c637;
+#line 7
+category c638;
+#line 7
+category c639;
+#line 7
+category c640;
+#line 7
+category c641;
+#line 7
+category c642;
+#line 7
+category c643;
+#line 7
+category c644;
+#line 7
+category c645;
+#line 7
+category c646;
+#line 7
+category c647;
+#line 7
+category c648;
+#line 7
+category c649;
+#line 7
+category c650;
+#line 7
+category c651;
+#line 7
+category c652;
+#line 7
+category c653;
+#line 7
+category c654;
+#line 7
+category c655;
+#line 7
+category c656;
+#line 7
+category c657;
+#line 7
+category c658;
+#line 7
+category c659;
+#line 7
+category c660;
+#line 7
+category c661;
+#line 7
+category c662;
+#line 7
+category c663;
+#line 7
+category c664;
+#line 7
+category c665;
+#line 7
+category c666;
+#line 7
+category c667;
+#line 7
+category c668;
+#line 7
+category c669;
+#line 7
+category c670;
+#line 7
+category c671;
+#line 7
+category c672;
+#line 7
+category c673;
+#line 7
+category c674;
+#line 7
+category c675;
+#line 7
+category c676;
+#line 7
+category c677;
+#line 7
+category c678;
+#line 7
+category c679;
+#line 7
+category c680;
+#line 7
+category c681;
+#line 7
+category c682;
+#line 7
+category c683;
+#line 7
+category c684;
+#line 7
+category c685;
+#line 7
+category c686;
+#line 7
+category c687;
+#line 7
+category c688;
+#line 7
+category c689;
+#line 7
+category c690;
+#line 7
+category c691;
+#line 7
+category c692;
+#line 7
+category c693;
+#line 7
+category c694;
+#line 7
+category c695;
+#line 7
+category c696;
+#line 7
+category c697;
+#line 7
+category c698;
+#line 7
+category c699;
+#line 7
+category c700;
+#line 7
+category c701;
+#line 7
+category c702;
+#line 7
+category c703;
+#line 7
+category c704;
+#line 7
+category c705;
+#line 7
+category c706;
+#line 7
+category c707;
+#line 7
+category c708;
+#line 7
+category c709;
+#line 7
+category c710;
+#line 7
+category c711;
+#line 7
+category c712;
+#line 7
+category c713;
+#line 7
+category c714;
+#line 7
+category c715;
+#line 7
+category c716;
+#line 7
+category c717;
+#line 7
+category c718;
+#line 7
+category c719;
+#line 7
+category c720;
+#line 7
+category c721;
+#line 7
+category c722;
+#line 7
+category c723;
+#line 7
+category c724;
+#line 7
+category c725;
+#line 7
+category c726;
+#line 7
+category c727;
+#line 7
+category c728;
+#line 7
+category c729;
+#line 7
+category c730;
+#line 7
+category c731;
+#line 7
+category c732;
+#line 7
+category c733;
+#line 7
+category c734;
+#line 7
+category c735;
+#line 7
+category c736;
+#line 7
+category c737;
+#line 7
+category c738;
+#line 7
+category c739;
+#line 7
+category c740;
+#line 7
+category c741;
+#line 7
+category c742;
+#line 7
+category c743;
+#line 7
+category c744;
+#line 7
+category c745;
+#line 7
+category c746;
+#line 7
+category c747;
+#line 7
+category c748;
+#line 7
+category c749;
+#line 7
+category c750;
+#line 7
+category c751;
+#line 7
+category c752;
+#line 7
+category c753;
+#line 7
+category c754;
+#line 7
+category c755;
+#line 7
+category c756;
+#line 7
+category c757;
+#line 7
+category c758;
+#line 7
+category c759;
+#line 7
+category c760;
+#line 7
+category c761;
+#line 7
+category c762;
+#line 7
+category c763;
+#line 7
+category c764;
+#line 7
+category c765;
+#line 7
+category c766;
+#line 7
+category c767;
+#line 7
+category c768;
+#line 7
+category c769;
+#line 7
+category c770;
+#line 7
+category c771;
+#line 7
+category c772;
+#line 7
+category c773;
+#line 7
+category c774;
+#line 7
+category c775;
+#line 7
+category c776;
+#line 7
+category c777;
+#line 7
+category c778;
+#line 7
+category c779;
+#line 7
+category c780;
+#line 7
+category c781;
+#line 7
+category c782;
+#line 7
+category c783;
+#line 7
+category c784;
+#line 7
+category c785;
+#line 7
+category c786;
+#line 7
+category c787;
+#line 7
+category c788;
+#line 7
+category c789;
+#line 7
+category c790;
+#line 7
+category c791;
+#line 7
+category c792;
+#line 7
+category c793;
+#line 7
+category c794;
+#line 7
+category c795;
+#line 7
+category c796;
+#line 7
+category c797;
+#line 7
+category c798;
+#line 7
+category c799;
+#line 7
+category c800;
+#line 7
+category c801;
+#line 7
+category c802;
+#line 7
+category c803;
+#line 7
+category c804;
+#line 7
+category c805;
+#line 7
+category c806;
+#line 7
+category c807;
+#line 7
+category c808;
+#line 7
+category c809;
+#line 7
+category c810;
+#line 7
+category c811;
+#line 7
+category c812;
+#line 7
+category c813;
+#line 7
+category c814;
+#line 7
+category c815;
+#line 7
+category c816;
+#line 7
+category c817;
+#line 7
+category c818;
+#line 7
+category c819;
+#line 7
+category c820;
+#line 7
+category c821;
+#line 7
+category c822;
+#line 7
+category c823;
+#line 7
+category c824;
+#line 7
+category c825;
+#line 7
+category c826;
+#line 7
+category c827;
+#line 7
+category c828;
+#line 7
+category c829;
+#line 7
+category c830;
+#line 7
+category c831;
+#line 7
+category c832;
+#line 7
+category c833;
+#line 7
+category c834;
+#line 7
+category c835;
+#line 7
+category c836;
+#line 7
+category c837;
+#line 7
+category c838;
+#line 7
+category c839;
+#line 7
+category c840;
+#line 7
+category c841;
+#line 7
+category c842;
+#line 7
+category c843;
+#line 7
+category c844;
+#line 7
+category c845;
+#line 7
+category c846;
+#line 7
+category c847;
+#line 7
+category c848;
+#line 7
+category c849;
+#line 7
+category c850;
+#line 7
+category c851;
+#line 7
+category c852;
+#line 7
+category c853;
+#line 7
+category c854;
+#line 7
+category c855;
+#line 7
+category c856;
+#line 7
+category c857;
+#line 7
+category c858;
+#line 7
+category c859;
+#line 7
+category c860;
+#line 7
+category c861;
+#line 7
+category c862;
+#line 7
+category c863;
+#line 7
+category c864;
+#line 7
+category c865;
+#line 7
+category c866;
+#line 7
+category c867;
+#line 7
+category c868;
+#line 7
+category c869;
+#line 7
+category c870;
+#line 7
+category c871;
+#line 7
+category c872;
+#line 7
+category c873;
+#line 7
+category c874;
+#line 7
+category c875;
+#line 7
+category c876;
+#line 7
+category c877;
+#line 7
+category c878;
+#line 7
+category c879;
+#line 7
+category c880;
+#line 7
+category c881;
+#line 7
+category c882;
+#line 7
+category c883;
+#line 7
+category c884;
+#line 7
+category c885;
+#line 7
+category c886;
+#line 7
+category c887;
+#line 7
+category c888;
+#line 7
+category c889;
+#line 7
+category c890;
+#line 7
+category c891;
+#line 7
+category c892;
+#line 7
+category c893;
+#line 7
+category c894;
+#line 7
+category c895;
+#line 7
+category c896;
+#line 7
+category c897;
+#line 7
+category c898;
+#line 7
+category c899;
+#line 7
+category c900;
+#line 7
+category c901;
+#line 7
+category c902;
+#line 7
+category c903;
+#line 7
+category c904;
+#line 7
+category c905;
+#line 7
+category c906;
+#line 7
+category c907;
+#line 7
+category c908;
+#line 7
+category c909;
+#line 7
+category c910;
+#line 7
+category c911;
+#line 7
+category c912;
+#line 7
+category c913;
+#line 7
+category c914;
+#line 7
+category c915;
+#line 7
+category c916;
+#line 7
+category c917;
+#line 7
+category c918;
+#line 7
+category c919;
+#line 7
+category c920;
+#line 7
+category c921;
+#line 7
+category c922;
+#line 7
+category c923;
+#line 7
+category c924;
+#line 7
+category c925;
+#line 7
+category c926;
+#line 7
+category c927;
+#line 7
+category c928;
+#line 7
+category c929;
+#line 7
+category c930;
+#line 7
+category c931;
+#line 7
+category c932;
+#line 7
+category c933;
+#line 7
+category c934;
+#line 7
+category c935;
+#line 7
+category c936;
+#line 7
+category c937;
+#line 7
+category c938;
+#line 7
+category c939;
+#line 7
+category c940;
+#line 7
+category c941;
+#line 7
+category c942;
+#line 7
+category c943;
+#line 7
+category c944;
+#line 7
+category c945;
+#line 7
+category c946;
+#line 7
+category c947;
+#line 7
+category c948;
+#line 7
+category c949;
+#line 7
+category c950;
+#line 7
+category c951;
+#line 7
+category c952;
+#line 7
+category c953;
+#line 7
+category c954;
+#line 7
+category c955;
+#line 7
+category c956;
+#line 7
+category c957;
+#line 7
+category c958;
+#line 7
+category c959;
+#line 7
+category c960;
+#line 7
+category c961;
+#line 7
+category c962;
+#line 7
+category c963;
+#line 7
+category c964;
+#line 7
+category c965;
+#line 7
+category c966;
+#line 7
+category c967;
+#line 7
+category c968;
+#line 7
+category c969;
+#line 7
+category c970;
+#line 7
+category c971;
+#line 7
+category c972;
+#line 7
+category c973;
+#line 7
+category c974;
+#line 7
+category c975;
+#line 7
+category c976;
+#line 7
+category c977;
+#line 7
+category c978;
+#line 7
+category c979;
+#line 7
+category c980;
+#line 7
+category c981;
+#line 7
+category c982;
+#line 7
+category c983;
+#line 7
+category c984;
+#line 7
+category c985;
+#line 7
+category c986;
+#line 7
+category c987;
+#line 7
+category c988;
+#line 7
+category c989;
+#line 7
+category c990;
+#line 7
+category c991;
+#line 7
+category c992;
+#line 7
+category c993;
+#line 7
+category c994;
+#line 7
+category c995;
+#line 7
+category c996;
+#line 7
+category c997;
+#line 7
+category c998;
+#line 7
+category c999;
+#line 7
+category c1000;
+#line 7
+category c1001;
+#line 7
+category c1002;
+#line 7
+category c1003;
+#line 7
+category c1004;
+#line 7
+category c1005;
+#line 7
+category c1006;
+#line 7
+category c1007;
+#line 7
+category c1008;
+#line 7
+category c1009;
+#line 7
+category c1010;
+#line 7
+category c1011;
+#line 7
+category c1012;
+#line 7
+category c1013;
+#line 7
+category c1014;
+#line 7
+category c1015;
+#line 7
+category c1016;
+#line 7
+category c1017;
+#line 7
+category c1018;
+#line 7
+category c1019;
+#line 7
+category c1020;
+#line 7
+category c1021;
+#line 7
+category c1022;
+#line 7
+category c1023;
+#line 7
+
+
+# Generate level definitions for each sensitivity and category.
+level s0:c0.c1023;
+#line 10
+
+#line 1 "system/sepolicy/private/mls"
+#################################################
+# MLS policy constraints
+#
+
+#
+# Process constraints
+#
+
+# Process transition: Require equivalence unless the subject is trusted.
+mlsconstrain process { transition dyntransition }
+ ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
+
+# Process read operations: No read up unless trusted.
+mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
+ (l1 dom l2 or t1 == mlstrustedsubject);
+
+# Process write operations: Require equivalence unless trusted.
+mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share }
+ (l1 eq l2 or t1 == mlstrustedsubject);
+
+#
+# Socket constraints
+#
+
+# Create/relabel operations: Subject must be equivalent to object unless
+# the subject is trusted. Sockets inherit the range of their creator.
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } { create relabelfrom relabelto }
+ ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
+
+# Datagram send: Sender must be equivalent to the receiver unless one of them
+# is trusted.
+mlsconstrain unix_dgram_socket { sendto }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
+
+# Stream connect: Client must be equivalent to server unless one of them
+# is trusted.
+mlsconstrain unix_stream_socket { connectto }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
+
+#
+# Directory/file constraints
+#
+
+# Create/relabel operations: Subject must be equivalent to object unless
+# the subject is trusted. Also, files should always be single-level.
+# Do NOT exempt mlstrustedobject types from this constraint.
+mlsconstrain { dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create relabelfrom relabelto }
+ (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject));
+
+#
+# Userfaultfd constraints
+#
+# To enforce that anonymous inodes are self contained in the application's process.
+mlsconstrain anon_inode { ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute open execmod }
+ (l1 eq l2);
+
+#
+# Constraints for app data files only.
+#
+
+# Only constrain open, not read/write, so already open fds can be used.
+# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc.
+# Subject must dominate object unless the subject is trusted.
+mlsconstrain dir { open search getattr setattr rename add_name remove_name reparent rmdir }
+ (t2 != app_data_file_type or l1 dom l2 or t1 == mlstrustedsubject);
+mlsconstrain { file sock_file } { open setattr unlink link rename }
+ ( (t2 != app_data_file_type and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+
+# For symlinks in app data files, require equivalence in order to manipulate or follow (read).
+mlsconstrain { lnk_file } { open setattr unlink link rename read }
+ ( (t2 != app_data_file_type or t2 == privapp_data_file) or l1 eq l2 or t1 == mlstrustedsubject);
+# But for priv_app_data_file, continue to use dominance for symlinks because dynamite relies on this.
+# TODO: Migrate to equivalence when it's no longer needed.
+mlsconstrain { lnk_file } { open setattr unlink link rename read }
+ ( (t2 != privapp_data_file and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+
+#
+# Constraints for file types other than app data files.
+#
+
+# Read operations: Subject must dominate object unless the subject
+# or the object is trusted.
+mlsconstrain dir { read getattr search }
+ (t2 == app_data_file_type or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject
+ or (t1 == mlsvendorcompat and (t2 == system_data_file or t2 == user_profile_root_file) ) );
+
+mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute }
+ (t2 == app_data_file_type or t2 == appdomain_tmpfs or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+# Write operations: Subject must be equivalent to the object unless the
+# subject or the object is trusted.
+mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir }
+ (t2 == app_data_file_type or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename }
+ (t2 == app_data_file_type or t2 == appdomain_tmpfs or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+# Special case for FIFOs.
+# These can be unnamed pipes, in which case they will be labeled with the
+# creating process' label. Thus we also have an exemption when the "object"
+# is a domain type, so that processes can communicate via unnamed pipes
+# passed by binder or local socket IPC.
+mlsconstrain fifo_file { read getattr }
+ (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
+
+mlsconstrain fifo_file { write setattr append unlink link rename }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
+
+#
+# Binder IPC constraints
+#
+# Presently commented out, as apps are expected to call one another.
+# This would only make sense if apps were assigned categories
+# based on allowable communications rather than per-app categories.
+#mlsconstrain binder call
+# (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
+#line 1 "system/sepolicy/private/policy_capabilities"
+# Enable new networking controls.
+policycap network_peer_controls;
+
+# Enable open permission check.
+policycap open_perms;
+
+# Enable separate security classes for
+# all network address families previously
+# mapped to the socket class and for
+# ICMP and SCTP sockets previously mapped
+# to the rawip_socket class.
+policycap extended_socket_class;
+
+# Enable NoNewPrivileges support. Requires libsepol 2.7+
+# and kernel 4.14 (estimated).
+#
+# Checks enabled;
+# process2: nnp_transition, nosuid_transition
+#
+policycap nnp_nosuid_transition;
+#line 1 "system/sepolicy/public/te_macros"
+#####################################
+# domain_trans(olddomain, type, newdomain)
+# Allow a transition from olddomain to newdomain
+# upon executing a file labeled with type.
+# This only allows the transition; it does not
+# cause it to occur automatically - use domain_auto_trans
+# if that is what you want.
+#
+#line 21
+
+
+#####################################
+# domain_auto_trans(olddomain, type, newdomain)
+# Automatically transition from olddomain to newdomain
+# upon executing a file labeled with type.
+#
+#line 33
+
+
+#####################################
+# file_type_trans(domain, dir_type, file_type)
+# Allow domain to create a file labeled file_type in a
+# directory labeled dir_type.
+# This only allows the transition; it does not
+# cause it to occur automatically - use file_type_auto_trans
+# if that is what you want.
+#
+#line 49
+
+
+#####################################
+# file_type_auto_trans(domain, dir_type, file_type)
+# Automatically label new files with file_type when
+# they are created by domain in directories labeled dir_type.
+#
+#line 62
+
+
+#####################################
+# r_dir_file(domain, type)
+# Allow the specified domain to read directories, files
+# and symbolic links of the specified type.
+#line 71
+
+
+#####################################
+# tmpfs_domain(domain)
+# Allow access to a unique type for this domain when creating tmpfs / ashmem files.
+#line 79
+
+
+# pdx macros for IPC. pdx is a high-level name which contains transport-specific
+# rules from underlying transport (e.g. UDS-based implementation).
+
+#####################################
+# pdx_service_attributes(service)
+# Defines type attribute used to identify various service-related types.
+#line 92
+
+
+#####################################
+# pdx_service_socket_types(service, endpoint_dir_t)
+# Define types for endpoint and channel sockets.
+#line 105
+
+
+#####################################
+# pdx_server(server_domain, service)
+#line 124
+
+
+#####################################
+# pdx_connect(client, service)
+#line 134
+
+
+#####################################
+# pdx_use(client, service)
+#line 149
+
+
+#####################################
+# pdx_client(client, service)
+#line 156
+
+
+#####################################
+# init_daemon_domain(domain)
+# Set up a transition from init to the daemon domain
+# upon executing its binary.
+#line 164
+
+
+####################################
+# userfaultfd_use(domain)
+# Allow domain to create/use userfaultfd.
+#line 179
+
+
+####################################
+# virtualizationservice_use(domain)
+# Allow domain to create and communicate with a virtual machine using
+# virtualizationservice and virtualizationmanager.
+#line 208
+
+
+####################################
+# early_virtmgr_use(domain)
+# Allow domain to create and communicate with an early virtual machine using
+# early_virtmgr.
+#line 236
+
+
+#####################################
+# app_domain(domain)
+# Allow a base set of permissions required for all apps.
+#line 258
+
+
+#####################################
+# untrusted_app_domain(domain)
+# Allow a base set of permissions required for all untrusted apps.
+#line 265
+
+
+#####################################
+# isolated_app_domain(domain)
+# Allow a base set of permissions required for all isolated apps.
+#line 272
+
+
+#####################################
+# net_domain(domain)
+# Allow a base set of permissions required for network access.
+#line 279
+
+
+#####################################
+# bluetooth_domain(domain)
+# Allow a base set of permissions required for bluetooth access.
+#line 286
+
+
+#####################################
+# hal_attribute(hal_name)
+# Add an attribute for hal implementations along with necessary
+# restrictions.
+#line 308
+
+
+#####################################
+# hal_server_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to offer a
+# HAL implementation of the specified type over HwBinder.
+#
+# For example, default implementation of Foo HAL:
+# type hal_foo_default, domain;
+# hal_server_domain(hal_foo_default, hal_foo)
+#
+#line 323
+
+
+#####################################
+# hal_client_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to be a
+# client of a HAL of the specified type.
+#
+# For example, make some_domain a client of Foo HAL:
+# hal_client_domain(some_domain, hal_foo)
+#
+#line 347
+
+
+#####################################
+# passthrough_hal_client_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to be a
+# client of a passthrough HAL of the specified type.
+#
+# For example, make some_domain a client of passthrough Foo HAL:
+# passthrough_hal_client_domain(some_domain, hal_foo)
+#
+#line 365
+
+
+#####################################
+# unix_socket_connect(clientdomain, socket, serverdomain)
+# Allow a local socket connection from clientdomain via
+# socket to serverdomain.
+#
+# Note: If you see denial records that distill to the
+# following allow rules:
+# allow clientdomain property_socket:sock_file write;
+# allow clientdomain init:unix_stream_socket connectto;
+# allow clientdomain something_prop:property_service set;
+#
+# This sequence is indicative of attempting to set a property.
+# use set_prop(sourcedomain, targetproperty)
+#
+#line 384
+
+
+#####################################
+# set_prop(sourcedomain, targetproperty)
+# Allows source domain to set the
+# targetproperty.
+#
+#line 395
+
+
+#####################################
+# get_prop(sourcedomain, targetproperty)
+# Allows source domain to read the
+# targetproperty.
+#
+#line 404
+
+
+#####################################
+# unix_socket_send(clientdomain, socket, serverdomain)
+# Allow a local socket send from clientdomain via
+# socket to serverdomain.
+#line 413
+
+
+#####################################
+# binder_use(domain)
+# Allow domain to use Binder IPC.
+#line 429
+
+
+#####################################
+# hwbinder_use(domain)
+# Allow domain to use HwBinder IPC.
+#line 445
+
+
+#####################################
+# vndbinder_use(domain)
+# Allow domain to use Binder IPC.
+#line 459
+
+
+#####################################
+# binder_call(clientdomain, serverdomain)
+# Allow clientdomain to perform binder IPC to serverdomain.
+#line 471
+
+
+#####################################
+# binder_service(domain)
+# Deprecated. Consider granting the exact permissions required by your service.
+#line 478
+
+
+#####################################
+# wakelock_use(domain)
+# Allow domain to manage wake locks
+#line 500
+
+
+#####################################
+# selinux_check_access(domain)
+# Allow domain to check SELinux permissions via selinuxfs.
+#line 510
+
+
+#####################################
+# selinux_check_context(domain)
+# Allow domain to check SELinux contexts via selinuxfs.
+#line 519
+
+
+#####################################
+# create_pty(domain)
+# Allow domain to create and use a pty, isolated from any other domain ptys.
+#line 538
+
+
+#####################################
+# Non system_app application set
+#
+
+
+#####################################
+# Recovery only
+# SELinux rules which apply only to recovery mode
+#
+
+
+#####################################
+# Not recovery
+# SELinux rules which apply only to non-recovery (normal) mode
+#
+
+
+#####################################
+# Full TREBLE only
+# SELinux rules which apply only to full TREBLE devices
+#
+#line 566
+
+
+#####################################
+# Not full TREBLE
+# SELinux rules which apply only to devices which are not full TREBLE devices
+#
+
+
+#####################################
+# enforce_debugfs_restriction
+# SELinux rules which apply to devices that enable debugfs restrictions.
+# The keyword "cts" is used to insert markers to only CTS test the neverallows
+# added by the macro for S-launch devices and newer.
+#line 584
+
+
+#####################################
+# no_debugfs_restriction
+# SELinux rules which apply to devices that do not have debugfs restrictions in non-user builds.
+
+
+#####################################
+# Compatible property only
+# SELinux rules which apply only to devices with compatible property
+#
+#line 600
+
+
+#####################################
+# Not compatible property
+# SELinux rules which apply only to devices without compatible property
+#
+
+
+#####################################
+# Userdebug or eng builds
+# SELinux rules which apply only to userdebug or eng builds
+#
+
+
+#####################################
+# asan builds
+# SELinux rules which apply only to asan builds
+#
+
+
+#####################################
+# native coverage builds
+# SELinux rules which apply only to builds with native coverage
+#
+
+
+#####################################
+# Build-time-only test
+# SELinux rules which are verified during build, but not as part of *TS testing.
+#
+
+
+####################################
+# Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp).
+#
+#line 650
+
+
+#####################################
+# WITH_DEXPREOPT builds
+# SELinux rules which apply only when pre-opting.
+#
+
+
+#####################################
+# write_logd(domain)
+# Ability to write to android log
+# daemon via sockets
+#line 665
+
+
+#####################################
+# read_logd(domain)
+# Ability to run logcat and read from android
+# log daemon via sockets
+#line 674
+
+
+#####################################
+# read_runtime_log_tags(domain)
+# ability to directly map the runtime event log tags
+#line 681
+
+
+#####################################
+# control_logd(domain)
+# Ability to control
+# android log daemon via sockets
+#line 691
+
+
+#####################################
+# use_keystore(domain)
+# Ability to use keystore.
+# Keystore is requires the following permissions
+# to call getpidcon.
+#line 707
+
+
+#####################################
+# use_credstore(domain)
+# Ability to use credstore.
+#line 719
+
+
+###########################################
+# use_drmservice(domain)
+# Ability to use DrmService which requires
+# DrmService to call getpidcon.
+#line 729
+
+
+###########################################
+# add_service(domain, service)
+# Ability for domain to add a service to service_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#line 745
+
+
+###########################################
+# add_hwservice(domain, service)
+# Ability for domain to add a service to hwservice_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#line 756
+
+
+###########################################
+# hal_attribute_hwservice(attribute, service)
+# Ability for domain to get a service to hwservice_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#
+# Used to pair hal_foo_client with hal_foo_hwservice
+#line 775
+
+
+###########################################
+# hal_attribute_service(attribute, service)
+# Ability for domain to get a service to service_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#
+# Used to pair hal_foo_client with hal_foo_service
+#line 803
+
+
+###################################
+# can_profile_heap(domain)
+# Allow processes within the domain to have their heap profiled by central
+# heapprofd.
+#line 833
+
+
+###################################
+# never_profile_heap(domain)
+# Opt out of heap profiling by heapprofd.
+#line 841
+
+
+###################################
+# can_profile_perf(domain)
+# Allow processes within the domain to be profiled, and have their stacks
+# sampled, by traced_perf.
+#line 861
+
+
+###################################
+# never_profile_perf(domain)
+# Opt out of profiling by traced_perf.
+#line 869
+
+
+###################################
+# perfetto_producer(domain)
+# Allow processes within the domain to write data to Perfetto.
+# When applying this macro, you might need to also allow traced to use the
+# producer tmpfs domain, if the producer will be the one creating the shared
+# memory.
+#line 886
+
+
+###########################################
+# dump_hal(hal_type)
+# Ability to dump the hal debug info
+#
+#line 896
+
+
+#####################################
+# treble_sysprop_neverallow(rules)
+# SELinux neverallow rules which enforces the accessibility of each property
+# outside the owner.
+#
+# For devices launching with R or later, exported properties must be explicitly marked as
+# "restricted" or "public", depending on the accessibility outside the owner.
+# For devices launching with Q or eariler, this neverallow rules can be relaxed with defining
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true on BoardConfig.mk.
+# See {partition}_{accessibility}_prop macros below.
+#
+# CTS uses these rules only for devices launching with R or later.
+#
+# TODO(b/131162102): deprecate BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW
+#
+#line 918
+
+
+#####################################
+# enforce_sysprop_owner(rules)
+# SELinux neverallow rules which enforces the owner of each property.
+#
+# For devices launching with S or later, all properties must be explicitly marked as one of:
+# system_property_type, vendor_property_type, or product_property_type.
+# For devices launching with R or eariler, this neverallow rules can be relaxed with defining
+# BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true on BoardConfig.mk.
+# See {partition}_{accessibility}_prop macros below.
+#
+# CTS uses these ules only for devices launching with S or later.
+#
+#line 937
+
+
+###########################################
+# define_prop(name, owner, scope)
+# Define a property with given owner and scope
+#
+#line 945
+
+
+###########################################
+# system_internal_prop(name)
+# Define a /system-owned property used only in /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 958
+
+
+###########################################
+# system_restricted_prop(name)
+# Define a /system-owned property which can't be written outside /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 971
+
+
+###########################################
+# system_public_prop(name)
+# Define a /system-owned property with no restrictions
+#
+
+
+###########################################
+# system_vendor_config_prop(name)
+# Define a /system-owned property which can only be written by vendor_init
+# This is a macro for vendor-specific configuration properties which is meant
+# to be set once from vendor_init.
+#
+#line 989
+
+
+###########################################
+# product_internal_prop(name)
+# Define a /product-owned property used only in /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 1002
+
+
+###########################################
+# product_restricted_prop(name)
+# Define a /product-owned property which can't be written outside /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 1015
+
+
+###########################################
+# product_public_prop(name)
+# Define a /product-owned property with no restrictions
+#
+
+
+###########################################
+# vendor_internal_prop(name)
+# Define a /vendor-owned property used only in /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 1035
+
+
+###########################################
+# vendor_restricted_prop(name)
+# Define a /vendor-owned property which can't be written outside /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+#line 1049
+
+
+###########################################
+# vendor_public_prop(name)
+# Define a /vendor-owned property with no restrictions
+#
+
+
+#####################################
+# read_fstab(domain)
+# Ability to call ReadDefaultFstab() and ReadFstabFromFile().
+#
+#line 1065
+
+
+######################################
+# use_bootstrap_libs(domain)
+# Allow domain to use bootstrap bionic libraries in system/lib[64]/bootstrap
+#line 1073
+
+
+######################################
+# use_apex_info(domain)
+# Allow access to apex information
+#line 1082
+
+
+####################################
+# io_uring_use(domain)
+# Allow domain to create/use io_uring.
+#line 1100
+
+#line 1 "system/sepolicy/public/ioctl_defines"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#line 1 "system/sepolicy/public/ioctl_macros"
+# socket ioctls allowed to unprivileged apps
+#line 12
+
+
+# socket ioctls never allowed to unprivileged apps
+#line 42
+
+
+# commonly used ioctls on unix sockets
+#line 47
+
+
+# commonly used TTY ioctls
+# merge with unpriv_unix_sock_ioctls?
+#line 54
+
+
+# point to point ioctls
+#line 68
+
+
+# unprivileged binder ioctls
+#line 77
+
+#line 1 "system/sepolicy/public/attributes"
+######################################
+# Attribute declarations
+#
+
+# All types used for devices.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# in tools/checkfc.c
+attribute dev_type;
+
+# Attribute for all bpf filesystem subtypes.
+attribute bpffs_type;
+
+# All types used for processes.
+attribute domain;
+
+# All types used for filesystems.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute fs_type;
+
+# All types used for context= mounts.
+attribute contextmount_type;
+
+# All types referencing a FUSE filesystem.
+# When mounting a new FUSE filesystem, the fscontext= option should be used to
+# set a domain-specific type with this attribute. See app_fusefs for an
+# example.
+attribute fusefs_type;
+
+# All types used for files that can exist on a labeled fs.
+# Do not use for pseudo file types.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute file_type;
+
+# All types used for domain entry points.
+attribute exec_type;
+
+# All types used for /data files.
+attribute data_file_type;
+expandattribute data_file_type false;
+# All types in /data, not in /data/vendor
+attribute core_data_file_type;
+expandattribute core_data_file_type false;
+
+# All types used for app private data files in seapp_contexts.
+# Such types should not be applied to any other files.
+attribute app_data_file_type;
+expandattribute app_data_file_type false;
+
+# All types in /system
+attribute system_file_type;
+
+# All types in /system_dlkm
+attribute system_dlkm_file_type;
+
+# All types in /vendor
+attribute vendor_file_type;
+
+# All types used for procfs files.
+attribute proc_type;
+expandattribute proc_type false;
+
+# Types in /proc/net, excluding qtaguid types.
+# TODO(b/9496886) Lock down access to /proc/net.
+# This attribute is used to audit access to proc_net. it is temporary and will
+# be removed.
+attribute proc_net_type;
+expandattribute proc_net_type true;
+
+# All types used for sysfs files.
+attribute sysfs_type;
+
+# All types use for debugfs files.
+attribute debugfs_type;
+
+# All types used for tracefs files.
+attribute tracefs_type;
+
+# Attribute used for all sdcards
+attribute sdcard_type;
+
+# All types used for nodes/hosts.
+attribute node_type;
+
+# All types used for network interfaces.
+attribute netif_type;
+
+# All types used for network ports.
+attribute port_type;
+
+# All types used for property service
+# On change, update CHECK_PC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute property_type;
+
+# All properties defined in core SELinux policy. Should not be
+# used by device specific properties
+attribute core_property_type;
+
+# All properties used to configure log filtering.
+attribute log_property_type;
+
+# All properties that are not specific to device but are added from
+# outside of AOSP. (e.g. OEM-specific properties)
+# These properties are not accessible from device-specific domains
+attribute extended_core_property_type;
+
+# Properties used for representing ownership. All properties should have one
+# of: system_property_type, product_property_type, or vendor_property_type.
+
+# All properties defined by /system.
+attribute system_property_type;
+expandattribute system_property_type false;
+
+# All /system-defined properties used only in /system.
+attribute system_internal_property_type;
+expandattribute system_internal_property_type false;
+
+# All /system-defined properties which can't be written outside /system.
+attribute system_restricted_property_type;
+expandattribute system_restricted_property_type false;
+
+# All /system-defined properties with no restrictions.
+attribute system_public_property_type;
+expandattribute system_public_property_type false;
+
+# All keystore2_key labels.
+attribute keystore2_key_type;
+
+# All properties defined by /product.
+# Currently there are no enforcements between /system and /product, so for now
+# /product attributes are just replaced to /system attributes.
+
+
+
+
+
+# All properties defined by /vendor.
+attribute vendor_property_type;
+expandattribute vendor_property_type false;
+
+# All /vendor-defined properties used only in /vendor.
+attribute vendor_internal_property_type;
+expandattribute vendor_internal_property_type false;
+
+# All /vendor-defined properties which can't be written outside /vendor.
+attribute vendor_restricted_property_type;
+expandattribute vendor_restricted_property_type false;
+
+# All /vendor-defined properties with no restrictions.
+attribute vendor_public_property_type;
+expandattribute vendor_public_property_type false;
+
+# All service_manager types created by system_server
+attribute system_server_service;
+
+# services which should be available to all but isolated apps
+attribute app_api_service;
+
+# services which should be available to all ephemeral apps
+attribute ephemeral_app_api_service;
+
+# services which export only system_api
+attribute system_api_service;
+
+# services which are explicitly disallowed for untrusted apps to access
+attribute protected_service;
+
+# All types used for services managed by servicemanager.
+# On change, update CHECK_SC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute service_manager_type;
+
+# All types used for services managed by hwservicemanager
+attribute hwservice_manager_type;
+
+# All HwBinder services guaranteed to be passthrough. These services always run
+# in the process of their clients, and thus operate with the same access as
+# their clients.
+attribute same_process_hwservice;
+
+# All HwBinder services guaranteed to be offered only by core domain components
+attribute coredomain_hwservice;
+
+# All HwBinder services that untrusted apps can't directly access
+attribute protected_hwservice;
+
+# All types used for services managed by vndservicemanager
+attribute vndservice_manager_type;
+
+# All services declared as part of an HAL
+attribute hal_service_type;
+
+# All domains that can override MLS restrictions.
+# i.e. processes that can read up and write down.
+attribute mlstrustedsubject;
+
+# All types that can override MLS restrictions.
+# i.e. files that can be read by lower and written by higher
+attribute mlstrustedobject;
+
+# All domains used for apps.
+attribute appdomain;
+
+# All third party apps (except isolated_app and ephemeral_app)
+attribute untrusted_app_all;
+
+# All apps with UID between AID_ISOLATED_START (99000) and AID_ISOLATED_END (99999).
+attribute isolated_app_all;
+
+# All service types that would be allowed for isolated_compute_app.
+attribute isolated_compute_allowed_service;
+
+# All device types that would be allowed for isolated_compute_app.
+attribute isolated_compute_allowed_device;
+
+# All domains used for apps with network access.
+attribute netdomain;
+
+# All domains used for apps with bluetooth access.
+attribute bluetoothdomain;
+
+# Specific domains that expose a binder service.
+# Deprecated, consider granting the exact permissions required by your service.
+attribute binderservicedomain;
+
+# All domains which have BPF access.
+attribute bpfdomain;
+expandattribute bpfdomain false;
+
+# update_engine related domains that need to apply an update and run
+# postinstall. This includes the background daemon and the sideload tool from
+# recovery for A/B devices.
+attribute update_engine_common;
+
+# All core domains (as opposed to vendor/device-specific domains)
+attribute coredomain;
+
+# All vendor hwservice.
+attribute vendor_hwservice_type;
+
+# All socket devices owned by core domain components
+attribute coredomain_socket;
+expandattribute coredomain_socket false;
+
+# All vendor domains which violate the requirement of not using sockets for
+# communicating with core components
+# TODO(b/36577153): Remove this once there are no violations
+attribute socket_between_core_and_vendor_violators;
+expandattribute socket_between_core_and_vendor_violators false;
+
+
+#line 253
+# All vsock communication is required to go through AVF so that we can
+#line 253
+# have a consistent permission model for which is allowed to talk to
+#line 253
+# which. This breaks Treble as well as updatability of VMs and
+#line 253
+# other components.
+#line 253
+# TODO(b/347661724): Remove this once there are no violations.
+#line 253
+attribute unconstrained_vsock_violators;
+#line 253
+expandattribute unconstrained_vsock_violators false;
+#line 261
+
+
+# All vendor domains which violate the requirement of not executing
+# system processes
+# TODO(b/36463595)
+attribute vendor_executes_system_violators;
+expandattribute vendor_executes_system_violators false;
+
+# All domains which violate the requirement of not sharing files by path
+# between between vendor and core domains.
+# TODO(b/34980020)
+attribute data_between_core_and_vendor_violators;
+expandattribute data_between_core_and_vendor_violators false;
+
+# All system domains which violate the requirement of not executing vendor
+# binaries/libraries.
+# TODO(b/62041836)
+attribute system_executes_vendor_violators;
+expandattribute system_executes_vendor_violators false;
+
+# All system domains which violate the requirement of not writing vendor
+# properties.
+# TODO(b/78598545): Remove this once there are no violations
+attribute system_writes_vendor_properties_violators;
+expandattribute system_writes_vendor_properties_violators false;
+
+# All system domains which violate the requirement of not writing to
+# /mnt/vendor/*. Must not be used on devices launched with P or later.
+attribute system_writes_mnt_vendor_violators;
+expandattribute system_writes_mnt_vendor_violators false;
+
+# hwservices that are accessible from untrusted applications
+# WARNING: Use of this attribute should be avoided unless
+# absolutely necessary. It is a temporary allowance to aid the
+# transition to treble and will be removed in a future platform
+# version, requiring all hwservices that are labeled with this
+# attribute to be submitted to AOSP in order to maintain their
+# app-visibility.
+attribute untrusted_app_visible_hwservice_violators;
+expandattribute untrusted_app_visible_hwservice_violators false;
+
+# halserver domains that are accessible to untrusted applications. These
+# domains are typically those hosting hwservices attributed by the
+# untrusted_app_visible_hwservice_violators.
+# WARNING: Use of this attribute should be avoided unless absolutely necessary.
+# It is a temporary allowance to aid the transition to treble and will be
+# removed in the future platform version, requiring all halserver domains that
+# are labeled with this attribute to be submitted to AOSP in order to maintain
+# their app-visibility.
+attribute untrusted_app_visible_halserver_violators;
+expandattribute untrusted_app_visible_halserver_violators false;
+
+# PDX services
+attribute pdx_endpoint_dir_type;
+attribute pdx_endpoint_socket_type;
+expandattribute pdx_endpoint_socket_type false;
+attribute pdx_channel_socket_type;
+expandattribute pdx_channel_socket_type false;
+
+
+#line 320
+attribute pdx_display_client_endpoint_dir_type;
+#line 320
+attribute pdx_display_client_endpoint_socket_type;
+#line 320
+attribute pdx_display_client_channel_socket_type;
+#line 320
+attribute pdx_display_client_server_type;
+#line 320
+
+
+#line 321
+attribute pdx_display_manager_endpoint_dir_type;
+#line 321
+attribute pdx_display_manager_endpoint_socket_type;
+#line 321
+attribute pdx_display_manager_channel_socket_type;
+#line 321
+attribute pdx_display_manager_server_type;
+#line 321
+
+
+#line 322
+attribute pdx_display_screenshot_endpoint_dir_type;
+#line 322
+attribute pdx_display_screenshot_endpoint_socket_type;
+#line 322
+attribute pdx_display_screenshot_channel_socket_type;
+#line 322
+attribute pdx_display_screenshot_server_type;
+#line 322
+
+
+#line 323
+attribute pdx_display_vsync_endpoint_dir_type;
+#line 323
+attribute pdx_display_vsync_endpoint_socket_type;
+#line 323
+attribute pdx_display_vsync_channel_socket_type;
+#line 323
+attribute pdx_display_vsync_server_type;
+#line 323
+
+
+#line 324
+attribute pdx_performance_client_endpoint_dir_type;
+#line 324
+attribute pdx_performance_client_endpoint_socket_type;
+#line 324
+attribute pdx_performance_client_channel_socket_type;
+#line 324
+attribute pdx_performance_client_server_type;
+#line 324
+
+
+#line 325
+attribute pdx_bufferhub_client_endpoint_dir_type;
+#line 325
+attribute pdx_bufferhub_client_endpoint_socket_type;
+#line 325
+attribute pdx_bufferhub_client_channel_socket_type;
+#line 325
+attribute pdx_bufferhub_client_server_type;
+#line 325
+
+
+# All HAL servers
+attribute halserverdomain;
+# All HAL clients
+attribute halclientdomain;
+expandattribute halclientdomain true;
+
+# Exempt for halserverdomain to access sockets. Only builds for automotive
+# device types are allowed to use this attribute (enforced by CTS).
+# Unlike phone, in a car many modules are external from Android perspective and
+# HALs should be able to communicate with those devices through sockets.
+attribute hal_automotive_socket_exemption;
+
+# HALs
+
+#line 340
+attribute hal_allocator;
+#line 340
+expandattribute hal_allocator true;
+#line 340
+attribute hal_allocator_client;
+#line 340
+expandattribute hal_allocator_client true;
+#line 340
+attribute hal_allocator_server;
+#line 340
+expandattribute hal_allocator_server false;
+#line 340
+
+#line 340
+neverallow { hal_allocator_server -halserverdomain } domain:process fork;
+#line 340
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 340
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 340
+# verified by CTS since these attributes are already expanded by that time.
+#line 340
+
+#line 340
+;
+
+#line 341
+attribute hal_atrace;
+#line 341
+expandattribute hal_atrace true;
+#line 341
+attribute hal_atrace_client;
+#line 341
+expandattribute hal_atrace_client true;
+#line 341
+attribute hal_atrace_server;
+#line 341
+expandattribute hal_atrace_server false;
+#line 341
+
+#line 341
+neverallow { hal_atrace_server -halserverdomain } domain:process fork;
+#line 341
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 341
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 341
+# verified by CTS since these attributes are already expanded by that time.
+#line 341
+
+#line 341
+;
+
+#line 342
+attribute hal_audio;
+#line 342
+expandattribute hal_audio true;
+#line 342
+attribute hal_audio_client;
+#line 342
+expandattribute hal_audio_client true;
+#line 342
+attribute hal_audio_server;
+#line 342
+expandattribute hal_audio_server false;
+#line 342
+
+#line 342
+neverallow { hal_audio_server -halserverdomain } domain:process fork;
+#line 342
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 342
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 342
+# verified by CTS since these attributes are already expanded by that time.
+#line 342
+
+#line 342
+;
+
+#line 343
+attribute hal_audiocontrol;
+#line 343
+expandattribute hal_audiocontrol true;
+#line 343
+attribute hal_audiocontrol_client;
+#line 343
+expandattribute hal_audiocontrol_client true;
+#line 343
+attribute hal_audiocontrol_server;
+#line 343
+expandattribute hal_audiocontrol_server false;
+#line 343
+
+#line 343
+neverallow { hal_audiocontrol_server -halserverdomain } domain:process fork;
+#line 343
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 343
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 343
+# verified by CTS since these attributes are already expanded by that time.
+#line 343
+
+#line 343
+;
+
+#line 344
+attribute hal_authgraph;
+#line 344
+expandattribute hal_authgraph true;
+#line 344
+attribute hal_authgraph_client;
+#line 344
+expandattribute hal_authgraph_client true;
+#line 344
+attribute hal_authgraph_server;
+#line 344
+expandattribute hal_authgraph_server false;
+#line 344
+
+#line 344
+neverallow { hal_authgraph_server -halserverdomain } domain:process fork;
+#line 344
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 344
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 344
+# verified by CTS since these attributes are already expanded by that time.
+#line 344
+
+#line 344
+;
+
+#line 345
+attribute hal_authsecret;
+#line 345
+expandattribute hal_authsecret true;
+#line 345
+attribute hal_authsecret_client;
+#line 345
+expandattribute hal_authsecret_client true;
+#line 345
+attribute hal_authsecret_server;
+#line 345
+expandattribute hal_authsecret_server false;
+#line 345
+
+#line 345
+neverallow { hal_authsecret_server -halserverdomain } domain:process fork;
+#line 345
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 345
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 345
+# verified by CTS since these attributes are already expanded by that time.
+#line 345
+
+#line 345
+;
+
+#line 346
+attribute hal_bluetooth;
+#line 346
+expandattribute hal_bluetooth true;
+#line 346
+attribute hal_bluetooth_client;
+#line 346
+expandattribute hal_bluetooth_client true;
+#line 346
+attribute hal_bluetooth_server;
+#line 346
+expandattribute hal_bluetooth_server false;
+#line 346
+
+#line 346
+neverallow { hal_bluetooth_server -halserverdomain } domain:process fork;
+#line 346
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 346
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 346
+# verified by CTS since these attributes are already expanded by that time.
+#line 346
+
+#line 346
+;
+
+#line 347
+attribute hal_bootctl;
+#line 347
+expandattribute hal_bootctl true;
+#line 347
+attribute hal_bootctl_client;
+#line 347
+expandattribute hal_bootctl_client true;
+#line 347
+attribute hal_bootctl_server;
+#line 347
+expandattribute hal_bootctl_server false;
+#line 347
+
+#line 347
+neverallow { hal_bootctl_server -halserverdomain } domain:process fork;
+#line 347
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 347
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 347
+# verified by CTS since these attributes are already expanded by that time.
+#line 347
+
+#line 347
+;
+
+#line 348
+attribute hal_broadcastradio;
+#line 348
+expandattribute hal_broadcastradio true;
+#line 348
+attribute hal_broadcastradio_client;
+#line 348
+expandattribute hal_broadcastradio_client true;
+#line 348
+attribute hal_broadcastradio_server;
+#line 348
+expandattribute hal_broadcastradio_server false;
+#line 348
+
+#line 348
+neverallow { hal_broadcastradio_server -halserverdomain } domain:process fork;
+#line 348
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 348
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 348
+# verified by CTS since these attributes are already expanded by that time.
+#line 348
+
+#line 348
+;
+
+#line 349
+attribute hal_camera;
+#line 349
+expandattribute hal_camera true;
+#line 349
+attribute hal_camera_client;
+#line 349
+expandattribute hal_camera_client true;
+#line 349
+attribute hal_camera_server;
+#line 349
+expandattribute hal_camera_server false;
+#line 349
+
+#line 349
+neverallow { hal_camera_server -halserverdomain } domain:process fork;
+#line 349
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 349
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 349
+# verified by CTS since these attributes are already expanded by that time.
+#line 349
+
+#line 349
+;
+
+#line 350
+attribute hal_can_bus;
+#line 350
+expandattribute hal_can_bus true;
+#line 350
+attribute hal_can_bus_client;
+#line 350
+expandattribute hal_can_bus_client true;
+#line 350
+attribute hal_can_bus_server;
+#line 350
+expandattribute hal_can_bus_server false;
+#line 350
+
+#line 350
+neverallow { hal_can_bus_server -halserverdomain } domain:process fork;
+#line 350
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 350
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 350
+# verified by CTS since these attributes are already expanded by that time.
+#line 350
+
+#line 350
+;
+
+#line 351
+attribute hal_can_controller;
+#line 351
+expandattribute hal_can_controller true;
+#line 351
+attribute hal_can_controller_client;
+#line 351
+expandattribute hal_can_controller_client true;
+#line 351
+attribute hal_can_controller_server;
+#line 351
+expandattribute hal_can_controller_server false;
+#line 351
+
+#line 351
+neverallow { hal_can_controller_server -halserverdomain } domain:process fork;
+#line 351
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 351
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 351
+# verified by CTS since these attributes are already expanded by that time.
+#line 351
+
+#line 351
+;
+
+#line 352
+attribute hal_cas;
+#line 352
+expandattribute hal_cas true;
+#line 352
+attribute hal_cas_client;
+#line 352
+expandattribute hal_cas_client true;
+#line 352
+attribute hal_cas_server;
+#line 352
+expandattribute hal_cas_server false;
+#line 352
+
+#line 352
+neverallow { hal_cas_server -halserverdomain } domain:process fork;
+#line 352
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 352
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 352
+# verified by CTS since these attributes are already expanded by that time.
+#line 352
+
+#line 352
+;
+
+#line 353
+attribute hal_codec2;
+#line 353
+expandattribute hal_codec2 true;
+#line 353
+attribute hal_codec2_client;
+#line 353
+expandattribute hal_codec2_client true;
+#line 353
+attribute hal_codec2_server;
+#line 353
+expandattribute hal_codec2_server false;
+#line 353
+
+#line 353
+neverallow { hal_codec2_server -halserverdomain } domain:process fork;
+#line 353
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 353
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 353
+# verified by CTS since these attributes are already expanded by that time.
+#line 353
+
+#line 353
+;
+
+#line 354
+attribute hal_configstore;
+#line 354
+expandattribute hal_configstore true;
+#line 354
+attribute hal_configstore_client;
+#line 354
+expandattribute hal_configstore_client true;
+#line 354
+attribute hal_configstore_server;
+#line 354
+expandattribute hal_configstore_server false;
+#line 354
+
+#line 354
+neverallow { hal_configstore_server -halserverdomain } domain:process fork;
+#line 354
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 354
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 354
+# verified by CTS since these attributes are already expanded by that time.
+#line 354
+
+#line 354
+;
+
+#line 355
+attribute hal_confirmationui;
+#line 355
+expandattribute hal_confirmationui true;
+#line 355
+attribute hal_confirmationui_client;
+#line 355
+expandattribute hal_confirmationui_client true;
+#line 355
+attribute hal_confirmationui_server;
+#line 355
+expandattribute hal_confirmationui_server false;
+#line 355
+
+#line 355
+neverallow { hal_confirmationui_server -halserverdomain } domain:process fork;
+#line 355
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 355
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 355
+# verified by CTS since these attributes are already expanded by that time.
+#line 355
+
+#line 355
+;
+
+#line 356
+attribute hal_contexthub;
+#line 356
+expandattribute hal_contexthub true;
+#line 356
+attribute hal_contexthub_client;
+#line 356
+expandattribute hal_contexthub_client true;
+#line 356
+attribute hal_contexthub_server;
+#line 356
+expandattribute hal_contexthub_server false;
+#line 356
+
+#line 356
+neverallow { hal_contexthub_server -halserverdomain } domain:process fork;
+#line 356
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 356
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 356
+# verified by CTS since these attributes are already expanded by that time.
+#line 356
+
+#line 356
+;
+
+#line 357
+attribute hal_drm;
+#line 357
+expandattribute hal_drm true;
+#line 357
+attribute hal_drm_client;
+#line 357
+expandattribute hal_drm_client true;
+#line 357
+attribute hal_drm_server;
+#line 357
+expandattribute hal_drm_server false;
+#line 357
+
+#line 357
+neverallow { hal_drm_server -halserverdomain } domain:process fork;
+#line 357
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 357
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 357
+# verified by CTS since these attributes are already expanded by that time.
+#line 357
+
+#line 357
+;
+
+#line 358
+attribute hal_dumpstate;
+#line 358
+expandattribute hal_dumpstate true;
+#line 358
+attribute hal_dumpstate_client;
+#line 358
+expandattribute hal_dumpstate_client true;
+#line 358
+attribute hal_dumpstate_server;
+#line 358
+expandattribute hal_dumpstate_server false;
+#line 358
+
+#line 358
+neverallow { hal_dumpstate_server -halserverdomain } domain:process fork;
+#line 358
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 358
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 358
+# verified by CTS since these attributes are already expanded by that time.
+#line 358
+
+#line 358
+;
+
+#line 359
+attribute hal_evs;
+#line 359
+expandattribute hal_evs true;
+#line 359
+attribute hal_evs_client;
+#line 359
+expandattribute hal_evs_client true;
+#line 359
+attribute hal_evs_server;
+#line 359
+expandattribute hal_evs_server false;
+#line 359
+
+#line 359
+neverallow { hal_evs_server -halserverdomain } domain:process fork;
+#line 359
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 359
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 359
+# verified by CTS since these attributes are already expanded by that time.
+#line 359
+
+#line 359
+;
+
+#line 360
+attribute hal_face;
+#line 360
+expandattribute hal_face true;
+#line 360
+attribute hal_face_client;
+#line 360
+expandattribute hal_face_client true;
+#line 360
+attribute hal_face_server;
+#line 360
+expandattribute hal_face_server false;
+#line 360
+
+#line 360
+neverallow { hal_face_server -halserverdomain } domain:process fork;
+#line 360
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 360
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 360
+# verified by CTS since these attributes are already expanded by that time.
+#line 360
+
+#line 360
+;
+
+#line 361
+attribute hal_fastboot;
+#line 361
+expandattribute hal_fastboot true;
+#line 361
+attribute hal_fastboot_client;
+#line 361
+expandattribute hal_fastboot_client true;
+#line 361
+attribute hal_fastboot_server;
+#line 361
+expandattribute hal_fastboot_server false;
+#line 361
+
+#line 361
+neverallow { hal_fastboot_server -halserverdomain } domain:process fork;
+#line 361
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 361
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 361
+# verified by CTS since these attributes are already expanded by that time.
+#line 361
+
+#line 361
+;
+
+#line 362
+attribute hal_fingerprint;
+#line 362
+expandattribute hal_fingerprint true;
+#line 362
+attribute hal_fingerprint_client;
+#line 362
+expandattribute hal_fingerprint_client true;
+#line 362
+attribute hal_fingerprint_server;
+#line 362
+expandattribute hal_fingerprint_server false;
+#line 362
+
+#line 362
+neverallow { hal_fingerprint_server -halserverdomain } domain:process fork;
+#line 362
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 362
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 362
+# verified by CTS since these attributes are already expanded by that time.
+#line 362
+
+#line 362
+;
+
+#line 363
+attribute hal_gatekeeper;
+#line 363
+expandattribute hal_gatekeeper true;
+#line 363
+attribute hal_gatekeeper_client;
+#line 363
+expandattribute hal_gatekeeper_client true;
+#line 363
+attribute hal_gatekeeper_server;
+#line 363
+expandattribute hal_gatekeeper_server false;
+#line 363
+
+#line 363
+neverallow { hal_gatekeeper_server -halserverdomain } domain:process fork;
+#line 363
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 363
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 363
+# verified by CTS since these attributes are already expanded by that time.
+#line 363
+
+#line 363
+;
+
+#line 364
+attribute hal_gnss;
+#line 364
+expandattribute hal_gnss true;
+#line 364
+attribute hal_gnss_client;
+#line 364
+expandattribute hal_gnss_client true;
+#line 364
+attribute hal_gnss_server;
+#line 364
+expandattribute hal_gnss_server false;
+#line 364
+
+#line 364
+neverallow { hal_gnss_server -halserverdomain } domain:process fork;
+#line 364
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 364
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 364
+# verified by CTS since these attributes are already expanded by that time.
+#line 364
+
+#line 364
+;
+
+#line 365
+attribute hal_graphics_allocator;
+#line 365
+expandattribute hal_graphics_allocator true;
+#line 365
+attribute hal_graphics_allocator_client;
+#line 365
+expandattribute hal_graphics_allocator_client true;
+#line 365
+attribute hal_graphics_allocator_server;
+#line 365
+expandattribute hal_graphics_allocator_server false;
+#line 365
+
+#line 365
+neverallow { hal_graphics_allocator_server -halserverdomain } domain:process fork;
+#line 365
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 365
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 365
+# verified by CTS since these attributes are already expanded by that time.
+#line 365
+
+#line 365
+;
+
+#line 366
+attribute hal_graphics_composer;
+#line 366
+expandattribute hal_graphics_composer true;
+#line 366
+attribute hal_graphics_composer_client;
+#line 366
+expandattribute hal_graphics_composer_client true;
+#line 366
+attribute hal_graphics_composer_server;
+#line 366
+expandattribute hal_graphics_composer_server false;
+#line 366
+
+#line 366
+neverallow { hal_graphics_composer_server -halserverdomain } domain:process fork;
+#line 366
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 366
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 366
+# verified by CTS since these attributes are already expanded by that time.
+#line 366
+
+#line 366
+;
+
+#line 367
+attribute hal_health;
+#line 367
+expandattribute hal_health true;
+#line 367
+attribute hal_health_client;
+#line 367
+expandattribute hal_health_client true;
+#line 367
+attribute hal_health_server;
+#line 367
+expandattribute hal_health_server false;
+#line 367
+
+#line 367
+neverallow { hal_health_server -halserverdomain } domain:process fork;
+#line 367
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 367
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 367
+# verified by CTS since these attributes are already expanded by that time.
+#line 367
+
+#line 367
+;
+
+#line 368
+attribute hal_health_storage;
+#line 368
+expandattribute hal_health_storage true;
+#line 368
+attribute hal_health_storage_client;
+#line 368
+expandattribute hal_health_storage_client true;
+#line 368
+attribute hal_health_storage_server;
+#line 368
+expandattribute hal_health_storage_server false;
+#line 368
+
+#line 368
+neverallow { hal_health_storage_server -halserverdomain } domain:process fork;
+#line 368
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 368
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 368
+# verified by CTS since these attributes are already expanded by that time.
+#line 368
+
+#line 368
+;
+
+#line 369
+attribute hal_identity;
+#line 369
+expandattribute hal_identity true;
+#line 369
+attribute hal_identity_client;
+#line 369
+expandattribute hal_identity_client true;
+#line 369
+attribute hal_identity_server;
+#line 369
+expandattribute hal_identity_server false;
+#line 369
+
+#line 369
+neverallow { hal_identity_server -halserverdomain } domain:process fork;
+#line 369
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 369
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 369
+# verified by CTS since these attributes are already expanded by that time.
+#line 369
+
+#line 369
+;
+
+#line 370
+attribute hal_input_classifier;
+#line 370
+expandattribute hal_input_classifier true;
+#line 370
+attribute hal_input_classifier_client;
+#line 370
+expandattribute hal_input_classifier_client true;
+#line 370
+attribute hal_input_classifier_server;
+#line 370
+expandattribute hal_input_classifier_server false;
+#line 370
+
+#line 370
+neverallow { hal_input_classifier_server -halserverdomain } domain:process fork;
+#line 370
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 370
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 370
+# verified by CTS since these attributes are already expanded by that time.
+#line 370
+
+#line 370
+;
+
+#line 371
+attribute hal_input_processor;
+#line 371
+expandattribute hal_input_processor true;
+#line 371
+attribute hal_input_processor_client;
+#line 371
+expandattribute hal_input_processor_client true;
+#line 371
+attribute hal_input_processor_server;
+#line 371
+expandattribute hal_input_processor_server false;
+#line 371
+
+#line 371
+neverallow { hal_input_processor_server -halserverdomain } domain:process fork;
+#line 371
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 371
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 371
+# verified by CTS since these attributes are already expanded by that time.
+#line 371
+
+#line 371
+;
+
+#line 372
+attribute hal_ir;
+#line 372
+expandattribute hal_ir true;
+#line 372
+attribute hal_ir_client;
+#line 372
+expandattribute hal_ir_client true;
+#line 372
+attribute hal_ir_server;
+#line 372
+expandattribute hal_ir_server false;
+#line 372
+
+#line 372
+neverallow { hal_ir_server -halserverdomain } domain:process fork;
+#line 372
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 372
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 372
+# verified by CTS since these attributes are already expanded by that time.
+#line 372
+
+#line 372
+;
+
+#line 373
+attribute hal_ivn;
+#line 373
+expandattribute hal_ivn true;
+#line 373
+attribute hal_ivn_client;
+#line 373
+expandattribute hal_ivn_client true;
+#line 373
+attribute hal_ivn_server;
+#line 373
+expandattribute hal_ivn_server false;
+#line 373
+
+#line 373
+neverallow { hal_ivn_server -halserverdomain } domain:process fork;
+#line 373
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 373
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 373
+# verified by CTS since these attributes are already expanded by that time.
+#line 373
+
+#line 373
+;
+
+#line 374
+attribute hal_keymaster;
+#line 374
+expandattribute hal_keymaster true;
+#line 374
+attribute hal_keymaster_client;
+#line 374
+expandattribute hal_keymaster_client true;
+#line 374
+attribute hal_keymaster_server;
+#line 374
+expandattribute hal_keymaster_server false;
+#line 374
+
+#line 374
+neverallow { hal_keymaster_server -halserverdomain } domain:process fork;
+#line 374
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 374
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 374
+# verified by CTS since these attributes are already expanded by that time.
+#line 374
+
+#line 374
+;
+
+#line 375
+attribute hal_keymint;
+#line 375
+expandattribute hal_keymint true;
+#line 375
+attribute hal_keymint_client;
+#line 375
+expandattribute hal_keymint_client true;
+#line 375
+attribute hal_keymint_server;
+#line 375
+expandattribute hal_keymint_server false;
+#line 375
+
+#line 375
+neverallow { hal_keymint_server -halserverdomain } domain:process fork;
+#line 375
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 375
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 375
+# verified by CTS since these attributes are already expanded by that time.
+#line 375
+
+#line 375
+;
+
+#line 376
+attribute hal_light;
+#line 376
+expandattribute hal_light true;
+#line 376
+attribute hal_light_client;
+#line 376
+expandattribute hal_light_client true;
+#line 376
+attribute hal_light_server;
+#line 376
+expandattribute hal_light_server false;
+#line 376
+
+#line 376
+neverallow { hal_light_server -halserverdomain } domain:process fork;
+#line 376
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 376
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 376
+# verified by CTS since these attributes are already expanded by that time.
+#line 376
+
+#line 376
+;
+
+#line 377
+attribute hal_lowpan;
+#line 377
+expandattribute hal_lowpan true;
+#line 377
+attribute hal_lowpan_client;
+#line 377
+expandattribute hal_lowpan_client true;
+#line 377
+attribute hal_lowpan_server;
+#line 377
+expandattribute hal_lowpan_server false;
+#line 377
+
+#line 377
+neverallow { hal_lowpan_server -halserverdomain } domain:process fork;
+#line 377
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 377
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 377
+# verified by CTS since these attributes are already expanded by that time.
+#line 377
+
+#line 377
+;
+
+#line 378
+attribute hal_macsec;
+#line 378
+expandattribute hal_macsec true;
+#line 378
+attribute hal_macsec_client;
+#line 378
+expandattribute hal_macsec_client true;
+#line 378
+attribute hal_macsec_server;
+#line 378
+expandattribute hal_macsec_server false;
+#line 378
+
+#line 378
+neverallow { hal_macsec_server -halserverdomain } domain:process fork;
+#line 378
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 378
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 378
+# verified by CTS since these attributes are already expanded by that time.
+#line 378
+
+#line 378
+;
+
+#line 379
+
+#line 379
+attribute hal_mediaquality;
+#line 379
+expandattribute hal_mediaquality true;
+#line 379
+attribute hal_mediaquality_client;
+#line 379
+expandattribute hal_mediaquality_client true;
+#line 379
+attribute hal_mediaquality_server;
+#line 379
+expandattribute hal_mediaquality_server false;
+#line 379
+
+#line 379
+neverallow { hal_mediaquality_server -halserverdomain } domain:process fork;
+#line 379
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 379
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 379
+# verified by CTS since these attributes are already expanded by that time.
+#line 379
+
+#line 379
+;
+#line 381
+
+
+#line 382
+attribute hal_memtrack;
+#line 382
+expandattribute hal_memtrack true;
+#line 382
+attribute hal_memtrack_client;
+#line 382
+expandattribute hal_memtrack_client true;
+#line 382
+attribute hal_memtrack_server;
+#line 382
+expandattribute hal_memtrack_server false;
+#line 382
+
+#line 382
+neverallow { hal_memtrack_server -halserverdomain } domain:process fork;
+#line 382
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 382
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 382
+# verified by CTS since these attributes are already expanded by that time.
+#line 382
+
+#line 382
+;
+
+#line 383
+attribute hal_neuralnetworks;
+#line 383
+expandattribute hal_neuralnetworks true;
+#line 383
+attribute hal_neuralnetworks_client;
+#line 383
+expandattribute hal_neuralnetworks_client true;
+#line 383
+attribute hal_neuralnetworks_server;
+#line 383
+expandattribute hal_neuralnetworks_server false;
+#line 383
+
+#line 383
+neverallow { hal_neuralnetworks_server -halserverdomain } domain:process fork;
+#line 383
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 383
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 383
+# verified by CTS since these attributes are already expanded by that time.
+#line 383
+
+#line 383
+;
+
+#line 384
+attribute hal_nfc;
+#line 384
+expandattribute hal_nfc true;
+#line 384
+attribute hal_nfc_client;
+#line 384
+expandattribute hal_nfc_client true;
+#line 384
+attribute hal_nfc_server;
+#line 384
+expandattribute hal_nfc_server false;
+#line 384
+
+#line 384
+neverallow { hal_nfc_server -halserverdomain } domain:process fork;
+#line 384
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 384
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 384
+# verified by CTS since these attributes are already expanded by that time.
+#line 384
+
+#line 384
+;
+
+#line 385
+attribute hal_nlinterceptor;
+#line 385
+expandattribute hal_nlinterceptor true;
+#line 385
+attribute hal_nlinterceptor_client;
+#line 385
+expandattribute hal_nlinterceptor_client true;
+#line 385
+attribute hal_nlinterceptor_server;
+#line 385
+expandattribute hal_nlinterceptor_server false;
+#line 385
+
+#line 385
+neverallow { hal_nlinterceptor_server -halserverdomain } domain:process fork;
+#line 385
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 385
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 385
+# verified by CTS since these attributes are already expanded by that time.
+#line 385
+
+#line 385
+;
+
+#line 386
+attribute hal_oemlock;
+#line 386
+expandattribute hal_oemlock true;
+#line 386
+attribute hal_oemlock_client;
+#line 386
+expandattribute hal_oemlock_client true;
+#line 386
+attribute hal_oemlock_server;
+#line 386
+expandattribute hal_oemlock_server false;
+#line 386
+
+#line 386
+neverallow { hal_oemlock_server -halserverdomain } domain:process fork;
+#line 386
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 386
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 386
+# verified by CTS since these attributes are already expanded by that time.
+#line 386
+
+#line 386
+;
+
+#line 387
+attribute hal_omx;
+#line 387
+expandattribute hal_omx true;
+#line 387
+attribute hal_omx_client;
+#line 387
+expandattribute hal_omx_client true;
+#line 387
+attribute hal_omx_server;
+#line 387
+expandattribute hal_omx_server false;
+#line 387
+
+#line 387
+neverallow { hal_omx_server -halserverdomain } domain:process fork;
+#line 387
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 387
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 387
+# verified by CTS since these attributes are already expanded by that time.
+#line 387
+
+#line 387
+;
+
+#line 388
+attribute hal_power;
+#line 388
+expandattribute hal_power true;
+#line 388
+attribute hal_power_client;
+#line 388
+expandattribute hal_power_client true;
+#line 388
+attribute hal_power_server;
+#line 388
+expandattribute hal_power_server false;
+#line 388
+
+#line 388
+neverallow { hal_power_server -halserverdomain } domain:process fork;
+#line 388
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 388
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 388
+# verified by CTS since these attributes are already expanded by that time.
+#line 388
+
+#line 388
+;
+
+#line 389
+attribute hal_power_stats;
+#line 389
+expandattribute hal_power_stats true;
+#line 389
+attribute hal_power_stats_client;
+#line 389
+expandattribute hal_power_stats_client true;
+#line 389
+attribute hal_power_stats_server;
+#line 389
+expandattribute hal_power_stats_server false;
+#line 389
+
+#line 389
+neverallow { hal_power_stats_server -halserverdomain } domain:process fork;
+#line 389
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 389
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 389
+# verified by CTS since these attributes are already expanded by that time.
+#line 389
+
+#line 389
+;
+
+#line 390
+attribute hal_rebootescrow;
+#line 390
+expandattribute hal_rebootescrow true;
+#line 390
+attribute hal_rebootescrow_client;
+#line 390
+expandattribute hal_rebootescrow_client true;
+#line 390
+attribute hal_rebootescrow_server;
+#line 390
+expandattribute hal_rebootescrow_server false;
+#line 390
+
+#line 390
+neverallow { hal_rebootescrow_server -halserverdomain } domain:process fork;
+#line 390
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 390
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 390
+# verified by CTS since these attributes are already expanded by that time.
+#line 390
+
+#line 390
+;
+
+#line 391
+attribute hal_remoteaccess;
+#line 391
+expandattribute hal_remoteaccess true;
+#line 391
+attribute hal_remoteaccess_client;
+#line 391
+expandattribute hal_remoteaccess_client true;
+#line 391
+attribute hal_remoteaccess_server;
+#line 391
+expandattribute hal_remoteaccess_server false;
+#line 391
+
+#line 391
+neverallow { hal_remoteaccess_server -halserverdomain } domain:process fork;
+#line 391
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 391
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 391
+# verified by CTS since these attributes are already expanded by that time.
+#line 391
+
+#line 391
+;
+
+#line 392
+attribute hal_secretkeeper;
+#line 392
+expandattribute hal_secretkeeper true;
+#line 392
+attribute hal_secretkeeper_client;
+#line 392
+expandattribute hal_secretkeeper_client true;
+#line 392
+attribute hal_secretkeeper_server;
+#line 392
+expandattribute hal_secretkeeper_server false;
+#line 392
+
+#line 392
+neverallow { hal_secretkeeper_server -halserverdomain } domain:process fork;
+#line 392
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 392
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 392
+# verified by CTS since these attributes are already expanded by that time.
+#line 392
+
+#line 392
+;
+
+#line 393
+attribute hal_remotelyprovisionedcomponent_avf;
+#line 393
+expandattribute hal_remotelyprovisionedcomponent_avf true;
+#line 393
+attribute hal_remotelyprovisionedcomponent_avf_client;
+#line 393
+expandattribute hal_remotelyprovisionedcomponent_avf_client true;
+#line 393
+attribute hal_remotelyprovisionedcomponent_avf_server;
+#line 393
+expandattribute hal_remotelyprovisionedcomponent_avf_server false;
+#line 393
+
+#line 393
+neverallow { hal_remotelyprovisionedcomponent_avf_server -halserverdomain } domain:process fork;
+#line 393
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 393
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 393
+# verified by CTS since these attributes are already expanded by that time.
+#line 393
+
+#line 393
+;
+
+#line 394
+attribute hal_secure_element;
+#line 394
+expandattribute hal_secure_element true;
+#line 394
+attribute hal_secure_element_client;
+#line 394
+expandattribute hal_secure_element_client true;
+#line 394
+attribute hal_secure_element_server;
+#line 394
+expandattribute hal_secure_element_server false;
+#line 394
+
+#line 394
+neverallow { hal_secure_element_server -halserverdomain } domain:process fork;
+#line 394
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 394
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 394
+# verified by CTS since these attributes are already expanded by that time.
+#line 394
+
+#line 394
+;
+
+#line 395
+attribute hal_sensors;
+#line 395
+expandattribute hal_sensors true;
+#line 395
+attribute hal_sensors_client;
+#line 395
+expandattribute hal_sensors_client true;
+#line 395
+attribute hal_sensors_server;
+#line 395
+expandattribute hal_sensors_server false;
+#line 395
+
+#line 395
+neverallow { hal_sensors_server -halserverdomain } domain:process fork;
+#line 395
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 395
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 395
+# verified by CTS since these attributes are already expanded by that time.
+#line 395
+
+#line 395
+;
+
+#line 396
+attribute hal_telephony;
+#line 396
+expandattribute hal_telephony true;
+#line 396
+attribute hal_telephony_client;
+#line 396
+expandattribute hal_telephony_client true;
+#line 396
+attribute hal_telephony_server;
+#line 396
+expandattribute hal_telephony_server false;
+#line 396
+
+#line 396
+neverallow { hal_telephony_server -halserverdomain } domain:process fork;
+#line 396
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 396
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 396
+# verified by CTS since these attributes are already expanded by that time.
+#line 396
+
+#line 396
+;
+
+#line 397
+attribute hal_tetheroffload;
+#line 397
+expandattribute hal_tetheroffload true;
+#line 397
+attribute hal_tetheroffload_client;
+#line 397
+expandattribute hal_tetheroffload_client true;
+#line 397
+attribute hal_tetheroffload_server;
+#line 397
+expandattribute hal_tetheroffload_server false;
+#line 397
+
+#line 397
+neverallow { hal_tetheroffload_server -halserverdomain } domain:process fork;
+#line 397
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 397
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 397
+# verified by CTS since these attributes are already expanded by that time.
+#line 397
+
+#line 397
+;
+
+#line 398
+attribute hal_thermal;
+#line 398
+expandattribute hal_thermal true;
+#line 398
+attribute hal_thermal_client;
+#line 398
+expandattribute hal_thermal_client true;
+#line 398
+attribute hal_thermal_server;
+#line 398
+expandattribute hal_thermal_server false;
+#line 398
+
+#line 398
+neverallow { hal_thermal_server -halserverdomain } domain:process fork;
+#line 398
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 398
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 398
+# verified by CTS since these attributes are already expanded by that time.
+#line 398
+
+#line 398
+;
+
+#line 399
+attribute hal_threadnetwork;
+#line 399
+expandattribute hal_threadnetwork true;
+#line 399
+attribute hal_threadnetwork_client;
+#line 399
+expandattribute hal_threadnetwork_client true;
+#line 399
+attribute hal_threadnetwork_server;
+#line 399
+expandattribute hal_threadnetwork_server false;
+#line 399
+
+#line 399
+neverallow { hal_threadnetwork_server -halserverdomain } domain:process fork;
+#line 399
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 399
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 399
+# verified by CTS since these attributes are already expanded by that time.
+#line 399
+
+#line 399
+;
+
+#line 400
+attribute hal_tv_cec;
+#line 400
+expandattribute hal_tv_cec true;
+#line 400
+attribute hal_tv_cec_client;
+#line 400
+expandattribute hal_tv_cec_client true;
+#line 400
+attribute hal_tv_cec_server;
+#line 400
+expandattribute hal_tv_cec_server false;
+#line 400
+
+#line 400
+neverallow { hal_tv_cec_server -halserverdomain } domain:process fork;
+#line 400
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 400
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 400
+# verified by CTS since these attributes are already expanded by that time.
+#line 400
+
+#line 400
+;
+
+#line 401
+attribute hal_tv_hdmi_cec;
+#line 401
+expandattribute hal_tv_hdmi_cec true;
+#line 401
+attribute hal_tv_hdmi_cec_client;
+#line 401
+expandattribute hal_tv_hdmi_cec_client true;
+#line 401
+attribute hal_tv_hdmi_cec_server;
+#line 401
+expandattribute hal_tv_hdmi_cec_server false;
+#line 401
+
+#line 401
+neverallow { hal_tv_hdmi_cec_server -halserverdomain } domain:process fork;
+#line 401
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 401
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 401
+# verified by CTS since these attributes are already expanded by that time.
+#line 401
+
+#line 401
+;
+
+#line 402
+attribute hal_tv_hdmi_connection;
+#line 402
+expandattribute hal_tv_hdmi_connection true;
+#line 402
+attribute hal_tv_hdmi_connection_client;
+#line 402
+expandattribute hal_tv_hdmi_connection_client true;
+#line 402
+attribute hal_tv_hdmi_connection_server;
+#line 402
+expandattribute hal_tv_hdmi_connection_server false;
+#line 402
+
+#line 402
+neverallow { hal_tv_hdmi_connection_server -halserverdomain } domain:process fork;
+#line 402
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 402
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 402
+# verified by CTS since these attributes are already expanded by that time.
+#line 402
+
+#line 402
+;
+
+#line 403
+attribute hal_tv_hdmi_earc;
+#line 403
+expandattribute hal_tv_hdmi_earc true;
+#line 403
+attribute hal_tv_hdmi_earc_client;
+#line 403
+expandattribute hal_tv_hdmi_earc_client true;
+#line 403
+attribute hal_tv_hdmi_earc_server;
+#line 403
+expandattribute hal_tv_hdmi_earc_server false;
+#line 403
+
+#line 403
+neverallow { hal_tv_hdmi_earc_server -halserverdomain } domain:process fork;
+#line 403
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 403
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 403
+# verified by CTS since these attributes are already expanded by that time.
+#line 403
+
+#line 403
+;
+
+#line 404
+attribute hal_tv_input;
+#line 404
+expandattribute hal_tv_input true;
+#line 404
+attribute hal_tv_input_client;
+#line 404
+expandattribute hal_tv_input_client true;
+#line 404
+attribute hal_tv_input_server;
+#line 404
+expandattribute hal_tv_input_server false;
+#line 404
+
+#line 404
+neverallow { hal_tv_input_server -halserverdomain } domain:process fork;
+#line 404
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 404
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 404
+# verified by CTS since these attributes are already expanded by that time.
+#line 404
+
+#line 404
+;
+
+#line 405
+attribute hal_tv_tuner;
+#line 405
+expandattribute hal_tv_tuner true;
+#line 405
+attribute hal_tv_tuner_client;
+#line 405
+expandattribute hal_tv_tuner_client true;
+#line 405
+attribute hal_tv_tuner_server;
+#line 405
+expandattribute hal_tv_tuner_server false;
+#line 405
+
+#line 405
+neverallow { hal_tv_tuner_server -halserverdomain } domain:process fork;
+#line 405
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 405
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 405
+# verified by CTS since these attributes are already expanded by that time.
+#line 405
+
+#line 405
+;
+
+#line 406
+attribute hal_usb;
+#line 406
+expandattribute hal_usb true;
+#line 406
+attribute hal_usb_client;
+#line 406
+expandattribute hal_usb_client true;
+#line 406
+attribute hal_usb_server;
+#line 406
+expandattribute hal_usb_server false;
+#line 406
+
+#line 406
+neverallow { hal_usb_server -halserverdomain } domain:process fork;
+#line 406
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 406
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 406
+# verified by CTS since these attributes are already expanded by that time.
+#line 406
+
+#line 406
+;
+
+#line 407
+attribute hal_usb_gadget;
+#line 407
+expandattribute hal_usb_gadget true;
+#line 407
+attribute hal_usb_gadget_client;
+#line 407
+expandattribute hal_usb_gadget_client true;
+#line 407
+attribute hal_usb_gadget_server;
+#line 407
+expandattribute hal_usb_gadget_server false;
+#line 407
+
+#line 407
+neverallow { hal_usb_gadget_server -halserverdomain } domain:process fork;
+#line 407
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 407
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 407
+# verified by CTS since these attributes are already expanded by that time.
+#line 407
+
+#line 407
+;
+
+#line 408
+attribute hal_uwb;
+#line 408
+expandattribute hal_uwb true;
+#line 408
+attribute hal_uwb_client;
+#line 408
+expandattribute hal_uwb_client true;
+#line 408
+attribute hal_uwb_server;
+#line 408
+expandattribute hal_uwb_server false;
+#line 408
+
+#line 408
+neverallow { hal_uwb_server -halserverdomain } domain:process fork;
+#line 408
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 408
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 408
+# verified by CTS since these attributes are already expanded by that time.
+#line 408
+
+#line 408
+;
+# TODO(b/196225233): Remove this attribute and its usages elsewhere
+# once all chip vendors integrate to the new UWB stack.
+
+#line 411
+attribute hal_uwb_vendor;
+#line 411
+expandattribute hal_uwb_vendor true;
+#line 411
+attribute hal_uwb_vendor_client;
+#line 411
+expandattribute hal_uwb_vendor_client true;
+#line 411
+attribute hal_uwb_vendor_server;
+#line 411
+expandattribute hal_uwb_vendor_server false;
+#line 411
+
+#line 411
+neverallow { hal_uwb_vendor_server -halserverdomain } domain:process fork;
+#line 411
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 411
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 411
+# verified by CTS since these attributes are already expanded by that time.
+#line 411
+
+#line 411
+;
+
+#line 412
+attribute hal_vehicle;
+#line 412
+expandattribute hal_vehicle true;
+#line 412
+attribute hal_vehicle_client;
+#line 412
+expandattribute hal_vehicle_client true;
+#line 412
+attribute hal_vehicle_server;
+#line 412
+expandattribute hal_vehicle_server false;
+#line 412
+
+#line 412
+neverallow { hal_vehicle_server -halserverdomain } domain:process fork;
+#line 412
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 412
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 412
+# verified by CTS since these attributes are already expanded by that time.
+#line 412
+
+#line 412
+;
+
+#line 413
+attribute hal_vibrator;
+#line 413
+expandattribute hal_vibrator true;
+#line 413
+attribute hal_vibrator_client;
+#line 413
+expandattribute hal_vibrator_client true;
+#line 413
+attribute hal_vibrator_server;
+#line 413
+expandattribute hal_vibrator_server false;
+#line 413
+
+#line 413
+neverallow { hal_vibrator_server -halserverdomain } domain:process fork;
+#line 413
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 413
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 413
+# verified by CTS since these attributes are already expanded by that time.
+#line 413
+
+#line 413
+;
+
+#line 414
+attribute hal_vr;
+#line 414
+expandattribute hal_vr true;
+#line 414
+attribute hal_vr_client;
+#line 414
+expandattribute hal_vr_client true;
+#line 414
+attribute hal_vr_server;
+#line 414
+expandattribute hal_vr_server false;
+#line 414
+
+#line 414
+neverallow { hal_vr_server -halserverdomain } domain:process fork;
+#line 414
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 414
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 414
+# verified by CTS since these attributes are already expanded by that time.
+#line 414
+
+#line 414
+;
+
+#line 415
+attribute hal_weaver;
+#line 415
+expandattribute hal_weaver true;
+#line 415
+attribute hal_weaver_client;
+#line 415
+expandattribute hal_weaver_client true;
+#line 415
+attribute hal_weaver_server;
+#line 415
+expandattribute hal_weaver_server false;
+#line 415
+
+#line 415
+neverallow { hal_weaver_server -halserverdomain } domain:process fork;
+#line 415
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 415
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 415
+# verified by CTS since these attributes are already expanded by that time.
+#line 415
+
+#line 415
+;
+
+#line 416
+attribute hal_wifi;
+#line 416
+expandattribute hal_wifi true;
+#line 416
+attribute hal_wifi_client;
+#line 416
+expandattribute hal_wifi_client true;
+#line 416
+attribute hal_wifi_server;
+#line 416
+expandattribute hal_wifi_server false;
+#line 416
+
+#line 416
+neverallow { hal_wifi_server -halserverdomain } domain:process fork;
+#line 416
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 416
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 416
+# verified by CTS since these attributes are already expanded by that time.
+#line 416
+
+#line 416
+;
+
+#line 417
+attribute hal_wifi_hostapd;
+#line 417
+expandattribute hal_wifi_hostapd true;
+#line 417
+attribute hal_wifi_hostapd_client;
+#line 417
+expandattribute hal_wifi_hostapd_client true;
+#line 417
+attribute hal_wifi_hostapd_server;
+#line 417
+expandattribute hal_wifi_hostapd_server false;
+#line 417
+
+#line 417
+neverallow { hal_wifi_hostapd_server -halserverdomain } domain:process fork;
+#line 417
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 417
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 417
+# verified by CTS since these attributes are already expanded by that time.
+#line 417
+
+#line 417
+;
+
+#line 418
+attribute hal_wifi_supplicant;
+#line 418
+expandattribute hal_wifi_supplicant true;
+#line 418
+attribute hal_wifi_supplicant_client;
+#line 418
+expandattribute hal_wifi_supplicant_client true;
+#line 418
+attribute hal_wifi_supplicant_server;
+#line 418
+expandattribute hal_wifi_supplicant_server false;
+#line 418
+
+#line 418
+neverallow { hal_wifi_supplicant_server -halserverdomain } domain:process fork;
+#line 418
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 418
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 418
+# verified by CTS since these attributes are already expanded by that time.
+#line 418
+
+#line 418
+;
+
+# HwBinder services offered across the core-vendor boundary
+#
+# We annotate server domains with x_server to loosen the coupling between
+# system and vendor images. For example, it should be possible to move a service
+# from one core domain to another, without having to update the vendor image
+# which contains clients of this service.
+
+attribute automotive_display_service_server;
+attribute camera_service_server;
+attribute display_service_server;
+attribute evsmanager_service_server;
+attribute remote_provisioning_service_server;
+attribute scheduler_service_server;
+attribute sensor_service_server;
+attribute stats_service_server;
+attribute system_suspend_internal_server;
+attribute system_suspend_server;
+attribute wifi_keystore_service_server;
+
+# All types used for super partition block devices.
+attribute super_block_device_type;
+
+# All types used for DMA-BUF heaps
+attribute dmabuf_heap_device_type;
+expandattribute dmabuf_heap_device_type false;
+
+# Types for VM managers
+attribute vm_manager_device_type;
+
+# All types used for DSU metadata files.
+attribute gsi_metadata_file_type;
+
+# Types used for module-specific APEX data directories under
+# /data/{misc,misc_ce,misc_de}/apexdata.
+attribute apex_data_file_type;
+
+# Domains used for charger.
+# This is the common type for domains that executes charger's
+# functionalities, including setting and getting necessary properties,
+# permissions to maintain the health loop, writing to kernel log, handling
+# inputs and drawing screens, etc.
+attribute charger_type;
+
+# All types of ART properties.
+attribute dalvik_config_prop_type;
+
+# All tee services that can be accessed by VMs
+
+#line 467
+ attribute tee_service_type;
+#line 469
+
+
+# HAL service used for custom smc filtering project
+
+#line 472
+
+#line 472
+attribute hal_vm_capabilities;
+#line 472
+expandattribute hal_vm_capabilities true;
+#line 472
+attribute hal_vm_capabilities_client;
+#line 472
+expandattribute hal_vm_capabilities_client true;
+#line 472
+attribute hal_vm_capabilities_server;
+#line 472
+expandattribute hal_vm_capabilities_server false;
+#line 472
+
+#line 472
+neverallow { hal_vm_capabilities_server -halserverdomain } domain:process fork;
+#line 472
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 472
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 472
+# verified by CTS since these attributes are already expanded by that time.
+#line 472
+
+#line 472
+;
+#line 474
+
+#line 1 "system/sepolicy/public/adbd.te"
+# adbd seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type adbd, domain;
+type adbd_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/aidl_lazy_test_server.te"
+type aidl_lazy_test_server, domain;
+type aidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/apexd.te"
+# apexd -- manager for APEX packages
+type apexd, domain;
+type apexd_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/app.te"
+###
+### Domain for all zygote spawned apps
+###
+### This file is the base policy for all zygote spawned apps.
+### Other policy files, such as isolated_app.te, untrusted_app.te, etc
+### extend from this policy. Only policies which should apply to ALL
+### zygote spawned apps should be added here.
+###
+type appdomain_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/app_zygote.te"
+# app_zygote is an auxiliary zygote process that is used to spawn
+# isolated service processes for individual applications. It is
+# spawned from the regular zygote process as a "child zygote".
+type app_zygote, domain;
+type app_zygote_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/artd.te"
+# ART service daemon.
+type artd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/asan_extract.te"
+# asan_extract
+#
+# This command set moves the artifact corresponding to the current slot
+# from /data/ota to /data/dalvik-cache.
+
+#line 9
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/atrace.te"
+type atrace, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/audioserver.te"
+# audioserver - audio services daemon
+type audioserver, domain;
+type audioserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/blkid.te"
+# blkid called from vold
+type blkid, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/blkid_untrusted.te"
+# blkid for untrusted block devices
+type blkid_untrusted, domain;
+#line 1 "system/sepolicy/public/bluetooth.te"
+# bluetooth subsystem
+type bluetooth, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/bootanim.te"
+# bootanimation oneshot service
+type bootanim, domain;
+type bootanim_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/bootstat.te"
+# bootstat command
+type bootstat, domain;
+type bootstat_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/bpfloader.te"
+type bpfloader, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/bufferhubd.te"
+# bufferhubd
+type bufferhubd, domain, mlstrustedsubject;
+type bufferhubd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/cameraserver.te"
+# cameraserver - camera daemon
+type cameraserver, domain;
+type cameraserver_exec, system_file_type, exec_type, file_type;
+type cameraserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/charger.te"
+type charger, charger_type, domain;
+type charger_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/charger_vendor.te"
+# Context when health HAL runs charger mode
+type charger_vendor, charger_type, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/crash_dump.te"
+type crash_dump, domain;
+type crash_dump_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/credstore.te"
+# credstore daemon
+type credstore, domain;
+type credstore_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/crosvm.te"
+
+#line 1
+ type crosvm, domain, coredomain;
+#line 3
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/device.te"
+# Device types
+type device, dev_type, fs_type;
+type ashmem_device, dev_type, mlstrustedobject;
+type ashmem_libcutils_device, dev_type, mlstrustedobject;
+type audio_device, dev_type;
+type binder_device, dev_type, mlstrustedobject;
+type hwbinder_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type vndbinder_device, dev_type;
+type block_device, dev_type;
+type bt_device, dev_type;
+type camera_device, dev_type;
+type dm_device, dev_type;
+type ublk_block_device, dev_type;
+type dm_user_device, dev_type;
+type ublk_control_device, dev_type;
+type keychord_device, dev_type;
+type loop_control_device, dev_type;
+type loop_device, dev_type;
+type pmsg_device, dev_type, mlstrustedobject;
+type radio_device, dev_type;
+type ram_device, dev_type;
+type rtc_device, dev_type;
+type vd_device, dev_type;
+type vold_device, dev_type;
+type console_device, dev_type;
+type fscklogs, dev_type;
+# GPU (used by most UI apps)
+type gpu_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type graphics_device, dev_type;
+type hw_random_device, dev_type;
+type input_device, dev_type;
+type port_device, dev_type;
+type lowpan_device, dev_type;
+type mtp_device, dev_type, mlstrustedobject;
+type nfc_device, dev_type;
+type ptmx_device, dev_type, mlstrustedobject;
+type kmsg_device, dev_type, mlstrustedobject;
+type kmsg_debug_device, dev_type;
+type null_device, dev_type, mlstrustedobject;
+type random_device, dev_type, mlstrustedobject;
+type secure_element_device, dev_type;
+type sensors_device, dev_type;
+type serial_device, dev_type;
+type socket_device, dev_type;
+type owntty_device, dev_type, mlstrustedobject;
+type tty_device, dev_type;
+type video_device, dev_type;
+type zero_device, dev_type, mlstrustedobject;
+type fuse_device, dev_type, mlstrustedobject;
+type iio_device, dev_type;
+type ion_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type dmabuf_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject;
+type dmabuf_system_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type dmabuf_system_secure_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject;
+type qtaguid_device, dev_type;
+type watchdog_device, dev_type;
+type uhid_device, dev_type, mlstrustedobject;
+type uio_device, dev_type;
+type tun_device, dev_type, mlstrustedobject;
+type usbaccessory_device, dev_type, mlstrustedobject;
+type usb_device, dev_type, mlstrustedobject;
+type usb_serial_device, dev_type;
+type gnss_device, dev_type;
+type properties_device, dev_type;
+type properties_serial, dev_type;
+type property_info, dev_type;
+type hidraw_device, dev_type;
+
+# All devices have a uart for the hci
+# attach service. The uart dev node
+# varies per device. This type
+# is used in per device policy
+type hci_attach_dev, dev_type;
+
+# All devices have a rpmsg device for
+# achieving remoteproc and rpmsg modules
+type rpmsg_device, dev_type;
+
+# Partition layout block device
+type root_block_device, dev_type;
+
+# factory reset protection block device
+type frp_block_device, dev_type;
+
+# System block device mounted on /system.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type system_block_device, dev_type;
+
+# Recovery block device.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type recovery_block_device, dev_type;
+
+# boot block device.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type boot_block_device, dev_type;
+
+# dtbo block device, type used for getting DTBO information for AVF.
+# Documented at https://source.android.com/docs/core/architecture/dto/partitions
+type dtbo_block_device, dev_type;
+
+# Userdata block device mounted on /data.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type userdata_block_device, dev_type;
+
+# Zoned block device.
+type zoned_block_device, dev_type;
+
+# Cache block device mounted on /cache.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type cache_block_device, dev_type;
+
+# Block device for any swap partition.
+type swap_block_device, dev_type;
+
+# Metadata block device mounted on /metadata, used for encryption metadata and
+# various other purposes.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type metadata_block_device, dev_type;
+
+# The 'misc' partition used by recovery and A/B.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type misc_block_device, dev_type;
+
+# 'super' partition to be used for logical partitioning.
+type super_block_device, super_block_device_type, dev_type;
+
+# sdcard devices; normally vold uses the vold_block_device label and creates a
+# separate device node. gsid, however, accesses the original devide node
+# created through uevents, so we use a separate label.
+type sdcard_block_device, dev_type;
+
+# Userdata device file for filesystem tunables
+type userdata_sysdev, dev_type;
+
+# Root disk file for disk tunables
+type rootdisk_sysdev, dev_type;
+
+# vfio device
+type vfio_device, dev_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/dhcp.te"
+type dhcp, domain;
+type dhcp_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/dnsmasq.te"
+# DNS, DHCP services
+type dnsmasq, domain;
+type dnsmasq_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/drmserver.te"
+# drmserver - DRM service
+type drmserver, domain;
+type drmserver_exec, system_file_type, exec_type, file_type;
+type drmserver_socket, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/dumpstate.te"
+# dumpstate
+type dumpstate, domain, mlstrustedsubject;
+type dumpstate_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/e2fs.te"
+type e2fs, domain, coredomain;
+type e2fs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/early_virtmgr.te"
+
+#line 1
+ # Domain for a child process that manages early VMs available before /data mount, on behalf of
+#line 1
+ # its parent.
+#line 1
+
+#line 1
+ type early_virtmgr, domain, coredomain;
+#line 1
+ type early_virtmgr_exec, system_file_type, exec_type, file_type;
+#line 1
+
+#line 8
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/ephemeral_app.te"
+###
+### Ephemeral apps.
+###
+### This file defines the security policy for apps with the ephemeral
+### feature.
+###
+### The ephemeral_app domain is a reduced permissions sandbox allowing
+### ephemeral applications to be safely installed and run. Non ephemeral
+### applications may also opt-in to ephemeral to take advantage of the
+### additional security features.
+###
+### PackageManager flags an app as ephemeral at install time.
+
+type ephemeral_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/evsmanagerd.te"
+# evsmanager daemon
+type evsmanagerd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/extra_free_kbytes.te"
+# The extra_free_kbytes.sh script run by init.
+type extra_free_kbytes, domain;
+type extra_free_kbytes_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/fastbootd.te"
+# fastbootd (used in recovery init.rc for /sbin/fastbootd)
+
+# Declare the domain unconditionally so we can always reference it
+# in neverallow rules.
+type fastbootd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/file.te"
+# Filesystem types
+type labeledfs, fs_type;
+type pipefs, fs_type;
+type sockfs, fs_type;
+type rootfs, fs_type;
+type proc, fs_type, proc_type;
+type binderfs, fs_type;
+type binderfs_logs, fs_type;
+type binderfs_logs_proc, fs_type;
+type binderfs_logs_stats, fs_type;
+
+
+#line 12
+ type binderfs_logs_transactions, fs_type;
+#line 12
+ type binderfs_logs_transaction_history, fs_type;
+#line 15
+
+
+type binderfs_features, fs_type;
+# Security-sensitive proc nodes that should not be writable to most.
+type proc_security, fs_type, proc_type;
+type proc_drop_caches, fs_type, proc_type;
+type proc_overcommit_memory, fs_type, proc_type;
+type proc_min_free_order_shift, fs_type, proc_type;
+type proc_kpageflags, fs_type, proc_type;
+type proc_watermark_boost_factor, fs_type, proc_type;
+type proc_percpu_pagelist_high_fraction, fs_type, proc_type;
+# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
+type usermodehelper, fs_type, proc_type;
+type sysfs_usermodehelper, fs_type, sysfs_type;
+type proc_qtaguid_ctrl, fs_type, mlstrustedobject, proc_type;
+type proc_qtaguid_stat, fs_type, mlstrustedobject, proc_type;
+type proc_bluetooth_writable, fs_type, proc_type;
+type proc_abi, fs_type, proc_type;
+type proc_asound, fs_type, proc_type;
+type proc_bootconfig, fs_type, proc_type;
+type proc_bpf, fs_type, proc_type;
+type proc_buddyinfo, fs_type, proc_type;
+
+#line 37
+ type proc_cgroups, fs_type, proc_type;
+#line 39
+
+type proc_cmdline, fs_type, proc_type;
+type proc_cpu_alignment, fs_type, proc_type;
+type proc_cpuinfo, fs_type, proc_type;
+type proc_dirty, fs_type, proc_type;
+type proc_diskstats, fs_type, proc_type;
+type proc_extra_free_kbytes, fs_type, proc_type;
+type proc_filesystems, fs_type, proc_type;
+type proc_fs_verity, fs_type, proc_type;
+type proc_hostname, fs_type, proc_type;
+type proc_hung_task, fs_type, proc_type;
+type proc_interrupts, fs_type, proc_type;
+type proc_iomem, fs_type, proc_type;
+type proc_kallsyms, fs_type, proc_type;
+type proc_keys, fs_type, proc_type;
+type proc_kmsg, fs_type, proc_type;
+type proc_loadavg, fs_type, proc_type;
+type proc_locks, fs_type, proc_type;
+type proc_lowmemorykiller, fs_type, proc_type;
+type proc_max_map_count, fs_type, proc_type;
+type proc_meminfo, fs_type, proc_type;
+type proc_misc, fs_type, proc_type;
+type proc_modules, fs_type, proc_type;
+type proc_mounts, fs_type, proc_type;
+type proc_net, fs_type, proc_type, proc_net_type;
+type proc_net_tcp_udp, fs_type, proc_type;
+type proc_page_cluster, fs_type, proc_type;
+type proc_pagetypeinfo, fs_type, proc_type;
+type proc_panic, fs_type, proc_type;
+type proc_perf, fs_type, proc_type;
+type proc_pid_max, fs_type, proc_type;
+type proc_pipe_conf, fs_type, proc_type;
+type proc_pressure_cpu, fs_type, proc_type;
+type proc_pressure_io, fs_type, proc_type;
+type proc_pressure_mem, fs_type, proc_type;
+type proc_random, fs_type, proc_type;
+type proc_sched, fs_type, proc_type;
+type proc_slabinfo, fs_type, proc_type;
+type proc_stat, fs_type, proc_type;
+type proc_swaps, fs_type, proc_type;
+type proc_sysrq, fs_type, proc_type;
+type proc_timer, fs_type, proc_type;
+type proc_tty_drivers, fs_type, proc_type;
+type proc_uid_cputime_showstat, fs_type, proc_type;
+type proc_uid_cputime_removeuid, fs_type, proc_type;
+type proc_uid_io_stats, fs_type, proc_type;
+type proc_uid_procstat_set, fs_type, proc_type;
+type proc_uid_time_in_state, fs_type, proc_type;
+type proc_uid_concurrent_active_time, fs_type, proc_type;
+type proc_uid_concurrent_policy_time, fs_type, proc_type;
+type proc_uid_cpupower, fs_type, proc_type;
+type proc_uptime, fs_type, proc_type;
+type proc_version, fs_type, proc_type;
+type proc_vmallocinfo, fs_type, proc_type;
+type proc_vmstat, fs_type, proc_type;
+type proc_watermark_scale_factor, fs_type, proc_type;
+type proc_zoneinfo, fs_type, proc_type;
+type proc_vendor_sched, proc_type, fs_type;
+type selinuxfs, fs_type, mlstrustedobject;
+type fusectlfs, fs_type;
+type cgroup, fs_type, mlstrustedobject;
+type cgroup_v2, fs_type;
+type sysfs, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_android_usb, fs_type, sysfs_type;
+type sysfs_uio, sysfs_type, fs_type;
+type sysfs_batteryinfo, fs_type, sysfs_type;
+type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
+
+
+#line 107
+ type sysfs_cma, fs_type, sysfs_type;
+#line 109
+
+
+type sysfs_devfreq_cur, fs_type, sysfs_type;
+type sysfs_devfreq_dir, fs_type, sysfs_type;
+type sysfs_devices_block, fs_type, sysfs_type;
+type sysfs_dm, fs_type, sysfs_type;
+type sysfs_dm_verity, fs_type, sysfs_type;
+type sysfs_dma_heap, fs_type, sysfs_type;
+type sysfs_dmabuf_stats, fs_type, sysfs_type;
+type sysfs_dt_firmware_android, fs_type, sysfs_type;
+type sysfs_extcon, fs_type, sysfs_type;
+type sysfs_ion, fs_type, sysfs_type;
+type sysfs_ipv4, fs_type, sysfs_type;
+type sysfs_kernel_notes, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_leds, fs_type, sysfs_type;
+type sysfs_loop, fs_type, sysfs_type;
+type sysfs_gpu, fs_type, sysfs_type;
+type sysfs_hwrandom, fs_type, sysfs_type;
+type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_wake_lock, fs_type, sysfs_type;
+type sysfs_net, fs_type, sysfs_type;
+type sysfs_power, fs_type, sysfs_type;
+type sysfs_rtc, fs_type, sysfs_type;
+
+
+#line 133
+ type sysfs_mem_sleep, fs_type, sysfs_type;
+#line 135
+
+
+type sysfs_suspend_stats, fs_type, sysfs_type;
+type sysfs_switch, fs_type, sysfs_type;
+type sysfs_sync_on_suspend, fs_type, sysfs_type;
+type sysfs_transparent_hugepage, fs_type, sysfs_type;
+type sysfs_lru_gen_enabled, fs_type, sysfs_type;
+type sysfs_usb, fs_type, sysfs_type;
+type sysfs_wakeup, fs_type, sysfs_type;
+type sysfs_wakeup_reasons, fs_type, sysfs_type;
+type sysfs_fs_ext4_features, sysfs_type, fs_type;
+type sysfs_fs_f2fs, sysfs_type, fs_type;
+type sysfs_fs_fuse_bpf, sysfs_type, fs_type;
+type sysfs_fs_fuse_features, sysfs_type, fs_type;
+type sysfs_fs_incfs_features, sysfs_type, fs_type;
+type sysfs_fs_incfs_metrics, sysfs_type, fs_type;
+type sysfs_vendor_sched, sysfs_type, fs_type;
+#line 154
+
+type fs_bpf, fs_type, bpffs_type;
+# TODO: S+ fs_bpf_tethering (used by mainline) should be private
+type fs_bpf_tethering, fs_type, bpffs_type;
+type fs_bpf_vendor, fs_type, bpffs_type;
+
+type configfs, fs_type;
+# /sys/devices/cs_etm
+type sysfs_devices_cs_etm, fs_type, sysfs_type;
+# /sys/devices/system/cpu
+type sysfs_devices_system_cpu, fs_type, sysfs_type;
+# /sys/module/lowmemorykiller
+type sysfs_lowmemorykiller, fs_type, sysfs_type;
+# /sys/module/wlan/parameters/fwpath
+type sysfs_wlan_fwpath, fs_type, sysfs_type;
+type sysfs_vibrator, fs_type, sysfs_type;
+type sysfs_uhid, fs_type, sysfs_type;
+type sysfs_thermal, sysfs_type, fs_type;
+
+type sysfs_zram, fs_type, sysfs_type;
+type sysfs_zram_uevent, fs_type, sysfs_type;
+type inotify, fs_type, mlstrustedobject;
+type devpts, fs_type, mlstrustedobject;
+type tmpfs, fs_type;
+type shm, fs_type;
+type mqueue, fs_type;
+type fuse, fusefs_type, fs_type, mlstrustedobject;
+type fuseblk, sdcard_type, fusefs_type, fs_type, mlstrustedobject;
+type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
+type vfat, sdcard_type, fs_type, mlstrustedobject;
+type exfat, sdcard_type, fs_type, mlstrustedobject;
+type debugfs, fs_type, debugfs_type;
+type debugfs_kprobes, fs_type, debugfs_type;
+type debugfs_mmc, fs_type, debugfs_type;
+type debugfs_mm_events_tracing, fs_type, debugfs_type, tracefs_type;
+type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing_debug, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing_instances, fs_type, debugfs_type, tracefs_type;
+type debugfs_tracing_printk_formats, fs_type, debugfs_type, tracefs_type;
+type debugfs_wakeup_sources, fs_type, debugfs_type;
+type debugfs_wifi_tracing, fs_type, debugfs_type, tracefs_type;
+type securityfs, fs_type;
+
+type pstorefs, fs_type;
+type functionfs, fs_type, mlstrustedobject;
+type oemfs, fs_type, contextmount_type;
+type usbfs, fs_type;
+type binfmt_miscfs, fs_type;
+type app_fusefs, fs_type, fusefs_type, contextmount_type;
+
+# File types
+type unlabeled, file_type;
+
+# Default type for anything under /system.
+type system_file, system_file_type, file_type;
+# Default type for /system/asan.options
+type system_asan_options_file, system_file_type, file_type;
+# Type for /system/etc/event-log-tags (liblog implementation detail)
+type system_event_log_tags_file, system_file_type, file_type;
+# Default type for anything under /system/lib[64].
+type system_lib_file, system_file_type, file_type;
+# system libraries that are available only to bootstrap processes
+type system_bootstrap_lib_file, system_file_type, file_type;
+# Default type for the group file /system/etc/group.
+type system_group_file, system_file_type, file_type;
+# Default type for linker executable /system/bin/linker[64].
+type system_linker_exec, system_file_type, file_type;
+# Default type for linker config /system/etc/ld.config.*.
+type system_linker_config_file, system_file_type, file_type;
+# Default type for the passwd file /system/etc/passwd.
+type system_passwd_file, system_file_type, file_type;
+# Default type for linker config /system/etc/seccomp_policy/*.
+type system_seccomp_policy_file, system_file_type, file_type;
+# Default type for cacerts in /system/etc/security/cacerts/*.
+type system_security_cacerts_file, system_file_type, file_type;
+# Default type for /system/bin/tcpdump.
+type tcpdump_exec, system_file_type, exec_type, file_type;
+# Default type for zoneinfo files in /system/usr/share/zoneinfo/*.
+type system_zoneinfo_file, system_file_type, file_type;
+# Cgroups description file under /system/etc/cgroups.json or
+# API file under /system/etc/task_profiles/cgroups_*.json
+type cgroup_desc_file, system_file_type, file_type;
+#line 240
+
+# Vendor cgroups description file under /vendor/etc/cgroups.json
+type vendor_cgroup_desc_file, vendor_file_type, file_type;
+# Task profiles file under /system/etc/task_profiles.json or
+# API file under /system/etc/task_profiles/task_profiles_*.json
+type task_profiles_file, system_file_type, file_type;
+#line 249
+
+# Vendor task profiles file under /vendor/etc/task_profiles.json
+type vendor_task_profiles_file, vendor_file_type, file_type;
+# Type for /system/apex/com.android.art
+type art_apex_dir, system_file_type, file_type;
+# /linkerconfig(/.*)?
+type linkerconfig_file, file_type;
+# Control files under /data/incremental
+type incremental_control_file, file_type, data_file_type, core_data_file_type;
+# /oem/media/bootanimation.zip|shutdownanimation.zip|userspace-reboot.zip
+type bootanim_oem_file, file_type, system_file_type;
+
+# Default type for directories search for
+# HAL implementations
+type vendor_hal_file, vendor_file_type, file_type;
+# Default type for under /vendor or /system/vendor
+type vendor_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/app
+type vendor_app_file, vendor_file_type, file_type;
+# Default type for everything under /vendor/etc/
+type vendor_configs_file, vendor_file_type, file_type;
+# Default type for all *same process* HALs and their lib/bin dependencies.
+# e.g. libEGL_xxx.so, android.hardware.graphics.mapper@2.0-impl.so
+type same_process_hal_file, vendor_file_type, file_type;
+# Default type for vndk-sp libs. /vendor/lib/vndk-sp
+type vndk_sp_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/framework
+type vendor_framework_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/overlay
+type vendor_overlay_file, vendor_file_type, file_type;
+# Type for all vendor public libraries. These libs should only be exposed to
+# apps. ABI stability of these libs is vendor's responsibility.
+type vendor_public_lib_file, vendor_file_type, file_type;
+# Type for all vendor public libraries for system. These libs should only be exposed to
+# system. ABI stability of these libs is vendor's responsibility.
+type vendor_public_framework_file, vendor_file_type, file_type;
+# Type for all microdroid related files in the vendor partition.
+# Files having this type should be read-only.
+type vendor_microdroid_file, vendor_file_type, file_type;
+
+
+#line 289
+ # boot otas for 16KB developer option
+#line 289
+ type vendor_boot_ota_file, vendor_file_type, file_type;
+#line 292
+
+
+# Input configuration
+type vendor_keylayout_file, vendor_file_type, file_type;
+type vendor_keychars_file, vendor_file_type, file_type;
+type vendor_idc_file, vendor_file_type, file_type;
+
+# Type for vendor uuid mapping config file
+type vendor_uuid_mapping_config_file, vendor_file_type, file_type;
+
+# SoC-specific virtual machine disk files
+type vendor_vm_file, vendor_file_type, file_type;
+# SoC-specific virtual machine disk files that are mutable
+type vendor_vm_data_file, vendor_file_type, file_type;
+
+# /metadata partition itself
+type metadata_file, file_type;
+# Vold files within /metadata
+type vold_metadata_file, file_type;
+# GSI files within /metadata
+type gsi_metadata_file, gsi_metadata_file_type, file_type;
+# DSU (GSI) files within /metadata that are globally readable.
+type gsi_public_metadata_file, gsi_metadata_file_type, file_type;
+# system_server shares Weaver slot information in /metadata
+type password_slot_metadata_file, file_type;
+# APEX files within /metadata
+type apex_metadata_file, file_type;
+# libsnapshot files within /metadata
+type ota_metadata_file, file_type;
+# property files within /metadata/bootstat
+type metadata_bootstat_file, file_type;
+# userspace reboot files within /metadata/userspacereboot
+type userspace_reboot_metadata_file, file_type;
+# Staged install files within /metadata/staged-install
+type staged_install_file, file_type;
+# Metadata information within /metadata/watchdog
+type watchdog_metadata_file, file_type;
+# Repair mode files within /metadata/repair-mode
+type repair_mode_metadata_file, file_type;
+# Aconfig storage file
+type aconfig_storage_metadata_file, file_type;
+# Aconfig storage flag value persistent copy
+type aconfig_storage_flags_metadata_file, file_type;
+
+# Type for /dev/cpu_variant:.*.
+type dev_cpu_variant, file_type;
+# Speedup access for trusted applications to the runtime event tags
+type runtime_event_log_tags_file, file_type;
+# Type for /system/bin/logcat.
+type logcat_exec, system_file_type, exec_type, file_type;
+# Speedup access to cgroup map file
+type cgroup_rc_file, file_type;
+# /cores for coredumps on userdebug / eng builds
+type coredump_file, file_type;
+# Type of /data itself
+type system_data_root_file, file_type, data_file_type, core_data_file_type;
+# Default type for anything under /data.
+type system_data_file, file_type, data_file_type, core_data_file_type;
+# Default type for directories containing per-user encrypted directories, such
+# as /data/user and /data/user_de.
+type system_userdir_file, file_type, data_file_type, core_data_file_type;
+# Type for /data/system/packages.list.
+# TODO(b/129332765): Narrow down permissions to this.
+# Find out users of system_data_file that should be granted only this.
+type packages_list_file, file_type, data_file_type, core_data_file_type;
+type game_mode_intervention_list_file, file_type, data_file_type, core_data_file_type;
+# Default type for anything inside /data/vendor_{ce,de}.
+type vendor_data_file, file_type, data_file_type;
+# Type for /data/vendor_{ce,de} themselves. This has core_data_file_type
+# because these directories themselves are platform-managed; only the files
+# *inside* them are vendor data. (Somewhat similar to system_data_root_file.)
+type vendor_userdir_file, file_type, data_file_type, core_data_file_type;
+# Unencrypted data
+type unencrypted_data_file, file_type, data_file_type, core_data_file_type;
+# installd-create files in /data/misc/installd such as layout_version
+type install_data_file, file_type, data_file_type, core_data_file_type;
+# /data/drm - DRM plugin data
+type drm_data_file, file_type, data_file_type, core_data_file_type;
+# /data/adb - adb debugging files
+type adb_data_file, file_type, data_file_type, core_data_file_type;
+# /data/anr - ANR traces
+type anr_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/tombstones - core dumps
+type tombstone_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/vendor/tombstones/wifi - vendor wifi dumps
+type tombstone_wifi_data_file, file_type, data_file_type;
+# /data/apex - APEX data files
+type apex_data_file, file_type, data_file_type, core_data_file_type;
+# /data/app - user-installed apps
+type apk_data_file, file_type, data_file_type, core_data_file_type;
+type apk_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/app-private - forward-locked apps
+type apk_private_data_file, file_type, data_file_type, core_data_file_type;
+type apk_private_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/dalvik-cache
+type dalvikcache_data_file, file_type, data_file_type, core_data_file_type;
+# /data/ota
+type ota_data_file, file_type, data_file_type, core_data_file_type;
+# /data/ota_package
+type ota_package_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/misc/profiles
+type user_profile_root_file, file_type, data_file_type, core_data_file_type;
+type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/misc/profman
+type profman_dump_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/prereboot
+type prereboot_data_file, file_type, data_file_type, core_data_file_type;
+# /data/resource-cache
+type resourcecache_data_file, file_type, data_file_type, core_data_file_type;
+# /data/local - writable by shell
+type shell_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+# /data/property
+type property_data_file, file_type, data_file_type, core_data_file_type;
+# /data/bootchart
+type bootchart_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system/dropbox
+type dropbox_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system/heapdump
+type heapdump_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/nativetest
+type nativetest_data_file, file_type, data_file_type, core_data_file_type;
+# /data/local/tests
+type shell_test_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system_de/0/ringtones
+type ringtone_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/preloads
+type preloads_data_file, file_type, data_file_type, core_data_file_type;
+# /data/preloads/media
+type preloads_media_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/dhcp and /data/misc/dhcp-6.8.2
+type dhcp_data_file, file_type, data_file_type, core_data_file_type;
+# /data/server_configurable_flags
+type server_configurable_flags_data_file, file_type, data_file_type, core_data_file_type;
+# /data/app-staging
+type staging_data_file, file_type, data_file_type, core_data_file_type;
+# /vendor/apex
+type vendor_apex_file, vendor_file_type, file_type;
+# apex_manifest.pb in vendor apex
+type vendor_apex_metadata_file, vendor_file_type, file_type;
+# /data/system/shutdown-checkpoints
+type shutdown_checkpoints_system_data_file, file_type, data_file_type, core_data_file_type;
+
+# Mount locations managed by vold
+type mnt_media_rw_file, file_type;
+type mnt_user_file, file_type;
+type mnt_pass_through_file, file_type;
+type mnt_expand_file, file_type;
+type mnt_sdcard_file, file_type;
+type storage_file, file_type;
+
+# Label for storage dirs which are just mount stubs
+type mnt_media_rw_stub_file, file_type;
+type storage_stub_file, file_type;
+
+# Mount location for read-write vendor partitions.
+type mnt_vendor_file, file_type;
+
+# Mount location for read-write product partitions.
+type mnt_product_file, file_type;
+
+# Mount point used for APEX images
+type apex_mnt_dir, file_type;
+
+# /apex/apex-info-list.xml created by apexd
+type apex_info_file, file_type;
+
+# /postinstall: Mount point used by update_engine to run postinstall.
+type postinstall_mnt_dir, file_type;
+# Files inside the /postinstall mountpoint are all labeled as postinstall_file.
+type postinstall_file, file_type;
+# /postinstall/apex: Mount point used for APEX images within /postinstall.
+type postinstall_apex_mnt_dir, file_type;
+
+# /data_mirror: Contains mirror directory for storing all apps data.
+type mirror_data_file, file_type, core_data_file_type;
+
+# /data/misc subdirectories
+type adb_keys_file, file_type, data_file_type, core_data_file_type;
+type apex_system_server_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_module_data_file, file_type, data_file_type, core_data_file_type;
+type apex_ota_reserved_file, file_type, data_file_type, core_data_file_type;
+type apex_rollback_data_file, file_type, data_file_type, core_data_file_type;
+type appcompat_data_file, file_type, data_file_type, core_data_file_type;
+type audio_data_file, file_type, data_file_type, core_data_file_type;
+type audioserver_data_file, file_type, data_file_type, core_data_file_type;
+type bluetooth_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+type bluetooth_logs_data_file, file_type, data_file_type, core_data_file_type;
+type bootstat_data_file, file_type, data_file_type, core_data_file_type;
+type boottrace_data_file, file_type, data_file_type, core_data_file_type;
+type camera_data_file, file_type, data_file_type, core_data_file_type;
+type credstore_data_file, file_type, data_file_type, core_data_file_type;
+type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
+type incident_data_file, file_type, data_file_type, core_data_file_type;
+type keychain_data_file, file_type, data_file_type, core_data_file_type;
+type keystore_data_file, file_type, data_file_type, core_data_file_type;
+type media_data_file, file_type, data_file_type, core_data_file_type;
+type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type media_userdir_file, file_type, data_file_type, core_data_file_type;
+type misc_user_data_file, file_type, data_file_type, core_data_file_type;
+type net_data_file, file_type, data_file_type, core_data_file_type;
+type network_watchlist_data_file, file_type, data_file_type, core_data_file_type;
+type nfc_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+type nfc_logs_data_file, file_type, data_file_type, core_data_file_type;
+type radio_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+type recovery_data_file, file_type, data_file_type, core_data_file_type;
+type shared_relro_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type snapshotctl_log_data_file, file_type, data_file_type, core_data_file_type;
+type stats_config_data_file, file_type, data_file_type, core_data_file_type;
+type stats_data_file, file_type, data_file_type, core_data_file_type;
+type systemkeys_data_file, file_type, data_file_type, core_data_file_type;
+type textclassifier_data_file, file_type, data_file_type, core_data_file_type;
+type trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type vpn_data_file, file_type, data_file_type, core_data_file_type;
+type wifi_data_file, file_type, data_file_type, core_data_file_type;
+type vold_data_file, file_type, data_file_type, core_data_file_type;
+type tee_data_file, file_type, data_file_type;
+type update_engine_data_file, file_type, data_file_type, core_data_file_type;
+type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
+type snapuserd_log_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/trace for method traces on userdebug / eng builds
+type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type gsi_data_file, file_type, data_file_type, core_data_file_type;
+type radio_core_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/data subdirectories - app sandboxes
+type app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# /data/data subdirectories - priv-app sandboxes
+type privapp_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# /data/data subdirectory for system UID apps.
+type system_app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+# Compatibility with type name used in Android 4.3 and 4.4.
+# Default type for anything under /cache
+type cache_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for /cache/overlay /mnt/scratch/overlay
+type overlayfs_file, file_type, data_file_type, core_data_file_type;
+# Type for /cache/backup_stage/* (fd interchange with apps)
+type cache_backup_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# type for anything under /cache/backup (local transport storage)
+type cache_private_backup_file, file_type, data_file_type, core_data_file_type;
+# Type for anything under /cache/recovery
+type cache_recovery_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Default type for anything under /efs
+type efs_file, file_type;
+# Type for wallpaper file.
+type wallpaper_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for shortcut manager icon file.
+type shortcut_manager_icons, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for user icon file.
+type icon_file, file_type, data_file_type, core_data_file_type;
+# /mnt/asec
+type asec_apk_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Elements of asec files (/mnt/asec) that are world readable
+type asec_public_file, file_type, data_file_type, core_data_file_type;
+# /data/app-asec
+type asec_image_file, file_type, data_file_type, core_data_file_type;
+# /data/backup and /data/secure/backup
+type backup_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# All devices have bluetooth efs files. But they
+# vary per device, so this type is used in per
+# device policy
+type bluetooth_efs_file, file_type;
+# Type for fingerprint template file
+type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
+# Type for _new_ fingerprint template file
+type fingerprint_vendor_data_file, file_type, data_file_type;
+# Type for appfuse file.
+type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for face template file
+type face_vendor_data_file, file_type, data_file_type;
+# Type for iris template file
+type iris_vendor_data_file, file_type, data_file_type;
+
+# Socket types
+type adbd_socket, file_type, coredomain_socket;
+type bluetooth_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
+type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject;
+type dumpstate_socket, file_type, coredomain_socket;
+type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject;
+type lmkd_socket, file_type, coredomain_socket;
+type logd_socket, file_type, coredomain_socket, mlstrustedobject;
+type logdr_socket, file_type, coredomain_socket, mlstrustedobject;
+type logdw_socket, file_type, coredomain_socket, mlstrustedobject;
+type mdns_socket, file_type, coredomain_socket;
+type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject;
+type misc_logd_file, coredomain_socket, file_type, data_file_type, core_data_file_type;
+type mtpd_socket, file_type, coredomain_socket;
+type ot_daemon_socket, file_type, coredomain_socket;
+type property_socket, file_type, coredomain_socket, mlstrustedobject;
+type racoon_socket, file_type, coredomain_socket;
+type recovery_socket, file_type, coredomain_socket;
+type rild_socket, file_type;
+type rild_debug_socket, file_type;
+type snapuserd_socket, file_type, coredomain_socket;
+type snapuserd_proxy_socket, file_type, coredomain_socket;
+type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
+type system_wpa_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
+type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
+type system_unsolzygote_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
+type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
+type tombstoned_java_trace_socket, file_type, mlstrustedobject;
+type tombstoned_intercept_socket, file_type, coredomain_socket;
+type traced_consumer_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_perf_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject;
+type uncrypt_socket, file_type, coredomain_socket;
+type wpa_socket, file_type, data_file_type, core_data_file_type;
+type zygote_socket, file_type, coredomain_socket;
+type heapprofd_socket, file_type, coredomain_socket, mlstrustedobject;
+# UART (for GPS) control proc file
+type gps_control, file_type;
+
+# PDX endpoint types
+type pdx_display_dir, pdx_endpoint_dir_type, file_type;
+type pdx_performance_dir, pdx_endpoint_dir_type, file_type;
+type pdx_bufferhub_dir, pdx_endpoint_dir_type, file_type;
+
+
+#line 608
+typeattribute pdx_display_dir pdx_display_client_endpoint_dir_type;
+#line 608
+type pdx_display_client_endpoint_socket, pdx_display_client_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 608
+type pdx_display_client_channel_socket, pdx_display_client_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 608
+
+#line 608
+
+
+#line 609
+typeattribute pdx_display_dir pdx_display_manager_endpoint_dir_type;
+#line 609
+type pdx_display_manager_endpoint_socket, pdx_display_manager_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 609
+type pdx_display_manager_channel_socket, pdx_display_manager_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 609
+
+#line 609
+
+
+#line 610
+typeattribute pdx_display_dir pdx_display_screenshot_endpoint_dir_type;
+#line 610
+type pdx_display_screenshot_endpoint_socket, pdx_display_screenshot_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 610
+type pdx_display_screenshot_channel_socket, pdx_display_screenshot_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 610
+
+#line 610
+
+
+#line 611
+typeattribute pdx_display_dir pdx_display_vsync_endpoint_dir_type;
+#line 611
+type pdx_display_vsync_endpoint_socket, pdx_display_vsync_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 611
+type pdx_display_vsync_channel_socket, pdx_display_vsync_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 611
+
+#line 611
+
+
+#line 612
+typeattribute pdx_performance_dir pdx_performance_client_endpoint_dir_type;
+#line 612
+type pdx_performance_client_endpoint_socket, pdx_performance_client_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 612
+type pdx_performance_client_channel_socket, pdx_performance_client_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 612
+
+#line 612
+
+
+#line 613
+typeattribute pdx_bufferhub_dir pdx_bufferhub_client_endpoint_dir_type;
+#line 613
+type pdx_bufferhub_client_endpoint_socket, pdx_bufferhub_client_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+#line 613
+type pdx_bufferhub_client_channel_socket, pdx_bufferhub_client_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+#line 613
+
+#line 613
+
+
+# file_contexts files
+type file_contexts_file, system_file_type, file_type;
+
+# mac_permissions file
+type mac_perms_file, system_file_type, file_type;
+
+# property_contexts file
+type property_contexts_file, system_file_type, file_type;
+
+# seapp_contexts file
+type seapp_contexts_file, system_file_type, file_type;
+
+# sepolicy files binary and others
+type sepolicy_file, system_file_type, file_type;
+
+# service_contexts file
+type service_contexts_file, system_file_type, file_type;
+
+# keystore2_key_contexts_file
+type keystore2_key_contexts_file, system_file_type, file_type;
+
+# vendor service_contexts file
+type vendor_service_contexts_file, vendor_file_type, file_type;
+
+# hwservice_contexts file
+type hwservice_contexts_file, system_file_type, file_type;
+
+# vndservice_contexts file
+type vndservice_contexts_file, file_type;
+
+# /sys/kernel/tracing/instances/bootreceiver for monitoring kernel memory corruptions.
+type debugfs_bootreceiver_tracing, fs_type, debugfs_type, tracefs_type;
+
+# kernel modules
+type vendor_kernel_modules, vendor_file_type, file_type;
+
+# system_dlkm
+type system_dlkm_file, system_dlkm_file_type, file_type;
+
+# asanwrapper (run a sanitized app_process, to be used with wrap properties)
+
+
+# Deprecated in SDK version 28
+type audiohal_data_file, file_type, data_file_type, core_data_file_type;
+
+
+#line 660
+ type sysfs_udc, fs_type, sysfs_type;
+#line 660
+ type tee_service_contexts_file, system_file_type, file_type;
+#line 663
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/fingerprintd.te"
+type fingerprintd, domain;
+type fingerprintd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/flags_health_check.te"
+# The flags_health_check command run by init.
+type flags_health_check, domain, coredomain;
+type flags_health_check_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/fsck.te"
+# Any fsck program run by init
+type fsck, domain;
+type fsck_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/fsck_untrusted.te"
+# Any fsck program run on untrusted block devices
+type fsck_untrusted, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/gatekeeperd.te"
+type gatekeeperd, domain;
+type gatekeeperd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/gmscore_app.te"
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+
+type gmscore_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/gpuservice.te"
+# gpuservice - server for gpu stats and other gpu related services
+type gpuservice, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/hal_graphics_composer.te"
+type hal_graphics_composer_server_tmpfs, file_type;
+attribute hal_graphics_composer_client_tmpfs;
+expandattribute hal_graphics_composer_client_tmpfs true;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/healthd.te"
+# healthd - battery/charger monitoring service daemon
+# healthd is removed. The type is kept for backwards compatibility.
+type healthd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/heapprofd.te"
+type heapprofd, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/hwservice.te"
+# hwservice types. By default most of the HALs are protected_hwservice, which means
+# access from untrusted apps is prohibited.
+type default_android_hwservice, hwservice_manager_type, protected_hwservice;
+type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_stats_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_automotive_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type hal_atrace_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audiocontrol_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_authsecret_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bluetooth_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bootctl_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_broadcastradio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_camera_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_bus_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_controller_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_confirmationui_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_contexthub_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_dumpstate_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_evs_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_face_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_fingerprint_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gatekeeper_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gnss_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_graphics_composer_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_storage_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_input_classifier_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_ir_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_keymaster_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_light_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_lowpan_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_memtrack_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_nfc_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_oemlock_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_stats_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_secure_element_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_sensors_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_telephony_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tetheroffload_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_thermal_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_cec_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_input_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_tuner_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_gadget_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vehicle_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vibrator_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vr_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_weaver_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hostapd_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_supplicant_hwservice, hwservice_manager_type, protected_hwservice;
+type system_net_netd_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_suspend_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_wifi_keystore_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+
+# Following is the hwservices that are explicitly not marked with protected_hwservice.
+# These are directly accessible from untrusted apps.
+# - same process services: because they by definition run in the process
+# of the client and thus have the same access as the client domain in which
+# the process runs
+# - coredomain_hwservice: are considered safer than ordinary hwservices which
+# are from vendor partition
+# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been
+# designed for use by any domain.
+# - hal_graphics_allocator_hwservice: because these operations are also offered
+# by surfaceflinger Binder service, which apps are permitted to access
+# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
+# Binder service which apps were permitted to access.
+# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
+# - hal_drm_hwservice: versions > API 29 are designed specifically with
+# untrusted app access in mind.
+type fwk_bufferhub_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hal_cas_hwservice, hwservice_manager_type;
+type hal_codec2_hwservice, hwservice_manager_type;
+type hal_configstore_ISurfaceFlingerConfigs, hwservice_manager_type;
+type hal_drm_hwservice, hwservice_manager_type;
+type hal_graphics_allocator_hwservice, hwservice_manager_type;
+type hal_graphics_mapper_hwservice, hwservice_manager_type, same_process_hwservice;
+type hal_neuralnetworks_hwservice, hwservice_manager_type;
+type hal_omx_hwservice, hwservice_manager_type;
+type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice;
+type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_base_hwservice, hwservice_manager_type;
+type hidl_manager_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_memory_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_token_hwservice, hwservice_manager_type, coredomain_hwservice;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/hwservicemanager.te"
+# hwservicemanager - the Binder context manager for HAL services
+type hwservicemanager, domain, mlstrustedsubject;
+type hwservicemanager_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/idmap.te"
+# idmap, when executed by installd
+type idmap, domain;
+type idmap_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/incident.te"
+# The incident command is used to call into the incidentd service to
+# take an incident report (binary, shared bugreport), download incident
+# reports that have already been taken, and monitor for new ones.
+# It doesn't do anything else.
+
+# incident
+type incident, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/incident_helper.te"
+# The incident_helper is called by incidentd and
+# can only read/write data from/to incidentd
+
+# incident_helper
+type incident_helper, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/incidentd.te"
+# incidentd
+type incidentd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/init.te"
+# init is its own domain.
+type init, domain, mlstrustedsubject;
+type init_exec, system_file_type, exec_type, file_type;
+type init_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/inputflinger.te"
+# inputflinger
+type inputflinger, domain;
+type inputflinger_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/installd.te"
+# installer daemon
+type installd, domain;
+type installd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/isolated_app.te"
+###
+### Services with isolatedProcess=true in their manifest.
+###
+### This file defines the rules for isolated apps. An "isolated
+### app" is an APP with UID between AID_ISOLATED_START (99000)
+### and AID_ISOLATED_END (99999).
+###
+
+type isolated_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/isolated_compute_app.te"
+type isolated_compute_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/kernel.te"
+# Life begins with the kernel.
+type kernel, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/keystore.te"
+# keystore daemon
+type keystore, domain, keystore2_key_type;
+type keystore_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/keystore_keys.te"
+# A keystore2 namespace for WI-FI.
+type wifi_key, keystore2_key_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/llkd.te"
+# llkd Live LocK Daemon
+type llkd, domain, mlstrustedsubject;
+type llkd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/lmkd.te"
+# lmkd low memory killer daemon
+type lmkd, domain, mlstrustedsubject;
+type lmkd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/logd.te"
+# android user-space log manager
+type logd, domain, mlstrustedsubject;
+type logd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/logpersist.te"
+# android debug logging, logpersist domains
+type logpersist, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mdnsd.te"
+# mdns daemon
+type mdnsd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediadrmserver.te"
+# mediadrmserver - mediadrm daemon
+type mediadrmserver, domain;
+type mediadrmserver_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediaextractor.te"
+# mediaextractor - multimedia daemon
+type mediaextractor, domain;
+type mediaextractor_exec, system_file_type, exec_type, file_type;
+type mediaextractor_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediametrics.te"
+# mediametrics - daemon for collecting media.metrics data
+type mediametrics, domain;
+type mediametrics_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediaprovider.te"
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+type mediaprovider, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediaserver.te"
+# mediaserver - multimedia daemon
+type mediaserver, domain;
+type mediaserver_exec, system_file_type, exec_type, file_type;
+type mediaserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediaswcodec.te"
+type mediaswcodec, domain;
+type mediaswcodec_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mediatranscoding.te"
+type mediatranscoding, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/modprobe.te"
+type modprobe, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/mtp.te"
+# vpn tunneling protocol manager
+type mtp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/net.te"
+## Network types
+type node, node_type;
+type netif, netif_type;
+type port, port_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/netd.te"
+# network manager
+type netd, domain, mlstrustedsubject;
+type netd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/netutils_wrapper.te"
+type netutils_wrapper, domain;
+type netutils_wrapper_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/network_stack.te"
+# Network stack service app
+type network_stack, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/nfc.te"
+# nfc subsystem
+type nfc, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/otapreopt_chroot.te"
+# otapreopt_chroot seclabel
+
+# TODO: Only present to allow mediatek/wembley-sepolicy to see it for validation reasons.
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/perfetto.te"
+type perfetto, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/performanced.te"
+# performanced
+type performanced, domain, mlstrustedsubject;
+type performanced_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/platform_app.te"
+###
+### Apps signed with the platform key.
+###
+
+type platform_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/postinstall.te"
+# Domain where the postinstall program runs during the update.
+# Extend the permissions in this domain to allow this program to access other
+# files needed by the specific device on your device's sepolicy directory.
+type postinstall, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/ppp.te"
+# Point to Point Protocol daemon
+type ppp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/priv_app.te"
+###
+### A domain for further sandboxing privileged apps.
+###
+
+type priv_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/prng_seeder.te"
+# PRNG seeder daemon
+type prng_seeder, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/profman.te"
+# profman
+type profman, domain;
+type profman_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/property.te"
+# Properties used only in /system
+#
+# DO NOT ADD system_internal_prop here.
+# Instead, add to private/property.te.
+# TODO(b/150331497): move these to private/property.te
+
+#line 6
+
+#line 6
+ type apexd_prop, property_type, system_property_type, system_internal_property_type;
+#line 6
+
+#line 6
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 6
+
+#line 6
+ neverallow { domain -coredomain } apexd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+
+#line 6
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+ type bootloader_boot_reason_prop, property_type, system_property_type, system_internal_property_type;
+#line 7
+
+#line 7
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 7
+
+#line 7
+ neverallow { domain -coredomain } bootloader_boot_reason_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+
+#line 7
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 7
+
+#line 7
+
+
+#line 8
+
+#line 8
+ type device_config_activity_manager_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 8
+
+#line 8
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 8
+
+#line 8
+ neverallow { domain -coredomain } device_config_activity_manager_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 8
+
+#line 8
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 8
+
+#line 8
+
+
+#line 9
+
+#line 9
+ type device_config_boot_count_prop, property_type, system_property_type, system_internal_property_type;
+#line 9
+
+#line 9
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 9
+
+#line 9
+ neverallow { domain -coredomain } device_config_boot_count_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+
+#line 9
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+ type device_config_input_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 10
+
+#line 10
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 10
+
+#line 10
+ neverallow { domain -coredomain } device_config_input_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 10
+
+#line 10
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+ type device_config_netd_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 11
+
+#line 11
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 11
+
+#line 11
+ neverallow { domain -coredomain } device_config_netd_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 11
+
+#line 11
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 11
+
+#line 11
+
+
+#line 12
+
+#line 12
+ type device_config_reset_performed_prop, property_type, system_property_type, system_internal_property_type;
+#line 12
+
+#line 12
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 12
+
+#line 12
+ neverallow { domain -coredomain } device_config_reset_performed_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 12
+
+#line 12
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 12
+
+#line 12
+
+
+#line 13
+
+#line 13
+ type firstboot_prop, property_type, system_property_type, system_internal_property_type;
+#line 13
+
+#line 13
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 13
+
+#line 13
+ neverallow { domain -coredomain } firstboot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+
+#line 13
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 13
+
+#line 13
+
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ # DO NOT ADD ANY PROPERTIES HERE
+#line 15
+
+#line 15
+
+#line 15
+ type boottime_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } boottime_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type charger_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } charger_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type cold_boot_done_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } cold_boot_done_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_adbd_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_adbd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_apexd_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_apexd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_bootanim_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_bootanim_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_bugreport_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_bugreport_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_console_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_console_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_dumpstate_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_dumpstate_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_fuse_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_fuse_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_gsid_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_gsid_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_interface_restart_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_interface_restart_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_interface_stop_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_interface_stop_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_mdnsd_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_mdnsd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_restart_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_restart_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_rildaemon_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_rildaemon_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type ctl_sigstop_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } ctl_sigstop_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type dynamic_system_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } dynamic_system_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type heapprofd_enabled_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } heapprofd_enabled_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type llkd_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } llkd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type lpdumpd_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } lpdumpd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type mmc_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } mmc_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type mock_ota_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } mock_ota_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type net_dns_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } net_dns_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type overlay_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } overlay_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type persistent_properties_ready_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } persistent_properties_ready_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type safemode_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } safemode_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type system_lmk_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } system_lmk_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type system_trace_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } system_trace_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type test_boot_reason_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } test_boot_reason_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type time_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } time_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type traced_enabled_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } traced_enabled_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+ type traced_lazy_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } traced_lazy_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 50
+
+
+# Properties which can't be written outside system
+
+#line 53
+
+#line 53
+ type aac_drc_prop, property_type, system_property_type, system_restricted_property_type;
+#line 53
+
+#line 53
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 53
+
+#line 53
+ neverallow { domain -coredomain } aac_drc_prop:property_service set;
+#line 53
+
+#line 53
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 53
+
+#line 53
+
+
+#line 54
+
+#line 54
+ type adaptive_haptics_prop, property_type, system_property_type, system_restricted_property_type;
+#line 54
+
+#line 54
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 54
+
+#line 54
+ neverallow { domain -coredomain } adaptive_haptics_prop:property_service set;
+#line 54
+
+#line 54
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 54
+
+#line 54
+
+
+#line 55
+
+#line 55
+ type apex_ready_prop, property_type, system_property_type, system_restricted_property_type;
+#line 55
+
+#line 55
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 55
+
+#line 55
+ neverallow { domain -coredomain } apex_ready_prop:property_service set;
+#line 55
+
+#line 55
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 55
+
+#line 55
+
+
+#line 56
+
+#line 56
+ type arm64_memtag_prop, property_type, system_property_type, system_restricted_property_type;
+#line 56
+
+#line 56
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 56
+
+#line 56
+ neverallow { domain -coredomain } arm64_memtag_prop:property_service set;
+#line 56
+
+#line 56
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 56
+
+#line 56
+
+
+#line 57
+
+#line 57
+ type binder_cache_bluetooth_server_prop, property_type, system_property_type, system_restricted_property_type;
+#line 57
+
+#line 57
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 57
+
+#line 57
+ neverallow { domain -coredomain } binder_cache_bluetooth_server_prop:property_service set;
+#line 57
+
+#line 57
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 57
+
+#line 57
+
+
+#line 58
+
+#line 58
+ type binder_cache_system_server_prop, property_type, system_property_type, system_restricted_property_type;
+#line 58
+
+#line 58
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 58
+
+#line 58
+ neverallow { domain -coredomain } binder_cache_system_server_prop:property_service set;
+#line 58
+
+#line 58
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 58
+
+#line 58
+
+
+#line 59
+
+#line 59
+ type binder_cache_telephony_server_prop, property_type, system_property_type, system_restricted_property_type;
+#line 59
+
+#line 59
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 59
+
+#line 59
+ neverallow { domain -coredomain } binder_cache_telephony_server_prop:property_service set;
+#line 59
+
+#line 59
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 59
+
+#line 59
+
+
+#line 60
+
+#line 60
+ type boot_status_prop, property_type, system_property_type, system_restricted_property_type;
+#line 60
+
+#line 60
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 60
+
+#line 60
+ neverallow { domain -coredomain } boot_status_prop:property_service set;
+#line 60
+
+#line 60
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 60
+
+#line 60
+
+
+#line 61
+
+#line 61
+ type bootanim_system_prop, property_type, system_property_type, system_restricted_property_type;
+#line 61
+
+#line 61
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 61
+
+#line 61
+ neverallow { domain -coredomain } bootanim_system_prop:property_service set;
+#line 61
+
+#line 61
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 61
+
+#line 61
+
+
+#line 62
+
+#line 62
+ type bootloader_prop, property_type, system_property_type, system_restricted_property_type;
+#line 62
+
+#line 62
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 62
+
+#line 62
+ neverallow { domain -coredomain } bootloader_prop:property_service set;
+#line 62
+
+#line 62
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 62
+
+#line 62
+
+
+#line 63
+
+#line 63
+ type boottime_public_prop, property_type, system_property_type, system_restricted_property_type;
+#line 63
+
+#line 63
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 63
+
+#line 63
+ neverallow { domain -coredomain } boottime_public_prop:property_service set;
+#line 63
+
+#line 63
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 63
+
+#line 63
+
+
+#line 64
+
+#line 64
+ type bq_config_prop, property_type, system_property_type, system_restricted_property_type;
+#line 64
+
+#line 64
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 64
+
+#line 64
+ neverallow { domain -coredomain } bq_config_prop:property_service set;
+#line 64
+
+#line 64
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 64
+
+#line 64
+
+
+#line 65
+
+#line 65
+ type build_bootimage_prop, property_type, system_property_type, system_restricted_property_type;
+#line 65
+
+#line 65
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 65
+
+#line 65
+ neverallow { domain -coredomain } build_bootimage_prop:property_service set;
+#line 65
+
+#line 65
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 65
+
+#line 65
+
+
+#line 66
+
+#line 66
+ type build_prop, property_type, system_property_type, system_restricted_property_type;
+#line 66
+
+#line 66
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 66
+
+#line 66
+ neverallow { domain -coredomain } build_prop:property_service set;
+#line 66
+
+#line 66
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 66
+
+#line 66
+
+
+#line 67
+
+#line 67
+ type composd_vm_art_prop, property_type, system_property_type, system_restricted_property_type;
+#line 67
+
+#line 67
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 67
+
+#line 67
+ neverallow { domain -coredomain } composd_vm_art_prop:property_service set;
+#line 67
+
+#line 67
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 67
+
+#line 67
+
+
+#line 68
+
+#line 68
+ type device_config_aconfig_flags_prop, property_type, system_property_type, system_restricted_property_type;
+#line 68
+
+#line 68
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 68
+
+#line 68
+ neverallow { domain -coredomain } device_config_aconfig_flags_prop:property_service set;
+#line 68
+
+#line 68
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 68
+
+#line 68
+
+
+#line 69
+
+#line 69
+ type device_config_camera_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 69
+
+#line 69
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 69
+
+#line 69
+ neverallow { domain -coredomain } device_config_camera_native_prop:property_service set;
+#line 69
+
+#line 69
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 69
+
+#line 69
+
+
+#line 70
+
+#line 70
+ type device_config_edgetpu_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 70
+
+#line 70
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 70
+
+#line 70
+ neverallow { domain -coredomain } device_config_edgetpu_native_prop:property_service set;
+#line 70
+
+#line 70
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 70
+
+#line 70
+
+
+#line 71
+
+#line 71
+ type device_config_media_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 71
+
+#line 71
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 71
+
+#line 71
+ neverallow { domain -coredomain } device_config_media_native_prop:property_service set;
+#line 71
+
+#line 71
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 71
+
+#line 71
+
+
+#line 72
+
+#line 72
+ type device_config_nnapi_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 72
+
+#line 72
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 72
+
+#line 72
+ neverallow { domain -coredomain } device_config_nnapi_native_prop:property_service set;
+#line 72
+
+#line 72
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 72
+
+#line 72
+
+
+#line 73
+
+#line 73
+ type device_config_runtime_native_boot_prop, property_type, system_property_type, system_restricted_property_type;
+#line 73
+
+#line 73
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 73
+
+#line 73
+ neverallow { domain -coredomain } device_config_runtime_native_boot_prop:property_service set;
+#line 73
+
+#line 73
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 73
+
+#line 73
+
+
+#line 74
+
+#line 74
+ type device_config_runtime_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 74
+
+#line 74
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 74
+
+#line 74
+ neverallow { domain -coredomain } device_config_runtime_native_prop:property_service set;
+#line 74
+
+#line 74
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 74
+
+#line 74
+
+
+#line 75
+
+#line 75
+ type device_config_surface_flinger_native_boot_prop, property_type, system_property_type, system_restricted_property_type;
+#line 75
+
+#line 75
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 75
+
+#line 75
+ neverallow { domain -coredomain } device_config_surface_flinger_native_boot_prop:property_service set;
+#line 75
+
+#line 75
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 75
+
+#line 75
+
+
+#line 76
+
+#line 76
+ type device_config_vendor_system_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 76
+
+#line 76
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 76
+
+#line 76
+ neverallow { domain -coredomain } device_config_vendor_system_native_prop:property_service set;
+#line 76
+
+#line 76
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 76
+
+#line 76
+
+
+#line 77
+
+#line 77
+ type device_config_vendor_system_native_boot_prop, property_type, system_property_type, system_restricted_property_type;
+#line 77
+
+#line 77
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 77
+
+#line 77
+ neverallow { domain -coredomain } device_config_vendor_system_native_boot_prop:property_service set;
+#line 77
+
+#line 77
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 77
+
+#line 77
+
+
+#line 78
+
+#line 78
+ type drm_forcel3_prop, property_type, system_property_type, system_restricted_property_type;
+#line 78
+
+#line 78
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 78
+
+#line 78
+ neverallow { domain -coredomain } drm_forcel3_prop:property_service set;
+#line 78
+
+#line 78
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 78
+
+#line 78
+
+
+#line 79
+
+#line 79
+ type fingerprint_prop, property_type, system_property_type, system_restricted_property_type;
+#line 79
+
+#line 79
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 79
+
+#line 79
+ neverallow { domain -coredomain } fingerprint_prop:property_service set;
+#line 79
+
+#line 79
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 79
+
+#line 79
+
+
+#line 80
+
+#line 80
+ type gwp_asan_prop, property_type, system_property_type, system_restricted_property_type;
+#line 80
+
+#line 80
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 80
+
+#line 80
+ neverallow { domain -coredomain } gwp_asan_prop:property_service set;
+#line 80
+
+#line 80
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 80
+
+#line 80
+
+
+#line 81
+
+#line 81
+ type hal_instrumentation_prop, property_type, system_property_type, system_restricted_property_type;
+#line 81
+
+#line 81
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 81
+
+#line 81
+ neverallow { domain -coredomain } hal_instrumentation_prop:property_service set;
+#line 81
+
+#line 81
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 81
+
+#line 81
+
+
+#line 82
+
+#line 82
+ type userdebug_or_eng_prop, property_type, system_property_type, system_restricted_property_type;
+#line 82
+
+#line 82
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 82
+
+#line 82
+ neverallow { domain -coredomain } userdebug_or_eng_prop:property_service set;
+#line 82
+
+#line 82
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 82
+
+#line 82
+
+
+#line 83
+
+#line 83
+ type init_service_status_prop, property_type, system_property_type, system_restricted_property_type;
+#line 83
+
+#line 83
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 83
+
+#line 83
+ neverallow { domain -coredomain } init_service_status_prop:property_service set;
+#line 83
+
+#line 83
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 83
+
+#line 83
+
+
+#line 84
+
+#line 84
+ type libc_debug_prop, property_type, system_property_type, system_restricted_property_type;
+#line 84
+
+#line 84
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 84
+
+#line 84
+ neverallow { domain -coredomain } libc_debug_prop:property_service set;
+#line 84
+
+#line 84
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 84
+
+#line 84
+
+
+#line 85
+
+#line 85
+ type module_sdkextensions_prop, property_type, system_property_type, system_restricted_property_type;
+#line 85
+
+#line 85
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 85
+
+#line 85
+ neverallow { domain -coredomain } module_sdkextensions_prop:property_service set;
+#line 85
+
+#line 85
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 85
+
+#line 85
+
+
+#line 86
+
+#line 86
+ type nnapi_ext_deny_product_prop, property_type, system_property_type, system_restricted_property_type;
+#line 86
+
+#line 86
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 86
+
+#line 86
+ neverallow { domain -coredomain } nnapi_ext_deny_product_prop:property_service set;
+#line 86
+
+#line 86
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 86
+
+#line 86
+
+
+#line 87
+
+#line 87
+ type persist_wm_debug_prop, property_type, system_property_type, system_restricted_property_type;
+#line 87
+
+#line 87
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 87
+
+#line 87
+ neverallow { domain -coredomain } persist_wm_debug_prop:property_service set;
+#line 87
+
+#line 87
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 87
+
+#line 87
+
+
+#line 88
+
+#line 88
+ type power_debug_prop, property_type, system_property_type, system_restricted_property_type;
+#line 88
+
+#line 88
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 88
+
+#line 88
+ neverallow { domain -coredomain } power_debug_prop:property_service set;
+#line 88
+
+#line 88
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 88
+
+#line 88
+
+
+#line 89
+
+#line 89
+ type property_service_version_prop, property_type, system_property_type, system_restricted_property_type;
+#line 89
+
+#line 89
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 89
+
+#line 89
+ neverallow { domain -coredomain } property_service_version_prop:property_service set;
+#line 89
+
+#line 89
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 89
+
+#line 89
+
+
+#line 90
+
+#line 90
+ type provisioned_prop, property_type, system_property_type, system_restricted_property_type;
+#line 90
+
+#line 90
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 90
+
+#line 90
+ neverallow { domain -coredomain } provisioned_prop:property_service set;
+#line 90
+
+#line 90
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 90
+
+#line 90
+
+
+#line 91
+
+#line 91
+ type restorecon_prop, property_type, system_property_type, system_restricted_property_type;
+#line 91
+
+#line 91
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 91
+
+#line 91
+ neverallow { domain -coredomain } restorecon_prop:property_service set;
+#line 91
+
+#line 91
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 91
+
+#line 91
+
+
+#line 92
+
+#line 92
+ type retaildemo_prop, property_type, system_property_type, system_restricted_property_type;
+#line 92
+
+#line 92
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 92
+
+#line 92
+ neverallow { domain -coredomain } retaildemo_prop:property_service set;
+#line 92
+
+#line 92
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 92
+
+#line 92
+
+
+#line 93
+
+#line 93
+ type servicemanager_prop, property_type, system_property_type, system_restricted_property_type;
+#line 93
+
+#line 93
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 93
+
+#line 93
+ neverallow { domain -coredomain } servicemanager_prop:property_service set;
+#line 93
+
+#line 93
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 93
+
+#line 93
+
+
+#line 94
+
+#line 94
+ type smart_idle_maint_enabled_prop, property_type, system_property_type, system_restricted_property_type;
+#line 94
+
+#line 94
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 94
+
+#line 94
+ neverallow { domain -coredomain } smart_idle_maint_enabled_prop:property_service set;
+#line 94
+
+#line 94
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 94
+
+#line 94
+
+
+#line 95
+
+#line 95
+ type socket_hook_prop, property_type, system_property_type, system_restricted_property_type;
+#line 95
+
+#line 95
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 95
+
+#line 95
+ neverallow { domain -coredomain } socket_hook_prop:property_service set;
+#line 95
+
+#line 95
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 95
+
+#line 95
+
+
+#line 96
+
+#line 96
+ type sqlite_log_prop, property_type, system_property_type, system_restricted_property_type;
+#line 96
+
+#line 96
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 96
+
+#line 96
+ neverallow { domain -coredomain } sqlite_log_prop:property_service set;
+#line 96
+
+#line 96
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 96
+
+#line 96
+
+
+#line 97
+
+#line 97
+ type surfaceflinger_display_prop, property_type, system_property_type, system_restricted_property_type;
+#line 97
+
+#line 97
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 97
+
+#line 97
+ neverallow { domain -coredomain } surfaceflinger_display_prop:property_service set;
+#line 97
+
+#line 97
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 97
+
+#line 97
+
+
+#line 98
+
+#line 98
+ type system_boot_reason_prop, property_type, system_property_type, system_restricted_property_type;
+#line 98
+
+#line 98
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 98
+
+#line 98
+ neverallow { domain -coredomain } system_boot_reason_prop:property_service set;
+#line 98
+
+#line 98
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 98
+
+#line 98
+
+
+#line 99
+
+#line 99
+ type system_jvmti_agent_prop, property_type, system_property_type, system_restricted_property_type;
+#line 99
+
+#line 99
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 99
+
+#line 99
+ neverallow { domain -coredomain } system_jvmti_agent_prop:property_service set;
+#line 99
+
+#line 99
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 99
+
+#line 99
+
+
+#line 100
+
+#line 100
+ type traced_oome_heap_session_count_prop, property_type, system_property_type, system_restricted_property_type;
+#line 100
+
+#line 100
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 100
+
+#line 100
+ neverallow { domain -coredomain } traced_oome_heap_session_count_prop:property_service set;
+#line 100
+
+#line 100
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 100
+
+#line 100
+
+
+#line 101
+
+#line 101
+ type ab_update_gki_prop, property_type, system_property_type, system_restricted_property_type;
+#line 101
+
+#line 101
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 101
+
+#line 101
+ neverallow { domain -coredomain } ab_update_gki_prop:property_service set;
+#line 101
+
+#line 101
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 101
+
+#line 101
+
+
+#line 102
+
+#line 102
+ type usb_prop, property_type, system_property_type, system_restricted_property_type;
+#line 102
+
+#line 102
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 102
+
+#line 102
+ neverallow { domain -coredomain } usb_prop:property_service set;
+#line 102
+
+#line 102
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 102
+
+#line 102
+
+
+#line 103
+
+#line 103
+ type userspace_reboot_exported_prop, property_type, system_property_type, system_restricted_property_type;
+#line 103
+
+#line 103
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 103
+
+#line 103
+ neverallow { domain -coredomain } userspace_reboot_exported_prop:property_service set;
+#line 103
+
+#line 103
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 103
+
+#line 103
+
+
+#line 104
+
+#line 104
+ type vold_status_prop, property_type, system_property_type, system_restricted_property_type;
+#line 104
+
+#line 104
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 104
+
+#line 104
+ neverallow { domain -coredomain } vold_status_prop:property_service set;
+#line 104
+
+#line 104
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 104
+
+#line 104
+
+
+#line 105
+
+#line 105
+ type vts_status_prop, property_type, system_property_type, system_restricted_property_type;
+#line 105
+
+#line 105
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 105
+
+#line 105
+ neverallow { domain -coredomain } vts_status_prop:property_service set;
+#line 105
+
+#line 105
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 105
+
+#line 105
+
+
+
+#line 107
+
+#line 107
+
+#line 107
+ type enable_16k_pages_prop, property_type, system_property_type, system_restricted_property_type;
+#line 107
+
+#line 107
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 107
+
+#line 107
+ neverallow { domain -coredomain } enable_16k_pages_prop:property_service set;
+#line 107
+
+#line 107
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 107
+
+#line 107
+
+#line 107
+
+#line 107
+
+#line 107
+ type profcollectd_etr_prop, property_type, system_property_type, system_restricted_property_type;
+#line 107
+
+#line 107
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 107
+
+#line 107
+ neverallow { domain -coredomain } profcollectd_etr_prop:property_service set;
+#line 107
+
+#line 107
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 107
+
+#line 107
+
+#line 110
+
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ # DO NOT ADD ANY PROPERTIES HERE
+#line 112
+
+#line 112
+
+#line 112
+ type config_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } config_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type cppreopt_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } cppreopt_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type dalvik_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } dalvik_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type debuggerd_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } debuggerd_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type device_logging_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } device_logging_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type dhcp_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } dhcp_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type dumpstate_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } dumpstate_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type exported3_system_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } exported3_system_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type exported_dumpstate_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } exported_dumpstate_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type exported_secure_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } exported_secure_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type heapprofd_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } heapprofd_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type net_radio_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } net_radio_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type pan_result_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } pan_result_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type persist_debug_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } persist_debug_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type shell_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } shell_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type test_harness_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } test_harness_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type theme_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } theme_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type use_memfd_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } use_memfd_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+ type vold_prop, property_type, system_property_type, system_restricted_property_type;
+#line 112
+
+#line 112
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+ neverallow { domain -coredomain } vold_prop:property_service set;
+#line 112
+
+#line 112
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 133
+
+
+# Properties which can be written only by vendor_init
+
+#line 136
+
+#line 136
+ type apexd_config_prop, property_type, system_property_type, system_public_property_type;
+#line 136
+
+#line 136
+
+#line 136
+
+#line 136
+allow vendor_init property_socket:sock_file write;
+#line 136
+allow vendor_init init:unix_stream_socket connectto;
+#line 136
+
+#line 136
+allow vendor_init apexd_config_prop:property_service set;
+#line 136
+
+#line 136
+allow vendor_init apexd_config_prop:file { getattr open read map };
+#line 136
+
+#line 136
+
+#line 136
+ neverallow { domain -init -vendor_init } apexd_config_prop:property_service set;
+#line 136
+
+
+#line 137
+
+#line 137
+ type apexd_select_prop, property_type, system_property_type, system_public_property_type;
+#line 137
+
+#line 137
+
+#line 137
+
+#line 137
+allow vendor_init property_socket:sock_file write;
+#line 137
+allow vendor_init init:unix_stream_socket connectto;
+#line 137
+
+#line 137
+allow vendor_init apexd_select_prop:property_service set;
+#line 137
+
+#line 137
+allow vendor_init apexd_select_prop:file { getattr open read map };
+#line 137
+
+#line 137
+
+#line 137
+ neverallow { domain -init -vendor_init } apexd_select_prop:property_service set;
+#line 137
+
+
+#line 138
+
+#line 138
+ type aaudio_config_prop, property_type, system_property_type, system_public_property_type;
+#line 138
+
+#line 138
+
+#line 138
+
+#line 138
+allow vendor_init property_socket:sock_file write;
+#line 138
+allow vendor_init init:unix_stream_socket connectto;
+#line 138
+
+#line 138
+allow vendor_init aaudio_config_prop:property_service set;
+#line 138
+
+#line 138
+allow vendor_init aaudio_config_prop:file { getattr open read map };
+#line 138
+
+#line 138
+
+#line 138
+ neverallow { domain -init -vendor_init } aaudio_config_prop:property_service set;
+#line 138
+
+
+#line 139
+
+#line 139
+ type apk_verity_prop, property_type, system_property_type, system_public_property_type;
+#line 139
+
+#line 139
+
+#line 139
+
+#line 139
+allow vendor_init property_socket:sock_file write;
+#line 139
+allow vendor_init init:unix_stream_socket connectto;
+#line 139
+
+#line 139
+allow vendor_init apk_verity_prop:property_service set;
+#line 139
+
+#line 139
+allow vendor_init apk_verity_prop:file { getattr open read map };
+#line 139
+
+#line 139
+
+#line 139
+ neverallow { domain -init -vendor_init } apk_verity_prop:property_service set;
+#line 139
+
+
+#line 140
+
+#line 140
+ type audio_config_prop, property_type, system_property_type, system_public_property_type;
+#line 140
+
+#line 140
+
+#line 140
+
+#line 140
+allow vendor_init property_socket:sock_file write;
+#line 140
+allow vendor_init init:unix_stream_socket connectto;
+#line 140
+
+#line 140
+allow vendor_init audio_config_prop:property_service set;
+#line 140
+
+#line 140
+allow vendor_init audio_config_prop:file { getattr open read map };
+#line 140
+
+#line 140
+
+#line 140
+ neverallow { domain -init -vendor_init } audio_config_prop:property_service set;
+#line 140
+
+
+#line 141
+
+#line 141
+ type bootanim_config_prop, property_type, system_property_type, system_public_property_type;
+#line 141
+
+#line 141
+
+#line 141
+
+#line 141
+allow vendor_init property_socket:sock_file write;
+#line 141
+allow vendor_init init:unix_stream_socket connectto;
+#line 141
+
+#line 141
+allow vendor_init bootanim_config_prop:property_service set;
+#line 141
+
+#line 141
+allow vendor_init bootanim_config_prop:file { getattr open read map };
+#line 141
+
+#line 141
+
+#line 141
+ neverallow { domain -init -vendor_init } bootanim_config_prop:property_service set;
+#line 141
+
+
+#line 142
+
+#line 142
+ type bluetooth_config_prop, property_type, system_property_type, system_public_property_type;
+#line 142
+
+#line 142
+
+#line 142
+
+#line 142
+allow vendor_init property_socket:sock_file write;
+#line 142
+allow vendor_init init:unix_stream_socket connectto;
+#line 142
+
+#line 142
+allow vendor_init bluetooth_config_prop:property_service set;
+#line 142
+
+#line 142
+allow vendor_init bluetooth_config_prop:file { getattr open read map };
+#line 142
+
+#line 142
+
+#line 142
+ neverallow { domain -init -vendor_init } bluetooth_config_prop:property_service set;
+#line 142
+
+
+#line 143
+
+#line 143
+ type build_attestation_prop, property_type, system_property_type, system_public_property_type;
+#line 143
+
+#line 143
+
+#line 143
+
+#line 143
+allow vendor_init property_socket:sock_file write;
+#line 143
+allow vendor_init init:unix_stream_socket connectto;
+#line 143
+
+#line 143
+allow vendor_init build_attestation_prop:property_service set;
+#line 143
+
+#line 143
+allow vendor_init build_attestation_prop:file { getattr open read map };
+#line 143
+
+#line 143
+
+#line 143
+ neverallow { domain -init -vendor_init } build_attestation_prop:property_service set;
+#line 143
+
+
+#line 144
+
+#line 144
+ type build_config_prop, property_type, system_property_type, system_public_property_type;
+#line 144
+
+#line 144
+
+#line 144
+
+#line 144
+allow vendor_init property_socket:sock_file write;
+#line 144
+allow vendor_init init:unix_stream_socket connectto;
+#line 144
+
+#line 144
+allow vendor_init build_config_prop:property_service set;
+#line 144
+
+#line 144
+allow vendor_init build_config_prop:file { getattr open read map };
+#line 144
+
+#line 144
+
+#line 144
+ neverallow { domain -init -vendor_init } build_config_prop:property_service set;
+#line 144
+
+
+#line 145
+
+#line 145
+ type build_odm_prop, property_type, system_property_type, system_public_property_type;
+#line 145
+
+#line 145
+
+#line 145
+
+#line 145
+allow vendor_init property_socket:sock_file write;
+#line 145
+allow vendor_init init:unix_stream_socket connectto;
+#line 145
+
+#line 145
+allow vendor_init build_odm_prop:property_service set;
+#line 145
+
+#line 145
+allow vendor_init build_odm_prop:file { getattr open read map };
+#line 145
+
+#line 145
+
+#line 145
+ neverallow { domain -init -vendor_init } build_odm_prop:property_service set;
+#line 145
+
+
+#line 146
+
+#line 146
+ type build_vendor_prop, property_type, system_property_type, system_public_property_type;
+#line 146
+
+#line 146
+
+#line 146
+
+#line 146
+allow vendor_init property_socket:sock_file write;
+#line 146
+allow vendor_init init:unix_stream_socket connectto;
+#line 146
+
+#line 146
+allow vendor_init build_vendor_prop:property_service set;
+#line 146
+
+#line 146
+allow vendor_init build_vendor_prop:file { getattr open read map };
+#line 146
+
+#line 146
+
+#line 146
+ neverallow { domain -init -vendor_init } build_vendor_prop:property_service set;
+#line 146
+
+
+#line 147
+
+#line 147
+ type camera_calibration_prop, property_type, system_property_type, system_public_property_type;
+#line 147
+
+#line 147
+
+#line 147
+
+#line 147
+allow vendor_init property_socket:sock_file write;
+#line 147
+allow vendor_init init:unix_stream_socket connectto;
+#line 147
+
+#line 147
+allow vendor_init camera_calibration_prop:property_service set;
+#line 147
+
+#line 147
+allow vendor_init camera_calibration_prop:file { getattr open read map };
+#line 147
+
+#line 147
+
+#line 147
+ neverallow { domain -init -vendor_init } camera_calibration_prop:property_service set;
+#line 147
+
+
+#line 148
+
+#line 148
+ type camera_config_prop, property_type, system_property_type, system_public_property_type;
+#line 148
+
+#line 148
+
+#line 148
+
+#line 148
+allow vendor_init property_socket:sock_file write;
+#line 148
+allow vendor_init init:unix_stream_socket connectto;
+#line 148
+
+#line 148
+allow vendor_init camera_config_prop:property_service set;
+#line 148
+
+#line 148
+allow vendor_init camera_config_prop:file { getattr open read map };
+#line 148
+
+#line 148
+
+#line 148
+ neverallow { domain -init -vendor_init } camera_config_prop:property_service set;
+#line 148
+
+
+#line 149
+
+#line 149
+ type camera2_extensions_prop, property_type, system_property_type, system_public_property_type;
+#line 149
+
+#line 149
+
+#line 149
+
+#line 149
+allow vendor_init property_socket:sock_file write;
+#line 149
+allow vendor_init init:unix_stream_socket connectto;
+#line 149
+
+#line 149
+allow vendor_init camera2_extensions_prop:property_service set;
+#line 149
+
+#line 149
+allow vendor_init camera2_extensions_prop:file { getattr open read map };
+#line 149
+
+#line 149
+
+#line 149
+ neverallow { domain -init -vendor_init } camera2_extensions_prop:property_service set;
+#line 149
+
+
+#line 150
+
+#line 150
+ type camerax_extensions_prop, property_type, system_property_type, system_public_property_type;
+#line 150
+
+#line 150
+
+#line 150
+
+#line 150
+allow vendor_init property_socket:sock_file write;
+#line 150
+allow vendor_init init:unix_stream_socket connectto;
+#line 150
+
+#line 150
+allow vendor_init camerax_extensions_prop:property_service set;
+#line 150
+
+#line 150
+allow vendor_init camerax_extensions_prop:file { getattr open read map };
+#line 150
+
+#line 150
+
+#line 150
+ neverallow { domain -init -vendor_init } camerax_extensions_prop:property_service set;
+#line 150
+
+
+#line 151
+
+#line 151
+ type charger_config_prop, property_type, system_property_type, system_public_property_type;
+#line 151
+
+#line 151
+
+#line 151
+
+#line 151
+allow vendor_init property_socket:sock_file write;
+#line 151
+allow vendor_init init:unix_stream_socket connectto;
+#line 151
+
+#line 151
+allow vendor_init charger_config_prop:property_service set;
+#line 151
+
+#line 151
+allow vendor_init charger_config_prop:file { getattr open read map };
+#line 151
+
+#line 151
+
+#line 151
+ neverallow { domain -init -vendor_init } charger_config_prop:property_service set;
+#line 151
+
+
+#line 152
+
+#line 152
+ type codec2_config_prop, property_type, system_property_type, system_public_property_type;
+#line 152
+
+#line 152
+
+#line 152
+
+#line 152
+allow vendor_init property_socket:sock_file write;
+#line 152
+allow vendor_init init:unix_stream_socket connectto;
+#line 152
+
+#line 152
+allow vendor_init codec2_config_prop:property_service set;
+#line 152
+
+#line 152
+allow vendor_init codec2_config_prop:file { getattr open read map };
+#line 152
+
+#line 152
+
+#line 152
+ neverallow { domain -init -vendor_init } codec2_config_prop:property_service set;
+#line 152
+
+
+#line 153
+
+#line 153
+ type composd_vm_vendor_prop, property_type, system_property_type, system_public_property_type;
+#line 153
+
+#line 153
+
+#line 153
+
+#line 153
+allow vendor_init property_socket:sock_file write;
+#line 153
+allow vendor_init init:unix_stream_socket connectto;
+#line 153
+
+#line 153
+allow vendor_init composd_vm_vendor_prop:property_service set;
+#line 153
+
+#line 153
+allow vendor_init composd_vm_vendor_prop:file { getattr open read map };
+#line 153
+
+#line 153
+
+#line 153
+ neverallow { domain -init -vendor_init } composd_vm_vendor_prop:property_service set;
+#line 153
+
+
+#line 154
+
+#line 154
+ type cpu_variant_prop, property_type, system_property_type, system_public_property_type;
+#line 154
+
+#line 154
+
+#line 154
+
+#line 154
+allow vendor_init property_socket:sock_file write;
+#line 154
+allow vendor_init init:unix_stream_socket connectto;
+#line 154
+
+#line 154
+allow vendor_init cpu_variant_prop:property_service set;
+#line 154
+
+#line 154
+allow vendor_init cpu_variant_prop:file { getattr open read map };
+#line 154
+
+#line 154
+
+#line 154
+ neverallow { domain -init -vendor_init } cpu_variant_prop:property_service set;
+#line 154
+
+
+#line 155
+
+#line 155
+ type debugfs_restriction_prop, property_type, system_property_type, system_public_property_type;
+#line 155
+
+#line 155
+
+#line 155
+
+#line 155
+allow vendor_init property_socket:sock_file write;
+#line 155
+allow vendor_init init:unix_stream_socket connectto;
+#line 155
+
+#line 155
+allow vendor_init debugfs_restriction_prop:property_service set;
+#line 155
+
+#line 155
+allow vendor_init debugfs_restriction_prop:file { getattr open read map };
+#line 155
+
+#line 155
+
+#line 155
+ neverallow { domain -init -vendor_init } debugfs_restriction_prop:property_service set;
+#line 155
+
+
+#line 156
+
+#line 156
+ type drm_service_config_prop, property_type, system_property_type, system_public_property_type;
+#line 156
+
+#line 156
+
+#line 156
+
+#line 156
+allow vendor_init property_socket:sock_file write;
+#line 156
+allow vendor_init init:unix_stream_socket connectto;
+#line 156
+
+#line 156
+allow vendor_init drm_service_config_prop:property_service set;
+#line 156
+
+#line 156
+allow vendor_init drm_service_config_prop:file { getattr open read map };
+#line 156
+
+#line 156
+
+#line 156
+ neverallow { domain -init -vendor_init } drm_service_config_prop:property_service set;
+#line 156
+
+
+#line 157
+
+#line 157
+ type exported_camera_prop, property_type, system_property_type, system_public_property_type;
+#line 157
+
+#line 157
+
+#line 157
+
+#line 157
+allow vendor_init property_socket:sock_file write;
+#line 157
+allow vendor_init init:unix_stream_socket connectto;
+#line 157
+
+#line 157
+allow vendor_init exported_camera_prop:property_service set;
+#line 157
+
+#line 157
+allow vendor_init exported_camera_prop:file { getattr open read map };
+#line 157
+
+#line 157
+
+#line 157
+ neverallow { domain -init -vendor_init } exported_camera_prop:property_service set;
+#line 157
+
+
+#line 158
+
+#line 158
+ type exported_config_prop, property_type, system_property_type, system_public_property_type;
+#line 158
+
+#line 158
+
+#line 158
+
+#line 158
+allow vendor_init property_socket:sock_file write;
+#line 158
+allow vendor_init init:unix_stream_socket connectto;
+#line 158
+
+#line 158
+allow vendor_init exported_config_prop:property_service set;
+#line 158
+
+#line 158
+allow vendor_init exported_config_prop:file { getattr open read map };
+#line 158
+
+#line 158
+
+#line 158
+ neverallow { domain -init -vendor_init } exported_config_prop:property_service set;
+#line 158
+
+
+#line 159
+
+#line 159
+ type exported_default_prop, property_type, system_property_type, system_public_property_type;
+#line 159
+
+#line 159
+
+#line 159
+
+#line 159
+allow vendor_init property_socket:sock_file write;
+#line 159
+allow vendor_init init:unix_stream_socket connectto;
+#line 159
+
+#line 159
+allow vendor_init exported_default_prop:property_service set;
+#line 159
+
+#line 159
+allow vendor_init exported_default_prop:file { getattr open read map };
+#line 159
+
+#line 159
+
+#line 159
+ neverallow { domain -init -vendor_init } exported_default_prop:property_service set;
+#line 159
+
+
+#line 160
+
+#line 160
+ type ffs_config_prop, property_type, system_property_type, system_public_property_type;
+#line 160
+
+#line 160
+
+#line 160
+
+#line 160
+allow vendor_init property_socket:sock_file write;
+#line 160
+allow vendor_init init:unix_stream_socket connectto;
+#line 160
+
+#line 160
+allow vendor_init ffs_config_prop:property_service set;
+#line 160
+
+#line 160
+allow vendor_init ffs_config_prop:file { getattr open read map };
+#line 160
+
+#line 160
+
+#line 160
+ neverallow { domain -init -vendor_init } ffs_config_prop:property_service set;
+#line 160
+
+
+#line 161
+
+#line 161
+ type framework_watchdog_config_prop, property_type, system_property_type, system_public_property_type;
+#line 161
+
+#line 161
+
+#line 161
+
+#line 161
+allow vendor_init property_socket:sock_file write;
+#line 161
+allow vendor_init init:unix_stream_socket connectto;
+#line 161
+
+#line 161
+allow vendor_init framework_watchdog_config_prop:property_service set;
+#line 161
+
+#line 161
+allow vendor_init framework_watchdog_config_prop:file { getattr open read map };
+#line 161
+
+#line 161
+
+#line 161
+ neverallow { domain -init -vendor_init } framework_watchdog_config_prop:property_service set;
+#line 161
+
+
+#line 162
+
+#line 162
+ type graphics_config_prop, property_type, system_property_type, system_public_property_type;
+#line 162
+
+#line 162
+
+#line 162
+
+#line 162
+allow vendor_init property_socket:sock_file write;
+#line 162
+allow vendor_init init:unix_stream_socket connectto;
+#line 162
+
+#line 162
+allow vendor_init graphics_config_prop:property_service set;
+#line 162
+
+#line 162
+allow vendor_init graphics_config_prop:file { getattr open read map };
+#line 162
+
+#line 162
+
+#line 162
+ neverallow { domain -init -vendor_init } graphics_config_prop:property_service set;
+#line 162
+
+
+#line 163
+
+#line 163
+ type hdmi_config_prop, property_type, system_property_type, system_public_property_type;
+#line 163
+
+#line 163
+
+#line 163
+
+#line 163
+allow vendor_init property_socket:sock_file write;
+#line 163
+allow vendor_init init:unix_stream_socket connectto;
+#line 163
+
+#line 163
+allow vendor_init hdmi_config_prop:property_service set;
+#line 163
+
+#line 163
+allow vendor_init hdmi_config_prop:file { getattr open read map };
+#line 163
+
+#line 163
+
+#line 163
+ neverallow { domain -init -vendor_init } hdmi_config_prop:property_service set;
+#line 163
+
+
+#line 164
+
+#line 164
+ type hw_timeout_multiplier_prop, property_type, system_property_type, system_public_property_type;
+#line 164
+
+#line 164
+
+#line 164
+
+#line 164
+allow vendor_init property_socket:sock_file write;
+#line 164
+allow vendor_init init:unix_stream_socket connectto;
+#line 164
+
+#line 164
+allow vendor_init hw_timeout_multiplier_prop:property_service set;
+#line 164
+
+#line 164
+allow vendor_init hw_timeout_multiplier_prop:file { getattr open read map };
+#line 164
+
+#line 164
+
+#line 164
+ neverallow { domain -init -vendor_init } hw_timeout_multiplier_prop:property_service set;
+#line 164
+
+
+#line 165
+
+#line 165
+ type hypervisor_prop, property_type, system_property_type, system_public_property_type;
+#line 165
+
+#line 165
+
+#line 165
+
+#line 165
+allow vendor_init property_socket:sock_file write;
+#line 165
+allow vendor_init init:unix_stream_socket connectto;
+#line 165
+
+#line 165
+allow vendor_init hypervisor_prop:property_service set;
+#line 165
+
+#line 165
+allow vendor_init hypervisor_prop:file { getattr open read map };
+#line 165
+
+#line 165
+
+#line 165
+ neverallow { domain -init -vendor_init } hypervisor_prop:property_service set;
+#line 165
+
+
+#line 166
+
+#line 166
+ type hypervisor_restricted_prop, property_type, system_property_type, system_public_property_type;
+#line 166
+
+#line 166
+
+#line 166
+
+#line 166
+allow vendor_init property_socket:sock_file write;
+#line 166
+allow vendor_init init:unix_stream_socket connectto;
+#line 166
+
+#line 166
+allow vendor_init hypervisor_restricted_prop:property_service set;
+#line 166
+
+#line 166
+allow vendor_init hypervisor_restricted_prop:file { getattr open read map };
+#line 166
+
+#line 166
+
+#line 166
+ neverallow { domain -init -vendor_init } hypervisor_restricted_prop:property_service set;
+#line 166
+
+
+#line 167
+
+#line 167
+ type incremental_prop, property_type, system_property_type, system_public_property_type;
+#line 167
+
+#line 167
+
+#line 167
+
+#line 167
+allow vendor_init property_socket:sock_file write;
+#line 167
+allow vendor_init init:unix_stream_socket connectto;
+#line 167
+
+#line 167
+allow vendor_init incremental_prop:property_service set;
+#line 167
+
+#line 167
+allow vendor_init incremental_prop:file { getattr open read map };
+#line 167
+
+#line 167
+
+#line 167
+ neverallow { domain -init -vendor_init } incremental_prop:property_service set;
+#line 167
+
+
+#line 168
+
+#line 168
+ type input_device_config_prop, property_type, system_property_type, system_public_property_type;
+#line 168
+
+#line 168
+
+#line 168
+
+#line 168
+allow vendor_init property_socket:sock_file write;
+#line 168
+allow vendor_init init:unix_stream_socket connectto;
+#line 168
+
+#line 168
+allow vendor_init input_device_config_prop:property_service set;
+#line 168
+
+#line 168
+allow vendor_init input_device_config_prop:file { getattr open read map };
+#line 168
+
+#line 168
+
+#line 168
+ neverallow { domain -init -vendor_init } input_device_config_prop:property_service set;
+#line 168
+
+
+#line 169
+
+#line 169
+ type keyguard_config_prop, property_type, system_property_type, system_public_property_type;
+#line 169
+
+#line 169
+
+#line 169
+
+#line 169
+allow vendor_init property_socket:sock_file write;
+#line 169
+allow vendor_init init:unix_stream_socket connectto;
+#line 169
+
+#line 169
+allow vendor_init keyguard_config_prop:property_service set;
+#line 169
+
+#line 169
+allow vendor_init keyguard_config_prop:file { getattr open read map };
+#line 169
+
+#line 169
+
+#line 169
+ neverallow { domain -init -vendor_init } keyguard_config_prop:property_service set;
+#line 169
+
+
+#line 170
+
+#line 170
+ type keystore_config_prop, property_type, system_property_type, system_public_property_type;
+#line 170
+
+#line 170
+
+#line 170
+
+#line 170
+allow vendor_init property_socket:sock_file write;
+#line 170
+allow vendor_init init:unix_stream_socket connectto;
+#line 170
+
+#line 170
+allow vendor_init keystore_config_prop:property_service set;
+#line 170
+
+#line 170
+allow vendor_init keystore_config_prop:file { getattr open read map };
+#line 170
+
+#line 170
+
+#line 170
+ neverallow { domain -init -vendor_init } keystore_config_prop:property_service set;
+#line 170
+
+
+#line 171
+
+#line 171
+ type lmkd_config_prop, property_type, system_property_type, system_public_property_type;
+#line 171
+
+#line 171
+
+#line 171
+
+#line 171
+allow vendor_init property_socket:sock_file write;
+#line 171
+allow vendor_init init:unix_stream_socket connectto;
+#line 171
+
+#line 171
+allow vendor_init lmkd_config_prop:property_service set;
+#line 171
+
+#line 171
+allow vendor_init lmkd_config_prop:file { getattr open read map };
+#line 171
+
+#line 171
+
+#line 171
+ neverallow { domain -init -vendor_init } lmkd_config_prop:property_service set;
+#line 171
+
+
+#line 172
+
+#line 172
+ type media_config_prop, property_type, system_property_type, system_public_property_type;
+#line 172
+
+#line 172
+
+#line 172
+
+#line 172
+allow vendor_init property_socket:sock_file write;
+#line 172
+allow vendor_init init:unix_stream_socket connectto;
+#line 172
+
+#line 172
+allow vendor_init media_config_prop:property_service set;
+#line 172
+
+#line 172
+allow vendor_init media_config_prop:file { getattr open read map };
+#line 172
+
+#line 172
+
+#line 172
+ neverallow { domain -init -vendor_init } media_config_prop:property_service set;
+#line 172
+
+
+#line 173
+
+#line 173
+ type media_variant_prop, property_type, system_property_type, system_public_property_type;
+#line 173
+
+#line 173
+
+#line 173
+
+#line 173
+allow vendor_init property_socket:sock_file write;
+#line 173
+allow vendor_init init:unix_stream_socket connectto;
+#line 173
+
+#line 173
+allow vendor_init media_variant_prop:property_service set;
+#line 173
+
+#line 173
+allow vendor_init media_variant_prop:file { getattr open read map };
+#line 173
+
+#line 173
+
+#line 173
+ neverallow { domain -init -vendor_init } media_variant_prop:property_service set;
+#line 173
+
+
+#line 174
+
+#line 174
+ type mediadrm_config_prop, property_type, system_property_type, system_public_property_type;
+#line 174
+
+#line 174
+
+#line 174
+
+#line 174
+allow vendor_init property_socket:sock_file write;
+#line 174
+allow vendor_init init:unix_stream_socket connectto;
+#line 174
+
+#line 174
+allow vendor_init mediadrm_config_prop:property_service set;
+#line 174
+
+#line 174
+allow vendor_init mediadrm_config_prop:file { getattr open read map };
+#line 174
+
+#line 174
+
+#line 174
+ neverallow { domain -init -vendor_init } mediadrm_config_prop:property_service set;
+#line 174
+
+
+#line 175
+
+#line 175
+ type mm_events_config_prop, property_type, system_property_type, system_public_property_type;
+#line 175
+
+#line 175
+
+#line 175
+
+#line 175
+allow vendor_init property_socket:sock_file write;
+#line 175
+allow vendor_init init:unix_stream_socket connectto;
+#line 175
+
+#line 175
+allow vendor_init mm_events_config_prop:property_service set;
+#line 175
+
+#line 175
+allow vendor_init mm_events_config_prop:file { getattr open read map };
+#line 175
+
+#line 175
+
+#line 175
+ neverallow { domain -init -vendor_init } mm_events_config_prop:property_service set;
+#line 175
+
+
+#line 176
+
+#line 176
+ type oem_unlock_prop, property_type, system_property_type, system_public_property_type;
+#line 176
+
+#line 176
+
+#line 176
+
+#line 176
+allow vendor_init property_socket:sock_file write;
+#line 176
+allow vendor_init init:unix_stream_socket connectto;
+#line 176
+
+#line 176
+allow vendor_init oem_unlock_prop:property_service set;
+#line 176
+
+#line 176
+allow vendor_init oem_unlock_prop:file { getattr open read map };
+#line 176
+
+#line 176
+
+#line 176
+ neverallow { domain -init -vendor_init } oem_unlock_prop:property_service set;
+#line 176
+
+
+#line 177
+
+#line 177
+ type ota_build_prop, property_type, system_property_type, system_public_property_type;
+#line 177
+
+#line 177
+
+#line 177
+
+#line 177
+allow vendor_init property_socket:sock_file write;
+#line 177
+allow vendor_init init:unix_stream_socket connectto;
+#line 177
+
+#line 177
+allow vendor_init ota_build_prop:property_service set;
+#line 177
+
+#line 177
+allow vendor_init ota_build_prop:file { getattr open read map };
+#line 177
+
+#line 177
+
+#line 177
+ neverallow { domain -init -vendor_init } ota_build_prop:property_service set;
+#line 177
+
+
+#line 178
+
+#line 178
+ type packagemanager_config_prop, property_type, system_property_type, system_public_property_type;
+#line 178
+
+#line 178
+
+#line 178
+
+#line 178
+allow vendor_init property_socket:sock_file write;
+#line 178
+allow vendor_init init:unix_stream_socket connectto;
+#line 178
+
+#line 178
+allow vendor_init packagemanager_config_prop:property_service set;
+#line 178
+
+#line 178
+allow vendor_init packagemanager_config_prop:file { getattr open read map };
+#line 178
+
+#line 178
+
+#line 178
+ neverallow { domain -init -vendor_init } packagemanager_config_prop:property_service set;
+#line 178
+
+
+#line 179
+
+#line 179
+ type quick_start_prop, property_type, system_property_type, system_public_property_type;
+#line 179
+
+#line 179
+
+#line 179
+
+#line 179
+allow vendor_init property_socket:sock_file write;
+#line 179
+allow vendor_init init:unix_stream_socket connectto;
+#line 179
+
+#line 179
+allow vendor_init quick_start_prop:property_service set;
+#line 179
+
+#line 179
+allow vendor_init quick_start_prop:file { getattr open read map };
+#line 179
+
+#line 179
+
+#line 179
+ neverallow { domain -init -vendor_init } quick_start_prop:property_service set;
+#line 179
+
+
+#line 180
+
+#line 180
+ type recovery_config_prop, property_type, system_property_type, system_public_property_type;
+#line 180
+
+#line 180
+
+#line 180
+
+#line 180
+allow vendor_init property_socket:sock_file write;
+#line 180
+allow vendor_init init:unix_stream_socket connectto;
+#line 180
+
+#line 180
+allow vendor_init recovery_config_prop:property_service set;
+#line 180
+
+#line 180
+allow vendor_init recovery_config_prop:file { getattr open read map };
+#line 180
+
+#line 180
+
+#line 180
+ neverallow { domain -init -vendor_init } recovery_config_prop:property_service set;
+#line 180
+
+
+#line 181
+
+#line 181
+ type recovery_usb_config_prop, property_type, system_property_type, system_public_property_type;
+#line 181
+
+#line 181
+
+#line 181
+
+#line 181
+allow vendor_init property_socket:sock_file write;
+#line 181
+allow vendor_init init:unix_stream_socket connectto;
+#line 181
+
+#line 181
+allow vendor_init recovery_usb_config_prop:property_service set;
+#line 181
+
+#line 181
+allow vendor_init recovery_usb_config_prop:file { getattr open read map };
+#line 181
+
+#line 181
+
+#line 181
+ neverallow { domain -init -vendor_init } recovery_usb_config_prop:property_service set;
+#line 181
+
+
+#line 182
+
+#line 182
+ type sendbug_config_prop, property_type, system_property_type, system_public_property_type;
+#line 182
+
+#line 182
+
+#line 182
+
+#line 182
+allow vendor_init property_socket:sock_file write;
+#line 182
+allow vendor_init init:unix_stream_socket connectto;
+#line 182
+
+#line 182
+allow vendor_init sendbug_config_prop:property_service set;
+#line 182
+
+#line 182
+allow vendor_init sendbug_config_prop:file { getattr open read map };
+#line 182
+
+#line 182
+
+#line 182
+ neverallow { domain -init -vendor_init } sendbug_config_prop:property_service set;
+#line 182
+
+
+#line 183
+
+#line 183
+ type soc_prop, property_type, system_property_type, system_public_property_type;
+#line 183
+
+#line 183
+
+#line 183
+
+#line 183
+allow vendor_init property_socket:sock_file write;
+#line 183
+allow vendor_init init:unix_stream_socket connectto;
+#line 183
+
+#line 183
+allow vendor_init soc_prop:property_service set;
+#line 183
+
+#line 183
+allow vendor_init soc_prop:file { getattr open read map };
+#line 183
+
+#line 183
+
+#line 183
+ neverallow { domain -init -vendor_init } soc_prop:property_service set;
+#line 183
+
+
+#line 184
+
+#line 184
+ type storage_config_prop, property_type, system_property_type, system_public_property_type;
+#line 184
+
+#line 184
+
+#line 184
+
+#line 184
+allow vendor_init property_socket:sock_file write;
+#line 184
+allow vendor_init init:unix_stream_socket connectto;
+#line 184
+
+#line 184
+allow vendor_init storage_config_prop:property_service set;
+#line 184
+
+#line 184
+allow vendor_init storage_config_prop:file { getattr open read map };
+#line 184
+
+#line 184
+
+#line 184
+ neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
+#line 184
+
+
+#line 185
+
+#line 185
+ type storagemanager_config_prop, property_type, system_property_type, system_public_property_type;
+#line 185
+
+#line 185
+
+#line 185
+
+#line 185
+allow vendor_init property_socket:sock_file write;
+#line 185
+allow vendor_init init:unix_stream_socket connectto;
+#line 185
+
+#line 185
+allow vendor_init storagemanager_config_prop:property_service set;
+#line 185
+
+#line 185
+allow vendor_init storagemanager_config_prop:file { getattr open read map };
+#line 185
+
+#line 185
+
+#line 185
+ neverallow { domain -init -vendor_init } storagemanager_config_prop:property_service set;
+#line 185
+
+
+#line 186
+
+#line 186
+ type surfaceflinger_prop, property_type, system_property_type, system_public_property_type;
+#line 186
+
+#line 186
+
+#line 186
+
+#line 186
+allow vendor_init property_socket:sock_file write;
+#line 186
+allow vendor_init init:unix_stream_socket connectto;
+#line 186
+
+#line 186
+allow vendor_init surfaceflinger_prop:property_service set;
+#line 186
+
+#line 186
+allow vendor_init surfaceflinger_prop:file { getattr open read map };
+#line 186
+
+#line 186
+
+#line 186
+ neverallow { domain -init -vendor_init } surfaceflinger_prop:property_service set;
+#line 186
+
+
+#line 187
+
+#line 187
+ type suspend_prop, property_type, system_property_type, system_public_property_type;
+#line 187
+
+#line 187
+
+#line 187
+
+#line 187
+allow vendor_init property_socket:sock_file write;
+#line 187
+allow vendor_init init:unix_stream_socket connectto;
+#line 187
+
+#line 187
+allow vendor_init suspend_prop:property_service set;
+#line 187
+
+#line 187
+allow vendor_init suspend_prop:file { getattr open read map };
+#line 187
+
+#line 187
+
+#line 187
+ neverallow { domain -init -vendor_init } suspend_prop:property_service set;
+#line 187
+
+
+#line 188
+
+#line 188
+ type systemsound_config_prop, property_type, system_property_type, system_public_property_type;
+#line 188
+
+#line 188
+
+#line 188
+
+#line 188
+allow vendor_init property_socket:sock_file write;
+#line 188
+allow vendor_init init:unix_stream_socket connectto;
+#line 188
+
+#line 188
+allow vendor_init systemsound_config_prop:property_service set;
+#line 188
+
+#line 188
+allow vendor_init systemsound_config_prop:file { getattr open read map };
+#line 188
+
+#line 188
+
+#line 188
+ neverallow { domain -init -vendor_init } systemsound_config_prop:property_service set;
+#line 188
+
+
+#line 189
+
+#line 189
+ type telephony_config_prop, property_type, system_property_type, system_public_property_type;
+#line 189
+
+#line 189
+
+#line 189
+
+#line 189
+allow vendor_init property_socket:sock_file write;
+#line 189
+allow vendor_init init:unix_stream_socket connectto;
+#line 189
+
+#line 189
+allow vendor_init telephony_config_prop:property_service set;
+#line 189
+
+#line 189
+allow vendor_init telephony_config_prop:file { getattr open read map };
+#line 189
+
+#line 189
+
+#line 189
+ neverallow { domain -init -vendor_init } telephony_config_prop:property_service set;
+#line 189
+
+
+#line 190
+
+#line 190
+ type threadnetwork_config_prop, property_type, system_property_type, system_public_property_type;
+#line 190
+
+#line 190
+
+#line 190
+
+#line 190
+allow vendor_init property_socket:sock_file write;
+#line 190
+allow vendor_init init:unix_stream_socket connectto;
+#line 190
+
+#line 190
+allow vendor_init threadnetwork_config_prop:property_service set;
+#line 190
+
+#line 190
+allow vendor_init threadnetwork_config_prop:file { getattr open read map };
+#line 190
+
+#line 190
+
+#line 190
+ neverallow { domain -init -vendor_init } threadnetwork_config_prop:property_service set;
+#line 190
+
+
+#line 191
+
+#line 191
+ type tombstone_config_prop, property_type, system_property_type, system_public_property_type;
+#line 191
+
+#line 191
+
+#line 191
+
+#line 191
+allow vendor_init property_socket:sock_file write;
+#line 191
+allow vendor_init init:unix_stream_socket connectto;
+#line 191
+
+#line 191
+allow vendor_init tombstone_config_prop:property_service set;
+#line 191
+
+#line 191
+allow vendor_init tombstone_config_prop:file { getattr open read map };
+#line 191
+
+#line 191
+
+#line 191
+ neverallow { domain -init -vendor_init } tombstone_config_prop:property_service set;
+#line 191
+
+
+#line 192
+
+#line 192
+ type usb_config_prop, property_type, system_property_type, system_public_property_type;
+#line 192
+
+#line 192
+
+#line 192
+
+#line 192
+allow vendor_init property_socket:sock_file write;
+#line 192
+allow vendor_init init:unix_stream_socket connectto;
+#line 192
+
+#line 192
+allow vendor_init usb_config_prop:property_service set;
+#line 192
+
+#line 192
+allow vendor_init usb_config_prop:file { getattr open read map };
+#line 192
+
+#line 192
+
+#line 192
+ neverallow { domain -init -vendor_init } usb_config_prop:property_service set;
+#line 192
+
+
+#line 193
+
+#line 193
+ type userspace_reboot_config_prop, property_type, system_property_type, system_public_property_type;
+#line 193
+
+#line 193
+
+#line 193
+
+#line 193
+allow vendor_init property_socket:sock_file write;
+#line 193
+allow vendor_init init:unix_stream_socket connectto;
+#line 193
+
+#line 193
+allow vendor_init userspace_reboot_config_prop:property_service set;
+#line 193
+
+#line 193
+allow vendor_init userspace_reboot_config_prop:file { getattr open read map };
+#line 193
+
+#line 193
+
+#line 193
+ neverallow { domain -init -vendor_init } userspace_reboot_config_prop:property_service set;
+#line 193
+
+
+#line 194
+
+#line 194
+ type vehicle_hal_prop, property_type, system_property_type, system_public_property_type;
+#line 194
+
+#line 194
+
+#line 194
+
+#line 194
+allow vendor_init property_socket:sock_file write;
+#line 194
+allow vendor_init init:unix_stream_socket connectto;
+#line 194
+
+#line 194
+allow vendor_init vehicle_hal_prop:property_service set;
+#line 194
+
+#line 194
+allow vendor_init vehicle_hal_prop:file { getattr open read map };
+#line 194
+
+#line 194
+
+#line 194
+ neverallow { domain -init -vendor_init } vehicle_hal_prop:property_service set;
+#line 194
+
+
+#line 195
+
+#line 195
+ type vendor_security_patch_level_prop, property_type, system_property_type, system_public_property_type;
+#line 195
+
+#line 195
+
+#line 195
+
+#line 195
+allow vendor_init property_socket:sock_file write;
+#line 195
+allow vendor_init init:unix_stream_socket connectto;
+#line 195
+
+#line 195
+allow vendor_init vendor_security_patch_level_prop:property_service set;
+#line 195
+
+#line 195
+allow vendor_init vendor_security_patch_level_prop:file { getattr open read map };
+#line 195
+
+#line 195
+
+#line 195
+ neverallow { domain -init -vendor_init } vendor_security_patch_level_prop:property_service set;
+#line 195
+
+
+#line 196
+
+#line 196
+ type vendor_socket_hook_prop, property_type, system_property_type, system_public_property_type;
+#line 196
+
+#line 196
+
+#line 196
+
+#line 196
+allow vendor_init property_socket:sock_file write;
+#line 196
+allow vendor_init init:unix_stream_socket connectto;
+#line 196
+
+#line 196
+allow vendor_init vendor_socket_hook_prop:property_service set;
+#line 196
+
+#line 196
+allow vendor_init vendor_socket_hook_prop:file { getattr open read map };
+#line 196
+
+#line 196
+
+#line 196
+ neverallow { domain -init -vendor_init } vendor_socket_hook_prop:property_service set;
+#line 196
+
+
+#line 197
+
+#line 197
+ type virtual_ab_prop, property_type, system_property_type, system_public_property_type;
+#line 197
+
+#line 197
+
+#line 197
+
+#line 197
+allow vendor_init property_socket:sock_file write;
+#line 197
+allow vendor_init init:unix_stream_socket connectto;
+#line 197
+
+#line 197
+allow vendor_init virtual_ab_prop:property_service set;
+#line 197
+
+#line 197
+allow vendor_init virtual_ab_prop:file { getattr open read map };
+#line 197
+
+#line 197
+
+#line 197
+ neverallow { domain -init -vendor_init } virtual_ab_prop:property_service set;
+#line 197
+
+
+#line 198
+
+#line 198
+ type vndk_prop, property_type, system_property_type, system_public_property_type;
+#line 198
+
+#line 198
+
+#line 198
+
+#line 198
+allow vendor_init property_socket:sock_file write;
+#line 198
+allow vendor_init init:unix_stream_socket connectto;
+#line 198
+
+#line 198
+allow vendor_init vndk_prop:property_service set;
+#line 198
+
+#line 198
+allow vendor_init vndk_prop:file { getattr open read map };
+#line 198
+
+#line 198
+
+#line 198
+ neverallow { domain -init -vendor_init } vndk_prop:property_service set;
+#line 198
+
+
+#line 199
+
+#line 199
+ type vts_config_prop, property_type, system_property_type, system_public_property_type;
+#line 199
+
+#line 199
+
+#line 199
+
+#line 199
+allow vendor_init property_socket:sock_file write;
+#line 199
+allow vendor_init init:unix_stream_socket connectto;
+#line 199
+
+#line 199
+allow vendor_init vts_config_prop:property_service set;
+#line 199
+
+#line 199
+allow vendor_init vts_config_prop:file { getattr open read map };
+#line 199
+
+#line 199
+
+#line 199
+ neverallow { domain -init -vendor_init } vts_config_prop:property_service set;
+#line 199
+
+
+#line 200
+
+#line 200
+ type vold_config_prop, property_type, system_property_type, system_public_property_type;
+#line 200
+
+#line 200
+
+#line 200
+
+#line 200
+allow vendor_init property_socket:sock_file write;
+#line 200
+allow vendor_init init:unix_stream_socket connectto;
+#line 200
+
+#line 200
+allow vendor_init vold_config_prop:property_service set;
+#line 200
+
+#line 200
+allow vendor_init vold_config_prop:file { getattr open read map };
+#line 200
+
+#line 200
+
+#line 200
+ neverallow { domain -init -vendor_init } vold_config_prop:property_service set;
+#line 200
+
+
+#line 201
+
+#line 201
+ type wifi_config_prop, property_type, system_property_type, system_public_property_type;
+#line 201
+
+#line 201
+
+#line 201
+
+#line 201
+allow vendor_init property_socket:sock_file write;
+#line 201
+allow vendor_init init:unix_stream_socket connectto;
+#line 201
+
+#line 201
+allow vendor_init wifi_config_prop:property_service set;
+#line 201
+
+#line 201
+allow vendor_init wifi_config_prop:file { getattr open read map };
+#line 201
+
+#line 201
+
+#line 201
+ neverallow { domain -init -vendor_init } wifi_config_prop:property_service set;
+#line 201
+
+
+#line 202
+
+#line 202
+ type zram_config_prop, property_type, system_property_type, system_public_property_type;
+#line 202
+
+#line 202
+
+#line 202
+
+#line 202
+allow vendor_init property_socket:sock_file write;
+#line 202
+allow vendor_init init:unix_stream_socket connectto;
+#line 202
+
+#line 202
+allow vendor_init zram_config_prop:property_service set;
+#line 202
+
+#line 202
+allow vendor_init zram_config_prop:file { getattr open read map };
+#line 202
+
+#line 202
+
+#line 202
+ neverallow { domain -init -vendor_init } zram_config_prop:property_service set;
+#line 202
+
+
+#line 203
+
+#line 203
+ type zygote_config_prop, property_type, system_property_type, system_public_property_type;
+#line 203
+
+#line 203
+
+#line 203
+
+#line 203
+allow vendor_init property_socket:sock_file write;
+#line 203
+allow vendor_init init:unix_stream_socket connectto;
+#line 203
+
+#line 203
+allow vendor_init zygote_config_prop:property_service set;
+#line 203
+
+#line 203
+allow vendor_init zygote_config_prop:file { getattr open read map };
+#line 203
+
+#line 203
+
+#line 203
+ neverallow { domain -init -vendor_init } zygote_config_prop:property_service set;
+#line 203
+
+
+#line 204
+
+#line 204
+ type dck_prop, property_type, system_property_type, system_public_property_type;
+#line 204
+
+#line 204
+
+#line 204
+
+#line 204
+allow vendor_init property_socket:sock_file write;
+#line 204
+allow vendor_init init:unix_stream_socket connectto;
+#line 204
+
+#line 204
+allow vendor_init dck_prop:property_service set;
+#line 204
+
+#line 204
+allow vendor_init dck_prop:file { getattr open read map };
+#line 204
+
+#line 204
+
+#line 204
+ neverallow { domain -init -vendor_init } dck_prop:property_service set;
+#line 204
+
+
+#line 205
+
+#line 205
+ type tuner_config_prop, property_type, system_property_type, system_public_property_type;
+#line 205
+
+#line 205
+
+#line 205
+
+#line 205
+allow vendor_init property_socket:sock_file write;
+#line 205
+allow vendor_init init:unix_stream_socket connectto;
+#line 205
+
+#line 205
+allow vendor_init tuner_config_prop:property_service set;
+#line 205
+
+#line 205
+allow vendor_init tuner_config_prop:file { getattr open read map };
+#line 205
+
+#line 205
+
+#line 205
+ neverallow { domain -init -vendor_init } tuner_config_prop:property_service set;
+#line 205
+
+
+#line 206
+
+#line 206
+ type usb_uvc_enabled_prop, property_type, system_property_type, system_public_property_type;
+#line 206
+
+#line 206
+
+#line 206
+
+#line 206
+allow vendor_init property_socket:sock_file write;
+#line 206
+allow vendor_init init:unix_stream_socket connectto;
+#line 206
+
+#line 206
+allow vendor_init usb_uvc_enabled_prop:property_service set;
+#line 206
+
+#line 206
+allow vendor_init usb_uvc_enabled_prop:file { getattr open read map };
+#line 206
+
+#line 206
+
+#line 206
+ neverallow { domain -init -vendor_init } usb_uvc_enabled_prop:property_service set;
+#line 206
+
+
+#line 207
+
+#line 207
+ type setupwizard_mode_prop, property_type, system_property_type, system_public_property_type;
+#line 207
+
+#line 207
+
+#line 207
+
+#line 207
+allow vendor_init property_socket:sock_file write;
+#line 207
+allow vendor_init init:unix_stream_socket connectto;
+#line 207
+
+#line 207
+allow vendor_init setupwizard_mode_prop:property_service set;
+#line 207
+
+#line 207
+allow vendor_init setupwizard_mode_prop:file { getattr open read map };
+#line 207
+
+#line 207
+
+#line 207
+ neverallow { domain -init -vendor_init } setupwizard_mode_prop:property_service set;
+#line 207
+
+
+#line 208
+
+#line 208
+ type pm_archiving_enabled_prop, property_type, system_property_type, system_public_property_type;
+#line 208
+
+#line 208
+
+#line 208
+
+#line 208
+allow vendor_init property_socket:sock_file write;
+#line 208
+allow vendor_init init:unix_stream_socket connectto;
+#line 208
+
+#line 208
+allow vendor_init pm_archiving_enabled_prop:property_service set;
+#line 208
+
+#line 208
+allow vendor_init pm_archiving_enabled_prop:file { getattr open read map };
+#line 208
+
+#line 208
+
+#line 208
+ neverallow { domain -init -vendor_init } pm_archiving_enabled_prop:property_service set;
+#line 208
+
+
+#line 209
+
+#line 209
+
+#line 209
+ type trusty_security_vm_sys_vendor_prop, property_type, system_property_type, system_public_property_type;
+#line 209
+
+#line 209
+
+#line 209
+
+#line 209
+allow vendor_init property_socket:sock_file write;
+#line 209
+allow vendor_init init:unix_stream_socket connectto;
+#line 209
+
+#line 209
+allow vendor_init trusty_security_vm_sys_vendor_prop:property_service set;
+#line 209
+
+#line 209
+allow vendor_init trusty_security_vm_sys_vendor_prop:file { getattr open read map };
+#line 209
+
+#line 209
+
+#line 209
+ neverallow { domain -init -vendor_init } trusty_security_vm_sys_vendor_prop:property_service set;
+#line 209
+
+#line 211
+
+
+# Properties with no restrictions
+
+#line 214
+ type adbd_config_prop, property_type, system_property_type, system_public_property_type;
+#line 214
+
+
+#line 215
+ type audio_prop, property_type, system_property_type, system_public_property_type;
+#line 215
+
+
+#line 216
+ type bluetooth_a2dp_offload_prop, property_type, system_property_type, system_public_property_type;
+#line 216
+
+
+#line 217
+ type bluetooth_audio_hal_prop, property_type, system_property_type, system_public_property_type;
+#line 217
+
+
+#line 218
+
+#line 218
+ type bluetooth_finder_prop, property_type, system_property_type, system_public_property_type;
+#line 218
+
+#line 220
+
+
+#line 221
+ type bluetooth_prop, property_type, system_property_type, system_public_property_type;
+#line 221
+
+
+#line 222
+ type bpf_progs_loaded_prop, property_type, system_property_type, system_public_property_type;
+#line 222
+
+
+#line 223
+ type charger_status_prop, property_type, system_property_type, system_public_property_type;
+#line 223
+
+
+#line 224
+ type ctl_default_prop, property_type, system_property_type, system_public_property_type;
+#line 224
+
+
+#line 225
+ type ctl_interface_start_prop, property_type, system_property_type, system_public_property_type;
+#line 225
+
+
+#line 226
+ type ctl_start_prop, property_type, system_property_type, system_public_property_type;
+#line 226
+
+
+#line 227
+ type ctl_stop_prop, property_type, system_property_type, system_public_property_type;
+#line 227
+
+
+#line 228
+ type dalvik_config_prop, property_type, system_property_type, system_public_property_type;
+#line 228
+
+
+#line 229
+ type dalvik_dynamic_config_prop, property_type, system_property_type, system_public_property_type;
+#line 229
+
+
+#line 230
+ type dalvik_runtime_prop, property_type, system_property_type, system_public_property_type;
+#line 230
+
+
+#line 231
+ type debug_prop, property_type, system_property_type, system_public_property_type;
+#line 231
+
+
+#line 232
+ type device_config_memory_safety_native_boot_prop, property_type, system_property_type, system_public_property_type;
+#line 232
+
+
+#line 233
+ type device_config_memory_safety_native_prop, property_type, system_property_type, system_public_property_type;
+#line 233
+
+
+#line 234
+ type dumpstate_options_prop, property_type, system_property_type, system_public_property_type;
+#line 234
+
+
+#line 235
+ type exported_system_prop, property_type, system_property_type, system_public_property_type;
+#line 235
+
+
+#line 236
+ type exported_bluetooth_prop, property_type, system_property_type, system_public_property_type;
+#line 236
+
+
+#line 237
+ type exported_overlay_prop, property_type, system_property_type, system_public_property_type;
+#line 237
+
+
+#line 238
+ type exported_pm_prop, property_type, system_property_type, system_public_property_type;
+#line 238
+
+
+#line 239
+ type future_pm_prop, property_type, system_property_type, system_public_property_type;
+#line 239
+
+
+#line 240
+ type ffs_control_prop, property_type, system_property_type, system_public_property_type;
+#line 240
+
+
+#line 241
+ type framework_status_prop, property_type, system_property_type, system_public_property_type;
+#line 241
+
+
+#line 242
+ type gesture_prop, property_type, system_property_type, system_public_property_type;
+#line 242
+
+
+#line 243
+ type graphics_config_writable_prop, property_type, system_property_type, system_public_property_type;
+#line 243
+
+
+#line 244
+ type hal_dumpstate_config_prop, property_type, system_property_type, system_public_property_type;
+#line 244
+
+
+#line 245
+ type sota_prop, property_type, system_property_type, system_public_property_type;
+#line 245
+
+
+#line 246
+ type hwservicemanager_prop, property_type, system_property_type, system_public_property_type;
+#line 246
+
+
+#line 247
+ type lmkd_prop, property_type, system_property_type, system_public_property_type;
+#line 247
+
+
+#line 248
+ type locale_prop, property_type, system_property_type, system_public_property_type;
+#line 248
+
+
+#line 249
+ type logd_prop, property_type, system_property_type, system_public_property_type;
+#line 249
+
+
+#line 250
+ type logpersistd_logging_prop, property_type, system_property_type, system_public_property_type;
+#line 250
+
+
+#line 251
+ type log_prop, property_type, system_property_type, system_public_property_type;
+#line 251
+
+
+#line 252
+ type log_tag_prop, property_type, system_property_type, system_public_property_type;
+#line 252
+
+
+#line 253
+ type lowpan_prop, property_type, system_property_type, system_public_property_type;
+#line 253
+
+
+#line 254
+ type nfc_prop, property_type, system_property_type, system_public_property_type;
+#line 254
+
+
+#line 255
+ type ota_prop, property_type, system_property_type, system_public_property_type;
+#line 255
+
+
+#line 256
+ type permissive_mte_prop, property_type, system_property_type, system_public_property_type;
+#line 256
+
+
+#line 257
+ type powerctl_prop, property_type, system_property_type, system_public_property_type;
+#line 257
+
+
+#line 258
+ type qemu_hw_prop, property_type, system_property_type, system_public_property_type;
+#line 258
+
+
+#line 259
+ type qemu_sf_lcd_density_prop, property_type, system_property_type, system_public_property_type;
+#line 259
+
+
+#line 260
+ type radio_control_prop, property_type, system_property_type, system_public_property_type;
+#line 260
+
+
+#line 261
+ type radio_prop, property_type, system_property_type, system_public_property_type;
+#line 261
+
+
+#line 262
+ type serialno_prop, property_type, system_property_type, system_public_property_type;
+#line 262
+
+
+#line 263
+ type surfaceflinger_color_prop, property_type, system_property_type, system_public_property_type;
+#line 263
+
+
+#line 264
+ type system_prop, property_type, system_property_type, system_public_property_type;
+#line 264
+
+
+#line 265
+ type system_user_mode_emulation_prop, property_type, system_property_type, system_public_property_type;
+#line 265
+
+
+#line 266
+ type telephony_status_prop, property_type, system_property_type, system_public_property_type;
+#line 266
+
+
+#line 267
+ type timezone_prop, property_type, system_property_type, system_public_property_type;
+#line 267
+
+
+#line 268
+ type usb_control_prop, property_type, system_property_type, system_public_property_type;
+#line 268
+
+
+#line 269
+ type vold_post_fs_data_prop, property_type, system_property_type, system_public_property_type;
+#line 269
+
+
+#line 270
+ type wifi_hal_prop, property_type, system_property_type, system_public_property_type;
+#line 270
+
+
+#line 271
+ type wifi_log_prop, property_type, system_property_type, system_public_property_type;
+#line 271
+
+
+#line 272
+ type wifi_prop, property_type, system_property_type, system_public_property_type;
+#line 272
+
+
+#line 273
+ type zram_control_prop, property_type, system_property_type, system_public_property_type;
+#line 273
+
+
+# Properties which don't have entries on property_contexts
+
+#line 276
+
+#line 276
+ type default_prop, property_type, system_property_type, system_internal_property_type;
+#line 276
+
+#line 276
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 276
+
+#line 276
+ neverallow { domain -coredomain } default_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 276
+
+#line 276
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 276
+
+#line 276
+
+
+# Properties used in default HAL implementations
+
+#line 279
+
+#line 279
+ type rebootescrow_hal_prop, property_type, vendor_property_type, vendor_internal_property_type;
+#line 279
+
+#line 279
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 279
+
+#line 279
+# init and dumpstate are in coredomain, but should be able to read all props.
+#line 279
+ neverallow { coredomain -init -dumpstate } rebootescrow_hal_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 279
+
+#line 279
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 279
+
+#line 279
+
+
+# Properties used in the default Face HAL implementations
+
+#line 282
+
+#line 282
+ type virtual_face_hal_prop, property_type, vendor_property_type, vendor_internal_property_type;
+#line 282
+
+#line 282
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 282
+
+#line 282
+# init and dumpstate are in coredomain, but should be able to read all props.
+#line 282
+ neverallow { coredomain -init -dumpstate } virtual_face_hal_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 282
+
+#line 282
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 282
+
+#line 282
+
+
+#line 283
+
+#line 283
+ type virtual_face_prop, property_type, system_property_type, system_public_property_type;
+#line 283
+
+#line 285
+
+
+# Properties used in the default Fingerprint HAL implementations
+
+#line 288
+
+#line 288
+ type virtual_fingerprint_hal_prop, property_type, vendor_property_type, vendor_internal_property_type;
+#line 288
+
+#line 288
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 288
+
+#line 288
+# init and dumpstate are in coredomain, but should be able to read all props.
+#line 288
+ neverallow { coredomain -init -dumpstate } virtual_fingerprint_hal_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 288
+
+#line 288
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 288
+
+#line 288
+
+
+#line 289
+
+#line 289
+ type virtual_fingerprint_prop, property_type, system_property_type, system_public_property_type;
+#line 289
+
+#line 291
+
+
+
+#line 293
+ type persist_vendor_debug_wifi_prop, property_type, vendor_property_type, vendor_public_property_type;
+#line 293
+
+
+# Properties which are public for devices launching with Android O or earlier
+# This should not be used for any new properties.
+
+#line 297
+ # DO NOT ADD ANY PROPERTIES HERE
+#line 297
+
+#line 297
+ type boottime_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type charger_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type cold_boot_done_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_adbd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_apexd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_bootanim_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_bugreport_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_console_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_dumpstate_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_fuse_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_gsid_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_interface_restart_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_interface_stop_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_mdnsd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_restart_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_rildaemon_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type ctl_sigstop_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type dynamic_system_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type heapprofd_enabled_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type llkd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type lpdumpd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type mmc_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type mock_ota_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type net_dns_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type overlay_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type persistent_properties_ready_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type safemode_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type system_lmk_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type system_trace_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type test_boot_reason_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type time_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type traced_enabled_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type traced_lazy_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+
+#line 297
+ type config_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type cppreopt_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type dalvik_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type debuggerd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type device_logging_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type dhcp_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type dumpstate_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type exported3_system_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type exported_dumpstate_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type exported_secure_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type heapprofd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type net_radio_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type pan_result_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type persist_debug_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type shell_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type test_harness_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type theme_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type use_memfd_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 297
+
+#line 297
+ type vold_prop, property_type, system_property_type, system_public_property_type;
+#line 297
+
+#line 352
+
+
+
+#line 354
+
+#line 354
+ type vendor_default_prop, property_type, vendor_property_type, vendor_public_property_type;
+#line 354
+
+#line 356
+
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 358
+
+#line 358
+
+#line 358
+
+#line 358
+ type vendor_default_prop, property_type, vendor_property_type, vendor_internal_property_type;
+#line 358
+
+#line 358
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 358
+
+#line 358
+# init and dumpstate are in coredomain, but should be able to read all props.
+#line 358
+ neverallow { coredomain -init -dumpstate } vendor_default_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 358
+
+#line 358
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 358
+
+#line 358
+
+#line 358
+
+#line 358
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 360
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/radio.te"
+# phone subsystem
+type radio, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/recovery.te"
+# recovery console (used in recovery init.rc for /sbin/recovery)
+
+# Declare the domain unconditionally so we can always reference it
+# in neverallow rules.
+type recovery, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/recovery_persist.te"
+# android recovery persistent log manager
+type recovery_persist, domain;
+type recovery_persist_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/recovery_refresh.te"
+# android recovery refresh log manager
+type recovery_refresh, domain;
+type recovery_refresh_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/rkpd_app.te"
+###
+### A domain for sandboxing the remote key provisioning daemon
+### app that is shipped via mainline.
+###
+
+type rkpdapp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/rs.te"
+type rs, domain, coredomain;
+type rs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/rss_hwm_reset.te"
+# rss_hwm_reset resets RSS high-water mark counters for all procesess.
+type rss_hwm_reset, domain, coredomain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/runas.te"
+type runas, domain, mlstrustedsubject;
+type runas_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/runas_app.te"
+type runas_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/sdcardd.te"
+type sdcardd, domain;
+type sdcardd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/secure_element.te"
+# secure_element subsystem
+type secure_element, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/service.te"
+type aidl_lazy_test_service, service_manager_type;
+type apc_service, service_manager_type;
+type apex_service, service_manager_type;
+type artd_service, service_manager_type;
+type artd_pre_reboot_service, service_manager_type;
+type audioserver_service, service_manager_type, isolated_compute_allowed_service;
+type authorization_service, service_manager_type;
+type batteryproperties_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type bluetooth_service, service_manager_type;
+type cameraserver_service, service_manager_type, isolated_compute_allowed_service;
+type fwk_camera_service, service_manager_type;
+type default_android_service, service_manager_type;
+type device_config_updatable_service, system_api_service, system_server_service,service_manager_type;
+type dexopt_chroot_setup_service, service_manager_type;
+type dnsresolver_service, service_manager_type;
+type drmserver_service, service_manager_type;
+type dumpstate_service, service_manager_type;
+type evsmanagerd_service, service_manager_type;
+type fingerprintd_service, service_manager_type;
+type fwk_automotive_display_service, service_manager_type;
+type gatekeeper_service, app_api_service, service_manager_type;
+type gpu_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type idmap_service, service_manager_type;
+type incident_service, service_manager_type;
+type installd_service, service_manager_type;
+type credstore_service, app_api_service, service_manager_type;
+type keystore_compat_hal_service, service_manager_type;
+type keystore_maintenance_service, service_manager_type;
+type keystore_metrics_service, service_manager_type;
+type keystore_service, service_manager_type;
+type legacykeystore_service, service_manager_type;
+type lpdump_service, service_manager_type;
+type mdns_service, service_manager_type;
+type mediaserver_service, service_manager_type, isolated_compute_allowed_service;
+type mediametrics_service, service_manager_type;
+type mediaextractor_service, service_manager_type;
+type mediadrmserver_service, service_manager_type;
+type mediatranscoding_service, app_api_service, service_manager_type;
+type netd_service, service_manager_type;
+type nfc_service, service_manager_type;
+type ondevicepersonalization_system_service, system_api_service, system_server_service, service_manager_type;
+type ot_daemon_service, service_manager_type;
+type profiling_service, app_api_service, system_server_service, service_manager_type;
+type radio_service, service_manager_type;
+type secure_element_service, service_manager_type;
+type service_manager_service, service_manager_type;
+type storaged_service, service_manager_type;
+type surfaceflinger_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type system_app_service, service_manager_type;
+type system_net_netd_service, service_manager_type;
+type system_suspend_control_internal_service, service_manager_type;
+type system_suspend_control_service, service_manager_type;
+type update_engine_service, service_manager_type;
+type update_engine_stable_service, service_manager_type;
+type virtualization_service, service_manager_type;
+type virtual_camera_service, service_manager_type;
+type virtual_touchpad_service, service_manager_type;
+type vold_service, service_manager_type;
+type vr_hwc_service, service_manager_type;
+type vrflinger_vsync_service, service_manager_type;
+
+# system_server_services broken down
+type accessibility_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type account_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type activity_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type activity_task_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type adb_service, system_api_service, system_server_service, service_manager_type;
+type adservices_manager_service, system_api_service, system_server_service, service_manager_type;
+type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type app_binding_service, system_server_service, service_manager_type;
+
+#line 71
+ type app_function_service, app_api_service, system_server_service, service_manager_type;
+#line 73
+
+type app_hibernation_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type app_integrity_service, system_api_service, system_server_service, service_manager_type;
+type app_prediction_service, app_api_service, system_server_service, service_manager_type;
+type app_search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type appops_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type appwidget_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type archive_service, app_api_service, system_server_service, service_manager_type;
+type assetatlas_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type attestation_verification_service, app_api_service, system_server_service, service_manager_type;
+type audio_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type auth_service, app_api_service, system_server_service, service_manager_type;
+type autofill_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type backup_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type batterystats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type battery_service, system_server_service, service_manager_type;
+type binder_calls_stats_service, system_server_service, service_manager_type;
+type blob_store_service, app_api_service, system_server_service, service_manager_type;
+type bluetooth_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type broadcastradio_service, app_api_service, system_server_service, service_manager_type;
+type cacheinfo_service, system_api_service, system_server_service, service_manager_type;
+type cameraproxy_service, system_server_service, service_manager_type;
+type clipboard_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type cloudsearch_service, app_api_service, system_server_service, service_manager_type;
+type contexthub_service, app_api_service, system_server_service, service_manager_type;
+type contextual_search_service, app_api_service, system_server_service, service_manager_type;
+type crossprofileapps_service, app_api_service, system_server_service, service_manager_type;
+type IProxyService_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type companion_device_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connectivity_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connectivity_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connmetrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type consumer_ir_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type content_capture_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type content_suggestions_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type content_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type country_detector_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+# Note: The coverage_service should only be enabled for userdebug / eng builds that were compiled
+# with EMMA_INSTRUMENT=true. We should consider locking this down in the future.
+type coverage_service, system_server_service, service_manager_type;
+type cpuinfo_service, system_api_service, system_server_service, service_manager_type;
+type cpu_monitor_service, system_server_service, service_manager_type;
+type credential_service, app_api_service, ephemeral_app_api_service, system_api_service, system_server_service, service_manager_type;
+type dataloader_manager_service, system_server_service, service_manager_type;
+type dbinfo_service, system_api_service, system_server_service, service_manager_type;
+type device_config_service, system_server_service, service_manager_type;
+type device_policy_service, app_api_service, system_server_service, service_manager_type;
+type device_state_service, app_api_service, system_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type deviceidle_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type device_identifiers_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type devicestoragemonitor_service, system_server_service, service_manager_type;
+type diskstats_service, system_api_service, system_server_service, service_manager_type;
+type display_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type domain_verification_service, app_api_service, system_server_service, service_manager_type;
+type color_display_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type ecm_enhanced_confirmation_service, app_api_service, system_server_service, service_manager_type;
+type external_vibrator_service, system_server_service, service_manager_type;
+type file_integrity_service, app_api_service, system_server_service, service_manager_type;
+type font_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type netd_listener_service, system_server_service, service_manager_type;
+type network_watchlist_service, system_server_service, service_manager_type;
+type devicelock_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type DockObserver_service, system_server_service, service_manager_type;
+type dreams_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type dropbox_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type ethernet_service, app_api_service, system_server_service, service_manager_type;
+type biometric_service, app_api_service, system_server_service, service_manager_type;
+type bugreport_service, app_api_service, system_server_service, service_manager_type;
+type platform_compat_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type face_service, app_api_service, system_server_service, service_manager_type;
+type fingerprint_service, app_api_service, system_server_service, service_manager_type;
+type fwk_altitude_service, system_server_service, service_manager_type;
+type fwk_stats_service, app_api_service, system_server_service, service_manager_type;
+type fwk_sensor_service, system_server_service, service_manager_type;
+type fwk_vibrator_control_service, system_server_service, service_manager_type;
+type game_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
+type gnss_time_update_service, system_server_service, service_manager_type;
+type grammatical_inflection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type graphicsstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type hardware_service, system_server_service, service_manager_type;
+type hardware_properties_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type hdmi_control_service, app_api_service, system_server_service, service_manager_type;
+type healthconnect_service, app_api_service, system_server_service, service_manager_type;
+type hint_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type imms_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type incremental_service, system_server_service, service_manager_type;
+type input_method_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+
+#line 162
+ type intrusion_detection_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+#line 164
+
+type ipsec_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type iris_service, app_api_service, system_server_service, service_manager_type;
+type jobscheduler_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type launcherapps_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type legacy_permission_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type light_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type locale_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type location_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type location_time_zone_manager_service, system_server_service, service_manager_type;
+type lock_settings_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type looper_stats_service, system_server_service, service_manager_type;
+type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_projection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+
+#line 179
+ type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+#line 181
+
+type media_router_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_session_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type meminfo_service, system_api_service, system_server_service, service_manager_type;
+type memtrackproxy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type midi_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type mount_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type music_recognition_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type nearby_service, app_api_service, system_server_service, service_manager_type;
+type netpolicy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type netstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type network_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type network_score_service, system_api_service, system_server_service, service_manager_type;
+type network_stack_service, system_server_service, service_manager_type;
+type network_time_update_service, system_server_service, service_manager_type;
+type notification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type oem_lock_service, system_api_service, system_server_service, service_manager_type;
+type otadexopt_service, system_server_service, service_manager_type;
+type overlay_service, system_api_service, system_server_service, service_manager_type;
+type pac_proxy_service, app_api_service, system_server_service, service_manager_type;
+type package_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type package_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type people_service, app_api_service, system_server_service, service_manager_type;
+type permission_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type permissionmgr_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type permission_checker_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type persistent_data_block_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type pinner_service, system_server_service, service_manager_type;
+type powerstats_service, app_api_service, system_server_service, service_manager_type;
+type power_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type print_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type processinfo_service, system_server_service, service_manager_type;
+type procstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type reboot_readiness_service, app_api_service, system_server_service, service_manager_type;
+type recovery_service, system_server_service, service_manager_type;
+type registry_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type remote_auth_service, app_api_service, system_server_service, service_manager_type;
+type remote_provisioning_service, system_server_service, service_manager_type;
+type resources_manager_service, system_api_service, system_server_service, service_manager_type;
+type restrictions_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type role_service, app_api_service, system_server_service, service_manager_type;
+type rollback_service, app_api_service, system_server_service, service_manager_type;
+type runtime_service, system_server_service, service_manager_type;
+type rttmanager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type samplingprofiler_service, system_server_service, service_manager_type;
+type scheduling_policy_service, system_server_service, service_manager_type;
+type search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type search_ui_service, app_api_service, system_server_service, service_manager_type;
+type sec_key_att_app_id_provider_service, app_api_service, system_server_service, service_manager_type;
+type security_state_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type selection_toolbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sensitive_content_protection_service, app_api_service, system_server_service, service_manager_type;
+type sensorservice_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sensor_privacy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type serial_service, system_api_service, system_server_service, service_manager_type;
+type servicediscovery_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type settings_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type shortcut_service, app_api_service, system_server_service, service_manager_type;
+type slice_service, app_api_service, system_server_service, service_manager_type;
+type smartspace_service, app_api_service, system_server_service, service_manager_type;
+type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sdk_sandbox_service, app_api_service, system_server_service, service_manager_type;
+type system_config_service, system_api_service, system_server_service, service_manager_type;
+type system_server_dumper_service, system_api_service, system_server_service, service_manager_type;
+type system_update_service, system_server_service, service_manager_type;
+type soundtrigger_middleware_service, system_server_service, service_manager_type;
+type speech_recognition_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type tare_service, app_api_service, system_server_service, service_manager_type;
+type task_service, system_server_service, service_manager_type;
+type testharness_service, system_server_service, service_manager_type;
+type textclassification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type textservices_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type texttospeech_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type telecom_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type thermal_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type threadnetwork_service, app_api_service, system_server_service, service_manager_type;
+type timedetector_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type timezonedetector_service, app_api_service, system_server_service, service_manager_type;
+type translation_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type trust_service, app_api_service, system_server_service, service_manager_type;
+type tv_ad_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_iapp_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_tuner_resource_mgr_service, app_api_service, system_server_service, service_manager_type;
+type uimode_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type updatelock_service, system_api_service, system_server_service, service_manager_type;
+type uri_grants_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type usagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type usb_service, app_api_service, system_server_service, service_manager_type;
+type user_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type uwb_service, app_api_service, system_server_service, service_manager_type;
+type vcn_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vibrator_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type virtual_device_service, app_api_service, system_server_service, service_manager_type;
+type virtual_device_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type voiceinteraction_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vpn_management_service, app_api_service, system_server_service, service_manager_type;
+type vr_manager_service, system_server_service, service_manager_type;
+type wallpaper_service, app_api_service, system_server_service, service_manager_type;
+type wallpaper_effects_generation_service, app_api_service, system_server_service, service_manager_type;
+type webviewupdate_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type wifip2p_service, app_api_service, system_server_service, service_manager_type;
+type wifiscanner_service, app_api_service, system_server_service, service_manager_type;
+type wifi_service, app_api_service, system_server_service, service_manager_type;
+type wifinl80211_service, service_manager_type;
+type wifiaware_service, app_api_service, system_server_service, service_manager_type;
+
+#line 289
+ type wifi_usd_service, app_api_service, system_server_service, service_manager_type;
+#line 291
+
+type window_service, system_api_service, system_server_service, service_manager_type;
+type inputflinger_service, system_api_service, system_server_service, service_manager_type;
+type tethering_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type emergency_affordance_service, system_server_service, service_manager_type;
+
+###
+### HAL Services
+###
+
+type hal_audio_service, protected_service, hal_service_type, service_manager_type;
+type hal_audiocontrol_service, hal_service_type, service_manager_type;
+type hal_authgraph_service, protected_service, hal_service_type, service_manager_type;
+type hal_authsecret_service, protected_service, hal_service_type, service_manager_type;
+type hal_bluetooth_service, protected_service, hal_service_type, service_manager_type;
+type hal_bootctl_service, protected_service, hal_service_type, service_manager_type;
+type hal_broadcastradio_service, protected_service, hal_service_type, service_manager_type;
+type hal_camera_service, protected_service, hal_service_type, service_manager_type;
+type hal_can_controller_service, protected_service, hal_service_type, service_manager_type;
+type hal_cas_service, hal_service_type, service_manager_type;
+type hal_codec2_service, hal_service_type, service_manager_type, isolated_compute_allowed_service;
+type hal_confirmationui_service, protected_service, hal_service_type, service_manager_type;
+type hal_contexthub_service, protected_service, hal_service_type, service_manager_type;
+type hal_drm_service, hal_service_type, service_manager_type;
+type hal_dumpstate_service, protected_service, hal_service_type, service_manager_type;
+type hal_evs_service, protected_service, hal_service_type, service_manager_type;
+type hal_face_service, protected_service, hal_service_type, service_manager_type;
+type hal_fastboot_service, protected_service, hal_service_type, service_manager_type;
+type hal_fingerprint_service, protected_service, hal_service_type, service_manager_type;
+type hal_gnss_service, protected_service, hal_service_type, service_manager_type;
+type hal_graphics_allocator_service, hal_service_type, service_manager_type;
+type hal_graphics_composer_service, protected_service, hal_service_type, service_manager_type;
+type hal_graphics_mapper_service, hal_service_type, service_manager_type;
+type hal_health_service, protected_service, hal_service_type, service_manager_type;
+type hal_health_storage_service, protected_service, hal_service_type, service_manager_type;
+type hal_identity_service, protected_service, hal_service_type, service_manager_type;
+type hal_input_processor_service, protected_service, hal_service_type, service_manager_type;
+type hal_ir_service, protected_service, hal_service_type, service_manager_type;
+type hal_ivn_service, protected_service, hal_service_type, service_manager_type;
+type hal_keymint_service, protected_service, hal_service_type, service_manager_type;
+type hal_light_service, protected_service, hal_service_type, service_manager_type;
+type hal_macsec_service, protected_service, hal_service_type, service_manager_type;
+
+#line 333
+ type hal_mediaquality_service, protected_service, hal_service_type, service_manager_type;
+#line 335
+
+type hal_memtrack_service, protected_service, hal_service_type, service_manager_type;
+type hal_neuralnetworks_service, hal_service_type, service_manager_type;
+type hal_nfc_service, protected_service, hal_service_type, service_manager_type;
+type hal_oemlock_service, protected_service, hal_service_type, service_manager_type;
+type hal_power_service, protected_service, hal_service_type, service_manager_type;
+type hal_power_stats_service, protected_service, hal_service_type, service_manager_type;
+type hal_radio_service, protected_service, hal_service_type, service_manager_type;
+type hal_rebootescrow_service, protected_service, hal_service_type, service_manager_type;
+type hal_remoteaccess_service, protected_service, hal_service_type, service_manager_type;
+type hal_remotelyprovisionedcomponent_avf_service, protected_service, hal_service_type, service_manager_type;
+type hal_remotelyprovisionedcomponent_service, protected_service, hal_service_type, service_manager_type;
+type hal_sensors_service, protected_service, hal_service_type, service_manager_type;
+type hal_secretkeeper_service, protected_service, hal_service_type, service_manager_type;
+type hal_secureclock_service, protected_service, hal_service_type, service_manager_type;
+type hal_secure_element_service, protected_service, hal_service_type, service_manager_type;
+type hal_sharedsecret_service, protected_service, hal_service_type, service_manager_type;
+type hal_system_suspend_service, protected_service, hal_service_type, service_manager_type;
+type hal_tetheroffload_service, protected_service, hal_service_type, service_manager_type;
+type hal_thermal_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_cec_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_connection_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_earc_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_input_service, protected_service, hal_service_type, service_manager_type;
+type hal_threadnetwork_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_tuner_service, protected_service, hal_service_type, service_manager_type;
+type hal_usb_service, protected_service, hal_service_type, service_manager_type;
+type hal_usb_gadget_service, protected_service, hal_service_type, service_manager_type;
+type hal_uwb_service, protected_service, hal_service_type, service_manager_type;
+type hal_vehicle_service, protected_service, hal_service_type, service_manager_type;
+type hal_vibrator_service, protected_service, hal_service_type, service_manager_type;
+type hal_weaver_service, protected_service, hal_service_type, service_manager_type;
+type hal_nlinterceptor_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_hostapd_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_supplicant_service, protected_service, hal_service_type, service_manager_type;
+type hal_gatekeeper_service, protected_service, hal_service_type, service_manager_type;
+
+#line 372
+ type hal_vm_capabilities_service, protected_service, hal_service_type, service_manager_type;
+#line 374
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/servicemanager.te"
+# servicemanager - the Binder context manager
+type servicemanager, domain, mlstrustedsubject;
+type servicemanager_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/sgdisk.te"
+# sgdisk called from vold
+type sgdisk, domain;
+type sgdisk_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/shared_relro.te"
+# Process which creates/updates shared RELRO files to be used by other apps.
+type shared_relro, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/shell.te"
+# Domain for shell processes spawned by ADB or console service.
+type shell, domain, mlstrustedsubject;
+type shell_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/simpleperf.te"
+type simpleperf, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/simpleperf_app_runner.te"
+type simpleperf_app_runner, domain, mlstrustedsubject;
+type simpleperf_app_runner_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/slideshow.te"
+# slideshow seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type slideshow, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/statsd.te"
+type statsd, domain, mlstrustedsubject;
+type statsd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/su.te"
+# Domain used for su processes, as well as for adbd and adb shell
+# after performing an adb root command.
+
+# All types must be defined regardless of build variant to ensure
+# policy compilation succeeds with userdebug/user combination at boot
+type su, domain;
+
+# File types must be defined for file_contexts.
+type su_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/surfaceflinger.te"
+# surfaceflinger - display compositor service
+type surfaceflinger, domain;
+type surfaceflinger_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/system_app.te"
+###
+### Apps that run with the system UID, e.g. com.android.system.ui,
+### com.android.settings. These are not as privileged as the system
+### server.
+###
+
+type system_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/system_server.te"
+#
+# System Server aka system_server spawned by zygote.
+# Most of the framework services run in this process.
+#
+type system_server, domain;
+type system_server_tmpfs, file_type, mlstrustedobject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/tee.te"
+##
+# trusted execution environment (tee) daemon
+#
+type tee, domain;
+
+# Device(s) for communicating with the TEE
+type tee_device, dev_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/tombstoned.te"
+# debugger interface
+type tombstoned, domain, mlstrustedsubject;
+type tombstoned_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/toolbox.te"
+# Any toolbox command run by init.
+# Do NOT use this domain for toolbox when run by any other domain.
+type toolbox, domain;
+type toolbox_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/traced.te"
+type traced, domain, coredomain, mlstrustedsubject;
+type traced_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/traced_perf.te"
+type traced_perf, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/traced_probes.te"
+type traced_probes, domain, coredomain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/traceur_app.te"
+type traceur_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/ueventd.te"
+# ueventd seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type ueventd, domain;
+type ueventd_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/uncrypt.te"
+# uncrypt
+type uncrypt, domain, mlstrustedsubject;
+type uncrypt_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/untrusted_app.te"
+###
+### Untrusted apps.
+###
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The untrusted_app domain is the default assignment in
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml. In current AOSP, this
+### domain is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key. To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
+###
+
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion >= 34.
+type untrusted_app, domain;
+# This file defines the rules for untrusted apps running with
+# 31 < targetSdkVersion <= 33.
+type untrusted_app_32, domain;
+# This file defines the rules for untrusted apps running with
+# 29 < targetSdkVersion <= 31.
+type untrusted_app_30, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion = 29.
+type untrusted_app_29, domain;
+# This file defines the rules for untrusted apps running with
+# 25 < targetSdkVersion <= 28.
+type untrusted_app_27, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion <= 25.
+type untrusted_app_25, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/update_engine.te"
+# Domain for update_engine daemon.
+type update_engine, domain, update_engine_common;
+type update_engine_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/update_verifier.te"
+# update_verifier
+type update_verifier, domain;
+type update_verifier_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/usbd.te"
+type usbd, domain;
+type usbd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vdc.te"
+# vdc is a helper program for making Binder calls to vold. It is spawned from
+# init for various reasons, such as initializing file-based encryption and
+# metadata encryption, and managing userdata checkpointing.
+#
+# We also transition into this domain from dumpstate, when
+# collecting bug reports.
+type vdc, domain;
+type vdc_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vendor_init.te"
+# vendor_init is its own domain.
+type vendor_init, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vendor_misc_writer.te"
+# vendor_misc_writer
+type vendor_misc_writer, domain;
+type vendor_misc_writer_exec, vendor_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vendor_modprobe.te"
+type vendor_modprobe, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vendor_shell.te"
+type vendor_shell, domain;
+type vendor_shell_exec, exec_type, vendor_file_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vendor_toolbox.te"
+# Toolbox installation for vendor binaries / scripts
+# Non-vendor processes are not allowed to execute the binary
+# and is always executed without transition.
+type vendor_toolbox_exec, exec_type, vendor_file_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/virtual_camera.te"
+# virtual_camera - virtual camera daemon
+
+
+#line 3
+ type virtual_camera, domain, coredomain;
+#line 3
+ type virtual_camera_exec, system_file_type, exec_type, file_type;
+#line 6
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/virtual_touchpad.te"
+type virtual_touchpad, domain;
+type virtual_touchpad_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/virtualizationmanager.te"
+# Domain for a child process that manages virtual machines on behalf of its parent.
+
+#line 2
+ type virtualizationmanager, domain, coredomain;
+#line 2
+ type virtualizationmanager_exec, system_file_type, exec_type, file_type;
+#line 5
+
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vndservice.te"
+type service_manager_vndservice, vndservice_manager_type;
+type default_android_vndservice, vndservice_manager_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vndservicemanager.te"
+# vndservicemanager - the Binder context manager for vendor processes
+type vndservicemanager, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vold.te"
+# volume manager
+type vold, domain;
+type vold_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/vold_prepare_subdirs.te"
+# SELinux directory creation and labelling for vold-managed directories
+type vold_prepare_subdirs, domain;
+type vold_prepare_subdirs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/watchdogd.te"
+# watchdogd seclabel is specified in init.<board>.rc
+type watchdogd, domain;
+type watchdogd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/webview_zygote.te"
+# webview_zygote is an auxiliary zygote process that is used to spawn
+# isolated_app processes for rendering untrusted web content.
+type webview_zygote, domain;
+type webview_zygote_exec, exec_type, file_type;
+type webview_zygote_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/wificond.te"
+# wificond
+type wificond, domain;
+type wificond_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/public/zygote.te"
+# zygote
+type zygote, domain;
+type zygote_tmpfs, file_type;
+type zygote_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
+#line 1 "system/sepolicy/private/attributes"
+
+#line 1
+attribute hal_lazy_test;
+#line 1
+expandattribute hal_lazy_test true;
+#line 1
+attribute hal_lazy_test_client;
+#line 1
+expandattribute hal_lazy_test_client true;
+#line 1
+attribute hal_lazy_test_server;
+#line 1
+expandattribute hal_lazy_test_server false;
+#line 1
+
+#line 1
+neverallow { hal_lazy_test_server -halserverdomain } domain:process fork;
+#line 1
+# hal_*_client and halclientdomain attributes are always expanded for
+#line 1
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+#line 1
+# verified by CTS since these attributes are already expanded by that time.
+#line 1
+
+#line 1
+;
+
+# This is applied to apps on vendor images with SDK <=30 only,
+# to exempt them from recent mls changes. It must not be applied
+# to any domain on newer system or vendor image.
+attribute mlsvendorcompat;
+
+# Attributes for property types having both system_property_type
+# and vendor_property_type. Such types are ill-formed because
+# property owner attributes must be exclusive.
+attribute system_and_vendor_property_type;
+expandattribute system_and_vendor_property_type false;
+
+# HALs
+#line 17
+
+
+#line 22
+
+
+# All SDK sandbox domains
+attribute sdk_sandbox_all;
+# The SDK sandbox domains for the current SDK level.
+attribute sdk_sandbox_current;
+# Common to adbd and adbd_tradeinmode.
+attribute adbd_common;
+
+# Provides access to platform update services.
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+attribute update_provider;
+expandattribute update_provider false;
+
+#line 38
+
+
+#line 42
+
+#line 1 "system/sepolicy/private/aconfigd.te"
+# aconfigd -- manager for aconfig flags
+type aconfigd, domain, coredomain, mlstrustedsubject;
+type aconfigd_exec, exec_type, file_type, system_file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init aconfigd_exec:file { getattr open read execute map };
+#line 5
+allow init aconfigd:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow aconfigd aconfigd_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init aconfigd:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init aconfigd:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init aconfigd_exec:process aconfigd;
+#line 5
+
+#line 5
+
+
+allow aconfigd metadata_file:dir search;
+
+allow aconfigd {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+allow aconfigd {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
+
+# allow aconfigd to read vendor partition storage files
+allow aconfigd vendor_aconfig_storage_file:file { getattr open read ioctl lock map watch watch_reads };
+allow aconfigd vendor_aconfig_storage_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# allow aconfigd to read /apex dir
+allow aconfigd apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow aconfigd apex_mnt_dir:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit aconfigd apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
+
+# Do not allow write access to boot/map storage files except, aconfigd and aconfigd_mainline.
+# These files are meant to serve flag reads for all processes. They are created by aconfigd (for
+# platform storage files) and aconfigd_mainline (mainline storage files) processes.
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_metadata_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_metadata_file:file { append create link unlink relabelfrom rename setattr write };
+
+# Only aconfigd and aconfigd_mainline can access persist storage files
+# These files are meant to serve as persist flag value storage, only aconfigd and
+# aconfigd_mainline process should manage them. Other processes should have zero access.
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_flags_metadata_file:dir *;
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_flags_metadata_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1 "system/sepolicy/private/aconfigd_mainline.te"
+# aconfigd_mainline -- manager for mainline aconfig flags
+type aconfigd_mainline, domain, coredomain, mlstrustedsubject;
+type aconfigd_mainline_exec, exec_type, file_type, system_file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init aconfigd_mainline_exec:file { getattr open read execute map };
+#line 5
+allow init aconfigd_mainline:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow aconfigd_mainline aconfigd_mainline_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init aconfigd_mainline:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init aconfigd_mainline:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init aconfigd_mainline_exec:process aconfigd_mainline;
+#line 5
+
+#line 5
+
+
+# allow aconfigd_mainline to search /metadata dir as it needs to access files under
+# /metadata/aconfig dir
+allow aconfigd_mainline metadata_file:dir search;
+
+# aconfigd_mainline should be able to create storage files under /metadata/aconfig dir
+allow aconfigd_mainline {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+allow aconfigd_mainline {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow aconfigd_mainline to log to the kernel.
+allow aconfigd_mainline kmsg_device:chr_file write;
+
+# allow aconfigd_mainline to read /apex dir, aconfigd_mainline need to loop thru all
+# dirs under /apex to find all currently mounted mainline modules and get their
+# storage files
+allow aconfigd_mainline apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow aconfigd_mainline apex_mnt_dir:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit aconfigd_mainline apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd_mainline domain
+neverallow { domain -init } aconfigd_mainline:process transition;
+neverallow * aconfigd_mainline:process dyntransition;
+#line 1 "system/sepolicy/private/adbd.te"
+### ADB daemon
+
+typeattribute adbd coredomain;
+typeattribute adbd mlstrustedsubject;
+typeattribute adbd adbd_common;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init adbd_exec:file { getattr open read execute map };
+#line 7
+allow init adbd:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow adbd adbd_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init adbd:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init adbd:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init adbd_exec:process adbd;
+#line 7
+
+#line 7
+
+
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow adbd shell_exec:file { getattr open read execute map };
+#line 9
+allow adbd shell:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow shell shell_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+allow shell adbd:process sigchld;
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit adbd shell:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow adbd shell:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition adbd shell_exec:process shell;
+#line 9
+
+
+# Allow adb to setcon() to tradeinmode.
+allow adbd self:process setcurrent;
+allow adbd adbd_tradeinmode:process dyntransition;
+
+#line 17
+
+
+# When 'adb shell' is executed in recovery mode, adbd explicitly
+# switches into shell domain using setcon() because the shell executable
+# is not labeled as shell but as rootfs.
+#line 28
+
+
+# Control Perfetto traced and obtain traces from it.
+# Needed to allow port forwarding directly to traced.
+
+#line 32
+allow adbd traced_consumer_socket:sock_file write;
+#line 32
+allow adbd traced:unix_stream_socket connectto;
+#line 32
+
+
+# Do not sanitize the environment or open fds of the shell. Allow signaling
+# created processes.
+allow adbd shell:process { noatsecure signal };
+
+# Set UID and GID to shell. Set supplementary groups.
+allow adbd self:{ capability cap_userns } { setuid setgid };
+
+# Drop capabilities from bounding set on user builds.
+allow adbd self:{ capability cap_userns } setpcap;
+
+# ignore spurious denials for adbd when disk space is low.
+dontaudit adbd self:{ capability cap_userns } sys_resource;
+
+# Create and use network sockets.
+
+#line 48
+typeattribute adbd netdomain;
+#line 48
+
+# Access /dev/usb-ffs/adb/ep0
+allow adbd functionfs:dir search;
+allow adbd functionfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm adbd functionfs:file ioctl {
+ 0x80096782
+ 0x00006703
+};
+
+# adb pull /data/local/traces/*
+allow adbd trace_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd trace_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# adb pull /data/misc/profman.
+allow adbd profman_dump_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd profman_dump_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# adb push/pull sdcard.
+allow adbd tmpfs:dir search;
+allow adbd rootfs:lnk_file { getattr open read ioctl lock map watch watch_reads }; # /sdcard symlink
+allow adbd tmpfs:lnk_file { getattr open read ioctl lock map watch watch_reads }; # /mnt/sdcard symlink
+allow adbd { sdcard_type fuse }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow adbd { sdcard_type fuse }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# adb pull /data/anr/traces.txt
+allow adbd anr_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd anr_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# adb pull /vendor/framework/*
+allow adbd vendor_framework_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd vendor_framework_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
+
+#line 81
+
+#line 81
+allow adbd property_socket:sock_file write;
+#line 81
+allow adbd init:unix_stream_socket connectto;
+#line 81
+
+#line 81
+allow adbd shell_prop:property_service set;
+#line 81
+
+#line 81
+allow adbd shell_prop:file { getattr open read map };
+#line 81
+
+#line 81
+
+
+#line 82
+
+#line 82
+allow adbd property_socket:sock_file write;
+#line 82
+allow adbd init:unix_stream_socket connectto;
+#line 82
+
+#line 82
+allow adbd powerctl_prop:property_service set;
+#line 82
+
+#line 82
+allow adbd powerctl_prop:file { getattr open read map };
+#line 82
+
+#line 82
+
+
+#line 83
+allow adbd ffs_config_prop:file { getattr open read map };
+#line 83
+
+
+#line 84
+
+#line 84
+allow adbd property_socket:sock_file write;
+#line 84
+allow adbd init:unix_stream_socket connectto;
+#line 84
+
+#line 84
+allow adbd ffs_control_prop:property_service set;
+#line 84
+
+#line 84
+allow adbd ffs_control_prop:file { getattr open read map };
+#line 84
+
+#line 84
+
+
+#line 85
+
+#line 85
+allow adbd property_socket:sock_file write;
+#line 85
+allow adbd init:unix_stream_socket connectto;
+#line 85
+
+#line 85
+allow adbd adbd_tradeinmode_prop:property_service set;
+#line 85
+
+#line 85
+allow adbd adbd_tradeinmode_prop:file { getattr open read map };
+#line 85
+
+#line 85
+
+
+# Allow adbd start/stop mdnsd via ctl.start
+
+#line 88
+
+#line 88
+allow adbd property_socket:sock_file write;
+#line 88
+allow adbd init:unix_stream_socket connectto;
+#line 88
+
+#line 88
+allow adbd ctl_mdnsd_prop:property_service set;
+#line 88
+
+#line 88
+allow adbd ctl_mdnsd_prop:file { getattr open read map };
+#line 88
+
+#line 88
+
+
+# Read device's overlayfs related properties and files
+#line 94
+
+
+# Run /system/bin/bu
+allow adbd system_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Perform binder IPC to surfaceflinger (screencap)
+# XXX Run screencap in a separate domain?
+
+#line 101
+# Call the servicemanager and transfer references to it.
+#line 101
+allow adbd servicemanager:binder { call transfer };
+#line 101
+# Allow servicemanager to send out callbacks
+#line 101
+allow servicemanager adbd:binder { call transfer };
+#line 101
+# servicemanager performs getpidcon on clients.
+#line 101
+allow servicemanager adbd:dir search;
+#line 101
+allow servicemanager adbd:file { read open };
+#line 101
+allow servicemanager adbd:process getattr;
+#line 101
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 101
+# all domains in domain.te.
+#line 101
+
+
+#line 102
+# Call the server domain and optionally transfer references to it.
+#line 102
+allow adbd surfaceflinger:binder { call transfer };
+#line 102
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 102
+allow surfaceflinger adbd:binder transfer;
+#line 102
+# Receive and use open files from the server.
+#line 102
+allow adbd surfaceflinger:fd use;
+#line 102
+
+
+#line 103
+# Call the server domain and optionally transfer references to it.
+#line 103
+allow adbd gpuservice:binder { call transfer };
+#line 103
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 103
+allow gpuservice adbd:binder transfer;
+#line 103
+# Receive and use open files from the server.
+#line 103
+allow adbd gpuservice:fd use;
+#line 103
+
+# b/13188914
+allow adbd gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow adbd gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+#line 108
+allow adbd system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 108
+allow adbd system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 108
+
+
+# Needed for various screenshots
+
+#line 111
+typeattribute adbd halclientdomain;
+#line 111
+typeattribute adbd hal_graphics_allocator_client;
+#line 111
+
+#line 111
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 111
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 111
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 111
+
+#line 111
+typeattribute adbd hal_graphics_allocator;
+#line 111
+# Find passthrough HAL implementations
+#line 111
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 111
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 111
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 111
+
+#line 111
+
+
+# Read /data/misc/adb/adb_keys.
+allow adbd adb_keys_file:dir search;
+allow adbd adb_keys_file:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 123
+
+
+# ndk-gdb invokes adb forward to forward the gdbserver socket.
+allow adbd app_data_file:dir search;
+allow adbd app_data_file:sock_file write;
+allow adbd appdomain:unix_stream_socket connectto;
+
+# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
+allow adbd zygote_exec:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd system_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow pulling the SELinux policy for CTS purposes
+allow adbd selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd selinuxfs:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd kernel:security read_policy;
+allow adbd service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd property_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd sepolicy_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow pulling config.gz for CTS purposes
+allow adbd config_gz:file { getattr open read ioctl lock map watch watch_reads };
+
+# For CTS listening ports test.
+allow adbd proc_net_tcp_udp:file { getattr open read ioctl lock map watch watch_reads };
+
+allow adbd gpu_service:service_manager find;
+allow adbd surfaceflinger_service:service_manager find;
+allow adbd bootchart_data_file:dir search;
+allow adbd bootchart_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow access to external storage; we have several visible mount points under /storage
+# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
+allow adbd storage_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd storage_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow adbd mnt_user_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd mnt_user_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow adbd media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow adbd media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 168
+allow adbd apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 168
+allow adbd apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 168
+
+
+allow adbd rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow killing child "perfetto" binary processes, which auto-transition to
+# their own domain. Allows propagating termination of "adb shell perfetto ..."
+# invocations.
+allow adbd perfetto:process signal;
+
+# Allow to pull Perfetto traces.
+allow adbd perfetto_traces_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd perfetto_traces_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow to push and manage configs in /data/misc/perfetto-configs.
+allow adbd perfetto_configs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow adbd perfetto_configs_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Connect to shell and use a socket transferred from it.
+# Used for e.g. abb.
+allow adbd shell:unix_stream_socket { read write shutdown };
+allow adbd shell:fd use;
+
+# adb push/pull /data/local/tmp.
+allow adbd shell_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow adbd shell_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow pull /vendor/apex files for CTS tests
+
+#line 195
+allow adbd vendor_apex_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 195
+allow adbd vendor_apex_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 195
+
+
+# Allow adb pull of updated apex files in /data/apex/active.
+allow adbd apex_data_file:dir search;
+allow adbd staging_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow adbd to pull /apex/apex-info-list.xml for CTS tests.
+allow adbd apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow reading tombstones. users can already use bugreports to get those.
+allow adbd tombstone_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd tombstone_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/local/tests.
+allow adbd shell_test_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow adbd shell_test_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow adbd shell_test_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+###
+### Neverallow rules
+###
+
+# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
+# transitions to the shell or tradeinmode domain (except when it crashes). In
+# particular, we never want to see a transition from adbd to su (aka "adb root")
+neverallow adbd { domain -crash_dump -shell -adbd_tradeinmode }:process transition;
+neverallow adbd {
+ domain
+
+
+ -adbd_tradeinmode
+}:process dyntransition;
+
+# Only init is allowed to enter the adbd domain via exec()
+neverallow { domain -init } adbd:process transition;
+neverallow * adbd:process dyntransition;
+#line 1 "system/sepolicy/private/adbd_common.te"
+### ADB daemon common rules.
+### Put things here that are needed for both adbd proper and adbd in trade-in mode.
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 5
+allow adbd_common mdnsd_socket:sock_file write;
+#line 5
+allow adbd_common mdnsd:unix_stream_socket connectto;
+#line 5
+
+
+# adbd probes for vsock support. Do not generate denials when
+# this occurs. (b/123569840)
+dontaudit adbd_common self:{ socket vsock_socket } create;
+
+# Allow adbd inside vm to forward vm's vsock.
+allow adbd_common self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } listen accept };
+
+# Access device logging gating property
+
+#line 15
+allow adbd_common device_logging_prop:file { getattr open read map };
+#line 15
+
+
+# Use a pseudo tty.
+allow adbd_common devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read persist.adb.tls_server.enable property
+
+#line 21
+allow adbd_common system_adbd_prop:file { getattr open read map };
+#line 21
+
+
+# Read whether or not Test Harness Mode is enabled
+
+#line 24
+allow adbd_common test_harness_prop:file { getattr open read map };
+#line 24
+
+
+# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
+
+#line 27
+
+#line 27
+allow adbd_common property_socket:sock_file write;
+#line 27
+allow adbd_common init:unix_stream_socket connectto;
+#line 27
+
+#line 27
+allow adbd_common adbd_prop:property_service set;
+#line 27
+
+#line 27
+allow adbd_common adbd_prop:file { getattr open read map };
+#line 27
+
+#line 27
+
+
+#line 28
+
+#line 28
+allow adbd_common property_socket:sock_file write;
+#line 28
+allow adbd_common init:unix_stream_socket connectto;
+#line 28
+
+#line 28
+allow adbd_common adbd_config_prop:property_service set;
+#line 28
+
+#line 28
+allow adbd_common adbd_config_prop:file { getattr open read map };
+#line 28
+
+#line 28
+
+
+# Read device's serial number from system properties
+
+#line 31
+allow adbd_common serialno_prop:file { getattr open read map };
+#line 31
+
+#line 1 "system/sepolicy/private/adbd_tradeinmode.te"
+### ADB in trade-in mode
+type adbd_tradeinmode, domain, coredomain, adbd_common;
+
+# Create and use network sockets.
+
+#line 5
+typeattribute adbd_tradeinmode netdomain;
+#line 5
+
+
+# Run /system/bin/tradeinmode
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow adbd_tradeinmode tradeinmode_exec:file { getattr open read execute map };
+#line 8
+allow adbd_tradeinmode tradeinmode:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow tradeinmode tradeinmode_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+allow tradeinmode adbd_tradeinmode:process sigchld;
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit adbd_tradeinmode tradeinmode:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow adbd_tradeinmode tradeinmode:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition adbd_tradeinmode tradeinmode_exec:process tradeinmode;
+#line 8
+
+
+# Baseline rules to make adbd work after setcon().
+allow adbd_tradeinmode adbd:unix_stream_socket {
+ { read getattr write setattr lock append bind connect getopt setopt shutdown map }
+ listen
+ accept
+};
+allow adbd_tradeinmode adbd:fd use;
+allow adbd_tradeinmode adbd:unix_dgram_socket { connect write };
+allow adbd_tradeinmode functionfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow adbd_tradeinmode functionfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow adbd_tradeinmode proc_uptime:file { getattr open read ioctl lock map watch watch_reads };
+allow adbd_tradeinmode rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 23
+
+#line 23
+allow adbd_tradeinmode property_socket:sock_file write;
+#line 23
+allow adbd_tradeinmode init:unix_stream_socket connectto;
+#line 23
+
+#line 23
+allow adbd_tradeinmode ffs_control_prop:property_service set;
+#line 23
+
+#line 23
+allow adbd_tradeinmode ffs_control_prop:file { getattr open read map };
+#line 23
+
+#line 23
+
+
+# Allow changing persist.adb.tradeinmode when testing.
+
+#line 10 "system/sepolicy/private/aidl_lazy_test_server.te"
+
+#line 1 "system/sepolicy/private/apex_test_prepostinstall.te"
+# APEX pre- & post-install test.
+#
+# Allow to run pre- and post-install hooks for APEX test modules
+# in debuggable builds.
+
+type apex_test_prepostinstall, domain, coredomain;
+type apex_test_prepostinstall_exec, system_file_type, exec_type, file_type;
+
+#line 20
+
+#line 1 "system/sepolicy/private/apexd.te"
+typeattribute apexd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init apexd_exec:file { getattr open read execute map };
+#line 3
+allow init apexd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow apexd apexd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init apexd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init apexd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init apexd_exec:process apexd;
+#line 3
+
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow apexd servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager apexd:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager apexd:dir search;
+#line 5
+allow servicemanager apexd:file { read open };
+#line 5
+allow servicemanager apexd:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+#line 6
+ allow apexd apex_service:service_manager { add find };
+#line 6
+ neverallow { domain -apexd } apex_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+
+# Allow creating, reading and writing of APEX files/dirs in the APEX data dir
+allow apexd apex_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow apexd apex_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# Allow relabeling file created in /data/apex/decompressed
+allow apexd apex_data_file:file relabelfrom;
+
+# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir
+allow apexd metadata_file:dir search;
+allow apexd apex_metadata_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow apexd apex_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow reserving space on /data/apex/ota_reserved for apex decompression
+allow apexd apex_ota_reserved_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow apexd apex_ota_reserved_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow apexd to create files and directories for snapshots of apex data
+allow apexd apex_data_file_type:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow apexd apex_data_file_type:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelto };
+allow apexd apex_module_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow apexd apex_module_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+allow apexd apex_rollback_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow apexd apex_rollback_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow apexd to read /data/misc_de and the directories under it, in order to
+# snapshot and restore apex data for all users.
+allow apexd {
+ system_userdir_file
+ system_data_file
+}:dir { open getattr read search ioctl lock watch watch_reads };
+
+# allow apexd to create loop devices with /dev/loop-control
+allow apexd loop_control_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# allow apexd to access loop devices
+allow apexd loop_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm apexd loop_device:blk_file ioctl {
+ 0x00004c05
+ 0x00004c04
+ 0x00004c00
+ 0x00004c09
+ 0x00004c08
+ 0x00004c01
+ 0x00001261
+ 0x00004c0a
+};
+# Allow apexd to access /dev/block
+allow apexd dev_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow apexd dev_type:blk_file getattr;
+
+#allow apexd to access virtual disks
+allow apexd vd_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# allow apexd to access /dev/block/dm-* (device-mapper entries)
+allow apexd dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow apexd dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# sys_admin is required to access the device-mapper and mount
+# dac_override, chown, and fowner are needed for snapshot and restore
+allow apexd self:{ capability cap_userns } { sys_admin chown dac_override dac_read_search fowner };
+
+# Note: fsetid is deliberately not included above. fsetid checks are
+# triggered by chmod on a directory or file owned by a group other
+# than one of the groups assigned to the current process to see if
+# the setgid bit should be cleared, regardless of whether the setgid
+# bit was even set. We do not appear to truly need this capability
+# for apexd to operate.
+dontaudit apexd self:{ capability cap_userns } fsetid;
+
+# allow apexd to create a mount point in /apex
+allow apexd apex_mnt_dir:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+# allow apexd to mount in /apex
+allow apexd apex_mnt_dir:filesystem { mount unmount };
+allow apexd apex_mnt_dir:dir mounton;
+# allow apexd to create symlinks in /apex
+allow apexd apex_mnt_dir:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file
+allow apexd apex_mnt_dir:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom mounton };
+allow apexd apex_info_file:file relabelto;
+# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update.
+allow apexd apex_info_file:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# allow apexd to unlink apex files in /data/apex/active
+# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX,
+# because it doesn't have write permission for staging_data_file object.
+allow apexd staging_data_file:file unlink;
+
+# allow apexd to read files from /data/app-staging and hardlink them to /data/apex.
+allow apexd staging_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow apexd staging_data_file:file { { getattr open read ioctl lock map watch watch_reads } link };
+# # Allow relabeling file created in /data/apex/decompressed
+allow apexd staging_data_file:file relabelto;
+# Allow renaming files in /data/apex/decompressed (from .ota.apex to .decompressed.apex)
+allow apexd staging_data_file:file rename;
+
+# allow apexd to read files from /vendor/apex
+
+#line 102
+allow apexd vendor_apex_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 102
+allow apexd vendor_apex_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 102
+
+
+#line 103
+allow apexd vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 103
+allow apexd vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 103
+
+
+# Unmount and mount filesystems
+allow apexd labeledfs:filesystem { mount unmount };
+
+# /sys directory tree traversal
+allow apexd sysfs_type:dir search;
+# Access to /sys/class/block
+allow apexd sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow apexd sysfs_type:file { getattr open read ioctl lock map watch watch_reads };
+# Configure read-ahead of dm-verity and loop devices
+# for dm-X
+allow apexd sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+allow apexd sysfs_dm:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# for loopX
+allow apexd sysfs_loop:dir { open getattr read search ioctl lock watch watch_reads };
+allow apexd sysfs_loop:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow apexd to log to the kernel.
+allow apexd kmsg_device:chr_file { open append write lock map };
+
+# Allow apexd to reboot device. Required for rollbacks of apexes that are
+# not covered by rollback manager.
+
+#line 126
+
+#line 126
+allow apexd property_socket:sock_file write;
+#line 126
+allow apexd init:unix_stream_socket connectto;
+#line 126
+
+#line 126
+allow apexd powerctl_prop:property_service set;
+#line 126
+
+#line 126
+allow apexd powerctl_prop:file { getattr open read map };
+#line 126
+
+#line 126
+
+
+# Allow apexd to stop itself
+
+#line 129
+
+#line 129
+allow apexd property_socket:sock_file write;
+#line 129
+allow apexd init:unix_stream_socket connectto;
+#line 129
+
+#line 129
+allow apexd ctl_apexd_prop:property_service set;
+#line 129
+
+#line 129
+allow apexd ctl_apexd_prop:file { getattr open read map };
+#line 129
+
+#line 129
+
+
+# Allow apexd to send control messages to load/unload apex from init
+
+#line 132
+
+#line 132
+allow apexd property_socket:sock_file write;
+#line 132
+allow apexd init:unix_stream_socket connectto;
+#line 132
+
+#line 132
+allow apexd ctl_apex_load_prop:property_service set;
+#line 132
+
+#line 132
+allow apexd ctl_apex_load_prop:file { getattr open read map };
+#line 132
+
+#line 132
+
+
+# Find the vold service, and call into vold to manage FS checkpoints
+allow apexd vold_service:service_manager find;
+
+#line 136
+# Call the server domain and optionally transfer references to it.
+#line 136
+allow apexd vold:binder { call transfer };
+#line 136
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 136
+allow vold apexd:binder transfer;
+#line 136
+# Receive and use open files from the server.
+#line 136
+allow apexd vold:fd use;
+#line 136
+
+
+# apexd is using bootstrap bionic
+
+#line 139
+ allow apexd system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 139
+ allow apexd system_bootstrap_lib_file:file { execute read open getattr map };
+#line 139
+
+
+# Allow apexd to be invoked with logwrapper from init during userspace reboot.
+allow apexd devpts:chr_file { read write };
+
+# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to
+# other processes
+
+#line 146
+# Each domain gets a unique devpts type.
+#line 146
+type apexd_devpts, fs_type;
+#line 146
+# Label the pty with the unique type when created.
+#line 146
+type_transition apexd devpts:chr_file apexd_devpts;
+#line 146
+# Allow use of the pty after creation.
+#line 146
+allow apexd apexd_devpts:chr_file { open getattr read write ioctl };
+#line 146
+allowxperm apexd apexd_devpts:chr_file ioctl {
+#line 146
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 146
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 146
+};
+#line 146
+# TIOCSTI is only ever used for exploits. Block it.
+#line 146
+# b/33073072, b/7530569
+#line 146
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+#line 146
+neverallowxperm * apexd_devpts:chr_file ioctl 0x00005412;
+#line 146
+# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
+#line 146
+# allowed to everyone via domain.te.
+#line 146
+
+
+# Allow apexd to read file contexts when performing restorecon of snapshots.
+allow apexd file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow apexd to execute toybox for snapshot & restore
+allow apexd toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow apexd to release compressed blocks in case /data is f2fs-compressed fs.
+allowxperm apexd staging_data_file:file ioctl {
+ 0x80086601
+ 0xf512
+};
+
+# Allow apexd to read ro.cold_boot_done prop.
+# apexd uses it to decide whether it needs to keep retrying polling for loop device.
+
+#line 162
+allow apexd cold_boot_done_prop:file { getattr open read map };
+#line 162
+
+
+# Allow apexd to read per-device configuration properties.
+
+#line 165
+allow apexd apexd_config_prop:file { getattr open read map };
+#line 165
+
+
+# Allow apexd to read apex selection properties.
+# These are used to choose between multi-installed APEXes at activation time.
+
+#line 169
+allow apexd apexd_select_prop:file { getattr open read map };
+#line 169
+
+#
+# Allow apexd to read apexd_payload_metadata_prop
+
+#line 172
+allow apexd apexd_payload_metadata_prop:file { getattr open read map };
+#line 172
+
+
+
+#line 174
+
+#line 174
+allow apexd property_socket:sock_file write;
+#line 174
+allow apexd init:unix_stream_socket connectto;
+#line 174
+
+#line 174
+allow apexd apexd_prop:property_service set;
+#line 174
+
+#line 174
+allow apexd apexd_prop:file { getattr open read map };
+#line 174
+
+#line 174
+
+
+# Allow for use in postinstall
+allow apexd otapreopt_chroot:fd use;
+allow apexd postinstall_apex_mnt_dir:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow apexd postinstall_apex_mnt_dir:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+allow apexd postinstall_apex_mnt_dir:lnk_file create;
+allow apexd proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow for use in Pre-reboot Dexopt.
+allow apexd dexopt_chroot_setup:fd use;
+
+# Allow calling derive_classpath to gather BCP information for staged sessions
+
+#line 187
+# Allow the necessary permissions.
+#line 187
+
+#line 187
+# Old domain may exec the file and transition to the new domain.
+#line 187
+allow apexd derive_classpath_exec:file { getattr open read execute map };
+#line 187
+allow apexd apexd_derive_classpath:process transition;
+#line 187
+# New domain is entered by executing the file.
+#line 187
+allow apexd_derive_classpath derive_classpath_exec:file { entrypoint open read execute getattr map };
+#line 187
+# New domain can send SIGCHLD to its caller.
+#line 187
+allow apexd_derive_classpath apexd:process sigchld;
+#line 187
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 187
+dontaudit apexd apexd_derive_classpath:process noatsecure;
+#line 187
+# XXX dontaudit candidate but requires further study.
+#line 187
+allow apexd apexd_derive_classpath:process { siginh rlimitinh };
+#line 187
+
+#line 187
+# Make the transition occur by default.
+#line 187
+type_transition apexd derive_classpath_exec:process apexd_derive_classpath;
+#line 187
+;
+
+# Allow set apex ready property
+
+#line 190
+
+#line 190
+allow apexd property_socket:sock_file write;
+#line 190
+allow apexd init:unix_stream_socket connectto;
+#line 190
+
+#line 190
+allow apexd apex_ready_prop:property_service set;
+#line 190
+
+#line 190
+allow apexd apex_ready_prop:file { getattr open read map };
+#line 190
+
+#line 190
+
+
+# Allow apexd to write to statsd.
+
+#line 193
+allow apexd statsdw_socket:sock_file write;
+#line 193
+allow apexd statsd:unix_dgram_socket sendto;
+#line 193
+
+# Allow apexd to call
+allow apexd statsbootstrap_service:service_manager find;
+
+#line 196
+# Call the server domain and optionally transfer references to it.
+#line 196
+allow apexd system_server:binder { call transfer };
+#line 196
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 196
+allow system_server apexd:binder transfer;
+#line 196
+# Receive and use open files from the server.
+#line 196
+allow apexd system_server:fd use;
+#line 196
+ # system_server serves statsbootstrap_service
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -apexd -init } apex_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -apexd -init } apex_metadata_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -apexd -init -kernel } apex_data_file:file { append create link unlink relabelfrom rename setattr write };
+neverallow { domain -apexd -init -kernel } apex_metadata_file:file { append create link unlink relabelfrom rename setattr write };
+neverallow { domain -apexd } apex_mnt_dir:lnk_file { append create link unlink relabelfrom rename setattr write };
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file { append create link unlink relabelfrom rename setattr write };
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file { append create link unlink relabelfrom rename setattr write };
+
+# only apexd can set apexd sysprop
+neverallow { domain -apexd -init } apexd_prop:property_service set;
+
+# only apexd can write apex-info-list.xml
+neverallow { domain -apexd } apex_info_file:file { append create link unlink relabelfrom rename setattr write };
+
+# Only apexd and init should be allowed to manage /apex mounts
+# A note on otapreopt_chroot. It used to mount APEXes during postainstall stage of A/B OTAs,
+# but starting from S it just calls into apexd to prepare /apex for otapreoprt. Once the sepolicies
+# around otapreopt_chroot are cleaned up we should be able to remove it from the lists below.
+# dexopt_chroot_setup calls apexd to prepare /apex for Pre-reboot Dexopt, but it
+# needs to mount a tmpfs on /apex for apexd to work on.
+neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:filesystem { mount unmount };
+neverallow { domain -apexd -dexopt_chroot_setup -init -otapreopt_chroot } apex_mnt_dir:dir mounton;
+
+# The update_provider performs APEX updates. To do this, it needs to be able to find apex_service
+# and make binder calls to apexd.
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -apexd -keystore -system_server -update_engine -update_provider } apex_service:service_manager find;
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -apexd -keystore -system_server -servicemanager -update_engine -update_provider } apexd:binder call;
+
+neverallow { domain } apexd:process ptrace;
+#line 1 "system/sepolicy/private/apexd_derive_classpath.te"
+# Exclusive domain for apexd calling into derive_classpath binary
+type apexd_derive_classpath, domain, coredomain;
+
+# Allow the binary to write into output file at location /apex/derive_classpath_temp
+allow apexd_derive_classpath apexd:fd use;
+allow apexd_derive_classpath apex_mnt_dir:file { write open };
+# Allow the binary to log using logwrap
+allow apexd_derive_classpath apexd_devpts:chr_file { read write };
+
+#line 1 "system/sepolicy/private/app.te"
+# /proc/net access.
+# TODO(b/9496886) Audit access for removal.
+# proc_net access for the negated domains below is granted (or not) in their
+# individual .te files.
+
+#line 5
+allow {
+#line 5
+ appdomain
+#line 5
+ -ephemeral_app
+#line 5
+ -isolated_app_all
+#line 5
+ -platform_app
+#line 5
+ -priv_app
+#line 5
+ -shell
+#line 5
+ -sdk_sandbox_all
+#line 5
+ -system_app
+#line 5
+ -untrusted_app_all
+#line 5
+} proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 5
+allow {
+#line 5
+ appdomain
+#line 5
+ -ephemeral_app
+#line 5
+ -isolated_app_all
+#line 5
+ -platform_app
+#line 5
+ -priv_app
+#line 5
+ -shell
+#line 5
+ -sdk_sandbox_all
+#line 5
+ -system_app
+#line 5
+ -untrusted_app_all
+#line 5
+} proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+# audit access for all these non-core app domains.
+#line 30
+
+
+# Allow apps to read the Test Harness Mode property. This property is used in
+# the implementation of ActivityManager.isDeviceInTestHarnessMode()
+
+#line 34
+allow appdomain test_harness_prop:file { getattr open read map };
+#line 34
+
+
+
+#line 36
+allow appdomain boot_status_prop:file { getattr open read map };
+#line 36
+
+
+#line 37
+allow appdomain dalvik_config_prop_type:file { getattr open read map };
+#line 37
+
+
+#line 38
+allow appdomain media_config_prop:file { getattr open read map };
+#line 38
+
+
+#line 39
+allow appdomain packagemanager_config_prop:file { getattr open read map };
+#line 39
+
+
+#line 40
+allow appdomain radio_control_prop:file { getattr open read map };
+#line 40
+
+
+#line 41
+allow appdomain surfaceflinger_color_prop:file { getattr open read map };
+#line 41
+
+
+#line 42
+allow appdomain systemsound_config_prop:file { getattr open read map };
+#line 42
+
+
+#line 43
+allow appdomain telephony_config_prop:file { getattr open read map };
+#line 43
+
+
+#line 44
+allow appdomain userspace_reboot_config_prop:file { getattr open read map };
+#line 44
+
+
+#line 45
+allow appdomain vold_config_prop:file { getattr open read map };
+#line 45
+
+
+#line 46
+allow appdomain adbd_config_prop:file { getattr open read map };
+#line 46
+
+
+#line 47
+allow appdomain dck_prop:file { getattr open read map };
+#line 47
+
+
+#line 48
+allow appdomain persist_wm_debug_prop:file { getattr open read map };
+#line 48
+
+
+#line 49
+allow appdomain persist_sysui_builder_extras_prop:file { getattr open read map };
+#line 49
+
+
+#line 50
+allow appdomain persist_sysui_ranking_update_prop:file { getattr open read map };
+#line 50
+
+
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+
+#line 53
+allow appdomain traced_oome_heap_session_count_prop:file { getattr open read map };
+#line 53
+
+
+# Allow to read ro.vendor.camera.extensions.enabled
+
+#line 56
+allow appdomain camera2_extensions_prop:file { getattr open read map };
+#line 56
+
+
+# Allow to ro.camerax.extensions.enabled
+
+#line 59
+allow appdomain camerax_extensions_prop:file { getattr open read map };
+#line 59
+
+
+# Prevent apps from causing presubmit failures.
+# Apps can cause selinux denials by accessing CE storage
+# and/or external storage. In either case, the selinux denial is
+# not the cause of the failure, but just a symptom that
+# storage isn't ready. Many apps handle the failure appropriately.
+#
+# Apps cannot access external storage before it becomes available.
+dontaudit appdomain storage_stub_file:dir getattr;
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
+# allowed to write to CE storage before it's available.
+# Attempting to do so will be blocked by both selinux and unix
+# permissions.
+dontaudit appdomain system_data_file:dir write;
+# Apps should not be reading vendor-defined properties.
+dontaudit appdomain vendor_default_prop:file read;
+
+# Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
+allow { appdomain -sdk_sandbox_all } mnt_media_rw_file:dir search;
+
+# allow apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow appdomain system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# Allow to read sendbug.preferred.domain
+
+#line 88
+allow appdomain sendbug_config_prop:file { getattr open read map };
+#line 88
+
+
+# Allow to read graphics related properties.
+
+#line 91
+allow appdomain graphics_config_prop:file { getattr open read map };
+#line 91
+
+
+# Allow to read persist.config.calibration_fac
+
+#line 94
+allow appdomain camera_calibration_prop:file { getattr open read map };
+#line 94
+
+
+# Allow to read db.log.detailed, db.log.slow_query_threshold*
+
+#line 97
+allow appdomain sqlite_log_prop:file { getattr open read map };
+#line 97
+
+
+# Allow to read system_user_mode_emulation_prop, which is used by UserManager.java
+
+
+# Allow font file read by apps.
+allow appdomain font_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow appdomain font_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Enter /data/misc/apexdata/
+allow appdomain apex_module_data_file:dir search;
+# Read /data/misc/apexdata/com.android.art, execute signed AOT artifacts.
+allow appdomain apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow appdomain apex_art_data_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow access to tombstones if an fd to one is given to you.
+# An app cannot open the tombstone itself because it lacks `open`.
+allow appdomain tombstone_data_file:file { getattr read };
+
+# Execute the shell or other system executables.
+allow { appdomain -ephemeral_app -sdk_sandbox_all } shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow { appdomain -ephemeral_app -sdk_sandbox_all } toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_file:file { getattr execute execute_no_trans map };
+
+# Allow apps access to /vendor/app except for privileged
+# apps which cannot be in /vendor.
+
+#line 123
+allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 123
+allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 123
+
+allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:file execute;
+
+# Allow apps to read microdroid related files in vendor partition for CTS purpose.
+
+#line 127
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } vendor_microdroid_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 127
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } vendor_microdroid_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 127
+
+
+# Perform binder IPC to sdk sandbox.
+
+#line 130
+# Call the server domain and optionally transfer references to it.
+#line 130
+allow appdomain sdk_sandbox_all:binder { call transfer };
+#line 130
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 130
+allow sdk_sandbox_all appdomain:binder transfer;
+#line 130
+# Receive and use open files from the server.
+#line 130
+allow appdomain sdk_sandbox_all:fd use;
+#line 130
+
+
+# Allow apps to communicate via binder with virtual camera service.
+
+#line 133
+# Call the server domain and optionally transfer references to it.
+#line 133
+allow appdomain virtual_camera:binder { call transfer };
+#line 133
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 133
+allow virtual_camera appdomain:binder transfer;
+#line 133
+# Receive and use open files from the server.
+#line 133
+allow appdomain virtual_camera:fd use;
+#line 133
+
+
+# Allow access to external storage; we have several visible mount points under /storage
+# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } storage_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } storage_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } mnt_user_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } mnt_user_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Read/write visible storage
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } { sdcard_type fuse }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } { sdcard_type fuse }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow apps to use the USB Accessory interface.
+# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
+#
+# USB devices are first opened by the system server (USBDeviceManagerService)
+# and the file descriptor is passed to the right Activity via binder.
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } usb_device:chr_file { read write getattr ioctl };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } usbaccessory_device:chr_file { read write getattr };
+
+#logd access
+
+#line 159
+# Group AID_LOG checked by filesystem & logd
+#line 159
+# to permit control commands
+#line 159
+
+#line 159
+allow { appdomain -ephemeral_app -sdk_sandbox_all } logd_socket:sock_file write;
+#line 159
+allow { appdomain -ephemeral_app -sdk_sandbox_all } logd:unix_stream_socket connectto;
+#line 159
+
+#line 159
+
+
+# application inherit logd write socket (urge is to deprecate this long term)
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info grant rebind update };
+
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;
+
+
+#line 166
+ allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:dir search;
+#line 166
+ allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:file { read open };
+#line 166
+ allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:process getattr;
+#line 166
+ allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } apc_service:service_manager find;
+#line 166
+ allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_service:service_manager find;
+#line 166
+ allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } legacykeystore_service:service_manager find;
+#line 166
+
+#line 166
+# Call the server domain and optionally transfer references to it.
+#line 166
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:binder { call transfer };
+#line 166
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 166
+allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:binder transfer;
+#line 166
+# Receive and use open files from the server.
+#line 166
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:fd use;
+#line 166
+
+#line 166
+
+#line 166
+# Call the server domain and optionally transfer references to it.
+#line 166
+allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:binder { call transfer };
+#line 166
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 166
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:binder transfer;
+#line 166
+# Receive and use open files from the server.
+#line 166
+allow keystore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 166
+
+#line 166
+
+
+
+#line 168
+ allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:dir search;
+#line 168
+ allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:file { read open };
+#line 168
+ allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:process getattr;
+#line 168
+ allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } credstore_service:service_manager find;
+#line 168
+
+#line 168
+# Call the server domain and optionally transfer references to it.
+#line 168
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } credstore:binder { call transfer };
+#line 168
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 168
+allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:binder transfer;
+#line 168
+# Receive and use open files from the server.
+#line 168
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } credstore:fd use;
+#line 168
+
+#line 168
+
+#line 168
+# Call the server domain and optionally transfer references to it.
+#line 168
+allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:binder { call transfer };
+#line 168
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 168
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } credstore:binder transfer;
+#line 168
+# Receive and use open files from the server.
+#line 168
+allow credstore { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 168
+
+#line 168
+
+
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } persistent_data_block_service:service_manager find;
+
+# For app fuse.
+
+#line 173
+
+#line 173
+# Allow client to open the service endpoint file.
+#line 173
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_client_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 173
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_client_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 173
+# Allow the client to connect to endpoint socket.
+#line 173
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_client_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 173
+
+#line 173
+
+#line 173
+# Allow the client to use the PDX channel socket.
+#line 173
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 173
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 173
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 173
+# Client needs to use an channel event fd from the server.
+#line 173
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_client_server_type:fd use;
+#line 173
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 173
+# This could be tightened on a per-server basis, but keeping track of service
+#line 173
+# clients is error prone.
+#line 173
+allow pdx_display_client_server_type { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 173
+
+#line 173
+
+
+#line 174
+
+#line 174
+# Allow client to open the service endpoint file.
+#line 174
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_manager_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 174
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_manager_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 174
+# Allow the client to connect to endpoint socket.
+#line 174
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_manager_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 174
+
+#line 174
+
+#line 174
+# Allow the client to use the PDX channel socket.
+#line 174
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 174
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 174
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_manager_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 174
+# Client needs to use an channel event fd from the server.
+#line 174
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_manager_server_type:fd use;
+#line 174
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 174
+# This could be tightened on a per-server basis, but keeping track of service
+#line 174
+# clients is error prone.
+#line 174
+allow pdx_display_manager_server_type { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 174
+
+#line 174
+
+
+#line 175
+
+#line 175
+# Allow client to open the service endpoint file.
+#line 175
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_vsync_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 175
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_vsync_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 175
+# Allow the client to connect to endpoint socket.
+#line 175
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_vsync_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 175
+
+#line 175
+
+#line 175
+# Allow the client to use the PDX channel socket.
+#line 175
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 175
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 175
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_vsync_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 175
+# Client needs to use an channel event fd from the server.
+#line 175
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_display_vsync_server_type:fd use;
+#line 175
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 175
+# This could be tightened on a per-server basis, but keeping track of service
+#line 175
+# clients is error prone.
+#line 175
+allow pdx_display_vsync_server_type { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 175
+
+#line 175
+
+
+#line 176
+
+#line 176
+# Allow client to open the service endpoint file.
+#line 176
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_performance_client_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 176
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_performance_client_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 176
+# Allow the client to connect to endpoint socket.
+#line 176
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_performance_client_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 176
+
+#line 176
+
+#line 176
+# Allow the client to use the PDX channel socket.
+#line 176
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 176
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 176
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_performance_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 176
+# Client needs to use an channel event fd from the server.
+#line 176
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_performance_client_server_type:fd use;
+#line 176
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 176
+# This could be tightened on a per-server basis, but keeping track of service
+#line 176
+# clients is error prone.
+#line 176
+allow pdx_performance_client_server_type { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 176
+
+#line 176
+
+# Apps do not directly open the IPC socket for bufferhubd.
+
+#line 178
+# Allow the client to use the PDX channel socket.
+#line 178
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 178
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 178
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_bufferhub_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 178
+# Client needs to use an channel event fd from the server.
+#line 178
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } pdx_bufferhub_client_server_type:fd use;
+#line 178
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 178
+# This could be tightened on a per-server basis, but keeping track of service
+#line 178
+# clients is error prone.
+#line 178
+allow pdx_bufferhub_client_server_type { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:fd use;
+#line 178
+
+
+# Apps receive an open tun fd from the framework for
+# device traffic. Do not allow untrusted app to directly open tun_device
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } tun_device:chr_file { read write getattr append ioctl };
+allowxperm { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } tun_device:chr_file ioctl 0x800454d2;
+
+
+# WebView and other application-specific JIT compilers
+allow appdomain self:process execmem;
+
+allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute;
+
+# Receive and use open file descriptors inherited from zygote.
+allow appdomain zygote:fd use;
+
+# Receive and use open file descriptors inherited from app zygote.
+allow appdomain app_zygote:fd use;
+
+# gdbserver for ndk-gdb reads the zygote.
+# valgrind needs mmap exec for zygote
+allow appdomain zygote_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Notify zygote of death;
+allow appdomain zygote:process sigchld;
+
+# Read /data/dalvik-cache.
+allow appdomain dalvikcache_data_file:dir { search getattr };
+allow appdomain dalvikcache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read the /sdcard and /mnt/sdcard symlinks
+allow { appdomain -isolated_app_all -sdk_sandbox_all } rootfs:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow { appdomain -isolated_app_all -sdk_sandbox_all } tmpfs:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Search /storage/emulated tmpfs mount.
+allow { appdomain -sdk_sandbox_all } tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Notify zygote of the wrapped process PID when using --invoke-with.
+allow appdomain zygote:fifo_file write;
+
+#line 222
+
+
+# Notify shell and adbd of death when spawned via runas for ndk-gdb.
+allow appdomain shell:process sigchld;
+allow appdomain adbd:process sigchld;
+
+# child shell or gdbserver pty access for runas.
+allow appdomain devpts:chr_file { getattr read write ioctl };
+
+# Use pipes and sockets provided by system_server via binder or local socket.
+allow appdomain system_server:fd use;
+allow appdomain system_server:fifo_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
+allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
+
+# For AppFuse.
+allow appdomain vold:fd use;
+
+# Communication with other apps via fifos
+allow appdomain appdomain:fifo_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Communicate with surfaceflinger.
+allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
+
+# App sandbox file accesses.
+allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 258
+ # an app can read but cannot write to its own directory of storage areas
+#line 258
+ allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } storage_area_app_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 258
+ # an app can write to its storage areas
+#line 258
+ allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } storage_area_dir:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+#line 263
+
+
+allowxperm { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:file ioctl 0x6686;
+
+# Access via already open fds is ok even for mlstrustedsubject.
+allow { appdomain -isolated_app_all -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ system_app_data_file
+ storage_area_content_file
+}:file { getattr map read write };
+
+# Access open fds from SDK sandbox
+allow appdomain sdk_sandbox_data_file:file { getattr read };
+
+# Traverse into expanded storage
+allow appdomain mnt_expand_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Keychain and user-trusted credentials
+
+#line 286
+allow appdomain keychain_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 286
+allow appdomain keychain_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 286
+
+allow appdomain misc_user_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow appdomain misc_user_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# TextClassifier
+
+#line 291
+allow { appdomain -isolated_app_all } textclassifier_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 291
+allow { appdomain -isolated_app_all } textclassifier_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 291
+
+
+# Access to OEM provided data and apps
+allow appdomain oemfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow appdomain oemfs:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allow appdomain system_file:file { getattr execute execute_no_trans map };
+
+# Renderscript needs the ability to read directories on /system
+allow appdomain system_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow appdomain system_file:lnk_file { getattr open read };
+# Renderscript specific permissions to open /system/vendor/lib64.
+
+#line 303
+ allow appdomain vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 303
+ allow appdomain vendor_file_type:lnk_file { getattr open read };
+#line 306
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 308
+
+#line 308
+ # For looking up Renderscript vendor drivers
+#line 308
+ allow { appdomain -isolated_app_all } vendor_file:dir { open read };
+#line 308
+
+#line 308
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 311
+
+
+# Allow apps access to /vendor/overlay
+
+#line 314
+allow appdomain vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 314
+allow appdomain vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 314
+
+
+# Allow apps access to /vendor/framework
+# for vendor provided libraries.
+
+#line 318
+allow appdomain vendor_framework_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 318
+allow appdomain vendor_framework_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 318
+
+
+# Allow apps read / execute access to vendor public libraries.
+allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir { open getattr read search ioctl lock watch watch_reads };
+allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map };
+
+# Read/write wallpaper file (opened by system).
+allow appdomain wallpaper_file:file { getattr read write map };
+
+# Read/write cached ringtones (opened by system).
+allow appdomain ringtone_file:file { getattr read write map };
+
+# Read ShortcutManager icon files (opened by system).
+allow appdomain shortcut_manager_icons:file { getattr read map };
+
+# Read icon file (opened by system).
+allow appdomain icon_file:file { getattr read map };
+
+# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt).
+#
+# TODO: All of these permissions except for anr_data_file:file append can be
+# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548
+# and the rules below.
+allow appdomain anr_data_file:dir search;
+allow appdomain anr_data_file:file { open append };
+
+# New stack dumping scheme : request an output FD from tombstoned via a unix
+# domain socket.
+#
+# Allow apps to connect and write to the tombstoned java trace socket in
+# order to dump their traces. Also allow them to append traces to pipes
+# created by dumptrace. (Also see the rules below where they are given
+# additional permissions to dumpstate pipes for other aspects of bug report
+# creation).
+
+#line 352
+allow appdomain tombstoned_java_trace_socket:sock_file write;
+#line 352
+allow appdomain tombstoned:unix_stream_socket connectto;
+#line 352
+
+allow appdomain tombstoned:fd use;
+allow appdomain dumpstate:fifo_file append;
+allow appdomain incidentd:fifo_file append;
+
+# Allow apps to send dump information to dumpstate
+allow appdomain dumpstate:fd use;
+allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
+allow appdomain dumpstate:fifo_file { write getattr };
+allow appdomain shell_data_file:file { write getattr };
+
+# Allow apps to send dump information to incidentd
+allow appdomain incidentd:fd use;
+allow appdomain incidentd:fifo_file { write getattr };
+
+# Allow apps to send information to statsd socket.
+
+#line 368
+allow appdomain statsdw_socket:sock_file write;
+#line 368
+allow appdomain statsd:unix_dgram_socket sendto;
+#line 368
+
+
+# Write profiles /data/misc/profiles
+allow appdomain user_profile_root_file:dir search;
+allow appdomain user_profile_data_file:dir { open search write add_name remove_name lock };
+allow appdomain user_profile_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow writing performance tracing data into the perfetto traced daemon.
+# Needed for java heap graph ART plugin (perfetto_hprof).
+# The perfetto profiling daemon will check for the specific application's
+# opt-in/opt-out.
+
+#line 379
+ allow appdomain traced:fd use;
+#line 379
+ allow appdomain traced_tmpfs:file { read write getattr map };
+#line 379
+
+#line 379
+allow appdomain traced_producer_socket:sock_file write;
+#line 379
+allow appdomain traced:unix_stream_socket connectto;
+#line 379
+
+#line 379
+
+#line 379
+ # Also allow the service to use the producer file descriptors. This is
+#line 379
+ # necessary when the producer is creating the shared memory, as it will be
+#line 379
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 379
+ allow traced appdomain:fd use;
+#line 379
+
+
+# Send heap dumps to system_server via an already open file descriptor
+# % adb shell am set-watch-heap com.android.systemui 1048576
+# % adb shell dumpsys procstats --start-testing
+# debuggable builds only.
+#line 387
+
+
+# Grant GPU access to all processes started by Zygote.
+# They need that to render the standard UI.
+allow { appdomain -isolated_app_all } gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow { appdomain -isolated_app_all } gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow { appdomain -isolated_app_all } sysfs_gpu:file { getattr open read ioctl lock map watch watch_reads };
+
+
+# Use the Binder.
+
+#line 397
+# Call the servicemanager and transfer references to it.
+#line 397
+allow appdomain servicemanager:binder { call transfer };
+#line 397
+# Allow servicemanager to send out callbacks
+#line 397
+allow servicemanager appdomain:binder { call transfer };
+#line 397
+# servicemanager performs getpidcon on clients.
+#line 397
+allow servicemanager appdomain:dir search;
+#line 397
+allow servicemanager appdomain:file { read open };
+#line 397
+allow servicemanager appdomain:process getattr;
+#line 397
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 397
+# all domains in domain.te.
+#line 397
+
+# Perform binder IPC to binder services.
+
+#line 399
+# Call the server domain and optionally transfer references to it.
+#line 399
+allow appdomain binderservicedomain:binder { call transfer };
+#line 399
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 399
+allow binderservicedomain appdomain:binder transfer;
+#line 399
+# Receive and use open files from the server.
+#line 399
+allow appdomain binderservicedomain:fd use;
+#line 399
+
+# Perform binder IPC to other apps.
+
+#line 401
+# Call the server domain and optionally transfer references to it.
+#line 401
+allow appdomain appdomain:binder { call transfer };
+#line 401
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 401
+allow appdomain appdomain:binder transfer;
+#line 401
+# Receive and use open files from the server.
+#line 401
+allow appdomain appdomain:fd use;
+#line 401
+
+# Perform binder IPC to ephemeral apps.
+
+#line 403
+# Call the server domain and optionally transfer references to it.
+#line 403
+allow appdomain ephemeral_app:binder { call transfer };
+#line 403
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 403
+allow ephemeral_app appdomain:binder transfer;
+#line 403
+# Receive and use open files from the server.
+#line 403
+allow appdomain ephemeral_app:fd use;
+#line 403
+
+# Perform binder IPC to gpuservice.
+
+#line 405
+# Call the server domain and optionally transfer references to it.
+#line 405
+allow { appdomain -isolated_app_all } gpuservice:binder { call transfer };
+#line 405
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 405
+allow gpuservice { appdomain -isolated_app_all }:binder transfer;
+#line 405
+# Receive and use open files from the server.
+#line 405
+allow { appdomain -isolated_app_all } gpuservice:fd use;
+#line 405
+
+
+# Talk with graphics composer fences
+allow appdomain hal_graphics_composer:fd use;
+
+# Already connected, unnamed sockets being passed over some other IPC
+# hence no sock_file or connectto permission. This appears to be how
+# Chrome works, may need to be updated as more apps using isolated services
+# are examined.
+allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
+
+# Backup ability for every app. BMS opens and passes the fd
+# to any app that has backup ability. Hence, no open permissions here.
+allow appdomain backup_data_file:file { read write getattr map };
+allow appdomain cache_backup_file:file { read write getattr map };
+allow appdomain cache_backup_file:dir getattr;
+# Backup ability using 'adb backup'
+allow appdomain system_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow appdomain system_data_file:file { getattr read map };
+
+# Allow read/stat of /data/media files passed by Binder or local socket IPC.
+allow { appdomain -isolated_app_all -sdk_sandbox_all } media_rw_data_file:file { read getattr };
+
+# Read and write /data/data/com.android.providers.telephony files passed over Binder.
+allow { appdomain -isolated_app_all } radio_data_file:file { read write getattr };
+
+# For art.
+allow appdomain dalvikcache_data_file:file execute;
+allow appdomain dalvikcache_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow any app to read shared RELRO files.
+allow appdomain shared_relro_file:dir search;
+allow appdomain shared_relro_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow apps to read/execute installed binaries
+allow appdomain apk_data_file:dir { open getattr read search ioctl lock };
+allow appdomain apk_data_file:file { getattr open read ioctl lock map { getattr execute execute_no_trans map } };
+
+# /data/resource-cache
+allow appdomain resourcecache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow appdomain resourcecache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# logd access
+
+#line 448
+allow appdomain logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 448
+
+#line 448
+allow appdomain logdr_socket:sock_file write;
+#line 448
+allow appdomain logd:unix_stream_socket connectto;
+#line 448
+
+#line 448
+
+
+allow appdomain zygote:unix_dgram_socket write;
+
+allow appdomain console_device:chr_file { read write };
+
+# only allow unprivileged socket ioctl commands
+allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket }
+ ioctl {
+#line 456
+{
+#line 456
+# Socket ioctls for gathering information about the interface
+#line 456
+0x00008906 0x00008907
+#line 456
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 456
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 456
+# Wireless extension ioctls. Primarily get functions.
+#line 456
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 456
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 456
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 456
+} {
+#line 456
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 456
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 456
+} };
+
+allow { appdomain -isolated_app_all } ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow { appdomain -isolated_app_all } dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow { appdomain -isolated_app_all } dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow AAudio apps to use shared memory file descriptors from the HAL
+allow { appdomain -isolated_app_all } hal_audio:fd use;
+
+# Allow app to access shared memory created by camera HAL1
+allow { appdomain -isolated_app_all } hal_camera:fd use;
+
+# Allow apps to access shared memory file descriptor from the tuner HAL
+allow {appdomain -isolated_app_all} hal_tv_tuner_server:fd use;
+
+# Allow app to access shared memory created by PowerHAL for FMQ use
+allow { appdomain -isolated_app_all } hal_power_server:fd use;
+
+# RenderScript always-passthrough HAL
+allow { appdomain -isolated_app_all } hal_renderscript_hwservice:hwservice_manager find;
+allow appdomain same_process_hal_file:file { execute read open getattr map };
+
+# TODO: switch to meminfo service
+allow appdomain proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# For app fuse.
+allow appdomain app_fuse_file:file { getattr read append write map };
+
+###
+### CTS-specific rules
+###
+
+# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
+# testRunAsHasCorrectCapabilities
+allow appdomain runas_exec:file getattr;
+# Others are either allowed elsewhere or not desired.
+
+
+#line 493
+allow appdomain high_barometer_quality_prop:file { getattr open read map };
+#line 493
+
+
+# Connect to adbd and use a socket transferred from it.
+# This is used for e.g. adb backup/restore.
+allow appdomain adbd:unix_stream_socket connectto;
+allow appdomain adbd:fd use;
+allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
+
+allow appdomain cache_file:dir getattr;
+
+# Allow apps to run with asanwrapper.
+
+
+# Read access to FDs from the DropboxManagerService.
+allow appdomain dropbox_data_file:file { getattr read };
+
+# Read tmpfs types from these processes.
+allow appdomain audioserver_tmpfs:file { getattr map read write };
+allow appdomain system_server_tmpfs:file { getattr map read write };
+allow appdomain zygote_tmpfs:file { map read };
+
+###
+### Neverallow rules
+###
+### These are things that Android apps should NEVER be able to do
+###
+
+# Superuser capabilities.
+# bluetooth requires net_admin and wake_alarm. network stack app requires net_admin.
+neverallow { appdomain -bluetooth -network_stack } self:{ capability capability2 cap_userns cap2_userns } *;
+
+# Block device access.
+neverallow appdomain dev_type:blk_file { read write };
+
+# Note: Try expanding list of app domains in the future.
+neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write };
+
+neverallow { appdomain -nfc } nfc_device:chr_file
+ { read write };
+neverallow { appdomain -bluetooth } hci_attach_dev:chr_file
+ { read write };
+neverallow appdomain tee_device:chr_file { read write };
+
+# Privileged netlink socket interfaces.
+neverallow { appdomain -network_stack }
+ domain:{
+ netlink_tcpdiag_socket
+ netlink_nflog_socket
+ netlink_xfrm_socket
+ netlink_audit_socket
+ netlink_dnrt_socket
+ } *;
+
+# These messages are broadcast messages from the kernel to userspace.
+# Do not allow the writing of netlink messages, which has been a source
+# of rooting vulns in the past.
+neverallow { appdomain -network_stack }
+ domain:netlink_kobject_uevent_socket { write append };
+
+# Sockets under /dev/socket that are not specifically typed.
+neverallow appdomain socket_device:sock_file write;
+
+# Unix domain sockets.
+neverallow appdomain adbd_socket:sock_file write;
+neverallow { appdomain -radio } rild_socket:sock_file write;
+
+# ptrace access to non-app domains.
+neverallow appdomain { domain -appdomain }:process ptrace;
+
+# The Android security model guarantees the confidentiality and integrity
+# of application data and execution state. Ptrace bypasses those
+# confidentiality guarantees. Disallow ptrace access from system components
+# to apps. Crash_dump is excluded, as it needs ptrace access to
+# produce stack traces. llkd is excluded, as it needs ptrace access to
+# inspect stack traces for live lock conditions.
+
+neverallow {
+ domain
+ -appdomain
+ -crash_dump
+
+} appdomain:process ptrace;
+
+# Read or write access to /proc/pid entries for any non-app domain.
+# A different form of hidepid=2 like protections
+neverallow appdomain { domain -appdomain }:file { append create link unlink relabelfrom rename setattr write };
+neverallow { appdomain -shell } { domain -appdomain }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# signal access to non-app domains.
+# sigchld allowed for parent death notification.
+# signull allowed for kill(pid, 0) existence test.
+# All others prohibited.
+# -perfetto is to allow shell (which is an appdomain) to kill perfetto
+# (see private/shell.te).
+neverallow appdomain { domain -appdomain -perfetto }:process
+ { sigkill sigstop signal };
+
+# Write to rootfs.
+neverallow appdomain rootfs:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to /system.
+neverallow appdomain system_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to entrypoint executables.
+neverallow appdomain exec_type:file
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to system-owned parts of /data.
+# This is the default type for anything under /data not otherwise
+# specified in file_contexts. Define a different type for portions
+# that should be writable by apps.
+neverallow appdomain system_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to various other parts of /data.
+neverallow appdomain drm_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_private_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_private_tmp_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -shell }
+ shell_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -bluetooth }
+ bluetooth_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { domain -credstore -init } credstore_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } *;
+neverallow appdomain
+ keystore_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ systemkeys_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ wifi_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ dhcp_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# access tmp apk files
+neverallow { appdomain -platform_app }
+ apk_tmp_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Access to factory files.
+neverallow appdomain efs_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+neverallow { appdomain -shell } efs_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } read;
+
+# Write to various pseudo file systems.
+neverallow { appdomain -bluetooth -nfc }
+ sysfs:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+neverallow appdomain
+ proc:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Access to syslog(2) or /proc/kmsg.
+neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console };
+
+# SELinux is not an API for apps to use
+neverallow { appdomain -shell } *:security { compute_av check_context };
+neverallow { appdomain -shell } *:netlink_selinux_socket *;
+
+# Ability to perform any filesystem operation other than statfs(2).
+# i.e. no mount(2), unmount(2), etc.
+neverallow appdomain fs_type:filesystem ~getattr;
+
+# prevent creation/manipulation of globally readable symlinks
+neverallow appdomain {
+ apk_data_file
+ cache_file
+ cache_recovery_file
+ dev_type
+ rootfs
+ system_file
+ tmpfs
+}:lnk_file { append create link unlink relabelfrom rename setattr write };
+
+# Applications should use the activity model for receiving events
+neverallow {
+ appdomain
+ -shell # bugreport
+} input_device:chr_file ~getattr;
+
+# Do not allow access to Bluetooth-related system properties except for a few allowed domains.
+# neverallow rules for access to Bluetooth-related data files are above.
+neverallow {
+ appdomain
+ -bluetooth
+ -system_app
+} { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow system_app to access Nfc-related system properties.
+
+#line 693
+
+#line 693
+allow system_app property_socket:sock_file write;
+#line 693
+allow system_app init:unix_stream_socket connectto;
+#line 693
+
+#line 693
+allow system_app nfc_prop:property_service set;
+#line 693
+
+#line 693
+allow system_app nfc_prop:file { getattr open read map };
+#line 693
+
+#line 693
+
+
+# allow system_app to access radio_config system properties.
+
+#line 696
+
+#line 696
+allow system_app property_socket:sock_file write;
+#line 696
+allow system_app init:unix_stream_socket connectto;
+#line 696
+
+#line 696
+allow system_app radio_control_prop:property_service set;
+#line 696
+
+#line 696
+allow system_app radio_control_prop:file { getattr open read map };
+#line 696
+
+#line 696
+
+
+# Apps cannot access proc_uid_time_in_state
+neverallow appdomain proc_uid_time_in_state:file *;
+
+# Apps cannot access proc_uid_concurrent_active_time
+neverallow appdomain proc_uid_concurrent_active_time:file *;
+
+# Apps cannot access proc_uid_concurrent_policy_time
+neverallow appdomain proc_uid_concurrent_policy_time:file *;
+
+# Apps cannot access proc_uid_cpupower
+neverallow appdomain proc_uid_cpupower:file *;
+
+# Apps may not read /proc/net/{tcp,tcp6,udp,udp6}. These files leak information across the
+# application boundary. VPN apps may use the ConnectivityManager.getConnectionOwnerUid() API to
+# perform UID lookups.
+neverallow { appdomain -shell } proc_net_tcp_udp:file *;
+
+# Apps cannot access bootstrap files. The bootstrap files are only for
+# extremely early processes (like init, etc.) which are started before
+# the runtime APEX is activated and Bionic libs are provided from there.
+# If app process accesses (or even load/execute) the bootstrap files,
+# it might cause problems such as ODR violation, etc.
+neverallow appdomain system_bootstrap_lib_file:file
+ { open read write append execute execute_no_trans map };
+neverallow appdomain system_bootstrap_lib_file:dir
+ { open read getattr search };
+
+# Sensitive app domains are not allowed to execute from /data
+# to prevent persistence attacks and ensure all code is executed
+# from read-only locations.
+neverallow {
+ bluetooth
+ isolated_app_all
+ nfc
+ radio
+ shared_relro
+ sdk_sandbox_all
+ system_app
+} {
+ data_file_type
+ -apex_art_data_file
+ -dalvikcache_data_file
+ -system_data_file # shared libs in apks
+ -apk_data_file
+}:file { execute execute_no_trans };
+
+# Don't allow apps access to any of the following character devices.
+neverallow appdomain {
+ audio_device
+ camera_device
+ dm_device
+ radio_device
+ rpmsg_device
+}:chr_file { read write };
+
+# Block video device access for all apps except the DeviceAsWebcam Service which
+# needs access to /dev/video* for interfacing with the host
+neverallow {
+ appdomain
+ -device_as_webcam
+} video_device:chr_file { read write };
+
+# Prevent calling inotify on APKs. This can be used as a side channel
+# to observer app launches, so it must be disallowed. b/231587164
+# Gate by targetSdkVersion to avoid breaking existing apps.
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:dir { watch watch_reads };
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:file { watch watch_reads };
+
+neverallow appdomain system_server:udp_socket {
+ accept append bind create ioctl listen lock name_bind
+ relabelfrom relabelto setattr shutdown };
+
+# Transition to a non-app domain.
+# Exception for the shell and su domains, can transition to runas, etc.
+# Exception for crash_dump to allow for app crash reporting.
+# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
+# to allow renderscript to create privileged executable files.
+# Exception for virtualizationmanager to allow running VMs as child processes.
+neverallow { appdomain -shell }
+ { domain -appdomain -crash_dump -rs -virtualizationmanager }:process { transition };
+neverallow { appdomain -shell }
+ { domain -appdomain }:process { dyntransition };
+
+# Don't allow regular apps access to storage configuration properties.
+neverallow { appdomain -mediaprovider_app } storage_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Don't allow apps reading /system/etc/font_fallback.xml
+dontaudit appdomain system_font_fallback_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow appdomain system_font_fallback_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow { appdomain -shell } tombstone_data_file:file ~{ getattr read };
+
+#line 803
+ # Files and directories that apps write to their storage areas
+#line 803
+ # should have type storage_area_content_file
+#line 803
+ type_transition {
+#line 803
+ appdomain
+#line 803
+ -isolated_app_all
+#line 803
+ -ephemeral_app
+#line 803
+ -sdk_sandbox_all
+#line 803
+ } storage_area_dir:{ { file lnk_file sock_file fifo_file } dir } storage_area_content_file;
+#line 812
+
+#line 1 "system/sepolicy/private/app_neverallows.te"
+###
+### neverallow rules for untrusted app domains
+###
+
+#line 18
+
+# Receive or send uevent messages.
+neverallow {
+#line 20
+ ephemeral_app
+#line 20
+ isolated_app
+#line 20
+ isolated_app_all
+#line 20
+ isolated_compute_app
+#line 20
+ mediaprovider
+#line 20
+ mediaprovider_app
+#line 20
+ untrusted_app
+#line 20
+ untrusted_app_25
+#line 20
+ untrusted_app_27
+#line 20
+ untrusted_app_29
+#line 20
+ untrusted_app_30
+#line 20
+ untrusted_app_all
+#line 20
+} domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow {
+#line 23
+ ephemeral_app
+#line 23
+ isolated_app
+#line 23
+ isolated_app_all
+#line 23
+ isolated_compute_app
+#line 23
+ mediaprovider
+#line 23
+ mediaprovider_app
+#line 23
+ untrusted_app
+#line 23
+ untrusted_app_25
+#line 23
+ untrusted_app_27
+#line 23
+ untrusted_app_29
+#line 23
+ untrusted_app_30
+#line 23
+ untrusted_app_all
+#line 23
+} domain:netlink_socket *;
+
+# Read or write kernel printk buffer
+neverallow {
+#line 26
+ ephemeral_app
+#line 26
+ isolated_app
+#line 26
+ isolated_app_all
+#line 26
+ isolated_compute_app
+#line 26
+ mediaprovider
+#line 26
+ mediaprovider_app
+#line 26
+ untrusted_app
+#line 26
+ untrusted_app_25
+#line 26
+ untrusted_app_27
+#line 26
+ untrusted_app_29
+#line 26
+ untrusted_app_30
+#line 26
+ untrusted_app_all
+#line 26
+} kmsg_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow {
+#line 30
+ ephemeral_app
+#line 30
+ isolated_app
+#line 30
+ isolated_app_all
+#line 30
+ isolated_compute_app
+#line 30
+ mediaprovider
+#line 30
+ mediaprovider_app
+#line 30
+ untrusted_app
+#line 30
+ untrusted_app_25
+#line 30
+ untrusted_app_27
+#line 30
+ untrusted_app_29
+#line 30
+ untrusted_app_30
+#line 30
+ untrusted_app_all
+#line 30
+} { debugfs_type -debugfs_kcov }:file read;
+neverallow {{
+#line 31
+ ephemeral_app
+#line 31
+ isolated_app
+#line 31
+ isolated_app_all
+#line 31
+ isolated_compute_app
+#line 31
+ mediaprovider
+#line 31
+ mediaprovider_app
+#line 31
+ untrusted_app
+#line 31
+ untrusted_app_25
+#line 31
+ untrusted_app_27
+#line 31
+ untrusted_app_29
+#line 31
+ untrusted_app_30
+#line 31
+ untrusted_app_all
+#line 31
+} } debugfs_type:{ file lnk_file } read;
+
+# Do not allow untrusted apps to register services.
+# Only trusted components of Android should be registering
+# services.
+neverallow {
+#line 36
+ ephemeral_app
+#line 36
+ isolated_app
+#line 36
+ isolated_app_all
+#line 36
+ isolated_compute_app
+#line 36
+ mediaprovider
+#line 36
+ mediaprovider_app
+#line 36
+ untrusted_app
+#line 36
+ untrusted_app_25
+#line 36
+ untrusted_app_27
+#line 36
+ untrusted_app_29
+#line 36
+ untrusted_app_30
+#line 36
+ untrusted_app_all
+#line 36
+} service_manager_type:service_manager add;
+
+# Do not allow untrusted apps to use VendorBinder
+neverallow {
+#line 39
+ ephemeral_app
+#line 39
+ isolated_app
+#line 39
+ isolated_app_all
+#line 39
+ isolated_compute_app
+#line 39
+ mediaprovider
+#line 39
+ mediaprovider_app
+#line 39
+ untrusted_app
+#line 39
+ untrusted_app_25
+#line 39
+ untrusted_app_27
+#line 39
+ untrusted_app_29
+#line 39
+ untrusted_app_30
+#line 39
+ untrusted_app_all
+#line 39
+} vndbinder_device:chr_file *;
+neverallow {
+#line 40
+ ephemeral_app
+#line 40
+ isolated_app
+#line 40
+ isolated_app_all
+#line 40
+ isolated_compute_app
+#line 40
+ mediaprovider
+#line 40
+ mediaprovider_app
+#line 40
+ untrusted_app
+#line 40
+ untrusted_app_25
+#line 40
+ untrusted_app_27
+#line 40
+ untrusted_app_29
+#line 40
+ untrusted_app_30
+#line 40
+ untrusted_app_all
+#line 40
+} vndservice_manager_type:service_manager *;
+
+# Do not allow untrusted apps to connect to the property service
+# or set properties. b/10243159
+neverallow { {
+#line 44
+ ephemeral_app
+#line 44
+ isolated_app
+#line 44
+ isolated_app_all
+#line 44
+ isolated_compute_app
+#line 44
+ mediaprovider
+#line 44
+ mediaprovider_app
+#line 44
+ untrusted_app
+#line 44
+ untrusted_app_25
+#line 44
+ untrusted_app_27
+#line 44
+ untrusted_app_29
+#line 44
+ untrusted_app_30
+#line 44
+ untrusted_app_all
+#line 44
+} -mediaprovider } property_socket:sock_file write;
+neverallow { {
+#line 45
+ ephemeral_app
+#line 45
+ isolated_app
+#line 45
+ isolated_app_all
+#line 45
+ isolated_compute_app
+#line 45
+ mediaprovider
+#line 45
+ mediaprovider_app
+#line 45
+ untrusted_app
+#line 45
+ untrusted_app_25
+#line 45
+ untrusted_app_27
+#line 45
+ untrusted_app_29
+#line 45
+ untrusted_app_30
+#line 45
+ untrusted_app_all
+#line 45
+} -mediaprovider } init:unix_stream_socket connectto;
+neverallow { {
+#line 46
+ ephemeral_app
+#line 46
+ isolated_app
+#line 46
+ isolated_app_all
+#line 46
+ isolated_compute_app
+#line 46
+ mediaprovider
+#line 46
+ mediaprovider_app
+#line 46
+ untrusted_app
+#line 46
+ untrusted_app_25
+#line 46
+ untrusted_app_27
+#line 46
+ untrusted_app_29
+#line 46
+ untrusted_app_30
+#line 46
+ untrusted_app_all
+#line 46
+} -mediaprovider } property_type:property_service set;
+
+# Do not allow untrusted apps to modify temporarily staged APKs.
+neverallow {
+#line 49
+ ephemeral_app
+#line 49
+ isolated_app
+#line 49
+ isolated_app_all
+#line 49
+ isolated_compute_app
+#line 49
+ mediaprovider
+#line 49
+ mediaprovider_app
+#line 49
+ untrusted_app
+#line 49
+ untrusted_app_25
+#line 49
+ untrusted_app_27
+#line 49
+ untrusted_app_29
+#line 49
+ untrusted_app_30
+#line 49
+ untrusted_app_all
+#line 49
+} { apk_tmp_file apk_private_tmp_file }:{ { chr_file blk_file } dir fifo_file lnk_file sock_file } *;
+neverallow {
+#line 50
+ ephemeral_app
+#line 50
+ isolated_app
+#line 50
+ isolated_app_all
+#line 50
+ isolated_compute_app
+#line 50
+ mediaprovider
+#line 50
+ mediaprovider_app
+#line 50
+ untrusted_app
+#line 50
+ untrusted_app_25
+#line 50
+ untrusted_app_27
+#line 50
+ untrusted_app_29
+#line 50
+ untrusted_app_30
+#line 50
+ untrusted_app_all
+#line 50
+} { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read map };
+
+# net.dns properties are not a public API. Disallow untrusted apps from reading this property.
+neverallow { {
+#line 53
+ ephemeral_app
+#line 53
+ isolated_app
+#line 53
+ isolated_app_all
+#line 53
+ isolated_compute_app
+#line 53
+ mediaprovider
+#line 53
+ mediaprovider_app
+#line 53
+ untrusted_app
+#line 53
+ untrusted_app_25
+#line 53
+ untrusted_app_27
+#line 53
+ untrusted_app_29
+#line 53
+ untrusted_app_30
+#line 53
+ untrusted_app_all
+#line 53
+} } net_dns_prop:file read;
+
+# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property.
+neverallow { {
+#line 56
+ ephemeral_app
+#line 56
+ isolated_app
+#line 56
+ isolated_app_all
+#line 56
+ isolated_compute_app
+#line 56
+ mediaprovider
+#line 56
+ mediaprovider_app
+#line 56
+ untrusted_app
+#line 56
+ untrusted_app_25
+#line 56
+ untrusted_app_27
+#line 56
+ untrusted_app_29
+#line 56
+ untrusted_app_30
+#line 56
+ untrusted_app_all
+#line 56
+} } radio_cdma_ecm_prop:file read;
+
+# Shared libraries created by trusted components within an app home
+# directory can be dlopen()ed. To maintain the W^X property, these files
+# must never be writable to the app.
+neverallow {
+#line 61
+ ephemeral_app
+#line 61
+ isolated_app
+#line 61
+ isolated_app_all
+#line 61
+ isolated_compute_app
+#line 61
+ mediaprovider
+#line 61
+ mediaprovider_app
+#line 61
+ untrusted_app
+#line 61
+ untrusted_app_25
+#line 61
+ untrusted_app_27
+#line 61
+ untrusted_app_29
+#line 61
+ untrusted_app_30
+#line 61
+ untrusted_app_all
+#line 61
+} app_exec_data_file:file
+ { append create link relabelfrom relabelto rename setattr write };
+
+# Block calling execve() on files in an apps home directory.
+# This is a W^X violation (loading executable code from a writable
+# home directory). For compatibility, allow for targetApi <= 28.
+# b/112357170
+neverallow {
+ {
+#line 69
+ ephemeral_app
+#line 69
+ isolated_app
+#line 69
+ isolated_app_all
+#line 69
+ isolated_compute_app
+#line 69
+ mediaprovider
+#line 69
+ mediaprovider_app
+#line 69
+ untrusted_app
+#line 69
+ untrusted_app_25
+#line 69
+ untrusted_app_27
+#line 69
+ untrusted_app_29
+#line 69
+ untrusted_app_30
+#line 69
+ untrusted_app_all
+#line 69
+}
+ -untrusted_app_25
+ -untrusted_app_27
+ -runas_app
+} { app_data_file privapp_data_file }:file execute_no_trans;
+
+
+#line 75
+ # block apps from executing files in their storage areas
+#line 75
+ # this is a stronger and more desirable guarantee than blocking execute_no_trans, but
+#line 75
+ # execute cannot be blocked on all of app_data_file without causing
+#line 75
+ # backwards compatibility issues (see b/237289679)
+#line 75
+ neverallow appdomain storage_area_content_file:file execute;
+#line 81
+
+
+
+#line 83
+ # dont allow apps to modify their own directories of storage areas
+#line 83
+ neverallow appdomain storage_area_app_dir:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } {
+#line 83
+ create write setattr relabelfrom relabelto append unlink link rename
+#line 83
+ };
+#line 88
+
+
+# Do not allow untrusted apps to invoke dex2oat. This was historically required
+# by ART for compiling secondary dex files but has been removed in Q.
+# Exempt legacy apps (targetApi<=28) for compatibility.
+neverallow {
+ {
+#line 94
+ ephemeral_app
+#line 94
+ isolated_app
+#line 94
+ isolated_app_all
+#line 94
+ isolated_compute_app
+#line 94
+ mediaprovider
+#line 94
+ mediaprovider_app
+#line 94
+ untrusted_app
+#line 94
+ untrusted_app_25
+#line 94
+ untrusted_app_27
+#line 94
+ untrusted_app_29
+#line 94
+ untrusted_app_30
+#line 94
+ untrusted_app_all
+#line 94
+}
+ -untrusted_app_25
+ -untrusted_app_27
+} dex2oat_exec:file { execute execute_no_trans };
+
+# Do not allow untrusted apps to be assigned mlstrustedsubject.
+# This would undermine the per-user isolation model being
+# enforced via levelFrom=user in seapp_contexts and the mls
+# constraints. As there is no direct way to specify a neverallow
+# on attribute assignment, this relies on the fact that fork
+# permission only makes sense within a domain (hence should
+# never be granted to any other domain within mlstrustedsubject)
+# and an untrusted app is allowed fork permission to itself.
+neverallow {
+#line 107
+ ephemeral_app
+#line 107
+ isolated_app
+#line 107
+ isolated_app_all
+#line 107
+ isolated_compute_app
+#line 107
+ mediaprovider
+#line 107
+ mediaprovider_app
+#line 107
+ untrusted_app
+#line 107
+ untrusted_app_25
+#line 107
+ untrusted_app_27
+#line 107
+ untrusted_app_29
+#line 107
+ untrusted_app_30
+#line 107
+ untrusted_app_all
+#line 107
+} mlstrustedsubject:process fork;
+
+# Do not allow untrusted apps to hard link to any files.
+# In particular, if an untrusted app links to other app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure untrusted apps never have this
+# capability.
+neverallow {
+#line 115
+ ephemeral_app
+#line 115
+ isolated_app
+#line 115
+ isolated_app_all
+#line 115
+ isolated_compute_app
+#line 115
+ mediaprovider
+#line 115
+ mediaprovider_app
+#line 115
+ untrusted_app
+#line 115
+ untrusted_app_25
+#line 115
+ untrusted_app_27
+#line 115
+ untrusted_app_29
+#line 115
+ untrusted_app_30
+#line 115
+ untrusted_app_all
+#line 115
+} file_type:file link;
+
+# Do not allow untrusted apps to access network MAC address file
+neverallow {
+#line 118
+ ephemeral_app
+#line 118
+ isolated_app
+#line 118
+ isolated_app_all
+#line 118
+ isolated_compute_app
+#line 118
+ mediaprovider
+#line 118
+ mediaprovider_app
+#line 118
+ untrusted_app
+#line 118
+ untrusted_app_25
+#line 118
+ untrusted_app_27
+#line 118
+ untrusted_app_29
+#line 118
+ untrusted_app_30
+#line 118
+ untrusted_app_all
+#line 118
+} sysfs_net:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Do not allow any write access to files in /sys
+neverallow {
+#line 121
+ ephemeral_app
+#line 121
+ isolated_app
+#line 121
+ isolated_app_all
+#line 121
+ isolated_compute_app
+#line 121
+ mediaprovider
+#line 121
+ mediaprovider_app
+#line 121
+ untrusted_app
+#line 121
+ untrusted_app_25
+#line 121
+ untrusted_app_27
+#line 121
+ untrusted_app_29
+#line 121
+ untrusted_app_30
+#line 121
+ untrusted_app_all
+#line 121
+} sysfs_type:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+
+# Apps may never access the default sysfs label.
+neverallow {
+#line 124
+ ephemeral_app
+#line 124
+ isolated_app
+#line 124
+ isolated_app_all
+#line 124
+ isolated_compute_app
+#line 124
+ mediaprovider
+#line 124
+ mediaprovider_app
+#line 124
+ untrusted_app
+#line 124
+ untrusted_app_25
+#line 124
+ untrusted_app_27
+#line 124
+ untrusted_app_29
+#line 124
+ untrusted_app_30
+#line 124
+ untrusted_app_all
+#line 124
+} sysfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm {
+#line 128
+ ephemeral_app
+#line 128
+ isolated_app
+#line 128
+ isolated_app_all
+#line 128
+ isolated_compute_app
+#line 128
+ mediaprovider
+#line 128
+ mediaprovider_app
+#line 128
+ untrusted_app
+#line 128
+ untrusted_app_25
+#line 128
+ untrusted_app_27
+#line 128
+ untrusted_app_29
+#line 128
+ untrusted_app_30
+#line 128
+ untrusted_app_all
+#line 128
+} domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl
+#line 128
+{
+#line 128
+# qualcomm rmnet ioctls
+#line 128
+0x00006900 0x00006902
+#line 128
+# socket ioctls
+#line 128
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 128
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 128
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 128
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 128
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 128
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 128
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 128
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 128
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 128
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 128
+# device and protocol specific ioctls
+#line 128
+0x000089f0-0x000089ff
+#line 128
+0x000089e0-0x000089ef
+#line 128
+# Wireless extension ioctls
+#line 128
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 128
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 128
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 128
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 128
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 128
+0x00008b34 0x00008b35 0x00008b36
+#line 128
+# Dev private ioctl i.e. hardware specific ioctls
+#line 128
+0x00008be0-0x00008bff
+#line 128
+};
+neverallow {
+#line 129
+ ephemeral_app
+#line 129
+ isolated_app
+#line 129
+ isolated_app_all
+#line 129
+ isolated_compute_app
+#line 129
+ mediaprovider
+#line 129
+ mediaprovider_app
+#line 129
+ untrusted_app
+#line 129
+ untrusted_app_25
+#line 129
+ untrusted_app_27
+#line 129
+ untrusted_app_29
+#line 129
+ untrusted_app_30
+#line 129
+ untrusted_app_all
+#line 129
+} *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow {
+#line 130
+ ephemeral_app
+#line 130
+ isolated_app
+#line 130
+ isolated_app_all
+#line 130
+ isolated_compute_app
+#line 130
+ mediaprovider
+#line 130
+ mediaprovider_app
+#line 130
+ untrusted_app
+#line 130
+ untrusted_app_25
+#line 130
+ untrusted_app_27
+#line 130
+ untrusted_app_29
+#line 130
+ untrusted_app_30
+#line 130
+ untrusted_app_all
+#line 130
+} *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
+
+# Apps can read/write an already open vsock (e.g. created by
+# virtualizationservice) but nothing more than that (e.g. creating a
+# new vsock, etc.)
+neverallow {
+#line 147
+ ephemeral_app
+#line 147
+ isolated_app
+#line 147
+ isolated_app_all
+#line 147
+ isolated_compute_app
+#line 147
+ mediaprovider
+#line 147
+ mediaprovider_app
+#line 147
+ untrusted_app
+#line 147
+ untrusted_app_25
+#line 147
+ untrusted_app_27
+#line 147
+ untrusted_app_29
+#line 147
+ untrusted_app_30
+#line 147
+ untrusted_app_all
+#line 147
+} *:vsock_socket ~{ getattr getopt read write };
+
+# Disallow sending RTM_GETLINK messages on netlink sockets.
+neverallow {
+#line 150
+ ephemeral_app
+#line 150
+ isolated_app
+#line 150
+ isolated_app_all
+#line 150
+ isolated_compute_app
+#line 150
+ mediaprovider
+#line 150
+ mediaprovider_app
+#line 150
+ untrusted_app
+#line 150
+ untrusted_app_25
+#line 150
+ untrusted_app_27
+#line 150
+ untrusted_app_29
+#line 150
+ untrusted_app_30
+#line 150
+ untrusted_app_all
+#line 150
+} domain:netlink_route_socket { bind nlmsg_readpriv };
+neverallow priv_app domain:netlink_route_socket { bind nlmsg_readpriv };
+
+# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets.
+neverallow {
+ {
+#line 155
+ ephemeral_app
+#line 155
+ isolated_app
+#line 155
+ isolated_app_all
+#line 155
+ isolated_compute_app
+#line 155
+ mediaprovider
+#line 155
+ mediaprovider_app
+#line 155
+ untrusted_app
+#line 155
+ untrusted_app_25
+#line 155
+ untrusted_app_27
+#line 155
+ untrusted_app_29
+#line 155
+ untrusted_app_30
+#line 155
+ untrusted_app_all
+#line 155
+}
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+} domain:netlink_route_socket nlmsg_getneigh;
+
+# Do not allow untrusted apps access to /cache
+neverallow { {
+#line 163
+ ephemeral_app
+#line 163
+ isolated_app
+#line 163
+ isolated_app_all
+#line 163
+ isolated_compute_app
+#line 163
+ mediaprovider
+#line 163
+ mediaprovider_app
+#line 163
+ untrusted_app
+#line 163
+ untrusted_app_25
+#line 163
+ untrusted_app_27
+#line 163
+ untrusted_app_29
+#line 163
+ untrusted_app_30
+#line 163
+ untrusted_app_all
+#line 163
+} -mediaprovider } { cache_file cache_recovery_file }:dir ~{ { open getattr read search ioctl lock watch watch_reads } };
+neverallow { {
+#line 164
+ ephemeral_app
+#line 164
+ isolated_app
+#line 164
+ isolated_app_all
+#line 164
+ isolated_compute_app
+#line 164
+ mediaprovider
+#line 164
+ mediaprovider_app
+#line 164
+ untrusted_app
+#line 164
+ untrusted_app_25
+#line 164
+ untrusted_app_27
+#line 164
+ untrusted_app_29
+#line 164
+ untrusted_app_30
+#line 164
+ untrusted_app_all
+#line 164
+} -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
+
+# Do not allow untrusted apps to create/unlink files outside of its sandbox,
+# internal storage or sdcard.
+# World accessible data locations allow application to fill the device
+# with unaccounted for data. This data will not get removed during
+# application un-installation.
+neverallow { {
+#line 171
+ ephemeral_app
+#line 171
+ isolated_app
+#line 171
+ isolated_app_all
+#line 171
+ isolated_compute_app
+#line 171
+ mediaprovider
+#line 171
+ mediaprovider_app
+#line 171
+ untrusted_app
+#line 171
+ untrusted_app_25
+#line 171
+ untrusted_app_27
+#line 171
+ untrusted_app_29
+#line 171
+ untrusted_app_30
+#line 171
+ untrusted_app_all
+#line 171
+} -mediaprovider } {
+ fs_type
+ -sdcard_type
+ -fuse
+ file_type
+ -app_data_file # The apps sandbox itself
+ -privapp_data_file
+ -storage_area_content_file
+ -app_exec_data_file # stored within the app sandbox directory
+ -media_rw_data_file # Internal storage. Known that apps can
+ # leave artfacts here after uninstall.
+ -user_profile_data_file # Access to profile files
+
+#line 187
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create unlink };
+
+# No untrusted component except mediaprovider_app should be touching /dev/fuse
+neverallow { {
+#line 190
+ ephemeral_app
+#line 190
+ isolated_app
+#line 190
+ isolated_app_all
+#line 190
+ isolated_compute_app
+#line 190
+ mediaprovider
+#line 190
+ mediaprovider_app
+#line 190
+ untrusted_app
+#line 190
+ untrusted_app_25
+#line 190
+ untrusted_app_27
+#line 190
+ untrusted_app_29
+#line 190
+ untrusted_app_30
+#line 190
+ untrusted_app_all
+#line 190
+} -mediaprovider_app } fuse_device:chr_file *;
+
+# Do not allow untrusted apps to directly open the tun_device
+neverallow {
+#line 193
+ ephemeral_app
+#line 193
+ isolated_app
+#line 193
+ isolated_app_all
+#line 193
+ isolated_compute_app
+#line 193
+ mediaprovider
+#line 193
+ mediaprovider_app
+#line 193
+ untrusted_app
+#line 193
+ untrusted_app_25
+#line 193
+ untrusted_app_27
+#line 193
+ untrusted_app_29
+#line 193
+ untrusted_app_30
+#line 193
+ untrusted_app_all
+#line 193
+} tun_device:chr_file open;
+# The tun_device ioctls below are not allowed, to prove equivalence
+# to the kernel patch at
+# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21
+neverallowxperm {
+#line 197
+ ephemeral_app
+#line 197
+ isolated_app
+#line 197
+ isolated_app_all
+#line 197
+ isolated_compute_app
+#line 197
+ mediaprovider
+#line 197
+ mediaprovider_app
+#line 197
+ untrusted_app
+#line 197
+ untrusted_app_25
+#line 197
+ untrusted_app_27
+#line 197
+ untrusted_app_29
+#line 197
+ untrusted_app_30
+#line 197
+ untrusted_app_all
+#line 197
+} tun_device:chr_file ioctl ~{ 0x00005451 0x00005450 0x800454d2 };
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+neverallow {
+#line 200
+ ephemeral_app
+#line 200
+ isolated_app
+#line 200
+ isolated_app_all
+#line 200
+ isolated_compute_app
+#line 200
+ mediaprovider
+#line 200
+ mediaprovider_app
+#line 200
+ untrusted_app
+#line 200
+ untrusted_app_25
+#line 200
+ untrusted_app_27
+#line 200
+ untrusted_app_29
+#line 200
+ untrusted_app_30
+#line 200
+ untrusted_app_all
+#line 200
+} anr_data_file:file ~{ open append };
+neverallow {
+#line 201
+ ephemeral_app
+#line 201
+ isolated_app
+#line 201
+ isolated_app_all
+#line 201
+ isolated_compute_app
+#line 201
+ mediaprovider
+#line 201
+ mediaprovider_app
+#line 201
+ untrusted_app
+#line 201
+ untrusted_app_25
+#line 201
+ untrusted_app_27
+#line 201
+ untrusted_app_29
+#line 201
+ untrusted_app_30
+#line 201
+ untrusted_app_all
+#line 201
+} anr_data_file:dir ~search;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow {
+#line 205
+ ephemeral_app
+#line 205
+ isolated_app
+#line 205
+ isolated_app_all
+#line 205
+ isolated_compute_app
+#line 205
+ mediaprovider
+#line 205
+ mediaprovider_app
+#line 205
+ untrusted_app
+#line 205
+ untrusted_app_25
+#line 205
+ untrusted_app_27
+#line 205
+ untrusted_app_29
+#line 205
+ untrusted_app_30
+#line 205
+ untrusted_app_all
+#line 205
+} {
+ proc
+ proc_allocinfo
+ proc_asound
+ proc_kmsg
+ proc_loadavg
+ proc_mounts
+ proc_pagetypeinfo
+ proc_slabinfo
+ proc_stat
+ proc_swaps
+ proc_uptime
+ proc_version
+ proc_vmallocinfo
+ proc_vmstat
+}:file { { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads } { execute execute_no_trans } };
+
+# /proc/filesystems is accessible to mediaprovider_app only since it handles
+# external storage
+neverallow { {
+#line 224
+ ephemeral_app
+#line 224
+ isolated_app
+#line 224
+ isolated_app_all
+#line 224
+ isolated_compute_app
+#line 224
+ mediaprovider
+#line 224
+ mediaprovider_app
+#line 224
+ untrusted_app
+#line 224
+ untrusted_app_25
+#line 224
+ untrusted_app_27
+#line 224
+ untrusted_app_29
+#line 224
+ untrusted_app_30
+#line 224
+ untrusted_app_all
+#line 224
+} - mediaprovider_app } proc_filesystems:file { { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads } { execute execute_no_trans } };
+
+# Avoid all access to kernel configuration
+neverallow {
+#line 227
+ ephemeral_app
+#line 227
+ isolated_app
+#line 227
+ isolated_app_all
+#line 227
+ isolated_compute_app
+#line 227
+ mediaprovider
+#line 227
+ mediaprovider_app
+#line 227
+ untrusted_app
+#line 227
+ untrusted_app_25
+#line 227
+ untrusted_app_27
+#line 227
+ untrusted_app_29
+#line 227
+ untrusted_app_30
+#line 227
+ untrusted_app_all
+#line 227
+} config_gz:file { { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads } { execute execute_no_trans } };
+
+# Do not allow untrusted apps access to preloads data files
+neverallow {
+#line 230
+ ephemeral_app
+#line 230
+ isolated_app
+#line 230
+ isolated_app_all
+#line 230
+ isolated_compute_app
+#line 230
+ mediaprovider
+#line 230
+ mediaprovider_app
+#line 230
+ untrusted_app
+#line 230
+ untrusted_app_25
+#line 230
+ untrusted_app_27
+#line 230
+ untrusted_app_29
+#line 230
+ untrusted_app_30
+#line 230
+ untrusted_app_all
+#line 230
+} preloads_data_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Locking of files on /system could lead to denial of service attacks
+# against privileged system components
+neverallow {
+#line 234
+ ephemeral_app
+#line 234
+ isolated_app
+#line 234
+ isolated_app_all
+#line 234
+ isolated_compute_app
+#line 234
+ mediaprovider
+#line 234
+ mediaprovider_app
+#line 234
+ untrusted_app
+#line 234
+ untrusted_app_25
+#line 234
+ untrusted_app_27
+#line 234
+ untrusted_app_29
+#line 234
+ untrusted_app_30
+#line 234
+ untrusted_app_all
+#line 234
+} system_file:file lock;
+
+# Do not permit untrusted apps to perform actions on HwBinder service_manager
+# other than find actions for services listed below
+neverallow {
+#line 238
+ ephemeral_app
+#line 238
+ isolated_app
+#line 238
+ isolated_app_all
+#line 238
+ isolated_compute_app
+#line 238
+ mediaprovider
+#line 238
+ mediaprovider_app
+#line 238
+ untrusted_app
+#line 238
+ untrusted_app_25
+#line 238
+ untrusted_app_27
+#line 238
+ untrusted_app_29
+#line 238
+ untrusted_app_30
+#line 238
+ untrusted_app_all
+#line 238
+} *:hwservice_manager ~find;
+
+# Do not permit access from apps which host arbitrary code to the protected services
+# The two main reasons for this are:
+# 1. Protected HwBinder servers do not perform client authentication because
+# vendor code does not have a way to understand apps or their relation to
+# caller UID information and, even if it did, those services either operate
+# at a level below that of apps (e.g., HALs) or must not rely on app identity
+# for authorization. Thus, to be safe, the default assumption for all added
+# vendor services is that they treat all their clients as equally authorized
+# to perform operations offered by the service.
+# 2. HAL servers contain code with higher incidence rate of security issues
+# than system/core components and have access to lower layes of the stack
+# (all the way down to hardware) thus increasing opportunities for bypassing
+# the Android security model.
+neverallow {
+#line 253
+ ephemeral_app
+#line 253
+ isolated_app
+#line 253
+ isolated_app_all
+#line 253
+ isolated_compute_app
+#line 253
+ mediaprovider
+#line 253
+ mediaprovider_app
+#line 253
+ untrusted_app
+#line 253
+ untrusted_app_25
+#line 253
+ untrusted_app_27
+#line 253
+ untrusted_app_29
+#line 253
+ untrusted_app_30
+#line 253
+ untrusted_app_all
+#line 253
+} protected_hwservice:hwservice_manager find;
+neverallow {
+#line 254
+ ephemeral_app
+#line 254
+ isolated_app
+#line 254
+ isolated_app_all
+#line 254
+ isolated_compute_app
+#line 254
+ mediaprovider
+#line 254
+ mediaprovider_app
+#line 254
+ untrusted_app
+#line 254
+ untrusted_app_25
+#line 254
+ untrusted_app_27
+#line 254
+ untrusted_app_29
+#line 254
+ untrusted_app_30
+#line 254
+ untrusted_app_all
+#line 254
+} protected_service:service_manager find;
+
+# SELinux is not an API for untrusted apps to use
+neverallow {
+#line 257
+ ephemeral_app
+#line 257
+ isolated_app
+#line 257
+ isolated_app_all
+#line 257
+ isolated_compute_app
+#line 257
+ mediaprovider
+#line 257
+ mediaprovider_app
+#line 257
+ untrusted_app
+#line 257
+ untrusted_app_25
+#line 257
+ untrusted_app_27
+#line 257
+ untrusted_app_29
+#line 257
+ untrusted_app_30
+#line 257
+ untrusted_app_all
+#line 257
+} selinuxfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Access to /proc/tty/drivers, to allow apps to determine if they
+# are running in an emulated environment.
+# b/33214085 b/33814662 b/33791054 b/33211769
+# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
+# This will go away in a future Android release
+neverallow { {
+#line 264
+ ephemeral_app
+#line 264
+ isolated_app
+#line 264
+ isolated_app_all
+#line 264
+ isolated_compute_app
+#line 264
+ mediaprovider
+#line 264
+ mediaprovider_app
+#line 264
+ untrusted_app
+#line 264
+ untrusted_app_25
+#line 264
+ untrusted_app_27
+#line 264
+ untrusted_app_29
+#line 264
+ untrusted_app_30
+#line 264
+ untrusted_app_all
+#line 264
+} -untrusted_app_25 } proc_tty_drivers:file { getattr open read ioctl lock map watch watch_reads };
+neverallow {
+#line 265
+ ephemeral_app
+#line 265
+ isolated_app
+#line 265
+ isolated_app_all
+#line 265
+ isolated_compute_app
+#line 265
+ mediaprovider
+#line 265
+ mediaprovider_app
+#line 265
+ untrusted_app
+#line 265
+ untrusted_app_25
+#line 265
+ untrusted_app_27
+#line 265
+ untrusted_app_29
+#line 265
+ untrusted_app_30
+#line 265
+ untrusted_app_all
+#line 265
+} proc_tty_drivers:file ~{ getattr open read ioctl lock map watch watch_reads };
+
+# Untrusted apps are not allowed to use cgroups.
+neverallow {
+#line 268
+ ephemeral_app
+#line 268
+ isolated_app
+#line 268
+ isolated_app_all
+#line 268
+ isolated_compute_app
+#line 268
+ mediaprovider
+#line 268
+ mediaprovider_app
+#line 268
+ untrusted_app
+#line 268
+ untrusted_app_25
+#line 268
+ untrusted_app_27
+#line 268
+ untrusted_app_29
+#line 268
+ untrusted_app_30
+#line 268
+ untrusted_app_all
+#line 268
+} cgroup:file *;
+neverallow {
+#line 269
+ ephemeral_app
+#line 269
+ isolated_app
+#line 269
+ isolated_app_all
+#line 269
+ isolated_compute_app
+#line 269
+ mediaprovider
+#line 269
+ mediaprovider_app
+#line 269
+ untrusted_app
+#line 269
+ untrusted_app_25
+#line 269
+ untrusted_app_27
+#line 269
+ untrusted_app_29
+#line 269
+ untrusted_app_30
+#line 269
+ untrusted_app_all
+#line 269
+} cgroup_v2:file *;
+
+# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps
+# must not use it.
+neverallow {
+ {
+#line 274
+ ephemeral_app
+#line 274
+ isolated_app
+#line 274
+ isolated_app_all
+#line 274
+ isolated_compute_app
+#line 274
+ mediaprovider
+#line 274
+ mediaprovider_app
+#line 274
+ untrusted_app
+#line 274
+ untrusted_app_25
+#line 274
+ untrusted_app_27
+#line 274
+ untrusted_app_29
+#line 274
+ untrusted_app_30
+#line 274
+ untrusted_app_all
+#line 274
+}
+ -untrusted_app_25
+ -untrusted_app_27
+} mnt_sdcard_file:lnk_file *;
+
+# Only privileged apps may find the incident service
+neverallow {
+#line 280
+ ephemeral_app
+#line 280
+ isolated_app
+#line 280
+ isolated_app_all
+#line 280
+ isolated_compute_app
+#line 280
+ mediaprovider
+#line 280
+ mediaprovider_app
+#line 280
+ untrusted_app
+#line 280
+ untrusted_app_25
+#line 280
+ untrusted_app_27
+#line 280
+ untrusted_app_29
+#line 280
+ untrusted_app_30
+#line 280
+ untrusted_app_all
+#line 280
+} incident_service:service_manager find;
+
+# Only privileged apps may find stats service
+neverallow {
+#line 283
+ ephemeral_app
+#line 283
+ isolated_app
+#line 283
+ isolated_app_all
+#line 283
+ isolated_compute_app
+#line 283
+ mediaprovider
+#line 283
+ mediaprovider_app
+#line 283
+ untrusted_app
+#line 283
+ untrusted_app_25
+#line 283
+ untrusted_app_27
+#line 283
+ untrusted_app_29
+#line 283
+ untrusted_app_30
+#line 283
+ untrusted_app_all
+#line 283
+} stats_service:service_manager find;
+
+# Do not allow untrusted app to read hidden system proprerties.
+# We do not include in the exclusions other normally untrusted applications such as mediaprovider
+# due to the specific logging use cases.
+# Context: b/193912100
+neverallow {
+ {
+#line 290
+ ephemeral_app
+#line 290
+ isolated_app
+#line 290
+ isolated_app_all
+#line 290
+ isolated_compute_app
+#line 290
+ mediaprovider
+#line 290
+ mediaprovider_app
+#line 290
+ untrusted_app
+#line 290
+ untrusted_app_25
+#line 290
+ untrusted_app_27
+#line 290
+ untrusted_app_29
+#line 290
+ untrusted_app_30
+#line 290
+ untrusted_app_all
+#line 290
+}
+ -mediaprovider
+ -mediaprovider_app
+} { userdebug_or_eng_prop }:file read;
+
+# Do not allow untrusted app to access /dev/socket/mdnsd since U. The socket is
+# used to communicate to the mdnsd responder. The mdnsd responder will be
+# replaced by a java implementation which is integrated into the system server.
+# For untrusted apps running with API level 33-, they still have access to
+# /dev/socket/mdnsd for backward compatibility.
+neverallow {
+ {
+#line 301
+ ephemeral_app
+#line 301
+ isolated_app
+#line 301
+ isolated_app_all
+#line 301
+ isolated_compute_app
+#line 301
+ mediaprovider
+#line 301
+ mediaprovider_app
+#line 301
+ untrusted_app
+#line 301
+ untrusted_app_25
+#line 301
+ untrusted_app_27
+#line 301
+ untrusted_app_29
+#line 301
+ untrusted_app_30
+#line 301
+ untrusted_app_all
+#line 301
+}
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} mdnsd_socket:sock_file write;
+neverallow {
+ {
+#line 309
+ ephemeral_app
+#line 309
+ isolated_app
+#line 309
+ isolated_app_all
+#line 309
+ isolated_compute_app
+#line 309
+ mediaprovider
+#line 309
+ mediaprovider_app
+#line 309
+ untrusted_app
+#line 309
+ untrusted_app_25
+#line 309
+ untrusted_app_27
+#line 309
+ untrusted_app_29
+#line 309
+ untrusted_app_30
+#line 309
+ untrusted_app_all
+#line 309
+}
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} mdnsd:unix_stream_socket connectto;
+
+# Do not allow untrusted apps to use anonymous inodes. At the moment,
+# type transitions are the only way to distinguish between different
+# anon_inode usages like userfaultfd and io_uring. This prevents us from
+# creating a more fine-grained neverallow policy for each anon_inode usage.
+neverallow {
+#line 321
+ ephemeral_app
+#line 321
+ isolated_app
+#line 321
+ isolated_app_all
+#line 321
+ isolated_compute_app
+#line 321
+ mediaprovider
+#line 321
+ mediaprovider_app
+#line 321
+ untrusted_app
+#line 321
+ untrusted_app_25
+#line 321
+ untrusted_app_27
+#line 321
+ untrusted_app_29
+#line 321
+ untrusted_app_30
+#line 321
+ untrusted_app_all
+#line 321
+} domain:anon_inode *;
+
+# Do not allow untrusted app access to hidraw devices.
+neverallow {
+#line 324
+ ephemeral_app
+#line 324
+ isolated_app
+#line 324
+ isolated_app_all
+#line 324
+ isolated_compute_app
+#line 324
+ mediaprovider
+#line 324
+ mediaprovider_app
+#line 324
+ untrusted_app
+#line 324
+ untrusted_app_25
+#line 324
+ untrusted_app_27
+#line 324
+ untrusted_app_29
+#line 324
+ untrusted_app_30
+#line 324
+ untrusted_app_all
+#line 324
+} hidraw_device:chr_file *;
+#line 1 "system/sepolicy/private/app_zygote.te"
+typeattribute app_zygote coredomain;
+
+######
+###### Policy below is different from regular zygote-spawned apps
+######
+
+# Allow access to temporary files, which is normally permitted through
+# a domain macro.
+
+#line 9
+type_transition app_zygote tmpfs:file app_zygote_tmpfs;
+#line 9
+allow app_zygote app_zygote_tmpfs:file { read write getattr map };
+#line 9
+;
+
+# Set the UID/GID of the process.
+# This will be further limited to a range of isolated UIDs with seccomp.
+allow app_zygote self:{ capability cap_userns } { setgid setuid };
+# Drop capabilities from bounding set.
+allow app_zygote self:{ capability cap_userns } setpcap;
+# Switch SELinux context to isolated app domain.
+allow app_zygote self:process setcurrent;
+allow app_zygote isolated_app:process dyntransition;
+
+# For JIT
+allow app_zygote self:process execmem;
+
+# Allow exec mapping from tmpfs (memfds) for binary translation
+allow app_zygote app_zygote_tmpfs:file execute;
+
+# Allow app_zygote to stat the files that it opens. It must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow app_zygote debugfs_trace_marker:file getattr;
+
+# get system_server process group
+allow app_zygote system_server:process getpgid;
+
+# Interaction between the app_zygote and its children.
+allow app_zygote isolated_app:process setpgid;
+
+# TODO (b/63631799) fix this access
+dontaudit app_zygote mnt_expand_file:dir getattr;
+
+# Get seapp_contexts
+allow app_zygote seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# Check validity of SELinux context before use.
+
+#line 43
+
+#line 43
+allow app_zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 43
+allow app_zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 43
+
+#line 43
+allow app_zygote selinuxfs:file { open append write lock map };
+#line 43
+allow app_zygote kernel:security check_context;
+#line 43
+
+# Check SELinux permissions.
+
+#line 45
+
+#line 45
+allow app_zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 45
+allow app_zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 45
+
+#line 45
+allow app_zygote selinuxfs:file { open append write lock map };
+#line 45
+allow app_zygote kernel:security compute_av;
+#line 45
+allow app_zygote self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 45
+
+
+# Read and inspect temporary files managed by zygote.
+allow app_zygote zygote_tmpfs:file { read getattr };
+
+######
+###### Policy below is shared with regular zygote-spawned apps
+######
+
+# Child of zygote.
+allow app_zygote zygote:fd use;
+allow app_zygote zygote:process sigchld;
+
+# For ART (read /data/dalvik-cache).
+
+#line 59
+allow app_zygote dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 59
+allow app_zygote dalvikcache_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 59
+;
+allow app_zygote dalvikcache_data_file:file execute;
+
+# For ART (allow userfaultfd and related ioctls)
+
+#line 63
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 63
+type app_zygote_userfaultfd;
+#line 63
+type_transition app_zygote app_zygote:anon_inode app_zygote_userfaultfd "[userfaultfd]";
+#line 63
+# Allow domain to create/use userfaultfd anon_inode.
+#line 63
+allow app_zygote app_zygote_userfaultfd:anon_inode { create ioctl read };
+#line 63
+# Suppress errors generate during bugreport
+#line 63
+dontaudit su app_zygote_userfaultfd:anon_inode *;
+#line 63
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 63
+neverallow { domain -app_zygote } app_zygote_userfaultfd:anon_inode *;
+#line 63
+
+
+# Read /data/misc/apexdata/ to (get to com.android.art/dalvik-cache).
+allow app_zygote apex_module_data_file:dir search;
+# For ART APEX (read /data/misc/apexdata/com.android.art/dalvik-cache).
+
+#line 68
+allow app_zygote apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 68
+allow app_zygote apex_art_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 68
+
+
+# Allow reading/executing installed binaries to enable preloading
+# application data
+allow app_zygote apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow app_zygote apk_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# /oem accesses.
+allow app_zygote oemfs:dir search;
+
+# Allow app_zygote access to /vendor/overlay
+
+#line 79
+allow app_zygote vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 79
+allow app_zygote vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 79
+
+# Allow app_zygote to read vendor_overlay_file from vendor apex as well
+allow app_zygote vendor_apex_metadata_file:dir { getattr search };
+
+allow app_zygote system_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow app_zygote system_data_file:file { getattr read map };
+
+# Send unsolicited message to system_server
+
+#line 87
+allow app_zygote system_unsolzygote_socket:sock_file write;
+#line 87
+allow app_zygote system_server:unix_dgram_socket sendto;
+#line 87
+
+
+# Allow the app_zygote to access the runtime feature flag properties.
+
+#line 90
+allow app_zygote device_config_runtime_native_prop:file { getattr open read map };
+#line 90
+
+
+#line 91
+allow app_zygote device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 91
+
+
+# Allow app_zygote to access odsign verification status
+
+#line 94
+allow app_zygote odsign_prop:file { getattr open read map };
+#line 94
+
+
+# /data/resource-cache
+allow app_zygote resourcecache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow app_zygote resourcecache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+#####
+##### Neverallow
+#####
+
+# Only permit transition to isolated_app.
+neverallow app_zygote { domain -isolated_app }:process dyntransition;
+
+# Only setcon() transitions, no exec() based transitions, except for crash_dump.
+neverallow app_zygote { domain -crash_dump }:process transition;
+
+# Must not exec() a program without changing domains.
+# Having said that, exec() above is not allowed.
+neverallow app_zygote *:file execute_no_trans;
+
+# The only way to enter this domain is for the zygote to fork a new
+# app_zygote child.
+neverallow { domain -zygote } app_zygote:process dyntransition;
+
+# Disallow write access to properties.
+neverallow app_zygote property_socket:sock_file write;
+neverallow app_zygote property_type:property_service set;
+
+# Should not have any access to data files.
+neverallow app_zygote app_data_file_type:file { { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } { getattr execute execute_no_trans map } } };
+
+neverallow app_zygote {
+ service_manager_type
+ -activity_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps should not be able to access the driver directly.
+neverallow app_zygote gpu_device:chr_file { { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } { getattr execute execute_no_trans map } } };
+
+# Do not allow app_zygote access to /cache.
+neverallow app_zygote cache_file:dir ~{ { open getattr read search ioctl lock watch watch_reads } };
+neverallow app_zygote cache_file:file ~{ read getattr };
+
+# Do not allow most socket access. This is socket_class_set, excluding unix_dgram_socket,
+# unix_stream_socket, and netlink_selinux_socket.
+neverallow app_zygote domain:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket
+ appletalk_socket netlink_route_socket netlink_tcpdiag_socket
+ netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
+ sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket
+ x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket
+ pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket
+ rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
+} *;
+
+# Only allow app_zygote to talk to the logd socket, and su on eng/userdebug.
+# This is because cap_setuid/cap_setgid allow to forge uid/gid in
+# SCM_CREDENTIALS. Think twice before changing.
+neverallow app_zygote {
+ domain
+ -app_zygote
+ -logd
+ -system_server
+
+}:unix_dgram_socket *;
+
+neverallow app_zygote {
+ domain
+ -app_zygote
+ -prng_seeder
+
+}:unix_stream_socket *;
+
+# Never allow ptrace
+neverallow app_zygote *:process ptrace;
+
+# Do not allow access to Bluetooth-related system properties.
+# neverallow rules for Bluetooth-related data files are listed above.
+neverallow app_zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1 "system/sepolicy/private/art_boot.te"
+# ART boot oneshot service
+type art_boot, domain, coredomain;
+type art_boot_exec, exec_type, file_type, system_file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init art_boot_exec:file { getattr open read execute map };
+#line 5
+allow init art_boot:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow art_boot art_boot_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init art_boot:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init art_boot:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init art_boot_exec:process art_boot;
+#line 5
+
+#line 5
+
+
+# Allow query of device config properties, typically experiment flags.
+
+#line 8
+allow art_boot device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 8
+
+
+#line 9
+allow art_boot device_config_runtime_native_prop:file { getattr open read map };
+#line 9
+
+
+# Allow ART to set its config properties at boot, mainly to be able to propagate
+# experiment flags to properties that only may change at boot.
+
+#line 13
+
+#line 13
+allow art_boot property_socket:sock_file write;
+#line 13
+allow art_boot init:unix_stream_socket connectto;
+#line 13
+
+#line 13
+allow art_boot dalvik_config_prop_type:property_service set;
+#line 13
+
+#line 13
+allow art_boot dalvik_config_prop_type:file { getattr open read map };
+#line 13
+
+#line 13
+
+#line 1 "system/sepolicy/private/art_exec.te"
+# A wrapper program that configures the process and executes a command.
+type art_exec, domain, coredomain;
+type art_exec_exec, system_file_type, exec_type, file_type;
+
+# Usually, this program is executed in the caller's domain. For example, it is
+# executed in the `artd` domain when artd calls it. Domain transition will take
+# place as soon as it executes other programs.
+# The only exception is when called by init. In this case, it's executed in its
+# own domain because init should never execute a program without changing to
+# another domain.
+
+#line 11
+
+#line 11
+# Allow the necessary permissions.
+#line 11
+
+#line 11
+# Old domain may exec the file and transition to the new domain.
+#line 11
+allow init art_exec_exec:file { getattr open read execute map };
+#line 11
+allow init art_exec:process transition;
+#line 11
+# New domain is entered by executing the file.
+#line 11
+allow art_exec art_exec_exec:file { entrypoint open read execute getattr map };
+#line 11
+# New domain can send SIGCHLD to its caller.
+#line 11
+
+#line 11
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 11
+dontaudit init art_exec:process noatsecure;
+#line 11
+# XXX dontaudit candidate but requires further study.
+#line 11
+allow init art_exec:process { siginh rlimitinh };
+#line 11
+
+#line 11
+# Make the transition occur by default.
+#line 11
+type_transition init art_exec_exec:process art_exec;
+#line 11
+
+#line 11
+
+
+# init calls this program to execute artd in a chroot environment for Pre-reboot
+# Dexopt.
+
+#line 15
+# Allow the necessary permissions.
+#line 15
+
+#line 15
+# Old domain may exec the file and transition to the new domain.
+#line 15
+allow art_exec artd_exec:file { getattr open read execute map };
+#line 15
+allow art_exec artd:process transition;
+#line 15
+# New domain is entered by executing the file.
+#line 15
+allow artd artd_exec:file { entrypoint open read execute getattr map };
+#line 15
+# New domain can send SIGCHLD to its caller.
+#line 15
+allow artd art_exec:process sigchld;
+#line 15
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 15
+dontaudit art_exec artd:process noatsecure;
+#line 15
+# XXX dontaudit candidate but requires further study.
+#line 15
+allow art_exec artd:process { siginh rlimitinh };
+#line 15
+
+#line 15
+# Make the transition occur by default.
+#line 15
+type_transition art_exec artd_exec:process artd;
+#line 15
+
+
+# "sys_chroot" is for chroot'ing into the chroot environment, created by
+# dexopt_chroot_setup.
+allow art_exec self:{ capability cap_userns } sys_chroot;
+
+# Allow finding artd in the chroot dir for Pre-reboot Dexopt.
+allow art_exec pre_reboot_dexopt_file:dir search;
+#line 1 "system/sepolicy/private/artd.te"
+# ART service daemon.
+typeattribute artd coredomain;
+typeattribute artd mlstrustedsubject;
+type artd_exec, system_file_type, exec_type, file_type;
+type artd_tmpfs, file_type;
+
+# All types of artd subprocesses, which artd can kill.
+attribute artd_subprocess_type;
+
+# Allow artd to publish a binder service and make binder calls.
+
+#line 11
+# Call the servicemanager and transfer references to it.
+#line 11
+allow artd servicemanager:binder { call transfer };
+#line 11
+# Allow servicemanager to send out callbacks
+#line 11
+allow servicemanager artd:binder { call transfer };
+#line 11
+# servicemanager performs getpidcon on clients.
+#line 11
+allow servicemanager artd:dir search;
+#line 11
+allow servicemanager artd:file { read open };
+#line 11
+allow servicemanager artd:process getattr;
+#line 11
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 11
+# all domains in domain.te.
+#line 11
+
+
+#line 12
+ allow artd artd_service:service_manager { add find };
+#line 12
+ neverallow { domain -artd } artd_service:service_manager add;
+#line 12
+
+#line 12
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 12
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 12
+
+#line 12
+
+
+#line 13
+ allow artd artd_pre_reboot_service:service_manager { add find };
+#line 13
+ neverallow { domain -artd } artd_pre_reboot_service:service_manager add;
+#line 13
+
+#line 13
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 13
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 13
+
+#line 13
+
+allow artd dumpstate:fifo_file { getattr write };
+allow artd dumpstate:fd use;
+
+
+#line 17
+
+#line 17
+# Allow the necessary permissions.
+#line 17
+
+#line 17
+# Old domain may exec the file and transition to the new domain.
+#line 17
+allow init artd_exec:file { getattr open read execute map };
+#line 17
+allow init artd:process transition;
+#line 17
+# New domain is entered by executing the file.
+#line 17
+allow artd artd_exec:file { entrypoint open read execute getattr map };
+#line 17
+# New domain can send SIGCHLD to its caller.
+#line 17
+
+#line 17
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 17
+dontaudit init artd:process noatsecure;
+#line 17
+# XXX dontaudit candidate but requires further study.
+#line 17
+allow init artd:process { siginh rlimitinh };
+#line 17
+
+#line 17
+# Make the transition occur by default.
+#line 17
+type_transition init artd_exec:process artd;
+#line 17
+
+#line 17
+
+
+# Allow query ART device config properties
+
+#line 20
+allow artd device_config_runtime_native_prop:file { getattr open read map };
+#line 20
+
+
+#line 21
+allow artd device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 21
+
+
+# Access to "odsign.verification.success" for deciding whether to deny files in
+# the ART APEX data directory.
+
+#line 25
+allow artd odsign_prop:file { getattr open read map };
+#line 25
+
+
+# Reading an APK opens a ZipArchive, which unpack to tmpfs.
+# Use tmpfs_domain() which will give tmpfs files created by artd their
+# own label, which differs from other labels created by other processes.
+# This allows to distinguish in policy files created by artd vs other
+# processes.
+
+#line 32
+type_transition artd tmpfs:file artd_tmpfs;
+#line 32
+allow artd artd_tmpfs:file { read write getattr map };
+#line 32
+
+
+# Allow testing userfaultfd support.
+
+#line 35
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 35
+type artd_userfaultfd;
+#line 35
+type_transition artd artd:anon_inode artd_userfaultfd "[userfaultfd]";
+#line 35
+# Allow domain to create/use userfaultfd anon_inode.
+#line 35
+allow artd artd_userfaultfd:anon_inode { create ioctl read };
+#line 35
+# Suppress errors generate during bugreport
+#line 35
+dontaudit su artd_userfaultfd:anon_inode *;
+#line 35
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 35
+neverallow { domain -artd } artd_userfaultfd:anon_inode *;
+#line 35
+
+
+# Read access to primary dex'es on writable partitions
+# ({/data,/mnt/expand/<volume-uuid>}/app/...).
+# Also allow creating the "oat" directory before restorecon.
+allow artd mnt_expand_file:dir { getattr search };
+allow artd apk_data_file:dir { { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } create setattr relabelfrom };
+allow artd apk_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow artd apk_tmp_file:dir { { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } create setattr relabelfrom };
+allow artd apk_tmp_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read access to vendor APKs ({/vendor,/odm}/{app,priv-app}/...).
+
+#line 47
+allow artd vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 47
+allow artd vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 47
+
+
+# Read access to vendor overlay APKs ({/vendor,/odm,/oem,/apex/*}/overlay/...).
+allow artd oemfs:dir { getattr search };
+
+#line 51
+allow artd vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 51
+allow artd vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 51
+
+# Vendor overlay can be found in vendor apex
+allow artd vendor_apex_metadata_file:dir { getattr search };
+
+# Read access to vendor shared libraries ({/vendor,/odm}/framework/...).
+
+#line 56
+allow artd vendor_framework_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 56
+allow artd vendor_framework_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 56
+
+
+# Read/write access to all compilation artifacts generated on device for apps'
+# primary dex'es. (/data/dalvik-cache/..., /data/app/.../oat/..., etc.)
+allow artd dalvikcache_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow artd dalvikcache_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelto };
+
+# Read access to the ART APEX data directory.
+# Needed for reading the boot image generated on device.
+allow artd apex_module_data_file:dir { getattr search };
+
+#line 66
+allow artd apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 66
+allow artd apex_art_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 66
+
+
+# Read access to /apex/apex-info-list.xml
+# Needed for getting APEX versions.
+allow artd apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow getting root capabilities to bypass permission checks.
+# - "dac_override" and "dac_read_search" are for
+# - reading secondary dex'es in app data directories (reading primary dex'es
+# doesn't need root capabilities)
+# - managing (CRUD) compilation artifacts in both APK directories for primary
+# dex'es and in app data directories for secondary dex'es
+# - managing (CRUD) profile files for both primary dex'es and secondary dex'es
+# - "fowner" is for adjusting the file permissions of compilation artifacts and
+# profile files based on whether they include user data or not.
+# - "chown" is for transferring the ownership of compilation artifacts and
+# profile files to the system or apps.
+allow artd self:{ capability cap_userns } { dac_override dac_read_search fowner chown };
+
+# Read/write access to profiles (/data/misc/profiles/{ref,cur}/...). Also allow
+# scanning /data/misc/profiles/cur, for cleaning up obsolete managed files.
+allow artd user_profile_root_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow artd user_profile_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow artd user_profile_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read/write access to secondary dex files, their profiles, and their
+# compilation artifacts
+# ({/data,/mnt/expand/<volume-uuid>}/{user,user_de}/<user-id>/<package-name>/...).
+allow artd app_data_file_type:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom relabelto };
+allow artd app_data_file_type:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom relabelto };
+
+# Allow symlinks for secondary dex files. This has be to restricted because
+# symlinks can cause various security issues. We allow "privapp_data_file" just
+# for GMS because so far we only see GMS using symlinks.
+allow artd privapp_data_file:lnk_file { getattr read };
+
+# Read access to SELinux context files, for restorecon.
+allow artd file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow artd seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Check validity of SELinux context, for restorecon.
+
+#line 107
+
+#line 107
+allow artd selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 107
+allow artd selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 107
+
+#line 107
+allow artd selinuxfs:file { open append write lock map };
+#line 107
+allow artd kernel:security check_context;
+#line 107
+
+
+# Allow scanning /, for cleaning up obsolete managed files.
+allow artd rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow scanning /data, for cleaning up obsolete managed files.
+allow artd system_data_root_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow scanning /mnt, for cleaning up obsolete managed files.
+allow artd tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow scanning /mnt/expand, for cleaning up obsolete managed files.
+allow artd mnt_expand_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow scanning {/data,/mnt/expand/<volume-uuid>}/{user,user_de}, for cleaning
+# up obsolete managed files.
+allow artd system_userdir_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow scanning {/data,/mnt/expand/<volume-uuid>}/{user,user_de}/<user-id> and
+# /mnt/expand/<volume-uuid>, for cleaning up obsolete managed files.
+allow artd system_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow art_exec_exec to use the artd domain because it is a thin wrapper that
+# executes other binaries on behalf of artd. Domain transition will take place
+# as soon as art_exec_exec executes other binaries.
+allow artd art_exec_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow running other binaries in their own domains.
+
+#line 135
+# Allow the necessary permissions.
+#line 135
+
+#line 135
+# Old domain may exec the file and transition to the new domain.
+#line 135
+allow artd profman_exec:file { getattr open read execute map };
+#line 135
+allow artd profman:process transition;
+#line 135
+# New domain is entered by executing the file.
+#line 135
+allow profman profman_exec:file { entrypoint open read execute getattr map };
+#line 135
+# New domain can send SIGCHLD to its caller.
+#line 135
+allow profman artd:process sigchld;
+#line 135
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 135
+dontaudit artd profman:process noatsecure;
+#line 135
+# XXX dontaudit candidate but requires further study.
+#line 135
+allow artd profman:process { siginh rlimitinh };
+#line 135
+
+#line 135
+# Make the transition occur by default.
+#line 135
+type_transition artd profman_exec:process profman;
+#line 135
+
+
+#line 136
+# Allow the necessary permissions.
+#line 136
+
+#line 136
+# Old domain may exec the file and transition to the new domain.
+#line 136
+allow artd dex2oat_exec:file { getattr open read execute map };
+#line 136
+allow artd dex2oat:process transition;
+#line 136
+# New domain is entered by executing the file.
+#line 136
+allow dex2oat dex2oat_exec:file { entrypoint open read execute getattr map };
+#line 136
+# New domain can send SIGCHLD to its caller.
+#line 136
+allow dex2oat artd:process sigchld;
+#line 136
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 136
+dontaudit artd dex2oat:process noatsecure;
+#line 136
+# XXX dontaudit candidate but requires further study.
+#line 136
+allow artd dex2oat:process { siginh rlimitinh };
+#line 136
+
+#line 136
+# Make the transition occur by default.
+#line 136
+type_transition artd dex2oat_exec:process dex2oat;
+#line 136
+
+
+# Allow sending sigkill to subprocesses.
+allow artd artd_subprocess_type:process sigkill;
+
+# Allow reading process info (/proc/<pid>/...).
+# This is needed for getting CPU time and wall time spent on subprocesses.
+
+#line 143
+allow artd profman:dir { open getattr read search ioctl lock watch watch_reads };
+#line 143
+allow artd profman:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 143
+;
+
+#line 144
+allow artd dex2oat:dir { open getattr read search ioctl lock watch watch_reads };
+#line 144
+allow artd dex2oat:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 144
+;
+
+# Allow artd to reopen its own memfd.
+# artd needs to reopen a memfd with readonly in order to pass it to subprocesses
+# that don't have write permissions on memfds.
+allow artd artd_tmpfs:file open;
+
+# For Pre-reboot Dexopt.
+
+# Allow init to execute artd through art_exec.
+allow artd art_exec:fd use;
+
+# During Pre-reboot Dexopt, artd needs one more capability:
+# - "sys_admin" is for bind-mounting temp dirs at
+# /data/misc/apexdata/com.android.art and /data/misc/odrefresh, to run
+# odrefresh innocuously (in a way that doesn't affect the real boot images,
+# metrics, etc.).
+allow artd self:{ capability cap_userns } sys_admin;
+
+# Allow running other binaries in their own domains.
+
+#line 164
+# Allow the necessary permissions.
+#line 164
+
+#line 164
+# Old domain may exec the file and transition to the new domain.
+#line 164
+allow artd derive_classpath_exec:file { getattr open read execute map };
+#line 164
+allow artd derive_classpath:process transition;
+#line 164
+# New domain is entered by executing the file.
+#line 164
+allow derive_classpath derive_classpath_exec:file { entrypoint open read execute getattr map };
+#line 164
+# New domain can send SIGCHLD to its caller.
+#line 164
+allow derive_classpath artd:process sigchld;
+#line 164
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 164
+dontaudit artd derive_classpath:process noatsecure;
+#line 164
+# XXX dontaudit candidate but requires further study.
+#line 164
+allow artd derive_classpath:process { siginh rlimitinh };
+#line 164
+
+#line 164
+# Make the transition occur by default.
+#line 164
+type_transition artd derive_classpath_exec:process derive_classpath;
+#line 164
+
+
+#line 165
+# Allow the necessary permissions.
+#line 165
+
+#line 165
+# Old domain may exec the file and transition to the new domain.
+#line 165
+allow artd odrefresh_exec:file { getattr open read execute map };
+#line 165
+allow artd odrefresh:process transition;
+#line 165
+# New domain is entered by executing the file.
+#line 165
+allow odrefresh odrefresh_exec:file { entrypoint open read execute getattr map };
+#line 165
+# New domain can send SIGCHLD to its caller.
+#line 165
+allow odrefresh artd:process sigchld;
+#line 165
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 165
+dontaudit artd odrefresh:process noatsecure;
+#line 165
+# XXX dontaudit candidate but requires further study.
+#line 165
+allow artd odrefresh:process { siginh rlimitinh };
+#line 165
+
+#line 165
+# Make the transition occur by default.
+#line 165
+type_transition artd odrefresh_exec:process odrefresh;
+#line 165
+
+
+# Allow accessing Pre-reboot Dexopt files.
+allow artd pre_reboot_dexopt_file:dir { getattr search };
+
+# Allow reading /init.environ.rc in chroot, to extract env vars from it.
+allow artd rootfs:file { read open getattr };
+
+# Allow managing Pre-reboot Dexopt temp files.
+# The root of the temp dir that artd uses during Pre-reboot Dexopt is labeled
+# pre_reboot_dexopt_artd_file. Inside the temp dir, we create files and dirs and
+# relabel them after creation, so we need relabelfrom.
+allow artd pre_reboot_dexopt_artd_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow artd pre_reboot_dexopt_artd_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+
+# Allow bind-mounting at /data/misc/apexdata/com.android.art and
+# /data/misc/odrefresh and restorecon, to run odrefresh innocuously.
+allow artd { apex_art_data_file odrefresh_data_file }:dir relabelto;
+allow artd { apex_art_data_file odrefresh_data_file pre_reboot_dexopt_artd_file }:dir mounton;
+
+# Neverallow rules.
+
+# Never allow running other binaries without a domain transition.
+# The exception for art_exec_exec is explained above.
+neverallow artd ~{art_exec_exec}:file execute_no_trans;
+
+# Make sure artd_subprocess_type is complete, in a sense that it includes all
+# types of artd subprocesses.
+neverallow artd ~{artd_subprocess_type crash_dump}:process transition;
+
+# artd uses process groups to manage subprocesses and kill them. To ensure
+# successful kill, we need to prevent subprocesses from changing their
+# process groups or transitioning to other domains.
+# Transitioning crash_dump is allowed because it is transient and is only used
+# upon crashes.
+neverallow artd_subprocess_type self:process setpgid;
+neverallow artd_subprocess_type ~{artd_subprocess_type crash_dump}:process transition;
+#line 1 "system/sepolicy/private/asan_extract.te"
+# type_transition must be private policy the domain_trans rules could stay
+# public, but conceptually should go with this
+# Technically not a daemon but we do want the transition from init domain to
+# asan_extract to occur.
+#line 35
+
+#line 1 "system/sepolicy/private/atrace.te"
+# Domain for atrace process.
+# It is spawned either by traced_probes or by init for the boottrace service.
+
+type atrace_exec, exec_type, file_type, system_file_type;
+
+# boottrace services uses /data/misc/boottrace/categories
+allow atrace boottrace_data_file:dir search;
+allow atrace boottrace_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow atrace to access tracefs.
+allow atrace debugfs_tracing:dir { open getattr read search ioctl lock watch watch_reads };
+allow atrace debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow atrace debugfs_trace_marker:file getattr;
+
+# Allow atrace to write data when a pipe is used for stdout/stderr.
+# This is used by Perfetto to capture atrace stdout/stderr.
+allow atrace traced_probes:fd use;
+allow atrace traced_probes:fifo_file { getattr write };
+
+# atrace sets debug.atrace.* properties
+
+#line 21
+
+#line 21
+allow atrace property_socket:sock_file write;
+#line 21
+allow atrace init:unix_stream_socket connectto;
+#line 21
+
+#line 21
+allow atrace debug_prop:property_service set;
+#line 21
+
+#line 21
+allow atrace debug_prop:file { getattr open read map };
+#line 21
+
+#line 21
+
+
+# atrace pokes all the binder-enabled processes at startup with a
+# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
+
+# Allow discovery of binder services.
+allow atrace {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -dumpstate_service
+ -incident_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -stats_service
+ -tracingproxy_service
+ -vold_service
+ -default_android_service
+}:service_manager { find };
+allow atrace servicemanager:service_manager list;
+
+# Allow notifying the processes hosting specific binder services that
+# trace-related system properties have changed.
+
+#line 46
+# Call the servicemanager and transfer references to it.
+#line 46
+allow atrace servicemanager:binder { call transfer };
+#line 46
+# Allow servicemanager to send out callbacks
+#line 46
+allow servicemanager atrace:binder { call transfer };
+#line 46
+# servicemanager performs getpidcon on clients.
+#line 46
+allow servicemanager atrace:dir search;
+#line 46
+allow servicemanager atrace:file { read open };
+#line 46
+allow servicemanager atrace:process getattr;
+#line 46
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 46
+# all domains in domain.te.
+#line 46
+
+allow atrace surfaceflinger:binder call;
+allow atrace system_server:binder call;
+allow atrace cameraserver:binder call;
+
+# Similarly, on debug builds, allow specific HALs to be notified that
+# trace-related system properties have changed.
+#line 59
+
+
+# Remove logspam from notification attempts to non-allowlisted services.
+dontaudit atrace hwservice_manager_type:hwservice_manager find;
+dontaudit atrace service_manager_type:service_manager find;
+dontaudit atrace domain:binder call;
+
+# atrace can call atrace HAL
+
+#line 67
+typeattribute atrace halclientdomain;
+#line 67
+typeattribute atrace hal_atrace_client;
+#line 67
+
+#line 67
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 67
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 67
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 67
+
+#line 67
+typeattribute atrace hal_atrace;
+#line 67
+# Find passthrough HAL implementations
+#line 67
+allow hal_atrace system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 67
+allow hal_atrace vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 67
+allow hal_atrace vendor_file:file { read open getattr execute map };
+#line 67
+
+#line 67
+
+
+
+#line 69
+allow atrace hwservicemanager_prop:file { getattr open read map };
+#line 69
+
+
+#line 79
+
+
+dontaudit atrace debugfs_tracing_debug:file audit_access;
+#line 1 "system/sepolicy/private/audioserver.te"
+# audioserver - audio services daemon
+type audioserver_exec, exec_type, file_type, system_file_type;
+typeattribute audioserver coredomain;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init audioserver_exec:file { getattr open read execute map };
+#line 5
+allow init audioserver:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow audioserver audioserver_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init audioserver:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init audioserver:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init audioserver_exec:process audioserver;
+#line 5
+
+#line 5
+
+
+#line 6
+type_transition audioserver tmpfs:file audioserver_tmpfs;
+#line 6
+allow audioserver audioserver_tmpfs:file { read write getattr map };
+#line 6
+
+
+
+#line 8
+allow audioserver sdcard_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow audioserver sdcard_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 8
+
+
+#line 9
+allow audioserver fuse:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow audioserver fuse:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 9
+
+
+
+#line 11
+# Call the servicemanager and transfer references to it.
+#line 11
+allow audioserver servicemanager:binder { call transfer };
+#line 11
+# Allow servicemanager to send out callbacks
+#line 11
+allow servicemanager audioserver:binder { call transfer };
+#line 11
+# servicemanager performs getpidcon on clients.
+#line 11
+allow servicemanager audioserver:dir search;
+#line 11
+allow servicemanager audioserver:file { read open };
+#line 11
+allow servicemanager audioserver:process getattr;
+#line 11
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 11
+# all domains in domain.te.
+#line 11
+
+
+#line 12
+# Call the server domain and optionally transfer references to it.
+#line 12
+allow audioserver binderservicedomain:binder { call transfer };
+#line 12
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 12
+allow binderservicedomain audioserver:binder transfer;
+#line 12
+# Receive and use open files from the server.
+#line 12
+allow audioserver binderservicedomain:fd use;
+#line 12
+
+
+#line 13
+# Call the server domain and optionally transfer references to it.
+#line 13
+allow audioserver appdomain:binder { call transfer };
+#line 13
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 13
+allow appdomain audioserver:binder transfer;
+#line 13
+# Receive and use open files from the server.
+#line 13
+allow audioserver appdomain:fd use;
+#line 13
+
+
+#line 14
+typeattribute audioserver binderservicedomain;
+#line 14
+
+
+
+#line 16
+typeattribute audioserver halclientdomain;
+#line 16
+typeattribute audioserver hal_allocator_client;
+#line 16
+
+#line 16
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 16
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 16
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 16
+
+#line 16
+typeattribute audioserver hal_allocator;
+#line 16
+# Find passthrough HAL implementations
+#line 16
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 16
+
+#line 16
+
+# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
+
+#line 18
+allow audioserver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow audioserver system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+
+
+#line 20
+typeattribute audioserver halclientdomain;
+#line 20
+typeattribute audioserver hal_audio_client;
+#line 20
+
+#line 20
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 20
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 20
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 20
+
+#line 20
+typeattribute audioserver hal_audio;
+#line 20
+# Find passthrough HAL implementations
+#line 20
+allow hal_audio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_audio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_audio vendor_file:file { read open getattr execute map };
+#line 20
+
+#line 20
+
+
+#line 30
+
+
+
+#line 32
+ allow audioserver audioserver_service:service_manager { add find };
+#line 32
+ neverallow { domain -audioserver } audioserver_service:service_manager add;
+#line 32
+
+#line 32
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 32
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 32
+
+#line 32
+
+allow audioserver activity_service:service_manager find;
+allow audioserver appops_service:service_manager find;
+allow audioserver batterystats_service:service_manager find;
+allow audioserver external_vibrator_service:service_manager find;
+allow audioserver package_native_service:service_manager find;
+allow audioserver permission_service:service_manager find;
+allow audioserver permission_checker_service:service_manager find;
+allow audioserver power_service:service_manager find;
+allow audioserver scheduling_policy_service:service_manager find;
+allow audioserver mediametrics_service:service_manager find;
+allow audioserver sensor_privacy_service:service_manager find;
+allow audioserver soundtrigger_middleware_service:service_manager find;
+allow audioserver audio_service:service_manager find;
+allow audioserver virtual_device_native_service:service_manager find;
+
+# Allow read/write access to bluetooth-specific properties
+
+#line 49
+
+#line 49
+allow audioserver property_socket:sock_file write;
+#line 49
+allow audioserver init:unix_stream_socket connectto;
+#line 49
+
+#line 49
+allow audioserver bluetooth_a2dp_offload_prop:property_service set;
+#line 49
+
+#line 49
+allow audioserver bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 49
+
+#line 49
+
+
+#line 50
+
+#line 50
+allow audioserver property_socket:sock_file write;
+#line 50
+allow audioserver init:unix_stream_socket connectto;
+#line 50
+
+#line 50
+allow audioserver bluetooth_audio_hal_prop:property_service set;
+#line 50
+
+#line 50
+allow audioserver bluetooth_audio_hal_prop:file { getattr open read map };
+#line 50
+
+#line 50
+
+
+#line 51
+
+#line 51
+allow audioserver property_socket:sock_file write;
+#line 51
+allow audioserver init:unix_stream_socket connectto;
+#line 51
+
+#line 51
+allow audioserver bluetooth_prop:property_service set;
+#line 51
+
+#line 51
+allow audioserver bluetooth_prop:file { getattr open read map };
+#line 51
+
+#line 51
+
+
+#line 52
+
+#line 52
+allow audioserver property_socket:sock_file write;
+#line 52
+allow audioserver init:unix_stream_socket connectto;
+#line 52
+
+#line 52
+allow audioserver exported_bluetooth_prop:property_service set;
+#line 52
+
+#line 52
+allow audioserver exported_bluetooth_prop:file { getattr open read map };
+#line 52
+
+#line 52
+
+
+# Grant access to audio files to audioserver
+allow audioserver audio_data_file:dir { { open getattr read search ioctl lock watch watch_reads } add_name write };
+allow audioserver audio_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow access to ALSA MMAP FDs for AAudio API
+allow audioserver audio_device:chr_file { read write };
+
+allow audioserver audio_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow audioserver audio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# For A2DP bridge which is loaded directly into audioserver
+
+#line 65
+allow audioserver bluetooth_socket:sock_file write;
+#line 65
+allow audioserver bluetooth:unix_stream_socket connectto;
+#line 65
+
+
+# Allow shell commands from ADB and shell for CTS testing/dumping
+allow audioserver adbd:fd use;
+allow audioserver adbd:unix_stream_socket { read write };
+allow audioserver shell:fifo_file { read write };
+
+# Allow shell commands from ADB for CTS testing/dumping
+#line 77
+
+
+# Allow write access to log tag property
+
+#line 80
+
+#line 80
+allow audioserver property_socket:sock_file write;
+#line 80
+allow audioserver init:unix_stream_socket connectto;
+#line 80
+
+#line 80
+allow audioserver log_tag_prop:property_service set;
+#line 80
+
+#line 80
+allow audioserver log_tag_prop:file { getattr open read map };
+#line 80
+
+#line 80
+;
+
+# Allow audioserver to signal audio HAL processes and dump their stacks.
+allow audioserver hal_audio_server:process signal;
+
+# Allow audioserver to access sensorservice.
+allow audioserver sensorservice_service:service_manager find;
+allow audioserver system_server:unix_stream_socket { read write };
+
+# Allow using wake locks
+
+#line 90
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 90
+# deprecated.
+#line 90
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 90
+allow audioserver sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 90
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 90
+allow audioserver self:{ capability2 cap2_userns } block_suspend;
+#line 90
+# system_suspend permissions
+#line 90
+
+#line 90
+# Call the server domain and optionally transfer references to it.
+#line 90
+allow audioserver system_suspend_server:binder { call transfer };
+#line 90
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 90
+allow system_suspend_server audioserver:binder transfer;
+#line 90
+# Receive and use open files from the server.
+#line 90
+allow audioserver system_suspend_server:fd use;
+#line 90
+
+#line 90
+allow audioserver system_suspend_hwservice:hwservice_manager find;
+#line 90
+# halclientdomain permissions
+#line 90
+
+#line 90
+# Call the hwservicemanager and transfer references to it.
+#line 90
+allow audioserver hwservicemanager:binder { call transfer };
+#line 90
+# Allow hwservicemanager to send out callbacks
+#line 90
+allow hwservicemanager audioserver:binder { call transfer };
+#line 90
+# hwservicemanager performs getpidcon on clients.
+#line 90
+allow hwservicemanager audioserver:dir search;
+#line 90
+allow hwservicemanager audioserver:file { read open map };
+#line 90
+allow hwservicemanager audioserver:process getattr;
+#line 90
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 90
+# all domains in domain.te.
+#line 90
+
+#line 90
+
+#line 90
+allow audioserver hwservicemanager_prop:file { getattr open read map };
+#line 90
+
+#line 90
+allow audioserver hidl_manager_hwservice:hwservice_manager find;
+#line 90
+# AIDL suspend hal permissions
+#line 90
+allow audioserver hal_system_suspend_service:service_manager find;
+#line 90
+
+#line 90
+# Call the servicemanager and transfer references to it.
+#line 90
+allow audioserver servicemanager:binder { call transfer };
+#line 90
+# Allow servicemanager to send out callbacks
+#line 90
+allow servicemanager audioserver:binder { call transfer };
+#line 90
+# servicemanager performs getpidcon on clients.
+#line 90
+allow servicemanager audioserver:dir search;
+#line 90
+allow servicemanager audioserver:file { read open };
+#line 90
+allow servicemanager audioserver:process getattr;
+#line 90
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 90
+# all domains in domain.te.
+#line 90
+
+#line 90
+
+
+# Allow reading audio config props, e.g. af.fast_track_multiplier
+
+#line 93
+allow audioserver audio_config_prop:file { getattr open read map };
+#line 93
+
+
+#line 94
+allow audioserver system_audio_config_prop:file { getattr open read map };
+#line 94
+
+
+###
+### neverallow rules
+###
+
+# audioserver should never execute any executable without a
+# domain transition
+neverallow audioserver { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow audioserver domain:{ udp_socket rawip_socket } *;
+neverallow audioserver { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/auditctl.te"
+#
+# /system/bin/auditctl executed for logd
+#
+# Performs maintenance of the kernel auditing system, including
+# setting rate limits on SELinux denials.
+#
+
+type auditctl, domain, coredomain;
+type auditctl_exec, file_type, system_file_type, exec_type;
+
+# Uncomment the line below to put this domain into permissive
+# mode. This helps speed SELinux policy development.
+# userdebug_or_eng(`permissive auditctl;')
+
+
+#line 15
+
+#line 15
+# Allow the necessary permissions.
+#line 15
+
+#line 15
+# Old domain may exec the file and transition to the new domain.
+#line 15
+allow init auditctl_exec:file { getattr open read execute map };
+#line 15
+allow init auditctl:process transition;
+#line 15
+# New domain is entered by executing the file.
+#line 15
+allow auditctl auditctl_exec:file { entrypoint open read execute getattr map };
+#line 15
+# New domain can send SIGCHLD to its caller.
+#line 15
+
+#line 15
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 15
+dontaudit init auditctl:process noatsecure;
+#line 15
+# XXX dontaudit candidate but requires further study.
+#line 15
+allow init auditctl:process { siginh rlimitinh };
+#line 15
+
+#line 15
+# Make the transition occur by default.
+#line 15
+type_transition init auditctl_exec:process auditctl;
+#line 15
+
+#line 15
+
+
+allow auditctl self:{ capability cap_userns } audit_control;
+allow auditctl self:netlink_audit_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_write };
+#line 1 "system/sepolicy/private/automotive_display_service.te"
+# Display proxy service for Automotive
+type automotive_display_service, domain, coredomain;
+type automotive_display_service_exec, system_file_type, exec_type, file_type;
+
+typeattribute automotive_display_service automotive_display_service_server;
+
+# Allow to add a display service to the hwservicemanager
+
+#line 8
+ allow automotive_display_service fwk_automotive_display_hwservice:hwservice_manager { add find };
+#line 8
+ allow automotive_display_service hidl_base_hwservice:hwservice_manager add;
+#line 8
+ neverallow { domain -automotive_display_service } fwk_automotive_display_hwservice:hwservice_manager add;
+#line 8
+;
+
+# Allow init to launch automotive display service
+
+#line 11
+
+#line 11
+# Allow the necessary permissions.
+#line 11
+
+#line 11
+# Old domain may exec the file and transition to the new domain.
+#line 11
+allow init automotive_display_service_exec:file { getattr open read execute map };
+#line 11
+allow init automotive_display_service:process transition;
+#line 11
+# New domain is entered by executing the file.
+#line 11
+allow automotive_display_service automotive_display_service_exec:file { entrypoint open read execute getattr map };
+#line 11
+# New domain can send SIGCHLD to its caller.
+#line 11
+
+#line 11
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 11
+dontaudit init automotive_display_service:process noatsecure;
+#line 11
+# XXX dontaudit candidate but requires further study.
+#line 11
+allow init automotive_display_service:process { siginh rlimitinh };
+#line 11
+
+#line 11
+# Make the transition occur by default.
+#line 11
+type_transition init automotive_display_service_exec:process automotive_display_service;
+#line 11
+
+#line 11
+
+
+# Allow to use Binder IPC for SurfaceFlinger.
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow automotive_display_service servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager automotive_display_service:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager automotive_display_service:dir search;
+#line 14
+allow servicemanager automotive_display_service:file { read open };
+#line 14
+allow servicemanager automotive_display_service:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+# Allow to use HwBinder IPC for HAL implementations.
+
+#line 17
+# Call the hwservicemanager and transfer references to it.
+#line 17
+allow automotive_display_service hwservicemanager:binder { call transfer };
+#line 17
+# Allow hwservicemanager to send out callbacks
+#line 17
+allow hwservicemanager automotive_display_service:binder { call transfer };
+#line 17
+# hwservicemanager performs getpidcon on clients.
+#line 17
+allow hwservicemanager automotive_display_service:dir search;
+#line 17
+allow hwservicemanager automotive_display_service:file { read open map };
+#line 17
+allow hwservicemanager automotive_display_service:process getattr;
+#line 17
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 17
+# all domains in domain.te.
+#line 17
+
+
+#line 18
+typeattribute automotive_display_service halclientdomain;
+#line 18
+typeattribute automotive_display_service hal_graphics_composer_client;
+#line 18
+
+#line 18
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 18
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 18
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 18
+
+#line 18
+typeattribute automotive_display_service hal_graphics_composer;
+#line 18
+# Find passthrough HAL implementations
+#line 18
+allow hal_graphics_composer system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_graphics_composer vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_graphics_composer vendor_file:file { read open getattr execute map };
+#line 18
+
+#line 18
+
+
+#line 19
+typeattribute automotive_display_service halclientdomain;
+#line 19
+typeattribute automotive_display_service hal_graphics_allocator_client;
+#line 19
+
+#line 19
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 19
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 19
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 19
+
+#line 19
+typeattribute automotive_display_service hal_graphics_allocator;
+#line 19
+# Find passthrough HAL implementations
+#line 19
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 19
+
+#line 19
+
+
+# Allow to read the target property.
+
+#line 22
+allow automotive_display_service hwservicemanager_prop:file { getattr open read map };
+#line 22
+
+
+# Allow to find SurfaceFlinger.
+allow automotive_display_service surfaceflinger_service:service_manager find;
+
+# Allow client domain to do binder IPC to serverdomain.
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow automotive_display_service surfaceflinger:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow surfaceflinger automotive_display_service:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow automotive_display_service surfaceflinger:fd use;
+#line 28
+
+
+# Allow to use a graphics mapper
+allow automotive_display_service hal_graphics_mapper_hwservice:hwservice_manager find;
+
+# Allow to use hidl token service
+allow automotive_display_service hidl_token_hwservice:hwservice_manager find;
+
+# Allow to access EGL files
+allow automotive_display_service gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow automotive_display_service gpu_device:dir search;
+
+# Allow to add a service to the servicemanager
+
+#line 41
+ allow automotive_display_service fwk_automotive_display_service:service_manager { add find };
+#line 41
+ neverallow { domain -automotive_display_service } fwk_automotive_display_service:service_manager add;
+#line 41
+
+#line 41
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 41
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 41
+
+#line 41
+;
+
+# Allow to communicate with EVS services
+
+#line 44
+# Call the server domain and optionally transfer references to it.
+#line 44
+allow automotive_display_service hal_evs:binder { call transfer };
+#line 44
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 44
+allow hal_evs automotive_display_service:binder transfer;
+#line 44
+# Receive and use open files from the server.
+#line 44
+allow automotive_display_service hal_evs:fd use;
+#line 44
+
+#line 1 "system/sepolicy/private/bert_collector.te"
+type bert_collector, domain, coredomain;
+type bert_collector_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init bert_collector_exec:file { getattr open read execute map };
+#line 4
+allow init bert_collector:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow bert_collector bert_collector_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init bert_collector:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init bert_collector:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init bert_collector_exec:process bert_collector;
+#line 4
+
+#line 4
+
+
+
+#line 6
+allow bert_collector sysfs_firmware_acpi_tables:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow bert_collector sysfs_firmware_acpi_tables:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow bert_collector servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager bert_collector:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager bert_collector:dir search;
+#line 8
+allow servicemanager bert_collector:file { read open };
+#line 8
+allow servicemanager bert_collector:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow bert_collector system_server:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow system_server bert_collector:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow bert_collector system_server:fd use;
+#line 9
+
+
+allow bert_collector dropbox_service:service_manager find;
+allow bert_collector proc_version:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/binderservicedomain.te"
+# Rules common to some specific binder service domains.
+# Deprecated. Consider granting the exact permissions required by your service.
+
+# Allow dumpstate and incidentd to collect information from binder services
+allow binderservicedomain { dumpstate incidentd }:fd use;
+allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
+allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write };
+allow binderservicedomain shell_data_file:file { getattr write };
+
+# Allow dumpsys to work from adb shell or the serial console
+allow binderservicedomain devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow binderservicedomain console_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Receive and write to a pipe received over Binder from an app.
+allow binderservicedomain appdomain:fd use;
+allow binderservicedomain appdomain:fifo_file write;
+
+# allow all services to run permission checks
+allow binderservicedomain permission_service:service_manager find;
+
+allow binderservicedomain keystore:keystore2_key { delete get_info rebind use };
+
+
+#line 23
+ allow keystore binderservicedomain:dir search;
+#line 23
+ allow keystore binderservicedomain:file { read open };
+#line 23
+ allow keystore binderservicedomain:process getattr;
+#line 23
+ allow binderservicedomain apc_service:service_manager find;
+#line 23
+ allow binderservicedomain keystore_service:service_manager find;
+#line 23
+ allow binderservicedomain legacykeystore_service:service_manager find;
+#line 23
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow binderservicedomain keystore:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow keystore binderservicedomain:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow binderservicedomain keystore:fd use;
+#line 23
+
+#line 23
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow keystore binderservicedomain:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow binderservicedomain keystore:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow keystore binderservicedomain:fd use;
+#line 23
+
+#line 23
+
+# binderservicedomain is using apex_info via libvintf
+
+#line 25
+ allow binderservicedomain apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+ allow binderservicedomain apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 25
+
+#line 25
+allow binderservicedomain vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow binderservicedomain vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 25
+
+#line 25
+
+#line 1 "system/sepolicy/private/blank_screen.te"
+type blank_screen, domain, coredomain;
+type blank_screen_exec, exec_type, file_type, system_file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init blank_screen_exec:file { getattr open read execute map };
+#line 4
+allow init blank_screen:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow blank_screen blank_screen_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init blank_screen:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init blank_screen:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init blank_screen_exec:process blank_screen;
+#line 4
+
+#line 4
+
+
+# hal_light_client has access to hal_light_server
+
+#line 7
+typeattribute blank_screen halclientdomain;
+#line 7
+typeattribute blank_screen hal_light_client;
+#line 7
+
+#line 7
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 7
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 7
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 7
+
+#line 7
+typeattribute blank_screen hal_light;
+#line 7
+# Find passthrough HAL implementations
+#line 7
+allow hal_light system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 7
+allow hal_light vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 7
+allow hal_light vendor_file:file { read open getattr execute map };
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/blkid.te"
+# blkid called from vold
+
+typeattribute blkid coredomain;
+
+type blkid_exec, system_file_type, exec_type, file_type;
+
+# Allowed read-only access to encrypted devices to extract UUID/label
+allow blkid block_device:dir search;
+allow blkid userdata_block_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+allow blkid dm_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow stdin/out back to vold
+allow blkid vold:fd use;
+allow blkid vold:fifo_file { read write getattr };
+
+# For blkid launched through popen()
+allow blkid blkid_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Only allow entry from vold
+neverallow { domain -vold } blkid:process transition;
+neverallow * blkid:process dyntransition;
+neverallow blkid { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
+#line 1 "system/sepolicy/private/blkid_untrusted.te"
+# blkid for untrusted block devices
+
+typeattribute blkid_untrusted coredomain;
+
+# Allowed read-only access to vold block devices to extract UUID/label
+allow blkid_untrusted block_device:dir search;
+allow blkid_untrusted vold_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow stdin/out back to vold
+allow blkid_untrusted vold:fd use;
+allow blkid_untrusted vold:fifo_file { read write getattr };
+
+# For blkid launched through popen()
+allow blkid_untrusted blkid_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+###
+### neverallow rules
+###
+
+# Untrusted blkid should never be run on block devices holding sensitive data
+neverallow blkid_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only allow entry from vold via blkid binary
+neverallow { domain -vold } blkid_untrusted:process transition;
+neverallow * blkid_untrusted:process dyntransition;
+neverallow blkid_untrusted { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
+#line 1 "system/sepolicy/private/bluetooth.te"
+# bluetooth app
+
+typeattribute bluetooth coredomain, mlstrustedsubject;
+
+
+#line 5
+typeattribute bluetooth appdomain;
+#line 5
+# Label tmpfs objects for all apps.
+#line 5
+type_transition bluetooth tmpfs:file appdomain_tmpfs;
+#line 5
+
+#line 5
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 5
+type bluetooth_userfaultfd;
+#line 5
+type_transition bluetooth bluetooth:anon_inode bluetooth_userfaultfd "[userfaultfd]";
+#line 5
+# Allow domain to create/use userfaultfd anon_inode.
+#line 5
+allow bluetooth bluetooth_userfaultfd:anon_inode { create ioctl read };
+#line 5
+# Suppress errors generate during bugreport
+#line 5
+dontaudit su bluetooth_userfaultfd:anon_inode *;
+#line 5
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 5
+neverallow { domain -bluetooth } bluetooth_userfaultfd:anon_inode *;
+#line 5
+
+#line 5
+allow bluetooth appdomain_tmpfs:file { execute getattr map read write };
+#line 5
+neverallow { bluetooth -runas_app -shell -simpleperf } { domain -bluetooth }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 5
+neverallow { appdomain -runas_app -shell -simpleperf -bluetooth } bluetooth:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 5
+# The Android security model guarantees the confidentiality and integrity
+#line 5
+# of application data and execution state. Ptrace bypasses those
+#line 5
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 5
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 5
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 5
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 5
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 5
+# live lock conditions.
+#line 5
+neverallow { domain -bluetooth -crash_dump -runas_app -simpleperf } bluetooth:process ptrace;
+#line 5
+
+
+#line 6
+typeattribute bluetooth netdomain;
+#line 6
+
+
+# Socket creation under /data/misc/bluedroid.
+type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
+
+# Allow access to net_admin ioctls
+allowxperm bluetooth self:udp_socket ioctl
+#line 12
+{
+#line 12
+# qualcomm rmnet ioctls
+#line 12
+0x00006900 0x00006902
+#line 12
+# socket ioctls
+#line 12
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 12
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 12
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 12
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 12
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 12
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 12
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 12
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 12
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 12
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 12
+# device and protocol specific ioctls
+#line 12
+0x000089f0-0x000089ff
+#line 12
+0x000089e0-0x000089ef
+#line 12
+# Wireless extension ioctls
+#line 12
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 12
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 12
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 12
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 12
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 12
+0x00008b34 0x00008b35 0x00008b36
+#line 12
+# Dev private ioctl i.e. hardware specific ioctls
+#line 12
+0x00008be0-0x00008bff
+#line 12
+};
+
+
+#line 14
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 14
+# deprecated.
+#line 14
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 14
+allow bluetooth sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 14
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 14
+allow bluetooth self:{ capability2 cap2_userns } block_suspend;
+#line 14
+# system_suspend permissions
+#line 14
+
+#line 14
+# Call the server domain and optionally transfer references to it.
+#line 14
+allow bluetooth system_suspend_server:binder { call transfer };
+#line 14
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 14
+allow system_suspend_server bluetooth:binder transfer;
+#line 14
+# Receive and use open files from the server.
+#line 14
+allow bluetooth system_suspend_server:fd use;
+#line 14
+
+#line 14
+allow bluetooth system_suspend_hwservice:hwservice_manager find;
+#line 14
+# halclientdomain permissions
+#line 14
+
+#line 14
+# Call the hwservicemanager and transfer references to it.
+#line 14
+allow bluetooth hwservicemanager:binder { call transfer };
+#line 14
+# Allow hwservicemanager to send out callbacks
+#line 14
+allow hwservicemanager bluetooth:binder { call transfer };
+#line 14
+# hwservicemanager performs getpidcon on clients.
+#line 14
+allow hwservicemanager bluetooth:dir search;
+#line 14
+allow hwservicemanager bluetooth:file { read open map };
+#line 14
+allow hwservicemanager bluetooth:process getattr;
+#line 14
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+#line 14
+
+#line 14
+allow bluetooth hwservicemanager_prop:file { getattr open read map };
+#line 14
+
+#line 14
+allow bluetooth hidl_manager_hwservice:hwservice_manager find;
+#line 14
+# AIDL suspend hal permissions
+#line 14
+allow bluetooth hal_system_suspend_service:service_manager find;
+#line 14
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow bluetooth servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager bluetooth:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager bluetooth:dir search;
+#line 14
+allow servicemanager bluetooth:file { read open };
+#line 14
+allow servicemanager bluetooth:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+#line 14
+;
+
+# Data file accesses.
+allow bluetooth bluetooth_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow bluetooth bluetooth_data_file:{ file lnk_file sock_file fifo_file } { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } link };
+allow bluetooth bluetooth_logs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow bluetooth bluetooth_logs_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Socket creation under /data/misc/bluedroid.
+allow bluetooth bluetooth_socket:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow bluetooth self:{ capability cap_userns } net_admin;
+allow bluetooth self:{ capability2 cap2_userns } wake_alarm;
+
+# tethering
+allow bluetooth self:packet_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow bluetooth self:{ capability cap_userns } { net_admin net_raw net_bind_service };
+allow bluetooth self:tun_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow bluetooth tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm bluetooth tun_device:chr_file ioctl { 0x800454d2 0x400454ca };
+allow bluetooth efs_file:dir search;
+
+# allow Bluetooth to access uhid device for HID profile
+allow bluetooth uhid_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow bluetooth gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow bluetooth gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# For Bluetooth to check what profile are available
+allow bluetooth proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 47
+allow bluetooth incremental_prop:file { getattr open read map };
+#line 47
+
+
+# For Bluetooth to check security logging state
+
+#line 50
+allow bluetooth device_logging_prop:file { getattr open read map };
+#line 50
+
+
+# Allow write access to bluetooth specific properties
+
+#line 53
+
+#line 53
+allow bluetooth property_socket:sock_file write;
+#line 53
+allow bluetooth init:unix_stream_socket connectto;
+#line 53
+
+#line 53
+allow bluetooth binder_cache_bluetooth_server_prop:property_service set;
+#line 53
+
+#line 53
+allow bluetooth binder_cache_bluetooth_server_prop:file { getattr open read map };
+#line 53
+
+#line 53
+;
+neverallow { domain -bluetooth -init }
+ binder_cache_bluetooth_server_prop:property_service set;
+
+#line 56
+
+#line 56
+allow bluetooth property_socket:sock_file write;
+#line 56
+allow bluetooth init:unix_stream_socket connectto;
+#line 56
+
+#line 56
+allow bluetooth bluetooth_a2dp_offload_prop:property_service set;
+#line 56
+
+#line 56
+allow bluetooth bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 56
+
+#line 56
+
+
+#line 57
+
+#line 57
+allow bluetooth property_socket:sock_file write;
+#line 57
+allow bluetooth init:unix_stream_socket connectto;
+#line 57
+
+#line 57
+allow bluetooth bluetooth_audio_hal_prop:property_service set;
+#line 57
+
+#line 57
+allow bluetooth bluetooth_audio_hal_prop:file { getattr open read map };
+#line 57
+
+#line 57
+
+
+#line 58
+
+#line 58
+allow bluetooth property_socket:sock_file write;
+#line 58
+allow bluetooth init:unix_stream_socket connectto;
+#line 58
+
+#line 58
+allow bluetooth bluetooth_prop:property_service set;
+#line 58
+
+#line 58
+allow bluetooth bluetooth_prop:file { getattr open read map };
+#line 58
+
+#line 58
+
+
+#line 59
+
+#line 59
+allow bluetooth property_socket:sock_file write;
+#line 59
+allow bluetooth init:unix_stream_socket connectto;
+#line 59
+
+#line 59
+allow bluetooth exported_bluetooth_prop:property_service set;
+#line 59
+
+#line 59
+allow bluetooth exported_bluetooth_prop:file { getattr open read map };
+#line 59
+
+#line 59
+
+
+#line 60
+
+#line 60
+allow bluetooth property_socket:sock_file write;
+#line 60
+allow bluetooth init:unix_stream_socket connectto;
+#line 60
+
+#line 60
+allow bluetooth pan_result_prop:property_service set;
+#line 60
+
+#line 60
+allow bluetooth pan_result_prop:file { getattr open read map };
+#line 60
+
+#line 60
+
+
+allow bluetooth audioserver_service:service_manager find;
+allow bluetooth bluetooth_service:service_manager find;
+allow bluetooth drmserver_service:service_manager find;
+allow bluetooth mediaserver_service:service_manager find;
+allow bluetooth radio_service:service_manager find;
+allow bluetooth app_api_service:service_manager find;
+allow bluetooth system_api_service:service_manager find;
+allow bluetooth network_stack_service:service_manager find;
+allow bluetooth system_suspend_control_service:service_manager find;
+allow bluetooth hal_audio_service:service_manager find;
+
+# already open bugreport file descriptors may be shared with
+# the bluetooth process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow bluetooth shell_data_file:file read;
+
+# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
+allow bluetooth self:{ capability cap_userns } sys_nice;
+
+
+#line 81
+typeattribute bluetooth halclientdomain;
+#line 81
+typeattribute bluetooth hal_bluetooth_client;
+#line 81
+
+#line 81
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 81
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 81
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 81
+
+#line 81
+typeattribute bluetooth hal_bluetooth;
+#line 81
+# Find passthrough HAL implementations
+#line 81
+allow hal_bluetooth system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 81
+allow hal_bluetooth vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 81
+allow hal_bluetooth vendor_file:file { read open getattr execute map };
+#line 81
+
+#line 81
+
+
+#line 82
+typeattribute bluetooth halclientdomain;
+#line 82
+typeattribute bluetooth hal_telephony_client;
+#line 82
+
+#line 82
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 82
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 82
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 82
+
+#line 82
+typeattribute bluetooth hal_telephony;
+#line 82
+# Find passthrough HAL implementations
+#line 82
+allow hal_telephony system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 82
+allow hal_telephony vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 82
+allow hal_telephony vendor_file:file { read open getattr execute map };
+#line 82
+
+#line 82
+
+
+# Bluetooth A2DP offload requires binding with audio HAL
+
+#line 85
+typeattribute bluetooth halclientdomain;
+#line 85
+typeattribute bluetooth hal_audio_client;
+#line 85
+
+#line 85
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 85
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 85
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 85
+
+#line 85
+typeattribute bluetooth hal_audio;
+#line 85
+# Find passthrough HAL implementations
+#line 85
+allow hal_audio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 85
+allow hal_audio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 85
+allow hal_audio vendor_file:file { read open getattr execute map };
+#line 85
+
+#line 85
+
+
+
+#line 87
+allow bluetooth runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 87
+
+
+###
+### Neverallow rules
+###
+### These are things that the bluetooth app should NEVER be able to do
+###
+
+# Superuser capabilities.
+# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
+neverallow bluetooth self:{ capability cap_userns } ~{ net_admin net_raw net_bind_service sys_nice};
+neverallow bluetooth self:{ capability2 cap2_userns } ~{ wake_alarm block_suspend };
+#line 1 "system/sepolicy/private/bluetoothdomain.te"
+# Allow clients to use a socket provided by the bluetooth app.
+allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };
+#line 1 "system/sepolicy/private/bootanim.te"
+typeattribute bootanim coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init bootanim_exec:file { getattr open read execute map };
+#line 3
+allow init bootanim:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow bootanim bootanim_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init bootanim:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init bootanim:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init bootanim_exec:process bootanim;
+#line 3
+
+#line 3
+
+
+# b/68864350
+dontaudit bootanim unlabeled:dir search;
+
+# Bootanim should not be reading default vendor-defined properties.
+dontaudit bootanim vendor_default_prop:file read;
+
+# Read ro.boot.bootreason b/30654343
+
+#line 12
+allow bootanim bootloader_boot_reason_prop:file { getattr open read map };
+#line 12
+
+
+
+#line 14
+allow bootanim bootanim_config_prop:file { getattr open read map };
+#line 14
+
+
+# Allow updating boot animation status.
+
+#line 17
+
+#line 17
+allow bootanim property_socket:sock_file write;
+#line 17
+allow bootanim init:unix_stream_socket connectto;
+#line 17
+
+#line 17
+allow bootanim bootanim_system_prop:property_service set;
+#line 17
+
+#line 17
+allow bootanim bootanim_system_prop:file { getattr open read map };
+#line 17
+
+#line 17
+
+
+# Allow accessing /data/misc/bootanim
+
+#line 20
+allow bootanim bootanim_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow bootanim bootanim_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+
+# Allow accessing vendor apex for EGL/GLES
+allow bootanim vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 25
+typeattribute bootanim halclientdomain;
+#line 25
+typeattribute bootanim hal_configstore_client;
+#line 25
+
+#line 25
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 25
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 25
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 25
+
+#line 25
+typeattribute bootanim hal_configstore;
+#line 25
+# Find passthrough HAL implementations
+#line 25
+allow hal_configstore system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_configstore vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_configstore vendor_file:file { read open getattr execute map };
+#line 25
+
+#line 25
+
+
+#line 26
+typeattribute bootanim halclientdomain;
+#line 26
+typeattribute bootanim hal_graphics_allocator_client;
+#line 26
+
+#line 26
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 26
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 26
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 26
+
+#line 26
+typeattribute bootanim hal_graphics_allocator;
+#line 26
+# Find passthrough HAL implementations
+#line 26
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 26
+
+#line 26
+
+
+#line 27
+typeattribute bootanim halclientdomain;
+#line 27
+typeattribute bootanim hal_graphics_composer_client;
+#line 27
+
+#line 27
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 27
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 27
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 27
+
+#line 27
+typeattribute bootanim hal_graphics_composer;
+#line 27
+# Find passthrough HAL implementations
+#line 27
+allow hal_graphics_composer system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 27
+allow hal_graphics_composer vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 27
+allow hal_graphics_composer vendor_file:file { read open getattr execute map };
+#line 27
+
+#line 27
+
+
+
+#line 29
+# Call the servicemanager and transfer references to it.
+#line 29
+allow bootanim servicemanager:binder { call transfer };
+#line 29
+# Allow servicemanager to send out callbacks
+#line 29
+allow servicemanager bootanim:binder { call transfer };
+#line 29
+# servicemanager performs getpidcon on clients.
+#line 29
+allow servicemanager bootanim:dir search;
+#line 29
+allow servicemanager bootanim:file { read open };
+#line 29
+allow servicemanager bootanim:process getattr;
+#line 29
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 29
+# all domains in domain.te.
+#line 29
+
+
+#line 30
+# Call the server domain and optionally transfer references to it.
+#line 30
+allow bootanim surfaceflinger:binder { call transfer };
+#line 30
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 30
+allow surfaceflinger bootanim:binder transfer;
+#line 30
+# Receive and use open files from the server.
+#line 30
+allow bootanim surfaceflinger:fd use;
+#line 30
+
+
+#line 31
+# Call the server domain and optionally transfer references to it.
+#line 31
+allow bootanim audioserver:binder { call transfer };
+#line 31
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 31
+allow audioserver bootanim:binder transfer;
+#line 31
+# Receive and use open files from the server.
+#line 31
+allow bootanim audioserver:fd use;
+#line 31
+
+
+
+#line 33
+# Call the hwservicemanager and transfer references to it.
+#line 33
+allow bootanim hwservicemanager:binder { call transfer };
+#line 33
+# Allow hwservicemanager to send out callbacks
+#line 33
+allow hwservicemanager bootanim:binder { call transfer };
+#line 33
+# hwservicemanager performs getpidcon on clients.
+#line 33
+allow hwservicemanager bootanim:dir search;
+#line 33
+allow hwservicemanager bootanim:file { read open map };
+#line 33
+allow hwservicemanager bootanim:process getattr;
+#line 33
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 33
+# all domains in domain.te.
+#line 33
+
+
+allow bootanim gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow bootanim gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow bootanim sysfs_gpu:file { getattr open read ioctl lock map watch watch_reads };
+
+# /oem access
+allow bootanim oemfs:dir { open getattr read search ioctl lock watch watch_reads };
+# boot animations on oem are stored with specific label
+allow bootanim bootanim_oem_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow bootanim audio_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow bootanim audio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow bootanim audioserver_service:service_manager find;
+allow bootanim surfaceflinger_service:service_manager find;
+allow bootanim surfaceflinger:unix_stream_socket { read write };
+
+# Allow access to ion memory allocation device
+allow bootanim ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow access to DMA-BUF system heap
+allow bootanim dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+allow bootanim hal_graphics_allocator:fd use;
+
+# Fences
+allow bootanim hal_graphics_composer:fd use;
+
+# Read access to pseudo filesystems.
+allow bootanim proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# System file accesses.
+allow bootanim system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow bootanim to send information to statsd socket.
+
+#line 69
+allow bootanim statsdw_socket:sock_file write;
+#line 69
+allow bootanim statsd:unix_dgram_socket sendto;
+#line 1 "system/sepolicy/private/bootstat.te"
+typeattribute bootstat coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init bootstat_exec:file { getattr open read execute map };
+#line 3
+allow init bootstat:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow bootstat bootstat_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init bootstat:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init bootstat:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init bootstat_exec:process bootstat;
+#line 3
+
+#line 3
+
+
+# Collect metrics on boot time created by init
+
+#line 6
+allow bootstat boottime_prop:file { getattr open read map };
+#line 6
+
+
+# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty)
+
+#line 9
+
+#line 9
+allow bootstat property_socket:sock_file write;
+#line 9
+allow bootstat init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow bootstat bootloader_boot_reason_prop:property_service set;
+#line 9
+
+#line 9
+allow bootstat bootloader_boot_reason_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+allow bootstat property_socket:sock_file write;
+#line 10
+allow bootstat init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow bootstat system_boot_reason_prop:property_service set;
+#line 10
+
+#line 10
+allow bootstat system_boot_reason_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+allow bootstat property_socket:sock_file write;
+#line 11
+allow bootstat init:unix_stream_socket connectto;
+#line 11
+
+#line 11
+allow bootstat last_boot_reason_prop:property_service set;
+#line 11
+
+#line 11
+allow bootstat last_boot_reason_prop:file { getattr open read map };
+#line 11
+
+#line 11
+
+
+
+#line 13
+allow bootstat runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 13
+
+
+# Allow persistent storage in /data/misc/bootstat.
+allow bootstat bootstat_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow bootstat bootstat_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow bootstat metadata_file:dir search;
+allow bootstat metadata_bootstat_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow bootstat metadata_bootstat_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# ToDo: TBI move access for the following to a system health HAL
+
+# Allow access to /sys/fs/pstore/ and syslog
+allow bootstat pstorefs:dir search;
+allow bootstat pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+allow bootstat kernel:system syslog_read;
+
+# Allow access to reading the logs to read aspects of system health
+
+#line 31
+allow bootstat logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 31
+
+#line 31
+allow bootstat logdr_socket:sock_file write;
+#line 31
+allow bootstat logd:unix_stream_socket connectto;
+#line 31
+
+#line 31
+
+
+# Allow bootstat write to statsd.
+
+#line 34
+allow bootstat statsdw_socket:sock_file write;
+#line 34
+allow bootstat statsd:unix_dgram_socket sendto;
+#line 34
+
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -bootstat
+ -init
+} system_boot_reason_prop:property_service set;
+
+neverallow {
+ domain
+ -bootanim
+ -bootstat
+ -dumpstate
+
+ -init
+ -platform_app
+ -recovery
+ -shell
+ -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:file { getattr open read ioctl lock map watch watch_reads };
+# ... and refine, as these components should not set the last boot reason
+neverallow { bootanim recovery } last_boot_reason_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+neverallow {
+ domain
+ -bootstat
+ -init
+ -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set;
+# ... and refine ... for a ro propertly no less ... keep this _tight_
+neverallow system_server bootloader_boot_reason_prop:property_service set;
+#line 1 "system/sepolicy/private/boringssl_self_test.te"
+# System and vendor domains for BoringSSL self test binaries.
+#
+# For FIPS compliance, all processes linked against libcrypto perform a startup
+# self test which computes a hash of the BoringSSL Crypto Module (BCM) and, at least once
+# per device boot, also run a series of Known Answer Tests (KAT) to verify functionality.
+#
+# The KATs are expensive, and to ensure they are run as few times as possible, they
+# are skipped if a marker file exists in /dev/boringssl/selftest whose name is
+# the hash of the BCM that was computed earlier. The files are zero length and their contents
+# should never be read or written. To avoid giving arbitrary processes access to /dev/boringssl
+# to create these marker files, there are dedicated self test binaries which this policy
+# gives access to and which are run during early-init.
+#
+# Due to build skew, the version of libcrypto in /vendor may have a different hash than
+# the system one. To cater for this there are vendor variants of the self test binaries
+# which also have permission to write to the same files in /dev/boringssl. In the case where
+# vendor and system libcrypto have the same hash, there will be a race to create the file,
+# but this is harmless.
+#
+# If the self tests fail, then the device should reboot into firmware and for this reason
+# the system boringssl_self_test domain needs to be in coredomain. As vendor domains
+# are not allowed in coredomain, this means that the vendor self tests cannot trigger a
+# reboot. However every binary linked against the vendor libcrypto will abort on startup,
+# so in practice the device will crash anyway in this unlikely scenario.
+
+# System boringssl_self_test domain
+type boringssl_self_test, domain, coredomain;
+type boringssl_self_test_exec, system_file_type, exec_type, file_type;
+
+# Vendor boringssl_self_test domain
+type vendor_boringssl_self_test, domain;
+type vendor_boringssl_self_test_exec, vendor_file_type, exec_type, file_type;
+
+# Switch to boringssl_self_test security domain when running boringssl_self_test_exec
+
+#line 35
+
+#line 35
+# Allow the necessary permissions.
+#line 35
+
+#line 35
+# Old domain may exec the file and transition to the new domain.
+#line 35
+allow init boringssl_self_test_exec:file { getattr open read execute map };
+#line 35
+allow init boringssl_self_test:process transition;
+#line 35
+# New domain is entered by executing the file.
+#line 35
+allow boringssl_self_test boringssl_self_test_exec:file { entrypoint open read execute getattr map };
+#line 35
+# New domain can send SIGCHLD to its caller.
+#line 35
+
+#line 35
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 35
+dontaudit init boringssl_self_test:process noatsecure;
+#line 35
+# XXX dontaudit candidate but requires further study.
+#line 35
+allow init boringssl_self_test:process { siginh rlimitinh };
+#line 35
+
+#line 35
+# Make the transition occur by default.
+#line 35
+type_transition init boringssl_self_test_exec:process boringssl_self_test;
+#line 35
+
+#line 35
+
+
+# Switch to vendor_boringssl_self_test security domain when running vendor_boringssl_self_test_exec
+
+#line 38
+
+#line 38
+# Allow the necessary permissions.
+#line 38
+
+#line 38
+# Old domain may exec the file and transition to the new domain.
+#line 38
+allow init vendor_boringssl_self_test_exec:file { getattr open read execute map };
+#line 38
+allow init vendor_boringssl_self_test:process transition;
+#line 38
+# New domain is entered by executing the file.
+#line 38
+allow vendor_boringssl_self_test vendor_boringssl_self_test_exec:file { entrypoint open read execute getattr map };
+#line 38
+# New domain can send SIGCHLD to its caller.
+#line 38
+
+#line 38
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 38
+dontaudit init vendor_boringssl_self_test:process noatsecure;
+#line 38
+# XXX dontaudit candidate but requires further study.
+#line 38
+allow init vendor_boringssl_self_test:process { siginh rlimitinh };
+#line 38
+
+#line 38
+# Make the transition occur by default.
+#line 38
+type_transition init vendor_boringssl_self_test_exec:process vendor_boringssl_self_test;
+#line 38
+
+#line 38
+
+
+# Marker files, common to both domains, indicating KAT have been performed on a particular libcrypto
+#
+# The files are zero length so there is no issue if both vendor and system code
+# try to create the same file simultaneously. One will succeed and the other will fail
+# silently, i.e. still indicate success. Similar harmless naming collisions will happen in the
+# system domain e.g. when system and APEX copies of libcrypto are identical.
+type boringssl_self_test_marker, file_type;
+
+# Allow self test binaries to create/check for the existence of boringssl_self_test_marker files
+allow { boringssl_self_test vendor_boringssl_self_test }
+ boringssl_self_test_marker:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow { boringssl_self_test vendor_boringssl_self_test }
+ boringssl_self_test_marker:dir { { open getattr read search ioctl lock watch watch_reads } add_name write };
+
+# Allow self test binaries to write their stdout/stderr messages to kmsg_debug
+allow { boringssl_self_test vendor_boringssl_self_test }
+ kmsg_debug_device:chr_file { { open append write lock map } getattr ioctl };
+
+# No other process should be able to create marker files because their existence causes the
+# boringssl KAT to be skipped.
+neverallow {
+ domain
+ -vendor_boringssl_self_test
+ -boringssl_self_test
+ -init
+ -vendor_init
+} boringssl_self_test_marker:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -vendor_boringssl_self_test
+ -boringssl_self_test
+ -init
+ -vendor_init
+} boringssl_self_test_marker:dir write;
+#line 1 "system/sepolicy/private/bpfdomain.te"
+# platform should have ownership of network attachpoints for BPF
+neverallow {
+ bpfdomain
+ -bpfloader
+ -netd
+ -netutils_wrapper
+ -network_stack
+ -system_server
+} self:{ capability cap_userns } { net_admin net_raw };
+
+# any domain which uses bpf is a bpfdomain
+neverallow { domain -bpfdomain } *:bpf *;
+
+allow bpfdomain fs_bpf:dir search;
+
+# genfscon doesn't seem to trigger during symlink creation,
+# and thus any created symlinks end up as 'fs_bpf:lnk_type',
+# however this feels like a kernel bug / missing feature,
+# so let's allow all bpffs_type's instead,
+# this will keep things working even if this is fixed.
+allow bpfdomain bpffs_type:lnk_file read;
+
+# Needed for //frameworks/libs/net:
+# common/native/bpf_headers/include/bpf/WaitForProgsLoaded.h
+
+#line 25
+allow bpfdomain bpf_progs_loaded_prop:file { getattr open read map };
+#line 25
+
+#line 1 "system/sepolicy/private/bpfloader.te"
+type bpfloader_exec, system_file_type, exec_type, file_type;
+
+typeattribute bpfloader bpfdomain;
+
+# allow bpfloader to write to the kernel log (starts early)
+allow bpfloader kmsg_device:chr_file { open append write lock map };
+
+# These permissions are required to pin ebpf maps & programs.
+allow bpfloader bpffs_type:dir { add_name create open read remove_name search setattr write };
+allow bpfloader bpffs_type:file { create getattr read rename setattr };
+allow bpfloader bpffs_type:lnk_file { create getattr read };
+allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
+
+# Allow bpfloader to create bpf maps and programs.
+allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
+
+allow bpfloader self:capability { chown sys_admin net_admin };
+
+allow bpfloader sysfs_fs_fuse_bpf:file { getattr open read ioctl lock map watch watch_reads };
+
+allow bpfloader proc_bpf:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 23
+
+#line 23
+allow bpfloader property_socket:sock_file write;
+#line 23
+allow bpfloader init:unix_stream_socket connectto;
+#line 23
+
+#line 23
+allow bpfloader bpf_progs_loaded_prop:property_service set;
+#line 23
+
+#line 23
+allow bpfloader bpf_progs_loaded_prop:file { getattr open read map };
+#line 23
+
+#line 23
+
+
+allow bpfloader bpfloader_exec:file execute_no_trans;
+
+###
+### Neverallow rules
+###
+
+# Note: we don't care about getattr/mounton/search
+neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
+neverallow { domain -bpfloader } bpffs_type:dir { add_name create open read remove_name setattr write };
+
+neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
+neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };
+neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file { getattr read };
+neverallow { domain -bpfloader } fs_bpf_loader:file { getattr read };
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file { getattr read };
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file { getattr read };
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file { getattr read };
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file { getattr read };
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file { getattr read };
+neverallow { domain -bpfloader -uprobestats } fs_bpf_uprobestats:file { getattr read };
+neverallow { domain -bpfloader -gpuservice -lmkd -netd -netutils_wrapper -network_stack -system_server -uprobestats } { bpffs_type -fs_bpf_vendor }:file write;
+
+neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
+neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
+
+neverallow { domain -bpfloader } *:bpf prog_load;
+neverallow { domain -bpfdomain } *:bpf { map_create map_read map_write prog_run };
+
+# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
+neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
+neverallow { domain -bpfloader } fs_bpf_loader:file *;
+
+neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
+
+neverallow { coredomain -bpfloader -netd -netutils_wrapper } fs_bpf_vendor:file *;
+
+neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
+
+# No domain should be allowed to ptrace bpfloader
+neverallow { domain } bpfloader:process ptrace;
+
+neverallow { domain -bpfloader } proc_bpf:file write;
+#line 1 "system/sepolicy/private/bufferhubd.te"
+typeattribute bufferhubd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init bufferhubd_exec:file { getattr open read execute map };
+#line 3
+allow init bufferhubd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow bufferhubd bufferhubd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init bufferhubd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init bufferhubd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init bufferhubd_exec:process bufferhubd;
+#line 3
+
+#line 3
+
+
+
+#line 5
+typeattribute bufferhubd halclientdomain;
+#line 5
+typeattribute bufferhubd hal_graphics_allocator_client;
+#line 5
+
+#line 5
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 5
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 5
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 5
+
+#line 5
+typeattribute bufferhubd hal_graphics_allocator;
+#line 5
+# Find passthrough HAL implementations
+#line 5
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 5
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 5
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 5
+
+#line 5
+
+
+# TODO(b/112338294): remove these after migrate to Binder
+
+#line 8
+# Mark the server domain as a PDX server.
+#line 8
+typeattribute bufferhubd pdx_bufferhub_client_server_type;
+#line 8
+# Allow the init process to create the initial endpoint socket.
+#line 8
+allow init pdx_bufferhub_client_endpoint_socket_type:unix_stream_socket { create bind };
+#line 8
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 8
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 8
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 8
+allow bufferhubd pdx_bufferhub_client_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 8
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 8
+allow bufferhubd self:process setsockcreate;
+#line 8
+# Allow the server domain to create a client channel socket.
+#line 8
+allow bufferhubd pdx_bufferhub_client_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 8
+# Prevent other processes from claiming to be a server for the same service.
+#line 8
+neverallow {domain -bufferhubd} pdx_bufferhub_client_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 8
+
+
+#line 9
+
+#line 9
+# Allow client to open the service endpoint file.
+#line 9
+allow bufferhubd pdx_performance_client_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow bufferhubd pdx_performance_client_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 9
+# Allow the client to connect to endpoint socket.
+#line 9
+allow bufferhubd pdx_performance_client_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 9
+
+#line 9
+
+#line 9
+# Allow the client to use the PDX channel socket.
+#line 9
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 9
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 9
+allow bufferhubd pdx_performance_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 9
+# Client needs to use an channel event fd from the server.
+#line 9
+allow bufferhubd pdx_performance_client_server_type:fd use;
+#line 9
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 9
+# This could be tightened on a per-server basis, but keeping track of service
+#line 9
+# clients is error prone.
+#line 9
+allow pdx_performance_client_server_type bufferhubd:fd use;
+#line 9
+
+#line 9
+
+
+# Access the GPU.
+allow bufferhubd gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access /dev/ion
+allow bufferhubd ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Receive sync fence FDs from hal_omx_server. Note that hal_omx_server never directly
+# connects to bufferhubd via PDX. Instead, a VR app acts as a bridge between
+# those two: it talks to hal_omx_server via Binder and talks to bufferhubd via PDX.
+# Thus, there is no need to use pdx_client macro.
+allow bufferhubd hal_omx_server:fd use;
+
+# Codec2 is similar to OMX
+allow bufferhubd hal_codec2_server:fd use;
+#line 1 "system/sepolicy/private/camera_service_server.te"
+
+#line 1
+ allow camera_service_server fwk_camera_hwservice:hwservice_manager { add find };
+#line 1
+ allow camera_service_server hidl_base_hwservice:hwservice_manager add;
+#line 1
+ neverallow { domain -camera_service_server } fwk_camera_hwservice:hwservice_manager add;
+#line 1
+
+#line 1 "system/sepolicy/private/cameraserver.te"
+typeattribute cameraserver camera_service_server;
+typeattribute cameraserver coredomain;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init cameraserver_exec:file { getattr open read execute map };
+#line 4
+allow init cameraserver:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow cameraserver cameraserver_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init cameraserver:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init cameraserver:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init cameraserver_exec:process cameraserver;
+#line 4
+
+#line 4
+
+
+#line 5
+type_transition cameraserver tmpfs:file cameraserver_tmpfs;
+#line 5
+allow cameraserver cameraserver_tmpfs:file { read write getattr map };
+#line 5
+
+
+allow cameraserver gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow cameraserver gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow cameraserver virtual_camera:binder call;
+
+
+#line 11
+# Call the servicemanager and transfer references to it.
+#line 11
+allow cameraserver servicemanager:binder { call transfer };
+#line 11
+# Allow servicemanager to send out callbacks
+#line 11
+allow servicemanager cameraserver:binder { call transfer };
+#line 11
+# servicemanager performs getpidcon on clients.
+#line 11
+allow servicemanager cameraserver:dir search;
+#line 11
+allow servicemanager cameraserver:file { read open };
+#line 11
+allow servicemanager cameraserver:process getattr;
+#line 11
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 11
+# all domains in domain.te.
+#line 11
+
+
+#line 12
+# Call the server domain and optionally transfer references to it.
+#line 12
+allow cameraserver binderservicedomain:binder { call transfer };
+#line 12
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 12
+allow binderservicedomain cameraserver:binder transfer;
+#line 12
+# Receive and use open files from the server.
+#line 12
+allow cameraserver binderservicedomain:fd use;
+#line 12
+
+
+#line 13
+# Call the server domain and optionally transfer references to it.
+#line 13
+allow cameraserver appdomain:binder { call transfer };
+#line 13
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 13
+allow appdomain cameraserver:binder transfer;
+#line 13
+# Receive and use open files from the server.
+#line 13
+allow cameraserver appdomain:fd use;
+#line 13
+
+
+#line 14
+typeattribute cameraserver binderservicedomain;
+#line 14
+
+
+
+#line 16
+typeattribute cameraserver halclientdomain;
+#line 16
+typeattribute cameraserver hal_camera_client;
+#line 16
+
+#line 16
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 16
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 16
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 16
+
+#line 16
+typeattribute cameraserver hal_camera;
+#line 16
+# Find passthrough HAL implementations
+#line 16
+allow hal_camera system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_camera vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_camera vendor_file:file { read open getattr execute map };
+#line 16
+
+#line 16
+
+allow cameraserver hal_camera_server:process signal;
+
+#line 18
+typeattribute cameraserver halclientdomain;
+#line 18
+typeattribute cameraserver hal_graphics_allocator_client;
+#line 18
+
+#line 18
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 18
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 18
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 18
+
+#line 18
+typeattribute cameraserver hal_graphics_allocator;
+#line 18
+# Find passthrough HAL implementations
+#line 18
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 18
+
+#line 18
+
+
+allow cameraserver ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow cameraserver dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Talk with graphics composer fences
+allow cameraserver hal_graphics_composer:fd use;
+
+
+#line 26
+ allow cameraserver cameraserver_service:service_manager { add find };
+#line 26
+ neverallow { domain -cameraserver } cameraserver_service:service_manager add;
+#line 26
+
+#line 26
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 26
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 26
+
+#line 26
+
+
+#line 27
+ allow cameraserver fwk_camera_service:service_manager { add find };
+#line 27
+ neverallow { domain -cameraserver } fwk_camera_service:service_manager add;
+#line 27
+
+#line 27
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 27
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 27
+
+#line 27
+
+
+#line 28
+ allow cameraserver fwk_camera_hwservice:hwservice_manager { add find };
+#line 28
+ allow cameraserver hidl_base_hwservice:hwservice_manager add;
+#line 28
+ neverallow { domain -cameraserver } fwk_camera_hwservice:hwservice_manager add;
+#line 28
+
+
+allow cameraserver activity_service:service_manager find;
+allow cameraserver appops_service:service_manager find;
+allow cameraserver audioserver_service:service_manager find;
+allow cameraserver batterystats_service:service_manager find;
+allow cameraserver cameraproxy_service:service_manager find;
+allow cameraserver mediaserver_service:service_manager find;
+allow cameraserver package_native_service:service_manager find;
+allow cameraserver permission_checker_service:service_manager find;
+allow cameraserver processinfo_service:service_manager find;
+allow cameraserver scheduling_policy_service:service_manager find;
+allow cameraserver sensor_privacy_service:service_manager find;
+allow cameraserver surfaceflinger_service:service_manager find;
+
+allow cameraserver hidl_token_hwservice:hwservice_manager find;
+allow cameraserver hal_camera_service:service_manager find;
+allow cameraserver virtual_camera_service:service_manager find;
+
+# Allow to talk with surfaceflinger through unix stream socket
+allow cameraserver surfaceflinger:unix_stream_socket { read write };
+
+# Allow shell commands from ADB for CTS testing/dumping
+allow cameraserver adbd:fd use;
+allow cameraserver adbd:unix_stream_socket { read write };
+allow cameraserver shell:fd use;
+allow cameraserver shell:unix_stream_socket { read write };
+allow cameraserver shell:fifo_file { read write };
+
+# allow self to set SCHED_FIFO
+allow cameraserver self:{ capability cap_userns } sys_nice;
+
+# Allow to talk with media codec
+allow cameraserver mediametrics_service:service_manager find;
+
+#line 62
+typeattribute cameraserver halclientdomain;
+#line 62
+typeattribute cameraserver hal_codec2_client;
+#line 62
+
+#line 62
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 62
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 62
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 62
+
+#line 62
+typeattribute cameraserver hal_codec2;
+#line 62
+# Find passthrough HAL implementations
+#line 62
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 62
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 62
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 62
+
+#line 62
+
+
+#line 63
+typeattribute cameraserver halclientdomain;
+#line 63
+typeattribute cameraserver hal_omx_client;
+#line 63
+
+#line 63
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 63
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 63
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 63
+
+#line 63
+typeattribute cameraserver hal_omx;
+#line 63
+# Find passthrough HAL implementations
+#line 63
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 63
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 63
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 63
+
+#line 63
+
+
+#line 64
+typeattribute cameraserver halclientdomain;
+#line 64
+typeattribute cameraserver hal_allocator_client;
+#line 64
+
+#line 64
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 64
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 64
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 64
+
+#line 64
+typeattribute cameraserver hal_allocator;
+#line 64
+# Find passthrough HAL implementations
+#line 64
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 64
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 64
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 64
+
+#line 64
+
+
+# Allow shell commands from ADB for CTS testing/dumping
+#line 71
+
+
+###
+### neverallow rules
+###
+
+# cameraserver should never execute any executable without a
+# domain transition
+neverallow cameraserver { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow cameraserver domain:{ udp_socket rawip_socket } *;
+neverallow cameraserver { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/canhalconfigurator.te"
+type canhalconfigurator, domain, coredomain;
+type canhalconfigurator_exec, exec_type, system_file_type, file_type;
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init canhalconfigurator_exec:file { getattr open read execute map };
+#line 3
+allow init canhalconfigurator:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow canhalconfigurator canhalconfigurator_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init canhalconfigurator:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init canhalconfigurator:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init canhalconfigurator_exec:process canhalconfigurator;
+#line 3
+
+#line 3
+
+
+# This allows the configurator to look up the CAN HAL controller via
+# hwservice_manager and communicate with it.
+
+#line 7
+typeattribute canhalconfigurator halclientdomain;
+#line 7
+typeattribute canhalconfigurator hal_can_controller_client;
+#line 7
+
+#line 7
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 7
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 7
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 7
+
+#line 7
+typeattribute canhalconfigurator hal_can_controller;
+#line 7
+# Find passthrough HAL implementations
+#line 7
+allow hal_can_controller system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 7
+allow hal_can_controller vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 7
+allow hal_can_controller vendor_file:file { read open getattr execute map };
+#line 7
+
+#line 7
+
+
+
+#line 9
+# Call the servicemanager and transfer references to it.
+#line 9
+allow canhalconfigurator servicemanager:binder { call transfer };
+#line 9
+# Allow servicemanager to send out callbacks
+#line 9
+allow servicemanager canhalconfigurator:binder { call transfer };
+#line 9
+# servicemanager performs getpidcon on clients.
+#line 9
+allow servicemanager canhalconfigurator:dir search;
+#line 9
+allow servicemanager canhalconfigurator:file { read open };
+#line 9
+allow servicemanager canhalconfigurator:process getattr;
+#line 9
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow hal_can_controller canhalconfigurator:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow canhalconfigurator hal_can_controller:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow hal_can_controller canhalconfigurator:fd use;
+#line 10
+
+#line 1 "system/sepolicy/private/charger.te"
+typeattribute charger coredomain;
+
+# The system charger is a client of HIDL health HAL.
+
+#line 4
+typeattribute charger halclientdomain;
+#line 4
+typeattribute charger hal_health_client;
+#line 4
+
+#line 4
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 4
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 4
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 4
+
+#line 4
+typeattribute charger hal_health;
+#line 4
+# Find passthrough HAL implementations
+#line 4
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 4
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 4
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 4
+
+#line 4
+
+
+# charger needs to tell init to continue the boot
+# process when running in charger mode.
+# The system charger needs to be allowed to set these properties on legacy devices.
+
+#line 9
+
+#line 9
+allow charger property_socket:sock_file write;
+#line 9
+allow charger init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow charger system_prop:property_service set;
+#line 9
+
+#line 9
+allow charger system_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+allow charger property_socket:sock_file write;
+#line 10
+allow charger init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow charger exported_system_prop:property_service set;
+#line 10
+
+#line 10
+allow charger exported_system_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+allow charger property_socket:sock_file write;
+#line 11
+allow charger init:unix_stream_socket connectto;
+#line 11
+
+#line 11
+allow charger exported3_system_prop:property_service set;
+#line 11
+
+#line 11
+allow charger exported3_system_prop:file { getattr open read map };
+#line 11
+
+#line 11
+
+
+# The system charger can read ro.charger.*
+
+#line 14
+allow charger charger_prop:file { getattr open read map };
+#line 14
+
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 16
+
+#line 16
+ neverallow {
+#line 16
+ domain
+#line 16
+ -init
+#line 16
+ -dumpstate
+#line 16
+ -charger
+#line 16
+ } charger_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 16
+
+#line 16
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 23
+
+#line 1 "system/sepolicy/private/charger_type.te"
+# charger needs to tell init to continue the boot
+# process when running in charger mode.
+
+#line 3
+
+#line 3
+allow charger_type property_socket:sock_file write;
+#line 3
+allow charger_type init:unix_stream_socket connectto;
+#line 3
+
+#line 3
+allow charger_type charger_status_prop:property_service set;
+#line 3
+
+#line 3
+allow charger_type charger_status_prop:file { getattr open read map };
+#line 3
+
+#line 3
+
+
+#line 4
+allow charger_type charger_config_prop:file { getattr open read map };
+#line 4
+
+
+# get minui properties
+
+#line 7
+allow charger_type recovery_config_prop:file { getattr open read map };
+#line 7
+
+
+# Write to /dev/kmsg
+allow charger_type kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read access to pseudo filesystems.
+
+#line 13
+allow charger_type rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 13
+allow charger_type rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 13
+
+
+#line 14
+allow charger_type cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 14
+allow charger_type cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 14
+
+
+#line 15
+allow charger_type cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow charger_type cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+
+# Allow to read /sys/class/power_supply directory
+allow charger_type sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+
+allow charger_type self:{ capability cap_userns } {
+ sys_boot
+ sys_tty_config
+};
+
+
+#line 25
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 25
+# deprecated.
+#line 25
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 25
+allow charger_type sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 25
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 25
+allow charger_type self:{ capability2 cap2_userns } block_suspend;
+#line 25
+# system_suspend permissions
+#line 25
+
+#line 25
+# Call the server domain and optionally transfer references to it.
+#line 25
+allow charger_type system_suspend_server:binder { call transfer };
+#line 25
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 25
+allow system_suspend_server charger_type:binder transfer;
+#line 25
+# Receive and use open files from the server.
+#line 25
+allow charger_type system_suspend_server:fd use;
+#line 25
+
+#line 25
+allow charger_type system_suspend_hwservice:hwservice_manager find;
+#line 25
+# halclientdomain permissions
+#line 25
+
+#line 25
+# Call the hwservicemanager and transfer references to it.
+#line 25
+allow charger_type hwservicemanager:binder { call transfer };
+#line 25
+# Allow hwservicemanager to send out callbacks
+#line 25
+allow hwservicemanager charger_type:binder { call transfer };
+#line 25
+# hwservicemanager performs getpidcon on clients.
+#line 25
+allow hwservicemanager charger_type:dir search;
+#line 25
+allow hwservicemanager charger_type:file { read open map };
+#line 25
+allow hwservicemanager charger_type:process getattr;
+#line 25
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 25
+# all domains in domain.te.
+#line 25
+
+#line 25
+
+#line 25
+allow charger_type hwservicemanager_prop:file { getattr open read map };
+#line 25
+
+#line 25
+allow charger_type hidl_manager_hwservice:hwservice_manager find;
+#line 25
+# AIDL suspend hal permissions
+#line 25
+allow charger_type hal_system_suspend_service:service_manager find;
+#line 25
+
+#line 25
+# Call the servicemanager and transfer references to it.
+#line 25
+allow charger_type servicemanager:binder { call transfer };
+#line 25
+# Allow servicemanager to send out callbacks
+#line 25
+allow servicemanager charger_type:binder { call transfer };
+#line 25
+# servicemanager performs getpidcon on clients.
+#line 25
+allow servicemanager charger_type:dir search;
+#line 25
+allow servicemanager charger_type:file { read open };
+#line 25
+allow servicemanager charger_type:process getattr;
+#line 25
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 25
+# all domains in domain.te.
+#line 25
+
+#line 25
+
+
+allow charger_type self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Read/write to /sys/power/state
+allow charger_type sysfs_power:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 32
+allow charger_type sysfs_batteryinfo:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow charger_type sysfs_batteryinfo:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow charger_type pstorefs:dir { open getattr read search ioctl lock watch watch_reads };
+allow charger_type pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+
+allow charger_type graphics_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow charger_type graphics_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow charger_type input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow charger_type input_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow charger_type tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow charger_type proc_sysrq:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+### Neverallow rules for charger properties
+
+# charger_config_prop: Only init and vendor_init is allowed to set it
+neverallow {
+ domain
+ -init
+ -vendor_init
+} charger_config_prop:property_service set;
+
+# charger_status_prop: Only init, vendor_init, charger, and charger_vendor
+# are allowed to set it
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -charger
+ -charger_vendor
+} charger_status_prop:property_service set;
+
+# Both charger_config_prop and charger_status_prop:
+# Only init, vendor_init, dumpstate, charger, and charger_vendor
+# are allowed to read it
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -vendor_init
+ -charger
+ -charger_vendor
+} { charger_config_prop charger_status_prop }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1 "system/sepolicy/private/charger_vendor.te"
+
+#line 1
+typeattribute charger_vendor halserverdomain;
+#line 1
+typeattribute charger_vendor hal_health_server;
+#line 1
+typeattribute charger_vendor hal_health;
+#line 1
+
+
+typeattribute charger_vendor bpfdomain;
+#line 1 "system/sepolicy/private/clatd.te"
+# 464xlat daemon
+type clatd, domain, coredomain;
+type clatd_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+typeattribute clatd netdomain;
+#line 5
+
+
+# Access objects inherited from system_server.
+allow clatd system_server:fd use;
+allow clatd system_server:packet_socket { read write };
+allow clatd system_server:rawip_socket { read write };
+
+allow clatd tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/compos_fd_server.te"
+# Make ART inputs and outputs available to the CompOS VM
+type compos_fd_server, domain, coredomain;
+
+# Allow access to open fds inherited from composd
+allow compos_fd_server composd:fd use;
+
+# Allow creating new files and directories in the staging directory.
+allow compos_fd_server apex_art_staging_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow compos_fd_server apex_art_staging_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow creating new files and directories in the artifacts directory.
+allow compos_fd_server apex_art_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow compos_fd_server apex_art_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Use a pipe to signal readiness
+allow compos_fd_server composd:fifo_file write;
+
+# TODO(b/196109647) - remove this when no longer needed by minijail
+allow compos_fd_server composd:fifo_file read;
+
+# Create a listening vsock for the VM to connect back to
+allow compos_fd_server self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } listen accept };
+
+# Only composd can enter the domain via exec
+neverallow { domain -composd } compos_fd_server:process transition;
+neverallow * compos_fd_server:process dyntransition;
+#line 1 "system/sepolicy/private/compos_verify.te"
+# Run by odsign to verify a CompOS signature
+type compos_verify, domain, coredomain;
+type compos_verify_exec, exec_type, file_type, system_file_type;
+
+# Start a VM
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow compos_verify servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager compos_verify:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager compos_verify:dir search;
+#line 6
+allow servicemanager compos_verify:file { read open };
+#line 6
+allow servicemanager compos_verify:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+;
+
+#line 7
+# Transition to virtualizationmanager when the client executes it.
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow compos_verify virtualizationmanager_exec:file { getattr open read execute map };
+#line 7
+allow compos_verify virtualizationmanager:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+allow virtualizationmanager compos_verify:process sigchld;
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit compos_verify virtualizationmanager:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow compos_verify virtualizationmanager:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition compos_verify virtualizationmanager_exec:process virtualizationmanager;
+#line 7
+
+#line 7
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 7
+allow { virtualizationmanager crosvm } compos_verify:unix_stream_socket { ioctl getattr read write };
+#line 7
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 7
+allow { virtualizationmanager crosvm } compos_verify:fd use;
+#line 7
+# Let the client use file descriptors created by virtualizationmanager.
+#line 7
+allow compos_verify virtualizationmanager:fd use;
+#line 7
+# Allow piping console log to the client
+#line 7
+allow { virtualizationmanager crosvm } compos_verify:fifo_file { ioctl getattr read write };
+#line 7
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 7
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 7
+# the client can only connect to VMs that it owns.
+#line 7
+allow compos_verify virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 7
+# Allow client to inspect hypervisor capabilities
+#line 7
+
+#line 7
+allow compos_verify hypervisor_prop:file { getattr open read map };
+#line 7
+
+#line 7
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 7
+allow compos_verify virtualizationservice_data_file:file { getattr read };
+#line 7
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 7
+allow virtualizationmanager compos_verify:dir search;
+#line 7
+allow virtualizationmanager compos_verify:file read;
+#line 7
+allow virtualizationmanager compos_verify:lnk_file read;
+#line 7
+;
+
+# Read instance image & write VM logs
+allow compos_verify apex_module_data_file:dir search;
+allow compos_verify apex_compos_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow compos_verify apex_compos_data_file:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } create };
+
+# Read CompOS info & signature files
+allow compos_verify apex_art_data_file:dir search;
+allow compos_verify apex_art_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow odsign to redirect our stdout/stderr to log
+allow compos_verify odsign:fd use;
+allow compos_verify odsign_devpts:chr_file { read write };
+
+# Only odsign can enter the domain via exec
+neverallow { domain -odsign } compos_verify:process transition;
+neverallow * compos_verify:process dyntransition;
+#line 1 "system/sepolicy/private/composd.te"
+type composd, domain, coredomain;
+type composd_exec, system_file_type, exec_type, file_type;
+
+# Host dynamic AIDL services
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init composd_exec:file { getattr open read execute map };
+#line 5
+allow init composd:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow composd composd_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init composd:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init composd:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init composd_exec:process composd;
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow composd servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager composd:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager composd:dir search;
+#line 6
+allow servicemanager composd:file { read open };
+#line 6
+allow servicemanager composd:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+
+#line 7
+ allow composd compos_service:service_manager { add find };
+#line 7
+ neverallow { domain -composd } compos_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+
+# Call back into system server
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow composd system_server:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow system_server composd:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow composd system_server:fd use;
+#line 10
+
+
+# Start a VM
+
+#line 13
+# Transition to virtualizationmanager when the client executes it.
+#line 13
+
+#line 13
+# Allow the necessary permissions.
+#line 13
+
+#line 13
+# Old domain may exec the file and transition to the new domain.
+#line 13
+allow composd virtualizationmanager_exec:file { getattr open read execute map };
+#line 13
+allow composd virtualizationmanager:process transition;
+#line 13
+# New domain is entered by executing the file.
+#line 13
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 13
+# New domain can send SIGCHLD to its caller.
+#line 13
+allow virtualizationmanager composd:process sigchld;
+#line 13
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 13
+dontaudit composd virtualizationmanager:process noatsecure;
+#line 13
+# XXX dontaudit candidate but requires further study.
+#line 13
+allow composd virtualizationmanager:process { siginh rlimitinh };
+#line 13
+
+#line 13
+# Make the transition occur by default.
+#line 13
+type_transition composd virtualizationmanager_exec:process virtualizationmanager;
+#line 13
+
+#line 13
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 13
+allow { virtualizationmanager crosvm } composd:unix_stream_socket { ioctl getattr read write };
+#line 13
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 13
+allow { virtualizationmanager crosvm } composd:fd use;
+#line 13
+# Let the client use file descriptors created by virtualizationmanager.
+#line 13
+allow composd virtualizationmanager:fd use;
+#line 13
+# Allow piping console log to the client
+#line 13
+allow { virtualizationmanager crosvm } composd:fifo_file { ioctl getattr read write };
+#line 13
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 13
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 13
+# the client can only connect to VMs that it owns.
+#line 13
+allow composd virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 13
+# Allow client to inspect hypervisor capabilities
+#line 13
+
+#line 13
+allow composd hypervisor_prop:file { getattr open read map };
+#line 13
+
+#line 13
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 13
+allow composd virtualizationservice_data_file:file { getattr read };
+#line 13
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 13
+allow virtualizationmanager composd:dir search;
+#line 13
+allow virtualizationmanager composd:file read;
+#line 13
+allow virtualizationmanager composd:lnk_file read;
+#line 13
+
+
+# Prepare staging directory for odrefresh
+allow composd apex_art_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow composd apex_art_staging_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow composd apex_art_staging_data_file:file { getattr unlink };
+
+# Delete files or enable fs-verity in the odrefresh target directory
+allow composd apex_art_data_file:file { open ioctl read unlink write };
+allowxperm composd apex_art_data_file:file ioctl 0x6685;
+
+# Access our APEX data files
+allow composd apex_module_data_file:dir search;
+allow composd apex_compos_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow composd apex_compos_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Run fd_server in its own domain, and send SIGTERM when finished.
+
+#line 30
+# Allow the necessary permissions.
+#line 30
+
+#line 30
+# Old domain may exec the file and transition to the new domain.
+#line 30
+allow composd fd_server_exec:file { getattr open read execute map };
+#line 30
+allow composd compos_fd_server:process transition;
+#line 30
+# New domain is entered by executing the file.
+#line 30
+allow compos_fd_server fd_server_exec:file { entrypoint open read execute getattr map };
+#line 30
+# New domain can send SIGCHLD to its caller.
+#line 30
+allow compos_fd_server composd:process sigchld;
+#line 30
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 30
+dontaudit composd compos_fd_server:process noatsecure;
+#line 30
+# XXX dontaudit candidate but requires further study.
+#line 30
+allow composd compos_fd_server:process { siginh rlimitinh };
+#line 30
+
+#line 30
+# Make the transition occur by default.
+#line 30
+type_transition composd fd_server_exec:process compos_fd_server;
+#line 30
+
+allow composd compos_fd_server:process signal;
+
+# Read properties used to configure the CompOS VM
+
+#line 34
+allow composd composd_vm_art_prop:file { getattr open read map };
+#line 34
+
+
+#line 35
+allow composd composd_vm_vendor_prop:file { getattr open read map };
+#line 35
+
+
+# Read ART's properties
+
+#line 38
+allow composd dalvik_config_prop_type:file { getattr open read map };
+#line 38
+
+
+#line 39
+allow composd device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 39
+
+
+# We never create any artifact files directly
+neverallow composd apex_art_data_file:file create;
+
+# ART sets these properties via init script, nothing else should
+neverallow { domain -init } composd_vm_art_prop:property_service set;
+#line 1 "system/sepolicy/private/coredomain.te"
+
+#line 1
+allow coredomain apex_ready_prop:file { getattr open read map };
+#line 1
+
+
+#line 2
+allow coredomain boot_status_prop:file { getattr open read map };
+#line 2
+
+
+#line 3
+allow coredomain camera_config_prop:file { getattr open read map };
+#line 3
+
+
+#line 4
+allow coredomain dalvik_config_prop_type:file { getattr open read map };
+#line 4
+
+
+#line 5
+allow coredomain dalvik_runtime_prop:file { getattr open read map };
+#line 5
+
+
+#line 6
+allow coredomain exported_pm_prop:file { getattr open read map };
+#line 6
+
+
+#line 7
+allow coredomain ffs_config_prop:file { getattr open read map };
+#line 7
+
+
+#line 8
+allow coredomain graphics_config_prop:file { getattr open read map };
+#line 8
+
+
+#line 9
+allow coredomain graphics_config_writable_prop:file { getattr open read map };
+#line 9
+
+
+#line 10
+allow coredomain hdmi_config_prop:file { getattr open read map };
+#line 10
+
+
+#line 11
+allow coredomain init_service_status_private_prop:file { getattr open read map };
+#line 11
+
+
+#line 12
+allow coredomain lmkd_config_prop:file { getattr open read map };
+#line 12
+
+
+#line 13
+allow coredomain localization_prop:file { getattr open read map };
+#line 13
+
+
+#line 14
+allow coredomain pm_prop:file { getattr open read map };
+#line 14
+
+
+#line 15
+allow coredomain radio_control_prop:file { getattr open read map };
+#line 15
+
+
+#line 16
+allow coredomain rollback_test_prop:file { getattr open read map };
+#line 16
+
+
+#line 17
+allow coredomain setupwizard_prop:file { getattr open read map };
+#line 17
+
+
+#line 18
+allow coredomain setupwizard_mode_prop:file { getattr open read map };
+#line 18
+
+
+#line 19
+allow coredomain sqlite_log_prop:file { getattr open read map };
+#line 19
+
+
+#line 20
+allow coredomain storagemanager_config_prop:file { getattr open read map };
+#line 20
+
+
+#line 21
+allow coredomain surfaceflinger_color_prop:file { getattr open read map };
+#line 21
+
+
+#line 22
+allow coredomain systemsound_config_prop:file { getattr open read map };
+#line 22
+
+
+#line 23
+allow coredomain telephony_config_prop:file { getattr open read map };
+#line 23
+
+
+#line 24
+allow coredomain usb_config_prop:file { getattr open read map };
+#line 24
+
+
+#line 25
+allow coredomain usb_control_prop:file { getattr open read map };
+#line 25
+
+
+#line 26
+allow coredomain userspace_reboot_config_prop:file { getattr open read map };
+#line 26
+
+
+#line 27
+allow coredomain vold_config_prop:file { getattr open read map };
+#line 27
+
+
+#line 28
+allow coredomain vts_status_prop:file { getattr open read map };
+#line 28
+
+
+#line 29
+allow coredomain zygote_config_prop:file { getattr open read map };
+#line 29
+
+
+#line 30
+allow coredomain zygote_wrap_prop:file { getattr open read map };
+#line 30
+
+
+# TODO(b/170590987): remove this after cleaning up default_prop
+
+#line 33
+allow coredomain default_prop:file { getattr open read map };
+#line 33
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 35
+
+#line 35
+neverallow {
+#line 35
+ coredomain
+#line 35
+
+#line 35
+ # for chowning
+#line 35
+ -init
+#line 35
+
+#line 35
+ # generic access to sysfs_type
+#line 35
+ -apexd
+#line 35
+ -ueventd
+#line 35
+ -vold
+#line 35
+} sysfs_leds:file *;
+#line 35
+
+#line 35
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 47
+
+
+# On TREBLE devices, a limited set of files in /vendor are accessible to
+# only a few allowlisted coredomains to keep system/vendor separation.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 51
+
+#line 51
+ # Limit access to /vendor/app
+#line 51
+ neverallow {
+#line 51
+ coredomain
+#line 51
+ -appdomain
+#line 51
+ -artd
+#line 51
+ -dex2oat
+#line 51
+ -idmap
+#line 51
+ -init
+#line 51
+ -installd
+#line 51
+ -heapprofd
+#line 51
+ -postinstall_dexopt
+#line 51
+ -rs # spawned by appdomain, so carryover the exception above
+#line 51
+ -system_server
+#line 51
+ -traced_perf
+#line 51
+ } vendor_app_file:dir { open read getattr search };
+#line 51
+
+#line 51
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 67
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 69
+
+#line 69
+ neverallow {
+#line 69
+ coredomain
+#line 69
+ -appdomain
+#line 69
+ -artd
+#line 69
+ -dex2oat
+#line 69
+ -idmap
+#line 69
+ -init
+#line 69
+ -installd
+#line 69
+ -heapprofd
+#line 69
+
+#line 69
+ -postinstall_dexopt
+#line 69
+ -profman
+#line 69
+ -rs # spawned by appdomain, so carryover the exception above
+#line 69
+
+#line 69
+ -system_server
+#line 69
+ -traced_perf
+#line 69
+ -mediaserver
+#line 69
+ } vendor_app_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 69
+
+#line 69
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 88
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 90
+
+#line 90
+ # Limit access to /vendor/overlay
+#line 90
+ neverallow {
+#line 90
+ coredomain
+#line 90
+ -appdomain
+#line 90
+ -artd
+#line 90
+ -dex2oat
+#line 90
+ -idmap
+#line 90
+ -init
+#line 90
+ -installd
+#line 90
+ -postinstall_dexopt
+#line 90
+ -rs # spawned by appdomain, so carryover the exception above
+#line 90
+ -system_server
+#line 90
+ -traced_perf
+#line 90
+ -app_zygote
+#line 90
+ -webview_zygote
+#line 90
+ -zygote
+#line 90
+ -heapprofd
+#line 90
+ } vendor_overlay_file:dir { getattr open read search };
+#line 90
+
+#line 90
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 109
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 111
+
+#line 111
+ neverallow {
+#line 111
+ coredomain
+#line 111
+ -appdomain
+#line 111
+ -artd
+#line 111
+ -dex2oat
+#line 111
+ -idmap
+#line 111
+ -init
+#line 111
+ -installd
+#line 111
+ -postinstall_dexopt
+#line 111
+ -rs # spawned by appdomain, so carryover the exception above
+#line 111
+ -system_server
+#line 111
+ -traced_perf
+#line 111
+ -app_zygote
+#line 111
+ -webview_zygote
+#line 111
+ -zygote
+#line 111
+ -heapprofd
+#line 111
+
+#line 111
+
+#line 111
+ } vendor_overlay_file:file open;
+#line 111
+
+#line 111
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 131
+
+
+# Core domains are not permitted to use kernel interfaces which are not
+# explicitly labeled.
+# TODO(b/65643247): Apply these neverallow rules to all coredomain.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 136
+
+#line 136
+ # /proc
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -init
+#line 136
+ -vold
+#line 136
+ } proc:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # /sys
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -apexd
+#line 136
+ -init
+#line 136
+ -ueventd
+#line 136
+ -vfio_handler
+#line 136
+ -vold
+#line 136
+ } sysfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # /dev
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -apexd
+#line 136
+ -fsck
+#line 136
+ -init
+#line 136
+ -ueventd
+#line 136
+ } device:{ blk_file file } { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # debugfs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+
+#line 136
+ -dumpstate
+#line 136
+ -init
+#line 136
+ -system_server
+#line 136
+
+#line 136
+ } debugfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # tracefs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -atrace
+#line 136
+ -dumpstate
+#line 136
+ -gpuservice
+#line 136
+ -init
+#line 136
+ -lmkd
+#line 136
+ -traced_perf
+#line 136
+ -traced_probes
+#line 136
+ -shell
+#line 136
+ -system_server
+#line 136
+ -traceur_app
+#line 136
+ -prefetch
+#line 136
+
+#line 136
+
+#line 136
+ } debugfs_tracing:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # inotifyfs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -init
+#line 136
+ } inotify:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # pstorefs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -bootstat
+#line 136
+ -charger
+#line 136
+ -dumpstate
+#line 136
+
+#line 136
+ -init
+#line 136
+ -logd
+#line 136
+ -logpersist
+#line 136
+ -recovery_persist
+#line 136
+ -recovery_refresh
+#line 136
+ -shell
+#line 136
+ -system_server
+#line 136
+ } pstorefs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # configfs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -init
+#line 136
+ -system_server
+#line 136
+ } configfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # functionfs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -adbd
+#line 136
+ -adbd_tradeinmode
+#line 136
+ -init
+#line 136
+ -mediaprovider
+#line 136
+ -system_server
+#line 136
+ } functionfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # usbfs and binfmt_miscfs
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -init
+#line 136
+ }{ usbfs binfmt_miscfs }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+ # dmabuf heaps
+#line 136
+ neverallow {
+#line 136
+ coredomain
+#line 136
+ -init
+#line 136
+ -ueventd
+#line 136
+ }{
+#line 136
+ dmabuf_heap_device_type
+#line 136
+ -dmabuf_system_heap_device
+#line 136
+ -dmabuf_system_secure_heap_device
+#line 136
+ }:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 136
+
+#line 136
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 246
+
+
+# Following /dev nodes must not be directly accessed by coredomain, but should
+# instead be wrapped by HALs.
+neverallow coredomain {
+ iio_device
+ radio_device
+}:chr_file { open read append write ioctl };
+
+# TODO(b/120243891): HAL permission to tee_device is included into coredomain
+# on non-Treble devices.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 257
+
+#line 257
+ neverallow coredomain tee_device:chr_file { open read append write ioctl };
+#line 257
+
+#line 257
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 259
+
+#line 1 "system/sepolicy/private/cppreopts.te"
+# cppreopts
+#
+# This command copies preopted files from the system_b partition to the data
+# partition. This domain ensures that we are only copying into specific
+# directories.
+
+type cppreopts, domain, mlstrustedsubject, coredomain;
+type cppreopts_exec, system_file_type, exec_type, file_type;
+
+# Technically not a daemon but we do want the transition from init domain to
+# cppreopts to occur.
+
+#line 12
+
+#line 12
+# Allow the necessary permissions.
+#line 12
+
+#line 12
+# Old domain may exec the file and transition to the new domain.
+#line 12
+allow init cppreopts_exec:file { getattr open read execute map };
+#line 12
+allow init cppreopts:process transition;
+#line 12
+# New domain is entered by executing the file.
+#line 12
+allow cppreopts cppreopts_exec:file { entrypoint open read execute getattr map };
+#line 12
+# New domain can send SIGCHLD to its caller.
+#line 12
+
+#line 12
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 12
+dontaudit init cppreopts:process noatsecure;
+#line 12
+# XXX dontaudit candidate but requires further study.
+#line 12
+allow init cppreopts:process { siginh rlimitinh };
+#line 12
+
+#line 12
+# Make the transition occur by default.
+#line 12
+type_transition init cppreopts_exec:process cppreopts;
+#line 12
+
+#line 12
+
+
+#line 13
+# Allow the necessary permissions.
+#line 13
+
+#line 13
+# Old domain may exec the file and transition to the new domain.
+#line 13
+allow cppreopts preopt2cachename_exec:file { getattr open read execute map };
+#line 13
+allow cppreopts preopt2cachename:process transition;
+#line 13
+# New domain is entered by executing the file.
+#line 13
+allow preopt2cachename preopt2cachename_exec:file { entrypoint open read execute getattr map };
+#line 13
+# New domain can send SIGCHLD to its caller.
+#line 13
+allow preopt2cachename cppreopts:process sigchld;
+#line 13
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 13
+dontaudit cppreopts preopt2cachename:process noatsecure;
+#line 13
+# XXX dontaudit candidate but requires further study.
+#line 13
+allow cppreopts preopt2cachename:process { siginh rlimitinh };
+#line 13
+
+#line 13
+# Make the transition occur by default.
+#line 13
+type_transition cppreopts preopt2cachename_exec:process preopt2cachename;
+#line 13
+;
+
+# Allow cppreopts copy files into the dalvik-cache
+allow cppreopts dalvikcache_data_file:dir { add_name remove_name search write };
+allow cppreopts dalvikcache_data_file:file { create getattr open read rename write unlink };
+
+# Allow cppreopts to execute itself using #!/system/bin/sh
+allow cppreopts shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow us to run find on /postinstall
+allow cppreopts system_file:dir { open read };
+
+# Allow running the cp command using cppreopts permissions. Needed so we can
+# write into dalvik-cache
+allow cppreopts toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Silence the denial when /postinstall cannot be mounted, e.g., system_other
+# is wiped, but cppreopts.sh still runs.
+dontaudit cppreopts postinstall_mnt_dir:dir search;
+#line 1 "system/sepolicy/private/crash_dump.te"
+typeattribute crash_dump coredomain;
+
+# Crash dump does not need to access devices passed across exec().
+dontaudit crash_dump { devpts dev_type }:chr_file { read write };
+
+allow crash_dump {
+ domain
+ -apexd
+ -bpfloader
+ -crash_dump
+ -init
+ -kernel
+ -keystore
+ -llkd
+ -logd
+ -ueventd
+ -vendor_init
+ -vold
+}:process { ptrace signal sigchld sigstop sigkill };
+
+#line 23
+
+
+# Read ART APEX data directory
+allow crash_dump apex_art_data_file:dir { getattr search };
+allow crash_dump apex_art_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow crash dump to read bootstrap libraries
+allow crash_dump system_bootstrap_lib_file:dir { getattr search };
+allow crash_dump system_bootstrap_lib_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read Vendor APEX directories
+allow crash_dump vendor_apex_metadata_file:dir { getattr search };
+
+# crash_dump might inherit CAP_SYS_PTRACE from a privileged process,
+# which will result in an audit log even when it's allowed to trace.
+dontaudit crash_dump self:{ capability cap_userns } { sys_ptrace };
+
+#line 45
+
+
+# Use inherited file descriptors
+allow crash_dump domain:fd use;
+
+# Read/write IPC pipes inherited from crashing processes.
+allow crash_dump domain:fifo_file { read write };
+
+# Append to pipes given to us by processes requesting dumps (e.g. dumpstate)
+allow crash_dump domain:fifo_file { append };
+
+# Read information from /proc/$PID.
+allow crash_dump domain:process getattr;
+
+
+#line 59
+allow crash_dump domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 59
+allow crash_dump domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 59
+
+allow crash_dump exec_type:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /data/dalvik-cache.
+allow crash_dump dalvikcache_data_file:dir { search getattr };
+allow crash_dump dalvikcache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read APEX data directories.
+allow crash_dump apex_module_data_file:dir { getattr search };
+
+# Read uptime
+allow crash_dump proc_uptime:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read APK files.
+
+#line 73
+allow crash_dump apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 73
+allow crash_dump apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 73
+;
+
+# Read all /vendor
+
+#line 76
+allow crash_dump { vendor_file same_process_hal_file }:dir { open getattr read search ioctl lock watch watch_reads };
+#line 76
+allow crash_dump { vendor_file same_process_hal_file }:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 76
+
+
+# Read all /data/local/tests
+
+#line 79
+allow crash_dump shell_test_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 79
+allow crash_dump shell_test_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 79
+
+
+# Talk to tombstoned
+
+#line 82
+allow crash_dump tombstoned_crash_socket:sock_file write;
+#line 82
+allow crash_dump tombstoned:unix_stream_socket connectto;
+#line 82
+
+
+# Talk to ActivityManager.
+
+#line 85
+allow crash_dump system_ndebug_socket:sock_file write;
+#line 85
+allow crash_dump system_server:unix_stream_socket connectto;
+#line 85
+
+
+# Append to ANR files.
+allow crash_dump anr_data_file:file { append getattr };
+
+# Append to tombstone files.
+allow crash_dump tombstone_data_file:file { append getattr };
+
+# crash_dump writes out logcat logs at the bottom of tombstones,
+# which is super useful in some cases.
+
+#line 95
+allow crash_dump logdr_socket:sock_file write;
+#line 95
+allow crash_dump logd:unix_stream_socket connectto;
+#line 95
+
+
+# Crash dump is not intended to access the following files. Since these
+# are WAI, suppress the denials to clean up the logs.
+dontaudit crash_dump {
+ core_data_file_type
+ vendor_file_type
+}:dir search;
+# Crash dump might try to read files that are mapped into the crashed process's
+# memory space to extract useful binary information such as the ELF header. See
+# system/core/debuggerd/libdebuggerd/tombstone_proto.cpp:dump_mappings.
+# Ignore these accesses.
+dontaudit crash_dump {
+ app_data_file_type
+ property_type
+ system_data_file
+}:{ lnk_file file } { read open };
+
+
+#line 113
+allow crash_dump misctrl_prop:file { getattr open read map };
+#line 113
+
+
+###
+### neverallow assertions
+###
+
+# A domain transition must occur for crash_dump to get the privileges needed to trace the process.
+# Do not allow the execution of crash_dump without a domain transition.
+neverallow domain crash_dump_exec:file execute_no_trans;
+
+# sigchld not explicitly forbidden since it's part of the
+# domain-transition-on-exec macros, and is by itself not sensitive
+neverallow crash_dump {
+ apexd
+
+ bpfloader
+ init
+ kernel
+ keystore
+ llkd
+
+ logd
+
+ ueventd
+ vendor_init
+ vold
+
+}:process { ptrace signal sigstop sigkill };
+
+neverallow crash_dump self:process ptrace;
+neverallow crash_dump gpu_device:chr_file *;
+#line 1 "system/sepolicy/private/credstore.te"
+typeattribute credstore coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init credstore_exec:file { getattr open read execute map };
+#line 3
+allow init credstore:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow credstore credstore_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init credstore:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init credstore:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init credstore_exec:process credstore;
+#line 3
+
+#line 3
+
+
+# talk to Identity Credential
+
+#line 6
+typeattribute credstore halclientdomain;
+#line 6
+typeattribute credstore hal_identity_client;
+#line 6
+
+#line 6
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 6
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 6
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 6
+
+#line 6
+typeattribute credstore hal_identity;
+#line 6
+# Find passthrough HAL implementations
+#line 6
+allow hal_identity system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_identity vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_identity vendor_file:file { read open getattr execute map };
+#line 6
+
+#line 6
+
+
+# talk to keymint, specifically for IRemotelyProvisionedComponent/default
+
+#line 9
+typeattribute credstore halclientdomain;
+#line 9
+typeattribute credstore hal_keymint_client;
+#line 9
+
+#line 9
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 9
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 9
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 9
+
+#line 9
+typeattribute credstore hal_keymint;
+#line 9
+# Find passthrough HAL implementations
+#line 9
+allow hal_keymint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_keymint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_keymint vendor_file:file { read open getattr execute map };
+#line 9
+
+#line 9
+
+
+# credstore needs to get keys from the RKPD
+
+#line 12
+allow credstore remote_prov_prop:file { getattr open read map };
+#line 12
+
+allow credstore remote_provisioning_service:service_manager find;
+
+
+#line 15
+# Call the servicemanager and transfer references to it.
+#line 15
+allow credstore servicemanager:binder { call transfer };
+#line 15
+# Allow servicemanager to send out callbacks
+#line 15
+allow servicemanager credstore:binder { call transfer };
+#line 15
+# servicemanager performs getpidcon on clients.
+#line 15
+allow servicemanager credstore:dir search;
+#line 15
+allow servicemanager credstore:file { read open };
+#line 15
+allow servicemanager credstore:process getattr;
+#line 15
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 15
+# all domains in domain.te.
+#line 15
+
+
+#line 16
+typeattribute credstore binderservicedomain;
+#line 16
+
+
+#line 17
+# Call the server domain and optionally transfer references to it.
+#line 17
+allow credstore system_server:binder { call transfer };
+#line 17
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 17
+allow system_server credstore:binder transfer;
+#line 17
+# Receive and use open files from the server.
+#line 17
+allow credstore system_server:fd use;
+#line 17
+
+
+allow credstore credstore_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow credstore credstore_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 22
+ allow credstore credstore_service:service_manager { add find };
+#line 22
+ neverallow { domain -credstore } credstore_service:service_manager add;
+#line 22
+
+#line 22
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 22
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 22
+
+#line 22
+
+allow credstore sec_key_att_app_id_provider_service:service_manager find;
+allow credstore dropbox_service:service_manager find;
+allow credstore authorization_service:service_manager find;
+allow credstore keystore:keystore2 get_auth_token;
+
+
+#line 28
+allow credstore cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 28
+allow credstore cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 28
+
+
+#line 29
+allow credstore cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 29
+allow credstore cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 29
+
+#line 3 "system/sepolicy/private/crosvm.te"
+
+
+type crosvm_exec, system_file_type, exec_type, file_type;
+type crosvm_tmpfs, file_type;
+
+# Let crosvm open VM manager devices such as /dev/kvm.
+allow crosvm vm_manager_device_type:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Most other domains shouldn't access /dev/kvm.
+neverallow { domain -crosvm -ueventd -shell } kvm_device:chr_file getattr;
+neverallow { domain -crosvm -ueventd } kvm_device:chr_file ~getattr;
+neverallowxperm { domain -crosvm } kvm_device:chr_file ioctl ~{ 0x0000ae03 };
+
+# Most other domains shouldn't access other vm managers either.
+# These restrictions need to be slightly looser than for kvm_device to allow
+# for different implementations.
+neverallow { coredomain appdomain -crosvm -ueventd -shell } vm_manager_device_type:chr_file getattr;
+neverallow { coredomain appdomain -crosvm -ueventd } vm_manager_device_type:chr_file ~getattr;
+
+# Let crosvm create temporary files.
+
+#line 23
+type_transition crosvm tmpfs:file crosvm_tmpfs;
+#line 23
+allow crosvm crosvm_tmpfs:file { read write getattr map };
+#line 23
+
+
+# Let crosvm receive file descriptors from VirtualizationService.
+allow crosvm {
+ virtualizationmanager
+ early_virtmgr
+}:fd use;
+
+# Allow sending VirtualizationService the failure reason and console/log from the VM via pipe.
+allow crosvm {
+ virtualizationmanager
+ early_virtmgr
+}:fifo_file write;
+
+# Let crosvm read the composite disk images (virtualizationservice_data_file), APEXes
+# (staging_data_file), APKs (apk_data_file and shell_data_file where the latter is for test apks in
+# /data/local/tmp), instance.img (app_data_file), and microdroid vendor image (vendor_microdroid_file).
+# Allow crosvm to read the instance image of the service VM saved in apex_virt_data_file.
+# Note that the open permission is not given as the files are passed as file descriptors.
+allow crosvm {
+ virtualizationservice_data_file
+ staging_data_file
+ apk_data_file
+ app_data_file
+ privapp_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ shell_data_file
+ vendor_microdroid_file
+ vm_data_file
+}:file { getattr read ioctl lock };
+
+# Allow searching the directory where the composite disk images are.
+allow crosvm {
+ virtualizationservice_data_file
+ vm_data_file
+}:dir search;
+
+# When running a VM as root we get spurious capability denials.
+# Suppress them.
+#line 65
+
+
+# Allow crosvm to tune for performance.
+allow crosvm self:{ capability cap_userns } sys_nice;
+
+# Let crosvm access its control socket as created by VS.
+# read, write, getattr: listener socket polling
+# accept: listener socket accepting new connection
+# Note that the open permission is not given as the socket is passed by FD.
+allow crosvm {
+ virtualizationmanager
+ early_virtmgr
+}:unix_stream_socket { accept read write getattr getopt };
+
+# Let crosvm open test artifacts under /data/local/tmp with file path. (e.g. custom pvmfw.img)
+#line 83
+
+
+# The instance image and the composite image should be writable as well because they could represent
+# mutable disks.
+allow crosvm {
+ virtualizationservice_data_file
+ app_data_file
+ privapp_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ vm_data_file
+}:file write;
+
+# Allow crosvm to pipe console log to shell or app which could be the owner of a VM.
+allow crosvm adbd:fd use;
+allow crosvm adbd:unix_stream_socket { read write };
+allow crosvm devpts:chr_file { read write getattr ioctl };
+
+
+#line 101
+ # Allow crosvm to draw screen in the surface
+#line 101
+ allow crosvm device:dir { read open };
+#line 101
+ allow crosvm same_process_hal_file:file { read open getattr map execute };
+#line 101
+ allow crosvm gpu_device:chr_file { read write open ioctl map open getattr };
+#line 101
+ allow crosvm hal_graphics_allocator:fd use;
+#line 101
+ allow crosvm hal_graphics_allocator_server:binder call;
+#line 101
+ allow crosvm surfaceflinger:fd use;
+#line 101
+
+#line 101
+typeattribute crosvm halclientdomain;
+#line 101
+typeattribute crosvm hal_graphics_allocator_client;
+#line 101
+
+#line 101
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 101
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 101
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 101
+
+#line 101
+typeattribute crosvm hal_graphics_allocator;
+#line 101
+# Find passthrough HAL implementations
+#line 101
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 101
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 101
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 101
+
+#line 101
+
+#line 101
+
+#line 101
+ # To provide display service to an app to get surface.
+#line 101
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+#line 101
+ allow crosvm vmlauncher_app:binder { transfer call };
+#line 101
+ allow crosvm servicemanager:binder { call transfer };
+#line 101
+ allow crosvm virtualization_service:service_manager find;
+#line 101
+ allow crosvm virtualizationservice:binder { call transfer };
+#line 101
+
+#line 101
+ # Allow crosvm to play sound.
+#line 101
+
+#line 101
+# Call the server domain and optionally transfer references to it.
+#line 101
+allow crosvm audioserver:binder { call transfer };
+#line 101
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 101
+allow audioserver crosvm:binder transfer;
+#line 101
+# Receive and use open files from the server.
+#line 101
+allow crosvm audioserver:fd use;
+#line 101
+
+#line 101
+ allow crosvm audioserver_service:service_manager find;
+#line 101
+
+#line 101
+ # Allow crosvm to mount fuse path in guest VM through virtiofs
+#line 101
+ allow crosvm fuse:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 101
+ allow crosvm fuse:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+#line 101
+ allow crosvm mnt_user_file:dir search;
+#line 101
+
+#line 101
+ # Allow crosvm to create unix socket for vhost-user-fs
+#line 101
+ allow crosvm virtualizationservice_data_file:dir { add_name write remove_name };
+#line 101
+ allow crosvm virtualizationservice_data_file:sock_file { create write unlink };
+#line 130
+
+
+# crosvm tries to use netlink sockets as part its APCI implementation, but we don't need it for AVF (b/228077254)
+dontaudit crosvm self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# crosvm can write files in /data/local/tmp which are usually used for instance.img and logging by
+# compliance tests and demo apps. Write access to instance.img is particularily important because
+# the VM has to initialize the disk image on its first boot. Note that open access is still not
+# granted because the files are expected to be opened by the owner of the VM (apps or shell in case
+# when the vm is created by the `vm` tool) and handed over to crosvm as FD.
+allow crosvm shell_data_file:file write;
+
+# crosvm tries to read serial device, including the write-only pipe from virtualizationmanager (to
+# forward console/log to the host logcat).
+# crosvm only needs write permission, so dontaudit read
+dontaudit crosvm {
+ virtualizationmanager
+ early_virtmgr
+}:fifo_file { read getattr };
+
+# Required for crosvm to start gdb-server to enable debugging of guest kernel.
+allow crosvm self:tcp_socket { bind create read setopt write accept listen };
+allow crosvm port:tcp_socket name_bind;
+allow crosvm adbd:unix_stream_socket ioctl;
+allow crosvm node:tcp_socket node_bind;
+
+# Allow crosvm to interact to VFIO device
+allow crosvm vfio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow crosvm vfio_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow crosvm to access VM DTBO via a file created by virtualizationmanager.
+allow crosvm virtualizationservice_data_file:file read;
+
+
+#line 163
+ # Allow crosvm to deal with file descriptors of TAP interfaces.
+#line 163
+ allow crosvm tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 163
+ allowxperm crosvm tun_device:chr_file ioctl { 0x800454d2 0x400454d0 0x400454d8 };
+#line 163
+ allow crosvm self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+#line 163
+ allowxperm crosvm self:udp_socket ioctl 0x00008921;
+#line 163
+ allow crosvm vmnic:fd use;
+#line 170
+
+
+# Early VMs may print messages to kmsg_debug_device.
+allow crosvm kmsg_debug_device:chr_file { open append write lock map };
+
+# Don't allow crosvm to open files that it doesn't own.
+# This is important because a malicious application could try to start a VM with a composite disk
+# image referring by name to files which it doesn't have permission to open, trying to get crosvm to
+# open them on its behalf. By preventing crosvm from opening any other files we prevent this
+# potential privilege escalation. See http://b/192453819 for more discussion.
+neverallow crosvm {
+ virtualizationservice_data_file
+ staging_data_file
+ apk_data_file
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+ vm_data_file
+
+}:file open;
+
+# Don't allow crosvm to have access to ordinary vendor files that are not for VMs.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 192
+
+#line 192
+ neverallow crosvm {
+#line 192
+ vendor_file_type
+#line 192
+ -vendor_vm_file
+#line 192
+ -vendor_vm_data_file
+#line 192
+ # These types are not required for crosvm, but the access is granted to globally in domain.te
+#line 192
+ # thus should be exempted here.
+#line 192
+ -vendor_cgroup_desc_file
+#line 192
+ -vendor_configs_file
+#line 192
+ -vendor_microdroid_file
+#line 192
+ -vndk_sp_file
+#line 192
+ -vendor_task_profiles_file
+#line 192
+ -same_process_hal_file
+#line 192
+ }:file *;
+#line 192
+
+#line 192
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 206
+
+
+# Only allow crosvm to read app data files for clients that can start
+# VMs. Note that the use of app data files is further restricted
+# inside the virtualizationservice by checking the label of all disk
+# image files.
+neverallow crosvm {
+ app_data_file_type
+ -app_data_file
+ -privapp_data_file
+ -shell_data_file
+}:file read;
+
+# Only virtualizationmanager can run crosvm
+# Allow vmlauncher app to launch crosvm for virtiofs
+neverallow {
+ domain
+ -crosvm
+ -virtualizationmanager
+ -vmlauncher_app
+
+ -early_virtmgr
+} crosvm_exec:file { execute execute_no_trans };
+#line 1 "system/sepolicy/private/derive_classpath.te"
+
+# Domain for derive_classpath
+type derive_classpath, domain, coredomain, artd_subprocess_type;
+type derive_classpath_exec, system_file_type, exec_type, file_type;
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init derive_classpath_exec:file { getattr open read execute map };
+#line 5
+allow init derive_classpath:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow derive_classpath derive_classpath_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init derive_classpath:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init derive_classpath:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init derive_classpath_exec:process derive_classpath;
+#line 5
+
+#line 5
+
+
+# Read /apex
+allow derive_classpath apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow derive_classpath vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Create /data/system/environ/classpath file
+allow derive_classpath environ_system_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow derive_classpath environ_system_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# b/183079517 fails on gphone targets otherwise
+allow derive_classpath unlabeled:dir search;
+
+# Allow derive_classpath to write the classpath into ota dexopt
+# - Read the ota's apex dir
+allow derive_classpath postinstall_apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+# - Report the BCP to the ota's dexopt
+allow derive_classpath postinstall_dexopt:dir search;
+allow derive_classpath postinstall_dexopt:fd use;
+allow derive_classpath postinstall_dexopt:file read;
+allow derive_classpath postinstall_dexopt:lnk_file read;
+allow derive_classpath postinstall_dexopt_tmpfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow to be called by artd in Pre-reboot Dexopt.
+allow derive_classpath artd:fd use;
+
+# Allow writing to Pre-reboot Dexopt temp files.
+allow derive_classpath pre_reboot_dexopt_artd_file:file { open read write };
+#line 1 "system/sepolicy/private/derive_sdk.te"
+
+# Domain for derive_sdk
+type derive_sdk, domain, coredomain;
+type derive_sdk_exec, system_file_type, exec_type, file_type;
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init derive_sdk_exec:file { getattr open read execute map };
+#line 5
+allow init derive_sdk:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow derive_sdk derive_sdk_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init derive_sdk:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init derive_sdk:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init derive_sdk_exec:process derive_sdk;
+#line 5
+
+#line 5
+
+
+# Read /apex
+allow derive_sdk apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow derive_sdk vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Prop rules: writable by derive_sdk, readable by bootclasspath (apps)
+
+#line 12
+
+#line 12
+allow derive_sdk property_socket:sock_file write;
+#line 12
+allow derive_sdk init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow derive_sdk module_sdkextensions_prop:property_service set;
+#line 12
+
+#line 12
+allow derive_sdk module_sdkextensions_prop:file { getattr open read map };
+#line 12
+
+#line 12
+
+neverallow { domain -init -derive_sdk } module_sdkextensions_prop:property_service set;
+
+# Allow derive_sdk to write data back to dumpstate when forked from dumpstate.
+# The shell_data_file permissions are needed when a bugreport is taken:
+# dumpstate will redirect its stdout to a temporary shell_data_file:file, and
+# this makes derive_sdk append to that file.
+allow derive_sdk dumpstate:fd use;
+allow derive_sdk dumpstate:unix_stream_socket { read write };
+allow derive_sdk shell_data_file:file { getattr append read write };
+#line 1 "system/sepolicy/private/device_as_webcam.te"
+# Domain for DeviceAsWebcam Service
+type device_as_webcam, domain, coredomain, mlstrustedsubject;
+
+
+#line 4
+typeattribute device_as_webcam appdomain;
+#line 4
+# Label tmpfs objects for all apps.
+#line 4
+type_transition device_as_webcam tmpfs:file appdomain_tmpfs;
+#line 4
+
+#line 4
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 4
+type device_as_webcam_userfaultfd;
+#line 4
+type_transition device_as_webcam device_as_webcam:anon_inode device_as_webcam_userfaultfd "[userfaultfd]";
+#line 4
+# Allow domain to create/use userfaultfd anon_inode.
+#line 4
+allow device_as_webcam device_as_webcam_userfaultfd:anon_inode { create ioctl read };
+#line 4
+# Suppress errors generate during bugreport
+#line 4
+dontaudit su device_as_webcam_userfaultfd:anon_inode *;
+#line 4
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 4
+neverallow { domain -device_as_webcam } device_as_webcam_userfaultfd:anon_inode *;
+#line 4
+
+#line 4
+allow device_as_webcam appdomain_tmpfs:file { execute getattr map read write };
+#line 4
+neverallow { device_as_webcam -runas_app -shell -simpleperf } { domain -device_as_webcam }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 4
+neverallow { appdomain -runas_app -shell -simpleperf -device_as_webcam } device_as_webcam:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 4
+# The Android security model guarantees the confidentiality and integrity
+#line 4
+# of application data and execution state. Ptrace bypasses those
+#line 4
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 4
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 4
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 4
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 4
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 4
+# live lock conditions.
+#line 4
+neverallow { domain -device_as_webcam -crash_dump -runas_app -simpleperf } device_as_webcam:process ptrace;
+#line 4
+
+
+allow device_as_webcam system_app_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow device_as_webcam system_app_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow device_as_webcam { app_api_service cameraserver_service }:service_manager find;
+
+# Allow DeviceAsWebcam Service needs to access ro.usb.uvc.enabled property to
+# enale/disable itself
+
+#line 13
+allow device_as_webcam usb_uvc_enabled_prop:file { getattr open read map };
+#line 13
+
+
+# need to access /dev to list all devices
+allow device_as_webcam device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# UVC nodes are mounted as V4L2 nodes (/dev/video*) on the device. These need to
+# be accessed by the DeviceAsWebcam Service.
+allow device_as_webcam video_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow device_as_webcam video_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/dex2oat.te"
+# dex2oat
+type dex2oat, domain, coredomain, artd_subprocess_type;
+type dex2oat_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 5
+type dex2oat_userfaultfd;
+#line 5
+type_transition dex2oat dex2oat:anon_inode dex2oat_userfaultfd "[userfaultfd]";
+#line 5
+# Allow domain to create/use userfaultfd anon_inode.
+#line 5
+allow dex2oat dex2oat_userfaultfd:anon_inode { create ioctl read };
+#line 5
+# Suppress errors generate during bugreport
+#line 5
+dontaudit su dex2oat_userfaultfd:anon_inode *;
+#line 5
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 5
+neverallow { domain -dex2oat } dex2oat_userfaultfd:anon_inode *;
+#line 5
+
+
+
+#line 7
+allow dex2oat apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 7
+allow dex2oat apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 7
+
+# Access to /vendor/app
+
+#line 9
+allow dex2oat vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow dex2oat vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 9
+
+# Access /vendor/framework
+allow dex2oat vendor_framework_file:dir { getattr search };
+allow dex2oat vendor_framework_file:file { getattr open read map };
+# Access /vendor/overlay
+
+#line 14
+allow dex2oat vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 14
+allow dex2oat vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 14
+;
+# Vendor overlay can be found in vendor apex
+allow dex2oat vendor_apex_metadata_file:dir { getattr search };
+
+allow dex2oat tmpfs:file { read getattr map };
+
+
+#line 20
+allow dex2oat dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow dex2oat dalvikcache_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+allow dex2oat dalvikcache_data_file:file write;
+
+# Acquire advisory lock on /system/framework/arm/*
+allow dex2oat system_file:file lock;
+allow dex2oat postinstall_file:file lock;
+
+# Read already open asec_apk_file file descriptors passed by installd.
+# Also allow reading unlabeled files, to allow for upgrading forward
+# locked APKs.
+allow dex2oat asec_apk_file:file { read map };
+allow dex2oat unlabeled:file { read map };
+allow dex2oat oemfs:file { read map };
+allow dex2oat apk_tmp_file:dir search;
+allow dex2oat apk_tmp_file:file { getattr open read ioctl lock map watch watch_reads };
+allow dex2oat user_profile_data_file:file { getattr read lock map };
+
+# Allow dex2oat to compile app's secondary dex files which were reported back to
+# the framework.
+allow dex2oat { privapp_data_file app_data_file }:file { getattr read write lock map };
+
+# Allow dex2oat to find files and directories under /data/misc/apexdata/com.android.runtime.
+allow dex2oat apex_module_data_file:dir search;
+
+# Allow dex2oat to use devpts passed from odsign.
+allow dex2oat odsign_devpts:chr_file { read write };
+
+# Allow dex2oat to write to file descriptors from odrefresh for files
+# in the staging area.
+allow dex2oat apex_art_staging_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dex2oat apex_art_staging_data_file:file { getattr map read write unlink };
+
+# Allow dex2oat to read artifacts from odrefresh.
+allow dex2oat apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dex2oat apex_art_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dex2oat to read runtime native flag properties.
+
+#line 57
+allow dex2oat device_config_runtime_native_prop:file { getattr open read map };
+#line 57
+
+
+#line 58
+allow dex2oat device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 58
+
+
+# Allow dex2oat to read /apex/apex-info-list.xml
+allow dex2oat apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dex2oat to use file descriptors passed from privileged programs.
+allow dex2oat { artd installd odrefresh odsign }:fd use;
+
+# Allow dex2oat to read the /proc filesystem for CPU features, etc.
+allow dex2oat proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+##################
+# A/B OTA Dexopt #
+##################
+
+# Allow dex2oat to use file descriptors from otapreopt.
+allow dex2oat postinstall_dexopt:fd use;
+
+# Allow dex2oat to read files under /postinstall (e.g. APKs under /system, /system/bin/linker).
+allow dex2oat postinstall_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dex2oat postinstall_file:filesystem getattr;
+allow dex2oat postinstall_file:lnk_file { getattr read };
+allow dex2oat postinstall_file:file read;
+# Allow dex2oat to use libraries under /postinstall/system (e.g. /system/lib/libc.so).
+# TODO(b/120266448): Remove when Bionic libraries are part of the Runtime APEX.
+allow dex2oat postinstall_file:file { execute getattr open };
+
+# Allow dex2oat access to /postinstall/apex.
+allow dex2oat postinstall_apex_mnt_dir:dir { getattr search };
+allow dex2oat postinstall_apex_mnt_dir:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dex2oat access to files in /data/ota.
+allow dex2oat ota_data_file:dir { { open getattr read search ioctl lock watch watch_reads } add_name write };
+allow dex2oat ota_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Create and read symlinks in /data/ota/dalvik-cache. This is required for PIC mode boot images,
+# where the oat file is symlinked to the original file in /system.
+allow dex2oat ota_data_file:lnk_file { create read };
+
+# It would be nice to tie this down, but currently, because of how images are written, we can't
+# pass file descriptors for the preopted boot image to dex2oat. So dex2oat needs to be able to
+# create them itself (and make them world-readable).
+allow dex2oat ota_data_file:file { create { open append write lock map } setattr };
+
+###############
+# APEX Update #
+###############
+
+# /dev/zero is inherited.
+allow dex2oat apexd:fd use;
+
+# Allow dex2oat to use file descriptors from preinstall.
+
+##############
+# Neverallow #
+##############
+
+neverallow dex2oat app_data_file_type:{ file lnk_file sock_file fifo_file } open;
+#line 1 "system/sepolicy/private/dexopt_chroot_setup.te"
+# A service that sets up the chroot environment for Pre-reboot Dexopt.
+type dexopt_chroot_setup, domain, coredomain;
+type dexopt_chroot_setup_exec, system_file_type, exec_type, file_type;
+type dexopt_chroot_setup_tmpfs, file_type;
+
+# Allow dexopt_chroot_setup to publish a binder service and make binder calls.
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow dexopt_chroot_setup servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager dexopt_chroot_setup:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager dexopt_chroot_setup:dir search;
+#line 7
+allow servicemanager dexopt_chroot_setup:file { read open };
+#line 7
+allow servicemanager dexopt_chroot_setup:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+ allow dexopt_chroot_setup dexopt_chroot_setup_service:service_manager { add find };
+#line 8
+ neverallow { domain -dexopt_chroot_setup } dexopt_chroot_setup_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+allow dexopt_chroot_setup dumpstate:fifo_file { getattr write };
+allow dexopt_chroot_setup dumpstate:fd use;
+
+
+#line 12
+
+#line 12
+# Allow the necessary permissions.
+#line 12
+
+#line 12
+# Old domain may exec the file and transition to the new domain.
+#line 12
+allow init dexopt_chroot_setup_exec:file { getattr open read execute map };
+#line 12
+allow init dexopt_chroot_setup:process transition;
+#line 12
+# New domain is entered by executing the file.
+#line 12
+allow dexopt_chroot_setup dexopt_chroot_setup_exec:file { entrypoint open read execute getattr map };
+#line 12
+# New domain can send SIGCHLD to its caller.
+#line 12
+
+#line 12
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 12
+dontaudit init dexopt_chroot_setup:process noatsecure;
+#line 12
+# XXX dontaudit candidate but requires further study.
+#line 12
+allow init dexopt_chroot_setup:process { siginh rlimitinh };
+#line 12
+
+#line 12
+# Make the transition occur by default.
+#line 12
+type_transition init dexopt_chroot_setup_exec:process dexopt_chroot_setup;
+#line 12
+
+#line 12
+
+
+# Use tmpfs_domain() which will give tmpfs files created by dexopt_chroot_setup
+# their own label, which differs from other labels created by other processes.
+# This allows to distinguish in policy files created by dexopt_chroot_setup vs
+# other processes.
+
+#line 18
+type_transition dexopt_chroot_setup tmpfs:file dexopt_chroot_setup_tmpfs;
+#line 18
+allow dexopt_chroot_setup dexopt_chroot_setup_tmpfs:file { read write getattr map };
+#line 18
+
+
+# libart (mark_compact.cc) has some intialization code that touches the cache
+# info file and userfaultfd.
+allow dexopt_chroot_setup apex_module_data_file:dir { getattr search };
+
+#line 23
+allow dexopt_chroot_setup apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 23
+allow dexopt_chroot_setup apex_art_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 23
+
+
+#line 24
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 24
+type dexopt_chroot_setup_userfaultfd;
+#line 24
+type_transition dexopt_chroot_setup dexopt_chroot_setup:anon_inode dexopt_chroot_setup_userfaultfd "[userfaultfd]";
+#line 24
+# Allow domain to create/use userfaultfd anon_inode.
+#line 24
+allow dexopt_chroot_setup dexopt_chroot_setup_userfaultfd:anon_inode { create ioctl read };
+#line 24
+# Suppress errors generate during bugreport
+#line 24
+dontaudit su dexopt_chroot_setup_userfaultfd:anon_inode *;
+#line 24
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 24
+neverallow { domain -dexopt_chroot_setup } dexopt_chroot_setup_userfaultfd:anon_inode *;
+#line 24
+
+
+# Allow getting root capabilities to bypass permission checks.
+# - "sys_admin" is for performing mount and umount.
+# - "sys_chroot" is for performing chroot.
+allow dexopt_chroot_setup self:{ capability cap_userns } { sys_admin sys_chroot };
+
+# Allow managing its own files.
+# The root of the temp dir that dexopt_chroot_setup uses is labeled
+# pre_reboot_dexopt_file.
+allow dexopt_chroot_setup pre_reboot_dexopt_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow dexopt_chroot_setup pre_reboot_dexopt_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow accessing /proc/filesystems.
+allow dexopt_chroot_setup proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow accessing block devices (/dev/block/...).
+allow dexopt_chroot_setup block_device:dir { getattr search };
+
+# Allow mounting file systems, to create a chroot environment.
+# We recursively bind-mount directories under /data, /mnt/expand, /proc, /sys,
+# and /dev. We need some of them (e.g., incremental-fs directories for
+# incremental apps in /data; /dev/cpuctl and /dev/blkio for task profiles), but
+# not necessarily all of them. However, to avoid random crashes and silent
+# fallbacks, we bind-mount all of them. Therefore, we need access to many of the
+# fstypes.
+
+allow dexopt_chroot_setup {
+ apex_mnt_dir
+ apk_data_file
+ binderfs
+ binfmt_miscfs
+ cgroup
+ cgroup_v2
+
+ debugfs_tracing_debug
+ device
+ devpts
+ fs_bpf
+ functionfs
+ fusectlfs
+ linkerconfig_file
+ metadata_file
+ mnt_expand_file
+ pre_reboot_dexopt_file
+ proc
+ pstorefs
+ rootfs
+ selinuxfs
+ sysfs
+ system_data_file
+ system_data_root_file
+ system_file
+ system_lib_file
+ tmpfs
+ vendor_configs_file
+ vendor_file
+}:dir mounton;
+
+allow dexopt_chroot_setup { tmpfs labeledfs }:filesystem mount;
+
+allow dexopt_chroot_setup {
+ binderfs
+ binfmt_miscfs
+ cgroup
+ cgroup_v2
+
+ debugfs_tracing_debug
+ devpts
+ fs_bpf
+ functionfs
+ fusectlfs
+ labeledfs
+ proc
+ pstorefs
+ selinuxfs
+ sysfs
+ tmpfs
+}:filesystem unmount;
+
+# Allow reading /apex in chroot.
+
+#line 105
+allow dexopt_chroot_setup apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 105
+allow dexopt_chroot_setup apex_mnt_dir:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 105
+
+allow dexopt_chroot_setup apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow writing an empty linker config in chroot to suppress linker warnings.
+# The empty linker config is used until linkerconfig has run.
+# In chroot, we're reusing the type outside the chroot, to reuse all the rules
+# for it for other domains, even though we're not changing the real linker
+# config outside the chroot.
+allow dexopt_chroot_setup linkerconfig_file:dir { write add_name };
+allow dexopt_chroot_setup linkerconfig_file:file { create write };
+
+# Allow using the `rootcontext=` option when mounting tmpfs, so we can give the
+# right labels to /apex, /linkerconfig, /mnt/artd_tmp in chroot.
+# Combined with `allow file_type tmpfs:filesystem associate;`, this allows
+# giving any labels to any tmpfs filesystems as soon as they are mounted.
+# Note that those tmpfs filesystems are known to be empty at the time where the
+# labels are given, and this rule doesn't allow relabeling any existing tmpfs.
+allow dexopt_chroot_setup tmpfs:filesystem relabelfrom;
+
+# Allow executing art_exec_exec without a domain transition because it is a thin
+# wrapper that executes other binaries on behalf of dexopt_chroot_setup. Domain
+# transition will take place as soon as art_exec_exec executes other binaries.
+allow dexopt_chroot_setup art_exec_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow running other binaries in their own domains.
+
+#line 130
+# Allow the necessary permissions.
+#line 130
+
+#line 130
+# Old domain may exec the file and transition to the new domain.
+#line 130
+allow dexopt_chroot_setup apexd_exec:file { getattr open read execute map };
+#line 130
+allow dexopt_chroot_setup apexd:process transition;
+#line 130
+# New domain is entered by executing the file.
+#line 130
+allow apexd apexd_exec:file { entrypoint open read execute getattr map };
+#line 130
+# New domain can send SIGCHLD to its caller.
+#line 130
+allow apexd dexopt_chroot_setup:process sigchld;
+#line 130
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 130
+dontaudit dexopt_chroot_setup apexd:process noatsecure;
+#line 130
+# XXX dontaudit candidate but requires further study.
+#line 130
+allow dexopt_chroot_setup apexd:process { siginh rlimitinh };
+#line 130
+
+#line 130
+# Make the transition occur by default.
+#line 130
+type_transition dexopt_chroot_setup apexd_exec:process apexd;
+#line 130
+
+
+#line 131
+# Allow the necessary permissions.
+#line 131
+
+#line 131
+# Old domain may exec the file and transition to the new domain.
+#line 131
+allow dexopt_chroot_setup linkerconfig_exec:file { getattr open read execute map };
+#line 131
+allow dexopt_chroot_setup linkerconfig:process transition;
+#line 131
+# New domain is entered by executing the file.
+#line 131
+allow linkerconfig linkerconfig_exec:file { entrypoint open read execute getattr map };
+#line 131
+# New domain can send SIGCHLD to its caller.
+#line 131
+allow linkerconfig dexopt_chroot_setup:process sigchld;
+#line 131
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 131
+dontaudit dexopt_chroot_setup linkerconfig:process noatsecure;
+#line 131
+# XXX dontaudit candidate but requires further study.
+#line 131
+allow dexopt_chroot_setup linkerconfig:process { siginh rlimitinh };
+#line 131
+
+#line 131
+# Make the transition occur by default.
+#line 131
+type_transition dexopt_chroot_setup linkerconfig_exec:process linkerconfig;
+#line 131
+
+
+# Allow running snapshotctl through init, to map and unmap block devices.
+
+#line 134
+
+#line 134
+allow dexopt_chroot_setup property_socket:sock_file write;
+#line 134
+allow dexopt_chroot_setup init:unix_stream_socket connectto;
+#line 134
+
+#line 134
+allow dexopt_chroot_setup snapshotctl_prop:property_service set;
+#line 134
+
+#line 134
+allow dexopt_chroot_setup snapshotctl_prop:file { getattr open read map };
+#line 134
+
+#line 134
+
+
+# Allow accessing /data/app/..., to bind-mount dirs for incremental apps.
+allow dexopt_chroot_setup apk_data_file:dir { getattr search };
+
+# Neverallow rules.
+
+# Never allow running other binaries without a domain transition.
+# The exception for art_exec_exec is explained above.
+neverallow dexopt_chroot_setup ~{art_exec_exec}:file execute_no_trans;
+
+# Given how powerful this domain is, it shouldn't be used for other purposes.
+neverallow { domain -init } dexopt_chroot_setup:process transition;
+neverallow * dexopt_chroot_setup:process dyntransition;
+
+# Never allow other processes to access the temp dirs for Pre-reboot Dexopt.
+neverallow {
+ domain
+ -art_exec
+ -artd
+ -dexopt_chroot_setup
+ -init
+ -system_server
+ -vendor_init
+} pre_reboot_dexopt_file:dir *;
+#line 1 "system/sepolicy/private/dexoptanalyzer.te"
+# Deprecated file type for the legacy dexoptanalyzer binary, used by Android T-. We need to keep it
+# for compatibility because the file type is burnt into the apex image.
+type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
+#line 1 "system/sepolicy/private/dhcp.te"
+typeattribute dhcp coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init dhcp_exec:file { getattr open read execute map };
+#line 3
+allow init dhcp:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow dhcp dhcp_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init dhcp:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init dhcp:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init dhcp_exec:process dhcp;
+#line 3
+
+#line 3
+
+type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
+
+
+#line 6
+
+#line 6
+allow dhcp property_socket:sock_file write;
+#line 6
+allow dhcp init:unix_stream_socket connectto;
+#line 6
+
+#line 6
+allow dhcp dhcp_prop:property_service set;
+#line 6
+
+#line 6
+allow dhcp dhcp_prop:file { getattr open read map };
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+allow dhcp property_socket:sock_file write;
+#line 7
+allow dhcp init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow dhcp pan_result_prop:property_service set;
+#line 7
+
+#line 7
+allow dhcp pan_result_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+
+
+#line 9
+typeattribute dhcp netdomain;
+#line 9
+
+
+allow dhcp cgroup:dir { create write add_name };
+allow dhcp cgroup_v2:dir { create write add_name };
+allow dhcp self:{ capability cap_userns } { setgid setuid net_admin net_raw net_bind_service };
+allow dhcp self:packet_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow dhcp self:netlink_route_socket nlmsg_write;
+allow dhcp shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow dhcp system_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow dhcp vendor_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# dhcpcd runs dhcpcd-hooks/*, which runs getprop / setprop (toolbox_exec)
+allow dhcp toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# For /proc/sys/net/ipv4/conf/*/promote_secondaries
+allow dhcp proc_net_type:file write;
+
+allow dhcp dhcp_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow dhcp dhcp_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# PAN connections
+allow dhcp netd:fd use;
+allow dhcp netd:fifo_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow dhcp netd:{ { udp_socket unix_dgram_socket } unix_stream_socket } { read write };
+allow dhcp netd:{ netlink_kobject_uevent_socket netlink_route_socket netlink_nflog_socket } { read write };
+#line 1 "system/sepolicy/private/display_service_server.te"
+
+#line 1
+ allow display_service_server fwk_display_hwservice:hwservice_manager { add find };
+#line 1
+ allow display_service_server hidl_base_hwservice:hwservice_manager add;
+#line 1
+ neverallow { domain -display_service_server } fwk_display_hwservice:hwservice_manager add;
+#line 1
+
+#line 1 "system/sepolicy/private/dmesgd.te"
+type dmesgd, domain, coredomain;
+type dmesgd_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init dmesgd_exec:file { getattr open read execute map };
+#line 4
+allow init dmesgd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow dmesgd dmesgd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init dmesgd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init dmesgd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init dmesgd_exec:process dmesgd;
+#line 4
+
+#line 4
+
+
+allow dmesgd dmesgd_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow dmesgd dmesgd_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow dmesgd kernel:system syslog_read;
+allow dmesgd shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow dmesgd toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 12
+# Call the servicemanager and transfer references to it.
+#line 12
+allow dmesgd servicemanager:binder { call transfer };
+#line 12
+# Allow servicemanager to send out callbacks
+#line 12
+allow servicemanager dmesgd:binder { call transfer };
+#line 12
+# servicemanager performs getpidcon on clients.
+#line 12
+allow servicemanager dmesgd:dir search;
+#line 12
+allow servicemanager dmesgd:file { read open };
+#line 12
+allow servicemanager dmesgd:process getattr;
+#line 12
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 12
+# all domains in domain.te.
+#line 12
+
+
+#line 13
+# Call the server domain and optionally transfer references to it.
+#line 13
+allow dmesgd system_server:binder { call transfer };
+#line 13
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 13
+allow system_server dmesgd:binder transfer;
+#line 13
+# Receive and use open files from the server.
+#line 13
+allow dmesgd system_server:fd use;
+#line 13
+
+allow dmesgd dropbox_service:service_manager find;
+allow dmesgd proc_version:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/dnsmasq.te"
+typeattribute dnsmasq coredomain;
+
+
+#line 3
+typeattribute dnsmasq netdomain;
+#line 3
+
+allowxperm dnsmasq self:udp_socket ioctl
+#line 4
+{
+#line 4
+# qualcomm rmnet ioctls
+#line 4
+0x00006900 0x00006902
+#line 4
+# socket ioctls
+#line 4
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 4
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 4
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 4
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 4
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 4
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 4
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 4
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 4
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 4
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 4
+# device and protocol specific ioctls
+#line 4
+0x000089f0-0x000089ff
+#line 4
+0x000089e0-0x000089ef
+#line 4
+# Wireless extension ioctls
+#line 4
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 4
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 4
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 4
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 4
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 4
+0x00008b34 0x00008b35 0x00008b36
+#line 4
+# Dev private ioctl i.e. hardware specific ioctls
+#line 4
+0x00008be0-0x00008bff
+#line 4
+};
+
+# TODO: Run with dhcp group to avoid need for dac_override.
+allow dnsmasq self:{ capability cap_userns } { dac_override dac_read_search };
+
+allow dnsmasq self:{ capability cap_userns } { net_admin net_raw net_bind_service setgid setuid };
+
+allow dnsmasq dhcp_data_file:dir { open search write add_name remove_name lock };
+allow dnsmasq dhcp_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Inherit and use open files from netd.
+allow dnsmasq netd:fd use;
+allow dnsmasq netd:fifo_file { getattr read write };
+# TODO: Investigate whether these inherited sockets should be closed on exec.
+allow dnsmasq netd:netlink_kobject_uevent_socket { read write };
+allow dnsmasq netd:netlink_nflog_socket { read write };
+allow dnsmasq netd:netlink_route_socket { read write };
+allow dnsmasq netd:unix_stream_socket { getattr read write };
+allow dnsmasq netd:unix_dgram_socket { read write };
+allow dnsmasq netd:udp_socket { read write };
+#line 1 "system/sepolicy/private/domain.te"
+# Rules for all domains.
+
+# Allow reaping by init.
+allow domain init:process sigchld;
+
+# Intra-domain accesses.
+allow domain self:process {
+ fork
+ sigchld
+ sigkill
+ sigstop
+ signull
+ signal
+ getsched
+ setsched
+ getsession
+ getpgid
+ getcap
+ setcap
+ getattr
+ setrlimit
+};
+allow { domain -artd_subprocess_type } self:process setpgid;
+allow domain self:fd use;
+allow domain proc:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain proc_net_type:dir search;
+
+#line 27
+allow domain self:dir { open getattr read search ioctl lock watch watch_reads };
+#line 27
+allow domain self:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 27
+
+allow domain self:{ fifo_file file } { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain self:unix_dgram_socket { { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } } sendto };
+allow domain self:unix_stream_socket { { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } } connectto };
+
+# Inherit or receive open files from others.
+allow domain init:fd use;
+
+#line 52
+
+
+#line 58
+
+
+# Allow everyone to read aconfig flags
+
+#line 61
+allow domain device_config_aconfig_flags_prop:file { getattr open read map };
+#line 61
+;
+
+# Root fs.
+allow domain tmpfs:dir { getattr search };
+allow domain rootfs:dir search;
+allow domain rootfs:lnk_file { read getattr };
+
+# Device accesses.
+allow domain device:dir search;
+allow domain dev_type:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow domain devpts:dir search;
+allow domain dmabuf_heap_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain socket_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain owntty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain null_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain zero_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# /dev/ashmem is being deprecated by means of constraining and eventually
+# removing all "open" permissions. We preserve the other permissions.
+allow domain ashmem_device:chr_file { getattr read ioctl lock map append write };
+# This device is used by libcutils, which is accessible to everyone.
+allow domain ashmem_libcutils_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# /dev/binder can be accessed by ... everyone! :)
+allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+#line 86
+allow {domain -hwservicemanager -vndservicemanager } servicemanager_prop:file { getattr open read map };
+#line 86
+
+# Checking for the existance of the hwservicemanager binary is done in the client API
+# isHwServiceManagerInstalled
+dontaudit domain hwservicemanager_exec:file { getattr open read ioctl lock map watch watch_reads };
+
+
+# Restrict binder ioctls to an allowlist. Additional ioctl commands may be
+# added to individual domains, but this sets safe defaults for all processes.
+allowxperm domain binder_device:chr_file ioctl { {
+#line 94
+0xc0306201 0x40086203 0x40046205
+#line 94
+0x40046206 0x40046207 0x40046208
+#line 94
+0xc0046209 0xc018620b 0xc018620c
+#line 94
+0x4018620d 0x40046210
+#line 94
+0xc0486211
+#line 94
+} };
+
+# /dev/binderfs needs to be accessed by everyone too!
+allow domain binderfs:dir { getattr search };
+allow domain binderfs_logs_proc:dir search;
+allow domain binderfs_features:dir search;
+allow domain binderfs_features:file { getattr open read ioctl lock map watch watch_reads };
+
+allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain ptmx_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain random_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow domain proc_random:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain proc_random:file { getattr open read ioctl lock map watch watch_reads };
+allow domain properties_device:dir { search getattr };
+allow domain properties_serial:file { getattr open read ioctl lock map watch watch_reads };
+allow domain property_info:file { getattr open read ioctl lock map watch watch_reads };
+
+# Let everyone read log properties, so that liblog can avoid sending unloggable
+# messages to logd.
+
+#line 113
+allow domain log_property_type:file { getattr open read map };
+#line 113
+
+dontaudit domain property_type:file audit_access;
+allow domain property_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow domain init:key search;
+allow domain vold:key search;
+
+# logd access
+
+#line 121
+
+#line 121
+allow domain logdw_socket:sock_file write;
+#line 121
+allow domain logd:unix_dgram_socket sendto;
+#line 121
+
+#line 121
+allow domain pmsg_device:chr_file { open append write lock map };
+#line 121
+
+
+# Directory/link file access for path resolution.
+allow domain {
+ system_file
+ system_lib_file
+ system_seccomp_policy_file
+ system_security_cacerts_file
+}:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain system_file:lnk_file { getattr read };
+
+# Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*,
+# /(system|product|system_ext)/etc/(group|passwd), linker and its config.
+allow domain system_seccomp_policy_file:file { getattr open read ioctl lock map watch watch_reads };
+# cacerts are accessible from public Java API.
+allow domain system_security_cacerts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain system_group_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain system_passwd_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain system_linker_exec:file { execute read open getattr map };
+allow domain system_linker_config_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain system_lib_file:file { execute read open getattr map };
+# To allow following symlinks at /system/bin/linker, /system/lib/libc.so, etc.
+allow domain system_linker_exec:lnk_file { read open getattr };
+allow domain system_lib_file:lnk_file { read open getattr };
+
+allow domain system_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow { appdomain coredomain } system_file:file { execute read open getattr map };
+
+# Make sure system/vendor split doesn not affect non-treble
+# devices
+
+#line 152
+ allow domain system_file:file { execute read open getattr map };
+#line 152
+ allow domain vendor_file_type:dir { search getattr };
+#line 152
+ allow domain vendor_file_type:file { execute read open getattr map };
+#line 152
+ allow domain vendor_file_type:lnk_file { getattr read };
+#line 157
+
+
+# All domains are allowed to open and read directories
+# that contain HAL implementations (e.g. passthrough
+# HALs require clients to have these permissions)
+allow domain vendor_hal_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Everyone can read and execute all same process HALs
+allow domain same_process_hal_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow {
+ domain
+ -coredomain # access is explicitly granted to individual coredomains
+} same_process_hal_file:file { execute read open getattr map };
+
+# Any process can load vndk-sp libraries, which are system libraries
+# used by same process HALs
+allow domain vndk_sp_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain vndk_sp_file:file { execute read open getattr map };
+
+# All domains get access to /vendor/etc
+allow domain vendor_configs_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain vendor_configs_file:file { read open getattr map };
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 180
+
+#line 180
+ # Allow all domains to be able to follow /system/vendor and/or
+#line 180
+ # /vendor/odm symlinks.
+#line 180
+ allow domain vendor_file_type:lnk_file { getattr open read };
+#line 180
+
+#line 180
+ # This is required to be able to search & read /vendor/lib64
+#line 180
+ # in order to lookup vendor libraries. The execute permission
+#line 180
+ # for coredomains is granted *only* for same process HALs
+#line 180
+ allow domain vendor_file:dir { getattr search };
+#line 180
+
+#line 180
+ # Allow reading and executing out of /vendor to all vendor domains
+#line 180
+ allow { domain -coredomain } vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 180
+ allow { domain -coredomain } vendor_file_type:file { read open getattr execute map };
+#line 180
+ allow { domain -coredomain } vendor_file_type:lnk_file { getattr read };
+#line 180
+
+#line 180
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 194
+
+
+# read and stat any sysfs symlinks
+allow domain sysfs:lnk_file { getattr read };
+
+# libc references /system/usr/share/zoneinfo for timezone related information.
+# This directory is considered to be a VNDK-stable
+allow domain { system_zoneinfo_file }:file { getattr open read ioctl lock map watch watch_reads };
+allow domain { system_zoneinfo_file }:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Lots of processes access current CPU information
+
+#line 205
+allow domain sysfs_devices_system_cpu:dir { open getattr read search ioctl lock watch watch_reads };
+#line 205
+allow domain sysfs_devices_system_cpu:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 205
+
+
+
+#line 207
+allow domain sysfs_usb:dir { open getattr read search ioctl lock watch watch_reads };
+#line 207
+allow domain sysfs_usb:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 207
+;
+
+# If kernel CONFIG_TRANSPARENT_HUGEPAGE is enabled, libjemalloc5 (statically
+# included by libc) reads /sys/kernel/mm/transparent_hugepage/enabled.
+allow domain sysfs_transparent_hugepage:dir search;
+allow domain sysfs_transparent_hugepage:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow search access, and sometimes getattr access, to various directories
+# under /data. We are fairly lenient in allowing search access to top-level
+# dirs that commonly need to be traversed to get access to the "real" files, as
+# this greatly simplifies the policy and doesn't open up much attack surface.
+
+#line 218
+ allow domain system_data_file:dir getattr;
+#line 220
+
+allow { coredomain appdomain } system_data_file:dir getattr;
+# Anything that accesses anything in /data needs search access to /data itself.
+# This includes vendor components, as they need to access /data/vendor.
+allow domain system_data_root_file:dir { search getattr } ;
+# system_data_file is the default type for directories in /data. Anything
+# accessing data files with a more specific type often has to traverse a
+# system_data_file directory such as /data/misc to get there.
+allow domain system_data_file:dir search;
+# Anything that accesses files in /data/user (and /data/user_de, etc.) needs
+# search access to these directories themselves. getattr access is sometimes
+# needed too.
+allow { coredomain appdomain } system_userdir_file:dir { search getattr };
+# Anything that accesses files in /data/media needs search access to /data/media
+# itself.
+allow { coredomain appdomain } media_userdir_file:dir search;
+# TODO restrict this to non-coredomain
+allow domain vendor_userdir_file:dir { getattr search };
+allow domain vendor_data_file:dir { getattr search };
+
+# required by the dynamic linker
+allow domain proc:lnk_file { getattr read };
+
+# /proc/cpuinfo
+allow domain proc_cpuinfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# /dev/cpu_variant:.*
+allow domain dev_cpu_variant:file { getattr open read ioctl lock map watch watch_reads };
+
+# profiling needs to read /proc/sys/kernel/perf_event_max_sample_rate
+allow domain proc_perf:file { getattr open read ioctl lock map watch watch_reads };
+
+# toybox loads libselinux which stats /sys/fs/selinux/
+allow domain selinuxfs:dir search;
+allow domain selinuxfs:file getattr;
+allow domain sysfs:dir search;
+allow domain selinuxfs:filesystem getattr;
+
+# Almost all processes log tracing information to
+# /sys/kernel/debug/tracing/trace_marker
+# The reason behind this is documented in b/6513400
+allow domain debugfs:dir search;
+allow domain debugfs_tracing:dir search;
+allow domain debugfs_tracing_debug:dir search;
+allow domain debugfs_trace_marker:file { open append write lock map };
+
+# Linux lockdown mode offered coarse-grained definitions for access controls. In
+# previous versions of the policy, the integrity permission was neverallowed.
+# It was found that this permission mainly duplicates pre-existing rules in
+# the policy (see b/285443587). Additionally, some access were found to be
+# required (b/269377822). The access vector was removed from kernel 5.16
+# onwards. Grant unconditional access, these rules should be removed from the
+# policy once no kernel <5.16 are supported.
+allow domain self:lockdown { confidentiality integrity };
+
+# Filesystem access.
+allow domain fs_type:filesystem getattr;
+allow domain fs_type:dir getattr;
+
+# Restrict all domains to an allowlist for common socket types. Additional
+# ioctl commands may be added to individual domains, but this sets safe
+# defaults for all processes. Note that granting this allowlist to domain does
+# not grant the ioctl permission on these socket types. That must be granted
+# separately.
+allowxperm domain domain:{ icmp_socket rawip_socket tcp_socket udp_socket }
+ ioctl {
+#line 285
+{
+#line 285
+# Socket ioctls for gathering information about the interface
+#line 285
+0x00008906 0x00008907
+#line 285
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 285
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 285
+# Wireless extension ioctls. Primarily get functions.
+#line 285
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 285
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 285
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 285
+} {
+#line 285
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 285
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 285
+} };
+# default allowlist for unix sockets.
+allowxperm domain { domain pdx_channel_socket_type }:{ unix_dgram_socket unix_stream_socket }
+ ioctl {
+#line 288
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005413 0x00005414 0x0000541b
+#line 288
+};
+
+# Restrict PTYs to only allowed ioctls.
+# Note that granting this allowlist to domain does
+# not grant the wider ioctl permission. That must be granted
+# separately.
+allowxperm domain devpts:chr_file ioctl {
+#line 294
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 294
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 294
+};
+
+# All domains must clearly enumerate what ioctls they use
+# on filesystem objects (plain files, directories, symbolic links,
+# named pipes, and named sockets). We start off with a safe set.
+allowxperm domain { file_type fs_type domain dev_type }:{ dir { file lnk_file sock_file fifo_file } blk_file } ioctl { 0x00005451 0x00005450 };
+
+# If a domain has ioctl access to tun_device, it must clearly enumerate the
+# ioctls used. Safe defaults are listed below.
+allowxperm domain tun_device:chr_file ioctl { 0x00005451 0x00005450 };
+
+# Allow a process to make a determination whether a file descriptor
+# for a plain file or pipe (fifo_file) is a tty. Note that granting
+# this allowlist to domain does not grant the ioctl permission to
+# these files. That must be granted separately.
+allowxperm domain { file_type fs_type }:file ioctl { 0x00005401 };
+allowxperm domain domain:fifo_file ioctl { 0x00005401 };
+
+# If a domain has access to perform an ioctl on a block device, allow these
+# very common, benign ioctls
+allowxperm domain dev_type:blk_file ioctl { 0x80081272 0x00001268 };
+
+# Support sqlite F2FS specific optimizations
+# ioctl permission on the specific file type is still required
+# TODO: consider only compiling these rules if we know the
+# /data partition is F2FS
+allowxperm domain { file_type sdcard_type }:file ioctl {
+ 0xf505
+ 0xf502
+ 0xf50c
+ 0xf50e
+ 0xf50d
+ 0xf501
+};
+
+# Workaround for policy compiler being too aggressive and removing hwservice_manager_type
+# when it's not explicitly used in allow rules
+allow { domain -domain } hwservice_manager_type:hwservice_manager { add find };
+# Workaround for policy compiler being too aggressive and removing vndservice_manager_type
+# when it's not explicitly used in allow rules
+allow { domain -domain } vndservice_manager_type:service_manager { add find };
+
+# Under ASAN, processes will try to read /data, as the sanitized libraries are there.
+
+# Under ASAN, /system/asan.options needs to be globally accessible.
+
+
+# read APEX dir and stat any symlink pointing to APEXs.
+allow domain apex_mnt_dir:dir { getattr search };
+allow domain apex_mnt_dir:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow reading /sys/kernel/mm/pgsize_migration/enabled
+allow domain sysfs_pgsize_migration:dir search;
+allow domain sysfs_pgsize_migration:file { getattr open read ioctl lock map watch watch_reads };
+
+# Linker is executed from the context of the process requesting the dynamic linking,
+# so this prop must be "world-readable".
+
+#line 351
+allow domain bionic_linker_16kb_app_compat_prop:file { getattr open read map };
+#line 351
+
+
+# Allow everyone to read media server-configurable flags, so that libstagefright can be
+# configured using server-configurable flags
+
+#line 355
+allow domain device_config_media_native_prop:file { getattr open read map };
+#line 355
+
+
+# Transition to crash_dump when /system/bin/crash_dump* is executed.
+# This occurs when the process crashes.
+# We do not apply this to the su domain to avoid interfering with
+# tests (b/114136122)
+
+#line 361
+# Allow the necessary permissions.
+#line 361
+
+#line 361
+# Old domain may exec the file and transition to the new domain.
+#line 361
+allow { domain } crash_dump_exec:file { getattr open read execute map };
+#line 361
+allow { domain } crash_dump:process transition;
+#line 361
+# New domain is entered by executing the file.
+#line 361
+allow crash_dump crash_dump_exec:file { entrypoint open read execute getattr map };
+#line 361
+# New domain can send SIGCHLD to its caller.
+#line 361
+allow crash_dump { domain }:process sigchld;
+#line 361
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 361
+dontaudit { domain } crash_dump:process noatsecure;
+#line 361
+# XXX dontaudit candidate but requires further study.
+#line 361
+allow { domain } crash_dump:process { siginh rlimitinh };
+#line 361
+
+#line 361
+# Make the transition occur by default.
+#line 361
+type_transition { domain } crash_dump_exec:process crash_dump;
+#line 361
+;
+allow domain crash_dump:process sigchld;
+
+# Allow every process to check the heapprofd.enable properties to determine
+# whether to load the heap profiling library. This does not necessarily enable
+# heap profiling, as initialization will fail if it does not have the
+# necessary SELinux permissions.
+
+#line 368
+allow domain heapprofd_prop:file { getattr open read map };
+#line 368
+;
+
+# See private/crash_dump.te
+#line 385
+
+
+# Allow heap profiling by heapprofd.
+# Zygotes are excluded due to potential issues with holding open file
+# descriptors or other state across forks. Other exclusions conflict with
+# neverallows, and are not considered important to profile.
+
+#line 391
+ # Allow central daemon to send signal for client initialization.
+#line 391
+ allow heapprofd {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+}:process signal;
+#line 391
+ # Allow connecting to the daemon.
+#line 391
+
+#line 391
+allow {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+} heapprofd_socket:sock_file write;
+#line 391
+allow {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+} heapprofd:unix_stream_socket connectto;
+#line 391
+
+#line 391
+ # Allow daemon to use the passed fds.
+#line 391
+ allow heapprofd {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+}:fd use;
+#line 391
+ # Allow to read and write to heapprofd shmem.
+#line 391
+ # The client needs to read the read and write pointers in order to write.
+#line 391
+ allow {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+} heapprofd_tmpfs:file { read write getattr map };
+#line 391
+ # Use shared memory received over the unix socket.
+#line 391
+ allow {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+} heapprofd:fd use;
+#line 391
+
+#line 391
+ # To read and write from the received file descriptors.
+#line 391
+ # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the
+#line 391
+ # process they relate to.
+#line 391
+ # We need to write to /proc/$PID/page_idle to find idle allocations.
+#line 391
+ # The client only opens /proc/self/page_idle with RDWR, everything else
+#line 391
+ # with RDONLY.
+#line 391
+ # heapprofd cannot open /proc/$PID/mem itself, as it does not have
+#line 391
+ # sys_ptrace.
+#line 391
+ allow heapprofd {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+}:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 391
+ # Allow searching the /proc/[pid] directory for cmdline.
+#line 391
+ allow heapprofd {
+#line 391
+ {
+#line 391
+ domain
+#line 391
+ -apexd
+#line 391
+ -bpfloader
+#line 391
+ -crash_dump
+#line 391
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 391
+ -init
+#line 391
+ -kernel
+#line 391
+ -keystore
+#line 391
+ -llkd
+#line 391
+ -logd
+#line 391
+ -ueventd
+#line 391
+ -vendor_init
+#line 391
+ -vold
+#line 391
+}
+#line 391
+ -app_zygote
+#line 391
+ -hal_configstore_server
+#line 391
+ -logpersist
+#line 391
+ -recovery
+#line 391
+ -recovery_persist
+#line 391
+ -recovery_refresh
+#line 391
+ -webview_zygote
+#line 391
+ -zygote
+#line 391
+}:dir { open getattr read search ioctl lock watch watch_reads };
+#line 401
+
+
+# Allow profiling using perf_event_open by traced_perf.
+
+#line 404
+ # Allow directory & file read to traced_perf, as it stat(2)s /proc/[pid], and
+#line 404
+ # reads /proc/[pid]/cmdline.
+#line 404
+ allow traced_perf {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+}:file { getattr open read ioctl lock map watch watch_reads };
+#line 404
+ allow traced_perf {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+}:dir { open getattr read search ioctl lock watch watch_reads };
+#line 404
+
+#line 404
+ # Allow central daemon to send signal to request /proc/[pid]/maps and
+#line 404
+ # /proc/[pid]/mem fds from this process.
+#line 404
+ allow traced_perf {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+}:process signal;
+#line 404
+
+#line 404
+ # Allow connecting to the daemon.
+#line 404
+
+#line 404
+allow {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+} traced_perf_socket:sock_file write;
+#line 404
+allow {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+} traced_perf:unix_stream_socket connectto;
+#line 404
+
+#line 404
+ # Allow daemon to use the passed fds.
+#line 404
+ allow traced_perf {
+#line 404
+ {
+#line 404
+ domain
+#line 404
+ -apexd
+#line 404
+ -bpfloader
+#line 404
+ -crash_dump
+#line 404
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+#line 404
+ -init
+#line 404
+ -kernel
+#line 404
+ -keystore
+#line 404
+ -llkd
+#line 404
+ -logd
+#line 404
+ -ueventd
+#line 404
+ -vendor_init
+#line 404
+ -vold
+#line 404
+}
+#line 404
+ -app_zygote
+#line 404
+ -hal_configstore_server
+#line 404
+ -webview_zygote
+#line 404
+ -zygote
+#line 404
+}:fd use;
+#line 410
+
+
+# Everyone can access the IncFS list of features.
+
+#line 413
+allow domain sysfs_fs_incfs_features:dir { open getattr read search ioctl lock watch watch_reads };
+#line 413
+allow domain sysfs_fs_incfs_features:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 413
+;
+
+# Everyone can access the fuse list of features.
+
+#line 416
+allow domain sysfs_fs_fuse_features:dir { open getattr read search ioctl lock watch watch_reads };
+#line 416
+allow domain sysfs_fs_fuse_features:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 416
+;
+
+# Path resolution access in cgroups.
+allow domain cgroup:dir search;
+allow { domain -appdomain -rs } cgroup:dir { open search write add_name remove_name lock };
+allow { domain -appdomain -rs } cgroup:file { open append write lock map };
+
+allow domain cgroup_v2:dir search;
+allow { domain -appdomain -rs } cgroup_v2:dir { open search write add_name remove_name lock };
+allow { domain -appdomain -rs } cgroup_v2:file { open append write lock map };
+
+allow domain cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain cgroup_rc_file:dir search;
+allow domain cgroup_rc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain task_profiles_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain vendor_cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain vendor_task_profiles_file:file { getattr open read ioctl lock map watch watch_reads };
+allow domain libprocessgroup_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow domain libprocessgroup_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow all domains to read sys.use_memfd to determine
+# if memfd support can be used if device supports it
+
+#line 438
+allow domain use_memfd_prop:file { getattr open read map };
+#line 438
+;
+
+# Read access to sdkextensions props
+
+#line 441
+allow domain module_sdkextensions_prop:file { getattr open read map };
+#line 441
+
+
+# Read access to bq configuration values
+
+#line 444
+allow domain bq_config_prop:file { getattr open read map };
+#line 444
+;
+
+# Allow all domains to check whether MTE is set to permissive mode.
+
+#line 447
+allow domain permissive_mte_prop:file { getattr open read map };
+#line 447
+;
+
+# Allow ART to be configurable via device_config properties
+# (ART "runs" inside the app process), and MTE bootloader override to be
+# observed by everything
+
+#line 452
+allow domain device_config_memory_safety_native_boot_prop:file { getattr open read map };
+#line 452
+;
+
+#line 453
+allow domain device_config_memory_safety_native_prop:file { getattr open read map };
+#line 453
+;
+
+#line 454
+allow domain device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 454
+;
+
+#line 455
+allow domain device_config_runtime_native_prop:file { getattr open read map };
+#line 455
+;
+
+# For now, everyone can access core property files
+# Device specific properties are not granted by default
+
+#line 459
+ # DO NOT ADD ANY PROPERTIES HERE
+#line 459
+
+#line 459
+allow domain core_property_type:file { getattr open read map };
+#line 459
+
+#line 459
+
+#line 459
+allow domain exported3_system_prop:file { getattr open read map };
+#line 459
+
+#line 459
+
+#line 459
+allow domain vendor_default_prop:file { getattr open read map };
+#line 459
+
+#line 464
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 465
+
+#line 465
+ # DO NOT ADD ANY PROPERTIES HERE
+#line 465
+
+#line 465
+allow {coredomain appdomain shell} core_property_type:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {coredomain appdomain shell} exported3_system_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {coredomain appdomain shell} exported_camera_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {coredomain shell} userspace_reboot_exported_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {coredomain shell} userspace_reboot_log_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {coredomain shell} userspace_reboot_test_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+allow {domain -coredomain -appdomain} vendor_default_prop:file { getattr open read map };
+#line 465
+
+#line 465
+
+#line 465
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 474
+
+
+# Public readable properties
+
+#line 477
+allow domain aaudio_config_prop:file { getattr open read map };
+#line 477
+
+
+#line 478
+allow domain apexd_select_prop:file { getattr open read map };
+#line 478
+
+
+#line 479
+allow domain arm64_memtag_prop:file { getattr open read map };
+#line 479
+
+
+#line 480
+allow domain bluetooth_config_prop:file { getattr open read map };
+#line 480
+
+
+#line 481
+allow domain bootloader_prop:file { getattr open read map };
+#line 481
+
+
+#line 482
+allow domain build_odm_prop:file { getattr open read map };
+#line 482
+
+
+#line 483
+allow domain build_prop:file { getattr open read map };
+#line 483
+
+
+#line 484
+allow domain build_vendor_prop:file { getattr open read map };
+#line 484
+
+
+#line 485
+allow domain debug_prop:file { getattr open read map };
+#line 485
+
+
+#line 486
+allow domain exported_config_prop:file { getattr open read map };
+#line 486
+
+
+#line 487
+allow domain exported_default_prop:file { getattr open read map };
+#line 487
+
+
+#line 488
+allow domain exported_dumpstate_prop:file { getattr open read map };
+#line 488
+
+
+#line 489
+allow domain exported_secure_prop:file { getattr open read map };
+#line 489
+
+
+#line 490
+allow domain exported_system_prop:file { getattr open read map };
+#line 490
+
+
+#line 491
+allow domain fingerprint_prop:file { getattr open read map };
+#line 491
+
+
+#line 492
+allow domain framework_status_prop:file { getattr open read map };
+#line 492
+
+
+#line 493
+allow domain gwp_asan_prop:file { getattr open read map };
+#line 493
+
+
+#line 494
+allow domain hal_instrumentation_prop:file { getattr open read map };
+#line 494
+
+
+#line 495
+allow domain hw_timeout_multiplier_prop:file { getattr open read map };
+#line 495
+
+
+#line 496
+allow domain init_service_status_prop:file { getattr open read map };
+#line 496
+
+
+#line 497
+allow domain libc_debug_prop:file { getattr open read map };
+#line 497
+
+
+#line 498
+allow domain locale_prop:file { getattr open read map };
+#line 498
+
+
+#line 499
+allow domain logd_prop:file { getattr open read map };
+#line 499
+
+
+#line 500
+allow domain mediadrm_config_prop:file { getattr open read map };
+#line 500
+
+
+#line 501
+allow domain property_service_version_prop:file { getattr open read map };
+#line 501
+
+
+#line 502
+allow domain soc_prop:file { getattr open read map };
+#line 502
+
+
+#line 503
+allow domain socket_hook_prop:file { getattr open read map };
+#line 503
+
+
+#line 504
+allow domain surfaceflinger_prop:file { getattr open read map };
+#line 504
+
+
+#line 505
+allow domain telephony_status_prop:file { getattr open read map };
+#line 505
+
+
+#line 506
+allow domain timezone_prop:file { getattr open read map };
+#line 506
+
+
+#line 507
+allow {domain -untrusted_app_all -isolated_app_all -ephemeral_app -app_zygote } userdebug_or_eng_prop:file { getattr open read map };
+#line 507
+
+
+#line 508
+allow domain vendor_socket_hook_prop:file { getattr open read map };
+#line 508
+
+
+#line 509
+allow domain vndk_prop:file { getattr open read map };
+#line 509
+
+
+#line 510
+allow domain vold_status_prop:file { getattr open read map };
+#line 510
+
+
+#line 511
+allow domain vts_config_prop:file { getattr open read map };
+#line 511
+
+
+# Binder cache properties are world-readable
+
+#line 514
+allow domain binder_cache_bluetooth_server_prop:file { getattr open read map };
+#line 514
+
+
+#line 515
+allow domain binder_cache_system_server_prop:file { getattr open read map };
+#line 515
+
+
+#line 516
+allow domain binder_cache_telephony_server_prop:file { getattr open read map };
+#line 516
+
+
+# Binderfs logs contain sensitive information about other processes.
+neverallow {
+ domain
+ -init
+ -vendor_init
+
+
+} binderfs_logs_transactions:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Binderfs transaction history is less sensitive than transactions, but it
+# still contains global information about the system.
+neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_transaction_history:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Needed for loading kernel modules.
+# TODO(384942085): Reduce the scope.
+allow domain kernel:key search;
+
+# For testing purposes, allow access to keys installed with su.
+# TODO(277916185): Remove since this shouldn't be needed anymore.
+#line 539
+
+
+# Allow access to linkerconfig file
+allow domain linkerconfig_file:dir search;
+allow domain linkerconfig_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow all processes to check for the existence of the boringssl_self_test_marker files.
+allow domain boringssl_self_test_marker:dir search;
+
+# Allow all processes to read the file_logger property that liblog uses to check if file_logger
+# should be used.
+
+#line 550
+allow domain log_file_logger_prop:file { getattr open read map };
+#line 550
+
+
+# Allow all processes to connect to PRNG seeder daemon.
+
+#line 553
+allow domain prng_seeder_socket:sock_file write;
+#line 553
+allow domain prng_seeder:unix_stream_socket connectto;
+#line 553
+
+
+# Allow calls to system(3), popen(3), ...
+allow {
+ domain
+ # Except domains that explicitly neverallow it.
+ -kernel
+ -init
+ -vendor_init
+ -app_zygote
+ -webview_zygote
+ -system_server
+ -artd
+ -dexopt_chroot_setup
+ -audioserver
+ -cameraserver
+ -mediadrmserver
+ -mediaextractor
+ -mediametrics
+ -mediaserver
+ -mediatuner
+ -mediatranscoding
+ -ueventd
+ -hal_audio_server
+ -hal_camera_server
+ -hal_cas_server
+ -hal_codec2_server
+ -hal_configstore_server
+ -hal_drm_server
+ -hal_omx_server
+} {shell_exec toolbox_exec}:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow all processes to read aconfig flag storage files. The format is hidden behind
+# code-generated APIs, but since the libraries are executed in the context of the caller,
+# all processes need access to the underlying files.
+
+#line 588
+
+#line 588
+allow domain aconfig_storage_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 588
+allow domain aconfig_storage_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 588
+;
+#line 590
+
+
+
+#line 592
+allow { coredomain appdomain } system_aconfig_storage_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 592
+allow { coredomain appdomain } system_aconfig_storage_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 592
+;
+
+# processes needs to access storage file stored at /metadata/aconfig/boot, require search
+# permission on /metadata dir
+allow domain metadata_file:dir search;
+
+###
+### neverallow rules
+###
+
+# All ioctls on file-like objects (except chr_file and blk_file) and
+# sockets must be restricted to an allowlist.
+neverallowxperm * *:{ dir { file lnk_file sock_file fifo_file } { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } blk_file } ioctl { 0 };
+
+# b/68014825 and https://android-review.googlesource.com/516535
+# rfc6093 says that processes should not use the TCP urgent mechanism
+neverallowxperm domain domain:{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } ioctl { 0x00008905 };
+
+# TIOCSTI is only ever used for exploits. Block it.
+# b/33073072, b/7530569
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+neverallowxperm * devpts:chr_file ioctl 0x00005412;
+
+# Do not allow any domain other than init to create unlabeled files.
+neverallow { domain -init -recovery } unlabeled:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } create;
+
+# Limit device node creation to these allowed domains.
+neverallow {
+ domain
+ -kernel
+ -init
+ -ueventd
+ -vold
+} self:{ capability cap_userns } mknod;
+
+# No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
+neverallow * self:memprotect mmap_zero;
+
+# No domain needs mac_override as it is unused by SELinux.
+neverallow * self:{ capability2 cap2_userns } mac_override;
+
+# Disallow attempts to set contexts not defined in current policy
+# This helps guarantee that unknown or dangerous contents will not ever
+# be set.
+neverallow * self:{ capability2 cap2_userns } mac_admin;
+
+# Once the policy has been loaded there shall be none to modify the policy.
+# It is sealed.
+neverallow * kernel:security load_policy;
+
+# Only init prior to switching context should be able to set enforcing mode.
+# init starts in kernel domain and switches to init domain via setcon in
+# the init.rc, so the setenforce occurs while still in kernel. After
+# switching domains, there is never any need to setenforce again by init.
+neverallow * kernel:security setenforce;
+neverallow { domain -kernel } kernel:security setcheckreqprot;
+
+# No booleans in AOSP policy, so no need to ever set them.
+neverallow * kernel:security setbool;
+
+# Adjusting the AVC cache threshold.
+# Not presently allowed to anything in policy, but possibly something
+# that could be set from init.rc.
+neverallow { domain -init } kernel:security setsecparam;
+
+# Only the kernel hwrng thread should be able to read from the HW RNG.
+neverallow {
+ domain
+ -prng_seeder # PRNG seeder daemon periodically reseeds itself from HW RNG
+ -shell # For CTS, restricted to just getattr in shell.te
+ -ueventd # To create the /dev/hw_random file
+} hw_random_device:chr_file *;
+# b/78174219 b/64114943
+neverallow {
+ domain
+ -shell # stat of /dev, getattr only
+ -ueventd
+} keychord_device:chr_file *;
+
+# Ensure that all entrypoint executables are in exec_type or postinstall_file.
+neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
+
+# The dynamic linker always calls access(2) on the path. Don't generate SElinux
+# denials since the linker does not actually access the path in case the path
+# does not exist or isn't accessible for the process.
+dontaudit domain postinstall_mnt_dir:dir audit_access;
+
+#Ensure that nothing in userspace can access /dev/port
+neverallow {
+ domain
+ -shell # Shell user should not have any abilities outside of getattr
+ -ueventd
+} port_device:chr_file *;
+neverallow * port_device:chr_file ~{ create relabelto unlink setattr getattr };
+# Only init should be able to configure kernel usermodehelpers or
+# security-sensitive proc settings.
+neverallow { domain -init } usermodehelper:file { append write };
+neverallow { domain -init -ueventd } sysfs_usermodehelper:file { append write };
+neverallow { domain -init -vendor_init } proc_security:file { append open read write };
+
+# Init can't do anything with binder calls. If this neverallow rule is being
+# triggered, it's probably due to a service with no SELinux domain.
+neverallow * init:binder *;
+neverallow * vendor_init:binder *;
+
+# Binderfs logs contain sensitive information about other processes.
+neverallow { domain -dumpstate -init -vendor_init } { binderfs_logs binderfs_logs_proc }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_stats:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Don't allow raw read/write/open access to block_device
+# Rather force a relabel to a more specific type
+neverallow { domain -kernel -init -recovery } block_device:blk_file { open read write };
+
+# Do not allow renaming of block files or character files
+# Ability to do so can lead to possible use in an exploit chain
+# e.g. https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html
+neverallow * *:{ blk_file chr_file } rename;
+
+# Don't allow raw read/write/open access to generic devices.
+# Rather force a relabel to a more specific type.
+neverallow domain device:chr_file { open read write };
+
+# Files from cache should never be executed
+neverallow domain { cache_file cache_backup_file cache_private_backup_file cache_recovery_file }:file execute;
+
+# The test files and executables MUST not be accessible to any domain
+neverallow { domain } nativetest_data_file:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } { append create link unlink relabelfrom rename setattr write };
+neverallow domain nativetest_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain } nativetest_data_file:file { execute execute_no_trans };
+
+neverallow { domain -shell -init -adbd } shell_test_data_file:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } { append create link unlink relabelfrom rename setattr write };
+neverallow { domain -shell -init -adbd } shell_test_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -shell -init -adbd -heapprofd -crash_dump } shell_test_data_file:file *;
+neverallow heapprofd shell_test_data_file:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+neverallow { domain -shell -init -adbd } shell_test_data_file:sock_file *;
+
+# Only the init property service should write to /data/property and /dev/__properties__
+neverallow { domain -init } property_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain -init } property_data_file:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+neverallow { domain -init } property_type:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+neverallow { domain -init } properties_device:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+neverallow { domain -init } properties_serial:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+
+# Nobody should be doing writes to /system & /vendor
+# These partitions are intended to be read-only and must never be
+# modified. Doing so would violate important Android security guarantees
+# and invalidate dm-verity signatures.
+neverallow {
+ domain
+
+
+} {
+ system_file_type
+ vendor_file_type
+ exec_type
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create write setattr relabelfrom append unlink link rename };
+
+neverallow { domain -kernel } { system_file_type vendor_file_type exec_type }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } relabelto;
+
+# Don't allow mounting on top of /system files or directories
+neverallow * exec_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } mounton;
+
+# Nothing should be writing to files in the rootfs.
+neverallow * rootfs:file { create write setattr relabelto append unlink link rename };
+
+# Restrict context mounts to specific types marked with
+# the contextmount_type attribute.
+neverallow * {fs_type -contextmount_type}:filesystem relabelto;
+
+# Ensure that context mount types are not writable, to ensure that
+# the write to /system restriction above is not bypassed via context=
+# mount to another type.
+neverallow * contextmount_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } }
+ { create setattr relabelfrom relabelto append link rename };
+neverallow { domain } contextmount_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { write unlink };
+
+# Do not allow service_manager add for default service labels.
+# Instead domains should use a more specific type such as
+# system_app_service rather than the generic type.
+# New service_types are defined in {,hw,vnd}service.te and new mappings
+# from service name to service_type are defined in {,hw,vnd}service_contexts.
+neverallow * default_android_service:service_manager *;
+neverallow * default_android_vndservice:service_manager *;
+neverallow * default_android_hwservice:hwservice_manager *;
+
+# Looking up the base class/interface of all HwBinder services is a bad idea.
+# hwservicemanager currently offer such lookups only to make it so that security
+# decisions are expressed in SELinux policy. However, it's unclear whether this
+# lookup has security implications. If it doesn't, hwservicemanager should be
+# modified to not offer this lookup.
+# This rule can be removed if hwservicemanager is modified to not permit these
+# lookups.
+neverallow * hidl_base_hwservice:hwservice_manager find;
+
+# Require that domains explicitly label unknown properties, and do not allow
+# anyone but init to modify unknown properties.
+neverallow { domain -init -vendor_init } mmc_prop:property_service set;
+neverallow { domain -init -vendor_init } vndk_prop:property_service set;
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 791
+
+#line 791
+ neverallow { domain -init } mmc_prop:property_service set;
+#line 791
+ neverallow { domain -init -vendor_init } exported_default_prop:property_service set;
+#line 791
+ neverallow { domain -init } exported_secure_prop:property_service set;
+#line 791
+ neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
+#line 791
+ neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
+#line 791
+ neverallow { domain -init -vendor_init } hw_timeout_multiplier_prop:property_service set;
+#line 791
+
+#line 791
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 798
+
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 800
+
+#line 800
+ neverallow { domain -init -system_server -vendor_init } exported_pm_prop:property_service set;
+#line 800
+ neverallow { domain -coredomain -vendor_init } exported_pm_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 800
+
+#line 800
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 803
+
+
+# New "pm.dexopt." sysprops should be explicitly listed as exported_pm_prop.
+neverallow { domain -init -dumpstate -vendor_init } future_pm_prop:property_service set;
+neverallow { domain -init -dumpstate -vendor_init } future_pm_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# ART may introduce new sysprops. SELinux denials due to reading new sysprops on
+# old platforms shouldn't be regarded as a problem.
+dontaudit domain future_pm_prop:file read;
+
+neverallow { domain -init } aac_drc_prop:property_service set;
+neverallow { domain -init } build_prop:property_service set;
+neverallow { domain -init } userdebug_or_eng_prop:property_service set;
+
+# Do not allow reading device's serial number from system properties except form
+# a few allowed domains.
+neverallow {
+ domain
+ -adbd
+ -adbd_tradeinmode
+ -dumpstate
+ -fastbootd
+ -hal_camera_server
+ -hal_cas_server
+ -hal_drm_server
+ -hal_keymint_server
+
+ -init
+ -mediadrmserver
+ -mediaserver
+ -recovery
+ -shell
+ -system_server
+ -vendor_init
+} serialno_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+neverallow {
+ domain
+ -init
+ -recovery
+ -system_server
+ -ueventd # Further restricted in ueventd.te
+} frp_block_device:blk_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# The metadata block device is set aside for device encryption and
+# verified boot metadata. It may be reset at will and should not
+# be used by other domains.
+neverallow {
+ domain
+ -init
+ -recovery
+ -vold
+ -e2fs
+ -fsck
+ -fastbootd
+ -hal_fastboot_server
+} metadata_block_device:blk_file { append link rename write open read ioctl lock };
+
+# No domain other than recovery, update_engine and fastbootd can write to system partition(s).
+neverallow {
+ domain
+ -fastbootd
+
+
+ -recovery
+
+ -update_engine
+} system_block_device:blk_file { write append };
+
+# Only (hw|vnd|)servicemanager should be able to register with binder as the context manager
+neverallow { domain -servicemanager -hwservicemanager -vndservicemanager } *:binder set_context_mgr;
+# The service managers are only allowed to access their own device node
+neverallow servicemanager hwbinder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow servicemanager vndbinder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow hwservicemanager binder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow hwservicemanager vndbinder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow vndservicemanager binder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow vndservicemanager hwbinder_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 882
+
+#line 882
+ # Vendor apps are permited to use only stable public services. If they were to use arbitrary
+#line 882
+ # services which can change any time framework/core is updated, breakage is likely.
+#line 882
+ #
+#line 882
+ # Note, this same logic applies to untrusted apps, but neverallows for these are separate.
+#line 882
+ neverallow {
+#line 882
+ appdomain
+#line 882
+ -coredomain
+#line 882
+ } {
+#line 882
+ service_manager_type
+#line 882
+
+#line 882
+ -app_api_service
+#line 882
+ -ephemeral_app_api_service
+#line 882
+
+#line 882
+ -hal_service_type # see app_neverallows.te
+#line 882
+
+#line 882
+ -apc_service
+#line 882
+ -audioserver_service # TODO(b/36783122) remove exemptions below once app_api_service is fixed
+#line 882
+ -cameraserver_service
+#line 882
+ -drmserver_service
+#line 882
+ -credstore_service
+#line 882
+ -keystore_maintenance_service
+#line 882
+ -keystore_service
+#line 882
+ -legacykeystore_service
+#line 882
+ -mediadrmserver_service
+#line 882
+ -mediaextractor_service
+#line 882
+ -mediametrics_service
+#line 882
+ -mediaserver_service
+#line 882
+ -nfc_service
+#line 882
+ -radio_service
+#line 882
+ -virtual_touchpad_service
+#line 882
+ -vr_manager_service
+#line 882
+
+#line 882
+ }:service_manager find;
+#line 882
+
+#line 882
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 916
+
+
+# On full TREBLE devices, only vendor components, shell, and su can use VendorBinder.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 919
+
+#line 919
+ neverallow {
+#line 919
+ coredomain
+#line 919
+ -shell
+#line 919
+
+#line 919
+ -ueventd # uevent is granted create for this device, but we still neverallow I/O below
+#line 919
+ } vndbinder_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 919
+
+#line 919
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 926
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 927
+
+#line 927
+ neverallow ueventd vndbinder_device:chr_file { read write append ioctl };
+#line 927
+
+#line 927
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 929
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 930
+
+#line 930
+ neverallow {
+#line 930
+ coredomain
+#line 930
+ -shell
+#line 930
+
+#line 930
+ } vndservice_manager_type:service_manager *;
+#line 930
+
+#line 930
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 936
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 937
+
+#line 937
+ neverallow {
+#line 937
+ coredomain
+#line 937
+ -shell
+#line 937
+
+#line 937
+ } vndservicemanager:binder *;
+#line 937
+
+#line 937
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 943
+
+
+# On full TREBLE devices, socket communications between core components and vendor components are
+# not permitted.
+ # Most general rules first, more specific rules below.
+
+ # Core domains are not permitted to initiate communications to vendor domain sockets.
+ # We are not restricting the use of already established sockets because it is fine for a process
+ # to obtain an already established socket via some public/official/stable API and then exchange
+ # data with its peer over that socket. The wire format in this scenario is dicatated by the API
+ # and thus does not break the core-vendor separation.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 954
+
+#line 954
+
+#line 954
+ neverallow {
+#line 954
+ coredomain
+#line 954
+ -init
+#line 954
+ -adbd
+#line 954
+ } {
+#line 954
+ domain
+#line 954
+ -coredomain
+#line 954
+ -socket_between_core_and_vendor_violators
+#line 954
+ }:{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } { connect sendto };
+#line 954
+ neverallow {
+#line 954
+ coredomain
+#line 954
+ -init
+#line 954
+ -adbd
+#line 954
+ } {
+#line 954
+ domain
+#line 954
+ -coredomain
+#line 954
+ -socket_between_core_and_vendor_violators
+#line 954
+ }:unix_stream_socket connectto;
+#line 954
+;
+#line 954
+
+#line 954
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 964
+
+
+ # Vendor domains are not permitted to initiate create/open sockets owned by core domains
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 967
+
+#line 967
+ neverallow {
+#line 967
+ domain
+#line 967
+ -coredomain
+#line 967
+ -appdomain # appdomain restrictions below
+#line 967
+ -data_between_core_and_vendor_violators # b/70393317
+#line 967
+ -socket_between_core_and_vendor_violators
+#line 967
+ -vendor_init
+#line 967
+ } {
+#line 967
+ coredomain_socket
+#line 967
+ core_data_file_type
+#line 967
+ unlabeled # used only by core domains
+#line 967
+ }:sock_file ~{ append getattr ioctl read write };
+#line 967
+
+#line 967
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 980
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 981
+
+#line 981
+ neverallow {
+#line 981
+ appdomain
+#line 981
+ -coredomain
+#line 981
+ } {
+#line 981
+ coredomain_socket
+#line 981
+ unlabeled # used only by core domains
+#line 981
+ core_data_file_type
+#line 981
+ -app_data_file
+#line 981
+ -privapp_data_file
+#line 981
+ -pdx_endpoint_socket_type # used by VR layer
+#line 981
+ -pdx_channel_socket_type # used by VR layer
+#line 981
+ }:sock_file ~{ append getattr ioctl read write };
+#line 981
+
+#line 981
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 994
+
+
+ # Core domains are not permitted to create/open sockets owned by vendor domains
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 997
+
+#line 997
+ neverallow {
+#line 997
+ coredomain
+#line 997
+ -init
+#line 997
+ -ueventd
+#line 997
+ -socket_between_core_and_vendor_violators
+#line 997
+ } {
+#line 997
+ file_type
+#line 997
+ dev_type
+#line 997
+ -coredomain_socket
+#line 997
+ -core_data_file_type
+#line 997
+ -app_data_file_type
+#line 997
+ -unlabeled
+#line 997
+ }:sock_file ~{ append getattr ioctl read write };
+#line 997
+
+#line 997
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1011
+
+
+# On TREBLE devices, vendor and system components are only allowed to share
+# files by passing open FDs over hwbinder. Ban all directory access and all file
+# accesses other than what can be applied to an open FD such as
+# ioctl/stat/read/write/append. This is enforced by segregating /data.
+# Vendor domains may directly access file in /data/vendor by path, but may only
+# access files outside of /data/vendor via an open FD passed over hwbinder.
+# Likewise, core domains may only directly access files outside /data/vendor by
+# path and files in /data/vendor by open FD.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1021
+
+#line 1021
+ # only coredomains may only access core_data_file_type, particularly not
+#line 1021
+ # /data/vendor
+#line 1021
+ neverallow {
+#line 1021
+ coredomain
+#line 1021
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+#line 1021
+ -data_between_core_and_vendor_violators
+#line 1021
+ -init
+#line 1021
+ -vold_prepare_subdirs
+#line 1021
+ } {
+#line 1021
+ data_file_type
+#line 1021
+ -core_data_file_type
+#line 1021
+ -app_data_file_type
+#line 1021
+ }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ append getattr ioctl read write map };
+#line 1021
+
+#line 1021
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1035
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1036
+
+#line 1036
+ neverallow {
+#line 1036
+ coredomain
+#line 1036
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+#line 1036
+ -data_between_core_and_vendor_violators
+#line 1036
+ -init
+#line 1036
+ -vold_prepare_subdirs
+#line 1036
+ } {
+#line 1036
+ data_file_type
+#line 1036
+ -core_data_file_type
+#line 1036
+ -app_data_file_type
+#line 1036
+ # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
+#line 1036
+ # neverallow. Currently only getattr and search are allowed.
+#line 1036
+ -vendor_data_file
+#line 1036
+ }:dir *;
+#line 1036
+
+#line 1036
+
+#line 1036
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1052
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1053
+
+#line 1053
+ # vendor domains may only access files in /data/vendor, never core_data_file_types
+#line 1053
+ neverallow {
+#line 1053
+ domain
+#line 1053
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+#line 1053
+ -coredomain
+#line 1053
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+#line 1053
+ -vendor_init
+#line 1053
+ } {
+#line 1053
+ core_data_file_type
+#line 1053
+
+#line 1053
+ }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ append getattr ioctl read write map };
+#line 1053
+ neverallow {
+#line 1053
+ vendor_init
+#line 1053
+ -data_between_core_and_vendor_violators
+#line 1053
+ } {
+#line 1053
+ core_data_file_type
+#line 1053
+ -unencrypted_data_file
+#line 1053
+
+#line 1053
+ }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ append getattr ioctl read write map };
+#line 1053
+ # vendor init needs to be able to read unencrypted_data_file to create directories with FBE.
+#line 1053
+ # The vendor init binary lives on the system partition so there is not a concern with stability.
+#line 1053
+ neverallow vendor_init unencrypted_data_file:file ~{ getattr open read ioctl lock map watch watch_reads };
+#line 1053
+
+#line 1053
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1076
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1077
+
+#line 1077
+ # vendor domains may only access dirs in /data/vendor, never core_data_file_types
+#line 1077
+ neverallow {
+#line 1077
+ domain
+#line 1077
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+#line 1077
+ -coredomain
+#line 1077
+ -data_between_core_and_vendor_violators
+#line 1077
+ -vendor_init
+#line 1077
+ } {
+#line 1077
+ core_data_file_type
+#line 1077
+ -system_data_file # default label for files on /data. Covered below...
+#line 1077
+ -system_data_root_file
+#line 1077
+ -vendor_userdir_file
+#line 1077
+ -vendor_data_file
+#line 1077
+
+#line 1077
+ }:dir *;
+#line 1077
+ neverallow {
+#line 1077
+ vendor_init
+#line 1077
+ -data_between_core_and_vendor_violators
+#line 1077
+ } {
+#line 1077
+ core_data_file_type
+#line 1077
+ -unencrypted_data_file
+#line 1077
+ -system_data_file
+#line 1077
+ -system_data_root_file
+#line 1077
+ -vendor_userdir_file
+#line 1077
+ -vendor_data_file
+#line 1077
+
+#line 1077
+ }:dir *;
+#line 1077
+ # vendor init needs to be able to read unencrypted_data_file to create directories with FBE.
+#line 1077
+ # The vendor init binary lives on the system partition so there is not a concern with stability.
+#line 1077
+ neverallow vendor_init unencrypted_data_file:dir ~search;
+#line 1077
+
+#line 1077
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1108
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1109
+
+#line 1109
+ # vendor domains may only access dirs in /data/vendor, never core_data_file_types
+#line 1109
+ neverallow {
+#line 1109
+ domain
+#line 1109
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+#line 1109
+ -coredomain
+#line 1109
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+#line 1109
+ } {
+#line 1109
+ system_data_file # default label for files on /data. Covered below
+#line 1109
+ }:dir ~{ getattr search };
+#line 1109
+
+#line 1109
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1119
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1121
+
+#line 1121
+ # coredomains may not access dirs in /data/vendor.
+#line 1121
+ neverallow {
+#line 1121
+ coredomain
+#line 1121
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+#line 1121
+ -init
+#line 1121
+ -vold # vold creates per-user storage for both system and vendor
+#line 1121
+ -vold_prepare_subdirs
+#line 1121
+ } {
+#line 1121
+ vendor_data_file # default label for files on /data. Covered below
+#line 1121
+ }:dir ~{ getattr search };
+#line 1121
+
+#line 1121
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1132
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1134
+
+#line 1134
+ # coredomains may not access dirs in /data/vendor.
+#line 1134
+ neverallow {
+#line 1134
+ coredomain
+#line 1134
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+#line 1134
+ -init
+#line 1134
+ } {
+#line 1134
+ vendor_data_file # default label for files on /data/vendor{,_ce,_de}.
+#line 1134
+ }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ append getattr ioctl read write map };
+#line 1134
+
+#line 1134
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1143
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1145
+
+#line 1145
+ # Non-vendor domains are not allowed to file execute shell
+#line 1145
+ # from vendor
+#line 1145
+ neverallow {
+#line 1145
+ coredomain
+#line 1145
+ -init
+#line 1145
+ -shell
+#line 1145
+ -ueventd
+#line 1145
+ } vendor_shell_exec:file { execute execute_no_trans };
+#line 1145
+
+#line 1145
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1154
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1156
+
+#line 1156
+ # Do not allow vendor components to execute files from system
+#line 1156
+ # except for the ones allowed here.
+#line 1156
+ neverallow {
+#line 1156
+ domain
+#line 1156
+ -coredomain
+#line 1156
+ -appdomain
+#line 1156
+ -vendor_executes_system_violators
+#line 1156
+ -vendor_init
+#line 1156
+ } {
+#line 1156
+ system_file_type
+#line 1156
+ -system_lib_file
+#line 1156
+ -system_bootstrap_lib_file
+#line 1156
+ -system_linker_exec
+#line 1156
+ -crash_dump_exec
+#line 1156
+ -netutils_wrapper_exec
+#line 1156
+
+#line 1156
+ # Vendor components still can invoke shell commands via /system/bin/sh
+#line 1156
+ -shell_exec
+#line 1156
+ -toolbox_exec
+#line 1156
+ -virtualizationmanager_exec
+#line 1156
+ -early_virtmgr_exec
+#line 1156
+ }:file { entrypoint execute execute_no_trans };
+#line 1156
+
+#line 1156
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1179
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1181
+
+#line 1181
+ # Do not allow coredomain to access entrypoint for files other
+#line 1181
+ # than system_file_type and postinstall_file
+#line 1181
+ neverallow coredomain {
+#line 1181
+ file_type
+#line 1181
+ -system_file_type
+#line 1181
+ -postinstall_file
+#line 1181
+ }:file entrypoint;
+#line 1181
+ # Do not allow domains other than coredomain to access entrypoint
+#line 1181
+ # for anything but vendor_file_type and init_exec for vendor_init.
+#line 1181
+ neverallow { domain -coredomain } {
+#line 1181
+ file_type
+#line 1181
+ -vendor_file_type
+#line 1181
+ -init_exec
+#line 1181
+ }:file entrypoint;
+#line 1181
+
+#line 1181
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1196
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1198
+
+#line 1198
+ # Do not allow system components to execute files from vendor
+#line 1198
+ # except for the ones allowed here.
+#line 1198
+ neverallow {
+#line 1198
+ coredomain
+#line 1198
+ -init
+#line 1198
+ -shell
+#line 1198
+ -system_executes_vendor_violators
+#line 1198
+ -ueventd
+#line 1198
+ } {
+#line 1198
+ vendor_file_type
+#line 1198
+ -same_process_hal_file
+#line 1198
+ -vndk_sp_file
+#line 1198
+ -vendor_app_file
+#line 1198
+ -vendor_public_framework_file
+#line 1198
+ -vendor_public_lib_file
+#line 1198
+ }:file execute;
+#line 1198
+
+#line 1198
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1215
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1217
+
+#line 1217
+ neverallow {
+#line 1217
+ coredomain
+#line 1217
+ -shell
+#line 1217
+ -system_executes_vendor_violators
+#line 1217
+ } {
+#line 1217
+ vendor_file_type
+#line 1217
+ -same_process_hal_file
+#line 1217
+ }:file execute_no_trans;
+#line 1217
+
+#line 1217
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1226
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1228
+
+#line 1228
+ # Do not allow vendor components access to /system files except for the
+#line 1228
+ # ones allowed here.
+#line 1228
+ neverallow {
+#line 1228
+ domain
+#line 1228
+ -appdomain
+#line 1228
+ -coredomain
+#line 1228
+ -vendor_executes_system_violators
+#line 1228
+ # vendor_init needs access to init_exec for domain transition. vendor_init
+#line 1228
+ # neverallows are covered in public/vendor_init.te
+#line 1228
+ -vendor_init
+#line 1228
+ } {
+#line 1228
+ system_file_type
+#line 1228
+ -cgroup_desc_file
+#line 1228
+ -crash_dump_exec
+#line 1228
+ -file_contexts_file
+#line 1228
+ -netutils_wrapper_exec
+#line 1228
+ -property_contexts_file
+#line 1228
+ -system_event_log_tags_file
+#line 1228
+ -system_group_file
+#line 1228
+ -system_lib_file
+#line 1228
+ -system_bootstrap_lib_file
+#line 1228
+
+#line 1228
+ -system_linker_exec
+#line 1228
+ -system_linker_config_file
+#line 1228
+ -system_passwd_file
+#line 1228
+ -system_seccomp_policy_file
+#line 1228
+ -system_security_cacerts_file
+#line 1228
+ -system_zoneinfo_file
+#line 1228
+ -task_profiles_file
+#line 1228
+
+#line 1228
+ # Vendor components still can invoke shell commands via /system/bin/sh
+#line 1228
+ -shell_exec
+#line 1228
+ -toolbox_exec
+#line 1228
+ -virtualizationmanager_exec
+#line 1228
+ -early_virtmgr_exec
+#line 1228
+ }:file *;
+#line 1228
+
+#line 1228
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1265
+
+
+# Only system_server should be able to send commands via the zygote socket
+neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
+neverallow { domain -system_server } zygote_socket:sock_file write;
+
+neverallow { domain -system_server -webview_zygote -app_zygote } webview_zygote:unix_stream_socket connectto;
+neverallow { domain -system_server } webview_zygote:sock_file write;
+neverallow { domain -system_server } app_zygote:sock_file write;
+
+neverallow domain tombstoned_crash_socket:unix_stream_socket connectto;
+
+# Never allow anyone except dumpstate, incidentd, or the system server to connect or write to
+# the tombstoned intercept socket.
+neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:sock_file write;
+neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:unix_stream_socket connectto;
+
+# Never allow anyone but system_server to read heapdumps in /data/system/heapdump.
+neverallow { domain -init -system_server } heapdump_data_file:file read;
+
+# Android does not support System V IPCs.
+#
+# The reason for this is due to the fact that, by design, they lead to global
+# kernel resource leakage.
+#
+# For example, there is no way to automatically release a SysV semaphore
+# allocated in the kernel when:
+#
+# - a buggy or malicious process exits
+# - a non-buggy and non-malicious process crashes or is explicitly killed.
+#
+# Killing processes automatically to make room for new ones is an
+# important part of Android's application lifecycle implementation. This means
+# that, even assuming only non-buggy and non-malicious code, it is very likely
+# that over time, the kernel global tables used to implement SysV IPCs will fill
+# up.
+neverallow * *:{ shm sem msg msgq } *;
+
+# Do not mount on top of symlinks, fifos, or sockets.
+# Feature parity with Chromium LSM.
+neverallow * { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
+
+# Nobody should be able to execute su on user builds.
+# On userdebug/eng builds, only dumpstate, shell, and
+# su itself execute su.
+neverallow { domain } su_exec:file { execute execute_no_trans };
+
+# Do not allow the introduction of new execmod rules. Text relocations
+# and modification of executable pages are unsafe.
+# The only exceptions are for NDK text relocations associated with
+# https://code.google.com/p/android/issues/detail?id=23203
+# which, long term, need to go away.
+neverallow * {
+ file_type
+ -apk_data_file
+ -app_data_file
+ -asec_public_file
+}:file execmod;
+
+# Do not allow making the stack or heap executable.
+# We would also like to minimize execmem but it seems to be
+# required by some device-specific service domains.
+neverallow * self:process { execstack execheap };
+
+# Do not allow the introduction of new execmod rules. Text relocations
+# and modification of executable pages are unsafe.
+neverallow { domain -untrusted_app_25 -untrusted_app_27 } file_type:file execmod;
+
+# Ensure that all types assigned to processes are included
+# in the domain attribute, so that all allow and neverallow rules
+# written on domain are applied to all processes.
+# This is achieved by ensuring that it is impossible to transition
+# from a domain to a non-domain type and vice versa.
+# TODO - rework this: neverallow domain ~domain:process { transition dyntransition };
+neverallow ~domain domain:process { transition dyntransition };
+
+#
+# Only system_app and system_server should be creating or writing
+# their files. The proper way to share files is to setup
+# type transitions to a more specific type or assigning a type
+# to its parent directory via a file_contexts entry.
+# Example type transition:
+# mydomain.te:file_type_auto_trans(mydomain, system_data_file, new_file_type)
+#
+neverallow {
+ domain
+ -system_server
+ -system_app
+ -init
+ -toolbox # TODO(b/141108496) We want to remove toolbox
+ -installd # for relabelfrom and unlink, check for this in explicit neverallow
+ -vold_prepare_subdirs # For unlink
+
+} system_data_file:file { append create link unlink relabelfrom rename setattr write };
+# do not grant anything greater than r_file_perms and relabelfrom unlink
+# to installd
+neverallow installd system_data_file:file ~{ { getattr open read ioctl lock map watch watch_reads } relabelfrom unlink };
+
+#
+# Only these domains should transition to shell domain. This domain is
+# permissible for the "shell user". If you need a process to exec a shell
+# script with differing privilege, define a domain and set up a transition.
+#
+neverallow {
+ domain
+ -adbd
+ -init
+ -runas
+ -zygote
+} shell:process { transition dyntransition };
+
+# Only domains spawned from zygote, runas and simpleperf_app_runner may have
+# the appdomain attribute.
+#
+# simpleperf is excluded as a domain transitioned to when running an app-scoped
+# profiling session.
+#
+# tradeinmode is excluded; it is only run when adbd is in trade-in mode,
+# transitioned from the limited adbd_tradeinmode context. It is a wrapper
+# around "am" to avoid exposing the shell context when adbd is in trade-in
+# mode.
+neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
+ appdomain -shell -simpleperf -tradeinmode
+}:process { transition dyntransition };
+
+# Minimize read access to shell- or app-writable symlinks.
+# This is to prevent malicious symlink attacks.
+neverallow {
+ domain
+ -appdomain
+ -artd
+ -installd
+} { app_data_file privapp_data_file }:lnk_file read;
+
+neverallow {
+ domain
+ -shell
+
+ -installd
+} shell_data_file:lnk_file read;
+
+# servicemanager and vndservicemanager are the only processes which handle the
+# service_manager list request
+neverallow * ~{
+ servicemanager
+ vndservicemanager
+ }:service_manager list;
+
+# hwservicemanager is the only process which handles hw list requests
+neverallow * ~{
+ hwservicemanager
+ }:hwservice_manager list;
+
+# only service_manager_types can be added to service_manager
+# TODO - rework this: neverallow * ~service_manager_type:service_manager { add find };
+
+# Prevent assigning non property types to properties
+# TODO - rework this: neverallow * ~property_type:property_service set;
+
+# Domain types should never be assigned to any files other
+# than the /proc/pid files associated with a process. The
+# executable file used to enter a domain should be labeled
+# with its own _exec type, not with the domain type.
+# Conventionally, this looks something like:
+# $ cat mydaemon.te
+# type mydaemon, domain;
+# type mydaemon_exec, exec_type, file_type;
+# init_daemon_domain(mydaemon)
+# $ grep mydaemon file_contexts
+# /system/bin/mydaemon -- u:object_r:mydaemon_exec:s0
+neverallow * domain:file { execute execute_no_trans entrypoint };
+
+# Do not allow access to the generic debugfs label. This is too broad.
+# Instead, if access to part of debugfs is desired, it should have a
+# more specific label.
+# TODO: fix dumpstate
+neverallow { domain -init -vendor_init -dumpstate } debugfs:{ file lnk_file } { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Do not allow executable files in debugfs.
+neverallow domain debugfs_type:file { execute execute_no_trans };
+
+# Don't allow access to the FUSE control filesystem, except to vold and init's
+neverallow { domain -vold -init -vendor_init } fusectlfs:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Profiles contain untrusted data and profman parses that. We should only run
+# it from installd and artd forked processes.
+neverallow {
+ domain
+ -installd
+ -profman
+ -artd
+} profman_exec:file { execute execute_no_trans };
+
+# Enforce restrictions on kernel module origin.
+# Do not allow kernel module loading except from system,
+# vendor, boot, and system_dlkm partitions.
+# TODO(b/218951883): Remove usage of system and rootfs as origin
+neverallow * ~{ system_file_type vendor_file_type rootfs system_dlkm_file_type }:system module_load;
+
+# Only allow filesystem caps to be set at build time. Runtime changes
+# to filesystem capabilities are not permitted.
+neverallow * self:{ capability cap_userns } setfcap;
+
+# Enforce AT_SECURE for executing crash_dump.
+neverallow domain crash_dump:process noatsecure;
+
+# Do not permit non-core domains to register HwBinder services which are
+# guaranteed to be provided by core domains only.
+neverallow ~coredomain coredomain_hwservice:hwservice_manager add;
+
+# Do not permit the registeration of HwBinder services which are guaranteed to
+# be passthrough only (i.e., run in the process of their clients instead of a
+# separate server process).
+neverallow * same_process_hwservice:hwservice_manager add;
+
+# If an already existing file is opened with O_CREAT, the kernel might generate
+# a false report of a create denial. Silence these denials and make sure that
+# inappropriate permissions are not granted.
+
+# These filesystems don't allow files or directories to be created, so the permission
+# to do so should never be granted.
+neverallow domain {
+ proc_type
+ sysfs_type
+}:dir { add_name create link remove_name rename reparent rmdir write };
+
+# cgroupfs directories can be created, but not files within them.
+neverallow domain cgroup:file create;
+neverallow domain cgroup_v2:file create;
+
+dontaudit domain proc_type:dir write;
+dontaudit domain sysfs_type:dir write;
+dontaudit domain cgroup:file create;
+dontaudit domain cgroup_v2:file create;
+
+# These are only needed in permissive mode - in enforcing mode the
+# directory write check fails and so these are never attempted.
+#line 1507
+
+
+# Platform must not have access to /mnt/vendor.
+neverallow {
+ coredomain
+ -init
+ -ueventd
+ -vold
+ -system_writes_mnt_vendor_violators
+} mnt_vendor_file:dir *;
+
+# Only apps are allowed access to vendor public libraries.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1519
+
+#line 1519
+ neverallow {
+#line 1519
+ coredomain
+#line 1519
+ -appdomain
+#line 1519
+ } {vendor_public_framework_file vendor_public_lib_file}:file { execute execute_no_trans };
+#line 1519
+
+#line 1519
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1524
+
+
+# Vendor domian must not have access to /mnt/product.
+neverallow {
+ domain
+ -coredomain
+} mnt_product_file:dir *;
+
+# Platform must not have access to sysfs_batteryinfo, but should do it via health HAL
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1533
+
+#line 1533
+ neverallow {
+#line 1533
+ coredomain
+#line 1533
+ -shell
+#line 1533
+ # For access to block device information under /sys/class/block.
+#line 1533
+ -apexd
+#line 1533
+ # Read sysfs block device information.
+#line 1533
+ -init
+#line 1533
+ # Generate uevents for health info
+#line 1533
+ -ueventd
+#line 1533
+ # Recovery uses health HAL passthrough implementation.
+#line 1533
+ -recovery
+#line 1533
+ # Charger uses health HAL passthrough implementation.
+#line 1533
+ -charger
+#line 1533
+ # TODO(b/110891300): remove this exception
+#line 1533
+ -incidentd
+#line 1533
+ } sysfs_batteryinfo:file { open read };
+#line 1533
+
+#line 1533
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 1550
+
+
+neverallow {
+ domain
+ -hal_codec2_server
+ -hal_omx_server
+} hal_codec2_hwservice:hwservice_manager add;
+
+# Only apps targetting < Q are allowed to open /dev/ashmem directly.
+# Apps must use ASharedMemory NDK API. Native code must use libcutils API.
+neverallow {
+ domain
+ -ephemeral_app # We don't distinguish ephemeral apps based on target API.
+ -untrusted_app_25
+ -untrusted_app_27
+} ashmem_device:chr_file open;
+
+neverallow { domain -traced_probes -init -vendor_init } debugfs_tracing_printk_formats:file *;
+
+# No domains other than a select few can access the misc_block_device. This
+# block device is reserved for OTA use.
+# Do not assert this rule on userdebug/eng builds, due to some devices using
+# this partition for testing purposes.
+neverallow {
+ domain
+ # exclude debuggable builds
+ -fastbootd
+ -hal_bootctl_server
+ -init
+ -uncrypt
+ -update_engine
+ -vendor_init
+ -vendor_misc_writer
+ -vold
+ -recovery
+ -ueventd
+ -mtectrl
+ -misctrl
+ -kcmdlinectrl
+} misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
+
+# Limit ability to ptrace or read sensitive /proc/pid files of processes
+# with other UIDs to these allowlisted domains.
+neverallow {
+ domain
+ -vold
+
+ -dumpstate
+
+
+
+ -storaged
+ -system_server
+} self:{ capability cap_userns } sys_ptrace;
+
+# Limit ability to generate hardware unique device ID attestations to priv_apps
+neverallow { domain -priv_app -gmscore_app } *:keystore2_key gen_unique_id;
+neverallow { domain -system_server } *:keystore2_key use_dev_id;
+neverallow { domain -system_server } keystore:keystore2 { clear_ns lock reset unlock };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+
+} debugfs_tracing_debug:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# System_server owns dropbox data, and init creates/restorecons the directory
+# Disallow direct access by other processes.
+neverallow {
+ domain
+ -init
+ -system_server
+
+} dropbox_data_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_server
+
+} dropbox_data_file:file ~{ getattr read };
+
+###
+# Services should respect app sandboxes
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd # creation of sandbox
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create unlink };
+
+
+#line 1645
+ neverallow {
+#line 1645
+ domain
+#line 1645
+ -artd # compile secondary dex files
+#line 1645
+ -installd # creation of sandbox
+#line 1645
+ -vold_prepare_subdirs # creation of storage area directories
+#line 1645
+ } {storage_area_app_dir storage_area_dir }:dir { create unlink };
+#line 1652
+
+
+# Only the following processes should be directly accessing private app
+# directories.
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -app_zygote
+ -artd # compile secondary dex files
+ -installd
+ -profman
+ -rs # spawned by appdomain, so carryover the exception above
+ -runas
+ -system_server
+ -zygote
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:dir *;
+
+
+#line 1674
+ neverallow {
+#line 1674
+ domain
+#line 1674
+ -appdomain
+#line 1674
+ -app_zygote
+#line 1674
+ -artd # compile secondary dex files
+#line 1674
+ -installd
+#line 1674
+ -rs # spawned by appdomain, so carryover the exception above
+#line 1674
+ -system_server
+#line 1674
+ -vold # encryption of storage area directories
+#line 1674
+ -vold_prepare_subdirs # creation of storage area directories
+#line 1674
+ -zygote
+#line 1674
+ } { storage_area_dir storage_area_app_dir }:dir *;
+#line 1687
+
+
+
+#line 1689
+ # only vold and installd can access the storage area key files
+#line 1689
+ # (and init, in case of a recursive restorecon)
+#line 1689
+ neverallow {
+#line 1689
+ domain
+#line 1689
+ -init
+#line 1689
+ -vold
+#line 1689
+ -vold_prepare_subdirs
+#line 1689
+ -installd
+#line 1689
+ } { storage_area_key_file }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } *;
+#line 1699
+
+
+# Only apps should be modifying app data. installd is exempted for
+# restorecon and package install/uninstall.
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:dir ~{ open getattr read search ioctl lock watch watch_reads };
+
+
+#line 1715
+ neverallow {
+#line 1715
+ domain
+#line 1715
+ -appdomain
+#line 1715
+ -artd # compile secondary dex files
+#line 1715
+ -installd
+#line 1715
+ -rs # spawned by appdomain, so carryover the exception above
+#line 1715
+ -vold_prepare_subdirs # creation of storage area directories
+#line 1715
+ } { storage_area_dir storage_area_app_dir }:dir ~{ open getattr read search ioctl lock watch watch_reads };
+#line 1724
+
+
+neverallow {
+ domain
+ -appdomain
+ -app_zygote
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } open;
+
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd # creation of sandbox
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create unlink };
+
+neverallow {
+ domain
+ -artd # compile secondary dex files
+ -installd
+} {
+ privapp_data_file
+ app_data_file
+ storage_area_content_file
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { relabelfrom relabelto };
+
+
+#line 1760
+ neverallow {
+#line 1760
+ domain
+#line 1760
+ -artd # compile secondary dex files
+#line 1760
+ -installd
+#line 1760
+ -vold_prepare_subdirs
+#line 1760
+ } { storage_area_dir storage_area_app_dir }:dir { relabelfrom relabelto };
+#line 1767
+
+
+# The staging directory contains APEX and APK files. It is important to ensure
+# that these files cannot be accessed by other domains to ensure that the files
+# do not change between system_server staging the files and apexd processing
+# the files.
+# The update_provider can also stage files before apexd processes them.
+neverallow {
+ domain
+ -init
+ -system_server
+ -apexd
+ -installd
+ -priv_app
+ -virtualizationmanager
+ -update_provider # WARNING: USING THIS ATTRIBUTE WILL CAUSE CTS TO FAIL!
+} staging_data_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_app
+ -system_server
+ -apexd
+ -adbd
+ -kernel
+ -installd
+ -priv_app
+ -shell
+ -virtualizationmanager
+ -crosvm
+ -update_provider # WARNING: USING THIS ATTRIBUTE WILL CAUSE CTS TO FAIL!
+} staging_data_file:file *;
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -system_server -installd -update_provider } staging_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+# apexd needs the link/unlink/rename permissions
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -system_server -installd -apexd -update_provider } staging_data_file:file {
+ { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans }
+};
+neverallow apexd staging_data_file:file {
+ append create relabelfrom setattr write # no_w_file_perms -link -unlink -rename
+ { execute execute_no_trans }
+};
+
+neverallow {
+ domain
+ -appdomain # for oemfs
+ -bootanim # for oemfs
+ -recovery # for /tmp/update_binary in tmpfs
+} { fs_type -rootfs }:file execute;
+
+#
+# Assert that, to the extent possible, we're not loading executable content from
+# outside the rootfs or /system partition except for a few allowlisted domains.
+# Executable files loaded from /data is a persistence vector
+# we want to avoid. See
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
+#
+neverallow {
+ domain
+ -appdomain
+
+ -shell
+
+ -system_server_startup # for memfd backed executable regions
+ -app_zygote
+ -webview_zygote
+ -zygote
+
+
+} {
+ file_type
+ -system_file_type
+ -system_lib_file
+ -system_bootstrap_lib_file
+ -system_linker_exec
+ -vendor_file_type
+ -exec_type
+ -postinstall_file
+}:file execute;
+
+# Only init is allowed to write cgroup.rc file
+neverallow {
+ domain
+ -init
+ -vendor_init
+} cgroup_rc_file:file { append create link unlink relabelfrom rename setattr write };
+
+# Only authorized processes should be writing to files in /data/dalvik-cache
+neverallow {
+ domain
+ -init # TODO: limit init to relabelfrom for files
+ -zygote
+ -installd
+ -postinstall_dexopt
+ -cppreopts
+ -dex2oat
+ -otapreopt_slot
+ -artd
+} dalvikcache_data_file:file { append create link unlink relabelfrom rename setattr write };
+
+neverallow {
+ domain
+ -init
+ -installd
+ -postinstall_dexopt
+ -cppreopts
+ -dex2oat
+ -zygote
+ -otapreopt_slot
+ -artd
+} dalvikcache_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+
+# Only authorized processes should be writing to /data/misc/apexdata/com.android.art as it
+# contains boot class path and system server AOT artifacts following an ART APEX Mainline update.
+neverallow {
+ domain
+ # art-related processes
+ -composd
+ -compos_fd_server
+ -odrefresh
+ -odsign
+ # others
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_art_data_file:file { append create link unlink relabelfrom rename setattr write };
+
+neverallow {
+ domain
+ # art-related processes
+ -composd
+ -compos_fd_server
+ -odrefresh
+ -odsign
+ # others
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_art_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+
+# Protect most domains from executing arbitrary content from /data.
+neverallow {
+ domain
+ -appdomain
+} {
+ data_file_type
+ -apex_art_data_file
+ -dalvikcache_data_file
+ -system_data_file # shared libs in apks
+ -apk_data_file
+}:file { execute execute_no_trans };
+
+# Minimize dac_override and dac_read_search.
+# Instead of granting them it is usually better to add the domain to
+# a Unix group or change the permissions of a file.
+#line 1945
+
+neverallow ~{
+#line 1946
+ apexd
+#line 1946
+ artd
+#line 1946
+ dnsmasq
+#line 1946
+ dumpstate
+#line 1946
+ init
+#line 1946
+ installd
+#line 1946
+
+#line 1946
+ lmkd
+#line 1946
+ migrate_legacy_obb_data
+#line 1946
+ netd
+#line 1946
+ postinstall_dexopt
+#line 1946
+ recovery
+#line 1946
+ rss_hwm_reset
+#line 1946
+ sdcardd
+#line 1946
+ tee
+#line 1946
+ ueventd
+#line 1946
+ uncrypt
+#line 1946
+ vendor_init
+#line 1946
+ vold
+#line 1946
+ vold_prepare_subdirs
+#line 1946
+ zygote
+#line 1946
+} self:{ capability cap_userns } dac_override;
+# Since the kernel checks dac_read_search before dac_override, domains that
+# have dac_override should also have dac_read_search to eliminate spurious
+# denials. Some domains have dac_read_search without having dac_override, so
+# this list should be a superset of the one above.
+neverallow ~{
+ {
+#line 1952
+ apexd
+#line 1952
+ artd
+#line 1952
+ dnsmasq
+#line 1952
+ dumpstate
+#line 1952
+ init
+#line 1952
+ installd
+#line 1952
+
+#line 1952
+ lmkd
+#line 1952
+ migrate_legacy_obb_data
+#line 1952
+ netd
+#line 1952
+ postinstall_dexopt
+#line 1952
+ recovery
+#line 1952
+ rss_hwm_reset
+#line 1952
+ sdcardd
+#line 1952
+ tee
+#line 1952
+ ueventd
+#line 1952
+ uncrypt
+#line 1952
+ vendor_init
+#line 1952
+ vold
+#line 1952
+ vold_prepare_subdirs
+#line 1952
+ zygote
+#line 1952
+}
+ traced_perf
+ traced_probes
+ heapprofd
+} self:{ capability cap_userns } dac_read_search;
+
+# Limit what domains can mount filesystems or change their mount flags.
+# sdcard_type (including vfat and exfat) and fusefs_type are exempt as a larger
+# set of domains need this capability, including device-specific domains.
+neverallow {
+ domain
+ -apexd
+ -dexopt_chroot_setup
+
+ -init
+ -kernel
+ -otapreopt_chroot
+ -recovery
+ -update_engine
+ -vold
+ -zygote
+} { fs_type
+ -sdcard_type
+ -fusefs_type
+}:filesystem { mount remount relabelfrom relabelto };
+
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 1978
+
+#line 1978
+ neverallow {
+#line 1978
+ domain
+#line 1978
+ } { debugfs_type -debugfs_tracing_debug }:filesystem { mount remount relabelfrom relabelto };
+#line 1978
+
+#line 1978
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 1982
+
+
+# Limit raw I/O to these allowlisted domains. Do not apply to debug builds.
+neverallow {
+ domain
+
+ -kernel
+ -gsid
+ -init
+ -recovery
+ -ueventd
+ -uncrypt
+ -tee
+ -hal_bootctl_server
+ -fastbootd
+} self:{ capability cap_userns } sys_rawio;
+
+# Limit directory operations that doesn't need to do app data isolation.
+neverallow {
+ domain
+ -fsck
+ -init
+ -installd
+ -zygote
+} mirror_data_file:dir *;
+
+# This property is being removed. Remove remaining access.
+neverallow { domain -init -system_server -vendor_init } net_dns_prop:property_service set;
+neverallow { domain -dumpstate -init -system_server -vendor_init } net_dns_prop:file read;
+
+# Only core domains are allowed to access package_manager properties
+neverallow { domain -init -system_server } pm_prop:property_service set;
+neverallow { domain -coredomain } pm_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Do not allow reading the last boot timestamp from system properties
+neverallow { domain -init -system_server -dumpstate } firstboot_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow ART to set its config properties in its oneshot boot service, in
+# addition to the common init and vendor_init access.
+neverallow { domain -art_boot -init -vendor_init } dalvik_config_prop:property_service set;
+
+# Kprobes should only be used by adb root
+neverallow { domain -init -vendor_init } debugfs_kprobes:file *;
+
+# On TREBLE devices, most coredomains should not access vendor_files.
+# TODO(b/71553434): Remove exceptions here.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2028
+
+#line 2028
+ neverallow {
+#line 2028
+ coredomain
+#line 2028
+ -appdomain
+#line 2028
+ -bootanim
+#line 2028
+ -crash_dump
+#line 2028
+ -heapprofd
+#line 2028
+
+#line 2028
+ -init
+#line 2028
+ -kernel
+#line 2028
+
+#line 2028
+ -traced_perf
+#line 2028
+ -ueventd
+#line 2028
+ } vendor_file:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } open };
+#line 2028
+
+#line 2028
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2042
+
+
+# Vendor domains are not permitted to initiate communications to core domain sockets
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2045
+
+#line 2045
+
+#line 2045
+ neverallow {
+#line 2045
+ domain
+#line 2045
+ -coredomain
+#line 2045
+ -appdomain
+#line 2045
+ -socket_between_core_and_vendor_violators
+#line 2045
+ } {
+#line 2045
+ coredomain
+#line 2045
+ -logd # Logging by writing to logd Unix domain socket is public API
+#line 2045
+ -netd # netdomain needs this
+#line 2045
+ -mdnsd # netdomain needs this
+#line 2045
+ -prng_seeder # Any process using libcrypto needs this
+#line 2045
+ # communications with su are permitted only on userdebug or eng builds
+#line 2045
+ -init
+#line 2045
+ -tombstoned # linker to tombstoned
+#line 2045
+ -heapprofd
+#line 2045
+ -traced
+#line 2045
+ -traced_perf
+#line 2045
+ }:{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } { connect sendto };
+#line 2045
+ neverallow {
+#line 2045
+ domain
+#line 2045
+ -coredomain
+#line 2045
+ -appdomain
+#line 2045
+ -socket_between_core_and_vendor_violators
+#line 2045
+ } {
+#line 2045
+ coredomain
+#line 2045
+ -logd # Logging by writing to logd Unix domain socket is public API
+#line 2045
+ -netd # netdomain needs this
+#line 2045
+ -mdnsd # netdomain needs this
+#line 2045
+ -prng_seeder # Any process using libcrypto needs this
+#line 2045
+ # communications with su are permitted only on userdebug or eng builds
+#line 2045
+ -init
+#line 2045
+ -tombstoned # linker to tombstoned
+#line 2045
+ -heapprofd
+#line 2045
+ -traced
+#line 2045
+ -traced_perf
+#line 2045
+ }:unix_stream_socket connectto;
+#line 2045
+;
+#line 2045
+
+#line 2045
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2064
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2066
+
+#line 2066
+ # Do not allow system components access to /vendor files except for the
+#line 2066
+ # ones allowed here.
+#line 2066
+ neverallow {
+#line 2066
+ coredomain
+#line 2066
+ # TODO(b/37168747): clean up fwk access to /vendor
+#line 2066
+ -crash_dump
+#line 2066
+ -crosvm # loads vendor-specific disk images
+#line 2066
+ -init # starts vendor executables
+#line 2066
+ -kernel # loads /vendor/firmware
+#line 2066
+ -heapprofd
+#line 2066
+
+#line 2066
+ -shell
+#line 2066
+
+#line 2066
+ -system_executes_vendor_violators
+#line 2066
+ -traced_perf # library/binary access for symbolization
+#line 2066
+ -ueventd # reads /vendor/ueventd.rc
+#line 2066
+ -vold # loads incremental fs driver
+#line 2066
+ } {
+#line 2066
+ vendor_file_type
+#line 2066
+ -same_process_hal_file
+#line 2066
+ -vendor_app_file
+#line 2066
+ -vendor_apex_file
+#line 2066
+ -vendor_apex_metadata_file
+#line 2066
+ -vendor_boot_ota_file
+#line 2066
+ -vendor_cgroup_desc_file
+#line 2066
+ -vendor_configs_file
+#line 2066
+ -vendor_microdroid_file
+#line 2066
+ -vendor_service_contexts_file
+#line 2066
+ -vendor_framework_file
+#line 2066
+ -vendor_idc_file
+#line 2066
+ -vendor_keychars_file
+#line 2066
+ -vendor_keylayout_file
+#line 2066
+ -vendor_overlay_file
+#line 2066
+ -vendor_public_framework_file
+#line 2066
+ -vendor_public_lib_file
+#line 2066
+ -vendor_task_profiles_file
+#line 2066
+ -vendor_uuid_mapping_config_file
+#line 2066
+ -vndk_sp_file
+#line 2066
+ -vendor_aconfig_storage_file
+#line 2066
+ }:file *;
+#line 2066
+
+#line 2066
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 2107
+
+
+# mlsvendorcompat is only for compatibility support for older vendor
+# images, and should not be granted to any domain in current policy.
+# (Every domain is allowed self:fork, so this will trigger if the
+# intsersection of domain & mlsvendorcompat is not empty.)
+neverallow domain mlsvendorcompat:process fork;
+
+# Only init and otapreopt_chroot should be mounting filesystems on locations
+# labeled system or vendor (/product and /vendor respectively).
+neverallow { domain -dexopt_chroot_setup -init -otapreopt_chroot } { system_file_type vendor_file_type }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } mounton;
+
+# Only allow init and vendor_init to read/write mm_events properties
+# NOTE: dumpstate is allowed to read any system property
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+} mm_events_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow init to open /proc/kallsyms while kernel address mappings are still
+# visible, and later share it with tracing daemons (traced_probes,
+# traced_perf). These daemons are allowed to read from the shared fd, but also
+# to separately open the file (which will always have zeroed out addresses due
+# to init raising kptr_restrict) for locking to coordinate access to the shared
+# fd. The performance traces contain only the referenced kernel symbols, and
+# never the raw addresses (i.e. KASLR is not disclosed).
+# On debuggable builds, performance tools are allowed to open and read the file
+# directly because init is allowed to temporarily unrestrict systemwide address
+# visibility.
+neverallow {
+ domain
+ -init
+ -traced_probes
+ -traced_perf
+
+
+} proc_kallsyms:file *;
+
+# debugfs_kcov type is not included in this neverallow statement since the KCOV
+# tool uses it for kernel fuzzing.
+# vendor_modprobe is also exempted since the kernel modules it loads may create
+# debugfs files in its context.
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 2151
+
+#line 2151
+ neverallow {
+#line 2151
+ domain
+#line 2151
+ -vendor_modprobe
+#line 2151
+
+#line 2151
+ } { debugfs_type
+#line 2151
+
+#line 2151
+ -tracefs_type
+#line 2151
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 2151
+
+#line 2151
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 2164
+
+
+# Restrict write access to etm sysfs interface.
+neverallow { domain -ueventd -vendor_init } sysfs_devices_cs_etm:file { append create link unlink relabelfrom rename setattr write };
+
+# Restrict CAP_PERFMON.
+neverallow {
+ domain
+ -init
+ -vendor_modprobe
+
+ -kernel
+ -uprobestats
+} self:capability2 perfmon;
+
+# Restrict direct access to shell owned files. The /data/local/tmp directory is
+# untrustworthy, and non-allowed domains should not be trusting any content in
+# those directories. We allow shell files to be passed around by file
+# descriptor, but not directly opened.
+# artd doesn't need to access /data/local/tmp, but it needs to access
+# /data/{user,user_de}/<user-id>/com.android.shell/... for compiling secondary
+# dex files.
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -installd
+
+
+
+
+} shell_data_file:file open;
+
+# In addition to the symlink reading restrictions above, restrict
+# write access to shell owned directories. The /data/local/tmp
+# directory is untrustworthy, and non-allowed domains should
+# not be trusting any content in those directories.
+# artd doesn't need to access /data/local/tmp, but it needs to access
+# /data/{user,user_de}/<user-id>/com.android.shell/... for compiling secondary
+# dex files.
+neverallow {
+ domain
+ -adbd
+ -artd
+ -dumpstate
+ -installd
+ -init
+ -shell
+ -vold
+} shell_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -init
+ -installd
+ -simpleperf_app_runner
+ -system_server # why?
+
+} shell_data_file:dir open;
+
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -init
+ -installd
+ -simpleperf_app_runner
+ -system_server # why?
+
+
+
+} shell_data_file:dir search;
+
+# respect system_app sandboxes
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -system_server #populate com.android.providers.settings/databases/settings.db.
+ -installd # creation of app sandbox
+ -traced_probes # resolve inodes for i/o tracing.
+ # only needs open and read, the rest is neverallow in
+ # traced_probes.te.
+} system_app_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create unlink open };
+neverallow {
+ isolated_app_all
+ ephemeral_app
+ priv_app
+ sdk_sandbox_all
+ untrusted_app_all
+} system_app_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { create unlink open };
+
+neverallow { domain -init } mtectrl:process { dyntransition transition };
+neverallow { domain -init } kcmdlinectrl:process { dyntransition transition };
+
+# For now, don't allow processes other than gmscore to access /data/misc_ce/<userid>/checkin
+neverallow { domain -gmscore_app -init -vold_prepare_subdirs } checkin_data_file:{dir file} *;
+
+neverallow { domain -dexopt_chroot_setup -init } proc:{ file dir } mounton;
+neverallow { domain -dexopt_chroot_setup -init -zygote } proc_type:{ file dir } mounton;
+
+# Only init/vendor are allowed to write sysfs_pgsize_migration;
+# ueventd needs write access to all sysfs files.
+neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file { append create link unlink relabelfrom rename setattr write };
+
+# We need to be able to rely on vsock labels, so disallow changing them.
+neverallow domain *:vsock_socket { relabelfrom relabelto };
+#line 1 "system/sepolicy/private/drmserver.te"
+typeattribute drmserver coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init drmserver_exec:file { getattr open read execute map };
+#line 3
+allow init drmserver:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow drmserver drmserver_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init drmserver:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init drmserver:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init drmserver_exec:process drmserver;
+#line 3
+
+#line 3
+
+
+type_transition drmserver apk_data_file:sock_file drmserver_socket;
+
+typeattribute drmserver_socket coredomain_socket;
+
+
+#line 9
+allow drmserver drm_service_config_prop:file { getattr open read map };
+#line 9
+
+
+typeattribute drmserver mlstrustedsubject;
+
+
+#line 13
+typeattribute drmserver netdomain;
+#line 13
+
+
+# Perform Binder IPC to system server.
+
+#line 16
+# Call the servicemanager and transfer references to it.
+#line 16
+allow drmserver servicemanager:binder { call transfer };
+#line 16
+# Allow servicemanager to send out callbacks
+#line 16
+allow servicemanager drmserver:binder { call transfer };
+#line 16
+# servicemanager performs getpidcon on clients.
+#line 16
+allow servicemanager drmserver:dir search;
+#line 16
+allow servicemanager drmserver:file { read open };
+#line 16
+allow servicemanager drmserver:process getattr;
+#line 16
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 16
+# all domains in domain.te.
+#line 16
+
+
+#line 17
+# Call the server domain and optionally transfer references to it.
+#line 17
+allow drmserver system_server:binder { call transfer };
+#line 17
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 17
+allow system_server drmserver:binder transfer;
+#line 17
+# Receive and use open files from the server.
+#line 17
+allow drmserver system_server:fd use;
+#line 17
+
+
+#line 18
+# Call the server domain and optionally transfer references to it.
+#line 18
+allow drmserver appdomain:binder { call transfer };
+#line 18
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 18
+allow appdomain drmserver:binder transfer;
+#line 18
+# Receive and use open files from the server.
+#line 18
+allow drmserver appdomain:fd use;
+#line 18
+
+
+#line 19
+# Call the server domain and optionally transfer references to it.
+#line 19
+allow drmserver mediametrics:binder { call transfer };
+#line 19
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 19
+allow mediametrics drmserver:binder transfer;
+#line 19
+# Receive and use open files from the server.
+#line 19
+allow drmserver mediametrics:fd use;
+#line 19
+
+
+#line 20
+typeattribute drmserver binderservicedomain;
+#line 20
+
+# Inherit or receive open files from system_server.
+allow drmserver system_server:fd use;
+
+# Perform Binder IPC to mediaserver
+
+#line 25
+# Call the server domain and optionally transfer references to it.
+#line 25
+allow drmserver mediaserver:binder { call transfer };
+#line 25
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 25
+allow mediaserver drmserver:binder transfer;
+#line 25
+# Receive and use open files from the server.
+#line 25
+allow drmserver mediaserver:fd use;
+#line 25
+
+
+allow drmserver { sdcard_type fuse }:dir search;
+allow drmserver drm_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow drmserver drm_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow drmserver { app_data_file privapp_data_file }:file { read write getattr map };
+allow drmserver { sdcard_type fuse }:file { read write getattr map };
+
+#line 32
+allow drmserver efs_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow drmserver efs_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+
+# /data/app/tlcd_sock socket file.
+# Clearly, /data/app is the most logical place to create a socket. Not.
+allow drmserver apk_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+auditallow drmserver apk_data_file:dir { add_name write };
+allow drmserver drmserver_socket:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+auditallow drmserver drmserver_socket:sock_file create;
+# Delete old socket file if present.
+allow drmserver apk_data_file:sock_file unlink;
+
+# After taking a video, drmserver looks at the video file.
+
+#line 44
+allow drmserver media_rw_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 44
+allow drmserver media_rw_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 44
+
+
+# Read resources from open apk files passed over Binder.
+allow drmserver apk_data_file:file { read getattr map };
+allow drmserver asec_apk_file:file { read getattr map };
+allow drmserver ringtone_file:file { read getattr map };
+
+# Read /data/data/com.android.providers.telephony files passed over Binder.
+allow drmserver radio_data_file:file { read getattr map };
+
+# /oem access
+allow drmserver oemfs:dir search;
+allow drmserver oemfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# overlay package access
+allow drmserver vendor_overlay_file:file { read map };
+
+
+#line 61
+ allow drmserver drmserver_service:service_manager { add find };
+#line 61
+ neverallow { domain -drmserver } drmserver_service:service_manager add;
+#line 61
+
+#line 61
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 61
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 61
+
+#line 61
+
+allow drmserver permission_service:service_manager find;
+allow drmserver mediametrics_service:service_manager find;
+
+
+#line 65
+
+#line 65
+allow drmserver selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 65
+allow drmserver selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 65
+
+#line 65
+allow drmserver selinuxfs:file { open append write lock map };
+#line 65
+allow drmserver kernel:security compute_av;
+#line 65
+allow drmserver self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 65
+
+
+
+#line 67
+allow drmserver cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 67
+allow drmserver cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 67
+
+
+#line 68
+allow drmserver cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 68
+allow drmserver cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 68
+
+
+#line 69
+allow drmserver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 69
+allow drmserver system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 69
+
+#line 1 "system/sepolicy/private/dumpstate.te"
+typeattribute dumpstate coredomain;
+type dumpstate_tmpfs, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init dumpstate_exec:file { getattr open read execute map };
+#line 4
+allow init dumpstate:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow dumpstate dumpstate_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init dumpstate:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init dumpstate:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init dumpstate_exec:process dumpstate;
+#line 4
+
+#line 4
+
+
+# Execute and transition to the vdc domain
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow dumpstate vdc_exec:file { getattr open read execute map };
+#line 7
+allow dumpstate vdc:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow vdc vdc_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+allow vdc dumpstate:process sigchld;
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit dumpstate vdc:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow dumpstate vdc:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition dumpstate vdc_exec:process vdc;
+#line 7
+
+
+# Create tmpfs files for using memfd descriptors to get output from child
+# processes.
+
+#line 11
+type_transition dumpstate tmpfs:file dumpstate_tmpfs;
+#line 11
+allow dumpstate dumpstate_tmpfs:file { read write getattr map };
+#line 11
+
+
+# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables
+allow dumpstate system_file:file lock;
+
+allow dumpstate storaged_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# /data/misc/a11ytrace for accessibility traces
+#line 22
+
+
+# /data/misc/wmtrace for wm traces
+#line 28
+
+
+# /data/system/dropbox for dropbox entries
+#line 34
+
+
+
+#line 36
+allow dumpstate aconfig_storage_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow dumpstate aconfig_storage_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+;
+
+# Allow dumpstate to make binder calls to incidentd
+
+#line 39
+# Call the server domain and optionally transfer references to it.
+#line 39
+allow dumpstate incidentd:binder { call transfer };
+#line 39
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 39
+allow incidentd dumpstate:binder transfer;
+#line 39
+# Receive and use open files from the server.
+#line 39
+allow dumpstate incidentd:fd use;
+#line 39
+
+
+# Kill incident in case of a timeout
+allow dumpstate incident:process { signal sigkill };
+
+# Allow dumpstate to make binder calls to storaged service
+
+#line 45
+# Call the server domain and optionally transfer references to it.
+#line 45
+allow dumpstate storaged:binder { call transfer };
+#line 45
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 45
+allow storaged dumpstate:binder transfer;
+#line 45
+# Receive and use open files from the server.
+#line 45
+allow dumpstate storaged:fd use;
+#line 45
+
+
+# Allow dumpstate to make binder calls to statsd
+
+#line 48
+# Call the server domain and optionally transfer references to it.
+#line 48
+allow dumpstate statsd:binder { call transfer };
+#line 48
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 48
+allow statsd dumpstate:binder transfer;
+#line 48
+# Receive and use open files from the server.
+#line 48
+allow dumpstate statsd:fd use;
+#line 48
+
+
+# Allow dumpstate to talk to gpuservice over binder
+
+#line 51
+# Call the server domain and optionally transfer references to it.
+#line 51
+allow dumpstate gpuservice:binder { call transfer };
+#line 51
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 51
+allow gpuservice dumpstate:binder transfer;
+#line 51
+# Receive and use open files from the server.
+#line 51
+allow dumpstate gpuservice:fd use;
+#line 51
+;
+
+# Allow dumpstate to talk to idmap over binder
+
+#line 54
+# Call the server domain and optionally transfer references to it.
+#line 54
+allow dumpstate idmap:binder { call transfer };
+#line 54
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 54
+allow idmap dumpstate:binder transfer;
+#line 54
+# Receive and use open files from the server.
+#line 54
+allow dumpstate idmap:fd use;
+#line 54
+;
+
+# Allow dumpstate to talk to profcollectd over binder
+#line 59
+
+
+# Allow dumpstate to talk to automotive_display_service over binder
+
+#line 62
+# Call the server domain and optionally transfer references to it.
+#line 62
+allow dumpstate automotive_display_service:binder { call transfer };
+#line 62
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 62
+allow automotive_display_service dumpstate:binder transfer;
+#line 62
+# Receive and use open files from the server.
+#line 62
+allow dumpstate automotive_display_service:fd use;
+#line 62
+
+
+# Allow dumpstate to talk to virtual_camera service over binder
+
+#line 65
+# Call the server domain and optionally transfer references to it.
+#line 65
+allow dumpstate virtual_camera:binder { call transfer };
+#line 65
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 65
+allow virtual_camera dumpstate:binder transfer;
+#line 65
+# Receive and use open files from the server.
+#line 65
+allow dumpstate virtual_camera:fd use;
+#line 65
+
+
+# Allow dumpstate to talk to ot_daemon service over binder
+
+#line 68
+# Call the server domain and optionally transfer references to it.
+#line 68
+allow dumpstate ot_daemon:binder { call transfer };
+#line 68
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 68
+allow ot_daemon dumpstate:binder transfer;
+#line 68
+# Receive and use open files from the server.
+#line 68
+allow dumpstate ot_daemon:fd use;
+#line 68
+
+
+# Collect metrics on boot time created by init
+
+#line 71
+allow dumpstate boottime_prop:file { getattr open read map };
+#line 71
+
+
+
+#line 73
+allow dumpstate misctrl_prop:file { getattr open read map };
+#line 73
+
+
+# Signal native processes to dump their stack.
+allow dumpstate {
+ mediatranscoding
+ statsd
+ netd
+ virtual_camera
+ ot_daemon
+}:process signal;
+
+# Only allow dumpstate to dump Keystore on debuggable builds.
+#line 87
+
+dontaudit dumpstate keystore:process { signal };
+
+# For collecting bugreports.
+
+#line 91
+ allow dumpstate debugfs_wakeup_sources:file { getattr open read ioctl lock map watch watch_reads };
+#line 93
+
+
+allow dumpstate dev_type:blk_file getattr;
+allow dumpstate webview_zygote:process signal;
+allow dumpstate sysfs_dmabuf_stats:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit dumpstate update_engine:binder call;
+
+# Read files in /proc
+allow dumpstate {
+ config_gz
+ proc_net_tcp_udp
+ proc_pid_max
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# For comminucating with the system process to do confirmation ui.
+
+#line 108
+# Call the server domain and optionally transfer references to it.
+#line 108
+allow dumpstate incidentcompanion_service:binder { call transfer };
+#line 108
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 108
+allow incidentcompanion_service dumpstate:binder transfer;
+#line 108
+# Receive and use open files from the server.
+#line 108
+allow dumpstate incidentcompanion_service:fd use;
+#line 108
+
+
+# Set properties.
+# dumpstate_prop is used to share state with the Shell app.
+
+#line 112
+
+#line 112
+allow dumpstate property_socket:sock_file write;
+#line 112
+allow dumpstate init:unix_stream_socket connectto;
+#line 112
+
+#line 112
+allow dumpstate dumpstate_prop:property_service set;
+#line 112
+
+#line 112
+allow dumpstate dumpstate_prop:file { getattr open read map };
+#line 112
+
+#line 112
+
+
+#line 113
+
+#line 113
+allow dumpstate property_socket:sock_file write;
+#line 113
+allow dumpstate init:unix_stream_socket connectto;
+#line 113
+
+#line 113
+allow dumpstate exported_dumpstate_prop:property_service set;
+#line 113
+
+#line 113
+allow dumpstate exported_dumpstate_prop:file { getattr open read map };
+#line 113
+
+#line 113
+
+
+# dumpstate_options_prop is used to pass extra command-line args.
+
+#line 116
+
+#line 116
+allow dumpstate property_socket:sock_file write;
+#line 116
+allow dumpstate init:unix_stream_socket connectto;
+#line 116
+
+#line 116
+allow dumpstate dumpstate_options_prop:property_service set;
+#line 116
+
+#line 116
+allow dumpstate dumpstate_options_prop:file { getattr open read map };
+#line 116
+
+#line 116
+
+
+# Allow dumpstate to kill vendor dumpstate service by init
+
+#line 119
+
+#line 119
+allow dumpstate property_socket:sock_file write;
+#line 119
+allow dumpstate init:unix_stream_socket connectto;
+#line 119
+
+#line 119
+allow dumpstate ctl_dumpstate_prop:property_service set;
+#line 119
+
+#line 119
+allow dumpstate ctl_dumpstate_prop:file { getattr open read map };
+#line 119
+
+#line 119
+
+
+# For dumping dynamic partition information.
+
+#line 122
+
+#line 122
+allow dumpstate property_socket:sock_file write;
+#line 122
+allow dumpstate init:unix_stream_socket connectto;
+#line 122
+
+#line 122
+allow dumpstate lpdumpd_prop:property_service set;
+#line 122
+
+#line 122
+allow dumpstate lpdumpd_prop:file { getattr open read map };
+#line 122
+
+#line 122
+
+
+#line 123
+# Call the server domain and optionally transfer references to it.
+#line 123
+allow dumpstate lpdumpd:binder { call transfer };
+#line 123
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 123
+allow lpdumpd dumpstate:binder transfer;
+#line 123
+# Receive and use open files from the server.
+#line 123
+allow dumpstate lpdumpd:fd use;
+#line 123
+
+
+# For dumping hypervisor information.
+
+#line 126
+allow dumpstate hypervisor_prop:file { getattr open read map };
+#line 126
+
+
+# For dumping device-mapper and snapshot information.
+allow dumpstate gsid_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 130
+
+#line 130
+allow dumpstate property_socket:sock_file write;
+#line 130
+allow dumpstate init:unix_stream_socket connectto;
+#line 130
+
+#line 130
+allow dumpstate ctl_gsid_prop:property_service set;
+#line 130
+
+#line 130
+allow dumpstate ctl_gsid_prop:file { getattr open read map };
+#line 130
+
+#line 130
+
+
+#line 131
+# Call the server domain and optionally transfer references to it.
+#line 131
+allow dumpstate gsid:binder { call transfer };
+#line 131
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 131
+allow gsid dumpstate:binder transfer;
+#line 131
+# Receive and use open files from the server.
+#line 131
+allow dumpstate gsid:fd use;
+#line 131
+
+
+#Allow access to /dev/binderfs/binder_logs
+#line 136
+
+dontaudit dumpstate binderfs_logs_transactions:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate binderfs_logs_transaction_history:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 140
+allow dumpstate ota_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 140
+allow dumpstate ota_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 140
+
+
+# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace
+# is being recorded, the command above will serialize it into
+# /data/misc/perfetto-traces/bugreport/*.pftrace .
+
+#line 145
+# Allow the necessary permissions.
+#line 145
+
+#line 145
+# Old domain may exec the file and transition to the new domain.
+#line 145
+allow dumpstate perfetto_exec:file { getattr open read execute map };
+#line 145
+allow dumpstate perfetto:process transition;
+#line 145
+# New domain is entered by executing the file.
+#line 145
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 145
+# New domain can send SIGCHLD to its caller.
+#line 145
+allow perfetto dumpstate:process sigchld;
+#line 145
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 145
+dontaudit dumpstate perfetto:process noatsecure;
+#line 145
+# XXX dontaudit candidate but requires further study.
+#line 145
+allow dumpstate perfetto:process { siginh rlimitinh };
+#line 145
+
+#line 145
+# Make the transition occur by default.
+#line 145
+type_transition dumpstate perfetto_exec:process perfetto;
+#line 145
+
+allow dumpstate perfetto:process signal;
+allow dumpstate perfetto_traces_data_file:dir { search };
+allow dumpstate perfetto_traces_bugreport_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow dumpstate perfetto_traces_bugreport_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+
+# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null
+# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport
+# zip file. These rules are to allow perfetto.te to inherit dumpstate's
+# /dev/null.
+allow perfetto dumpstate_tmpfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow perfetto dumpstate:fd use;
+
+# system_dlkm_file for /system_dlkm partition
+allow dumpstate system_dlkm_file:dir getattr;
+
+# Allow dumpstate to execute derive_sdk in its own domain
+
+#line 162
+# Allow the necessary permissions.
+#line 162
+
+#line 162
+# Old domain may exec the file and transition to the new domain.
+#line 162
+allow dumpstate derive_sdk_exec:file { getattr open read execute map };
+#line 162
+allow dumpstate derive_sdk:process transition;
+#line 162
+# New domain is entered by executing the file.
+#line 162
+allow derive_sdk derive_sdk_exec:file { entrypoint open read execute getattr map };
+#line 162
+# New domain can send SIGCHLD to its caller.
+#line 162
+allow derive_sdk dumpstate:process sigchld;
+#line 162
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 162
+dontaudit dumpstate derive_sdk:process noatsecure;
+#line 162
+# XXX dontaudit candidate but requires further study.
+#line 162
+allow dumpstate derive_sdk:process { siginh rlimitinh };
+#line 162
+
+#line 162
+# Make the transition occur by default.
+#line 162
+type_transition dumpstate derive_sdk_exec:process derive_sdk;
+#line 162
+
+
+
+#line 164
+typeattribute dumpstate netdomain;
+#line 164
+
+
+#line 165
+# Call the servicemanager and transfer references to it.
+#line 165
+allow dumpstate servicemanager:binder { call transfer };
+#line 165
+# Allow servicemanager to send out callbacks
+#line 165
+allow servicemanager dumpstate:binder { call transfer };
+#line 165
+# servicemanager performs getpidcon on clients.
+#line 165
+allow servicemanager dumpstate:dir search;
+#line 165
+allow servicemanager dumpstate:file { read open };
+#line 165
+allow servicemanager dumpstate:process getattr;
+#line 165
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 165
+# all domains in domain.te.
+#line 165
+
+
+#line 166
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 166
+# deprecated.
+#line 166
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 166
+allow dumpstate sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 166
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 166
+allow dumpstate self:{ capability2 cap2_userns } block_suspend;
+#line 166
+# system_suspend permissions
+#line 166
+
+#line 166
+# Call the server domain and optionally transfer references to it.
+#line 166
+allow dumpstate system_suspend_server:binder { call transfer };
+#line 166
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 166
+allow system_suspend_server dumpstate:binder transfer;
+#line 166
+# Receive and use open files from the server.
+#line 166
+allow dumpstate system_suspend_server:fd use;
+#line 166
+
+#line 166
+allow dumpstate system_suspend_hwservice:hwservice_manager find;
+#line 166
+# halclientdomain permissions
+#line 166
+
+#line 166
+# Call the hwservicemanager and transfer references to it.
+#line 166
+allow dumpstate hwservicemanager:binder { call transfer };
+#line 166
+# Allow hwservicemanager to send out callbacks
+#line 166
+allow hwservicemanager dumpstate:binder { call transfer };
+#line 166
+# hwservicemanager performs getpidcon on clients.
+#line 166
+allow hwservicemanager dumpstate:dir search;
+#line 166
+allow hwservicemanager dumpstate:file { read open map };
+#line 166
+allow hwservicemanager dumpstate:process getattr;
+#line 166
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 166
+# all domains in domain.te.
+#line 166
+
+#line 166
+
+#line 166
+allow dumpstate hwservicemanager_prop:file { getattr open read map };
+#line 166
+
+#line 166
+allow dumpstate hidl_manager_hwservice:hwservice_manager find;
+#line 166
+# AIDL suspend hal permissions
+#line 166
+allow dumpstate hal_system_suspend_service:service_manager find;
+#line 166
+
+#line 166
+# Call the servicemanager and transfer references to it.
+#line 166
+allow dumpstate servicemanager:binder { call transfer };
+#line 166
+# Allow servicemanager to send out callbacks
+#line 166
+allow servicemanager dumpstate:binder { call transfer };
+#line 166
+# servicemanager performs getpidcon on clients.
+#line 166
+allow servicemanager dumpstate:dir search;
+#line 166
+allow servicemanager dumpstate:file { read open };
+#line 166
+allow servicemanager dumpstate:process getattr;
+#line 166
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 166
+# all domains in domain.te.
+#line 166
+
+#line 166
+
+
+# Allow setting process priority, protect from OOM killer, and dropping
+# privileges by switching UID / GID
+allow dumpstate self:{ capability cap_userns } { setuid setgid sys_resource };
+
+# Allow dumpstate to scan through /proc/pid for all processes
+
+#line 173
+allow dumpstate domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 173
+allow dumpstate domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 173
+
+
+allow dumpstate self:{ capability cap_userns } {
+ # Send signals to processes
+ kill
+ # Run iptables
+ net_raw
+ net_admin
+};
+
+# Allow executing files on system, such as:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow dumpstate system_file:file execute_no_trans;
+allow dumpstate vendor_file:file execute_no_trans;
+allow dumpstate toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# hidl searches for files in /system/lib(64)/hw/
+allow dumpstate system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Create and write into /data/anr/
+allow dumpstate self:{ capability cap_userns } { dac_override dac_read_search chown fowner fsetid };
+allow dumpstate anr_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow dumpstate anr_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow reading /data/system/uiderrors.txt
+# TODO: scope this down.
+allow dumpstate system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dumpstate to append into apps' private files.
+allow dumpstate app_data_file_type:file append;
+
+# Read dmesg
+allow dumpstate self:{ capability2 cap2_userns } syslog;
+allow dumpstate kernel:system syslog_read;
+
+# Read /sys/fs/pstore/console-ramoops
+allow dumpstate pstorefs:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+
+# Get process attributes
+allow dumpstate domain:process getattr;
+
+# Signal java processes to dump their stack
+allow dumpstate { appdomain system_server zygote app_zygote }:process signal;
+
+# Signal native processes to dump their stack.
+allow dumpstate {
+ # This list comes from native_processes_to_dump in dumputils/dump_utils.c
+ audioserver
+ cameraserver
+ drmserver
+ inputflinger
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ mediaswcodec
+ sdcardd
+ surfaceflinger
+ vold
+
+ # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.c
+ evsmanagerd
+ hal_audio_server
+ hal_audiocontrol_server
+ hal_bluetooth_server
+ hal_broadcastradio_server
+ hal_camera_server
+ hal_codec2_server
+ hal_drm_server
+ hal_evs_server
+ hal_face_server
+ hal_fingerprint_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_input_processor_server
+ hal_neuralnetworks_server
+ hal_omx_server
+ hal_power_server
+ hal_power_stats_server
+ hal_sensors_server
+ hal_thermal_server
+ hal_vehicle_server
+ hal_vr_server
+ system_suspend_server
+}:process signal;
+
+# On userdebug, dumpstate may fork and execute a command as su. Make sure the
+# timeout logic is allowed to terminate the child process if necessary.
+#line 267
+
+
+# Connect to tombstoned to intercept dumps.
+
+#line 270
+allow dumpstate tombstoned_intercept_socket:sock_file write;
+#line 270
+allow dumpstate tombstoned:unix_stream_socket connectto;
+#line 270
+
+
+# Access to /sys
+allow dumpstate sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+
+allow dumpstate {
+ sysfs_devices_block
+ sysfs_dm
+ sysfs_loop
+ sysfs_usb
+ sysfs_zram
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Ignore other file access under /sys.
+dontaudit dumpstate sysfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# Other random bits of data we want to collect
+
+#line 287
+ allow dumpstate debugfs:file { getattr open read ioctl lock map watch watch_reads };
+#line 287
+ auditallow dumpstate debugfs:file { getattr open read ioctl lock map watch watch_reads };
+#line 287
+
+#line 287
+ allow dumpstate debugfs_mmc:file { getattr open read ioctl lock map watch watch_reads };
+#line 292
+
+
+# df for
+allow dumpstate {
+ block_device
+ cache_file
+ metadata_file
+ rootfs
+ selinuxfs
+ storage_file
+ tmpfs
+}:dir { search getattr };
+allow dumpstate fuse_device:chr_file getattr;
+allow dumpstate { dm_device cache_block_device }:blk_file getattr;
+allow dumpstate { cache_file rootfs }:lnk_file { getattr read };
+
+# Read /dev/cpuctl and /dev/cpuset
+
+#line 309
+allow dumpstate cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 309
+allow dumpstate cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 309
+
+
+#line 310
+allow dumpstate cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 310
+allow dumpstate cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 310
+
+
+# Allow dumpstate to make binder calls to any binder service
+
+#line 313
+# Call the server domain and optionally transfer references to it.
+#line 313
+allow dumpstate binderservicedomain:binder { call transfer };
+#line 313
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 313
+allow binderservicedomain dumpstate:binder transfer;
+#line 313
+# Receive and use open files from the server.
+#line 313
+allow dumpstate binderservicedomain:fd use;
+#line 313
+
+
+#line 314
+# Call the server domain and optionally transfer references to it.
+#line 314
+allow dumpstate { appdomain artd netd wificond }:binder { call transfer };
+#line 314
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 314
+allow { appdomain artd netd wificond } dumpstate:binder transfer;
+#line 314
+# Receive and use open files from the server.
+#line 314
+allow dumpstate { appdomain artd netd wificond }:fd use;
+#line 314
+
+
+# Allow dumpstate to call dump() on specific hals.
+
+#line 317
+
+#line 317
+typeattribute dumpstate halclientdomain;
+#line 317
+typeattribute dumpstate hal_audio_client;
+#line 317
+
+#line 317
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 317
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 317
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 317
+
+#line 317
+typeattribute dumpstate hal_audio;
+#line 317
+# Find passthrough HAL implementations
+#line 317
+allow hal_audio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 317
+allow hal_audio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 317
+allow hal_audio vendor_file:file { read open getattr execute map };
+#line 317
+
+#line 317
+;
+#line 317
+ allow hal_audio_server dumpstate:fifo_file write;
+#line 317
+ allow hal_audio_server dumpstate:fd use;
+#line 317
+
+
+#line 318
+
+#line 318
+typeattribute dumpstate halclientdomain;
+#line 318
+typeattribute dumpstate hal_audiocontrol_client;
+#line 318
+
+#line 318
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 318
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 318
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 318
+
+#line 318
+typeattribute dumpstate hal_audiocontrol;
+#line 318
+# Find passthrough HAL implementations
+#line 318
+allow hal_audiocontrol system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 318
+allow hal_audiocontrol vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 318
+allow hal_audiocontrol vendor_file:file { read open getattr execute map };
+#line 318
+
+#line 318
+;
+#line 318
+ allow hal_audiocontrol_server dumpstate:fifo_file write;
+#line 318
+ allow hal_audiocontrol_server dumpstate:fd use;
+#line 318
+
+
+#line 319
+
+#line 319
+typeattribute dumpstate halclientdomain;
+#line 319
+typeattribute dumpstate hal_authgraph_client;
+#line 319
+
+#line 319
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 319
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 319
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 319
+
+#line 319
+typeattribute dumpstate hal_authgraph;
+#line 319
+# Find passthrough HAL implementations
+#line 319
+allow hal_authgraph system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 319
+allow hal_authgraph vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 319
+allow hal_authgraph vendor_file:file { read open getattr execute map };
+#line 319
+
+#line 319
+;
+#line 319
+ allow hal_authgraph_server dumpstate:fifo_file write;
+#line 319
+ allow hal_authgraph_server dumpstate:fd use;
+#line 319
+
+
+#line 320
+
+#line 320
+typeattribute dumpstate halclientdomain;
+#line 320
+typeattribute dumpstate hal_authsecret_client;
+#line 320
+
+#line 320
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 320
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 320
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 320
+
+#line 320
+typeattribute dumpstate hal_authsecret;
+#line 320
+# Find passthrough HAL implementations
+#line 320
+allow hal_authsecret system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 320
+allow hal_authsecret vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 320
+allow hal_authsecret vendor_file:file { read open getattr execute map };
+#line 320
+
+#line 320
+;
+#line 320
+ allow hal_authsecret_server dumpstate:fifo_file write;
+#line 320
+ allow hal_authsecret_server dumpstate:fd use;
+#line 320
+
+
+#line 321
+
+#line 321
+typeattribute dumpstate halclientdomain;
+#line 321
+typeattribute dumpstate hal_bluetooth_client;
+#line 321
+
+#line 321
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 321
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 321
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 321
+
+#line 321
+typeattribute dumpstate hal_bluetooth;
+#line 321
+# Find passthrough HAL implementations
+#line 321
+allow hal_bluetooth system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 321
+allow hal_bluetooth vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 321
+allow hal_bluetooth vendor_file:file { read open getattr execute map };
+#line 321
+
+#line 321
+;
+#line 321
+ allow hal_bluetooth_server dumpstate:fifo_file write;
+#line 321
+ allow hal_bluetooth_server dumpstate:fd use;
+#line 321
+
+
+#line 322
+
+#line 322
+typeattribute dumpstate halclientdomain;
+#line 322
+typeattribute dumpstate hal_broadcastradio_client;
+#line 322
+
+#line 322
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 322
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 322
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 322
+
+#line 322
+typeattribute dumpstate hal_broadcastradio;
+#line 322
+# Find passthrough HAL implementations
+#line 322
+allow hal_broadcastradio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 322
+allow hal_broadcastradio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 322
+allow hal_broadcastradio vendor_file:file { read open getattr execute map };
+#line 322
+
+#line 322
+;
+#line 322
+ allow hal_broadcastradio_server dumpstate:fifo_file write;
+#line 322
+ allow hal_broadcastradio_server dumpstate:fd use;
+#line 322
+
+
+#line 323
+
+#line 323
+typeattribute dumpstate halclientdomain;
+#line 323
+typeattribute dumpstate hal_camera_client;
+#line 323
+
+#line 323
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 323
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 323
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 323
+
+#line 323
+typeattribute dumpstate hal_camera;
+#line 323
+# Find passthrough HAL implementations
+#line 323
+allow hal_camera system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 323
+allow hal_camera vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 323
+allow hal_camera vendor_file:file { read open getattr execute map };
+#line 323
+
+#line 323
+;
+#line 323
+ allow hal_camera_server dumpstate:fifo_file write;
+#line 323
+ allow hal_camera_server dumpstate:fd use;
+#line 323
+
+
+#line 324
+
+#line 324
+typeattribute dumpstate halclientdomain;
+#line 324
+typeattribute dumpstate hal_codec2_client;
+#line 324
+
+#line 324
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 324
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 324
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 324
+
+#line 324
+typeattribute dumpstate hal_codec2;
+#line 324
+# Find passthrough HAL implementations
+#line 324
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 324
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 324
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 324
+
+#line 324
+;
+#line 324
+ allow hal_codec2_server dumpstate:fifo_file write;
+#line 324
+ allow hal_codec2_server dumpstate:fd use;
+#line 324
+
+
+#line 325
+
+#line 325
+typeattribute dumpstate halclientdomain;
+#line 325
+typeattribute dumpstate hal_contexthub_client;
+#line 325
+
+#line 325
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 325
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 325
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 325
+
+#line 325
+typeattribute dumpstate hal_contexthub;
+#line 325
+# Find passthrough HAL implementations
+#line 325
+allow hal_contexthub system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 325
+allow hal_contexthub vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 325
+allow hal_contexthub vendor_file:file { read open getattr execute map };
+#line 325
+
+#line 325
+;
+#line 325
+ allow hal_contexthub_server dumpstate:fifo_file write;
+#line 325
+ allow hal_contexthub_server dumpstate:fd use;
+#line 325
+
+
+#line 326
+
+#line 326
+typeattribute dumpstate halclientdomain;
+#line 326
+typeattribute dumpstate hal_drm_client;
+#line 326
+
+#line 326
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 326
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 326
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 326
+
+#line 326
+typeattribute dumpstate hal_drm;
+#line 326
+# Find passthrough HAL implementations
+#line 326
+allow hal_drm system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 326
+allow hal_drm vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 326
+allow hal_drm vendor_file:file { read open getattr execute map };
+#line 326
+
+#line 326
+;
+#line 326
+ allow hal_drm_server dumpstate:fifo_file write;
+#line 326
+ allow hal_drm_server dumpstate:fd use;
+#line 326
+
+
+#line 327
+
+#line 327
+typeattribute dumpstate halclientdomain;
+#line 327
+typeattribute dumpstate hal_dumpstate_client;
+#line 327
+
+#line 327
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 327
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 327
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 327
+
+#line 327
+typeattribute dumpstate hal_dumpstate;
+#line 327
+# Find passthrough HAL implementations
+#line 327
+allow hal_dumpstate system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 327
+allow hal_dumpstate vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 327
+allow hal_dumpstate vendor_file:file { read open getattr execute map };
+#line 327
+
+#line 327
+;
+#line 327
+ allow hal_dumpstate_server dumpstate:fifo_file write;
+#line 327
+ allow hal_dumpstate_server dumpstate:fd use;
+#line 327
+
+
+#line 328
+
+#line 328
+typeattribute dumpstate halclientdomain;
+#line 328
+typeattribute dumpstate hal_evs_client;
+#line 328
+
+#line 328
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 328
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 328
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 328
+
+#line 328
+typeattribute dumpstate hal_evs;
+#line 328
+# Find passthrough HAL implementations
+#line 328
+allow hal_evs system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 328
+allow hal_evs vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 328
+allow hal_evs vendor_file:file { read open getattr execute map };
+#line 328
+
+#line 328
+;
+#line 328
+ allow hal_evs_server dumpstate:fifo_file write;
+#line 328
+ allow hal_evs_server dumpstate:fd use;
+#line 328
+
+
+#line 329
+
+#line 329
+typeattribute dumpstate halclientdomain;
+#line 329
+typeattribute dumpstate hal_face_client;
+#line 329
+
+#line 329
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 329
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 329
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 329
+
+#line 329
+typeattribute dumpstate hal_face;
+#line 329
+# Find passthrough HAL implementations
+#line 329
+allow hal_face system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 329
+allow hal_face vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 329
+allow hal_face vendor_file:file { read open getattr execute map };
+#line 329
+
+#line 329
+;
+#line 329
+ allow hal_face_server dumpstate:fifo_file write;
+#line 329
+ allow hal_face_server dumpstate:fd use;
+#line 329
+
+
+#line 330
+
+#line 330
+typeattribute dumpstate halclientdomain;
+#line 330
+typeattribute dumpstate hal_fingerprint_client;
+#line 330
+
+#line 330
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 330
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 330
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 330
+
+#line 330
+typeattribute dumpstate hal_fingerprint;
+#line 330
+# Find passthrough HAL implementations
+#line 330
+allow hal_fingerprint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 330
+allow hal_fingerprint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 330
+allow hal_fingerprint vendor_file:file { read open getattr execute map };
+#line 330
+
+#line 330
+;
+#line 330
+ allow hal_fingerprint_server dumpstate:fifo_file write;
+#line 330
+ allow hal_fingerprint_server dumpstate:fd use;
+#line 330
+
+
+#line 331
+
+#line 331
+typeattribute dumpstate halclientdomain;
+#line 331
+typeattribute dumpstate hal_gnss_client;
+#line 331
+
+#line 331
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 331
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 331
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 331
+
+#line 331
+typeattribute dumpstate hal_gnss;
+#line 331
+# Find passthrough HAL implementations
+#line 331
+allow hal_gnss system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 331
+allow hal_gnss vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 331
+allow hal_gnss vendor_file:file { read open getattr execute map };
+#line 331
+
+#line 331
+;
+#line 331
+ allow hal_gnss_server dumpstate:fifo_file write;
+#line 331
+ allow hal_gnss_server dumpstate:fd use;
+#line 331
+
+
+#line 332
+
+#line 332
+typeattribute dumpstate halclientdomain;
+#line 332
+typeattribute dumpstate hal_graphics_allocator_client;
+#line 332
+
+#line 332
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 332
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 332
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 332
+
+#line 332
+typeattribute dumpstate hal_graphics_allocator;
+#line 332
+# Find passthrough HAL implementations
+#line 332
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 332
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 332
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 332
+
+#line 332
+;
+#line 332
+ allow hal_graphics_allocator_server dumpstate:fifo_file write;
+#line 332
+ allow hal_graphics_allocator_server dumpstate:fd use;
+#line 332
+
+
+#line 333
+
+#line 333
+typeattribute dumpstate halclientdomain;
+#line 333
+typeattribute dumpstate hal_graphics_composer_client;
+#line 333
+
+#line 333
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 333
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 333
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 333
+
+#line 333
+typeattribute dumpstate hal_graphics_composer;
+#line 333
+# Find passthrough HAL implementations
+#line 333
+allow hal_graphics_composer system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 333
+allow hal_graphics_composer vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 333
+allow hal_graphics_composer vendor_file:file { read open getattr execute map };
+#line 333
+
+#line 333
+;
+#line 333
+ allow hal_graphics_composer_server dumpstate:fifo_file write;
+#line 333
+ allow hal_graphics_composer_server dumpstate:fd use;
+#line 333
+
+
+#line 334
+
+#line 334
+typeattribute dumpstate halclientdomain;
+#line 334
+typeattribute dumpstate hal_health_client;
+#line 334
+
+#line 334
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 334
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 334
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 334
+
+#line 334
+typeattribute dumpstate hal_health;
+#line 334
+# Find passthrough HAL implementations
+#line 334
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 334
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 334
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 334
+
+#line 334
+;
+#line 334
+ allow hal_health_server dumpstate:fifo_file write;
+#line 334
+ allow hal_health_server dumpstate:fd use;
+#line 334
+
+
+#line 335
+
+#line 335
+typeattribute dumpstate halclientdomain;
+#line 335
+typeattribute dumpstate hal_identity_client;
+#line 335
+
+#line 335
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 335
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 335
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 335
+
+#line 335
+typeattribute dumpstate hal_identity;
+#line 335
+# Find passthrough HAL implementations
+#line 335
+allow hal_identity system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 335
+allow hal_identity vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 335
+allow hal_identity vendor_file:file { read open getattr execute map };
+#line 335
+
+#line 335
+;
+#line 335
+ allow hal_identity_server dumpstate:fifo_file write;
+#line 335
+ allow hal_identity_server dumpstate:fd use;
+#line 335
+
+
+#line 336
+
+#line 336
+typeattribute dumpstate halclientdomain;
+#line 336
+typeattribute dumpstate hal_input_processor_client;
+#line 336
+
+#line 336
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 336
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 336
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 336
+
+#line 336
+typeattribute dumpstate hal_input_processor;
+#line 336
+# Find passthrough HAL implementations
+#line 336
+allow hal_input_processor system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 336
+allow hal_input_processor vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 336
+allow hal_input_processor vendor_file:file { read open getattr execute map };
+#line 336
+
+#line 336
+;
+#line 336
+ allow hal_input_processor_server dumpstate:fifo_file write;
+#line 336
+ allow hal_input_processor_server dumpstate:fd use;
+#line 336
+
+
+#line 337
+
+#line 337
+typeattribute dumpstate halclientdomain;
+#line 337
+typeattribute dumpstate hal_keymint_client;
+#line 337
+
+#line 337
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 337
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 337
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 337
+
+#line 337
+typeattribute dumpstate hal_keymint;
+#line 337
+# Find passthrough HAL implementations
+#line 337
+allow hal_keymint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 337
+allow hal_keymint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 337
+allow hal_keymint vendor_file:file { read open getattr execute map };
+#line 337
+
+#line 337
+;
+#line 337
+ allow hal_keymint_server dumpstate:fifo_file write;
+#line 337
+ allow hal_keymint_server dumpstate:fd use;
+#line 337
+
+
+#line 338
+
+#line 338
+typeattribute dumpstate halclientdomain;
+#line 338
+typeattribute dumpstate hal_light_client;
+#line 338
+
+#line 338
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 338
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 338
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 338
+
+#line 338
+typeattribute dumpstate hal_light;
+#line 338
+# Find passthrough HAL implementations
+#line 338
+allow hal_light system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 338
+allow hal_light vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 338
+allow hal_light vendor_file:file { read open getattr execute map };
+#line 338
+
+#line 338
+;
+#line 338
+ allow hal_light_server dumpstate:fifo_file write;
+#line 338
+ allow hal_light_server dumpstate:fd use;
+#line 338
+
+
+#line 339
+
+#line 339
+typeattribute dumpstate halclientdomain;
+#line 339
+typeattribute dumpstate hal_memtrack_client;
+#line 339
+
+#line 339
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 339
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 339
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 339
+
+#line 339
+typeattribute dumpstate hal_memtrack;
+#line 339
+# Find passthrough HAL implementations
+#line 339
+allow hal_memtrack system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 339
+allow hal_memtrack vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 339
+allow hal_memtrack vendor_file:file { read open getattr execute map };
+#line 339
+
+#line 339
+;
+#line 339
+ allow hal_memtrack_server dumpstate:fifo_file write;
+#line 339
+ allow hal_memtrack_server dumpstate:fd use;
+#line 339
+
+
+#line 340
+
+#line 340
+typeattribute dumpstate halclientdomain;
+#line 340
+typeattribute dumpstate hal_neuralnetworks_client;
+#line 340
+
+#line 340
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 340
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 340
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 340
+
+#line 340
+typeattribute dumpstate hal_neuralnetworks;
+#line 340
+# Find passthrough HAL implementations
+#line 340
+allow hal_neuralnetworks system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 340
+allow hal_neuralnetworks vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 340
+allow hal_neuralnetworks vendor_file:file { read open getattr execute map };
+#line 340
+
+#line 340
+;
+#line 340
+ allow hal_neuralnetworks_server dumpstate:fifo_file write;
+#line 340
+ allow hal_neuralnetworks_server dumpstate:fd use;
+#line 340
+
+
+#line 341
+
+#line 341
+typeattribute dumpstate halclientdomain;
+#line 341
+typeattribute dumpstate hal_nfc_client;
+#line 341
+
+#line 341
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 341
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 341
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 341
+
+#line 341
+typeattribute dumpstate hal_nfc;
+#line 341
+# Find passthrough HAL implementations
+#line 341
+allow hal_nfc system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 341
+allow hal_nfc vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 341
+allow hal_nfc vendor_file:file { read open getattr execute map };
+#line 341
+
+#line 341
+;
+#line 341
+ allow hal_nfc_server dumpstate:fifo_file write;
+#line 341
+ allow hal_nfc_server dumpstate:fd use;
+#line 341
+
+
+#line 342
+
+#line 342
+typeattribute dumpstate halclientdomain;
+#line 342
+typeattribute dumpstate hal_oemlock_client;
+#line 342
+
+#line 342
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 342
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 342
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 342
+
+#line 342
+typeattribute dumpstate hal_oemlock;
+#line 342
+# Find passthrough HAL implementations
+#line 342
+allow hal_oemlock system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 342
+allow hal_oemlock vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 342
+allow hal_oemlock vendor_file:file { read open getattr execute map };
+#line 342
+
+#line 342
+;
+#line 342
+ allow hal_oemlock_server dumpstate:fifo_file write;
+#line 342
+ allow hal_oemlock_server dumpstate:fd use;
+#line 342
+
+
+#line 343
+
+#line 343
+typeattribute dumpstate halclientdomain;
+#line 343
+typeattribute dumpstate hal_power_client;
+#line 343
+
+#line 343
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 343
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 343
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 343
+
+#line 343
+typeattribute dumpstate hal_power;
+#line 343
+# Find passthrough HAL implementations
+#line 343
+allow hal_power system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 343
+allow hal_power vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 343
+allow hal_power vendor_file:file { read open getattr execute map };
+#line 343
+
+#line 343
+;
+#line 343
+ allow hal_power_server dumpstate:fifo_file write;
+#line 343
+ allow hal_power_server dumpstate:fd use;
+#line 343
+
+
+#line 344
+
+#line 344
+typeattribute dumpstate halclientdomain;
+#line 344
+typeattribute dumpstate hal_power_stats_client;
+#line 344
+
+#line 344
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 344
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 344
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 344
+
+#line 344
+typeattribute dumpstate hal_power_stats;
+#line 344
+# Find passthrough HAL implementations
+#line 344
+allow hal_power_stats system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 344
+allow hal_power_stats vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 344
+allow hal_power_stats vendor_file:file { read open getattr execute map };
+#line 344
+
+#line 344
+;
+#line 344
+ allow hal_power_stats_server dumpstate:fifo_file write;
+#line 344
+ allow hal_power_stats_server dumpstate:fd use;
+#line 344
+
+
+#line 345
+
+#line 345
+typeattribute dumpstate halclientdomain;
+#line 345
+typeattribute dumpstate hal_rebootescrow_client;
+#line 345
+
+#line 345
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 345
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 345
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 345
+
+#line 345
+typeattribute dumpstate hal_rebootescrow;
+#line 345
+# Find passthrough HAL implementations
+#line 345
+allow hal_rebootescrow system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 345
+allow hal_rebootescrow vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 345
+allow hal_rebootescrow vendor_file:file { read open getattr execute map };
+#line 345
+
+#line 345
+;
+#line 345
+ allow hal_rebootescrow_server dumpstate:fifo_file write;
+#line 345
+ allow hal_rebootescrow_server dumpstate:fd use;
+#line 345
+
+
+#line 346
+
+#line 346
+typeattribute dumpstate halclientdomain;
+#line 346
+typeattribute dumpstate hal_secretkeeper_client;
+#line 346
+
+#line 346
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 346
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 346
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 346
+
+#line 346
+typeattribute dumpstate hal_secretkeeper;
+#line 346
+# Find passthrough HAL implementations
+#line 346
+allow hal_secretkeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 346
+allow hal_secretkeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 346
+allow hal_secretkeeper vendor_file:file { read open getattr execute map };
+#line 346
+
+#line 346
+;
+#line 346
+ allow hal_secretkeeper_server dumpstate:fifo_file write;
+#line 346
+ allow hal_secretkeeper_server dumpstate:fd use;
+#line 346
+
+
+#line 347
+
+#line 347
+typeattribute dumpstate halclientdomain;
+#line 347
+typeattribute dumpstate hal_sensors_client;
+#line 347
+
+#line 347
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 347
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 347
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 347
+
+#line 347
+typeattribute dumpstate hal_sensors;
+#line 347
+# Find passthrough HAL implementations
+#line 347
+allow hal_sensors system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 347
+allow hal_sensors vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 347
+allow hal_sensors vendor_file:file { read open getattr execute map };
+#line 347
+
+#line 347
+;
+#line 347
+ allow hal_sensors_server dumpstate:fifo_file write;
+#line 347
+ allow hal_sensors_server dumpstate:fd use;
+#line 347
+
+
+#line 348
+
+#line 348
+typeattribute dumpstate halclientdomain;
+#line 348
+typeattribute dumpstate hal_thermal_client;
+#line 348
+
+#line 348
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 348
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 348
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 348
+
+#line 348
+typeattribute dumpstate hal_thermal;
+#line 348
+# Find passthrough HAL implementations
+#line 348
+allow hal_thermal system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 348
+allow hal_thermal vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 348
+allow hal_thermal vendor_file:file { read open getattr execute map };
+#line 348
+
+#line 348
+;
+#line 348
+ allow hal_thermal_server dumpstate:fifo_file write;
+#line 348
+ allow hal_thermal_server dumpstate:fd use;
+#line 348
+
+
+#line 349
+
+#line 349
+typeattribute dumpstate halclientdomain;
+#line 349
+typeattribute dumpstate hal_vehicle_client;
+#line 349
+
+#line 349
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 349
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 349
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 349
+
+#line 349
+typeattribute dumpstate hal_vehicle;
+#line 349
+# Find passthrough HAL implementations
+#line 349
+allow hal_vehicle system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 349
+allow hal_vehicle vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 349
+allow hal_vehicle vendor_file:file { read open getattr execute map };
+#line 349
+
+#line 349
+;
+#line 349
+ allow hal_vehicle_server dumpstate:fifo_file write;
+#line 349
+ allow hal_vehicle_server dumpstate:fd use;
+#line 349
+
+
+#line 350
+
+#line 350
+typeattribute dumpstate halclientdomain;
+#line 350
+typeattribute dumpstate hal_vm_capabilities_client;
+#line 350
+
+#line 350
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 350
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 350
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 350
+
+#line 350
+typeattribute dumpstate hal_vm_capabilities;
+#line 350
+# Find passthrough HAL implementations
+#line 350
+allow hal_vm_capabilities system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 350
+allow hal_vm_capabilities vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 350
+allow hal_vm_capabilities vendor_file:file { read open getattr execute map };
+#line 350
+
+#line 350
+;
+#line 350
+ allow hal_vm_capabilities_server dumpstate:fifo_file write;
+#line 350
+ allow hal_vm_capabilities_server dumpstate:fd use;
+#line 350
+
+
+#line 351
+
+#line 351
+typeattribute dumpstate halclientdomain;
+#line 351
+typeattribute dumpstate hal_weaver_client;
+#line 351
+
+#line 351
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 351
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 351
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 351
+
+#line 351
+typeattribute dumpstate hal_weaver;
+#line 351
+# Find passthrough HAL implementations
+#line 351
+allow hal_weaver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 351
+allow hal_weaver vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 351
+allow hal_weaver vendor_file:file { read open getattr execute map };
+#line 351
+
+#line 351
+;
+#line 351
+ allow hal_weaver_server dumpstate:fifo_file write;
+#line 351
+ allow hal_weaver_server dumpstate:fd use;
+#line 351
+
+
+#line 352
+
+#line 352
+typeattribute dumpstate halclientdomain;
+#line 352
+typeattribute dumpstate hal_wifi_client;
+#line 352
+
+#line 352
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 352
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 352
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 352
+
+#line 352
+typeattribute dumpstate hal_wifi;
+#line 352
+# Find passthrough HAL implementations
+#line 352
+allow hal_wifi system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 352
+allow hal_wifi vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 352
+allow hal_wifi vendor_file:file { read open getattr execute map };
+#line 352
+
+#line 352
+;
+#line 352
+ allow hal_wifi_server dumpstate:fifo_file write;
+#line 352
+ allow hal_wifi_server dumpstate:fd use;
+#line 352
+
+
+# Vibrate the device after we are done collecting the bugreport
+
+#line 355
+typeattribute dumpstate halclientdomain;
+#line 355
+typeattribute dumpstate hal_vibrator_client;
+#line 355
+
+#line 355
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 355
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 355
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 355
+
+#line 355
+typeattribute dumpstate hal_vibrator;
+#line 355
+# Find passthrough HAL implementations
+#line 355
+allow hal_vibrator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 355
+allow hal_vibrator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 355
+allow hal_vibrator vendor_file:file { read open getattr execute map };
+#line 355
+
+#line 355
+
+
+# Reading /proc/PID/maps of other processes
+allow dumpstate self:{ capability cap_userns } sys_ptrace;
+
+# Allow the bugreport service to create a file in
+# /data/data/com.android.shell/files/bugreports/bugreport
+allow dumpstate shell_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow dumpstate shell_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Run a shell.
+allow dumpstate shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# For running am and similar framework commands.
+# Run /system/bin/app_process.
+allow dumpstate zygote_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# For Bluetooth
+allow dumpstate bluetooth_data_file:dir search;
+allow dumpstate bluetooth_logs_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate bluetooth_logs_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# For Nfc
+allow dumpstate nfc_logs_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate nfc_logs_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# For uwb
+allow dumpstate apex_module_data_file:dir search;
+allow dumpstate apex_system_server_data_file:dir search;
+allow dumpstate apex_uwb_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate apex_uwb_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
+allow dumpstate gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow dumpstate gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# logd access
+
+#line 392
+allow dumpstate logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 392
+
+#line 392
+allow dumpstate logdr_socket:sock_file write;
+#line 392
+allow dumpstate logd:unix_stream_socket connectto;
+#line 392
+
+#line 392
+
+
+#line 393
+# Group AID_LOG checked by filesystem & logd
+#line 393
+# to permit control commands
+#line 393
+
+#line 393
+allow dumpstate logd_socket:sock_file write;
+#line 393
+allow dumpstate logd:unix_stream_socket connectto;
+#line 393
+
+#line 393
+
+
+#line 394
+allow dumpstate runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 394
+
+
+# Read files in /proc
+allow dumpstate {
+ proc_allocinfo
+ proc_bootconfig
+ proc_buddyinfo
+ proc_cmdline
+ proc_meminfo
+ proc_modules
+ proc_net_type
+ proc_pipe_conf
+ proc_pagetypeinfo
+ proc_qtaguid_ctrl
+ proc_qtaguid_stat
+ proc_slabinfo
+ proc_version
+ proc_vmallocinfo
+ proc_vmstat
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read network state info files.
+allow dumpstate net_data_file:dir search;
+allow dumpstate net_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# List sockets via ss.
+allow dumpstate self:netlink_tcpdiag_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_read };
+
+# Access /data/tombstones.
+allow dumpstate tombstone_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate tombstone_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /cache/recovery
+allow dumpstate cache_recovery_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate cache_recovery_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/misc/recovery
+allow dumpstate recovery_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate recovery_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/misc/update_engine & /data/misc/update_engine_log
+allow dumpstate { update_engine_data_file update_engine_log_data_file }:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate { update_engine_data_file update_engine_log_data_file }:file { getattr open read ioctl lock map watch watch_reads };
+# Access /data/misc/snapuserd_log
+allow dumpstate snapuserd_log_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate snapuserd_log_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/misc/profiles/{cur,ref}/
+#line 445
+
+
+# Access /data/misc/logd
+allow dumpstate misc_logd_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate misc_logd_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/misc/prereboot
+allow dumpstate prereboot_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate prereboot_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow dumpstate app_fuse_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate overlayfs_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+allow dumpstate {
+ service_manager_type
+ -apex_service
+ -dumpstate_service
+ -gatekeeper_service
+ -hal_service_type
+ -virtual_touchpad_service
+ -vold_service
+ -fwk_vold_service
+ -default_android_service
+}:service_manager find;
+# suppress denials for services dumpstate should not be accessing.
+dontaudit dumpstate {
+ apex_service
+ dumpstate_service
+ gatekeeper_service
+ hal_service_type
+ virtual_touchpad_service
+ vold_service
+ fwk_vold_service
+}:service_manager find;
+
+# Most of these are neverallowed.
+dontaudit dumpstate hwservice_manager_type:hwservice_manager find;
+
+allow dumpstate servicemanager:service_manager list;
+allow dumpstate hwservicemanager:hwservice_manager list;
+
+allow dumpstate devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read any system properties
+
+#line 489
+allow dumpstate property_type:file { getattr open read map };
+#line 489
+
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow dumpstate media_rw_data_file:dir getattr;
+allow dumpstate proc_interrupts:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate proc_zoneinfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# Create a service for talking back to system_server
+
+#line 499
+ allow dumpstate dumpstate_service:service_manager { add find };
+#line 499
+ neverallow { domain -dumpstate } dumpstate_service:service_manager add;
+#line 499
+
+#line 499
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 499
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 499
+
+#line 499
+
+
+# use /dev/ion for screen capture
+allow dumpstate ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dumpstate to run top
+allow dumpstate proc_stat:file { getattr open read ioctl lock map watch watch_reads };
+
+allow dumpstate proc_pressure_cpu:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate proc_pressure_mem:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate proc_pressure_io:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dumpstate to run ps
+allow dumpstate proc_pid_max:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow dumpstate to talk to installd over binder
+
+#line 515
+# Call the server domain and optionally transfer references to it.
+#line 515
+allow dumpstate installd:binder { call transfer };
+#line 515
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 515
+allow installd dumpstate:binder transfer;
+#line 515
+# Receive and use open files from the server.
+#line 515
+allow dumpstate installd:fd use;
+#line 515
+;
+
+# Allow dumpstate to run ip xfrm policy
+allow dumpstate self:netlink_xfrm_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_read };
+
+# Allow dumpstate to run iotop
+allow dumpstate self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+# newer kernels (e.g. 4.4) have a new class for sockets
+allow dumpstate self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Allow dumpstate to run ss
+allow dumpstate { domain pdx_channel_socket_type pdx_endpoint_socket_type }:{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } getattr;
+
+# Allow dumpstate to read linkerconfig directory
+allow dumpstate linkerconfig_file:dir { read open };
+
+# For when dumpstate runs df
+dontaudit dumpstate {
+ mnt_vendor_file
+ mirror_data_file
+ mnt_user_file
+ mnt_product_file
+}:dir search;
+dontaudit dumpstate {
+ apex_mnt_dir
+ linkerconfig_file
+ mirror_data_file
+ mnt_user_file
+ vm_data_file
+}:dir getattr;
+
+#suppress denials for dumpstate to call vitualizationservice.
+dontaudit dumpstate virtualizationservice:binder { call };
+
+# Allow dumpstate to talk to bufferhubd over binder
+
+#line 550
+# Call the server domain and optionally transfer references to it.
+#line 550
+allow dumpstate bufferhubd:binder { call transfer };
+#line 550
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 550
+allow bufferhubd dumpstate:binder transfer;
+#line 550
+# Receive and use open files from the server.
+#line 550
+allow dumpstate bufferhubd:fd use;
+#line 550
+;
+
+# Allow dumpstate to talk to mediaswcodec over binder
+
+#line 553
+# Call the server domain and optionally transfer references to it.
+#line 553
+allow dumpstate mediaswcodec:binder { call transfer };
+#line 553
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 553
+allow mediaswcodec dumpstate:binder transfer;
+#line 553
+# Receive and use open files from the server.
+#line 553
+allow dumpstate mediaswcodec:fd use;
+#line 553
+;
+
+#Access /data/misc/snapshotctl_log
+allow dumpstate snapshotctl_log_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate snapshotctl_log_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+#Allow access to /dev/binderfs/binder_logs
+allow dumpstate binderfs_logs:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate binderfs_logs:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate binderfs_logs_proc:file { getattr open read ioctl lock map watch watch_reads };
+allow dumpstate binderfs_logs_stats:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 565
+ allow dumpstate apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 565
+ allow dumpstate apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 565
+
+#line 565
+allow dumpstate vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 565
+allow dumpstate vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 565
+
+#line 565
+
+
+# Allow reading files under /data/system/shutdown-checkpoints/
+allow dumpstate shutdown_checkpoints_system_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow dumpstate shutdown_checkpoints_system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### neverallow rules
+###
+
+# dumpstate has capability sys_ptrace, but should only use that capability for
+# accessing sensitive /proc/PID files, never for using ptrace attach.
+neverallow dumpstate *:process ptrace;
+
+# only system_server, dumpstate, traceur_app and shell can find the dumpstate service
+neverallow {
+ domain
+ -system_server
+ -shell
+ -traceur_app
+ -dumpstate
+} dumpstate_service:service_manager find;
+
+# only dumpstate, system_server and related others to access apex_uwb_data_file
+neverallow {
+ domain
+ -dumpstate
+ -system_server
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_uwb_data_file:dir { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow {
+ domain
+ -dumpstate
+ -system_server
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_uwb_data_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1 "system/sepolicy/private/e2fs.te"
+allow e2fs devpts:chr_file { read write getattr ioctl };
+
+allow e2fs dev_type:blk_file getattr;
+allow e2fs block_device:dir search;
+allow e2fs userdata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow e2fs metadata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow e2fs dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow e2fs zoned_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# Vold needs to capture mkfs.ext4's output
+allow e2fs vold:fd use;
+# Need to be able to format a partition
+allow e2fs sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+allow e2fs sysfs_dm:file { getattr open read ioctl lock map watch watch_reads };
+
+allowxperm e2fs { userdata_block_device metadata_block_device dm_device zoned_block_device }:blk_file ioctl {
+ 0x0000127d 0x00001277 0x0000127b 0x0000127c 0x0000125e 0xc0101282 0x40101283
+};
+
+allow e2fs {
+ proc_filesystems
+ proc_mounts
+ proc_swaps
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# access /sys/fs/ext4/features
+allow e2fs sysfs_fs_ext4_features:dir search;
+allow e2fs sysfs_fs_ext4_features:file { getattr open read ioctl lock map watch watch_reads };
+
+# access SELinux context files
+allow e2fs file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/early_virtmgr.te"
+
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ allow early_virtmgr system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+ allow early_virtmgr system_bootstrap_lib_file:file { execute read open getattr map };
+#line 1
+
+#line 1
+
+#line 1
+ # Let early_virtmgr create files and directories inside /mnt/vm/early.
+#line 1
+ allow early_virtmgr vm_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+#line 1
+ allow early_virtmgr vm_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1
+ allow early_virtmgr vm_data_file:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1
+
+#line 1
+ # Allow early_virtmgr to communicate use, read and write over the adb connection.
+#line 1
+ allow early_virtmgr adbd:fd use;
+#line 1
+ allow early_virtmgr adbd:unix_stream_socket { getattr read write };
+#line 1
+
+#line 1
+ # Allow writing VM logs to the shell console
+#line 1
+ allow early_virtmgr devpts:chr_file { read write getattr ioctl };
+#line 1
+
+#line 1
+ # Let the early_virtmgr domain use Binder.
+#line 1
+
+#line 1
+# Call the servicemanager and transfer references to it.
+#line 1
+allow early_virtmgr servicemanager:binder { call transfer };
+#line 1
+# Allow servicemanager to send out callbacks
+#line 1
+allow servicemanager early_virtmgr:binder { call transfer };
+#line 1
+# servicemanager performs getpidcon on clients.
+#line 1
+allow servicemanager early_virtmgr:dir search;
+#line 1
+allow servicemanager early_virtmgr:file { read open };
+#line 1
+allow servicemanager early_virtmgr:process getattr;
+#line 1
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 1
+# all domains in domain.te.
+#line 1
+
+#line 1
+
+#line 1
+ # When early_virtmgr execs a file with the crosvm_exec label, run it in the crosvm domain.
+#line 1
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow early_virtmgr crosvm_exec:file { getattr open read execute map };
+#line 1
+allow early_virtmgr crosvm:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow crosvm crosvm_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+allow crosvm early_virtmgr:process sigchld;
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit early_virtmgr crosvm:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow early_virtmgr crosvm:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition early_virtmgr crosvm_exec:process crosvm;
+#line 1
+
+#line 1
+
+#line 1
+ # Let early_virtmgr kill crosvm.
+#line 1
+ allow early_virtmgr crosvm:process sigkill;
+#line 1
+
+#line 1
+ # Allow early_virtmgr to read apex-info-list.xml and access the APEX files listed there.
+#line 1
+ allow early_virtmgr apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 1
+ allow early_virtmgr apex_data_file:dir search;
+#line 1
+
+#line 1
+ # Ignore harmless denials on /proc/self/fd
+#line 1
+ dontaudit early_virtmgr self:dir write;
+#line 1
+
+#line 1
+ # Let early_virtmgr to accept vsock connection from the guest VMs
+#line 1
+ allow early_virtmgr self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } listen accept };
+#line 1
+
+#line 1
+ # Allow early_virtmgr to inspect all hypervisor capabilities.
+#line 1
+
+#line 1
+allow early_virtmgr hypervisor_prop:file { getattr open read map };
+#line 1
+
+#line 1
+
+#line 1
+allow early_virtmgr hypervisor_pvmfw_prop:file { getattr open read map };
+#line 1
+
+#line 1
+
+#line 1
+allow early_virtmgr hypervisor_restricted_prop:file { getattr open read map };
+#line 1
+
+#line 1
+
+#line 1
+allow early_virtmgr hypervisor_virtualizationmanager_prop:file { getattr open read map };
+#line 1
+
+#line 1
+
+#line 1
+ # Allow early_virtmgr to read file system DT for VM reference DT and AVF debug policy
+#line 1
+
+#line 1
+allow early_virtmgr proc_dt_avf:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+allow early_virtmgr proc_dt_avf:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1
+
+#line 1
+
+#line 1
+allow early_virtmgr sysfs_dt_avf:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+allow early_virtmgr sysfs_dt_avf:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1
+
+#line 1
+
+#line 1
+ # early_virtmgr to be client of secretkeeper HAL. It ferries SecretManagement messages from pVM
+#line 1
+ # to HAL.
+#line 1
+
+#line 1
+typeattribute early_virtmgr halclientdomain;
+#line 1
+typeattribute early_virtmgr hal_secretkeeper_client;
+#line 1
+
+#line 1
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 1
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 1
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 1
+
+#line 1
+typeattribute early_virtmgr hal_secretkeeper;
+#line 1
+# Find passthrough HAL implementations
+#line 1
+allow hal_secretkeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+allow hal_secretkeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+allow hal_secretkeeper vendor_file:file { read open getattr execute map };
+#line 1
+
+#line 1
+;
+#line 1
+
+#line 1
+ # Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
+#line 1
+
+#line 1
+allow early_virtmgr crosvm:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+allow early_virtmgr crosvm:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1
+;
+#line 1
+
+#line 1
+ # Allow early_virtmgr to:
+#line 1
+ # 1) bind to a vsock port less than 1024, because early VMs use static CIDs less than 1024
+#line 1
+ # 2) call RLIMIT_MEMLOCK for itself
+#line 1
+ allow early_virtmgr self:{ capability cap_userns } { net_bind_service ipc_lock sys_resource };
+#line 1
+
+#line 1
+ # early_virtmgr may print messages to kmsg_debug_device.
+#line 1
+ allow early_virtmgr kmsg_debug_device:chr_file { open append write lock map };
+#line 1
+
+#line 1
+ ###
+#line 1
+ ### Neverallow rules
+#line 1
+ ###
+#line 1
+
+#line 1
+ # Only crosvm and early_virtmgr can access vm_data_file
+#line 1
+ neverallow { domain -crosvm -early_virtmgr -init } vm_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+#line 1
+ neverallow { domain -crosvm -early_virtmgr } vm_data_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1
+
+#line 1
+ # No other domains can accept vsock connection from the guest VMs
+#line 1
+ neverallow { domain -early_virtmgr } early_virtmgr:vsock_socket { accept bind create connect listen };
+#line 75
+
+#line 1 "system/sepolicy/private/ephemeral_app.te"
+###
+### Ephemeral apps.
+###
+### This file defines the security policy for apps with the ephemeral
+### feature.
+###
+### The ephemeral_app domain is a reduced permissions sandbox allowing
+### ephemeral applications to be safely installed and run. Non ephemeral
+### applications may also opt-in to ephemeral to take advantage of the
+### additional security features.
+###
+### PackageManager flags an app as ephemeral at install time.
+
+typeattribute ephemeral_app coredomain;
+
+
+#line 16
+typeattribute ephemeral_app netdomain;
+#line 16
+
+
+#line 17
+typeattribute ephemeral_app appdomain;
+#line 17
+# Label tmpfs objects for all apps.
+#line 17
+type_transition ephemeral_app tmpfs:file appdomain_tmpfs;
+#line 17
+
+#line 17
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 17
+type ephemeral_app_userfaultfd;
+#line 17
+type_transition ephemeral_app ephemeral_app:anon_inode ephemeral_app_userfaultfd "[userfaultfd]";
+#line 17
+# Allow domain to create/use userfaultfd anon_inode.
+#line 17
+allow ephemeral_app ephemeral_app_userfaultfd:anon_inode { create ioctl read };
+#line 17
+# Suppress errors generate during bugreport
+#line 17
+dontaudit su ephemeral_app_userfaultfd:anon_inode *;
+#line 17
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 17
+neverallow { domain -ephemeral_app } ephemeral_app_userfaultfd:anon_inode *;
+#line 17
+
+#line 17
+allow ephemeral_app appdomain_tmpfs:file { execute getattr map read write };
+#line 17
+neverallow { ephemeral_app -runas_app -shell -simpleperf } { domain -ephemeral_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 17
+neverallow { appdomain -runas_app -shell -simpleperf -ephemeral_app } ephemeral_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 17
+# The Android security model guarantees the confidentiality and integrity
+#line 17
+# of application data and execution state. Ptrace bypasses those
+#line 17
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 17
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 17
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 17
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 17
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 17
+# live lock conditions.
+#line 17
+neverallow { domain -ephemeral_app -crash_dump -runas_app -simpleperf } ephemeral_app:process ptrace;
+#line 17
+
+
+# Allow ephemeral apps to read/write files in visible storage if provided fds
+allow ephemeral_app { sdcard_type fuse media_rw_data_file }:file {read write getattr ioctl lock append};
+
+# Some apps ship with shared libraries and binaries that they write out
+# to their sandbox directory and then execute.
+allow ephemeral_app privapp_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+allow ephemeral_app app_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# Follow priv-app symlinks. This is used for dynamite functionality.
+allow ephemeral_app privapp_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow the renderscript compiler to be run.
+
+#line 31
+# Allow the necessary permissions.
+#line 31
+
+#line 31
+# Old domain may exec the file and transition to the new domain.
+#line 31
+allow ephemeral_app rs_exec:file { getattr open read execute map };
+#line 31
+allow ephemeral_app rs:process transition;
+#line 31
+# New domain is entered by executing the file.
+#line 31
+allow rs rs_exec:file { entrypoint open read execute getattr map };
+#line 31
+# New domain can send SIGCHLD to its caller.
+#line 31
+allow rs ephemeral_app:process sigchld;
+#line 31
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 31
+dontaudit ephemeral_app rs:process noatsecure;
+#line 31
+# XXX dontaudit candidate but requires further study.
+#line 31
+allow ephemeral_app rs:process { siginh rlimitinh };
+#line 31
+
+#line 31
+# Make the transition occur by default.
+#line 31
+type_transition ephemeral_app rs_exec:process rs;
+#line 31
+
+
+# Allow loading and deleting shared libraries created by trusted system
+# components within an application home directory.
+allow ephemeral_app app_exec_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute unlink };
+
+# services
+allow ephemeral_app audioserver_service:service_manager find;
+allow ephemeral_app cameraserver_service:service_manager find;
+allow ephemeral_app mediaserver_service:service_manager find;
+allow ephemeral_app mediaextractor_service:service_manager find;
+allow ephemeral_app mediametrics_service:service_manager find;
+allow ephemeral_app mediadrmserver_service:service_manager find;
+allow ephemeral_app drmserver_service:service_manager find;
+allow ephemeral_app radio_service:service_manager find;
+allow ephemeral_app ephemeral_app_api_service:service_manager find;
+
+# allow ephemeral apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow ephemeral_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+allow ephemeral_app ashmem_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+###
+### neverallow rules
+###
+
+neverallow ephemeral_app app_data_file_type:file execute_no_trans;
+
+# Receive or send uevent messages.
+neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow ephemeral_app domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow ephemeral_app debugfs_type:file read;
+
+# execute gpu_device
+neverallow ephemeral_app gpu_device:chr_file execute;
+
+# access files in /sys with the default sysfs label
+neverallow ephemeral_app sysfs:file *;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow ephemeral_app proc:file { { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads } { execute execute_no_trans } };
+
+# Directly access external storage
+neverallow ephemeral_app { sdcard_type fuse media_rw_data_file }:file {open create};
+neverallow ephemeral_app { sdcard_type fuse media_rw_data_file }:dir search;
+
+# Avoid reads to proc_net, it contains too much device wide information about
+# ongoing connections.
+neverallow ephemeral_app proc_net:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1 "system/sepolicy/private/evsmanagerd.te"
+# evsmanager
+typeattribute evsmanagerd coredomain;
+typeattribute evsmanagerd evsmanager_service_server;
+
+type evsmanagerd_exec, system_file_type, exec_type, file_type;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init evsmanagerd_exec:file { getattr open read execute map };
+#line 7
+allow init evsmanagerd:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow evsmanagerd evsmanagerd_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init evsmanagerd:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init evsmanagerd:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init evsmanagerd_exec:process evsmanagerd;
+#line 7
+
+#line 7
+;
+
+# Declares as a binder service
+
+#line 10
+typeattribute evsmanagerd binderservicedomain;
+#line 10
+
+
+# Allows to add a service to service_manager
+
+#line 13
+ allow evsmanagerd evsmanagerd_service:service_manager { add find };
+#line 13
+ neverallow { domain -evsmanagerd } evsmanagerd_service:service_manager add;
+#line 13
+
+#line 13
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 13
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 13
+
+#line 13
+
+
+# Allows to use the binder IPC
+
+#line 16
+# Call the servicemanager and transfer references to it.
+#line 16
+allow evsmanagerd servicemanager:binder { call transfer };
+#line 16
+# Allow servicemanager to send out callbacks
+#line 16
+allow servicemanager evsmanagerd:binder { call transfer };
+#line 16
+# servicemanager performs getpidcon on clients.
+#line 16
+allow servicemanager evsmanagerd:dir search;
+#line 16
+allow servicemanager evsmanagerd:file { read open };
+#line 16
+allow servicemanager evsmanagerd:process getattr;
+#line 16
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 16
+# all domains in domain.te.
+#line 16
+
+
+# Allows binder IPCs to the various system services
+
+#line 19
+# Call the server domain and optionally transfer references to it.
+#line 19
+allow evsmanagerd system_server:binder { call transfer };
+#line 19
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 19
+allow system_server evsmanagerd:binder transfer;
+#line 19
+# Receive and use open files from the server.
+#line 19
+allow evsmanagerd system_server:fd use;
+#line 19
+
+
+# Allows to use EVS HAL implementations
+
+#line 22
+typeattribute evsmanagerd halclientdomain;
+#line 22
+typeattribute evsmanagerd hal_evs_client;
+#line 22
+
+#line 22
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 22
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 22
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 22
+
+#line 22
+typeattribute evsmanagerd hal_evs;
+#line 22
+# Find passthrough HAL implementations
+#line 22
+allow hal_evs system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 22
+allow hal_evs vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 22
+allow hal_evs vendor_file:file { read open getattr execute map };
+#line 22
+
+#line 22
+
+
+# Allows to write messages to the shell
+allow evsmanagerd shell:fd use;
+allow evsmanagerd shell:fifo_file write;
+
+# Allows to use the graphics allocator
+allow evsmanagerd hal_graphics_allocator:fd use;
+
+# Allows to use a bootstrap statsd
+allow evsmanagerd statsbootstrap_service:service_manager find;
+
+# Allows binder IPCs to the CarService
+
+#line 35
+# Call the server domain and optionally transfer references to it.
+#line 35
+allow evsmanagerd appdomain:binder { call transfer };
+#line 35
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 35
+allow appdomain evsmanagerd:binder transfer;
+#line 35
+# Receive and use open files from the server.
+#line 35
+allow evsmanagerd appdomain:fd use;
+#line 35
+
+
+# For HIDL evs manager implementation
+allow evsmanagerd hal_evs_hwservice:hwservice_manager add;
+allow evsmanagerd hidl_base_hwservice:hwservice_manager add;
+#line 1 "system/sepolicy/private/extra_free_kbytes.te"
+typeattribute extra_free_kbytes coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init extra_free_kbytes_exec:file { getattr open read execute map };
+#line 3
+allow init extra_free_kbytes:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow extra_free_kbytes extra_free_kbytes_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init extra_free_kbytes:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init extra_free_kbytes:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init extra_free_kbytes_exec:process extra_free_kbytes;
+#line 3
+
+#line 3
+
+
+# Only extra_free_kbytes script is allowed to store these properties
+
+#line 6
+
+#line 6
+allow extra_free_kbytes property_socket:sock_file write;
+#line 6
+allow extra_free_kbytes init:unix_stream_socket connectto;
+#line 6
+
+#line 6
+allow extra_free_kbytes init_storage_prop:property_service set;
+#line 6
+
+#line 6
+allow extra_free_kbytes init_storage_prop:file { getattr open read map };
+#line 6
+
+#line 6
+
+
+# required permissions to run the script from init
+allow extra_free_kbytes shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow extra_free_kbytes system_file:file { getattr execute execute_no_trans map };
+allow extra_free_kbytes toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# files used by the script
+allow extra_free_kbytes proc_extra_free_kbytes:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow extra_free_kbytes proc_watermark_scale_factor:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow extra_free_kbytes proc_zoneinfo:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/fastbootd.te"
+typeattribute fastbootd coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise fastbootd is only allowed the domain rules.
+#line 165
+
+
+# This capability allows fastbootd to circumvent memlock rlimits while using
+# io_uring. An Alternative would be to up the memlock rlimit for the fastbootd service.
+allow fastbootd self:capability ipc_lock;
+
+#line 170
+# Set up a type_transition to "io_uring" named anonymous inode object.
+#line 170
+type fastbootd_iouring;
+#line 170
+type_transition fastbootd fastbootd:anon_inode fastbootd_iouring "[io_uring]";
+#line 170
+# Allow domain to create/use io_uring anon_inode.
+#line 170
+allow fastbootd fastbootd_iouring:anon_inode { create map read write };
+#line 170
+allow fastbootd self:io_uring sqpoll;
+#line 170
+# Other domains may not use iouring anon_inodes created by this domain.
+#line 170
+neverallow { domain -fastbootd } fastbootd_iouring:anon_inode *;
+#line 170
+# io_uring checks for CAP_IPC_LOCK to determine whether or not to track
+#line 170
+# memory usage per uid against RLIMIT_MEMLOCK. This can lead folks to
+#line 170
+# grant CAP_IPC_LOCK to silence avc denials, which is undesireable.
+#line 170
+dontaudit fastbootd self:{ capability cap_userns } ipc_lock;
+#line 170
+
+
+###
+### neverallow rules
+###
+
+# Write permission is required to wipe userdata
+# until recovery supports vold.
+neverallow fastbootd {
+ data_file_type
+}:file { { execute execute_no_trans } };
+#line 1 "system/sepolicy/private/file.te"
+# /proc/allocinfo
+type proc_allocinfo, fs_type, proc_type;
+
+# /proc/config.gz
+type config_gz, fs_type, proc_type;
+
+# /sys/fs/bpf/<dir> for mainline tethering use
+# TODO: move S+ fs_bpf_tethering here from public/file.te
+type fs_bpf_net_private, fs_type, bpffs_type;
+type fs_bpf_net_shared, fs_type, bpffs_type;
+type fs_bpf_netd_readonly, fs_type, bpffs_type;
+type fs_bpf_netd_shared, fs_type, bpffs_type;
+type fs_bpf_loader, fs_type, bpffs_type;
+type fs_bpf_uprobestats, fs_type, bpffs_type;
+type fs_bpf_memevents, fs_type, bpffs_type;
+
+# /data/misc/storaged
+type storaged_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/wmtrace for wm traces
+type wm_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+
+# /data/misc/a11ytrace for accessibility traces
+type accessibility_trace_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces for perfetto traces
+type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports.
+type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces/profiling for perfetto traces from profiling apis.
+type perfetto_traces_profiling_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-configs for perfetto configs
+type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
+
+# /system/etc/perfetto for perfetto configs
+type system_perfetto_config_file, file_type, system_file_type;
+
+# /data/misc/uprobestats-configs for uprobestats configs
+type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type;
+
+# /apex/com.android.art/bin/oatdump
+# TODO (b/350628688): Remove this once it's safe to do so.
+type oatdump_exec, system_file_type, exec_type, file_type;
+
+# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
+type sdk_sandbox_system_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc_{ce/de}/<user>/sdksandbox/<app-name>/* subdirectory for sdk sandbox processes
+type sdk_sandbox_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+
+# /sys/kernel/debug/kcov for coverage guided kernel fuzzing in userdebug builds.
+type debugfs_kcov, fs_type, debugfs_type;
+
+# App executable files in /data/data directories
+type app_exec_data_file, file_type, data_file_type, core_data_file_type;
+typealias app_exec_data_file alias rs_data_file;
+
+# /data/misc_[ce|de]/rollback : Used by installd to store snapshots
+# of application data.
+type rollback_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc_ce/checkin for checkin apps.
+type checkin_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/gsi/ota
+type ota_image_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/gsi_persistent_data
+type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/emergencynumberdb
+type emergency_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/profcollectd
+type profcollectd_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/apexdata/com.android.art
+type apex_art_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.art/staging
+type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/apexdata/com.android.compos
+type apex_compos_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.virt
+type apex_virt_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.tethering
+type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.uwb
+type apex_uwb_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# legacy labels for various /data/misc[_ce|_de]/*/apexdata directories - retained
+# for backward compatibility b/217581286
+type apex_appsearch_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_permission_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_scheduling_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_wifi_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/font/files
+type font_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/dmesgd
+type dmesgd_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odrefresh
+type odrefresh_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odsign
+type odsign_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odsign_metrics
+type odsign_metrics_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/virtualizationservice
+# The type needs to be mlstrustedobject to allow for being accessed from
+# virtualizationmanager, which runs at a more constrained MLS level.
+type virtualizationservice_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+
+# /mnt/vm
+type vm_data_file, file_type, core_data_file_type;
+
+# /data/system/environ
+type environ_system_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/bootanim
+type bootanim_data_file, file_type, data_file_type, core_data_file_type;
+
+# /dev/kvm
+# The type needs to be mlstrustedobject to allow for being accessed from
+# crosvm, which runs at a more constrained MLS level.
+type kvm_device, dev_type, mlstrustedobject, vm_manager_device_type;
+
+# /apex/com.android.virt/bin/fd_server
+type fd_server_exec, system_file_type, exec_type, file_type;
+
+# /apex/com.android.compos/bin/compsvc
+type compos_exec, exec_type, file_type, system_file_type;
+# /apex/com.android.compos/bin/compos_key_helper
+type compos_key_helper_exec, exec_type, file_type, system_file_type;
+
+# Filesystem entry for for PRNG seeder socket. Processes require
+# write permission on this to connect, and needs to be mlstrustedobject
+# in to satisfy MLS constraints for trusted domains.
+type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# /proc/device-tree/avf and /sys/firmware/devicetree/base/avf
+type sysfs_dt_avf, fs_type, sysfs_type;
+type proc_dt_avf, fs_type, proc_type;
+
+# Type for /system/fonts/font_fallback.xm
+type system_font_fallback_file, system_file_type, file_type;
+
+# Type for /sys/devices/uprobe.
+type sysfs_uprobe, fs_type, sysfs_type;
+
+# Type for aconfig daemon socket
+type aconfigd_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# Type for aconfig mainline daemon socket
+type aconfigd_mainline_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# Type for /(system|system_ext|product)/etc/aconfig
+type system_aconfig_storage_file, system_file_type, file_type;
+
+# Type for /vendor/etc/aconfig
+type vendor_aconfig_storage_file, vendor_file_type, file_type;
+
+# /data/misc/connectivityblobdb
+type connectivityblob_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/wifi/mainline_supplicant
+type mainline_supplicant_data_file, file_type, data_file_type, core_data_file_type;
+
+# Type for /mnt/pre_reboot_dexopt
+type pre_reboot_dexopt_file, file_type;
+
+# Type for /mnt/artd_tmp in the Pre-reboot Dexopt chroot
+# This type is set on the directory through the `rootcontext=` mount option.
+type pre_reboot_dexopt_artd_file, file_type;
+
+# /data/app-metadata - extracted app metadata bundles from APKs
+type apk_metadata_file, file_type, data_file_type, core_data_file_type;
+
+# Type for /sys/kernel/mm/pgsize_migration/enabled
+type sysfs_pgsize_migration, fs_type, sysfs_type;
+
+# /sys/firmware/acpi/tables
+type sysfs_firmware_acpi_tables, fs_type, sysfs_type;
+
+# Allow files to be created in their appropriate filesystems.
+allow fs_type self:filesystem associate;
+allow cgroup tmpfs:filesystem associate;
+allow cgroup_v2 tmpfs:filesystem associate;
+allow cgroup_rc_file tmpfs:filesystem associate;
+allow sysfs_type sysfs:filesystem associate;
+allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate;
+allow file_type labeledfs:filesystem associate;
+allow file_type tmpfs:filesystem associate;
+allow file_type rootfs:filesystem associate;
+allow dev_type tmpfs:filesystem associate;
+allow app_fuse_file app_fusefs:filesystem associate;
+allow postinstall_file self:filesystem associate;
+allow proc_net proc:filesystem associate;
+
+# It's a bug to assign the file_type attribute and fs_type attribute
+# to any type. Do not allow it.
+#
+# For example, the following is a bug:
+# type apk_data_file, file_type, data_file_type, fs_type;
+# Should be:
+# type apk_data_file, file_type, data_file_type;
+neverallow fs_type file_type:filesystem associate;
+# app directories of storage areas: /data/storage_area/userId/pkgName -- apps cannot write to it
+type storage_area_app_dir, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# app storage areas: /data/storage_area/userId/pkgName/storageAreaName
+type storage_area_dir, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# contents of app storage areas: /data/storage_area/userId/pkgName/storageAreaName/*
+type storage_area_content_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+
+# /data/misc_ce/userId/storage_area_keys
+type storage_area_key_file, file_type, data_file_type, core_data_file_type;
+
+# /metadata/tradeinmode files
+type tradeinmode_metadata_file, file_type;
+
+# /metadata/prefetch files
+type prefetch_metadata_file, file_type;
+
+# /metadata/libprocessgroup files
+type libprocessgroup_metadata_file, file_type;
+
+# Types added in 202504 in public/file.te
+#line 241
+
+
+#line 245
+
+
+#line 249
+
+
+#line 254
+
+
+#line 259
+
+
+#line 263
+
+
+#line 267
+
+
+## END Types added in 202504 in public/file.te
+#line 1 "system/sepolicy/private/fingerprintd.te"
+typeattribute fingerprintd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init fingerprintd_exec:file { getattr open read execute map };
+#line 3
+allow init fingerprintd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow fingerprintd fingerprintd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init fingerprintd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init fingerprintd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init fingerprintd_exec:process fingerprintd;
+#line 3
+
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow fingerprintd servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager fingerprintd:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager fingerprintd:dir search;
+#line 5
+allow servicemanager fingerprintd:file { read open };
+#line 5
+allow servicemanager fingerprintd:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+# Scan through /system/lib64/hw looking for installed HALs
+allow fingerprintd system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# need to find KeyStore and add self
+
+#line 11
+ allow fingerprintd fingerprintd_service:service_manager { add find };
+#line 11
+ neverallow { domain -fingerprintd } fingerprintd_service:service_manager add;
+#line 11
+
+#line 11
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 11
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 11
+
+#line 11
+
+
+# allow HAL module to read dir contents
+allow fingerprintd fingerprintd_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } };
+
+# allow HAL module to read/write/unlink contents of this dir
+allow fingerprintd fingerprintd_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Need to add auth tokens to KeyStore
+
+#line 20
+ allow keystore fingerprintd:dir search;
+#line 20
+ allow keystore fingerprintd:file { read open };
+#line 20
+ allow keystore fingerprintd:process getattr;
+#line 20
+ allow fingerprintd apc_service:service_manager find;
+#line 20
+ allow fingerprintd keystore_service:service_manager find;
+#line 20
+ allow fingerprintd legacykeystore_service:service_manager find;
+#line 20
+
+#line 20
+# Call the server domain and optionally transfer references to it.
+#line 20
+allow fingerprintd keystore:binder { call transfer };
+#line 20
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 20
+allow keystore fingerprintd:binder transfer;
+#line 20
+# Receive and use open files from the server.
+#line 20
+allow fingerprintd keystore:fd use;
+#line 20
+
+#line 20
+
+#line 20
+# Call the server domain and optionally transfer references to it.
+#line 20
+allow keystore fingerprintd:binder { call transfer };
+#line 20
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 20
+allow fingerprintd keystore:binder transfer;
+#line 20
+# Receive and use open files from the server.
+#line 20
+allow keystore fingerprintd:fd use;
+#line 20
+
+#line 20
+
+allow fingerprintd keystore:keystore2 { add_auth };
+
+# For permissions checking
+
+#line 24
+# Call the server domain and optionally transfer references to it.
+#line 24
+allow fingerprintd system_server:binder { call transfer };
+#line 24
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 24
+allow system_server fingerprintd:binder transfer;
+#line 24
+# Receive and use open files from the server.
+#line 24
+allow fingerprintd system_server:fd use;
+#line 24
+;
+allow fingerprintd permission_service:service_manager find;
+
+allow fingerprintd ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/flags_health_check.te"
+typeattribute flags_health_check coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init flags_health_check_exec:file { getattr open read execute map };
+#line 3
+allow init flags_health_check:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow flags_health_check flags_health_check_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init flags_health_check:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init flags_health_check:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init flags_health_check_exec:process flags_health_check;
+#line 3
+
+#line 3
+
+
+
+#line 5
+
+#line 5
+allow flags_health_check property_socket:sock_file write;
+#line 5
+allow flags_health_check init:unix_stream_socket connectto;
+#line 5
+
+#line 5
+allow flags_health_check device_config_boot_count_prop:property_service set;
+#line 5
+
+#line 5
+allow flags_health_check device_config_boot_count_prop:file { getattr open read map };
+#line 5
+
+#line 5
+
+
+#line 6
+
+#line 6
+allow flags_health_check property_socket:sock_file write;
+#line 6
+allow flags_health_check init:unix_stream_socket connectto;
+#line 6
+
+#line 6
+allow flags_health_check device_config_core_experiments_team_internal_prop:property_service set;
+#line 6
+
+#line 6
+allow flags_health_check device_config_core_experiments_team_internal_prop:file { getattr open read map };
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+allow flags_health_check property_socket:sock_file write;
+#line 7
+allow flags_health_check init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow flags_health_check device_config_edgetpu_native_prop:property_service set;
+#line 7
+
+#line 7
+allow flags_health_check device_config_edgetpu_native_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+
+#line 8
+
+#line 8
+allow flags_health_check property_socket:sock_file write;
+#line 8
+allow flags_health_check init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow flags_health_check device_config_reset_performed_prop:property_service set;
+#line 8
+
+#line 8
+allow flags_health_check device_config_reset_performed_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+#line 9
+
+#line 9
+allow flags_health_check property_socket:sock_file write;
+#line 9
+allow flags_health_check init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow flags_health_check device_config_runtime_native_boot_prop:property_service set;
+#line 9
+
+#line 9
+allow flags_health_check device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+allow flags_health_check property_socket:sock_file write;
+#line 10
+allow flags_health_check init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow flags_health_check device_config_runtime_native_prop:property_service set;
+#line 10
+
+#line 10
+allow flags_health_check device_config_runtime_native_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+allow flags_health_check property_socket:sock_file write;
+#line 11
+allow flags_health_check init:unix_stream_socket connectto;
+#line 11
+
+#line 11
+allow flags_health_check device_config_input_native_boot_prop:property_service set;
+#line 11
+
+#line 11
+allow flags_health_check device_config_input_native_boot_prop:file { getattr open read map };
+#line 11
+
+#line 11
+
+
+#line 12
+
+#line 12
+allow flags_health_check property_socket:sock_file write;
+#line 12
+allow flags_health_check init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow flags_health_check device_config_lmkd_native_prop:property_service set;
+#line 12
+
+#line 12
+allow flags_health_check device_config_lmkd_native_prop:file { getattr open read map };
+#line 12
+
+#line 12
+
+
+#line 13
+
+#line 13
+allow flags_health_check property_socket:sock_file write;
+#line 13
+allow flags_health_check init:unix_stream_socket connectto;
+#line 13
+
+#line 13
+allow flags_health_check device_config_netd_native_prop:property_service set;
+#line 13
+
+#line 13
+allow flags_health_check device_config_netd_native_prop:file { getattr open read map };
+#line 13
+
+#line 13
+
+
+#line 14
+
+#line 14
+allow flags_health_check property_socket:sock_file write;
+#line 14
+allow flags_health_check init:unix_stream_socket connectto;
+#line 14
+
+#line 14
+allow flags_health_check device_config_nnapi_native_prop:property_service set;
+#line 14
+
+#line 14
+allow flags_health_check device_config_nnapi_native_prop:file { getattr open read map };
+#line 14
+
+#line 14
+
+
+#line 15
+
+#line 15
+allow flags_health_check property_socket:sock_file write;
+#line 15
+allow flags_health_check init:unix_stream_socket connectto;
+#line 15
+
+#line 15
+allow flags_health_check device_config_activity_manager_native_boot_prop:property_service set;
+#line 15
+
+#line 15
+allow flags_health_check device_config_activity_manager_native_boot_prop:file { getattr open read map };
+#line 15
+
+#line 15
+
+
+#line 16
+
+#line 16
+allow flags_health_check property_socket:sock_file write;
+#line 16
+allow flags_health_check init:unix_stream_socket connectto;
+#line 16
+
+#line 16
+allow flags_health_check device_config_media_native_prop:property_service set;
+#line 16
+
+#line 16
+allow flags_health_check device_config_media_native_prop:file { getattr open read map };
+#line 16
+
+#line 16
+
+
+#line 17
+
+#line 17
+allow flags_health_check property_socket:sock_file write;
+#line 17
+allow flags_health_check init:unix_stream_socket connectto;
+#line 17
+
+#line 17
+allow flags_health_check device_config_mglru_native_prop:property_service set;
+#line 17
+
+#line 17
+allow flags_health_check device_config_mglru_native_prop:file { getattr open read map };
+#line 17
+
+#line 17
+
+
+#line 18
+
+#line 18
+allow flags_health_check property_socket:sock_file write;
+#line 18
+allow flags_health_check init:unix_stream_socket connectto;
+#line 18
+
+#line 18
+allow flags_health_check device_config_profcollect_native_boot_prop:property_service set;
+#line 18
+
+#line 18
+allow flags_health_check device_config_profcollect_native_boot_prop:file { getattr open read map };
+#line 18
+
+#line 18
+
+
+#line 19
+
+#line 19
+allow flags_health_check property_socket:sock_file write;
+#line 19
+allow flags_health_check init:unix_stream_socket connectto;
+#line 19
+
+#line 19
+allow flags_health_check device_config_statsd_native_prop:property_service set;
+#line 19
+
+#line 19
+allow flags_health_check device_config_statsd_native_prop:file { getattr open read map };
+#line 19
+
+#line 19
+
+
+#line 20
+
+#line 20
+allow flags_health_check property_socket:sock_file write;
+#line 20
+allow flags_health_check init:unix_stream_socket connectto;
+#line 20
+
+#line 20
+allow flags_health_check device_config_statsd_native_boot_prop:property_service set;
+#line 20
+
+#line 20
+allow flags_health_check device_config_statsd_native_boot_prop:file { getattr open read map };
+#line 20
+
+#line 20
+
+
+#line 21
+
+#line 21
+allow flags_health_check property_socket:sock_file write;
+#line 21
+allow flags_health_check init:unix_stream_socket connectto;
+#line 21
+
+#line 21
+allow flags_health_check device_config_storage_native_boot_prop:property_service set;
+#line 21
+
+#line 21
+allow flags_health_check device_config_storage_native_boot_prop:file { getattr open read map };
+#line 21
+
+#line 21
+
+
+#line 22
+
+#line 22
+allow flags_health_check property_socket:sock_file write;
+#line 22
+allow flags_health_check init:unix_stream_socket connectto;
+#line 22
+
+#line 22
+allow flags_health_check device_config_swcodec_native_prop:property_service set;
+#line 22
+
+#line 22
+allow flags_health_check device_config_swcodec_native_prop:file { getattr open read map };
+#line 22
+
+#line 22
+
+
+#line 23
+
+#line 23
+allow flags_health_check property_socket:sock_file write;
+#line 23
+allow flags_health_check init:unix_stream_socket connectto;
+#line 23
+
+#line 23
+allow flags_health_check device_config_sys_traced_prop:property_service set;
+#line 23
+
+#line 23
+allow flags_health_check device_config_sys_traced_prop:file { getattr open read map };
+#line 23
+
+#line 23
+
+
+#line 24
+
+#line 24
+allow flags_health_check property_socket:sock_file write;
+#line 24
+allow flags_health_check init:unix_stream_socket connectto;
+#line 24
+
+#line 24
+allow flags_health_check device_config_window_manager_native_boot_prop:property_service set;
+#line 24
+
+#line 24
+allow flags_health_check device_config_window_manager_native_boot_prop:file { getattr open read map };
+#line 24
+
+#line 24
+
+
+#line 25
+
+#line 25
+allow flags_health_check property_socket:sock_file write;
+#line 25
+allow flags_health_check init:unix_stream_socket connectto;
+#line 25
+
+#line 25
+allow flags_health_check device_config_configuration_prop:property_service set;
+#line 25
+
+#line 25
+allow flags_health_check device_config_configuration_prop:file { getattr open read map };
+#line 25
+
+#line 25
+
+
+#line 26
+
+#line 26
+allow flags_health_check property_socket:sock_file write;
+#line 26
+allow flags_health_check init:unix_stream_socket connectto;
+#line 26
+
+#line 26
+allow flags_health_check device_config_connectivity_prop:property_service set;
+#line 26
+
+#line 26
+allow flags_health_check device_config_connectivity_prop:file { getattr open read map };
+#line 26
+
+#line 26
+
+
+#line 27
+
+#line 27
+allow flags_health_check property_socket:sock_file write;
+#line 27
+allow flags_health_check init:unix_stream_socket connectto;
+#line 27
+
+#line 27
+allow flags_health_check device_config_surface_flinger_native_boot_prop:property_service set;
+#line 27
+
+#line 27
+allow flags_health_check device_config_surface_flinger_native_boot_prop:file { getattr open read map };
+#line 27
+
+#line 27
+
+
+#line 28
+
+#line 28
+allow flags_health_check property_socket:sock_file write;
+#line 28
+allow flags_health_check init:unix_stream_socket connectto;
+#line 28
+
+#line 28
+allow flags_health_check device_config_aconfig_flags_prop:property_service set;
+#line 28
+
+#line 28
+allow flags_health_check device_config_aconfig_flags_prop:file { getattr open read map };
+#line 28
+
+#line 28
+
+
+#line 29
+
+#line 29
+allow flags_health_check property_socket:sock_file write;
+#line 29
+allow flags_health_check init:unix_stream_socket connectto;
+#line 29
+
+#line 29
+allow flags_health_check device_config_vendor_system_native_prop:property_service set;
+#line 29
+
+#line 29
+allow flags_health_check device_config_vendor_system_native_prop:file { getattr open read map };
+#line 29
+
+#line 29
+
+
+#line 30
+
+#line 30
+allow flags_health_check property_socket:sock_file write;
+#line 30
+allow flags_health_check init:unix_stream_socket connectto;
+#line 30
+
+#line 30
+allow flags_health_check device_config_vendor_system_native_boot_prop:property_service set;
+#line 30
+
+#line 30
+allow flags_health_check device_config_vendor_system_native_boot_prop:file { getattr open read map };
+#line 30
+
+#line 30
+
+
+#line 31
+
+#line 31
+allow flags_health_check property_socket:sock_file write;
+#line 31
+allow flags_health_check init:unix_stream_socket connectto;
+#line 31
+
+#line 31
+allow flags_health_check device_config_virtualization_framework_native_prop:property_service set;
+#line 31
+
+#line 31
+allow flags_health_check device_config_virtualization_framework_native_prop:file { getattr open read map };
+#line 31
+
+#line 31
+
+
+#line 32
+
+#line 32
+allow flags_health_check property_socket:sock_file write;
+#line 32
+allow flags_health_check init:unix_stream_socket connectto;
+#line 32
+
+#line 32
+allow flags_health_check device_config_memory_safety_native_boot_prop:property_service set;
+#line 32
+
+#line 32
+allow flags_health_check device_config_memory_safety_native_boot_prop:file { getattr open read map };
+#line 32
+
+#line 32
+
+
+#line 33
+
+#line 33
+allow flags_health_check property_socket:sock_file write;
+#line 33
+allow flags_health_check init:unix_stream_socket connectto;
+#line 33
+
+#line 33
+allow flags_health_check device_config_memory_safety_native_prop:property_service set;
+#line 33
+
+#line 33
+allow flags_health_check device_config_memory_safety_native_prop:file { getattr open read map };
+#line 33
+
+#line 33
+
+
+#line 34
+
+#line 34
+allow flags_health_check property_socket:sock_file write;
+#line 34
+allow flags_health_check init:unix_stream_socket connectto;
+#line 34
+
+#line 34
+allow flags_health_check device_config_remote_key_provisioning_native_prop:property_service set;
+#line 34
+
+#line 34
+allow flags_health_check device_config_remote_key_provisioning_native_prop:file { getattr open read map };
+#line 34
+
+#line 34
+
+
+#line 35
+
+#line 35
+allow flags_health_check property_socket:sock_file write;
+#line 35
+allow flags_health_check init:unix_stream_socket connectto;
+#line 35
+
+#line 35
+allow flags_health_check device_config_camera_native_prop:property_service set;
+#line 35
+
+#line 35
+allow flags_health_check device_config_camera_native_prop:file { getattr open read map };
+#line 35
+
+#line 35
+
+
+#line 36
+
+#line 36
+allow flags_health_check property_socket:sock_file write;
+#line 36
+allow flags_health_check init:unix_stream_socket connectto;
+#line 36
+
+#line 36
+allow flags_health_check device_config_tethering_u_or_later_native_prop:property_service set;
+#line 36
+
+#line 36
+allow flags_health_check device_config_tethering_u_or_later_native_prop:file { getattr open read map };
+#line 36
+
+#line 36
+
+
+#line 37
+
+#line 37
+allow flags_health_check property_socket:sock_file write;
+#line 37
+allow flags_health_check init:unix_stream_socket connectto;
+#line 37
+
+#line 37
+allow flags_health_check device_config_mmd_native_prop:property_service set;
+#line 37
+
+#line 37
+allow flags_health_check device_config_mmd_native_prop:file { getattr open read map };
+#line 37
+
+#line 37
+
+
+#line 38
+
+#line 38
+allow flags_health_check property_socket:sock_file write;
+#line 38
+allow flags_health_check init:unix_stream_socket connectto;
+#line 38
+
+#line 38
+allow flags_health_check next_boot_prop:property_service set;
+#line 38
+
+#line 38
+allow flags_health_check next_boot_prop:file { getattr open read map };
+#line 38
+
+#line 38
+
+
+allow flags_health_check server_configurable_flags_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow flags_health_check server_configurable_flags_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+###
+### Neverallow rules
+###
+
+# server_configurable_flags_data_file is used for storing whether server configurable flags which
+# have been reset during current booting. Mistakenly modified by unrelated components can
+# cause bad server configurable flags synced back to device.
+neverallow { domain -init -flags_health_check } server_configurable_flags_data_file:file { append create link unlink relabelfrom rename setattr write };
+
+# system property device_config_boot_count_prop is used for deciding when to perform server
+# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
+# wrong timing, trigger server configurable flag related disaster recovery, which will override
+# server configured values of all flags with default values.
+neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
+
+# system property device_config_reset_performed_prop is used for indicating whether server
+# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
+# cause bad server configurable flags synced back to device.
+neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
+#line 1 "system/sepolicy/private/fsck.te"
+typeattribute fsck coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init fsck_exec:file { getattr open read execute map };
+#line 3
+allow init fsck:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow fsck fsck_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init fsck:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init fsck:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init fsck_exec:process fsck;
+#line 3
+
+#line 3
+
+
+# fsck can run before apex is ready.
+
+#line 6
+ allow fsck system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+ allow fsck system_bootstrap_lib_file:file { execute read open getattr map };
+#line 6
+
+
+allow fsck metadata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# /dev/__null__ created by init prior to policy load,
+# open fd inherited by fsck.
+allow fsck tmpfs:chr_file { read write ioctl };
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow fsck devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow fsck vold:fd use;
+allow fsck vold:fifo_file { read write getattr };
+
+# Run fsck on certain block devices
+allow fsck userdata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow fsck cache_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow fsck dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow fsck zoned_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 28
+
+
+# e2fsck performs a comprehensive search of /proc/mounts to check whether the
+# checked filesystem is currently mounted.
+allow fsck metadata_file:dir getattr;
+allow fsck block_device:dir search;
+allow fsck mirror_data_file:dir search;
+
+# For the block devices where we have ioctl access,
+# allow at a minimum the following common fsck ioctls.
+allowxperm fsck dev_type:blk_file ioctl {
+ 0x0000127c
+ 0x0000125e
+ 0xc0101282
+};
+
+# To determine if it is safe to run fsck on a filesystem, e2fsck
+# must first determine if the filesystem is mounted. To do that,
+# e2fsck scans through /proc/mounts and collects all the mounted
+# block devices. With that information, it runs stat() on each block
+# device, comparing the major and minor numbers to the filesystem
+# passed in on the command line. If there is a match, then the filesystem
+# is currently mounted and running fsck is dangerous.
+# Allow stat access to all block devices so that fsck can compare
+# major/minor values.
+allow fsck dev_type:blk_file getattr;
+
+allow fsck {
+ proc_mounts
+ proc_swaps
+ sysfs_dm
+}:file { getattr open read ioctl lock map watch watch_reads };
+allow fsck rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow fsck sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+
+###
+### neverallow rules
+###
+
+# fsck should never be run on these block devices
+neverallow fsck {
+ boot_block_device
+ frp_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+
+ vold_device
+}:blk_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only allow entry from init or vold via fsck binaries
+neverallow { domain -init -vold } fsck:process transition;
+neverallow * fsck:process dyntransition;
+neverallow fsck { file_type fs_type -fsck_exec }:file entrypoint;
+#line 1 "system/sepolicy/private/fsck_untrusted.te"
+typeattribute fsck_untrusted coredomain;
+
+
+#line 3
+ allow fsck system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 3
+ allow fsck system_bootstrap_lib_file:file { execute read open getattr map };
+#line 3
+
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow fsck_untrusted devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow fsck_untrusted vold:fd use;
+allow fsck_untrusted vold:fifo_file { read write getattr };
+
+# Run fsck on vold block devices
+allow fsck_untrusted block_device:dir search;
+allow fsck_untrusted vold_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow fsck_untrusted proc_mounts:file { getattr open read ioctl lock map watch watch_reads };
+
+# To determine if it is safe to run fsck on a filesystem, e2fsck
+# must first determine if the filesystem is mounted. To do that,
+# e2fsck scans through /proc/mounts and collects all the mounted
+# block devices. With that information, it runs stat() on each block
+# device, comparing the major and minor numbers to the filesystem
+# passed in on the command line. If there is a match, then the filesystem
+# is currently mounted and running fsck is dangerous.
+# Allow stat access to all block devices so that fsck can compare
+# major/minor values.
+allow fsck_untrusted dev_type:blk_file getattr;
+
+###
+### neverallow rules
+###
+
+# Untrusted fsck should never be run on block devices holding sensitive data
+neverallow fsck_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only allow entry from vold via fsck binaries
+neverallow { domain -vold } fsck_untrusted:process transition;
+neverallow * fsck_untrusted:process dyntransition;
+neverallow fsck_untrusted { file_type fs_type -fsck_exec }:file entrypoint;
+
+# fsck_untrusted should never have sys_admin permissions. If it requires sys_admin
+# permissions, that is a code mistake that needs to be fixed, not a permission that
+# should be granted. Same with setgid and setuid.
+neverallow fsck_untrusted self:{ capability cap_userns } { setgid setuid sys_admin };
+
+###
+### dontaudit rules
+###
+
+# Ignores attempts to access sysfs. fsck binaries seem to like trying to go
+# here, but nothing bad happens if they can't, and they shouldn't be allowed.
+dontaudit fsck_untrusted sysfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+dontaudit fsck_untrusted sysfs_dm:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+dontaudit fsck_untrusted sysfs_dm:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Ignore attempts to access tmpfs. fsck don't need to do this.
+dontaudit fsck_untrusted tmpfs:lnk_file read;
+#line 1 "system/sepolicy/private/fuseblkd.te"
+# Compartmentalized domain specifically for mounting fuseblk filesystems.
+# We need this to not grant fuseblkd_untrusted sys_admin permissions.
+type fuseblkd_exec, system_file_type, exec_type, file_type;
+type fuseblkd, domain;
+
+typeattribute fuseblkd coredomain;
+
+# Required for mount and unmounting. We can't minimize this permission,
+# even though we only allow mount/unmount.
+allow fuseblkd self:{ capability cap_userns } sys_admin;
+
+# Permissions for the fuseblk filesystem.
+allow fuseblkd fuse_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow fuseblkd fuseblk:filesystem { mount unmount };
+allow fuseblkd fuseblkd_untrusted:fd use;
+
+# Look through block devices to find the correct one.
+allow fuseblkd block_device:dir search;
+
+# Permissions to mount on the media_rw directory for USB drives.
+allow fuseblkd mnt_media_rw_file:dir search;
+allow fuseblkd mnt_media_rw_stub_file:dir mounton;
+
+###
+### neverallow rules
+###
+
+# Only allow entry from fuseblkd_untrusted, and only through fuseblkd_exec binary.
+neverallow { domain -fuseblkd_untrusted } fuseblkd:process transition;
+neverallow * fuseblkd:process dyntransition;
+neverallow fuseblkd { file_type fs_type -fuseblkd_exec }:file entrypoint;
+#line 1 "system/sepolicy/private/fuseblkd_untrusted.te"
+# Fuseblk is a Filesystem in USErspace for block device. It should only be used
+# to mount untrusted blocks like USB drives.
+type fuseblkd_untrusted_exec, system_file_type, exec_type, file_type;
+type fuseblkd_untrusted, domain;
+
+typeattribute fuseblkd_untrusted coredomain;
+
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow fuseblkd_untrusted fuseblkd_exec:file { getattr open read execute map };
+#line 8
+allow fuseblkd_untrusted fuseblkd:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow fuseblkd fuseblkd_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+allow fuseblkd fuseblkd_untrusted:process sigchld;
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit fuseblkd_untrusted fuseblkd:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow fuseblkd_untrusted fuseblkd:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition fuseblkd_untrusted fuseblkd_exec:process fuseblkd;
+#line 8
+;
+
+# Allow stdin/out back to vold.
+allow fuseblkd_untrusted vold:fd use;
+
+# Allows fuseblk to read block devices.
+allow fuseblkd_untrusted block_device:dir search;
+
+# Permissions to read dynamic partitions blocks.
+allow fuseblkd_untrusted super_block_device:blk_file getattr;
+
+# Permissions to access FUSE character devices.
+allow fuseblkd_untrusted fuse_device:chr_file { getattr open read write };
+
+# Permissions to access /mnt/media_rw/.
+allow fuseblkd_untrusted mnt_media_rw_file:dir { getattr search };
+allow fuseblkd_untrusted mnt_media_rw_stub_file:dir getattr;
+
+# Permissions to read device mappers.
+allow fuseblkd_untrusted sysfs_dm:dir search;
+allow fuseblkd_untrusted sysfs_dm:file { getattr open read };
+allow fuseblkd_untrusted dm_device:blk_file getattr;
+
+# Permissions to read links in tmpfs.
+allow fuseblkd_untrusted tmpfs:lnk_file read;
+
+# Permissions to read loop device blocks.
+allow fuseblkd_untrusted loop_device:blk_file getattr;
+
+# Permissions to access the /proc/filesystems file.
+allow fuseblkd_untrusted proc_filesystems:file { open read getattr };
+
+###
+### dontaudit rules
+###
+
+# ntfs-3g wants this permission to read a fork return code, for some reason.
+# It's unclear why, because it still reads the fork return code correctly,
+# and nothing breaks. If enforce is set to permissive, the audit goes away.
+dontaudit fuseblkd_untrusted self:capability sys_admin;
+
+###
+### neverallow rules
+###
+
+# Fuseblk should never be run on block devices holding sensitive data.
+neverallow fuseblkd_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only allow entry from vold, and only through fuseblkd_untrusted_exec binaries.
+neverallow { domain -vold } fuseblkd_untrusted:process transition;
+neverallow * fuseblkd_untrusted:process dyntransition;
+neverallow fuseblkd_untrusted { file_type fs_type -fuseblkd_untrusted_exec }:file entrypoint;
+
+# Under no circumstances should fuseblkd_untrusted or any other fuseblk filesystem be
+# given sys_admin access. They are fundementally untrusted, insecure filesystems.
+# The correct solution here is to compartmentalize permissions correctly so that
+# a smaller binary can get the required permissions. See fuseblkd.te.
+# Similar to above, we don't need setgid or setuid permissions.
+neverallow fuseblkd_untrusted self:capability { setgid setuid sys_admin };
+neverallow fuseblkd_untrusted self:{ capability cap_userns } { setgid setuid sys_admin };
+
+# Since we can't have sys_admin permissions, we definitely can't have mount/unmount
+# permissions, since we won't be able to use them. Same with relabel permissions.
+neverallow fuseblkd_untrusted fuseblk:filesystem { mount unmount relabelto relabelfrom};
+#line 1 "system/sepolicy/private/fwk_bufferhub.te"
+type fwk_bufferhub, domain, coredomain;
+type fwk_bufferhub_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+typeattribute fwk_bufferhub halclientdomain;
+#line 4
+typeattribute fwk_bufferhub hal_graphics_allocator_client;
+#line 4
+
+#line 4
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 4
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 4
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 4
+
+#line 4
+typeattribute fwk_bufferhub hal_graphics_allocator;
+#line 4
+# Find passthrough HAL implementations
+#line 4
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 4
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 4
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 4
+
+#line 4
+
+allow fwk_bufferhub ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init fwk_bufferhub_exec:file { getattr open read execute map };
+#line 7
+allow init fwk_bufferhub:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow fwk_bufferhub fwk_bufferhub_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init fwk_bufferhub:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init fwk_bufferhub:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init fwk_bufferhub_exec:process fwk_bufferhub;
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/gatekeeperd.te"
+typeattribute gatekeeperd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init gatekeeperd_exec:file { getattr open read execute map };
+#line 3
+allow init gatekeeperd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow gatekeeperd gatekeeperd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init gatekeeperd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init gatekeeperd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init gatekeeperd_exec:process gatekeeperd;
+#line 3
+
+#line 3
+
+
+# For checking whether GSI is running
+
+#line 6
+allow gatekeeperd gsid_prop:file { getattr open read map };
+#line 6
+
+
+# gatekeeperd
+
+#line 9
+typeattribute gatekeeperd binderservicedomain;
+#line 9
+
+
+#line 10
+# Call the servicemanager and transfer references to it.
+#line 10
+allow gatekeeperd servicemanager:binder { call transfer };
+#line 10
+# Allow servicemanager to send out callbacks
+#line 10
+allow servicemanager gatekeeperd:binder { call transfer };
+#line 10
+# servicemanager performs getpidcon on clients.
+#line 10
+allow servicemanager gatekeeperd:dir search;
+#line 10
+allow servicemanager gatekeeperd:file { read open };
+#line 10
+allow servicemanager gatekeeperd:process getattr;
+#line 10
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+
+### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.
+### These rules should eventually be granted only when needed.
+allow gatekeeperd ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+# Load HAL implementation
+allow gatekeeperd system_file:dir { open getattr read search ioctl lock watch watch_reads };
+###
+
+### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.
+### These rules should eventually be granted only when needed.
+
+#line 21
+typeattribute gatekeeperd halclientdomain;
+#line 21
+typeattribute gatekeeperd hal_gatekeeper_client;
+#line 21
+
+#line 21
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 21
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 21
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 21
+
+#line 21
+typeattribute gatekeeperd hal_gatekeeper;
+#line 21
+# Find passthrough HAL implementations
+#line 21
+allow hal_gatekeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_gatekeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_gatekeeper vendor_file:file { read open getattr execute map };
+#line 21
+
+#line 21
+
+###
+
+# need to find KeyStore and add self
+
+#line 25
+ allow gatekeeperd gatekeeper_service:service_manager { add find };
+#line 25
+ neverallow { domain -gatekeeperd } gatekeeper_service:service_manager add;
+#line 25
+
+#line 25
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 25
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 25
+
+#line 25
+
+
+# Need to add auth tokens to KeyStore
+
+#line 28
+ allow keystore gatekeeperd:dir search;
+#line 28
+ allow keystore gatekeeperd:file { read open };
+#line 28
+ allow keystore gatekeeperd:process getattr;
+#line 28
+ allow gatekeeperd apc_service:service_manager find;
+#line 28
+ allow gatekeeperd keystore_service:service_manager find;
+#line 28
+ allow gatekeeperd legacykeystore_service:service_manager find;
+#line 28
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow gatekeeperd keystore:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow keystore gatekeeperd:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow gatekeeperd keystore:fd use;
+#line 28
+
+#line 28
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow keystore gatekeeperd:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow gatekeeperd keystore:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow keystore gatekeeperd:fd use;
+#line 28
+
+#line 28
+
+allow gatekeeperd keystore:keystore2 { add_auth };
+allow gatekeeperd authorization_service:service_manager find;
+
+
+# For permissions checking
+allow gatekeeperd system_server:binder call;
+allow gatekeeperd permission_service:service_manager find;
+
+# for SID file access
+allow gatekeeperd gatekeeper_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow gatekeeperd gatekeeper_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# For hardware properties retrieval
+allow gatekeeperd hardware_properties_service:service_manager find;
+
+
+#line 44
+allow gatekeeperd cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 44
+allow gatekeeperd cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 44
+
+
+#line 45
+allow gatekeeperd cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 45
+allow gatekeeperd cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 45
+
+#line 1 "system/sepolicy/private/gki_apex_prepostinstall.te"
+# GKI pre- & post-install hooks.
+#
+# Allow to run pre- and post-install hooks for GKI APEXes
+
+type gki_apex_prepostinstall, domain, coredomain;
+type gki_apex_prepostinstall_exec, system_file_type, exec_type, file_type;
+
+# Execute /system/bin/sh.
+allow gki_apex_prepostinstall shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Execute various toolsbox utilities.
+allow gki_apex_prepostinstall toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow preinstall.sh to execute update_engine_stable_client binary.
+allow gki_apex_prepostinstall gki_apex_prepostinstall_exec:file execute_no_trans;
+
+# Allow preinstall hook to communicate with update_engine to execute update.
+
+#line 18
+# Call the servicemanager and transfer references to it.
+#line 18
+allow gki_apex_prepostinstall servicemanager:binder { call transfer };
+#line 18
+# Allow servicemanager to send out callbacks
+#line 18
+allow servicemanager gki_apex_prepostinstall:binder { call transfer };
+#line 18
+# servicemanager performs getpidcon on clients.
+#line 18
+allow servicemanager gki_apex_prepostinstall:dir search;
+#line 18
+allow servicemanager gki_apex_prepostinstall:file { read open };
+#line 18
+allow servicemanager gki_apex_prepostinstall:process getattr;
+#line 18
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 18
+# all domains in domain.te.
+#line 18
+
+allow gki_apex_prepostinstall update_engine_stable_service:service_manager find;
+
+#line 20
+# Call the server domain and optionally transfer references to it.
+#line 20
+allow gki_apex_prepostinstall update_engine:binder { call transfer };
+#line 20
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 20
+allow update_engine gki_apex_prepostinstall:binder transfer;
+#line 20
+# Receive and use open files from the server.
+#line 20
+allow gki_apex_prepostinstall update_engine:fd use;
+#line 20
+
+
+# /dev/zero is inherited although it is not used. See b/126787589.
+allow gki_apex_prepostinstall apexd:fd use;
+#line 1 "system/sepolicy/private/gmscore_app.te"
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+typeattribute gmscore_app coredomain;
+
+
+#line 6
+typeattribute gmscore_app appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition gmscore_app tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type gmscore_app_userfaultfd;
+#line 6
+type_transition gmscore_app gmscore_app:anon_inode gmscore_app_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow gmscore_app gmscore_app_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su gmscore_app_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -gmscore_app } gmscore_app_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow gmscore_app appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { gmscore_app -runas_app -shell -simpleperf } { domain -gmscore_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -gmscore_app } gmscore_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -gmscore_app -crash_dump -runas_app -simpleperf } gmscore_app:process ptrace;
+#line 6
+
+
+allow gmscore_app sysfs_type:dir search;
+# Read access to /sys/block/zram*/mm_stat
+
+#line 10
+allow gmscore_app sysfs_zram:dir { open getattr read search ioctl lock watch watch_reads };
+#line 10
+allow gmscore_app sysfs_zram:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 10
+
+
+
+#line 12
+allow gmscore_app rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow gmscore_app rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+
+# Allow GMS core to open kernel config for OTA matching through libvintf
+allow gmscore_app config_gz:file { open read getattr };
+
+# Allow GMS core to communicate with update_engine for A/B update.
+
+#line 18
+# Call the server domain and optionally transfer references to it.
+#line 18
+allow gmscore_app update_engine:binder { call transfer };
+#line 18
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 18
+allow update_engine gmscore_app:binder transfer;
+#line 18
+# Receive and use open files from the server.
+#line 18
+allow gmscore_app update_engine:fd use;
+#line 18
+
+allow gmscore_app update_engine_service:service_manager find;
+
+# Allow GMS core to communicate with dumpsys storaged.
+
+#line 22
+# Call the server domain and optionally transfer references to it.
+#line 22
+allow gmscore_app storaged:binder { call transfer };
+#line 22
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 22
+allow storaged gmscore_app:binder transfer;
+#line 22
+# Receive and use open files from the server.
+#line 22
+allow gmscore_app storaged:fd use;
+#line 22
+
+allow gmscore_app storaged_service:service_manager find;
+
+# Allow GMS core to access system_update_service (e.g. to publish pending
+# system update info).
+allow gmscore_app system_update_service:service_manager find;
+
+# Allow GMS core to communicate with statsd.
+
+#line 30
+# Call the server domain and optionally transfer references to it.
+#line 30
+allow gmscore_app statsd:binder { call transfer };
+#line 30
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 30
+allow statsd gmscore_app:binder transfer;
+#line 30
+# Receive and use open files from the server.
+#line 30
+allow gmscore_app statsd:fd use;
+#line 30
+
+
+# Allow GMS core to receive Perfetto traces through the framework
+# (i.e. TracingServiceProxy) and sendfile them into its private directory
+# for reporting when network and battery conditions are appropriate.
+allow gmscore_app perfetto:fd use;
+allow gmscore_app perfetto_traces_data_file:file { read getattr };
+
+# Allow GMS core to generate unique hardware IDs
+allow gmscore_app keystore:keystore2_key gen_unique_id;
+
+# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
+allow gmscore_app selinuxfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# suppress denials for non-API accesses.
+dontaudit gmscore_app exec_type:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app device:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit gmscore_app fs_bpf:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit gmscore_app kernel:security *;
+dontaudit gmscore_app net_dns_prop:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc_interrupts:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc_modules:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc_net:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc_stat:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app proc_version:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit gmscore_app sysfs:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs_android_usb:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs_dm:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs_loop:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs_net:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app sysfs_net:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit gmscore_app { wifi_prop wifi_hal_prop }:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit gmscore_app mirror_data_file:dir search;
+dontaudit gmscore_app mnt_vendor_file:dir search;
+
+# Access the network
+
+#line 68
+typeattribute gmscore_app netdomain;
+#line 68
+
+
+# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
+allow gmscore_app self:process ptrace;
+
+# Allow loading executable code from writable priv-app home
+# directories. This is a W^X violation, however, it needs
+# to be supported for now for the following reasons.
+# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
+# 1) com.android.opengl.shaders_cache
+# 2) com.android.skia.shaders_cache
+# 3) com.android.renderscript.cache
+# * /data/user_de/0/com.google.android.gms/app_chimera
+# TODO: Tighten (b/112357170)
+allow gmscore_app privapp_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow gmscore_app system_linker_exec:file execute_no_trans;
+
+allow gmscore_app privapp_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# /proc access
+allow gmscore_app proc_vmstat:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow interaction with gpuservice
+
+#line 94
+# Call the server domain and optionally transfer references to it.
+#line 94
+allow gmscore_app gpuservice:binder { call transfer };
+#line 94
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 94
+allow gpuservice gmscore_app:binder transfer;
+#line 94
+# Receive and use open files from the server.
+#line 94
+allow gmscore_app gpuservice:fd use;
+#line 94
+
+allow gmscore_app gpu_service:service_manager find;
+
+# find services that expose both @SystemAPI and normal APIs.
+allow gmscore_app app_api_service:service_manager find;
+allow gmscore_app system_api_service:service_manager find;
+allow gmscore_app audioserver_service:service_manager find;
+allow gmscore_app cameraserver_service:service_manager find;
+allow gmscore_app drmserver_service:service_manager find;
+allow gmscore_app mediadrmserver_service:service_manager find;
+allow gmscore_app mediaextractor_service:service_manager find;
+allow gmscore_app mediametrics_service:service_manager find;
+allow gmscore_app mediaserver_service:service_manager find;
+allow gmscore_app network_watchlist_service:service_manager find;
+allow gmscore_app nfc_service:service_manager find;
+allow gmscore_app oem_lock_service:service_manager find;
+allow gmscore_app persistent_data_block_service:service_manager find;
+allow gmscore_app radio_service:service_manager find;
+allow gmscore_app recovery_service:service_manager find;
+allow gmscore_app stats_service:service_manager find;
+
+# Write to /cache.
+allow gmscore_app { cache_file cache_recovery_file }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow gmscore_app { cache_file cache_recovery_file }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow gmscore_app cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Write to /data/ota_package for OTA packages.
+allow gmscore_app ota_package_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow gmscore_app ota_package_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Write the checkin metadata to /data/misc_ce/<userid>/checkin
+allow gmscore_app checkin_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow gmscore_app checkin_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow gmscore_app shell_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow gmscore_app shell_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# allow gms core app write to aconfigd socket
+
+#line 135
+allow gmscore_app aconfigd_socket:sock_file write;
+#line 135
+allow gmscore_app aconfigd:unix_stream_socket connectto;
+#line 135
+;
+
+# allow gms core app write to aconfigd_mainline socket
+
+#line 138
+allow gmscore_app aconfigd_mainline_socket:sock_file write;
+#line 138
+allow gmscore_app aconfigd_mainline:unix_stream_socket connectto;
+#line 138
+;
+
+# b/18504118: Allow reads from /data/anr/traces.txt
+allow gmscore_app anr_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# b/148974132: com.android.vending needs this
+allow gmscore_app priv_app:tcp_socket { read write };
+
+# b/168059475 Allow GMSCore to read Virtual AB properties to determine
+# if device supports VAB.
+
+#line 148
+allow gmscore_app virtual_ab_prop:file { getattr open read map };
+#line 148
+
+
+# b/186488185: Allow GMSCore to read dck properties
+
+#line 151
+allow gmscore_app dck_prop:file { getattr open read map };
+#line 151
+
+
+# Allow GMSCore to read RKP properties for the purpose of GTS testing.
+
+#line 154
+allow gmscore_app remote_prov_prop:file { getattr open read map };
+#line 154
+
+
+# Allow GmsCore to read Quick Start properties and prevent access from other
+# policies.
+
+#line 158
+allow gmscore_app quick_start_prop:file { getattr open read map };
+#line 158
+
+neverallow { domain -init -dumpstate -vendor_init -gmscore_app } quick_start_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow GmsCore to read Bluetotoh Power Off Finder property
+
+#line 162
+allow gmscore_app bluetooth_finder_prop:file { getattr open read map };
+#line 162
+
+
+# Do not allow getting permission-protected network information from sysfs.
+neverallow gmscore_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm gmscore_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl
+#line 169
+{
+#line 169
+# qualcomm rmnet ioctls
+#line 169
+0x00006900 0x00006902
+#line 169
+# socket ioctls
+#line 169
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 169
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 169
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 169
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 169
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 169
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 169
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 169
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 169
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 169
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 169
+# device and protocol specific ioctls
+#line 169
+0x000089f0-0x000089ff
+#line 169
+0x000089e0-0x000089ef
+#line 169
+# Wireless extension ioctls
+#line 169
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 169
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 169
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 169
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 169
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 169
+0x00008b34 0x00008b35 0x00008b36
+#line 169
+# Dev private ioctl i.e. hardware specific ioctls
+#line 169
+0x00008be0-0x00008bff
+#line 169
+};
+neverallow gmscore_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow gmscore_app *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
+#line 1 "system/sepolicy/private/gpuservice.te"
+# gpuservice - server for gpu stats and other gpu related services
+typeattribute gpuservice coredomain;
+typeattribute gpuservice bpfdomain;
+
+type gpuservice_exec, system_file_type, exec_type, file_type;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init gpuservice_exec:file { getattr open read execute map };
+#line 7
+allow init gpuservice:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow gpuservice gpuservice_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init gpuservice:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init gpuservice:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init gpuservice_exec:process gpuservice;
+#line 7
+
+#line 7
+
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow gpuservice adbd:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow adbd gpuservice:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow gpuservice adbd:fd use;
+#line 9
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow gpuservice shell:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow shell gpuservice:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow gpuservice shell:fd use;
+#line 10
+
+
+#line 11
+# Call the server domain and optionally transfer references to it.
+#line 11
+allow gpuservice system_server:binder { call transfer };
+#line 11
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 11
+allow system_server gpuservice:binder transfer;
+#line 11
+# Receive and use open files from the server.
+#line 11
+allow gpuservice system_server:fd use;
+#line 11
+
+
+#line 12
+# Call the servicemanager and transfer references to it.
+#line 12
+allow gpuservice servicemanager:binder { call transfer };
+#line 12
+# Allow servicemanager to send out callbacks
+#line 12
+allow servicemanager gpuservice:binder { call transfer };
+#line 12
+# servicemanager performs getpidcon on clients.
+#line 12
+allow servicemanager gpuservice:dir search;
+#line 12
+allow servicemanager gpuservice:file { read open };
+#line 12
+allow servicemanager gpuservice:process getattr;
+#line 12
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 12
+# all domains in domain.te.
+#line 12
+
+
+# Access the GPU.
+allow gpuservice gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# GPU service will need to load GPU driver, for example Vulkan driver in order
+# to get the capability of the driver.
+allow gpuservice same_process_hal_file:file { open read getattr execute map };
+allow gpuservice ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+#line 21
+allow gpuservice hwservicemanager_prop:file { getattr open read map };
+#line 21
+
+
+#line 22
+# Call the hwservicemanager and transfer references to it.
+#line 22
+allow gpuservice hwservicemanager:binder { call transfer };
+#line 22
+# Allow hwservicemanager to send out callbacks
+#line 22
+allow hwservicemanager gpuservice:binder { call transfer };
+#line 22
+# hwservicemanager performs getpidcon on clients.
+#line 22
+allow hwservicemanager gpuservice:dir search;
+#line 22
+allow hwservicemanager gpuservice:file { read open map };
+#line 22
+allow hwservicemanager gpuservice:process getattr;
+#line 22
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 22
+# all domains in domain.te.
+#line 22
+
+
+# Access /dev/graphics/fb0.
+allow gpuservice graphics_device:dir search;
+allow gpuservice graphics_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow shell access
+allow gpuservice adbd:fd use;
+allow gpuservice adbd:unix_stream_socket { getattr read write };
+allow gpuservice shell:fifo_file { getattr read write };
+
+# Needed for perfetto producer.
+
+#line 34
+ allow gpuservice traced:fd use;
+#line 34
+ allow gpuservice traced_tmpfs:file { read write getattr map };
+#line 34
+
+#line 34
+allow gpuservice traced_producer_socket:sock_file write;
+#line 34
+allow gpuservice traced:unix_stream_socket connectto;
+#line 34
+
+#line 34
+
+#line 34
+ # Also allow the service to use the producer file descriptors. This is
+#line 34
+ # necessary when the producer is creating the shared memory, as it will be
+#line 34
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 34
+ allow traced gpuservice:fd use;
+#line 34
+
+
+# Needed for interactive shell
+allow gpuservice devpts:chr_file { read write getattr };
+
+# Needed for dumpstate to dumpsys gpu.
+allow gpuservice dumpstate:fd use;
+allow gpuservice dumpstate:fifo_file write;
+
+# Needed for stats callback registration to statsd.
+allow gpuservice stats_service:service_manager find;
+allow gpuservice statsmanager_service:service_manager find;
+# TODO(b/146461633): remove this once native pullers talk to StatsManagerService
+
+#line 47
+# Call the server domain and optionally transfer references to it.
+#line 47
+allow gpuservice statsd:binder { call transfer };
+#line 47
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 47
+allow statsd gpuservice:binder transfer;
+#line 47
+# Receive and use open files from the server.
+#line 47
+allow gpuservice statsd:fd use;
+#line 47
+;
+
+# Needed for reading tracepoint ids in order to attach bpf programs.
+allow gpuservice debugfs_tracing:file { getattr open read ioctl lock map watch watch_reads };
+allow gpuservice self:perf_event { cpu kernel open write };
+neverallow gpuservice self:perf_event ~{ cpu kernel open write };
+
+# Needed for interact with bpf fs.
+# Write is needed to open read/write bpf maps.
+allow gpuservice fs_bpf:file { read write };
+
+# Needed for enabling bpf programs and accessing bpf maps (read-only and read/write).
+allow gpuservice bpfloader:bpf { map_read map_write prog_run };
+
+
+#line 61
+ allow gpuservice gpu_service:service_manager { add find };
+#line 61
+ neverallow { domain -gpuservice } gpu_service:service_manager add;
+#line 61
+
+#line 61
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 61
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 61
+
+#line 61
+
+
+# Needed for enabling write access to persist.graphics.egl from developer option switch UI, through gpuservice.
+
+#line 64
+
+#line 64
+allow gpuservice property_socket:sock_file write;
+#line 64
+allow gpuservice init:unix_stream_socket connectto;
+#line 64
+
+#line 64
+allow gpuservice graphics_config_writable_prop:property_service set;
+#line 64
+
+#line 64
+allow gpuservice graphics_config_writable_prop:file { getattr open read map };
+#line 64
+
+#line 64
+
+
+neverallow { domain -init -vendor_init -gpuservice } graphics_config_writable_prop:property_service set;
+
+# Needed for querying permission
+allow gpuservice permission_service:service_manager find;
+
+# Only uncomment below line when in development
+# userdebug_or_eng(`permissive gpuservice;')
+#line 1 "system/sepolicy/private/gsid.te"
+# gsid - Manager for GSI Installation
+
+type gsid, domain;
+type gsid_exec, exec_type, file_type, system_file_type;
+typeattribute gsid coredomain;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init gsid_exec:file { getattr open read execute map };
+#line 7
+allow init gsid:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow gsid gsid_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init gsid:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init gsid:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init gsid_exec:process gsid;
+#line 7
+
+#line 7
+
+
+
+#line 9
+# Call the servicemanager and transfer references to it.
+#line 9
+allow gsid servicemanager:binder { call transfer };
+#line 9
+# Allow servicemanager to send out callbacks
+#line 9
+allow servicemanager gsid:binder { call transfer };
+#line 9
+# servicemanager performs getpidcon on clients.
+#line 9
+allow servicemanager gsid:dir search;
+#line 9
+allow servicemanager gsid:file { read open };
+#line 9
+allow servicemanager gsid:process getattr;
+#line 9
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+
+#line 10
+typeattribute gsid binderservicedomain;
+#line 10
+
+
+#line 11
+ allow gsid gsi_service:service_manager { add find };
+#line 11
+ neverallow { domain -gsid } gsi_service:service_manager add;
+#line 11
+
+#line 11
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 11
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 11
+
+#line 11
+
+
+# Manage DSU metadata encryption key through vold.
+allow gsid vold_service:service_manager find;
+
+#line 15
+# Call the server domain and optionally transfer references to it.
+#line 15
+allow gsid vold:binder { call transfer };
+#line 15
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 15
+allow vold gsid:binder transfer;
+#line 15
+# Receive and use open files from the server.
+#line 15
+allow gsid vold:fd use;
+#line 15
+
+
+
+#line 17
+
+#line 17
+allow gsid property_socket:sock_file write;
+#line 17
+allow gsid init:unix_stream_socket connectto;
+#line 17
+
+#line 17
+allow gsid gsid_prop:property_service set;
+#line 17
+
+#line 17
+allow gsid gsid_prop:file { getattr open read map };
+#line 17
+
+#line 17
+
+
+# Needed to create/delete device-mapper nodes, and read/write to them.
+allow gsid dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow gsid dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow gsid self:{ capability cap_userns } sys_admin;
+dontaudit gsid self:{ capability cap_userns } dac_override;
+
+# On FBE devices (not using dm-default-key), gsid will use loop devices to map
+# images rather than device-mapper.
+allow gsid loop_control_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow gsid loop_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm gsid loop_device:blk_file ioctl {
+ 0x00004c05
+ 0x00004c04
+ 0x00004c00
+ 0x00004c09
+ 0x00004c08
+ 0x00004c01
+ 0x00001261
+};
+
+# libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
+# This requires traversing /sys/block/dm-N/slaves/* and reading the list of
+# file names.
+
+#line 42
+allow gsid sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+#line 42
+allow gsid sysfs_dm:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 42
+
+
+# libfiemap_writer needs to read /sys/fs/f2fs/<dev>/features to determine
+# whether pin_file support is enabled.
+
+#line 46
+allow gsid sysfs_fs_f2fs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 46
+allow gsid sysfs_fs_f2fs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 46
+
+
+# Needed to read fstab, which is used to validate that system verity does not
+# use check_once_at_most for sdcard installs. (Note: proc_cmdline is needed
+# to get the A/B slot suffix).
+
+#line 51
+ allow gsid { metadata_file gsi_metadata_file_type }:dir search;
+#line 51
+ allow gsid gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 51
+ allow gsid { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 51
+
+allow gsid sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+allow gsid sysfs_dt_firmware_android:file { getattr open read ioctl lock map watch watch_reads };
+
+# Needed to stat /data/gsi/* and realpath on /dev/block/by-name/*
+allow gsid block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow querying the size of super_block_device_type.
+allow gsid super_block_device_type:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# liblp queries these block alignment properties.
+allowxperm gsid {
+ userdata_block_device
+ sdcard_block_device
+ super_block_device_type
+}:blk_file ioctl {
+ 0x00001278
+ 0x0000127a
+};
+
+# When installing images to an sdcard, gsid needs to be able to stat() the
+# block device. gsid also calls realpath() to remove symlinks.
+allow gsid mnt_media_rw_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow gsid mnt_media_rw_stub_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# When installing images to an sdcard, gsid must bypass sdcardfs and install
+# directly to vfat, which supports the FIBMAP ioctl.
+allow gsid vfat:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow gsid vfat:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow gsid sdcard_block_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+# This is needed for FIBMAP unfortunately. Oddly FIEMAP does not carry this
+# requirement, but the kernel does not implement FIEMAP support for VFAT.
+allow gsid self:{ capability cap_userns } sys_rawio;
+
+# Allow rules for gsi_tool.
+#line 95
+
+
+neverallow {
+ domain
+ -gsid
+ -init
+ -update_engine_common
+ -recovery
+ -fastbootd
+} gsid_prop:property_service set;
+
+# gsid needs to store images on /data, but cannot use file I/O. If it did, the
+# underlying blocks would be encrypted, and we couldn't mount the GSI image in
+# first-stage init. So instead of directly writing to /data, we:
+#
+# 1. fallocate a file large enough to hold the signed GSI
+# 2. extract its block layout with FIEMAP
+# 3. create a dm-linear device using the FIEMAP, targeting /dev/block/by-name/userdata
+# 4. write system_gsi into that dm device
+#
+# To make this process work, we need to unwrap the device-mapper stacking for
+# userdata to reach the underlying block device. To verify the result we use
+# stat(), which requires read access.
+allow gsid userdata_block_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# gsid uses /metadata/gsi to communicate GSI boot information to first-stage
+# init. It cannot use userdata since data cannot be decrypted during this
+# stage.
+#
+# gsid uses /metadata/gsi to store three files:
+# install_status - A short string indicating whether a GSI image is bootable.
+# lp_metadata - LpMetadata blob describing the block ranges on userdata
+# where system_gsi resides.
+# booted - An empty file that, if exists, indicates that a GSI is
+# currently running.
+#
+allow gsid metadata_file:dir { search getattr };
+allow gsid {
+ gsi_metadata_file_type
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+allow gsid {
+ ota_metadata_file
+}:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+allow gsid {
+ gsi_metadata_file_type
+ ota_metadata_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow restorecon to fix context of gsi_public_metadata_file.
+allow gsid file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow gsid gsi_metadata_file:file relabelfrom;
+allow gsid gsi_public_metadata_file:file relabelto;
+
+allow gsid {
+ gsi_data_file
+ ota_image_data_file
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow gsid {
+ gsi_data_file
+ ota_image_data_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allowxperm gsid {
+ gsi_data_file
+ ota_image_data_file
+}:file ioctl {
+ 0xc020660b
+ 0x80086601
+};
+
+allow gsid system_server:binder call;
+
+# Prevent most processes from writing to gsi_metadata_file_type, but allow
+# adding rules for path resolution of gsi_public_metadata_file and reading
+# gsi_public_metadata_file.
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} gsi_metadata_file_type:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} { gsi_metadata_file_type -gsi_public_metadata_file }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } *;
+
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} gsi_public_metadata_file:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ { getattr open read ioctl lock map watch watch_reads } };
+
+# Prevent apps from accessing gsi_metadata_file_type.
+neverallow {
+ appdomain
+ -shell
+} gsi_metadata_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } *;
+
+neverallow {
+ domain
+ -init
+ -gsid
+} gsi_data_file:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } *;
+
+neverallow {
+ domain
+ -gsid
+} gsi_data_file:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ relabelto getattr };
+#line 1 "system/sepolicy/private/hal_allocator.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_allocator_client hal_allocator_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_allocator_server hal_allocator_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_allocator_client hal_allocator_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_allocator_client hidl_allocator_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_allocator_server hidl_allocator_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_allocator_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_allocator_server } hidl_allocator_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+allow hal_allocator_client hidl_memory_hwservice:hwservice_manager find;
+allow hal_allocator_client same_process_hal_file:file { execute read open getattr map };
+#line 1 "system/sepolicy/private/hal_allocator_default.te"
+type hal_allocator_default, domain, coredomain;
+
+#line 2
+typeattribute hal_allocator_default halserverdomain;
+#line 2
+typeattribute hal_allocator_default hal_allocator_server;
+#line 2
+typeattribute hal_allocator_default hal_allocator;
+#line 2
+
+
+type hal_allocator_default_exec, system_file_type, exec_type, file_type;
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init hal_allocator_default_exec:file { getattr open read execute map };
+#line 5
+allow init hal_allocator_default:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow hal_allocator_default hal_allocator_default_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init hal_allocator_default:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init hal_allocator_default:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init hal_allocator_default_exec:process hal_allocator_default;
+#line 5
+
+#line 5
+
+
+# to force stop the service when it's not supported
+
+#line 8
+
+#line 8
+allow hal_allocator_default property_socket:sock_file write;
+#line 8
+allow hal_allocator_default init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow hal_allocator_default hidl_memory_prop:property_service set;
+#line 8
+
+#line 8
+allow hal_allocator_default hidl_memory_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+#line 1 "system/sepolicy/private/hal_atrace.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_atrace_client hal_atrace_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_atrace_server hal_atrace_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_atrace_client hal_atrace_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_atrace_client hal_atrace_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_atrace_server hal_atrace_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_atrace_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_atrace_server } hal_atrace_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 1 "system/sepolicy/private/hal_audio.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_audio_client hal_audio_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_audio_server hal_audio_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_audio_client hal_audio_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_audio_server hal_audio_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_audio_client hal_audio_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_audio_server hal_audio_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_audio_client hal_audio_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_audio_server hal_audio_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_audio_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_audio_server } hal_audio_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_audio_client hal_audio_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_audio_server hal_audio_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_audio_server } hal_audio_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+allow hal_audio ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow hal_audio_server servicemanager:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow servicemanager hal_audio_server:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow hal_audio_server servicemanager:fd use;
+#line 10
+
+
+
+#line 12
+allow hal_audio proc:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_audio proc:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+
+#line 13
+allow hal_audio proc_asound:dir { open getattr read search ioctl lock watch watch_reads };
+#line 13
+allow hal_audio proc_asound:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 13
+
+allow hal_audio_server audio_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow hal_audio_server audio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Needed to provide debug dump output via dumpsys' pipes.
+allow hal_audio shell:fd use;
+allow hal_audio shell:fifo_file write;
+allow hal_audio dumpstate:fd use;
+allow hal_audio dumpstate:fifo_file write;
+
+# Needed to allow sound trigger hal to access shared memory from apps.
+allow hal_audio_server appdomain:fd use;
+# Allow sound trigger hal to access shared memory from system server.
+allow hal_audio_server system_server_tmpfs:file { getattr map read };
+
+# allow self to set scheduler (and allows Binder RT PI)
+allow hal_audio_server self:{ capability cap_userns } sys_nice;
+
+# allow hal audio to use vnbinder
+
+#line 32
+# Talk to the vndbinder device node
+#line 32
+allow hal_audio vndbinder_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 32
+# Call the vndservicemanager and transfer references to it.
+#line 32
+allow hal_audio vndservicemanager:binder { call transfer };
+#line 32
+# vndservicemanager performs getpidcon on clients.
+#line 32
+allow vndservicemanager hal_audio:dir search;
+#line 32
+allow vndservicemanager hal_audio:file { read open map };
+#line 32
+allow vndservicemanager hal_audio:process getattr;
+#line 32
+
+
+###
+### neverallow rules
+###
+
+# Should never execute any executable without a domain transition
+neverallow hal_audio_server { file_type fs_type }:file execute_no_trans;
+
+# Only audio HAL may directly access the audio hardware
+neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *;
+
+
+#line 44
+allow hal_audio audio_config_prop:file { getattr open read map };
+#line 44
+
+
+#line 45
+allow hal_audio bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 45
+
+
+#line 46
+allow hal_audio bluetooth_audio_hal_prop:file { getattr open read map };
+#line 46
+
+#line 1 "system/sepolicy/private/hal_audiocontrol.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_audiocontrol_client hal_audiocontrol_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_audiocontrol_server hal_audiocontrol_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_audiocontrol_client hal_audiocontrol_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_audiocontrol_server hal_audiocontrol_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_audiocontrol_client hal_audiocontrol_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_audiocontrol_server hal_audiocontrol_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_audiocontrol_client hal_audiocontrol_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_audiocontrol_server hal_audiocontrol_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_audiocontrol_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_audiocontrol_server } hal_audiocontrol_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_audiocontrol_client hal_audiocontrol_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_audiocontrol_server hal_audiocontrol_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_audiocontrol_server } hal_audiocontrol_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_audiocontrol_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_audiocontrol_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_audiocontrol_server servicemanager:fd use;
+#line 8
+
+#line 1 "system/sepolicy/private/hal_authgraph.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_authgraph_client hal_authgraph_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_authgraph_server hal_authgraph_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_authgraph_client hal_authgraph_server:fd use;
+#line 1
+
+
+
+#line 3
+ allow hal_authgraph_client hal_authgraph_service:service_manager find;
+#line 3
+
+#line 3
+ allow hal_authgraph_server hal_authgraph_service:service_manager { add find };
+#line 3
+ neverallow { domain -hal_authgraph_server } hal_authgraph_service:service_manager add;
+#line 3
+
+#line 3
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 3
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_authgraph_server servicemanager:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow servicemanager hal_authgraph_server:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_authgraph_server servicemanager:fd use;
+#line 4
+
+
+allow hal_authgraph_server tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_authgraph_server ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/hal_authsecret.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_authsecret_client hal_authsecret_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_authsecret_server hal_authsecret_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_authsecret_client hal_authsecret_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_authsecret_client hal_authsecret_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_authsecret_server hal_authsecret_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_authsecret_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_authsecret_server } hal_authsecret_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_authsecret_client hal_authsecret_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_authsecret_server hal_authsecret_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_authsecret_server } hal_authsecret_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_authsecret_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_authsecret_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_authsecret_server servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_bluetooth.te"
+# HwBinder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_bluetooth_client hal_bluetooth_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_bluetooth_server hal_bluetooth_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_bluetooth_client hal_bluetooth_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_bluetooth_server hal_bluetooth_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_bluetooth_client hal_bluetooth_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_bluetooth_server hal_bluetooth_client:fd use;
+#line 3
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_bluetooth_server servicemanager:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow servicemanager hal_bluetooth_server:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_bluetooth_server servicemanager:fd use;
+#line 4
+
+
+
+#line 6
+ allow hal_bluetooth_client hal_bluetooth_hwservice:hwservice_manager find;
+#line 6
+
+#line 6
+ allow hal_bluetooth_server hal_bluetooth_hwservice:hwservice_manager { add find };
+#line 6
+ allow hal_bluetooth_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hal_bluetooth_server } hal_bluetooth_hwservice:hwservice_manager add;
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+ allow hal_bluetooth_client hal_bluetooth_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_bluetooth_server hal_bluetooth_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_bluetooth_server } hal_bluetooth_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+
+#line 9
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 9
+# deprecated.
+#line 9
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 9
+allow hal_bluetooth sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 9
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 9
+allow hal_bluetooth self:{ capability2 cap2_userns } block_suspend;
+#line 9
+# system_suspend permissions
+#line 9
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow hal_bluetooth system_suspend_server:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow system_suspend_server hal_bluetooth:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow hal_bluetooth system_suspend_server:fd use;
+#line 9
+
+#line 9
+allow hal_bluetooth system_suspend_hwservice:hwservice_manager find;
+#line 9
+# halclientdomain permissions
+#line 9
+
+#line 9
+# Call the hwservicemanager and transfer references to it.
+#line 9
+allow hal_bluetooth hwservicemanager:binder { call transfer };
+#line 9
+# Allow hwservicemanager to send out callbacks
+#line 9
+allow hwservicemanager hal_bluetooth:binder { call transfer };
+#line 9
+# hwservicemanager performs getpidcon on clients.
+#line 9
+allow hwservicemanager hal_bluetooth:dir search;
+#line 9
+allow hwservicemanager hal_bluetooth:file { read open map };
+#line 9
+allow hwservicemanager hal_bluetooth:process getattr;
+#line 9
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+#line 9
+
+#line 9
+allow hal_bluetooth hwservicemanager_prop:file { getattr open read map };
+#line 9
+
+#line 9
+allow hal_bluetooth hidl_manager_hwservice:hwservice_manager find;
+#line 9
+# AIDL suspend hal permissions
+#line 9
+allow hal_bluetooth hal_system_suspend_service:service_manager find;
+#line 9
+
+#line 9
+# Call the servicemanager and transfer references to it.
+#line 9
+allow hal_bluetooth servicemanager:binder { call transfer };
+#line 9
+# Allow servicemanager to send out callbacks
+#line 9
+allow servicemanager hal_bluetooth:binder { call transfer };
+#line 9
+# servicemanager performs getpidcon on clients.
+#line 9
+allow servicemanager hal_bluetooth:dir search;
+#line 9
+allow servicemanager hal_bluetooth:file { read open };
+#line 9
+allow servicemanager hal_bluetooth:process getattr;
+#line 9
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+#line 9
+;
+
+# The HAL toggles rfkill to power the chip off/on.
+allow hal_bluetooth self:{ capability cap_userns } net_admin;
+
+# bluetooth factory file accesses.
+
+#line 15
+allow hal_bluetooth bluetooth_efs_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_bluetooth bluetooth_efs_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+
+allow hal_bluetooth { uhid_device hci_attach_dev }:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# sysfs access.
+
+#line 20
+allow hal_bluetooth sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_bluetooth sysfs_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+allow hal_bluetooth sysfs_bluetooth_writable:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_bluetooth self:{ capability2 cap2_userns } wake_alarm;
+
+# Allow write access to bluetooth-specific properties
+
+#line 25
+
+#line 25
+allow hal_bluetooth property_socket:sock_file write;
+#line 25
+allow hal_bluetooth init:unix_stream_socket connectto;
+#line 25
+
+#line 25
+allow hal_bluetooth bluetooth_a2dp_offload_prop:property_service set;
+#line 25
+
+#line 25
+allow hal_bluetooth bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 25
+
+#line 25
+
+
+#line 26
+
+#line 26
+allow hal_bluetooth property_socket:sock_file write;
+#line 26
+allow hal_bluetooth init:unix_stream_socket connectto;
+#line 26
+
+#line 26
+allow hal_bluetooth bluetooth_audio_hal_prop:property_service set;
+#line 26
+
+#line 26
+allow hal_bluetooth bluetooth_audio_hal_prop:file { getattr open read map };
+#line 26
+
+#line 26
+
+
+#line 27
+
+#line 27
+allow hal_bluetooth property_socket:sock_file write;
+#line 27
+allow hal_bluetooth init:unix_stream_socket connectto;
+#line 27
+
+#line 27
+allow hal_bluetooth bluetooth_finder_prop:property_service set;
+#line 27
+
+#line 27
+allow hal_bluetooth bluetooth_finder_prop:file { getattr open read map };
+#line 27
+
+#line 27
+
+
+#line 28
+
+#line 28
+allow hal_bluetooth property_socket:sock_file write;
+#line 28
+allow hal_bluetooth init:unix_stream_socket connectto;
+#line 28
+
+#line 28
+allow hal_bluetooth bluetooth_prop:property_service set;
+#line 28
+
+#line 28
+allow hal_bluetooth bluetooth_prop:file { getattr open read map };
+#line 28
+
+#line 28
+
+
+#line 29
+
+#line 29
+allow hal_bluetooth property_socket:sock_file write;
+#line 29
+allow hal_bluetooth init:unix_stream_socket connectto;
+#line 29
+
+#line 29
+allow hal_bluetooth exported_bluetooth_prop:property_service set;
+#line 29
+
+#line 29
+allow hal_bluetooth exported_bluetooth_prop:file { getattr open read map };
+#line 29
+
+#line 29
+
+
+# /proc access (bluesleep etc.).
+allow hal_bluetooth proc_bluetooth_writable:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# allow to run with real-time scheduling policy
+allow hal_bluetooth self:{ capability cap_userns } sys_nice;
+#line 1 "system/sepolicy/private/hal_bootctl.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_bootctl_client hal_bootctl_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_bootctl_server hal_bootctl_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_bootctl_client hal_bootctl_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_bootctl_server hal_bootctl_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_bootctl_client hal_bootctl_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_bootctl_server hal_bootctl_client:fd use;
+#line 3
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow hal_bootctl_server servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager hal_bootctl_server:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager hal_bootctl_server:dir search;
+#line 4
+allow servicemanager hal_bootctl_server:file { read open };
+#line 4
+allow servicemanager hal_bootctl_server:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+
+
+#line 6
+ allow hal_bootctl_client hal_bootctl_hwservice:hwservice_manager find;
+#line 6
+
+#line 6
+ allow hal_bootctl_server hal_bootctl_hwservice:hwservice_manager { add find };
+#line 6
+ allow hal_bootctl_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hal_bootctl_server } hal_bootctl_hwservice:hwservice_manager add;
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+allow hal_bootctl_server proc_bootconfig:file { getattr open read ioctl lock map watch watch_reads };
+
+# Needed to wait for AIDL hal services
+
+#line 10
+ allow hal_bootctl_client hal_bootctl_service:service_manager find;
+#line 10
+
+#line 10
+ allow hal_bootctl_server hal_bootctl_service:service_manager { add find };
+#line 10
+ neverallow { domain -hal_bootctl_server } hal_bootctl_service:service_manager add;
+#line 10
+
+#line 10
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 10
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 10
+
+#line 10
+
+#line 10
+
+#line 10
+
+#line 10
+;
+#line 1 "system/sepolicy/private/hal_broadcastradio.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_broadcastradio_client hal_broadcastradio_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_broadcastradio_server hal_broadcastradio_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_broadcastradio_client hal_broadcastradio_server:fd use;
+#line 1
+
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_broadcastradio_server hal_broadcastradio_client:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_broadcastradio_client hal_broadcastradio_server:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_broadcastradio_server hal_broadcastradio_client:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_broadcastradio_client hal_broadcastradio_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_broadcastradio_server hal_broadcastradio_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_broadcastradio_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_broadcastradio_server } hal_broadcastradio_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_broadcastradio_client hal_broadcastradio_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_broadcastradio_server hal_broadcastradio_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_broadcastradio_server } hal_broadcastradio_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_broadcastradio_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_broadcastradio_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_broadcastradio_server servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_camera.te"
+# HwBinder IPC from clients to server and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_camera_client hal_camera_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_camera_server hal_camera_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_camera_client hal_camera_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_camera_server hal_camera_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_camera_client hal_camera_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_camera_server hal_camera_client:fd use;
+#line 3
+
+
+#binder IPC from client to service manager and callbacks
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow hal_camera_server servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager hal_camera_server:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager hal_camera_server:dir search;
+#line 6
+allow servicemanager hal_camera_server:file { read open };
+#line 6
+allow servicemanager hal_camera_server:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+
+
+#line 8
+ allow hal_camera_client hal_camera_hwservice:hwservice_manager find;
+#line 8
+
+#line 8
+ allow hal_camera_server hal_camera_hwservice:hwservice_manager { add find };
+#line 8
+ allow hal_camera_server hidl_base_hwservice:hwservice_manager add;
+#line 8
+ neverallow { domain -hal_camera_server } hal_camera_hwservice:hwservice_manager add;
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+#line 9
+ allow hal_camera_client hal_camera_service:service_manager find;
+#line 9
+
+#line 9
+ allow hal_camera_server hal_camera_service:service_manager { add find };
+#line 9
+ neverallow { domain -hal_camera_server } hal_camera_service:service_manager add;
+#line 9
+
+#line 9
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 9
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 9
+
+#line 9
+
+#line 9
+
+#line 9
+
+#line 9
+
+
+allow hal_camera device:dir { open getattr read search ioctl lock watch watch_reads };
+allow hal_camera video_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow hal_camera video_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_camera camera_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_camera ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_camera dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Both the client and the server need to use the graphics allocator
+allow { hal_camera_client hal_camera_server } hal_graphics_allocator:fd use;
+
+# Allow hal_camera to use fd from app,gralloc,and ashmem HAL
+allow hal_camera { appdomain -isolated_app }:fd use;
+allow hal_camera surfaceflinger:fd use;
+allow hal_camera hal_allocator_server:fd use;
+
+# Needed to provide debug dump output via dumpsys' pipes.
+allow hal_camera shell:fd use;
+allow hal_camera shell:fifo_file write;
+
+###
+### neverallow rules
+###
+
+# hal_camera should never execute any executable without a
+# domain transition
+neverallow hal_camera_server { file_type fs_type }:file execute_no_trans;
+
+# hal_camera should never need network access. Disallow network sockets.
+neverallow hal_camera_server { domain }:{ tcp_socket udp_socket rawip_socket } *;
+
+# Only camera HAL may directly access the camera hardware
+neverallow { halserverdomain -hal_camera_server } camera_device:chr_file *;
+#line 1 "system/sepolicy/private/hal_can.te"
+# CAN controller
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_can_controller_client hal_can_controller_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_can_controller_server hal_can_controller_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_can_controller_client hal_can_controller_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_can_controller_server hal_can_controller_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_can_controller_client hal_can_controller_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_can_controller_server hal_can_controller_client:fd use;
+#line 3
+
+
+#line 4
+ allow hal_can_controller_client hal_can_controller_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_can_controller_server hal_can_controller_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_can_controller_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_can_controller_server } hal_can_controller_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+# CAN bus
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_can_bus_client hal_can_bus_server:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow hal_can_bus_server hal_can_bus_client:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_can_bus_client hal_can_bus_server:fd use;
+#line 7
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_can_bus_server hal_can_bus_client:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow hal_can_bus_client hal_can_bus_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_can_bus_server hal_can_bus_client:fd use;
+#line 8
+
+
+#line 9
+ allow hal_can_bus_client hal_can_bus_hwservice:hwservice_manager find;
+#line 9
+
+#line 9
+ allow hal_can_bus_server hal_can_bus_hwservice:hwservice_manager { add find };
+#line 9
+ allow hal_can_bus_server hidl_base_hwservice:hwservice_manager add;
+#line 9
+ neverallow { domain -hal_can_bus_server } hal_can_bus_hwservice:hwservice_manager add;
+#line 9
+
+#line 9
+
+#line 9
+
+#line 9
+
+
+# AIDL HAL for CAN buses (ICanController)
+
+#line 12
+ allow hal_can_controller_client hal_can_controller_service:service_manager find;
+#line 12
+
+#line 12
+ allow hal_can_controller_server hal_can_controller_service:service_manager { add find };
+#line 12
+ neverallow { domain -hal_can_controller_server } hal_can_controller_service:service_manager add;
+#line 12
+
+#line 12
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 12
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 12
+
+#line 12
+
+#line 12
+
+#line 12
+
+#line 12
+
+
+#line 13
+# Call the servicemanager and transfer references to it.
+#line 13
+allow hal_can_controller servicemanager:binder { call transfer };
+#line 13
+# Allow servicemanager to send out callbacks
+#line 13
+allow servicemanager hal_can_controller:binder { call transfer };
+#line 13
+# servicemanager performs getpidcon on clients.
+#line 13
+allow servicemanager hal_can_controller:dir search;
+#line 13
+allow servicemanager hal_can_controller:file { read open };
+#line 13
+allow servicemanager hal_can_controller:process getattr;
+#line 13
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 13
+# all domains in domain.te.
+#line 13
+
+#line 1 "system/sepolicy/private/hal_cas.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_cas_client hal_cas_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_cas_server hal_cas_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_cas_client hal_cas_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_cas_server hal_cas_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_cas_client hal_cas_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_cas_server hal_cas_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_cas_client hal_cas_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_cas_server hal_cas_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_cas_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_cas_server } hal_cas_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+allow hal_cas_server hidl_memory_hwservice:hwservice_manager find;
+
+
+#line 8
+ allow hal_cas_client hal_cas_service:service_manager find;
+#line 8
+
+#line 8
+ allow hal_cas_server hal_cas_service:service_manager { add find };
+#line 8
+ neverallow { domain -hal_cas_server } hal_cas_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow hal_cas_server servicemanager:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow servicemanager hal_cas_server:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow hal_cas_server servicemanager:fd use;
+#line 10
+
+
+#line 11
+# Call the server domain and optionally transfer references to it.
+#line 11
+allow hal_cas_client servicemanager:binder { call transfer };
+#line 11
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 11
+allow servicemanager hal_cas_client:binder transfer;
+#line 11
+# Receive and use open files from the server.
+#line 11
+allow hal_cas_client servicemanager:fd use;
+#line 11
+
+
+# Permit reading device's serial number from system properties
+
+#line 14
+allow hal_cas_server serialno_prop:file { getattr open read map };
+#line 14
+
+
+# Read files already opened under /data
+allow hal_cas system_data_file:file { getattr read };
+
+# Read access to pseudo filesystems
+
+#line 20
+allow hal_cas cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_cas cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+allow hal_cas cgroup:dir { search write };
+allow hal_cas cgroup:file { open append write lock map };
+
+
+#line 24
+allow hal_cas cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 24
+allow hal_cas cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 24
+
+allow hal_cas cgroup_v2:dir { search write };
+allow hal_cas cgroup_v2:file { open append write lock map };
+
+# Allow access to ion memory allocation device
+allow hal_cas ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_cas hal_graphics_allocator:fd use;
+
+allow hal_cas tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+###
+### neverallow rules
+###
+
+# hal_cas should never execute any executable without a
+# domain transition
+neverallow hal_cas_server { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm hal_cas_server domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 43
+{
+#line 43
+# qualcomm rmnet ioctls
+#line 43
+0x00006900 0x00006902
+#line 43
+# socket ioctls
+#line 43
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 43
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 43
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 43
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 43
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 43
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 43
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 43
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 43
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 43
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 43
+# device and protocol specific ioctls
+#line 43
+0x000089f0-0x000089ff
+#line 43
+0x000089e0-0x000089ef
+#line 43
+# Wireless extension ioctls
+#line 43
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 43
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 43
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 43
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 43
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 43
+0x00008b34 0x00008b35 0x00008b36
+#line 43
+# Dev private ioctl i.e. hardware specific ioctls
+#line 43
+0x00008be0-0x00008bff
+#line 43
+};
+#line 1 "system/sepolicy/private/hal_codec2.te"
+
+#line 1
+allow hal_codec2_client media_variant_prop:file { getattr open read map };
+#line 1
+
+
+#line 2
+allow hal_codec2_server media_variant_prop:file { getattr open read map };
+#line 2
+
+
+#line 3
+allow hal_codec2_client codec2_config_prop:file { getattr open read map };
+#line 3
+
+
+#line 4
+allow hal_codec2_server codec2_config_prop:file { getattr open read map };
+#line 4
+
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_codec2_client hal_codec2_server:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow hal_codec2_server hal_codec2_client:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_codec2_client hal_codec2_server:fd use;
+#line 6
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_codec2_server hal_codec2_client:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow hal_codec2_client hal_codec2_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_codec2_server hal_codec2_client:fd use;
+#line 7
+
+
+
+#line 9
+ allow hal_codec2_client hal_codec2_hwservice:hwservice_manager find;
+#line 9
+
+#line 9
+ allow hal_codec2_server hal_codec2_hwservice:hwservice_manager { add find };
+#line 9
+ allow hal_codec2_server hidl_base_hwservice:hwservice_manager add;
+#line 9
+ neverallow { domain -hal_codec2_server } hal_codec2_hwservice:hwservice_manager add;
+#line 9
+
+#line 9
+
+#line 9
+
+#line 9
+
+
+#line 10
+ allow hal_codec2_client hal_codec2_service:service_manager find;
+#line 10
+
+#line 10
+ allow hal_codec2_server hal_codec2_service:service_manager { add find };
+#line 10
+ neverallow { domain -hal_codec2_server } hal_codec2_service:service_manager add;
+#line 10
+
+#line 10
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 10
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 10
+
+#line 10
+
+#line 10
+
+#line 10
+
+#line 10
+
+
+# The following permissions are added to hal_codec2_server because vendor and
+# vndk libraries provided for Codec2 implementation need them.
+
+# Allow server access to composer sync fences
+allow hal_codec2_server hal_graphics_composer:fd use;
+
+# Allow both server and client access to ion
+allow hal_codec2_server ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow server access to camera HAL's fences
+allow hal_codec2_server hal_camera:fd use;
+
+# Receive gralloc buffer FDs from bufferhubd.
+allow hal_codec2_server bufferhubd:fd use;
+
+allow hal_codec2_client ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+allow { hal_codec2_client -isolated_app_all } surfaceflinger_service:service_manager find;
+
+# codec2 aidl graphic buffer allocation waitable object
+allow hal_codec2_server su:fifo_file read;
+allow hal_codec2_server hal_codec2_client:fifo_file read;
+allow hal_codec2_server { appdomain -isolated_app_all }:fifo_file read;
+#line 1 "system/sepolicy/private/hal_configstore.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_configstore_client hal_configstore_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_configstore_server hal_configstore_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_configstore_client hal_configstore_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_configstore_client hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_configstore_server hal_configstore_ISurfaceFlingerConfigs:hwservice_manager { add find };
+#line 4
+ allow hal_configstore_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_configstore_server } hal_configstore_ISurfaceFlingerConfigs:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+# hal_configstore runs with a strict seccomp filter. Use crash_dump's
+# fallback path to collect crash data.
+
+#line 8
+
+#line 8
+allow hal_configstore_server anr_data_file:file append;
+#line 8
+allow hal_configstore_server dumpstate:fd use;
+#line 8
+allow hal_configstore_server incidentd:fd use;
+#line 8
+# TODO: Figure out why write is needed.
+#line 8
+allow hal_configstore_server dumpstate:fifo_file { append write };
+#line 8
+allow hal_configstore_server incidentd:fifo_file { append write };
+#line 8
+allow hal_configstore_server system_server:fifo_file { append write };
+#line 8
+allow hal_configstore_server tombstoned:unix_stream_socket connectto;
+#line 8
+allow hal_configstore_server tombstoned:fd use;
+#line 8
+allow hal_configstore_server tombstoned_crash_socket:sock_file write;
+#line 8
+allow hal_configstore_server tombstone_data_file:file append;
+#line 8
+
+
+###
+### neverallow rules
+###
+
+# Should never execute an executable without a domain transition
+neverallow hal_configstore_server { file_type fs_type }:file execute_no_trans;
+
+# Should never need network access. Disallow sockets except for
+# for unix stream/dgram sockets used for logging/debugging.
+neverallow hal_configstore_server domain:{
+ rawip_socket tcp_socket udp_socket
+ netlink_route_socket netlink_selinux_socket
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket
+} *;
+neverallow hal_configstore_server {
+ domain
+ -hal_configstore_server
+ -logd
+ -prng_seeder
+
+ -tombstoned
+}:{ unix_dgram_socket unix_stream_socket } *;
+
+# Should never need access to anything on /data
+neverallow hal_configstore_server {
+ data_file_type
+ -anr_data_file # for crash dump collection
+ -tombstone_data_file # for crash dump collection
+
+}:{ file fifo_file sock_file } *;
+
+# Should never need sdcard access
+neverallow hal_configstore_server {
+ sdcard_type
+ fuse sdcardfs vfat exfat fuseblk # manual expansion for completeness
+}:dir ~getattr;
+neverallow hal_configstore_server {
+ sdcard_type
+ fuse sdcardfs vfat exfat fuseblk # manual expansion for completeness
+}:file *;
+
+# Do not permit access to service_manager and vndservice_manager
+neverallow hal_configstore_server *:service_manager *;
+
+# No privileged capabilities
+neverallow hal_configstore_server self:{ capability capability2 cap_userns cap2_userns } *;
+
+# No ptracing other processes
+neverallow hal_configstore_server *:process ptrace;
+
+# no relabeling
+neverallow hal_configstore_server *:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } { relabelfrom relabelto };
+#line 1 "system/sepolicy/private/hal_confirmationui.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_confirmationui_client hal_confirmationui_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_confirmationui_server hal_confirmationui_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_confirmationui_client hal_confirmationui_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_confirmationui_client hal_confirmationui_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_confirmationui_server hal_confirmationui_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_confirmationui_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_confirmationui_server } hal_confirmationui_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_confirmationui_client hal_confirmationui_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_confirmationui_server hal_confirmationui_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_confirmationui_server } hal_confirmationui_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_confirmationui_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_confirmationui_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_confirmationui_server servicemanager:fd use;
+#line 6
+
+#line 1 "system/sepolicy/private/hal_contexthub.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_contexthub_client hal_contexthub_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_contexthub_server hal_contexthub_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_contexthub_client hal_contexthub_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_contexthub_server hal_contexthub_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_contexthub_client hal_contexthub_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_contexthub_server hal_contexthub_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_contexthub_server hal_contexthub_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_contexthub_server } hal_contexthub_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_contexthub_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_contexthub_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_contexthub_server servicemanager:fd use;
+#line 6
+
+
+allow hal_contexthub_client hal_contexthub_service:service_manager find;
+
+
+#line 10
+ allow hal_contexthub_client hal_contexthub_hwservice:hwservice_manager find;
+#line 10
+
+#line 10
+ allow hal_contexthub_server hal_contexthub_hwservice:hwservice_manager { add find };
+#line 10
+ allow hal_contexthub_server hidl_base_hwservice:hwservice_manager add;
+#line 10
+ neverallow { domain -hal_contexthub_server } hal_contexthub_hwservice:hwservice_manager add;
+#line 10
+
+#line 10
+
+#line 10
+
+#line 10
+
+#line 1 "system/sepolicy/private/hal_drm.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the servicemanager and transfer references to it.
+#line 2
+allow hal_drm_server servicemanager:binder { call transfer };
+#line 2
+# Allow servicemanager to send out callbacks
+#line 2
+allow servicemanager hal_drm_server:binder { call transfer };
+#line 2
+# servicemanager performs getpidcon on clients.
+#line 2
+allow servicemanager hal_drm_server:dir search;
+#line 2
+allow servicemanager hal_drm_server:file { read open };
+#line 2
+allow servicemanager hal_drm_server:process getattr;
+#line 2
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 2
+# all domains in domain.te.
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_drm_client hal_drm_server:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_drm_server hal_drm_client:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_drm_client hal_drm_server:fd use;
+#line 3
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_drm_server hal_drm_client:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow hal_drm_client hal_drm_server:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_drm_server hal_drm_client:fd use;
+#line 4
+
+
+
+#line 6
+ allow hal_drm_client hal_drm_hwservice:hwservice_manager find;
+#line 6
+
+#line 6
+ allow hal_drm_server hal_drm_hwservice:hwservice_manager { add find };
+#line 6
+ allow hal_drm_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hal_drm_server } hal_drm_hwservice:hwservice_manager add;
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+ allow hal_drm_client hal_drm_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_drm_server hal_drm_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_drm_server } hal_drm_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+allow hal_drm hidl_memory_hwservice:hwservice_manager find;
+
+# Required by Widevine DRM (b/22990512)
+allow hal_drm self:process execmem;
+
+# Permit reading device's serial number from system properties
+
+#line 15
+allow hal_drm_server serialno_prop:file { getattr open read map };
+#line 15
+
+# Permit reading force L3 system property
+
+#line 17
+allow hal_drm_server drm_forcel3_prop:file { getattr open read map };
+#line 17
+
+
+# Read files already opened under /data
+allow hal_drm system_data_file:file { getattr read };
+
+# Read access to pseudo filesystems
+
+#line 23
+allow hal_drm cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 23
+allow hal_drm cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 23
+
+allow hal_drm cgroup:dir { search write };
+allow hal_drm cgroup:file { open append write lock map };
+
+
+#line 27
+allow hal_drm cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 27
+allow hal_drm cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 27
+
+allow hal_drm cgroup_v2:dir { search write };
+allow hal_drm cgroup_v2:file { open append write lock map };
+
+# Allow dumpsys Widevine without root
+allow hal_drm_server shell:fd use;
+allow hal_drm_server shell:fifo_file write;
+
+# Allow access to ion memory allocation device
+allow hal_drm ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_drm hal_graphics_allocator:fd use;
+
+# Allow access to hidl_memory allocation service
+allow hal_drm hal_allocator_server:fd use;
+
+# Allow access to fds allocated by mediaserver
+allow hal_drm mediaserver:fd use;
+
+allow hal_drm sysfs:file { getattr open read ioctl lock map watch watch_reads };
+
+allow hal_drm tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow hal_drm_server { appdomain -isolated_app }:fd use;
+
+# only allow unprivileged socket ioctl commands
+allowxperm hal_drm self:{ rawip_socket tcp_socket udp_socket }
+ ioctl {
+#line 53
+{
+#line 53
+# Socket ioctls for gathering information about the interface
+#line 53
+0x00008906 0x00008907
+#line 53
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 53
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 53
+# Wireless extension ioctls. Primarily get functions.
+#line 53
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 53
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 53
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 53
+} {
+#line 53
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 53
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 53
+} };
+
+###
+### neverallow rules
+###
+
+# hal_drm should never execute any executable without a
+# domain transition
+neverallow hal_drm_server { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm hal_drm_server domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 64
+{
+#line 64
+# qualcomm rmnet ioctls
+#line 64
+0x00006900 0x00006902
+#line 64
+# socket ioctls
+#line 64
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 64
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 64
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 64
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 64
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 64
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 64
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 64
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 64
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 64
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 64
+# device and protocol specific ioctls
+#line 64
+0x000089f0-0x000089ff
+#line 64
+0x000089e0-0x000089ef
+#line 64
+# Wireless extension ioctls
+#line 64
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 64
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 64
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 64
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 64
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 64
+0x00008b34 0x00008b35 0x00008b36
+#line 64
+# Dev private ioctl i.e. hardware specific ioctls
+#line 64
+0x00008be0-0x00008bff
+#line 64
+};
+#line 1 "system/sepolicy/private/hal_dumpstate.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_dumpstate_client hal_dumpstate_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_dumpstate_server hal_dumpstate_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_dumpstate_client hal_dumpstate_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_dumpstate_server hal_dumpstate_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_dumpstate_client hal_dumpstate_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_dumpstate_server hal_dumpstate_client:fd use;
+#line 3
+
+
+
+#line 5
+
+#line 5
+allow hal_dumpstate_server property_socket:sock_file write;
+#line 5
+allow hal_dumpstate_server init:unix_stream_socket connectto;
+#line 5
+
+#line 5
+allow hal_dumpstate_server hal_dumpstate_config_prop:property_service set;
+#line 5
+
+#line 5
+allow hal_dumpstate_server hal_dumpstate_config_prop:file { getattr open read map };
+#line 5
+
+#line 5
+
+
+
+#line 7
+ allow hal_dumpstate_client hal_dumpstate_hwservice:hwservice_manager find;
+#line 7
+
+#line 7
+ allow hal_dumpstate_server hal_dumpstate_hwservice:hwservice_manager { add find };
+#line 7
+ allow hal_dumpstate_server hidl_base_hwservice:hwservice_manager add;
+#line 7
+ neverallow { domain -hal_dumpstate_server } hal_dumpstate_hwservice:hwservice_manager add;
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+#line 8
+ allow hal_dumpstate_client hal_dumpstate_service:service_manager find;
+#line 8
+
+#line 8
+ allow hal_dumpstate_server hal_dumpstate_service:service_manager { add find };
+#line 8
+ neverallow { domain -hal_dumpstate_server } hal_dumpstate_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow hal_dumpstate_server servicemanager:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow servicemanager hal_dumpstate_server:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow hal_dumpstate_server servicemanager:fd use;
+#line 10
+
+
+
+#line 12
+# Call the servicemanager and transfer references to it.
+#line 12
+allow hal_dumpstate_server servicemanager:binder { call transfer };
+#line 12
+# Allow servicemanager to send out callbacks
+#line 12
+allow servicemanager hal_dumpstate_server:binder { call transfer };
+#line 12
+# servicemanager performs getpidcon on clients.
+#line 12
+allow servicemanager hal_dumpstate_server:dir search;
+#line 12
+allow servicemanager hal_dumpstate_server:file { read open };
+#line 12
+allow servicemanager hal_dumpstate_server:process getattr;
+#line 12
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 12
+# all domains in domain.te.
+#line 12
+
+
+# write bug reports in /data/data/com.android.shell/files/bugreports/bugreport
+allow hal_dumpstate shell_data_file:file write;
+# allow reading /proc/interrupts for all hal impls
+allow hal_dumpstate proc_interrupts:file { getattr open read ioctl lock map watch watch_reads };
+
+# Log fsck results
+
+#line 20
+allow hal_dumpstate fscklogs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_dumpstate fscklogs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+#line 1 "system/sepolicy/private/hal_evs.te"
+
+#line 1
+# Call the hwservicemanager and transfer references to it.
+#line 1
+allow hal_evs_client hwservicemanager:binder { call transfer };
+#line 1
+# Allow hwservicemanager to send out callbacks
+#line 1
+allow hwservicemanager hal_evs_client:binder { call transfer };
+#line 1
+# hwservicemanager performs getpidcon on clients.
+#line 1
+allow hwservicemanager hal_evs_client:dir search;
+#line 1
+allow hwservicemanager hal_evs_client:file { read open map };
+#line 1
+allow hwservicemanager hal_evs_client:process getattr;
+#line 1
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 1
+# all domains in domain.te.
+#line 1
+
+
+#line 2
+# Call the hwservicemanager and transfer references to it.
+#line 2
+allow hal_evs_server hwservicemanager:binder { call transfer };
+#line 2
+# Allow hwservicemanager to send out callbacks
+#line 2
+allow hwservicemanager hal_evs_server:binder { call transfer };
+#line 2
+# hwservicemanager performs getpidcon on clients.
+#line 2
+allow hwservicemanager hal_evs_server:dir search;
+#line 2
+allow hwservicemanager hal_evs_server:file { read open map };
+#line 2
+allow hwservicemanager hal_evs_server:process getattr;
+#line 2
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 2
+# all domains in domain.te.
+#line 2
+
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_evs_client hal_evs_server:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow hal_evs_server hal_evs_client:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_evs_client hal_evs_server:fd use;
+#line 4
+
+
+#line 5
+# Call the server domain and optionally transfer references to it.
+#line 5
+allow hal_evs_server hal_evs_client:binder { call transfer };
+#line 5
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 5
+allow hal_evs_client hal_evs_server:binder transfer;
+#line 5
+# Receive and use open files from the server.
+#line 5
+allow hal_evs_server hal_evs_client:fd use;
+#line 5
+
+
+# Below lines are equivalent to hal_attribute_hwservice(hal_evs, hal_evs_hwservice)
+# except it allows evsmanagerd to add hal_evs_hwservice.
+allow hal_evs_client hal_evs_hwservice:hwservice_manager find;
+allow hal_evs_server hal_evs_hwservice:hwservice_manager { add find };
+allow hal_evs_server hidl_base_hwservice:hwservice_manager add;
+neverallow { domain -hal_evs_server -evsmanagerd } hal_evs_hwservice:hwservice_manager add;
+
+# Allows to add a service
+
+#line 15
+ allow hal_evs_client hal_evs_service:service_manager find;
+#line 15
+
+#line 15
+ allow hal_evs_server hal_evs_service:service_manager { add find };
+#line 15
+ neverallow { domain -hal_evs_server } hal_evs_service:service_manager add;
+#line 15
+
+#line 15
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 15
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 15
+
+#line 1 "system/sepolicy/private/hal_face.te"
+# Allow HwBinder IPC from client to server, and vice versa for callbacks.
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_face_client hal_face_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_face_server hal_face_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_face_client hal_face_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_face_server hal_face_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_face_client hal_face_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_face_server hal_face_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_face_client hal_face_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_face_server hal_face_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_face_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_face_server } hal_face_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_face_client hal_face_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_face_server hal_face_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_face_server } hal_face_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_face_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_face_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_face_server:dir search;
+#line 8
+allow servicemanager hal_face_server:file { read open };
+#line 8
+allow servicemanager hal_face_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+# Allow access to the ion memory allocation device.
+allow hal_face ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow read/write access to the face template directory.
+allow {hal_face -coredomain} face_vendor_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow {hal_face -coredomain} face_vendor_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+#line 1 "system/sepolicy/private/hal_fastboot.te"
+# allow binder connection from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_fastboot_client hal_fastboot_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_fastboot_server hal_fastboot_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_fastboot_client hal_fastboot_server:fd use;
+#line 2
+
+# allow client to find the service, allow server to register the service
+
+#line 4
+ allow hal_fastboot_client hal_fastboot_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_fastboot_server hal_fastboot_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_fastboot_server } hal_fastboot_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+# allow binder communication from server to service_manager
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_fastboot_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_fastboot_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_fastboot_server servicemanager:fd use;
+#line 6
+
+
+#line 1 "system/sepolicy/private/hal_fingerprint.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_fingerprint_client hal_fingerprint_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_fingerprint_server hal_fingerprint_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_fingerprint_client hal_fingerprint_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_fingerprint_server hal_fingerprint_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_fingerprint_client hal_fingerprint_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_fingerprint_server hal_fingerprint_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_fingerprint_client hal_fingerprint_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_fingerprint_server hal_fingerprint_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_fingerprint_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_fingerprint_server } hal_fingerprint_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_fingerprint_client hal_fingerprint_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_fingerprint_server hal_fingerprint_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_fingerprint_server } hal_fingerprint_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_fingerprint_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_fingerprint_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_fingerprint_server:dir search;
+#line 8
+allow servicemanager hal_fingerprint_server:file { read open };
+#line 8
+allow servicemanager hal_fingerprint_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+# For memory allocation
+allow hal_fingerprint ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } };
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+
+#line 16
+allow hal_fingerprint cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_fingerprint cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 16
+
+
+#line 17
+allow hal_fingerprint cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 17
+allow hal_fingerprint cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 17
+
+
+#line 18
+allow {hal_fingerprint -coredomain} sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow {hal_fingerprint -coredomain} sysfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+
+
+#line 1 "system/sepolicy/private/hal_gatekeeper.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_gatekeeper_client hal_gatekeeper_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_gatekeeper_server hal_gatekeeper_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_gatekeeper_client hal_gatekeeper_server:fd use;
+#line 1
+
+
+
+#line 3
+ allow hal_gatekeeper_client hal_gatekeeper_hwservice:hwservice_manager find;
+#line 3
+
+#line 3
+ allow hal_gatekeeper_server hal_gatekeeper_hwservice:hwservice_manager { add find };
+#line 3
+ allow hal_gatekeeper_server hidl_base_hwservice:hwservice_manager add;
+#line 3
+ neverallow { domain -hal_gatekeeper_server } hal_gatekeeper_hwservice:hwservice_manager add;
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+
+#line 4
+ allow hal_gatekeeper_client hal_gatekeeper_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_gatekeeper_server hal_gatekeeper_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_gatekeeper_server } hal_gatekeeper_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+# Call the server domain and optionally transfer references to it.
+#line 5
+allow hal_gatekeeper_server servicemanager:binder { call transfer };
+#line 5
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 5
+allow servicemanager hal_gatekeeper_server:binder transfer;
+#line 5
+# Receive and use open files from the server.
+#line 5
+allow hal_gatekeeper_server servicemanager:fd use;
+#line 5
+
+
+# TEE access.
+allow hal_gatekeeper tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_gatekeeper ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/hal_gnss.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_gnss_client hal_gnss_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_gnss_server hal_gnss_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_gnss_client hal_gnss_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_gnss_server hal_gnss_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_gnss_client hal_gnss_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_gnss_server hal_gnss_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_gnss_client hal_gnss_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_gnss_server hal_gnss_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_gnss_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_gnss_server } hal_gnss_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_gnss_client hal_gnss_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_gnss_server hal_gnss_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_gnss_server } hal_gnss_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow hal_gnss_server servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager hal_gnss_server:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager hal_gnss_server:dir search;
+#line 7
+allow servicemanager hal_gnss_server:file { read open };
+#line 7
+allow servicemanager hal_gnss_server:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_gnss_client servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_gnss_client:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_gnss_client:dir search;
+#line 8
+allow servicemanager hal_gnss_client:file { read open };
+#line 8
+allow servicemanager hal_gnss_client:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+#line 1 "system/sepolicy/private/hal_graphics_allocator.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_graphics_allocator_client hal_graphics_allocator_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_graphics_allocator_server hal_graphics_allocator_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_graphics_allocator_client hal_graphics_allocator_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_graphics_allocator_client hal_graphics_allocator_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_graphics_allocator_server hal_graphics_allocator_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_graphics_allocator_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_graphics_allocator_server } hal_graphics_allocator_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+allow hal_graphics_allocator_client hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_graphics_allocator_client hal_graphics_mapper_service:service_manager find;
+allow hal_graphics_allocator_client same_process_hal_file:file { execute read open getattr map };
+
+# GPU device access
+allow hal_graphics_allocator gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_graphics_allocator gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow hal_graphics_allocator ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow hal_graphics_allocator dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Access the secure heap
+allow hal_graphics_allocator dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# allow to run with real-time scheduling policy
+allow hal_graphics_allocator self:{ capability cap_userns } sys_nice;
+
+# IAllocator stable-aidl
+
+#line 22
+ allow hal_graphics_allocator_client hal_graphics_allocator_service:service_manager find;
+#line 22
+
+#line 22
+ allow hal_graphics_allocator_server hal_graphics_allocator_service:service_manager { add find };
+#line 22
+ neverallow { domain -hal_graphics_allocator_server } hal_graphics_allocator_service:service_manager add;
+#line 22
+
+#line 22
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 22
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 22
+
+#line 22
+
+#line 22
+
+#line 22
+
+#line 22
+
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow hal_graphics_allocator_server servicemanager:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow servicemanager hal_graphics_allocator_server:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow hal_graphics_allocator_server servicemanager:fd use;
+#line 23
+
+
+#line 24
+# Call the server domain and optionally transfer references to it.
+#line 24
+allow hal_graphics_allocator_client servicemanager:binder { call transfer };
+#line 24
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 24
+allow servicemanager hal_graphics_allocator_client:binder transfer;
+#line 24
+# Receive and use open files from the server.
+#line 24
+allow hal_graphics_allocator_client servicemanager:fd use;
+#line 24
+
+#line 1 "system/sepolicy/private/hal_graphics_composer.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_graphics_composer_client hal_graphics_composer_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_graphics_composer_server hal_graphics_composer_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_graphics_composer_client hal_graphics_composer_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_graphics_composer_server hal_graphics_composer_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_graphics_composer_client hal_graphics_composer_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_graphics_composer_server hal_graphics_composer_client:fd use;
+#line 3
+
+allow hal_graphics_composer_client hal_graphics_composer_server_tmpfs:file { getattr map read write };
+allow hal_graphics_composer_server hal_graphics_composer_client_tmpfs:file { getattr map read write };
+
+
+#line 7
+ allow hal_graphics_composer_client hal_graphics_composer_hwservice:hwservice_manager find;
+#line 7
+
+#line 7
+ allow hal_graphics_composer_server hal_graphics_composer_hwservice:hwservice_manager { add find };
+#line 7
+ allow hal_graphics_composer_server hidl_base_hwservice:hwservice_manager add;
+#line 7
+ neverallow { domain -hal_graphics_composer_server } hal_graphics_composer_hwservice:hwservice_manager add;
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+# Coordinate with hal_graphics_mapper
+allow hal_graphics_composer_server hal_graphics_mapper_hwservice:hwservice_manager find;
+
+# GPU device access
+allow hal_graphics_composer gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_graphics_composer gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow hal_graphics_composer ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow hal_graphics_composer dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow hal_graphics_composer hal_graphics_allocator:fd use;
+
+# Access /dev/graphics/fb0.
+allow hal_graphics_composer graphics_device:dir search;
+allow hal_graphics_composer graphics_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Fences
+allow hal_graphics_composer system_server:fd use;
+allow hal_graphics_composer bootanim:fd use;
+allow hal_graphics_composer appdomain:fd use;
+
+# allow self to set SCHED_FIFO
+allow hal_graphics_composer self:{ capability cap_userns } sys_nice;
+
+# allow surfaceflinger to use a pipe for dumpsys output
+allow hal_graphics_composer_server hal_graphics_composer_client:fifo_file write;
+
+
+
+#line 35
+# Call the server domain and optionally transfer references to it.
+#line 35
+allow hal_graphics_composer_client servicemanager:binder { call transfer };
+#line 35
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 35
+allow servicemanager hal_graphics_composer_client:binder transfer;
+#line 35
+# Receive and use open files from the server.
+#line 35
+allow hal_graphics_composer_client servicemanager:fd use;
+#line 35
+
+
+#line 36
+# Call the server domain and optionally transfer references to it.
+#line 36
+allow hal_graphics_composer_server servicemanager:binder { call transfer };
+#line 36
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 36
+allow servicemanager hal_graphics_composer_server:binder transfer;
+#line 36
+# Receive and use open files from the server.
+#line 36
+allow hal_graphics_composer_server servicemanager:fd use;
+#line 36
+
+
+
+#line 38
+ allow hal_graphics_composer_client hal_graphics_composer_service:service_manager find;
+#line 38
+
+#line 38
+ allow hal_graphics_composer_server hal_graphics_composer_service:service_manager { add find };
+#line 38
+ neverallow { domain -hal_graphics_composer_server } hal_graphics_composer_service:service_manager add;
+#line 38
+
+#line 38
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 38
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 38
+
+#line 38
+
+#line 38
+
+#line 38
+
+#line 38
+
+#line 1 "system/sepolicy/private/hal_health.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_health_client hal_health_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_health_server hal_health_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_health_client hal_health_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_health_server hal_health_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_health_client hal_health_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_health_server hal_health_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_health_client hal_health_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_health_server hal_health_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_health_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_health_server } hal_health_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_health_client hal_health_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_health_server hal_health_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_health_server } hal_health_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+# Common rules for a health service.
+
+# Allow to listen to uevents for updates
+allow hal_health_server self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Allow to read /sys/class/power_supply directory
+allow hal_health_server sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow to read files under /sys/class/power_supply. Implementations typically have symlinks
+# to vendor specific files. Vendors should mark sysfs_batteryinfo on all files read by health
+# HAL service.
+
+#line 19
+allow hal_health_server sysfs_batteryinfo:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_health_server sysfs_batteryinfo:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 19
+
+
+# Allow to wake up to send periodic events
+
+#line 22
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 22
+# deprecated.
+#line 22
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 22
+allow hal_health_server sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 22
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 22
+allow hal_health_server self:{ capability2 cap2_userns } block_suspend;
+#line 22
+# system_suspend permissions
+#line 22
+
+#line 22
+# Call the server domain and optionally transfer references to it.
+#line 22
+allow hal_health_server system_suspend_server:binder { call transfer };
+#line 22
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 22
+allow system_suspend_server hal_health_server:binder transfer;
+#line 22
+# Receive and use open files from the server.
+#line 22
+allow hal_health_server system_suspend_server:fd use;
+#line 22
+
+#line 22
+allow hal_health_server system_suspend_hwservice:hwservice_manager find;
+#line 22
+# halclientdomain permissions
+#line 22
+
+#line 22
+# Call the hwservicemanager and transfer references to it.
+#line 22
+allow hal_health_server hwservicemanager:binder { call transfer };
+#line 22
+# Allow hwservicemanager to send out callbacks
+#line 22
+allow hwservicemanager hal_health_server:binder { call transfer };
+#line 22
+# hwservicemanager performs getpidcon on clients.
+#line 22
+allow hwservicemanager hal_health_server:dir search;
+#line 22
+allow hwservicemanager hal_health_server:file { read open map };
+#line 22
+allow hwservicemanager hal_health_server:process getattr;
+#line 22
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 22
+# all domains in domain.te.
+#line 22
+
+#line 22
+
+#line 22
+allow hal_health_server hwservicemanager_prop:file { getattr open read map };
+#line 22
+
+#line 22
+allow hal_health_server hidl_manager_hwservice:hwservice_manager find;
+#line 22
+# AIDL suspend hal permissions
+#line 22
+allow hal_health_server hal_system_suspend_service:service_manager find;
+#line 22
+
+#line 22
+# Call the servicemanager and transfer references to it.
+#line 22
+allow hal_health_server servicemanager:binder { call transfer };
+#line 22
+# Allow servicemanager to send out callbacks
+#line 22
+allow servicemanager hal_health_server:binder { call transfer };
+#line 22
+# servicemanager performs getpidcon on clients.
+#line 22
+allow servicemanager hal_health_server:dir search;
+#line 22
+allow servicemanager hal_health_server:file { read open };
+#line 22
+allow servicemanager hal_health_server:process getattr;
+#line 22
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 22
+# all domains in domain.te.
+#line 22
+
+#line 22
+
+
+# Write to /dev/kmsg
+allow hal_health_server kmsg_device:chr_file { getattr { open append write lock map } };
+
+# Allow to use timerfd to wake itself up periodically to send health info.
+allow hal_health_server self:capability2 wake_alarm;
+
+# Use bpf programs
+allow hal_health_server fs_bpf_vendor:dir search;
+allow hal_health_server fs_bpf_vendor:file read;
+allow hal_health_server bpfloader:bpf prog_run;
+#line 1 "system/sepolicy/private/hal_health_storage.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_health_storage_client hal_health_storage_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_health_storage_server hal_health_storage_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_health_storage_client hal_health_storage_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_health_storage_server hal_health_storage_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_health_storage_client hal_health_storage_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_health_storage_server hal_health_storage_client:fd use;
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow hal_health_storage_server servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager hal_health_storage_server:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager hal_health_storage_server:dir search;
+#line 5
+allow servicemanager hal_health_storage_server:file { read open };
+#line 5
+allow servicemanager hal_health_storage_server:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+
+#line 7
+ allow hal_health_storage_client hal_health_storage_hwservice:hwservice_manager find;
+#line 7
+
+#line 7
+ allow hal_health_storage_server hal_health_storage_hwservice:hwservice_manager { add find };
+#line 7
+ allow hal_health_storage_server hidl_base_hwservice:hwservice_manager add;
+#line 7
+ neverallow { domain -hal_health_storage_server } hal_health_storage_hwservice:hwservice_manager add;
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+#line 8
+ allow hal_health_storage_client hal_health_storage_service:service_manager find;
+#line 8
+
+#line 8
+ allow hal_health_storage_server hal_health_storage_service:service_manager { add find };
+#line 8
+ neverallow { domain -hal_health_storage_server } hal_health_storage_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+# Allow ReadDefaultFstab().
+
+#line 11
+ allow hal_health_storage_server { metadata_file gsi_metadata_file_type }:dir search;
+#line 11
+ allow hal_health_storage_server gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 11
+ allow hal_health_storage_server { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 11
+
+#line 1 "system/sepolicy/private/hal_identity.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_identity_client hal_identity_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_identity_server hal_identity_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_identity_client hal_identity_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_identity_client hal_identity_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_identity_server hal_identity_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_identity_server } hal_identity_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_identity_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_identity_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_identity_server servicemanager:fd use;
+#line 6
+
+#line 1 "system/sepolicy/private/hal_input_classifier.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_input_classifier_client hal_input_classifier_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_input_classifier_server hal_input_classifier_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_input_classifier_client hal_input_classifier_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_input_classifier_client hal_input_classifier_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_input_classifier_server hal_input_classifier_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_input_classifier_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_input_classifier_server } hal_input_classifier_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 1 "system/sepolicy/private/hal_input_processor.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_input_processor_client hal_input_processor_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_input_processor_server hal_input_processor_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_input_processor_client hal_input_processor_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_input_processor_server servicemanager:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow servicemanager hal_input_processor_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_input_processor_server servicemanager:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_input_processor_client hal_input_processor_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_input_processor_server hal_input_processor_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_input_processor_server } hal_input_processor_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+# Allow dumping of the HAL
+allow hal_input_processor_server dumpstate:fifo_file write;
+#line 1 "system/sepolicy/private/hal_ir.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_ir_client hal_ir_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_ir_server hal_ir_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_ir_client hal_ir_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_ir_server hal_ir_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_ir_client hal_ir_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_ir_server hal_ir_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_ir_client hal_ir_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_ir_server hal_ir_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_ir_server } hal_ir_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_ir_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_ir_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_ir_server servicemanager:fd use;
+#line 6
+
+
+
+#line 8
+ allow hal_ir_client hal_ir_hwservice:hwservice_manager find;
+#line 8
+
+#line 8
+ allow hal_ir_server hal_ir_hwservice:hwservice_manager { add find };
+#line 8
+ allow hal_ir_server hidl_base_hwservice:hwservice_manager add;
+#line 8
+ neverallow { domain -hal_ir_server } hal_ir_hwservice:hwservice_manager add;
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+#line 1 "system/sepolicy/private/hal_ivn.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_ivn_client hal_ivn_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_ivn_server hal_ivn_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_ivn_client hal_ivn_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_ivn_client hal_ivn_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_ivn_server hal_ivn_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_ivn_server } hal_ivn_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 1 "system/sepolicy/private/hal_keymaster.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_keymaster_client hal_keymaster_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_keymaster_server hal_keymaster_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_keymaster_client hal_keymaster_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_keymaster_client hal_keymaster_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_keymaster_server hal_keymaster_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_keymaster_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_keymaster_server } hal_keymaster_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+allow hal_keymaster tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_keymaster ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/hal_keymint.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_keymint_client hal_keymint_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_keymint_server hal_keymint_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_keymint_client hal_keymint_server:fd use;
+#line 1
+
+
+
+#line 3
+ allow hal_keymint_client hal_keymint_service:service_manager find;
+#line 3
+
+#line 3
+ allow hal_keymint_server hal_keymint_service:service_manager { add find };
+#line 3
+ neverallow { domain -hal_keymint_server } hal_keymint_service:service_manager add;
+#line 3
+
+#line 3
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 3
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+
+#line 4
+ allow hal_keymint_client hal_remotelyprovisionedcomponent_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_keymint_server hal_remotelyprovisionedcomponent_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_keymint_server } hal_remotelyprovisionedcomponent_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+# Call the server domain and optionally transfer references to it.
+#line 5
+allow hal_keymint_server servicemanager:binder { call transfer };
+#line 5
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 5
+allow servicemanager hal_keymint_server:binder transfer;
+#line 5
+# Receive and use open files from the server.
+#line 5
+allow hal_keymint_server servicemanager:fd use;
+#line 5
+
+
+allow { hal_keymint_server -coredomain } tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow { hal_keymint_server -coredomain } ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/hal_keymint_system.te"
+type hal_keymint_system, domain, coredomain;
+
+#line 2
+typeattribute hal_keymint_system halserverdomain;
+#line 2
+typeattribute hal_keymint_system hal_keymint_server;
+#line 2
+typeattribute hal_keymint_system hal_keymint;
+#line 2
+
+
+type hal_keymint_system_exec, exec_type, system_file_type, file_type;
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init hal_keymint_system_exec:file { getattr open read execute map };
+#line 5
+allow init hal_keymint_system:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow hal_keymint_system hal_keymint_system_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init hal_keymint_system:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init hal_keymint_system:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init hal_keymint_system_exec:process hal_keymint_system;
+#line 5
+
+#line 5
+
+
+allow hal_keymint_system self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } };
+#line 3 "system/sepolicy/private/hal_lazy_test.te"
+
+#line 1 "system/sepolicy/private/hal_light.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_light_client hal_light_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_light_server hal_light_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_light_client hal_light_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_light_server hal_light_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_light_client hal_light_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_light_server hal_light_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_light_client hal_light_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_light_server hal_light_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_light_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_light_server } hal_light_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_light_client hal_light_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_light_server hal_light_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_light_server } hal_light_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_light_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_light_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_light_server servicemanager:fd use;
+#line 8
+
+
+#line 9
+# Call the servicemanager and transfer references to it.
+#line 9
+allow hal_light_client servicemanager:binder { call transfer };
+#line 9
+# Allow servicemanager to send out callbacks
+#line 9
+allow servicemanager hal_light_client:binder { call transfer };
+#line 9
+# servicemanager performs getpidcon on clients.
+#line 9
+allow servicemanager hal_light_client:dir search;
+#line 9
+allow servicemanager hal_light_client:file { read open };
+#line 9
+allow servicemanager hal_light_client:process getattr;
+#line 9
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+
+allow hal_light_server dumpstate:fifo_file write;
+
+allow hal_light sysfs_leds:lnk_file read;
+allow hal_light sysfs_leds:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_light sysfs_leds:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1 "system/sepolicy/private/hal_lowpan.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_lowpan_client hal_lowpan_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_lowpan_server hal_lowpan_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_lowpan_client hal_lowpan_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_lowpan_server hal_lowpan_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_lowpan_client hal_lowpan_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_lowpan_server hal_lowpan_client:fd use;
+#line 3
+
+
+
+# Allow hal_lowpan_client to be able to find the hal_lowpan_server
+
+#line 7
+ allow hal_lowpan_client hal_lowpan_hwservice:hwservice_manager find;
+#line 7
+
+#line 7
+ allow hal_lowpan_server hal_lowpan_hwservice:hwservice_manager { add find };
+#line 7
+ allow hal_lowpan_server hidl_base_hwservice:hwservice_manager add;
+#line 7
+ neverallow { domain -hal_lowpan_server } hal_lowpan_hwservice:hwservice_manager add;
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+# hal_lowpan domain can write/read to/from lowpan_prop
+
+#line 10
+
+#line 10
+allow hal_lowpan_server property_socket:sock_file write;
+#line 10
+allow hal_lowpan_server init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow hal_lowpan_server lowpan_prop:property_service set;
+#line 10
+
+#line 10
+allow hal_lowpan_server lowpan_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# Allow hal_lowpan_server to open lowpan_devices
+allow hal_lowpan_server lowpan_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+###
+### neverallow rules
+###
+
+# Only LoWPAN HAL may directly access LoWPAN hardware
+neverallow { domain -hal_lowpan_server -init -ueventd } lowpan_device:chr_file ~getattr;
+#line 1 "system/sepolicy/private/hal_macsec.te"
+# Binder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_macsec_client hal_macsec_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_macsec_server hal_macsec_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_macsec_client hal_macsec_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_macsec_server hal_macsec_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_macsec_client hal_macsec_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_macsec_server hal_macsec_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_macsec_client hal_macsec_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_macsec_server hal_macsec_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_macsec_server } hal_macsec_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow hal_macsec_server servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager hal_macsec_server:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager hal_macsec_server:dir search;
+#line 7
+allow servicemanager hal_macsec_server:file { read open };
+#line 7
+allow servicemanager hal_macsec_server:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+#line 1 "system/sepolicy/private/hal_mediaquality.te"
+
+#line 1
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_mediaquality_client hal_mediaquality_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_mediaquality_server hal_mediaquality_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_mediaquality_client hal_mediaquality_server:fd use;
+#line 1
+
+#line 1
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_mediaquality_server hal_mediaquality_client:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_mediaquality_client hal_mediaquality_server:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_mediaquality_server hal_mediaquality_client:fd use;
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ allow hal_mediaquality_client hal_mediaquality_service:service_manager find;
+#line 1
+
+#line 1
+ allow hal_mediaquality_server hal_mediaquality_service:service_manager { add find };
+#line 1
+ neverallow { domain -hal_mediaquality_server } hal_mediaquality_service:service_manager add;
+#line 1
+
+#line 1
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 1
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_mediaquality_server servicemanager:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow servicemanager hal_mediaquality_server:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_mediaquality_server servicemanager:fd use;
+#line 1
+
+#line 1
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_mediaquality_client servicemanager:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow servicemanager hal_mediaquality_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_mediaquality_client servicemanager:fd use;
+#line 1
+
+#line 9
+
+#line 1 "system/sepolicy/private/hal_memtrack.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_memtrack_client hal_memtrack_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_memtrack_server hal_memtrack_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_memtrack_client hal_memtrack_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_memtrack_client hal_memtrack_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_memtrack_server hal_memtrack_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_memtrack_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_memtrack_server } hal_memtrack_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+
+#line 6
+ allow hal_memtrack_client hal_memtrack_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_memtrack_server hal_memtrack_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_memtrack_server } hal_memtrack_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_memtrack_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_memtrack_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_memtrack_server servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_neuralnetworks.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_neuralnetworks_client hal_neuralnetworks_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_neuralnetworks_server hal_neuralnetworks_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_neuralnetworks_client hal_neuralnetworks_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_neuralnetworks_server hal_neuralnetworks_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_neuralnetworks_client hal_neuralnetworks_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_neuralnetworks_server hal_neuralnetworks_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_neuralnetworks_client hal_neuralnetworks_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_neuralnetworks_server hal_neuralnetworks_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_neuralnetworks_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_neuralnetworks_server } hal_neuralnetworks_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_allocator:fd use;
+allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_graphics_allocator:fd use;
+allow hal_neuralnetworks gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_neuralnetworks gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow NN HAL service to use a client-provided fd residing in /data/data/.
+allow hal_neuralnetworks_server app_data_file:file { read write getattr map };
+allow hal_neuralnetworks_server privapp_data_file:file { read write getattr map };
+
+# Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/.
+allow hal_neuralnetworks_server shell_data_file:file { read write getattr map };
+
+# Allow NN HAL service to read a client-provided ION memory fd.
+allow hal_neuralnetworks_server ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow NN HAL service to use a client-provided fd residing in /storage
+allow hal_neuralnetworks_server storage_file:file { getattr map read };
+
+# Allow NN HAL service to read a client-provided fd residing in /data/app/.
+allow hal_neuralnetworks_server apk_data_file:file { getattr map read };
+
+# Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product
+# property to determine whether to deny NNAPI extensions use for apps
+# on product partition (apps in GSI are not allowed to use NNAPI extensions).
+
+#line 32
+allow hal_neuralnetworks_client nnapi_ext_deny_product_prop:file { getattr open read map };
+#line 32
+;
+
+# Allow NN HAL client to read device_config_nnapi_native_prop.
+
+#line 35
+allow hal_neuralnetworks_client device_config_nnapi_native_prop:file { getattr open read map };
+#line 35
+
+
+# This property is only expected to be found in /product/build.prop,
+# allow to be set only by init.
+neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set;
+
+# Define sepolicy for NN AIDL HAL service
+
+#line 42
+ allow hal_neuralnetworks_client hal_neuralnetworks_service:service_manager find;
+#line 42
+
+#line 42
+ allow hal_neuralnetworks_server hal_neuralnetworks_service:service_manager { add find };
+#line 42
+ neverallow { domain -hal_neuralnetworks_server } hal_neuralnetworks_service:service_manager add;
+#line 42
+
+#line 42
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 42
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 42
+
+#line 42
+
+#line 42
+
+#line 42
+
+#line 42
+
+
+#line 43
+# Call the server domain and optionally transfer references to it.
+#line 43
+allow hal_neuralnetworks_server servicemanager:binder { call transfer };
+#line 43
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 43
+allow servicemanager hal_neuralnetworks_server:binder transfer;
+#line 43
+# Receive and use open files from the server.
+#line 43
+allow hal_neuralnetworks_server servicemanager:fd use;
+#line 43
+
+
+
+#line 45
+# Call the servicemanager and transfer references to it.
+#line 45
+allow hal_neuralnetworks_server servicemanager:binder { call transfer };
+#line 45
+# Allow servicemanager to send out callbacks
+#line 45
+allow servicemanager hal_neuralnetworks_server:binder { call transfer };
+#line 45
+# servicemanager performs getpidcon on clients.
+#line 45
+allow servicemanager hal_neuralnetworks_server:dir search;
+#line 45
+allow servicemanager hal_neuralnetworks_server:file { read open };
+#line 45
+allow servicemanager hal_neuralnetworks_server:process getattr;
+#line 45
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 45
+# all domains in domain.te.
+#line 45
+
+
+allow hal_neuralnetworks_server dumpstate:fifo_file write;
+#line 1 "system/sepolicy/private/hal_neverallows.te"
+# only HALs responsible for network hardware should have privileged
+# network capabilities
+neverallow {
+ halserverdomain
+ -hal_bluetooth_server
+ -hal_can_controller_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_uwb_server
+ # TODO(b/196225233): Remove hal_uwb_vendor_server
+ -hal_uwb_vendor_server
+ -hal_nlinterceptor_server
+ -hal_tv_tuner_server
+} self:{ capability cap_userns } { net_admin net_raw };
+
+# Unless a HAL's job is to communicate over the network, or control network
+# hardware, it should not be using network sockets.
+# NOTE: HALs for automotive devices have an exemption from this rule because in
+# a car it is common to have external modules and HALs need to communicate to
+# those modules using network. Using this exemption for non-automotive builds
+# will result in CTS failure.
+neverallow {
+ halserverdomain
+ -hal_automotive_socket_exemption
+ -hal_can_controller_server
+ -hal_tetheroffload_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_uwb_server
+ # TODO(b/196225233): Remove hal_uwb_vendor_server
+ -hal_uwb_vendor_server
+ -hal_nlinterceptor_server
+ -hal_bluetooth_server
+ -hal_tv_tuner_server
+} domain:{ udp_socket rawip_socket } *;
+
+neverallow {
+ halserverdomain
+ -hal_automotive_socket_exemption
+ -hal_can_controller_server
+ -hal_tetheroffload_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_nlinterceptor_server
+ -hal_bluetooth_server
+ -hal_tv_tuner_server
+} {
+ domain
+
+}:tcp_socket *;
+
+# The UWB HAL is not actually a networking HAL but may need to bring up and down
+# interfaces. Restrict it to only these networking operations.
+neverallow hal_uwb_vendor_server self:{ capability cap_userns } { net_raw };
+
+# Subset of socket_class_set likely to be usable for communication or accessible through net_admin.
+# udp_socket is required to use interface ioctls.
+neverallow hal_uwb_vendor_server domain:{ socket rawip_socket netlink_socket packet_socket key_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket qipcrtr_socket xdp_socket } *;
+
+###
+# HALs are defined as an attribute and so a given domain could hypothetically
+# have multiple HALs in it (or even all of them) with the subsequent policy of
+# the domain comprised of the union of all the HALs.
+#
+# This is a problem because
+# 1) Security sensitive components should only be accessed by specific HALs.
+# 2) hwbinder_call and the restrictions it provides cannot be reasoned about in
+# the platform.
+# 3) The platform cannot reason about defense in depth if there are
+# monolithic domains etc.
+#
+# As an example, hal_keymaster and hal_gatekeeper can access the TEE and while
+# its OK for them to share a process its not OK with them to share processes
+# with other hals.
+#
+# The following neverallow rules, in conjuntion with CTS tests, assert that
+# these security principles are adhered to.
+#
+# Do not allow a hal to exec another process without a domain transition.
+# TODO remove exemptions.
+neverallow {
+ halserverdomain
+ -hal_dumpstate_server
+ -hal_telephony_server
+} {
+ file_type
+ fs_type
+ # May invoke shell commands via /system/bin/sh
+ -shell_exec
+ -toolbox_exec
+}:file execute_no_trans;
+# Do not allow a process other than init to transition into a HAL domain.
+neverallow { domain -init } halserverdomain:process transition;
+# Only allow transitioning to a domain by running its executable. Do not
+# allow transitioning into a HAL domain by use of seclabel in an
+# init.*.rc script.
+neverallow * halserverdomain:process dyntransition;
+#line 1 "system/sepolicy/private/hal_nfc.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_nfc_client hal_nfc_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_nfc_server hal_nfc_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_nfc_client hal_nfc_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_nfc_server hal_nfc_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_nfc_client hal_nfc_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_nfc_server hal_nfc_client:fd use;
+#line 3
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_nfc_server servicemanager:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow servicemanager hal_nfc_server:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_nfc_server servicemanager:fd use;
+#line 4
+
+
+
+#line 6
+ allow hal_nfc_client hal_nfc_hwservice:hwservice_manager find;
+#line 6
+
+#line 6
+ allow hal_nfc_server hal_nfc_hwservice:hwservice_manager { add find };
+#line 6
+ allow hal_nfc_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hal_nfc_server } hal_nfc_hwservice:hwservice_manager add;
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+ allow hal_nfc_client hal_nfc_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_nfc_server hal_nfc_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_nfc_server } hal_nfc_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+
+# Set NFC properties (used by bcm2079x HAL).
+
+#line 10
+
+#line 10
+allow hal_nfc property_socket:sock_file write;
+#line 10
+allow hal_nfc init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow hal_nfc nfc_prop:property_service set;
+#line 10
+
+#line 10
+allow hal_nfc nfc_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# NFC device access.
+allow hal_nfc nfc_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/hal_nlinterceptor.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_nlinterceptor_client hal_nlinterceptor_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_nlinterceptor_server hal_nlinterceptor_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_nlinterceptor_client hal_nlinterceptor_server:fd use;
+#line 1
+
+
+
+#line 3
+ allow hal_nlinterceptor_client hal_nlinterceptor_service:service_manager find;
+#line 3
+
+#line 3
+ allow hal_nlinterceptor_server hal_nlinterceptor_service:service_manager { add find };
+#line 3
+ neverallow { domain -hal_nlinterceptor_server } hal_nlinterceptor_service:service_manager add;
+#line 3
+
+#line 3
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 3
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+#line 3
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_nlinterceptor servicemanager:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow servicemanager hal_nlinterceptor:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_nlinterceptor servicemanager:fd use;
+#line 4
+
+
+allow hal_nlinterceptor self:{ capability cap_userns } net_admin;
+allow hal_nlinterceptor self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_nlinterceptor self:netlink_route_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_readpriv nlmsg_write };
+#line 1 "system/sepolicy/private/hal_oemlock.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_oemlock_client hal_oemlock_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_oemlock_server hal_oemlock_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_oemlock_client hal_oemlock_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_oemlock_client hal_oemlock_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_oemlock_server hal_oemlock_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_oemlock_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_oemlock_server } hal_oemlock_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_oemlock_client hal_oemlock_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_oemlock_server hal_oemlock_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_oemlock_server } hal_oemlock_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_oemlock_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_oemlock_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_oemlock_server servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_omx.te"
+# applies all permissions to hal_omx NOT hal_omx_server
+# since OMX must always be in its own process.
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_omx_server binderservicedomain:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow binderservicedomain hal_omx_server:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_omx_server binderservicedomain:fd use;
+#line 4
+
+
+#line 5
+# Call the server domain and optionally transfer references to it.
+#line 5
+allow hal_omx_server { appdomain -isolated_app }:binder { call transfer };
+#line 5
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 5
+allow { appdomain -isolated_app } hal_omx_server:binder transfer;
+#line 5
+# Receive and use open files from the server.
+#line 5
+allow hal_omx_server { appdomain -isolated_app }:fd use;
+#line 5
+
+
+# Allow hal_omx_server access to composer sync fences
+allow hal_omx_server hal_graphics_composer:fd use;
+
+allow hal_omx_server ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_omx_server hal_camera:fd use;
+
+
+#line 13
+
+#line 13
+allow hal_omx_server anr_data_file:file append;
+#line 13
+allow hal_omx_server dumpstate:fd use;
+#line 13
+allow hal_omx_server incidentd:fd use;
+#line 13
+# TODO: Figure out why write is needed.
+#line 13
+allow hal_omx_server dumpstate:fifo_file { append write };
+#line 13
+allow hal_omx_server incidentd:fifo_file { append write };
+#line 13
+allow hal_omx_server system_server:fifo_file { append write };
+#line 13
+allow hal_omx_server tombstoned:unix_stream_socket connectto;
+#line 13
+allow hal_omx_server tombstoned:fd use;
+#line 13
+allow hal_omx_server tombstoned_crash_socket:sock_file write;
+#line 13
+allow hal_omx_server tombstone_data_file:file append;
+#line 13
+
+
+# Recieve gralloc buffer FDs from bufferhubd. Note that hal_omx_server never
+# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge
+# between those two: it talks to hal_omx_server via Binder and talks to bufferhubd
+# via PDX. Thus, there is no need to use pdx_client macro.
+allow hal_omx_server bufferhubd:fd use;
+
+
+#line 21
+ allow hal_omx_client hal_omx_hwservice:hwservice_manager find;
+#line 21
+
+#line 21
+ allow hal_omx_server hal_omx_hwservice:hwservice_manager { add find };
+#line 21
+ allow hal_omx_server hidl_base_hwservice:hwservice_manager add;
+#line 21
+ neverallow { domain -hal_omx_server } hal_omx_hwservice:hwservice_manager add;
+#line 21
+
+#line 21
+
+#line 21
+
+#line 21
+
+
+allow hal_omx_client hidl_token_hwservice:hwservice_manager find;
+
+
+#line 25
+allow hal_omx_client media_variant_prop:file { getattr open read map };
+#line 25
+
+
+#line 26
+allow hal_omx_server media_variant_prop:file { getattr open read map };
+#line 26
+
+
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow hal_omx_client hal_omx_server:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow hal_omx_server hal_omx_client:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow hal_omx_client hal_omx_server:fd use;
+#line 28
+
+
+#line 29
+# Call the server domain and optionally transfer references to it.
+#line 29
+allow hal_omx_server hal_omx_client:binder { call transfer };
+#line 29
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 29
+allow hal_omx_client hal_omx_server:binder transfer;
+#line 29
+# Receive and use open files from the server.
+#line 29
+allow hal_omx_server hal_omx_client:fd use;
+#line 29
+
+
+###
+### neverallow rules
+###
+
+# hal_omx_server should never execute any executable without a
+# domain transition
+neverallow hal_omx_server { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow hal_omx_server domain:{ udp_socket rawip_socket } *;
+neverallow hal_omx_server { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/hal_power.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_power_client hal_power_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_power_server hal_power_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_power_client hal_power_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_power_server hal_power_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_power_client hal_power_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_power_server hal_power_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_power_client hal_power_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_power_server hal_power_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_power_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_power_server } hal_power_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_power_client hal_power_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_power_server hal_power_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_power_server } hal_power_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_power_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_power_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_power_server servicemanager:fd use;
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow hal_power_client servicemanager:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow servicemanager hal_power_client:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow hal_power_client servicemanager:fd use;
+#line 9
+
+
+# power HAL sets dex2oat performance tuning properties
+
+#line 12
+
+#line 12
+allow hal_power_server property_socket:sock_file write;
+#line 12
+allow hal_power_server init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow hal_power_server dalvik_dynamic_config_prop:property_service set;
+#line 12
+
+#line 12
+allow hal_power_server dalvik_dynamic_config_prop:file { getattr open read map };
+#line 12
+
+#line 12
+
+#line 1 "system/sepolicy/private/hal_power_stats.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_power_stats_client hal_power_stats_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_power_stats_server hal_power_stats_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_power_stats_client hal_power_stats_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_power_stats_server hal_power_stats_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_power_stats_client hal_power_stats_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_power_stats_server hal_power_stats_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_power_stats_client hal_power_stats_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_power_stats_server hal_power_stats_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_power_stats_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_power_stats_server } hal_power_stats_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_power_stats_client hal_power_stats_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_power_stats_server hal_power_stats_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_power_stats_server } hal_power_stats_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_power_stats_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_power_stats_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_power_stats_server servicemanager:fd use;
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow hal_power_stats_client servicemanager:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow servicemanager hal_power_stats_client:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow hal_power_stats_client servicemanager:fd use;
+#line 9
+
+#line 1 "system/sepolicy/private/hal_rebootescrow.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_rebootescrow_client hal_rebootescrow_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_rebootescrow_server hal_rebootescrow_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_rebootescrow_client hal_rebootescrow_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_rebootescrow_client hal_rebootescrow_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_rebootescrow_server hal_rebootescrow_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_rebootescrow_server } hal_rebootescrow_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow hal_rebootescrow_server servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager hal_rebootescrow_server:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager hal_rebootescrow_server:dir search;
+#line 6
+allow servicemanager hal_rebootescrow_server:file { read open };
+#line 6
+allow servicemanager hal_rebootescrow_server:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+#line 1 "system/sepolicy/private/hal_remoteaccess.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_remoteaccess_client hal_remoteaccess_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_remoteaccess_server hal_remoteaccess_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_remoteaccess_client hal_remoteaccess_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_remoteaccess_server hal_remoteaccess_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_remoteaccess_client hal_remoteaccess_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_remoteaccess_server hal_remoteaccess_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_remoteaccess_client hal_remoteaccess_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_remoteaccess_server hal_remoteaccess_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_remoteaccess_server } hal_remoteaccess_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 1 "system/sepolicy/private/hal_remotelyprovisionedcomponent_avf.te"
+# allow binder connection from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_remotelyprovisionedcomponent_avf_server hal_remotelyprovisionedcomponent_avf_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_server:fd use;
+#line 2
+
+
+# allow client to find the service, allow server to register the service
+
+#line 5
+ allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_remotelyprovisionedcomponent_avf_server hal_remotelyprovisionedcomponent_avf_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_remotelyprovisionedcomponent_avf_server } hal_remotelyprovisionedcomponent_avf_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+# allow binder communication from server to service_manager
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_remotelyprovisionedcomponent_avf_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_remotelyprovisionedcomponent_avf_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_remotelyprovisionedcomponent_avf_server:dir search;
+#line 8
+allow servicemanager hal_remotelyprovisionedcomponent_avf_server:file { read open };
+#line 8
+allow servicemanager hal_remotelyprovisionedcomponent_avf_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+#line 1 "system/sepolicy/private/hal_secretkeeper.te"
+# Domains for the Secretkeeper HAL, which provides secure (tamper evident, rollback protected)
+# storage of secrets guarded by DICE policies.
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_secretkeeper_client hal_secretkeeper_server:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_secretkeeper_server hal_secretkeeper_client:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_secretkeeper_client hal_secretkeeper_server:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_secretkeeper_client hal_secretkeeper_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_secretkeeper_server hal_secretkeeper_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_secretkeeper_server } hal_secretkeeper_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow hal_secretkeeper_server servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager hal_secretkeeper_server:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager hal_secretkeeper_server:dir search;
+#line 7
+allow servicemanager hal_secretkeeper_server:file { read open };
+#line 7
+allow servicemanager hal_secretkeeper_server:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_secretkeeper_client servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_secretkeeper_client:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_secretkeeper_client:dir search;
+#line 8
+allow servicemanager hal_secretkeeper_client:file { read open };
+#line 8
+allow servicemanager hal_secretkeeper_client:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+# The Secretkeeper HAL service needs to communicate with a trusted application running
+# in the TEE, which is represented by the tee_device permission.
+allow hal_secretkeeper_server tee_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/hal_secure_element.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_secure_element_client hal_secure_element_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_secure_element_server hal_secure_element_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_secure_element_client hal_secure_element_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_secure_element_server hal_secure_element_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_secure_element_client hal_secure_element_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_secure_element_server hal_secure_element_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_secure_element_client hal_secure_element_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_secure_element_server hal_secure_element_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_secure_element_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_secure_element_server } hal_secure_element_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_secure_element_client hal_secure_element_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_secure_element_server hal_secure_element_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_secure_element_server } hal_secure_element_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_secure_element_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_secure_element_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_secure_element_server:dir search;
+#line 8
+allow servicemanager hal_secure_element_server:file { read open };
+#line 8
+allow servicemanager hal_secure_element_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+allow hal_secure_element_client hal_secure_element_service:service_manager find;
+#line 1 "system/sepolicy/private/hal_sensors.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_sensors_client hal_sensors_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_sensors_server hal_sensors_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_sensors_client hal_sensors_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_sensors_client hal_sensors_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_sensors_server hal_sensors_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_sensors_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_sensors_server } hal_sensors_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+# Allow sensor hals to access ashmem memory allocated by apps
+allow hal_sensors { appdomain -isolated_app }:fd use;
+
+# Allow sensor hals to access ashmem memory allocated by android.hidl.allocator
+# fd is passed in from framework sensorservice HAL.
+allow hal_sensors hal_allocator:fd use;
+
+# allow to run with real-time scheduling policy
+allow hal_sensors self:{ capability cap_userns } sys_nice;
+
+
+#line 16
+ allow hal_sensors_server hal_sensors_service:service_manager { add find };
+#line 16
+ neverallow { domain -hal_sensors_server } hal_sensors_service:service_manager add;
+#line 16
+
+#line 16
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 16
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 16
+
+#line 16
+
+
+#line 17
+# Call the server domain and optionally transfer references to it.
+#line 17
+allow hal_sensors_server servicemanager:binder { call transfer };
+#line 17
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 17
+allow servicemanager hal_sensors_server:binder transfer;
+#line 17
+# Receive and use open files from the server.
+#line 17
+allow hal_sensors_server servicemanager:fd use;
+#line 17
+
+
+allow hal_sensors_client hal_sensors_service:service_manager find;
+#line 1 "system/sepolicy/private/hal_telephony.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_telephony_client hal_telephony_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_telephony_server hal_telephony_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_telephony_client hal_telephony_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_telephony_server hal_telephony_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_telephony_client hal_telephony_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_telephony_server hal_telephony_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_telephony_client hal_telephony_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_telephony_server hal_telephony_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_telephony_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_telephony_server } hal_telephony_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_telephony_client hal_radio_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_telephony_server hal_radio_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_telephony_server } hal_radio_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+allowxperm hal_telephony_server self:udp_socket ioctl
+#line 8
+{
+#line 8
+# qualcomm rmnet ioctls
+#line 8
+0x00006900 0x00006902
+#line 8
+# socket ioctls
+#line 8
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 8
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 8
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 8
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 8
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 8
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 8
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 8
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 8
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 8
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 8
+# device and protocol specific ioctls
+#line 8
+0x000089f0-0x000089ff
+#line 8
+0x000089e0-0x000089ef
+#line 8
+# Wireless extension ioctls
+#line 8
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 8
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 8
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 8
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 8
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 8
+0x00008b34 0x00008b35 0x00008b36
+#line 8
+# Dev private ioctl i.e. hardware specific ioctls
+#line 8
+0x00008be0-0x00008bff
+#line 8
+};
+
+allow hal_telephony_server self:netlink_route_socket nlmsg_write;
+allow hal_telephony_server self:{ capability cap_userns } { setpcap setgid setuid net_admin net_raw };
+allow hal_telephony_server cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow hal_telephony_server cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+allow hal_telephony_server cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow hal_telephony_server cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+allow hal_telephony_server radio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_telephony_server radio_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+allow hal_telephony_server efs_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow hal_telephony_server efs_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow hal_telephony_server vendor_shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow hal_telephony_server bluetooth_efs_file:file { getattr open read ioctl lock map watch watch_reads };
+allow hal_telephony_server bluetooth_efs_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# property service
+
+#line 25
+allow hal_telephony_server telephony_config_prop:file { getattr open read map };
+#line 25
+
+
+#line 26
+
+#line 26
+allow hal_telephony_server property_socket:sock_file write;
+#line 26
+allow hal_telephony_server init:unix_stream_socket connectto;
+#line 26
+
+#line 26
+allow hal_telephony_server radio_control_prop:property_service set;
+#line 26
+
+#line 26
+allow hal_telephony_server radio_control_prop:file { getattr open read map };
+#line 26
+
+#line 26
+
+
+#line 27
+
+#line 27
+allow hal_telephony_server property_socket:sock_file write;
+#line 27
+allow hal_telephony_server init:unix_stream_socket connectto;
+#line 27
+
+#line 27
+allow hal_telephony_server radio_prop:property_service set;
+#line 27
+
+#line 27
+allow hal_telephony_server radio_prop:file { getattr open read map };
+#line 27
+
+#line 27
+
+
+#line 28
+
+#line 28
+allow hal_telephony_server property_socket:sock_file write;
+#line 28
+allow hal_telephony_server init:unix_stream_socket connectto;
+#line 28
+
+#line 28
+allow hal_telephony_server telephony_status_prop:property_service set;
+#line 28
+
+#line 28
+allow hal_telephony_server telephony_status_prop:file { getattr open read map };
+#line 28
+
+#line 28
+
+
+allow hal_telephony_server tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow hal_telephony_server to create and use netlink sockets.
+allow hal_telephony_server self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_telephony_server self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_telephony_server self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Access to wake locks
+
+#line 38
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 38
+# deprecated.
+#line 38
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 38
+allow hal_telephony_server sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 38
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 38
+allow hal_telephony_server self:{ capability2 cap2_userns } block_suspend;
+#line 38
+# system_suspend permissions
+#line 38
+
+#line 38
+# Call the server domain and optionally transfer references to it.
+#line 38
+allow hal_telephony_server system_suspend_server:binder { call transfer };
+#line 38
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 38
+allow system_suspend_server hal_telephony_server:binder transfer;
+#line 38
+# Receive and use open files from the server.
+#line 38
+allow hal_telephony_server system_suspend_server:fd use;
+#line 38
+
+#line 38
+allow hal_telephony_server system_suspend_hwservice:hwservice_manager find;
+#line 38
+# halclientdomain permissions
+#line 38
+
+#line 38
+# Call the hwservicemanager and transfer references to it.
+#line 38
+allow hal_telephony_server hwservicemanager:binder { call transfer };
+#line 38
+# Allow hwservicemanager to send out callbacks
+#line 38
+allow hwservicemanager hal_telephony_server:binder { call transfer };
+#line 38
+# hwservicemanager performs getpidcon on clients.
+#line 38
+allow hwservicemanager hal_telephony_server:dir search;
+#line 38
+allow hwservicemanager hal_telephony_server:file { read open map };
+#line 38
+allow hwservicemanager hal_telephony_server:process getattr;
+#line 38
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 38
+# all domains in domain.te.
+#line 38
+
+#line 38
+
+#line 38
+allow hal_telephony_server hwservicemanager_prop:file { getattr open read map };
+#line 38
+
+#line 38
+allow hal_telephony_server hidl_manager_hwservice:hwservice_manager find;
+#line 38
+# AIDL suspend hal permissions
+#line 38
+allow hal_telephony_server hal_system_suspend_service:service_manager find;
+#line 38
+
+#line 38
+# Call the servicemanager and transfer references to it.
+#line 38
+allow hal_telephony_server servicemanager:binder { call transfer };
+#line 38
+# Allow servicemanager to send out callbacks
+#line 38
+allow servicemanager hal_telephony_server:binder { call transfer };
+#line 38
+# servicemanager performs getpidcon on clients.
+#line 38
+allow servicemanager hal_telephony_server:dir search;
+#line 38
+allow servicemanager hal_telephony_server:file { read open };
+#line 38
+allow servicemanager hal_telephony_server:process getattr;
+#line 38
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 38
+# all domains in domain.te.
+#line 38
+
+#line 38
+
+
+
+#line 40
+allow hal_telephony_server proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 40
+allow hal_telephony_server proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 40
+
+
+#line 41
+allow hal_telephony_server sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow hal_telephony_server sysfs_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 41
+
+
+# granting the ioctl permission for hal_telephony_server should be device specific
+allow hal_telephony_server self:socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Allow AIDL HAL shim to call HIDL HAL implementation
+
+#line 47
+# Call the server domain and optionally transfer references to it.
+#line 47
+allow hal_telephony_server hal_telephony_server:binder { call transfer };
+#line 47
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 47
+allow hal_telephony_server hal_telephony_server:binder transfer;
+#line 47
+# Receive and use open files from the server.
+#line 47
+allow hal_telephony_server hal_telephony_server:fd use;
+#line 47
+
+#line 1 "system/sepolicy/private/hal_tetheroffload.te"
+## HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tetheroffload_client hal_tetheroffload_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tetheroffload_server hal_tetheroffload_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tetheroffload_client hal_tetheroffload_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tetheroffload_server hal_tetheroffload_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tetheroffload_client hal_tetheroffload_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tetheroffload_server hal_tetheroffload_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_tetheroffload_client hal_tetheroffload_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_tetheroffload_server hal_tetheroffload_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_tetheroffload_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_tetheroffload_server } hal_tetheroffload_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_tetheroffload_client hal_tetheroffload_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_tetheroffload_server hal_tetheroffload_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_tetheroffload_server } hal_tetheroffload_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_tetheroffload_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_tetheroffload_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_tetheroffload_server:dir search;
+#line 8
+allow servicemanager hal_tetheroffload_server:file { read open };
+#line 8
+allow servicemanager hal_tetheroffload_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+# allow the client to pass the server already open netlink sockets
+allow hal_tetheroffload_server hal_tetheroffload_client:netlink_netfilter_socket { getattr read setopt write };
+#line 1 "system/sepolicy/private/hal_thermal.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_thermal_client hal_thermal_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_thermal_server hal_thermal_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_thermal_client hal_thermal_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_thermal_server hal_thermal_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_thermal_client hal_thermal_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_thermal_server hal_thermal_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_thermal_client hal_thermal_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_thermal_server hal_thermal_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_thermal_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_thermal_server } hal_thermal_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_thermal_client hal_thermal_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_thermal_server hal_thermal_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_thermal_server } hal_thermal_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+ allow hal_thermal_server hal_thermal_service:service_manager { add find };
+#line 8
+ neverallow { domain -hal_thermal_server } hal_thermal_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow hal_thermal_server servicemanager:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow servicemanager hal_thermal_server:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow hal_thermal_server servicemanager:fd use;
+#line 9
+
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow hal_thermal_client servicemanager:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow servicemanager hal_thermal_client:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow hal_thermal_client servicemanager:fd use;
+#line 10
+
+#line 1 "system/sepolicy/private/hal_threadnetwork.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_threadnetwork_client hal_threadnetwork_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_threadnetwork_server hal_threadnetwork_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_threadnetwork_client hal_threadnetwork_server:fd use;
+#line 1
+
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_threadnetwork_server hal_threadnetwork_client:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_threadnetwork_client hal_threadnetwork_server:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_threadnetwork_server hal_threadnetwork_client:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_threadnetwork_client hal_threadnetwork_service:service_manager find;
+#line 4
+
+#line 4
+ allow hal_threadnetwork_server hal_threadnetwork_service:service_manager { add find };
+#line 4
+ neverallow { domain -hal_threadnetwork_server } hal_threadnetwork_service:service_manager add;
+#line 4
+
+#line 4
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 4
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_threadnetwork_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_threadnetwork_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_threadnetwork_server servicemanager:fd use;
+#line 6
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_threadnetwork_client servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_threadnetwork_client:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_threadnetwork_client servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_tv_cec.te"
+# HwBinder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_cec_client hal_tv_cec_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_cec_server hal_tv_cec_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_cec_client hal_tv_cec_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tv_cec_server hal_tv_cec_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tv_cec_client hal_tv_cec_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tv_cec_server hal_tv_cec_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_tv_cec_client hal_tv_cec_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_tv_cec_server hal_tv_cec_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_tv_cec_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_tv_cec_server } hal_tv_cec_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 1 "system/sepolicy/private/hal_tv_hdmi_cec.te"
+# Binder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client:fd use;
+#line 3
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow hal_tv_hdmi_cec_client servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager hal_tv_hdmi_cec_client:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager hal_tv_hdmi_cec_client:dir search;
+#line 4
+allow servicemanager hal_tv_hdmi_cec_client:file { read open };
+#line 4
+allow servicemanager hal_tv_hdmi_cec_client:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow hal_tv_hdmi_cec_server servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager hal_tv_hdmi_cec_server:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager hal_tv_hdmi_cec_server:dir search;
+#line 5
+allow servicemanager hal_tv_hdmi_cec_server:file { read open };
+#line 5
+allow servicemanager hal_tv_hdmi_cec_server:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+
+#line 7
+ allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_tv_hdmi_cec_server } hal_tv_hdmi_cec_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/hal_tv_hdmi_connection.te"
+# Binder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client:fd use;
+#line 3
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow hal_tv_hdmi_connection_client servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager hal_tv_hdmi_connection_client:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager hal_tv_hdmi_connection_client:dir search;
+#line 4
+allow servicemanager hal_tv_hdmi_connection_client:file { read open };
+#line 4
+allow servicemanager hal_tv_hdmi_connection_client:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow hal_tv_hdmi_connection_server servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager hal_tv_hdmi_connection_server:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager hal_tv_hdmi_connection_server:dir search;
+#line 5
+allow servicemanager hal_tv_hdmi_connection_server:file { read open };
+#line 5
+allow servicemanager hal_tv_hdmi_connection_server:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+
+#line 7
+ allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_tv_hdmi_connection_server } hal_tv_hdmi_connection_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/hal_tv_hdmi_earc.te"
+# Binder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client:fd use;
+#line 3
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow hal_tv_hdmi_earc_client servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager hal_tv_hdmi_earc_client:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager hal_tv_hdmi_earc_client:dir search;
+#line 4
+allow servicemanager hal_tv_hdmi_earc_client:file { read open };
+#line 4
+allow servicemanager hal_tv_hdmi_earc_client:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow hal_tv_hdmi_earc_server servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager hal_tv_hdmi_earc_server:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager hal_tv_hdmi_earc_server:dir search;
+#line 5
+allow servicemanager hal_tv_hdmi_earc_server:file { read open };
+#line 5
+allow servicemanager hal_tv_hdmi_earc_server:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+
+#line 7
+ allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_tv_hdmi_earc_server } hal_tv_hdmi_earc_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/hal_tv_input.te"
+# HwBinder IPC from clients into server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_input_client hal_tv_input_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_input_server hal_tv_input_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_input_client hal_tv_input_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_tv_input_server hal_tv_input_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_tv_input_client hal_tv_input_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_tv_input_server hal_tv_input_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_tv_input_client hal_tv_input_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_tv_input_server hal_tv_input_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_tv_input_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_tv_input_server } hal_tv_input_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_tv_input_client hal_tv_input_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_tv_input_server hal_tv_input_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_tv_input_server } hal_tv_input_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_tv_input_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_tv_input_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_tv_input_server servicemanager:fd use;
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow hal_tv_input_client servicemanager:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow servicemanager hal_tv_input_client:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow hal_tv_input_client servicemanager:fd use;
+#line 9
+
+#line 1 "system/sepolicy/private/hal_tv_tuner.te"
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow hal_tv_tuner_client hal_tv_tuner_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow hal_tv_tuner_server hal_tv_tuner_client:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow hal_tv_tuner_client hal_tv_tuner_server:fd use;
+#line 1
+
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_tv_tuner_server hal_tv_tuner_client:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_tv_tuner_client hal_tv_tuner_server:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_tv_tuner_server hal_tv_tuner_client:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_tv_tuner_client hal_tv_tuner_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_tv_tuner_server hal_tv_tuner_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_tv_tuner_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_tv_tuner_server } hal_tv_tuner_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_tv_tuner_client hal_tv_tuner_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_tv_tuner_server hal_tv_tuner_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_tv_tuner_server } hal_tv_tuner_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_tv_tuner_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_tv_tuner_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_tv_tuner_server servicemanager:fd use;
+#line 7
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_tv_tuner_client servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_tv_tuner_client:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_tv_tuner_client servicemanager:fd use;
+#line 8
+
+#line 1 "system/sepolicy/private/hal_usb.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_usb_client hal_usb_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_usb_server hal_usb_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_usb_client hal_usb_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_usb_server hal_usb_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_usb_client hal_usb_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_usb_server hal_usb_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_usb_client hal_usb_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_usb_server hal_usb_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_usb_server } hal_usb_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_usb_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_usb_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_usb_server servicemanager:fd use;
+#line 6
+
+
+
+#line 8
+ allow hal_usb_client hal_usb_hwservice:hwservice_manager find;
+#line 8
+
+#line 8
+ allow hal_usb_server hal_usb_hwservice:hwservice_manager { add find };
+#line 8
+ allow hal_usb_server hidl_base_hwservice:hwservice_manager add;
+#line 8
+ neverallow { domain -hal_usb_server } hal_usb_hwservice:hwservice_manager add;
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+allow hal_usb self:netlink_kobject_uevent_socket create;
+allow hal_usb self:netlink_kobject_uevent_socket setopt;
+allow hal_usb self:netlink_kobject_uevent_socket getopt;
+allow hal_usb self:netlink_kobject_uevent_socket bind;
+allow hal_usb self:netlink_kobject_uevent_socket read;
+allow hal_usb sysfs:dir open;
+allow hal_usb sysfs:dir read;
+allow hal_usb sysfs:file read;
+allow hal_usb sysfs:file open;
+allow hal_usb sysfs:file write;
+allow hal_usb sysfs:file getattr;
+
+#line 1 "system/sepolicy/private/hal_usb_gadget.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_usb_gadget_client hal_usb_gadget_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_usb_gadget_server hal_usb_gadget_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_usb_gadget_client hal_usb_gadget_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_usb_gadget_server hal_usb_gadget_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_usb_gadget_client hal_usb_gadget_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_usb_gadget_server hal_usb_gadget_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_usb_gadget_client hal_usb_gadget_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_usb_gadget_server hal_usb_gadget_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_usb_gadget_server } hal_usb_gadget_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+# Call the server domain and optionally transfer references to it.
+#line 6
+allow hal_usb_gadget_server servicemanager:binder { call transfer };
+#line 6
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 6
+allow servicemanager hal_usb_gadget_server:binder transfer;
+#line 6
+# Receive and use open files from the server.
+#line 6
+allow hal_usb_gadget_server servicemanager:fd use;
+#line 6
+
+
+
+#line 8
+ allow hal_usb_gadget_client hal_usb_gadget_hwservice:hwservice_manager find;
+#line 8
+
+#line 8
+ allow hal_usb_gadget_server hal_usb_gadget_hwservice:hwservice_manager { add find };
+#line 8
+ allow hal_usb_gadget_server hidl_base_hwservice:hwservice_manager add;
+#line 8
+ neverallow { domain -hal_usb_gadget_server } hal_usb_gadget_hwservice:hwservice_manager add;
+#line 8
+
+#line 8
+
+#line 8
+
+#line 8
+
+
+# Configuring usb gadget functions
+allow hal_usb_gadget_server configfs:lnk_file { read create unlink};
+allow hal_usb_gadget_server configfs:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow hal_usb_gadget_server configfs:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow hal_usb_gadget_server functionfs:dir { read search };
+allow hal_usb_gadget_server functionfs:file read;
+allow hal_usb_gadget_server proc_interrupts:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read access to ro.usb.uvc.enabled
+
+#line 19
+allow hal_usb_gadget_server usb_uvc_enabled_prop:file { getattr open read map };
+#line 19
+
+#line 1 "system/sepolicy/private/hal_uwb.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_uwb_client hal_uwb_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_uwb_server hal_uwb_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_uwb_client hal_uwb_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_uwb_server hal_uwb_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_uwb_client hal_uwb_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_uwb_server hal_uwb_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_uwb_client hal_uwb_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_uwb_server hal_uwb_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_uwb_server } hal_uwb_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_uwb_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_uwb_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_uwb_server servicemanager:fd use;
+#line 7
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_uwb_client servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_uwb_client:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_uwb_client servicemanager:fd use;
+#line 8
+
+#line 1 "system/sepolicy/private/hal_vehicle.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_vehicle_client hal_vehicle_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_vehicle_server hal_vehicle_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_vehicle_client hal_vehicle_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_vehicle_server hal_vehicle_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_vehicle_client hal_vehicle_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_vehicle_server hal_vehicle_client:fd use;
+#line 3
+
+
+
+
+#line 6
+ allow hal_vehicle_client hal_vehicle_hwservice:hwservice_manager find;
+#line 6
+
+#line 6
+ allow hal_vehicle_server hal_vehicle_hwservice:hwservice_manager { add find };
+#line 6
+ allow hal_vehicle_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hal_vehicle_server } hal_vehicle_hwservice:hwservice_manager add;
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+#line 7
+ allow hal_vehicle_client hal_vehicle_service:service_manager find;
+#line 7
+
+#line 7
+ allow hal_vehicle_server hal_vehicle_service:service_manager { add find };
+#line 7
+ neverallow { domain -hal_vehicle_server } hal_vehicle_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/hal_vibrator.te"
+# HwBinder IPC client/server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_vibrator_client hal_vibrator_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_vibrator_server hal_vibrator_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_vibrator_client hal_vibrator_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_vibrator_server hal_vibrator_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_vibrator_client hal_vibrator_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_vibrator_server hal_vibrator_client:fd use;
+#line 3
+;
+
+
+#line 5
+ allow hal_vibrator_client hal_vibrator_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_vibrator_server hal_vibrator_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_vibrator_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_vibrator_server } hal_vibrator_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_vibrator_client hal_vibrator_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_vibrator_server hal_vibrator_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_vibrator_server } hal_vibrator_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow hal_vibrator_server servicemanager:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow servicemanager hal_vibrator_server:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow hal_vibrator_server servicemanager:fd use;
+#line 8
+
+
+allow hal_vibrator_server dumpstate:fifo_file write;
+
+# vibrator sysfs rw access
+allow hal_vibrator sysfs_vibrator:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow hal_vibrator sysfs_vibrator:dir search;
+
+# Allow HAL vibrator to control some parameters of a vibration, such as scaling.
+allow hal_vibrator fwk_vibrator_control_service:service_manager find;
+#line 1 "system/sepolicy/private/hal_vm_capabilities.te"
+# Domain for the VM capability HAL, which is used to allow some pVMs to issue
+# vendor-specific SMCs.
+
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow hal_vm_capabilities_client hal_vm_capabilities_server:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow hal_vm_capabilities_server hal_vm_capabilities_client:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow hal_vm_capabilities_client hal_vm_capabilities_server:fd use;
+#line 4
+
+
+
+#line 6
+ allow hal_vm_capabilities_client hal_vm_capabilities_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_vm_capabilities_server hal_vm_capabilities_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_vm_capabilities_server } hal_vm_capabilities_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_vm_capabilities_client servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_vm_capabilities_client:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_vm_capabilities_client:dir search;
+#line 8
+allow servicemanager hal_vm_capabilities_client:file { read open };
+#line 8
+allow servicemanager hal_vm_capabilities_client:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+#line 9
+# Call the servicemanager and transfer references to it.
+#line 9
+allow hal_vm_capabilities_server servicemanager:binder { call transfer };
+#line 9
+# Allow servicemanager to send out callbacks
+#line 9
+allow servicemanager hal_vm_capabilities_server:binder { call transfer };
+#line 9
+# servicemanager performs getpidcon on clients.
+#line 9
+allow servicemanager hal_vm_capabilities_server:dir search;
+#line 9
+allow servicemanager hal_vm_capabilities_server:file { read open };
+#line 9
+allow servicemanager hal_vm_capabilities_server:process getattr;
+#line 9
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 9
+# all domains in domain.te.
+#line 9
+
+#line 1 "system/sepolicy/private/hal_vr.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_vr_client hal_vr_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_vr_server hal_vr_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_vr_client hal_vr_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_vr_server hal_vr_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_vr_client hal_vr_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_vr_server hal_vr_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_vr_client hal_vr_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_vr_server hal_vr_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_vr_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_vr_server } hal_vr_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 1 "system/sepolicy/private/hal_weaver.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_weaver_client hal_weaver_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_weaver_server hal_weaver_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_weaver_client hal_weaver_server:fd use;
+#line 2
+
+
+
+#line 4
+ allow hal_weaver_client hal_weaver_hwservice:hwservice_manager find;
+#line 4
+
+#line 4
+ allow hal_weaver_server hal_weaver_hwservice:hwservice_manager { add find };
+#line 4
+ allow hal_weaver_server hidl_base_hwservice:hwservice_manager add;
+#line 4
+ neverallow { domain -hal_weaver_server } hal_weaver_hwservice:hwservice_manager add;
+#line 4
+
+#line 4
+
+#line 4
+
+#line 4
+
+
+#line 5
+ allow hal_weaver_client hal_weaver_service:service_manager find;
+#line 5
+
+#line 5
+ allow hal_weaver_server hal_weaver_service:service_manager { add find };
+#line 5
+ neverallow { domain -hal_weaver_server } hal_weaver_service:service_manager add;
+#line 5
+
+#line 5
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 5
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow hal_weaver_server servicemanager:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow servicemanager hal_weaver_server:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow hal_weaver_server servicemanager:fd use;
+#line 7
+
+#line 1 "system/sepolicy/private/hal_wifi.te"
+# HwBinder IPC from client to server, and callbacks
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_wifi_client hal_wifi_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_wifi_server hal_wifi_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_wifi_client hal_wifi_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_wifi_server hal_wifi_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_wifi_client hal_wifi_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_wifi_server hal_wifi_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_wifi_client hal_wifi_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_wifi_server hal_wifi_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_wifi_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_wifi_server } hal_wifi_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_wifi_client hal_wifi_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_wifi_server hal_wifi_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_wifi_server } hal_wifi_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_wifi_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_wifi_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_wifi_server:dir search;
+#line 8
+allow servicemanager hal_wifi_server:file { read open };
+#line 8
+allow servicemanager hal_wifi_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+
+#line 10
+allow hal_wifi proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 10
+allow hal_wifi proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 10
+
+
+#line 11
+allow hal_wifi sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_wifi sysfs_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 11
+
+
+
+#line 13
+
+#line 13
+allow hal_wifi_server property_socket:sock_file write;
+#line 13
+allow hal_wifi_server init:unix_stream_socket connectto;
+#line 13
+
+#line 13
+allow hal_wifi_server wifi_hal_prop:property_service set;
+#line 13
+
+#line 13
+allow hal_wifi_server wifi_hal_prop:file { getattr open read map };
+#line 13
+
+#line 13
+
+
+#line 14
+
+#line 14
+allow hal_wifi property_socket:sock_file write;
+#line 14
+allow hal_wifi init:unix_stream_socket connectto;
+#line 14
+
+#line 14
+allow hal_wifi wifi_prop:property_service set;
+#line 14
+
+#line 14
+allow hal_wifi wifi_prop:file { getattr open read map };
+#line 14
+
+#line 14
+
+
+
+# allow hal wifi set interfaces up and down and get the factory MAC
+allow hal_wifi self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allowxperm hal_wifi self:udp_socket ioctl { 0x00008914 0x00008924 0x00008946 };
+
+allow hal_wifi self:{ capability cap_userns } { net_admin net_raw };
+# allow hal_wifi to speak to nl80211 in the kernel
+allow hal_wifi self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
+allow hal_wifi self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+# hal_wifi writes firmware paths to this file.
+allow hal_wifi sysfs_wlan_fwpath:file { { open append write lock map } };
+# allow hal_wifi to access /proc/modules to check if Wi-Fi driver is loaded
+allow hal_wifi proc_modules:file { getattr open read };
+# Allow hal_wifi to send dump info to dumpstate
+allow hal_wifi dumpstate:fifo_file write;
+
+# allow hal_wifi to write into /data/vendor/tombstones/wifi
+allow hal_wifi_server tombstone_wifi_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow hal_wifi_server tombstone_wifi_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1 "system/sepolicy/private/hal_wifi_hostapd.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_wifi_hostapd_client hal_wifi_hostapd_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_wifi_hostapd_server hal_wifi_hostapd_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_wifi_hostapd_client hal_wifi_hostapd_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_wifi_hostapd_server hal_wifi_hostapd_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_wifi_hostapd_client hal_wifi_hostapd_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_wifi_hostapd_server hal_wifi_hostapd_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_wifi_hostapd_client hal_wifi_hostapd_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_wifi_hostapd_server hal_wifi_hostapd_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_wifi_hostapd_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_wifi_hostapd_server } hal_wifi_hostapd_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_wifi_hostapd_client hal_wifi_hostapd_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_wifi_hostapd_server hal_wifi_hostapd_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_wifi_hostapd_server } hal_wifi_hostapd_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow hal_wifi_hostapd_server servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager hal_wifi_hostapd_server:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager hal_wifi_hostapd_server:dir search;
+#line 8
+allow servicemanager hal_wifi_hostapd_server:file { read open };
+#line 8
+allow servicemanager hal_wifi_hostapd_server:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+allow hal_wifi_hostapd_server dumpstate:fifo_file write;
+
+allow hal_wifi_hostapd_server self:{ capability cap_userns } { net_admin net_raw };
+
+allow hal_wifi_hostapd_server sysfs_net:dir search;
+
+# Allow hal_wifi_hostapd to access /proc/net/psched
+allow hal_wifi_hostapd_server proc_net_type:file { getattr open read };
+
+# Various socket permissions.
+allowxperm hal_wifi_hostapd_server self:udp_socket ioctl
+#line 20
+{
+#line 20
+# qualcomm rmnet ioctls
+#line 20
+0x00006900 0x00006902
+#line 20
+# socket ioctls
+#line 20
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 20
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 20
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 20
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 20
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 20
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 20
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 20
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 20
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 20
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 20
+# device and protocol specific ioctls
+#line 20
+0x000089f0-0x000089ff
+#line 20
+0x000089e0-0x000089ef
+#line 20
+# Wireless extension ioctls
+#line 20
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 20
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 20
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 20
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 20
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 20
+0x00008b34 0x00008b35 0x00008b36
+#line 20
+# Dev private ioctl i.e. hardware specific ioctls
+#line 20
+0x00008be0-0x00008bff
+#line 20
+};
+allow hal_wifi_hostapd_server self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_wifi_hostapd_server self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_wifi_hostapd_server self:packet_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_wifi_hostapd_server self:netlink_route_socket nlmsg_write;
+
+###
+### neverallow rules
+###
+
+# hal_wifi_hostapd should not trust any data from sdcards
+neverallow hal_wifi_hostapd_server { sdcard_type fuse }:dir ~getattr;
+neverallow hal_wifi_hostapd_server { sdcard_type fuse }:file *;
+#line 1 "system/sepolicy/private/hal_wifi_supplicant.te"
+# HwBinder IPC from client to server
+
+#line 2
+# Call the server domain and optionally transfer references to it.
+#line 2
+allow hal_wifi_supplicant_client hal_wifi_supplicant_server:binder { call transfer };
+#line 2
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 2
+allow hal_wifi_supplicant_server hal_wifi_supplicant_client:binder transfer;
+#line 2
+# Receive and use open files from the server.
+#line 2
+allow hal_wifi_supplicant_client hal_wifi_supplicant_server:fd use;
+#line 2
+
+
+#line 3
+# Call the server domain and optionally transfer references to it.
+#line 3
+allow hal_wifi_supplicant_server hal_wifi_supplicant_client:binder { call transfer };
+#line 3
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 3
+allow hal_wifi_supplicant_client hal_wifi_supplicant_server:binder transfer;
+#line 3
+# Receive and use open files from the server.
+#line 3
+allow hal_wifi_supplicant_server hal_wifi_supplicant_client:fd use;
+#line 3
+
+
+
+#line 5
+ allow hal_wifi_supplicant_client hal_wifi_supplicant_hwservice:hwservice_manager find;
+#line 5
+
+#line 5
+ allow hal_wifi_supplicant_server hal_wifi_supplicant_hwservice:hwservice_manager { add find };
+#line 5
+ allow hal_wifi_supplicant_server hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hal_wifi_supplicant_server } hal_wifi_supplicant_hwservice:hwservice_manager add;
+#line 5
+
+#line 5
+
+#line 5
+
+#line 5
+
+
+#line 6
+ allow hal_wifi_supplicant_client hal_wifi_supplicant_service:service_manager find;
+#line 6
+
+#line 6
+ allow hal_wifi_supplicant_server hal_wifi_supplicant_service:service_manager { add find };
+#line 6
+ neverallow { domain -hal_wifi_supplicant_server } hal_wifi_supplicant_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+#line 6
+
+
+# in addition to ioctls allowlisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
+allowxperm hal_wifi_supplicant self:udp_socket ioctl
+#line 9
+{
+#line 9
+# qualcomm rmnet ioctls
+#line 9
+0x00006900 0x00006902
+#line 9
+# socket ioctls
+#line 9
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 9
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 9
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 9
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 9
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 9
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 9
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 9
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 9
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 9
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 9
+# device and protocol specific ioctls
+#line 9
+0x000089f0-0x000089ff
+#line 9
+0x000089e0-0x000089ef
+#line 9
+# Wireless extension ioctls
+#line 9
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 9
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 9
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 9
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 9
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 9
+0x00008b34 0x00008b35 0x00008b36
+#line 9
+# Dev private ioctl i.e. hardware specific ioctls
+#line 9
+0x00008be0-0x00008bff
+#line 9
+};
+
+
+#line 11
+allow hal_wifi_supplicant sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_wifi_supplicant sysfs_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 11
+
+
+#line 12
+allow hal_wifi_supplicant proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_wifi_supplicant proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+
+allow hal_wifi_supplicant self:{ capability cap_userns } { setuid net_admin setgid net_raw };
+allow hal_wifi_supplicant cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow hal_wifi_supplicant cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow hal_wifi_supplicant self:netlink_route_socket nlmsg_write;
+allow hal_wifi_supplicant self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_wifi_supplicant self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow hal_wifi_supplicant self:packet_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allowxperm hal_wifi_supplicant self:packet_socket ioctl {
+#line 21
+{
+#line 21
+# Socket ioctls for gathering information about the interface
+#line 21
+0x00008906 0x00008907
+#line 21
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 21
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 21
+# Wireless extension ioctls. Primarily get functions.
+#line 21
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 21
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 21
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 21
+}
+#line 21
+{
+#line 21
+# qualcomm rmnet ioctls
+#line 21
+0x00006900 0x00006902
+#line 21
+# socket ioctls
+#line 21
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 21
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 21
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 21
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 21
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 21
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 21
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 21
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 21
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 21
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 21
+# device and protocol specific ioctls
+#line 21
+0x000089f0-0x000089ff
+#line 21
+0x000089e0-0x000089ef
+#line 21
+# Wireless extension ioctls
+#line 21
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 21
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 21
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 21
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 21
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 21
+0x00008b34 0x00008b35 0x00008b36
+#line 21
+# Dev private ioctl i.e. hardware specific ioctls
+#line 21
+0x00008be0-0x00008bff
+#line 21
+} {
+#line 21
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 21
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 21
+} };
+
+
+#line 23
+ allow keystore hal_wifi_supplicant:dir search;
+#line 23
+ allow keystore hal_wifi_supplicant:file { read open };
+#line 23
+ allow keystore hal_wifi_supplicant:process getattr;
+#line 23
+ allow hal_wifi_supplicant apc_service:service_manager find;
+#line 23
+ allow hal_wifi_supplicant keystore_service:service_manager find;
+#line 23
+ allow hal_wifi_supplicant legacykeystore_service:service_manager find;
+#line 23
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow hal_wifi_supplicant keystore:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow keystore hal_wifi_supplicant:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow hal_wifi_supplicant keystore:fd use;
+#line 23
+
+#line 23
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow keystore hal_wifi_supplicant:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow hal_wifi_supplicant keystore:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow keystore hal_wifi_supplicant:fd use;
+#line 23
+
+#line 23
+
+
+#line 24
+# Call the servicemanager and transfer references to it.
+#line 24
+allow hal_wifi_supplicant_server servicemanager:binder { call transfer };
+#line 24
+# Allow servicemanager to send out callbacks
+#line 24
+allow servicemanager hal_wifi_supplicant_server:binder { call transfer };
+#line 24
+# servicemanager performs getpidcon on clients.
+#line 24
+allow servicemanager hal_wifi_supplicant_server:dir search;
+#line 24
+allow servicemanager hal_wifi_supplicant_server:file { read open };
+#line 24
+allow servicemanager hal_wifi_supplicant_server:process getattr;
+#line 24
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 24
+# all domains in domain.te.
+#line 24
+
+
+# Allow the WI-FI HAL to use keys in the keystore namespace wifi_key.
+allow hal_wifi_supplicant wifi_key:keystore2_key {
+ get_info
+ use
+};
+
+###
+### neverallow rules
+###
+
+# wpa_supplicant should not trust any data from sdcards
+neverallow hal_wifi_supplicant_server { sdcard_type fuse }:dir ~getattr;
+neverallow hal_wifi_supplicant_server { sdcard_type fuse }:file *;
+#line 1 "system/sepolicy/private/halclientdomain.te"
+###
+### Rules for all domains which are clients of a HAL
+###
+
+# Find out whether a HAL in passthrough/in-process mode or
+# binderized/out-of-process mode
+
+#line 7
+# Call the hwservicemanager and transfer references to it.
+#line 7
+allow halclientdomain hwservicemanager:binder { call transfer };
+#line 7
+# Allow hwservicemanager to send out callbacks
+#line 7
+allow hwservicemanager halclientdomain:binder { call transfer };
+#line 7
+# hwservicemanager performs getpidcon on clients.
+#line 7
+allow hwservicemanager halclientdomain:dir search;
+#line 7
+allow hwservicemanager halclientdomain:file { read open map };
+#line 7
+allow hwservicemanager halclientdomain:process getattr;
+#line 7
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+# Used to wait for hwservicemanager
+
+#line 10
+allow halclientdomain hwservicemanager_prop:file { getattr open read map };
+#line 10
+
+
+# Wait for HAL server to be up (used by getService)
+allow halclientdomain hidl_manager_hwservice:hwservice_manager find;
+#line 1 "system/sepolicy/private/halserverdomain.te"
+###
+### Rules for all domains which offer a HAL service over HwBinder
+###
+
+# Register the HAL service with hwservicemanager
+
+#line 6
+# Call the hwservicemanager and transfer references to it.
+#line 6
+allow halserverdomain hwservicemanager:binder { call transfer };
+#line 6
+# Allow hwservicemanager to send out callbacks
+#line 6
+allow hwservicemanager halserverdomain:binder { call transfer };
+#line 6
+# hwservicemanager performs getpidcon on clients.
+#line 6
+allow hwservicemanager halserverdomain:dir search;
+#line 6
+allow hwservicemanager halserverdomain:file { read open map };
+#line 6
+allow hwservicemanager halserverdomain:process getattr;
+#line 6
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+
+# Find HAL implementations
+allow halserverdomain system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Used to wait for hwservicemanager
+
+#line 12
+allow halserverdomain hwservicemanager_prop:file { getattr open read map };
+#line 12
+
+#line 1 "system/sepolicy/private/healthd.te"
+typeattribute healthd coredomain;
+#line 1 "system/sepolicy/private/heapprofd.te"
+# Android heap profiling daemon. go/heapprofd.
+type heapprofd_exec, exec_type, file_type, system_file_type;
+type heapprofd_tmpfs, file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init heapprofd_exec:file { getattr open read execute map };
+#line 5
+allow init heapprofd:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow heapprofd heapprofd_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init heapprofd:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init heapprofd:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init heapprofd_exec:process heapprofd;
+#line 5
+
+#line 5
+
+
+#line 6
+type_transition heapprofd tmpfs:file heapprofd_tmpfs;
+#line 6
+allow heapprofd heapprofd_tmpfs:file { read write getattr map };
+#line 6
+
+
+# Allow apps in other MLS contexts (for multi-user) to access
+# shared memory buffers created by heapprofd.
+typeattribute heapprofd_tmpfs mlstrustedobject;
+
+
+#line 12
+
+#line 12
+allow heapprofd property_socket:sock_file write;
+#line 12
+allow heapprofd init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow heapprofd heapprofd_prop:property_service set;
+#line 12
+
+#line 12
+allow heapprofd heapprofd_prop:file { getattr open read map };
+#line 12
+
+#line 12
+;
+
+# Necessary for /proc/[pid]/cmdline access & sending signals.
+typeattribute heapprofd mlstrustedsubject;
+
+# Allow sending signals to processes. This excludes SIGKILL, SIGSTOP and
+# SIGCHLD, which are controlled by separate permissions.
+allow heapprofd self:capability kill;
+
+# When scanning /proc/[pid]/cmdline to find matching processes for by-name
+# profiling, only allowlisted domains will be allowed by SELinux. Avoid
+# spamming logs with denials for entries that we can not access.
+dontaudit heapprofd domain:dir { search open };
+
+# Write trace data to the Perfetto traced daemon. This requires connecting to
+# its producer socket and obtaining a (per-process) tmpfs fd.
+
+#line 28
+ allow heapprofd traced:fd use;
+#line 28
+ allow heapprofd traced_tmpfs:file { read write getattr map };
+#line 28
+
+#line 28
+allow heapprofd traced_producer_socket:sock_file write;
+#line 28
+allow heapprofd traced:unix_stream_socket connectto;
+#line 28
+
+#line 28
+
+#line 28
+ # Also allow the service to use the producer file descriptors. This is
+#line 28
+ # necessary when the producer is creating the shared memory, as it will be
+#line 28
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 28
+ allow traced heapprofd:fd use;
+#line 28
+
+
+# When handling profiling for all processes, heapprofd needs to read
+# executables/libraries/etc to do stack unwinding.
+
+#line 32
+allow heapprofd nativetest_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow heapprofd nativetest_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+
+#line 33
+allow heapprofd system_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 33
+allow heapprofd system_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 33
+
+
+#line 34
+allow heapprofd apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 34
+allow heapprofd apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 34
+
+
+#line 35
+allow heapprofd dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 35
+allow heapprofd dalvikcache_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 35
+
+
+#line 36
+allow heapprofd vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow heapprofd vendor_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+
+
+#line 37
+allow heapprofd shell_test_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 37
+allow heapprofd shell_test_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 37
+
+# ART apex files and directory access to the containing /data/misc/apexdata.
+
+#line 39
+allow heapprofd apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 39
+allow heapprofd apex_art_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 39
+
+allow heapprofd apex_module_data_file:dir { getattr search };
+
+# Some dex files are not world-readable.
+# We are still constrained by the SELinux rules above.
+allow heapprofd self:{ capability cap_userns } dac_read_search;
+
+# For checking profileability.
+allow heapprofd packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Never allow profiling privileged or otherwise incompatible domains.
+# Corresponding allow-rule is in private/domain.te.
+
+#line 51
+ neverallow heapprofd {
+#line 51
+ apexd
+#line 51
+ app_zygote
+#line 51
+ bpfloader
+#line 51
+ hal_configstore_server
+#line 51
+ init
+#line 51
+ kernel
+#line 51
+ keystore
+#line 51
+ llkd
+#line 51
+ logd
+#line 51
+ logpersist
+#line 51
+ recovery
+#line 51
+ recovery_persist
+#line 51
+ recovery_refresh
+#line 51
+ ueventd
+#line 51
+ vendor_init
+#line 51
+ vold
+#line 51
+ webview_zygote
+#line 51
+ zygote
+#line 51
+}:file read;
+#line 51
+ neverallow heapprofd {
+#line 51
+ apexd
+#line 51
+ app_zygote
+#line 51
+ bpfloader
+#line 51
+ hal_configstore_server
+#line 51
+ init
+#line 51
+ kernel
+#line 51
+ keystore
+#line 51
+ llkd
+#line 51
+ logd
+#line 51
+ logpersist
+#line 51
+ recovery
+#line 51
+ recovery_persist
+#line 51
+ recovery_refresh
+#line 51
+ ueventd
+#line 51
+ vendor_init
+#line 51
+ vold
+#line 51
+ webview_zygote
+#line 51
+ zygote
+#line 51
+}:process signal;
+#line 70
+
+
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 72
+
+#line 72
+ neverallow heapprofd vendor_file_type:file { append create link unlink relabelfrom rename setattr write };
+#line 72
+ neverallow heapprofd { vendor_file_type -vndk_sp_file }:file { execute execute_no_trans };
+#line 72
+
+#line 72
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 75
+
+#line 1 "system/sepolicy/private/hidl_lazy_test_server.te"
+type hidl_lazy_test_server, domain;
+type hidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+#line 8
+
+#line 1 "system/sepolicy/private/hwservice.te"
+type hal_lazy_test_hwservice, hwservice_manager_type, protected_hwservice;
+
+###
+### Neverallow rules
+###
+
+# hwservicemanager handles registering or looking up named services.
+# It does not make sense to register or lookup something which is not a
+# hwservice. Trigger a compile error if this occurs.
+neverallow domain ~hwservice_manager_type:hwservice_manager { add find };
+#line 1 "system/sepolicy/private/hwservicemanager.te"
+typeattribute hwservicemanager coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init hwservicemanager_exec:file { getattr open read execute map };
+#line 3
+allow init hwservicemanager:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow hwservicemanager hwservicemanager_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init hwservicemanager:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init hwservicemanager:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init hwservicemanager_exec:process hwservicemanager;
+#line 3
+
+#line 3
+
+
+
+#line 5
+ allow hwservicemanager hidl_manager_hwservice:hwservice_manager { add find };
+#line 5
+ allow hwservicemanager hidl_base_hwservice:hwservice_manager add;
+#line 5
+ neverallow { domain -hwservicemanager } hidl_manager_hwservice:hwservice_manager add;
+#line 5
+
+
+#line 6
+ allow hwservicemanager hidl_token_hwservice:hwservice_manager { add find };
+#line 6
+ allow hwservicemanager hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -hwservicemanager } hidl_token_hwservice:hwservice_manager add;
+#line 6
+
+
+
+#line 8
+
+#line 8
+allow hwservicemanager property_socket:sock_file write;
+#line 8
+allow hwservicemanager init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow hwservicemanager ctl_interface_start_prop:property_service set;
+#line 8
+
+#line 8
+allow hwservicemanager ctl_interface_start_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+#line 9
+
+#line 9
+allow hwservicemanager property_socket:sock_file write;
+#line 9
+allow hwservicemanager init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow hwservicemanager hwservicemanager_prop:property_service set;
+#line 9
+
+#line 9
+allow hwservicemanager hwservicemanager_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+# hwservicemanager is using bootstrap bionic
+
+#line 12
+ allow hwservicemanager system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+ allow hwservicemanager system_bootstrap_lib_file:file { execute read open getattr map };
+#line 12
+
+
+# hwservicemanager is using apex_info via libvintf
+
+#line 15
+ allow hwservicemanager apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+ allow hwservicemanager apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+#line 15
+allow hwservicemanager vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hwservicemanager vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+#line 15
+
+
+# Note that we do not use the binder_* macros here.
+# hwservicemanager provides name service (aka context manager)
+# for hwbinder.
+# Additionally, it initiates binder IPC calls to
+# clients who request service notifications. The permission
+# to do this is granted in the hwbinder_use macro.
+allow hwservicemanager self:binder set_context_mgr;
+
+# Scan through /system/lib64/hw looking for installed HALs
+allow hwservicemanager system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Read hwservice_contexts
+allow hwservicemanager hwservice_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Check SELinux permissions.
+
+#line 32
+
+#line 32
+allow hwservicemanager selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow hwservicemanager selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+#line 32
+allow hwservicemanager selinuxfs:file { open append write lock map };
+#line 32
+allow hwservicemanager kernel:security compute_av;
+#line 32
+allow hwservicemanager self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 32
+
+#line 1 "system/sepolicy/private/idmap.te"
+typeattribute idmap coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init idmap_exec:file { getattr open read execute map };
+#line 3
+allow init idmap:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow idmap idmap_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init idmap:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init idmap:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init idmap_exec:process idmap;
+#line 3
+
+#line 3
+
+
+# Allow read + write access to /data/resource-cache
+allow idmap resourcecache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow idmap resourcecache_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Open and read from target and overlay apk files passed by argument.
+allow idmap apk_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow idmap apk_data_file:dir search;
+
+# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
+allow idmap { apk_tmp_file apk_private_tmp_file }:file { getattr open read ioctl lock map watch watch_reads };
+allow idmap { apk_tmp_file apk_private_tmp_file }:dir search;
+
+# Allow apps access to /vendor/app
+
+#line 18
+allow idmap vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow idmap vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+
+# Allow apps access to /vendor/overlay
+
+#line 21
+allow idmap vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow idmap vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 21
+
+
+# Allow the idmap2d binary to register as a service and communicate via AIDL
+
+#line 24
+# Call the servicemanager and transfer references to it.
+#line 24
+allow idmap servicemanager:binder { call transfer };
+#line 24
+# Allow servicemanager to send out callbacks
+#line 24
+allow servicemanager idmap:binder { call transfer };
+#line 24
+# servicemanager performs getpidcon on clients.
+#line 24
+allow servicemanager idmap:dir search;
+#line 24
+allow servicemanager idmap:file { read open };
+#line 24
+allow servicemanager idmap:process getattr;
+#line 24
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 24
+# all domains in domain.te.
+#line 24
+
+
+#line 25
+typeattribute idmap binderservicedomain;
+#line 25
+
+
+#line 26
+ allow idmap idmap_service:service_manager { add find };
+#line 26
+ neverallow { domain -idmap } idmap_service:service_manager add;
+#line 26
+
+#line 26
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 26
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 26
+
+#line 26
+
+#line 1 "system/sepolicy/private/incident.te"
+typeattribute incident coredomain;
+
+type incident_exec, system_file_type, exec_type, file_type;
+
+# switch to incident domain for incident command
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow shell incident_exec:file { getattr open read execute map };
+#line 6
+allow shell incident:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow incident incident_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+allow incident shell:process sigchld;
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit shell incident:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow shell incident:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition shell incident_exec:process incident;
+#line 6
+
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow dumpstate incident_exec:file { getattr open read execute map };
+#line 7
+allow dumpstate incident:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow incident incident_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+allow incident dumpstate:process sigchld;
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit dumpstate incident:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow dumpstate incident:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition dumpstate incident_exec:process incident;
+#line 7
+
+
+# allow incident access to stdout from its parent shell.
+allow incident shell:fd use;
+
+# allow incident to communicate with dumpstate, and write incident report to
+# /data/data/com.android.shell/files/bugreports/tmp_incident_report
+allow incident dumpstate:fd use;
+allow incident dumpstate:unix_stream_socket { read write };
+allow incident shell_data_file:file write;
+
+# allow incident be able to output data for CTS to fetch.
+allow incident devpts:chr_file { read write };
+
+# allow incident to communicate use, read and write over the adb
+# connection.
+allow incident adbd:fd use;
+allow incident adbd:unix_stream_socket { read write };
+
+# allow adbd to reap incident
+allow incident adbd:process { sigchld };
+
+# Allow the incident command to talk to the incidentd over the binder, and get
+# back the incident report data from a ParcelFileDescriptor.
+
+#line 31
+# Call the servicemanager and transfer references to it.
+#line 31
+allow incident servicemanager:binder { call transfer };
+#line 31
+# Allow servicemanager to send out callbacks
+#line 31
+allow servicemanager incident:binder { call transfer };
+#line 31
+# servicemanager performs getpidcon on clients.
+#line 31
+allow servicemanager incident:dir search;
+#line 31
+allow servicemanager incident:file { read open };
+#line 31
+allow servicemanager incident:process getattr;
+#line 31
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 31
+# all domains in domain.te.
+#line 31
+
+allow incident incident_service:service_manager find;
+
+#line 33
+# Call the server domain and optionally transfer references to it.
+#line 33
+allow incident incidentd:binder { call transfer };
+#line 33
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 33
+allow incidentd incident:binder transfer;
+#line 33
+# Receive and use open files from the server.
+#line 33
+allow incident incidentd:fd use;
+#line 33
+
+allow incident incidentd:fifo_file write;
+
+# only allow incident being called by shell or dumpstate
+neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };
+#line 1 "system/sepolicy/private/incident_helper.te"
+typeattribute incident_helper coredomain;
+
+type incident_helper_exec, system_file_type, exec_type, file_type;
+
+# switch to incident_helper domain for incident_helper command
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow incidentd incident_helper_exec:file { getattr open read execute map };
+#line 6
+allow incidentd incident_helper:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow incident_helper incident_helper_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+allow incident_helper incidentd:process sigchld;
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit incidentd incident_helper:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow incidentd incident_helper:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition incidentd incident_helper_exec:process incident_helper;
+#line 6
+
+
+# use pipe to transmit data from/to incidentd/incident_helper for parsing
+allow incident_helper { shell incident incidentd dumpstate }:fd use;
+allow incident_helper { shell incident incidentd dumpstate }:fifo_file { getattr read write };
+allow incident_helper incidentd:unix_stream_socket { read write };
+
+# only allow incidentd and shell to call incident_helper
+neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };
+#line 1 "system/sepolicy/private/incidentd.te"
+typeattribute incidentd coredomain;
+typeattribute incidentd mlstrustedsubject;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init incidentd_exec:file { getattr open read execute map };
+#line 4
+allow init incidentd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow incidentd incidentd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init incidentd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init incidentd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init incidentd_exec:process incidentd;
+#line 4
+
+#line 4
+
+type incidentd_exec, system_file_type, exec_type, file_type;
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow incidentd servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager incidentd:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager incidentd:dir search;
+#line 6
+allow servicemanager incidentd:file { read open };
+#line 6
+allow servicemanager incidentd:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+
+#line 7
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 7
+# deprecated.
+#line 7
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 7
+allow incidentd sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 7
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 7
+allow incidentd self:{ capability2 cap2_userns } block_suspend;
+#line 7
+# system_suspend permissions
+#line 7
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow incidentd system_suspend_server:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow system_suspend_server incidentd:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow incidentd system_suspend_server:fd use;
+#line 7
+
+#line 7
+allow incidentd system_suspend_hwservice:hwservice_manager find;
+#line 7
+# halclientdomain permissions
+#line 7
+
+#line 7
+# Call the hwservicemanager and transfer references to it.
+#line 7
+allow incidentd hwservicemanager:binder { call transfer };
+#line 7
+# Allow hwservicemanager to send out callbacks
+#line 7
+allow hwservicemanager incidentd:binder { call transfer };
+#line 7
+# hwservicemanager performs getpidcon on clients.
+#line 7
+allow hwservicemanager incidentd:dir search;
+#line 7
+allow hwservicemanager incidentd:file { read open map };
+#line 7
+allow hwservicemanager incidentd:process getattr;
+#line 7
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+#line 7
+
+#line 7
+allow incidentd hwservicemanager_prop:file { getattr open read map };
+#line 7
+
+#line 7
+allow incidentd hidl_manager_hwservice:hwservice_manager find;
+#line 7
+# AIDL suspend hal permissions
+#line 7
+allow incidentd hal_system_suspend_service:service_manager find;
+#line 7
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow incidentd servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager incidentd:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager incidentd:dir search;
+#line 7
+allow servicemanager incidentd:file { read open };
+#line 7
+allow servicemanager incidentd:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+#line 7
+
+
+# Allow incidentd to scan through /proc/pid for all processes
+
+#line 10
+allow incidentd domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 10
+allow incidentd domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 10
+
+
+# Allow incidentd to kill incident_helper when timeout
+allow incidentd incident_helper:process sigkill;
+
+# Allow executing files on system, such as:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow incidentd system_file:file execute_no_trans;
+allow incidentd toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# section id 1002, allow reading kernel version /proc/version
+allow incidentd proc_version:file { getattr open read ioctl lock map watch watch_reads };
+
+# section id 1116, allow accessing statsd socket
+
+#line 26
+allow incidentd statsdw_socket:sock_file write;
+#line 26
+allow incidentd statsd:unix_dgram_socket sendto;
+#line 26
+
+
+# section id 2001, allow reading /proc/pagetypeinfo
+allow incidentd proc_pagetypeinfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# section id 2002, allow reading /d/wakeup_sources
+;
+
+# section id 2003, allow executing top
+allow incidentd proc_meminfo:file { open read };
+
+# section id 2004, allow reading /sys/devices/system/cpu/cpufreq/all_time_in_state
+allow incidentd sysfs_devices_system_cpu:file { getattr open read ioctl lock map watch watch_reads };
+
+# section id 2005, allow reading ps dump in full
+allow incidentd domain:process getattr;
+
+# section id 2006, allow reading /sys/class/power_supply/bms/battery_type
+allow incidentd sysfs_batteryinfo:dir { search };
+allow incidentd sysfs_batteryinfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# section id 2007, allow reading LAST_KMSG /sys/fs/pstore/console-ramoops
+;
+;
+
+# section id 3023, allow obtaining stats report
+allow incidentd stats_service:service_manager find;
+
+#line 53
+# Call the server domain and optionally transfer references to it.
+#line 53
+allow incidentd statsd:binder { call transfer };
+#line 53
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 53
+allow statsd incidentd:binder transfer;
+#line 53
+# Receive and use open files from the server.
+#line 53
+allow incidentd statsd:fd use;
+#line 53
+
+
+# section id 3026, allow reading /data/misc/perfetto-traces.
+allow incidentd perfetto_traces_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow incidentd perfetto_traces_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# section id 3052, allow accessing nfc_service
+allow incidentd nfc_service:service_manager find;
+
+# Create and write into /data/misc/incidents
+allow incidentd incident_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow incidentd incident_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Enable incidentd to get stack traces.
+
+#line 67
+# Call the servicemanager and transfer references to it.
+#line 67
+allow incidentd servicemanager:binder { call transfer };
+#line 67
+# Allow servicemanager to send out callbacks
+#line 67
+allow servicemanager incidentd:binder { call transfer };
+#line 67
+# servicemanager performs getpidcon on clients.
+#line 67
+allow servicemanager incidentd:dir search;
+#line 67
+allow servicemanager incidentd:file { read open };
+#line 67
+allow servicemanager incidentd:process getattr;
+#line 67
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 67
+# all domains in domain.te.
+#line 67
+
+
+#line 68
+# Call the hwservicemanager and transfer references to it.
+#line 68
+allow incidentd hwservicemanager:binder { call transfer };
+#line 68
+# Allow hwservicemanager to send out callbacks
+#line 68
+allow hwservicemanager incidentd:binder { call transfer };
+#line 68
+# hwservicemanager performs getpidcon on clients.
+#line 68
+allow hwservicemanager incidentd:dir search;
+#line 68
+allow hwservicemanager incidentd:file { read open map };
+#line 68
+allow hwservicemanager incidentd:process getattr;
+#line 68
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 68
+# all domains in domain.te.
+#line 68
+
+allow incidentd hwservicemanager:hwservice_manager { list };
+
+#line 70
+allow incidentd hwservicemanager_prop:file { getattr open read map };
+#line 70
+
+allow incidentd hidl_manager_hwservice:hwservice_manager { find };
+
+# Read files in /proc
+allow incidentd {
+ proc_cmdline
+ proc_pid_max
+ proc_pipe_conf
+ proc_stat
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Signal java processes to dump their stack and get the results
+allow incidentd { appdomain ephemeral_app system_server }:process signal;
+
+# Signal native processes to dump their stack.
+# This list comes from native_processes_to_dump in incidentd/utils.c
+allow incidentd {
+ # This list comes from native_processes_to_dump in dumputils/dump_utils.cpp
+ audioserver
+ cameraserver
+ drmserver
+ inputflinger
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ sdcardd
+ statsd
+ surfaceflinger
+
+ # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.cpp
+ hal_audio_server
+ hal_bluetooth_server
+ hal_camera_server
+ hal_codec2_server
+ hal_face_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_omx_server
+ hal_sensors_server
+ hal_vr_server
+}:process signal;
+
+# Allow incidentd to make binder calls to any binder service
+
+#line 115
+# Call the server domain and optionally transfer references to it.
+#line 115
+allow incidentd system_server:binder { call transfer };
+#line 115
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 115
+allow system_server incidentd:binder transfer;
+#line 115
+# Receive and use open files from the server.
+#line 115
+allow incidentd system_server:fd use;
+#line 115
+
+
+#line 116
+# Call the server domain and optionally transfer references to it.
+#line 116
+allow incidentd appdomain:binder { call transfer };
+#line 116
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 116
+allow appdomain incidentd:binder transfer;
+#line 116
+# Receive and use open files from the server.
+#line 116
+allow incidentd appdomain:fd use;
+#line 116
+
+
+# Reading /proc/PID/maps of other processes
+;
+# incidentd has capability sys_ptrace, but should only use that capability for
+# accessing sensitive /proc/PID files, never for using ptrace attach.
+neverallow incidentd *:process ptrace;
+
+allow incidentd self:{ capability cap_userns } {
+ # Send signals to processes
+ kill
+};
+
+# Connect to tombstoned to intercept dumps.
+
+#line 130
+allow incidentd tombstoned_intercept_socket:sock_file write;
+#line 130
+allow incidentd tombstoned:unix_stream_socket connectto;
+#line 130
+
+
+# Run a shell.
+allow incidentd shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# For running am, incident-helper-cmd and similar framework commands.
+# Run /system/bin/app_process.
+allow incidentd zygote_exec:file { { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } } };
+# Access the runtime feature flag properties.
+
+#line 139
+allow incidentd device_config_runtime_native_prop:file { getattr open read map };
+#line 139
+
+
+#line 140
+allow incidentd device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 140
+
+# Access odsign verification status.
+
+#line 142
+allow incidentd odsign_prop:file { getattr open read map };
+#line 142
+
+# ART locks profile files.
+allow incidentd system_file:file lock;
+# Incidentd should never exec from the memory (e.g. JIT cache). These denials are expected.
+dontaudit incidentd dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit incidentd apex_module_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit incidentd apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit incidentd tmpfs:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } { getattr execute execute_no_trans map } };
+
+# Allow incidentd to read /apex/apex-info-list.xml
+allow incidentd apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# logd access - work to be done is a PII safe log (possibly an event log?)
+
+# TODO control_logd(incidentd)
+
+# Access /data/misc/logd
+
+#line 159
+allow incidentd misc_logd_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 159
+allow incidentd misc_logd_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 159
+
+
+# Allow incidentd to find these standard groups of services.
+# Others can be allowlisted individually.
+allow incidentd {
+ system_server_service
+ app_api_service
+ system_api_service
+ -tracingproxy_service
+}:service_manager find;
+
+# Only incidentd can publish the binder service
+
+#line 171
+ allow incidentd incident_service:service_manager { add find };
+#line 171
+ neverallow { domain -incidentd } incident_service:service_manager add;
+#line 171
+
+#line 171
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 171
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 171
+
+#line 171
+
+
+# Allow pipes only from dumpstate and incident
+allow incidentd { dumpstate incident }:fd use;
+allow incidentd { dumpstate incident }:fifo_file write;
+
+# Allow incident to call back to incident with status updates.
+
+#line 178
+# Call the server domain and optionally transfer references to it.
+#line 178
+allow incidentd incident:binder { call transfer };
+#line 178
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 178
+allow incident incidentd:binder transfer;
+#line 178
+# Receive and use open files from the server.
+#line 178
+allow incidentd incident:fd use;
+#line 178
+
+
+# Read device serial number from system properties
+# This is used to track reports from lab testing devices
+#line 184
+
+
+# Read ro.boot.bootreason, persist.sys.boot.bootreason
+# This is used to track reports from lab testing devices
+#line 192
+
+
+# Allow incident to read the build properties for attestation feature
+
+#line 195
+allow incidentd build_attestation_prop:file { getattr open read map };
+#line 195
+;
+
+###
+### neverallow rules
+###
+# only incidentd and the other root services in limited circumstances
+# can get to the files in /data/misc/incidents
+#
+# write, execute, append are forbidden almost everywhere
+neverallow { domain -incidentd -init -vold } incident_data_file:file {
+ { open append write lock map }
+ { getattr execute execute_no_trans map }
+ create
+ rename
+ setattr
+ unlink
+ append
+};
+# read is also allowed by system_server, for when the file is handed to dropbox
+neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file { getattr open read ioctl lock map watch watch_reads };
+# limited access to the directory itself
+neverallow { domain -incidentd -init -vold } incident_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+#line 1 "system/sepolicy/private/init.te"
+typeattribute init coredomain;
+
+
+#line 3
+type_transition init tmpfs:file init_tmpfs;
+#line 3
+allow init init_tmpfs:file { read write getattr map };
+#line 3
+
+
+# Transitions to seclabel processes in init.rc
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init rootfs:file { getattr open read execute map };
+#line 6
+allow init slideshow:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow slideshow rootfs:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init slideshow:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init slideshow:process { siginh rlimitinh };
+#line 6
+
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init charger_exec:file { getattr open read execute map };
+#line 7
+allow init charger:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow charger charger_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init charger:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init charger:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init charger_exec:process charger;
+#line 7
+
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow init e2fs_exec:file { getattr open read execute map };
+#line 8
+allow init e2fs:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow e2fs e2fs_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit init e2fs:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow init e2fs:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition init e2fs_exec:process e2fs;
+#line 8
+
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow init bpfloader_exec:file { getattr open read execute map };
+#line 9
+allow init bpfloader:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow bpfloader bpfloader_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit init bpfloader:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow init bpfloader:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition init bpfloader_exec:process bpfloader;
+#line 9
+
+
+#line 23
+
+
+#line 24
+# Old domain may exec the file and transition to the new domain.
+#line 24
+allow init shell_exec:file { getattr open read execute map };
+#line 24
+allow init shell:process transition;
+#line 24
+# New domain is entered by executing the file.
+#line 24
+allow shell shell_exec:file { entrypoint open read execute getattr map };
+#line 24
+# New domain can send SIGCHLD to its caller.
+#line 24
+
+#line 24
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 24
+dontaudit init shell:process noatsecure;
+#line 24
+# XXX dontaudit candidate but requires further study.
+#line 24
+allow init shell:process { siginh rlimitinh };
+#line 24
+
+
+#line 25
+# Old domain may exec the file and transition to the new domain.
+#line 25
+allow init init_exec:file { getattr open read execute map };
+#line 25
+allow init ueventd:process transition;
+#line 25
+# New domain is entered by executing the file.
+#line 25
+allow ueventd init_exec:file { entrypoint open read execute getattr map };
+#line 25
+# New domain can send SIGCHLD to its caller.
+#line 25
+
+#line 25
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 25
+dontaudit init ueventd:process noatsecure;
+#line 25
+# XXX dontaudit candidate but requires further study.
+#line 25
+allow init ueventd:process { siginh rlimitinh };
+#line 25
+
+
+#line 26
+# Old domain may exec the file and transition to the new domain.
+#line 26
+allow init init_exec:file { getattr open read execute map };
+#line 26
+allow init vendor_init:process transition;
+#line 26
+# New domain is entered by executing the file.
+#line 26
+allow vendor_init init_exec:file { entrypoint open read execute getattr map };
+#line 26
+# New domain can send SIGCHLD to its caller.
+#line 26
+
+#line 26
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 26
+dontaudit init vendor_init:process noatsecure;
+#line 26
+# XXX dontaudit candidate but requires further study.
+#line 26
+allow init vendor_init:process { siginh rlimitinh };
+#line 26
+
+
+#line 27
+# Old domain may exec the file and transition to the new domain.
+#line 27
+allow init { rootfs toolbox_exec }:file { getattr open read execute map };
+#line 27
+allow init modprobe:process transition;
+#line 27
+# New domain is entered by executing the file.
+#line 27
+allow modprobe { rootfs toolbox_exec }:file { entrypoint open read execute getattr map };
+#line 27
+# New domain can send SIGCHLD to its caller.
+#line 27
+
+#line 27
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 27
+dontaudit init modprobe:process noatsecure;
+#line 27
+# XXX dontaudit candidate but requires further study.
+#line 27
+allow init modprobe:process { siginh rlimitinh };
+#line 27
+
+#line 36
+
+
+# Allow init to figure out name of dm-device from it's /dev/block/dm-XX path.
+# This is useful in case of remounting ext4 userdata into checkpointing mode,
+# since it potentially requires tearing down dm-devices (e.g. dm-bow, dm-crypto)
+# that userdata is mounted onto.
+allow init sysfs_dm:file read;
+
+# Allow init to modify the properties of loop devices.
+allow init sysfs_loop:dir { open getattr read search ioctl lock watch watch_reads };
+allow init sysfs_loop:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow init to examine the properties of block devices.
+allow init sysfs_type:file { getattr read };
+# Allow init get the attributes of block devices in /dev/block.
+allow init dev_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow init dev_type:blk_file getattr;
+
+# Allow init to write to the drop_caches file.
+allow init proc_drop_caches:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow the BoringSSL self test to request a reboot upon failure
+
+#line 58
+
+#line 58
+allow init property_socket:sock_file write;
+#line 58
+allow init init:unix_stream_socket connectto;
+#line 58
+
+#line 58
+allow init powerctl_prop:property_service set;
+#line 58
+
+#line 58
+allow init powerctl_prop:file { getattr open read map };
+#line 58
+
+#line 58
+
+
+
+#line 60
+
+#line 60
+allow init property_socket:sock_file write;
+#line 60
+allow init init:unix_stream_socket connectto;
+#line 60
+
+#line 60
+allow init userspace_reboot_exported_prop:property_service set;
+#line 60
+
+#line 60
+allow init userspace_reboot_exported_prop:file { getattr open read map };
+#line 60
+
+#line 60
+
+
+# Second-stage init performs a test for whether the kernel has SELinux hooks
+# for the perf_event_open() syscall. This is done by testing for the syscall
+# outcomes corresponding to this policy.
+# TODO(b/137092007): this can be removed once the platform stops supporting
+# kernels that precede the perf_event_open hooks (Android common kernels 4.4
+# and 4.9).
+allow init self:perf_event { open cpu };
+allow init self:{ capability2 cap2_userns } perfmon;
+
+# Allow opening /proc/kallsyms so that on boot, init can create and retain an
+# fd with the full address visibility (which is evaluated on open and persists
+# for the lifetime of the open file description). This fd can then be shared
+# with other privileged processes.
+allow init proc_kallsyms:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow init to communicate with snapuserd to transition Virtual A/B devices
+# from the first-stage daemon to the second-stage.
+allow init snapuserd_socket:sock_file write;
+allow init snapuserd:unix_stream_socket connectto;
+# Allow for libsnapshot's use of flock() on /metadata/ota.
+allow init ota_metadata_file:dir lock;
+
+# Allow init to restore contexts of vd_device(/dev/block/vd[..]) when labeling
+# /dev/block.
+allow init vd_device:blk_file relabelto;
+
+
+#line 88
+
+#line 88
+allow init property_socket:sock_file write;
+#line 88
+allow init init:unix_stream_socket connectto;
+#line 88
+
+#line 88
+allow init init_perf_lsm_hooks_prop:property_service set;
+#line 88
+
+#line 88
+allow init init_perf_lsm_hooks_prop:file { getattr open read map };
+#line 88
+
+#line 88
+
+
+#line 89
+
+#line 89
+allow init property_socket:sock_file write;
+#line 89
+allow init init:unix_stream_socket connectto;
+#line 89
+
+#line 89
+allow init vts_status_prop:property_service set;
+#line 89
+
+#line 89
+allow init vts_status_prop:file { getattr open read map };
+#line 89
+
+#line 89
+
+
+# Allow init to set 16kb app compatibility props
+
+#line 92
+
+#line 92
+allow init property_socket:sock_file write;
+#line 92
+allow init init:unix_stream_socket connectto;
+#line 92
+
+#line 92
+allow init bionic_linker_16kb_app_compat_prop:property_service set;
+#line 92
+
+#line 92
+allow init bionic_linker_16kb_app_compat_prop:file { getattr open read map };
+#line 92
+
+#line 92
+
+
+#line 93
+
+#line 93
+allow init property_socket:sock_file write;
+#line 93
+allow init init:unix_stream_socket connectto;
+#line 93
+
+#line 93
+allow init pm_16kb_app_compat_prop:property_service set;
+#line 93
+
+#line 93
+allow init pm_16kb_app_compat_prop:file { getattr open read map };
+#line 93
+
+#line 93
+
+
+
+# Allow init to set/get prefetch boot prop to initiate record/replay
+
+#line 97
+
+#line 97
+allow init property_socket:sock_file write;
+#line 97
+allow init init:unix_stream_socket connectto;
+#line 97
+
+#line 97
+allow init ctl_prefetch_prop:property_service set;
+#line 97
+
+#line 97
+allow init ctl_prefetch_prop:file { getattr open read map };
+#line 97
+
+#line 97
+;
+
+# Allow accessing /sys/kernel/tracing/instances/bootreceiver to set up tracing.
+allow init debugfs_bootreceiver_tracing:file { open append write lock map };
+
+# PRNG seeder daemon socket is created and listened on by init before forking.
+allow init prng_seeder:unix_stream_socket { create bind listen };
+
+# Devices with kernels where CONFIG_HIST_TRIGGERS isn't enabled will
+# attempt to write a non exisiting 'synthetic_events' file, when setting
+# up synthetic events. This is a no-op in tracefs.
+dontaudit init debugfs_tracing_debug:dir { write add_name };
+
+# chown/chmod on devices.
+allow init {
+ dev_type
+ -hw_random_device
+ -keychord_device
+ -vm_manager_device_type
+ -port_device
+}:chr_file setattr;
+
+# /dev/__null__ node created by init.
+allow init tmpfs:chr_file { create setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+#
+# init direct restorecon calls.
+#
+# /dev/kmsg
+allow init tmpfs:chr_file relabelfrom;
+allow init kmsg_device:chr_file { getattr write relabelto };
+# /dev/kmsg_debug
+#line 131
+
+# /mnt/vm, also permissions to mkdir / mount / chmod / chown
+allow init vm_data_file:dir { add_name create search write getattr setattr relabelto mounton };
+
+# allow init to mount and unmount debugfs in debug builds
+#line 138
+
+
+# /dev/__properties__
+allow init properties_device:dir relabelto;
+allow init properties_serial:file { write relabelto };
+allow init property_type:file { append create getattr map open read relabelto rename setattr unlink write };
+# /dev/__properties__/property_info and /dev/__properties/appcompat_override/property_info
+allow init properties_device:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow init property_info:file relabelto;
+# /dev/event-log-tags
+allow init device:file relabelfrom;
+allow init runtime_event_log_tags_file:file { open write setattr relabelto create };
+# /dev/socket
+allow init { device socket_device dm_user_device }:dir relabelto;
+# allow init to establish connection and communicate with lmkd
+
+#line 153
+allow init lmkd_socket:sock_file write;
+#line 153
+allow init lmkd:unix_stream_socket connectto;
+#line 153
+
+# Relabel /dev nodes created in first stage init: /dev/console, /dev/null, /dev/ptmx, /dev/random
+# and /dev/urandom
+allow init { console_device null_device ptmx_device random_device } : chr_file relabelto;
+# /dev/device-mapper, /dev/block(/.*)?
+allow init tmpfs:{ chr_file blk_file } relabelfrom;
+allow init tmpfs:blk_file getattr;
+allow init block_device:{ dir blk_file lnk_file } relabelto;
+allow init dm_device:{ chr_file blk_file } relabelto;
+allow init dm_user_device:chr_file relabelto;
+allow init kernel:fd use;
+# restorecon for early mount device symlinks
+allow init tmpfs:lnk_file { getattr read relabelfrom };
+allow init {
+ metadata_block_device
+ misc_block_device
+ recovery_block_device
+ system_block_device
+ userdata_block_device
+}:{ blk_file lnk_file } relabelto;
+
+allow init dtbo_block_device:lnk_file relabelto;
+allow init super_block_device:lnk_file relabelto;
+
+# Create /mnt/sdcard -> /storage/self/primary symlink.
+allow init mnt_sdcard_file:lnk_file create;
+
+# setrlimit
+allow init self:{ capability cap_userns } sys_resource;
+
+# Remove /dev/.booting and load /debug_ramdisk/* files
+allow init tmpfs:file { getattr unlink };
+
+# Access pty created for fsck.
+allow init devpts:chr_file { read write open };
+
+# Create /dev/fscklogs files.
+allow init fscklogs:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access /dev/__null__ node created prior to initial policy load.
+allow init tmpfs:chr_file write;
+
+# Access /dev/console.
+allow init console_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access /dev/tty0.
+allow init tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Call mount(2).
+allow init self:{ capability cap_userns } sys_admin;
+
+# Call setns(2).
+allow init self:{ capability cap_userns } sys_chroot;
+
+# Create and mount on directories in /.
+allow init rootfs:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init {
+ rootfs
+ cache_file
+ cgroup
+ linkerconfig_file
+ storage_file
+ mnt_user_file
+ system_data_file
+ system_data_root_file
+ system_dlkm_file
+ system_file
+ vendor_file
+ postinstall_mnt_dir
+ mirror_data_file
+ shell_data_file
+}:dir mounton;
+
+# Mount bpf fs on sys/fs/bpf
+allow init fs_bpf:dir mounton;
+
+# Mount on /dev/usb-ffs/adb.
+allow init device:dir mounton;
+
+# Mount tmpfs on /apex
+allow init apex_mnt_dir:dir mounton;
+
+# Bind-mount on /system/apex/com.android.art
+allow init art_apex_dir:dir mounton;
+
+# Create and remove symlinks in /.
+allow init rootfs:lnk_file { create unlink };
+
+# Mount debugfs on /sys/kernel/debug.
+allow init sysfs:dir mounton;
+
+# Create cgroups mount points in tmpfs and mount cgroups on them.
+allow init tmpfs:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init tmpfs:dir mounton;
+allow init cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init cgroup:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow init cgroup_rc_file:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow init cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow init vendor_cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow init cgroup_v2:dir { mounton { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } }};
+allow init cgroup_v2:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# /config
+allow init configfs:dir mounton;
+allow init configfs:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init configfs:{ file lnk_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# /metadata
+allow init metadata_file:dir mounton;
+
+# Run restorecon on /dev
+allow init tmpfs:dir relabelfrom;
+
+# Create directories under /dev/cpuctl after chowning it to system.
+allow init self:{ capability cap_userns } { dac_override dac_read_search };
+
+# Set system clock.
+allow init self:{ capability cap_userns } sys_time;
+
+allow init self:{ capability cap_userns } { sys_rawio mknod };
+
+# Mounting filesystems from block devices.
+allow init dev_type:blk_file { getattr open read ioctl lock map watch watch_reads };
+allowxperm init dev_type:blk_file ioctl 0x0000125d;
+allowxperm init system_data_root_file:dir ioctl 0x587d;
+
+# Mounting filesystems.
+# Only allow relabelto for types used in context= mount options,
+# which should all be assigned the contextmount_type attribute.
+# This can be done in device-specific policy via type or typeattribute
+# declarations.
+allow init {
+ fs_type
+ # BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 286
+-debugfs_type
+#line 286
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 286
+
+}:filesystem ~relabelto;
+
+# Allow init to mount/unmount debugfs in non-user builds.
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 290
+
+#line 290
+
+#line 290
+
+#line 290
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 292
+
+
+# Allow init to mount tracefs in /sys/kernel/tracing
+allow init debugfs_tracing_debug:filesystem mount;
+
+allow init unlabeled:filesystem ~relabelto;
+allow init contextmount_type:filesystem relabelto;
+
+# Allow read-only access to context= mounted filesystems.
+allow init contextmount_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow init contextmount_type:{ file lnk_file sock_file fifo_file } { getattr open read ioctl lock map watch watch_reads };
+
+# restorecon /adb_keys or any other rootfs files and directories to a more
+# specific type.
+allow init rootfs:{ dir file } relabelfrom;
+
+# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
+# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
+# system/core/init.rc requires at least cache_file and data_file_type.
+# init.<board>.rc files often include device-specific types, so
+# we just allow all file types except /system files here.
+allow init self:{ capability cap_userns } { chown fowner fsetid };
+
+allow init {
+ file_type
+ -app_data_file
+
+#line 318
+ -storage_area_dir
+#line 318
+ -storage_area_app_dir
+#line 318
+ -storage_area_content_file
+#line 318
+
+#line 323
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+}:dir { create search getattr open read setattr ioctl };
+
+allow init {
+ file_type
+ -app_data_file
+
+#line 338
+ -storage_area_dir
+#line 338
+ -storage_area_app_dir
+#line 338
+ -storage_area_content_file
+#line 338
+
+#line 343
+ -vm_data_file
+ -bpffs_type
+ -credstore_data_file
+ -exec_type
+ -keystore_data_file
+ -media_userdir_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -system_userdir_file
+ -vendor_file_type
+ -vendor_userdir_file
+ -vold_data_file
+}:dir { write add_name remove_name rmdir relabelfrom };
+
+allow init {
+ file_type
+ -apex_info_file
+ -app_data_file
+
+#line 366
+ -storage_area_dir
+#line 366
+ -storage_area_app_dir
+#line 366
+ -storage_area_content_file
+#line 366
+
+#line 371
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -runtime_event_log_tags_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+ # BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 387
+-debugfs_type
+#line 387
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 387
+
+}:file { create getattr open read write setattr relabelfrom unlink map };
+
+allow init tracefs_type:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+
+# Allow init to read /apex/apex-info-list.xml for preinstalled paths of APEXes to determine
+# subcontext for action/service defined in APEXes.
+allow init apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow init {
+ file_type
+ -app_data_file
+
+#line 399
+ -storage_area_dir
+#line 399
+ -storage_area_app_dir
+#line 399
+ -storage_area_content_file
+#line 399
+
+#line 404
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
+
+allow init {
+ file_type
+ -apex_mnt_dir
+ -app_data_file
+
+#line 425
+ -storage_area_dir
+#line 425
+ -storage_area_app_dir
+#line 425
+ -storage_area_content_file
+#line 425
+
+#line 430
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+}:lnk_file { create getattr setattr relabelfrom unlink };
+
+allow init cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+allow init {
+ file_type
+ -bpffs_type
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -exec_type
+ -app_data_file
+
+#line 457
+ -storage_area_dir
+#line 457
+ -storage_area_app_dir
+#line 457
+ -storage_area_content_file
+#line 457
+
+#line 462
+ -vm_data_file
+ -privapp_data_file
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } relabelto;
+
+allow init { sysfs debugfs debugfs_tracing debugfs_tracing_debug }:{ dir file lnk_file } { getattr relabelfrom };
+allow init { sysfs_type debugfs_type tracefs_type }:{ dir file lnk_file } { relabelto getattr };
+allow init dev_type:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init dev_type:lnk_file create;
+
+# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
+allow init debugfs_tracing:file { open append write lock map };
+
+# Setup and control wifi event tracing (see wifi-events.rc)
+allow init debugfs_tracing_instances:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init debugfs_tracing_instances:file { open append write lock map };
+allow init debugfs_wifi_tracing:file { open append write lock map };
+allow init debugfs_wifi_tracing:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# chown/chmod on pseudo files.
+allow init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -keychord_device
+ -proc_type
+ -sdcard_type
+ -fusefs_type
+ -sysfs_type
+ -rootfs
+ # BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 491
+-debugfs_type
+#line 491
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 491
+
+}:file { open read setattr };
+allow init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+}:dir { open read setattr search };
+
+allow init {
+ binder_device
+ console_device
+ devpts
+ dm_device
+ hwbinder_device
+ input_device
+ kmsg_device
+ null_device
+ owntty_device
+ pmsg_device
+ ptmx_device
+ random_device
+ tty_device
+ zero_device
+}:chr_file { read open };
+
+# Unlabeled file access for upgrades from 4.2.
+allow init unlabeled:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow init unlabeled:{ file lnk_file sock_file fifo_file } { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+
+# Any operation that can modify the kernel ring buffer, e.g. clear
+# or a read that consumes the messages that were read.
+allow init kernel:system syslog_mod;
+allow init self:{ capability2 cap2_userns } syslog;
+
+# init access to /proc.
+
+#line 529
+allow init proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 529
+allow init proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 529
+
+allow init proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 538
+
+
+allow init {
+ proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
+ proc_allocinfo
+ proc_bootconfig
+ proc_cmdline
+ proc_diskstats
+ proc_kmsg # Open /proc/kmsg for logd service.
+ proc_meminfo
+ proc_stat # Read /proc/stat for bootchart.
+ proc_uptime
+ proc_version
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+allow init {
+ proc_abi
+ proc_cpu_alignment
+ proc_dirty
+ proc_hostname
+ proc_hung_task
+ proc_extra_free_kbytes
+ proc_net_type
+ proc_max_map_count
+ proc_min_free_order_shift
+ proc_overcommit_memory # /proc/sys/vm/overcommit_memory
+ proc_panic
+ proc_page_cluster
+ proc_perf
+ proc_sched
+ proc_sysrq
+ proc_watermark_boost_factor
+}:file { open append write lock map };
+
+allow init {
+ proc_security
+}:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# init chmod/chown access to /proc files.
+allow init {
+ proc_allocinfo
+ proc_cmdline
+ proc_bootconfig
+ proc_kmsg
+ proc_net
+ proc_pagetypeinfo
+ proc_qtaguid_stat
+ proc_slabinfo
+ proc_sysrq
+ proc_qtaguid_ctrl
+ proc_vmallocinfo
+}:file setattr;
+
+# init access to /sys files.
+allow init {
+ sysfs_android_usb
+ sysfs_dm_verity
+ sysfs_leds
+ sysfs_power
+ sysfs_fs_f2fs
+ sysfs_dm
+ sysfs_lru_gen_enabled
+ sysfs_pgsize_migration
+}:file { open append write lock map };
+
+allow init {
+ sysfs_dt_firmware_android
+ sysfs_fs_ext4_features
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+allow init {
+ sysfs_zram
+}:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# allow init to create loop devices with /dev/loop-control
+allow init loop_control_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow init loop_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm init loop_device:blk_file ioctl {
+ 0x00004c00
+ 0x00004c01
+ 0x00004c82
+ 0x00004c09
+ 0x00004c08
+ 0x00004c03
+ 0x00004c04
+};
+
+# Allow init to write to vibrator/trigger
+allow init sysfs_vibrator:file { open append write lock map };
+
+# init chmod/chown access to /sys files.
+allow init {
+ sysfs_android_usb
+ sysfs_devices_system_cpu
+ sysfs_firmware_acpi_tables
+ sysfs_ipv4
+ sysfs_leds
+ sysfs_lowmemorykiller
+ sysfs_power
+ sysfs_vibrator
+ sysfs_wake_lock
+ sysfs_zram
+}:file setattr;
+
+# Set usermodehelpers.
+allow init { usermodehelper sysfs_usermodehelper }:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow init self:{ capability cap_userns } net_admin;
+
+# Reboot.
+allow init self:{ capability cap_userns } sys_boot;
+
+# Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd".
+# Init will also walk through the directory as part of a recursive restorecon.
+allow init misc_logd_file:dir { add_name open create read getattr setattr search write };
+allow init misc_logd_file:file { open create getattr setattr write };
+
+# Support "adb shell stop"
+allow init self:{ capability cap_userns } kill;
+allow init domain:process { getpgid sigkill signal };
+
+# Init creates credstore's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init credstore_data_file:dir { open create read getattr setattr search };
+allow init credstore_data_file:file { getattr };
+
+# Init creates keystore's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init keystore_data_file:dir { open create read getattr setattr search };
+allow init keystore_data_file:file { getattr };
+
+# Init creates vold's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init vold_data_file:dir { open create read getattr setattr search };
+allow init vold_data_file:file { getattr };
+
+# Init creates /data/local/tmp at boot
+allow init shell_data_file:dir { open create read getattr setattr search };
+allow init shell_data_file:file { getattr };
+
+# Set UID, GID, and adjust capability bounding set for services.
+allow init self:{ capability cap_userns } { setuid setgid setpcap };
+
+# For bootchart to read the /proc/$pid/cmdline file of each process,
+# we need to have following line to allow init to have access
+# to different domains.
+
+#line 684
+allow init domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 684
+allow init domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 684
+
+
+# Use setexeccon(), setfscreatecon(), and setsockcreatecon().
+# setexec is for services with seclabel options.
+# setfscreate is for labeling directories and socket files.
+# setsockcreate is for labeling local/unix domain sockets.
+allow init self:process { setexec setfscreate setsockcreate };
+
+# Get file context
+allow init file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# sepolicy access
+allow init sepolicy_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Perform SELinux access checks on setting properties.
+
+#line 699
+
+#line 699
+allow init selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 699
+allow init selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 699
+
+#line 699
+allow init selinuxfs:file { open append write lock map };
+#line 699
+allow init kernel:security compute_av;
+#line 699
+allow init self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 699
+
+
+# Ask the kernel for the new context on services to label their sockets.
+allow init kernel:security compute_create;
+
+# Create sockets for the services.
+allow init domain:unix_stream_socket { create bind setopt };
+allow init domain:unix_dgram_socket { create bind setopt };
+
+# Create /data/property and files within it.
+allow init property_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init property_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Set any property.
+allow init property_type:property_service set;
+
+# Send an SELinux userspace denial to the kernel audit subsystem,
+# so it can be picked up and processed by logd. These denials are
+# generated when an attempt to set a property is denied by policy.
+allow init self:netlink_audit_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_relay };
+allow init self:{ capability cap_userns } audit_write;
+
+# Run "ifup lo" to bring up the localhost interface
+allow init self:udp_socket { create ioctl };
+# in addition to unpriv ioctls granted to all domains, init also needs:
+allowxperm init self:udp_socket ioctl 0x00008914;
+allow init self:{ capability cap_userns } net_raw;
+
+# Set scheduling info for psi monitor thread.
+# TODO: delete or revise this line b/131761776
+allow init kernel:process { getsched setsched };
+
+# swapon() needs write access to swap device
+# system/core/fs_mgr/fs_mgr.c - fs_mgr_swapon_all
+allow init swap_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# Allow to change group owner and permissions for new swap setup in mmd
+allow init swap_block_device:blk_file setattr;
+
+# Create and access /dev files without a specific type,
+# e.g. /dev/.coldboot_done, /dev/.booting
+# TODO: Move these files into their own type unless they are
+# only ever accessed by init.
+allow init device:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# keychord retrieval from /dev/input/ devices
+allow init input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow init input_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access device mapper for setting up dm-verity
+allow init dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow init dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access dm-user for OTA boot
+allow init dm_user_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access metadata block device for storing dm-verity state
+allow init metadata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read /sys/fs/pstore/console-ramoops to detect restarts caused
+# by dm-verity detecting corrupted blocks
+allow init pstorefs:dir search;
+allow init pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+allow init kernel:system syslog_read;
+
+# linux keyring configuration
+allow init init:key { write search setattr };
+
+# Allow init to create /data/unencrypted
+allow init unencrypted_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# Set encryption policy on dirs in /data
+allowxperm init { data_file_type unlabeled }:dir ioctl {
+ 0x400c6615
+ 0x800c6613
+};
+
+# Raw writes to misc block device
+allow init misc_block_device:blk_file { open append write lock map };
+
+
+#line 778
+allow init system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 778
+allow init system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 778
+
+
+#line 779
+allow init system_dlkm_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 779
+allow init system_dlkm_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 779
+
+
+#line 780
+allow init vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 780
+allow init vendor_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 780
+
+
+allow init system_data_file:file { getattr read };
+allow init system_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# For init to be able to run shell scripts from vendor
+allow init vendor_shell_exec:file execute;
+
+# Metadata setup
+allow init vold_metadata_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init vold_metadata_file:file getattr;
+allow init metadata_bootstat_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow init metadata_bootstat_file:file { open append write lock map };
+allow init userspace_reboot_metadata_file:file { open append write lock map };
+
+# Allow init to touch PSI monitors
+allow init proc_pressure_mem:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } setattr };
+
+# init is using bootstrap bionic
+
+#line 799
+ allow init system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 799
+ allow init system_bootstrap_lib_file:file { execute read open getattr map };
+#line 799
+
+
+# stat the root dir of fuse filesystems (for the mount handler)
+allow init fuse:dir { search getattr };
+
+# allow filesystem tuning
+allow init userdata_sysdev:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow disk tuning
+allow init rootdisk_sysdev:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+###
+### neverallow rules
+###
+
+# The init domain is only entered via an exec based transition from the
+# kernel domain, never via setcon().
+neverallow domain init:process dyntransition;
+neverallow { domain -kernel } init:process transition;
+neverallow init { file_type fs_type -init_exec }:file entrypoint;
+
+# Never read/follow symlinks created by shell or untrusted apps.
+neverallow init shell_data_file:lnk_file read;
+neverallow init app_data_file_type:lnk_file read;
+
+# init should never execute a program without changing to another domain.
+neverallow init { file_type fs_type }:file execute_no_trans;
+
+# The use of sensitive environment variables, such as LD_PRELOAD, is disallowed
+# when init is executing other binaries. The use of LD_PRELOAD for init spawned
+# services is generally considered a no-no, as it injects libraries which the
+# binary was not expecting. This is especially problematic for APEXes. The use
+# of LD_PRELOAD via APEXes is a layering violation, and inappropriately loads
+# code into a process which wasn't expecting that code, with potentially
+# unexpected side effects. (b/140789528)
+neverallow init *:process noatsecure;
+
+# init can never add binder services
+neverallow init service_manager_type:service_manager { add find };
+# init can never list binder services
+neverallow init servicemanager:service_manager list;
+
+# Init should not be creating subdirectories in /data/local/tmp
+neverallow init shell_data_file:dir { write add_name remove_name };
+
+# Init should not access sysfs node that are not explicitly labeled.
+neverallow init sysfs:file { open write };
+
+# No domain should be allowed to ptrace init.
+neverallow * init:process ptrace;
+
+# init owns the root of /data
+# TODO(b/140259336) We want to remove vendor_init
+# TODO(b/141108496) We want to remove toolbox
+neverallow { domain -init -toolbox -vendor_init -vold } system_data_root_file:dir { write add_name remove_name };
+
+# Only init is allowed to set userspace reboot related properties.
+neverallow { domain -init } userspace_reboot_exported_prop:property_service set;
+
+neverallow init self:perf_event { kernel tracepoint read write };
+dontaudit init self:perf_event { kernel tracepoint read write };
+
+# Only init is allowed to set the sysprop indicating whether perf_event_open()
+# SELinux hooks were detected.
+neverallow { domain -init } init_perf_lsm_hooks_prop:property_service set;
+
+# Only init can write vts.native_server.on
+neverallow { domain -init } vts_status_prop:property_service set;
+
+# Only init can write normal ro.boot. properties
+neverallow { domain -init } bootloader_prop:property_service set;
+
+# Only init can write hal.instrumentation.enable
+neverallow { domain -init } hal_instrumentation_prop:property_service set;
+
+# Only init can write ro.property_service.version
+neverallow { domain -init } property_service_version_prop:property_service set;
+
+# Only init can set keystore.boot_level
+neverallow { domain -init } keystore_listen_prop:property_service set;
+#line 1 "system/sepolicy/private/inputflinger.te"
+typeattribute inputflinger coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init inputflinger_exec:file { getattr open read execute map };
+#line 3
+allow init inputflinger:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow inputflinger inputflinger_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init inputflinger:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init inputflinger:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init inputflinger_exec:process inputflinger;
+#line 3
+
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow inputflinger servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager inputflinger:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager inputflinger:dir search;
+#line 5
+allow servicemanager inputflinger:file { read open };
+#line 5
+allow servicemanager inputflinger:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+#line 6
+typeattribute inputflinger binderservicedomain;
+#line 6
+
+
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow inputflinger system_server:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow system_server inputflinger:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow inputflinger system_server:fd use;
+#line 8
+
+
+
+#line 10
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 10
+# deprecated.
+#line 10
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 10
+allow inputflinger sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 10
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 10
+allow inputflinger self:{ capability2 cap2_userns } block_suspend;
+#line 10
+# system_suspend permissions
+#line 10
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow inputflinger system_suspend_server:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow system_suspend_server inputflinger:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow inputflinger system_suspend_server:fd use;
+#line 10
+
+#line 10
+allow inputflinger system_suspend_hwservice:hwservice_manager find;
+#line 10
+# halclientdomain permissions
+#line 10
+
+#line 10
+# Call the hwservicemanager and transfer references to it.
+#line 10
+allow inputflinger hwservicemanager:binder { call transfer };
+#line 10
+# Allow hwservicemanager to send out callbacks
+#line 10
+allow hwservicemanager inputflinger:binder { call transfer };
+#line 10
+# hwservicemanager performs getpidcon on clients.
+#line 10
+allow hwservicemanager inputflinger:dir search;
+#line 10
+allow hwservicemanager inputflinger:file { read open map };
+#line 10
+allow hwservicemanager inputflinger:process getattr;
+#line 10
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+#line 10
+
+#line 10
+allow inputflinger hwservicemanager_prop:file { getattr open read map };
+#line 10
+
+#line 10
+allow inputflinger hidl_manager_hwservice:hwservice_manager find;
+#line 10
+# AIDL suspend hal permissions
+#line 10
+allow inputflinger hal_system_suspend_service:service_manager find;
+#line 10
+
+#line 10
+# Call the servicemanager and transfer references to it.
+#line 10
+allow inputflinger servicemanager:binder { call transfer };
+#line 10
+# Allow servicemanager to send out callbacks
+#line 10
+allow servicemanager inputflinger:binder { call transfer };
+#line 10
+# servicemanager performs getpidcon on clients.
+#line 10
+allow servicemanager inputflinger:dir search;
+#line 10
+allow servicemanager inputflinger:file { read open };
+#line 10
+allow servicemanager inputflinger:process getattr;
+#line 10
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+#line 10
+
+
+allow inputflinger input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow inputflinger input_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 15
+allow inputflinger cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow inputflinger cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+
+#line 16
+allow inputflinger cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow inputflinger cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 16
+
+#line 1 "system/sepolicy/private/installd.te"
+typeattribute installd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init installd_exec:file { getattr open read execute map };
+#line 3
+allow init installd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow installd installd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init installd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init installd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init installd_exec:process installd;
+#line 3
+
+#line 3
+
+
+# Run migrate_legacy_obb_data.sh in its own sandbox.
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow installd migrate_legacy_obb_data_exec:file { getattr open read execute map };
+#line 6
+allow installd migrate_legacy_obb_data:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow migrate_legacy_obb_data migrate_legacy_obb_data_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+allow migrate_legacy_obb_data installd:process sigchld;
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit installd migrate_legacy_obb_data:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow installd migrate_legacy_obb_data:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition installd migrate_legacy_obb_data_exec:process migrate_legacy_obb_data;
+#line 6
+
+allow installd shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Run dex2oat in its own sandbox.
+
+#line 10
+# Allow the necessary permissions.
+#line 10
+
+#line 10
+# Old domain may exec the file and transition to the new domain.
+#line 10
+allow installd dex2oat_exec:file { getattr open read execute map };
+#line 10
+allow installd dex2oat:process transition;
+#line 10
+# New domain is entered by executing the file.
+#line 10
+allow dex2oat dex2oat_exec:file { entrypoint open read execute getattr map };
+#line 10
+# New domain can send SIGCHLD to its caller.
+#line 10
+allow dex2oat installd:process sigchld;
+#line 10
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 10
+dontaudit installd dex2oat:process noatsecure;
+#line 10
+# XXX dontaudit candidate but requires further study.
+#line 10
+allow installd dex2oat:process { siginh rlimitinh };
+#line 10
+
+#line 10
+# Make the transition occur by default.
+#line 10
+type_transition installd dex2oat_exec:process dex2oat;
+#line 10
+
+
+# Run profman in its own sandbox.
+
+#line 13
+# Allow the necessary permissions.
+#line 13
+
+#line 13
+# Old domain may exec the file and transition to the new domain.
+#line 13
+allow installd profman_exec:file { getattr open read execute map };
+#line 13
+allow installd profman:process transition;
+#line 13
+# New domain is entered by executing the file.
+#line 13
+allow profman profman_exec:file { entrypoint open read execute getattr map };
+#line 13
+# New domain can send SIGCHLD to its caller.
+#line 13
+allow profman installd:process sigchld;
+#line 13
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 13
+dontaudit installd profman:process noatsecure;
+#line 13
+# XXX dontaudit candidate but requires further study.
+#line 13
+allow installd profman:process { siginh rlimitinh };
+#line 13
+
+#line 13
+# Make the transition occur by default.
+#line 13
+type_transition installd profman_exec:process profman;
+#line 13
+
+
+# Run idmap in its own sandbox.
+
+#line 16
+# Allow the necessary permissions.
+#line 16
+
+#line 16
+# Old domain may exec the file and transition to the new domain.
+#line 16
+allow installd idmap_exec:file { getattr open read execute map };
+#line 16
+allow installd idmap:process transition;
+#line 16
+# New domain is entered by executing the file.
+#line 16
+allow idmap idmap_exec:file { entrypoint open read execute getattr map };
+#line 16
+# New domain can send SIGCHLD to its caller.
+#line 16
+allow idmap installd:process sigchld;
+#line 16
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 16
+dontaudit installd idmap:process noatsecure;
+#line 16
+# XXX dontaudit candidate but requires further study.
+#line 16
+allow installd idmap:process { siginh rlimitinh };
+#line 16
+
+#line 16
+# Make the transition occur by default.
+#line 16
+type_transition installd idmap_exec:process idmap;
+#line 16
+
+
+# For collecting bugreports.
+allow installd dumpstate:fd use;
+allow installd dumpstate:fifo_file { getattr open read ioctl lock map watch watch_reads };
+
+# Delete /system/bin/bcc generated artifacts
+allow installd app_exec_data_file:file unlink;
+
+# Capture userdata snapshots to /data/misc_[ce|de]/rollback and
+# subsequently restore them.
+allow installd rollback_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd rollback_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow installd to access the runtime feature flag properties.
+
+#line 31
+allow installd device_config_runtime_native_prop:file { getattr open read map };
+#line 31
+
+
+#line 32
+allow installd device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 32
+
+
+# Allow installd to access apk verity feature flag (for legacy case).
+
+#line 35
+allow installd apk_verity_prop:file { getattr open read map };
+#line 35
+
+
+# Allow installd to access odsign verification status
+
+#line 38
+allow installd odsign_prop:file { getattr open read map };
+#line 38
+
+
+# Allow installd to delete files in /data/staging
+allow installd staging_data_file:file unlink;
+allow installd staging_data_file:dir { open read add_name remove_name rename rmdir search write getattr };
+
+# Allow installd manage dirs in /data/misc_ce/0/sdksandbox
+allow installd sdk_sandbox_system_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+
+# Allow installd to enable fs-verity for app file passed as FD;
+allow installd { untrusted_app_all priv_app gmscore_app }:fd use;
+allowxperm installd app_data_file_type:file ioctl 0x6685;
+
+typeattribute installd mlstrustedsubject;
+allow installd self:{ capability cap_userns } { chown dac_override dac_read_search fowner fsetid setgid setuid sys_admin kill };
+
+# Allow labeling of files under /data/app/com.example/oat/
+allow installd dalvikcache_data_file:dir relabelto;
+allow installd dalvikcache_data_file:file { relabelto link };
+
+# Allow movement of APK files between volumes
+allow installd apk_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow installd apk_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom link };
+allow installd apk_data_file:lnk_file { create { getattr open read ioctl lock map watch watch_reads } unlink };
+
+allow installd asec_apk_file:file { getattr open read ioctl lock map watch watch_reads };
+allow installd apk_tmp_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow installd apk_tmp_file:dir { relabelfrom { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } };
+allow installd oemfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow installd oemfs:file { getattr open read ioctl lock map watch watch_reads };
+allow installd cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd mnt_expand_file:dir { search getattr };
+# Check validity of SELinux context before use.
+
+#line 72
+
+#line 72
+allow installd selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 72
+allow installd selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 72
+
+#line 72
+allow installd selinuxfs:file { open append write lock map };
+#line 72
+allow installd kernel:security check_context;
+#line 72
+
+
+
+#line 74
+allow installd rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 74
+allow installd rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 74
+
+# Scan through APKs in /system/app and /system/priv-app
+
+#line 76
+allow installd system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 76
+allow installd system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 76
+
+# Scan through APKs in /vendor/app
+
+#line 78
+allow installd vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 78
+allow installd vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 78
+
+# Scan through JARs in /vendor/framework
+
+#line 80
+allow installd vendor_framework_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 80
+allow installd vendor_framework_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 80
+
+# Scan through Runtime Resource Overlay APKs in /vendor/overlay
+
+#line 82
+allow installd vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 82
+allow installd vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 82
+
+# Vendor overlay can be found in vendor apex
+allow installd vendor_apex_metadata_file:dir { getattr search };
+# Get file context
+allow installd file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# Get seapp_context
+allow installd seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Search /data/app-asec and stat files in it.
+allow installd asec_image_file:dir search;
+allow installd asec_image_file:file getattr;
+
+# Required to initially create subdirectories of /data/user/$userId
+# and lib symlinks before the setfilecon call. May want to
+# move symlink creation after setfilecon in installd.
+allow installd system_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+# Also, allow read for lnk_file so that we can process symlinks within
+# /data/user/$userId when optimizing application code.
+allow installd system_data_file:lnk_file { create getattr read setattr unlink };
+
+# Manage lower filesystem via pass_through mounts
+allow installd mnt_pass_through_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Upgrade /data/media for multi-user if necessary.
+allow installd media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd media_rw_data_file:file { getattr unlink };
+# restorecon new /data/media directory.
+allow installd system_data_file:dir relabelfrom;
+allow installd media_rw_data_file:dir relabelto;
+
+# Delete /data/media files through sdcardfs, instead of going behind its back
+allow installd media_userdir_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow installd tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow installd storage_file:dir search;
+allow installd { sdcard_type fuse }:dir { search open read write remove_name getattr rmdir };
+allow installd { sdcard_type fuse }:file { getattr unlink };
+
+# Create app's mirror data directory in /data_mirror, and bind mount the real directory to it
+allow installd mirror_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+
+# Upgrade /data/misc/keychain for multi-user if necessary.
+allow installd system_userdir_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow installd misc_user_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd misc_user_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow installd keychain_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd keychain_data_file:file {{ getattr open read ioctl lock map watch watch_reads } unlink};
+
+# Create /data/misc/installd/layout_version.* file
+allow installd install_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow installd install_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Create files under /data/dalvik-cache.
+allow installd dalvikcache_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow installd dalvikcache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow installd dalvikcache_data_file:lnk_file getattr;
+
+# Create files under /data/resource-cache.
+allow installd resourcecache_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow installd resourcecache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Upgrade from unlabeled userdata.
+# Just need enough to remove and/or relabel it.
+allow installd unlabeled:dir { getattr search relabelfrom { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } rmdir };
+allow installd unlabeled:{ file lnk_file sock_file fifo_file } { getattr relabelfrom rename unlink setattr };
+# Read pkg.apk file for input during dexopt.
+allow installd unlabeled:file { getattr open read ioctl lock map watch watch_reads };
+
+# Upgrade from before system_app_data_file was used for system UID apps.
+# Just need enough to relabel it and to unlink removed package files.
+# Directory access covered by earlier rule above.
+allow installd system_data_file:{ file lnk_file sock_file fifo_file } { getattr relabelfrom unlink };
+
+# Manage /data/data subdirectories, including initially labeling them
+# upon creation via setfilecon or running restorecon_recursive,
+# setting owner/mode, creating symlinks within them, and deleting them
+# upon package uninstall.
+allow installd app_data_file_type:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom relabelto };
+allow installd app_data_file_type:{ file lnk_file sock_file fifo_file } { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom relabelto };
+
+# Allow setting extended attributes (for project quota IDs) on dirs and files
+# and to enable project ID inheritance through FS_IOC_SETFLAGS
+# Added install_data_file to be able to create file under /data/misc/installd/ioctl_check
+allowxperm installd { app_data_file_type system_data_file install_data_file}:{ dir file } ioctl {
+ 0x801c581f
+ 0x401c5820
+ 0x80086601
+ 0x40086602
+};
+
+# Similar for the files under /data/misc/profiles/
+allow installd user_profile_root_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow installd user_profile_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow installd user_profile_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow installd user_profile_data_file:file unlink;
+
+# Allow zygote to unmount mirror directories
+allow installd labeledfs:filesystem unmount;
+
+# Files created/updated by profman dumps.
+allow installd profman_dump_data_file:dir { search add_name write };
+allow installd profman_dump_data_file:file { create setattr open write };
+
+# Create and use pty created by android_fork_execvp().
+allow installd devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# execute toybox for app relocation
+allow installd toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow installd to publish a binder service and make binder calls.
+
+#line 191
+# Call the servicemanager and transfer references to it.
+#line 191
+allow installd servicemanager:binder { call transfer };
+#line 191
+# Allow servicemanager to send out callbacks
+#line 191
+allow servicemanager installd:binder { call transfer };
+#line 191
+# servicemanager performs getpidcon on clients.
+#line 191
+allow servicemanager installd:dir search;
+#line 191
+allow servicemanager installd:file { read open };
+#line 191
+allow servicemanager installd:process getattr;
+#line 191
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 191
+# all domains in domain.te.
+#line 191
+
+
+#line 192
+ allow installd installd_service:service_manager { add find };
+#line 192
+ neverallow { domain -installd } installd_service:service_manager add;
+#line 192
+
+#line 192
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 192
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 192
+
+#line 192
+
+allow installd dumpstate:fifo_file { getattr write };
+
+# Allow installd to call into the system server so it can check permissions.
+
+#line 196
+# Call the server domain and optionally transfer references to it.
+#line 196
+allow installd system_server:binder { call transfer };
+#line 196
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 196
+allow system_server installd:binder transfer;
+#line 196
+# Receive and use open files from the server.
+#line 196
+allow installd system_server:fd use;
+#line 196
+
+allow installd permission_service:service_manager find;
+
+# Allow installd to read and write quotas
+allow installd block_device:dir { search };
+allow installd labeledfs:filesystem { quotaget quotamod };
+
+# Allow installd to delete from /data/preloads when trimming data caches
+# TODO b/34690396 Remove when time-based purge policy for preloads is implemented in system_server
+allow installd preloads_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow installd preloads_data_file:dir { { open getattr read search ioctl lock watch watch_reads } write remove_name rmdir };
+allow installd preloads_media_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow installd preloads_media_file:dir { { open getattr read search ioctl lock watch watch_reads } write remove_name rmdir };
+
+# Allow installd to read /proc/filesystems
+allow installd proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+#add for move app to sd card
+
+#line 214
+allow installd storage_config_prop:file { getattr open read map };
+#line 214
+
+
+# Allow installd to access apps installed on the Incremental File System
+# Accessing files on the Incremental File System uses fds opened in the context of vold.
+allow installd vold:fd use;
+
+# on app uninstall, installd deletes the storage area keys for the app
+
+#line 221
+ allow installd storage_area_key_file:dir {
+#line 221
+ open search write remove_name
+#line 221
+ lock read getattr rmdir
+#line 221
+ };
+#line 221
+ allow installd storage_area_key_file:file unlink;
+#line 227
+
+
+# Allow installd to delete the terminal app's data file.
+# `virtualizationservice_data_file` was used for a while, but it needs to be
+# deleted when terminal feature is disabled.
+# TODO(b/383026786): Remove this rule once the there is no
+# `virtualizationservice_data_file` in terminal app anymore..
+allow installd virtualizationservice_data_file:file unlink;
+
+###
+### Neverallow rules
+###
+
+# only system_server, installd, dumpstate, and servicemanager may interact with installd over binder
+neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
+neverallow { domain -system_server -dumpstate -servicemanager } installd:binder call;
+neverallow installd {
+ domain
+ -system_server
+ -servicemanager
+
+}:binder call;
+#line 1 "system/sepolicy/private/isolated_app.te"
+###
+### isolated_apps.
+###
+### This file defines the rules for isolated apps that does not wish to use
+### service managers and does not require extra computational resources.
+###
+
+typeattribute isolated_app coredomain;
+
+
+#line 10
+typeattribute isolated_app appdomain;
+#line 10
+# Label tmpfs objects for all apps.
+#line 10
+type_transition isolated_app tmpfs:file appdomain_tmpfs;
+#line 10
+
+#line 10
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 10
+type isolated_app_userfaultfd;
+#line 10
+type_transition isolated_app isolated_app:anon_inode isolated_app_userfaultfd "[userfaultfd]";
+#line 10
+# Allow domain to create/use userfaultfd anon_inode.
+#line 10
+allow isolated_app isolated_app_userfaultfd:anon_inode { create ioctl read };
+#line 10
+# Suppress errors generate during bugreport
+#line 10
+dontaudit su isolated_app_userfaultfd:anon_inode *;
+#line 10
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 10
+neverallow { domain -isolated_app } isolated_app_userfaultfd:anon_inode *;
+#line 10
+
+#line 10
+allow isolated_app appdomain_tmpfs:file { execute getattr map read write };
+#line 10
+neverallow { isolated_app -runas_app -shell -simpleperf } { domain -isolated_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 10
+neverallow { appdomain -runas_app -shell -simpleperf -isolated_app } isolated_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 10
+# The Android security model guarantees the confidentiality and integrity
+#line 10
+# of application data and execution state. Ptrace bypasses those
+#line 10
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 10
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 10
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 10
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 10
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 10
+# live lock conditions.
+#line 10
+neverallow { domain -isolated_app -crash_dump -runas_app -simpleperf } isolated_app:process ptrace;
+#line 10
+
+
+#line 11
+typeattribute isolated_app isolated_app_all;
+#line 11
+
+
+allow isolated_app webviewupdate_service:service_manager find;
+
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps
+# by other processes. Open should never be allowed, and is blocked by
+# neverallow rules in isolated_app_all attribute.
+# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs
+# is modified to change the secontext when accessing the lower filesystem.
+allow isolated_app { sdcard_type fuse media_rw_data_file }:file { read write append getattr lock map };
+
+# For webviews, isolated_app processes can be forked from the webview_zygote
+# in addition to the zygote. Allow access to resources inherited from the
+# webview_zygote process. These rules are specialized copies of the ones in app.te.
+# Inherit FDs from the webview_zygote.
+allow isolated_app webview_zygote:fd use;
+# Notify webview_zygote of child death.
+allow isolated_app webview_zygote:process sigchld;
+# Inherit logd write socket.
+allow isolated_app webview_zygote:unix_dgram_socket write;
+# Read system properties managed by webview_zygote.
+allow isolated_app webview_zygote_tmpfs:file read;
+#line 1 "system/sepolicy/private/isolated_app_all.te"
+###
+### isolated_app_all.
+###
+### Services with isolatedProcess=true in their manifest.
+###
+### This file defines the rules shared by all isolated apps. An "isolated
+### app" is an APP with UID between AID_ISOLATED_START (99000)
+### and AID_ISOLATED_END (99999).
+###
+
+# Access already open app data files received over Binder or local socket IPC.
+allow isolated_app_all { app_data_file privapp_data_file sdk_sandbox_data_file}:file { append read write getattr lock map };
+
+allow isolated_app_all activity_service:service_manager find;
+allow isolated_app_all display_service:service_manager find;
+
+# Google Breakpad (crash reporter for Chrome) relies on ptrace
+# functionality. Without the ability to ptrace, the crash reporter
+# tool is broken.
+# b/20150694
+# https://code.google.com/p/chromium/issues/detail?id=475270
+allow isolated_app_all self:process ptrace;
+
+# Inherit FDs from the app_zygote.
+allow isolated_app_all app_zygote:fd use;
+# Notify app_zygote of child death.
+allow isolated_app_all app_zygote:process sigchld;
+# Inherit logd write socket.
+allow isolated_app_all app_zygote:unix_dgram_socket write;
+
+# TODO (b/63631799) fix this access
+# suppress denials to /data/local/tmp
+dontaudit isolated_app_all shell_data_file:dir search;
+
+# Allow to read, map (but not open) staged apks.
+allow isolated_app_all { apk_tmp_file apk_private_tmp_file }:file { read getattr map };
+
+#####
+##### Neverallow
+#####
+
+# Isolated apps should not directly open app data files themselves.
+neverallow isolated_app_all app_data_file_type:file open;
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+# TODO: are there situations where isolated_apps write to this file?
+# TODO: should we tighten these restrictions further?
+neverallow isolated_app_all anr_data_file:file ~{ open append };
+neverallow isolated_app_all anr_data_file:dir ~search;
+
+# Isolated apps must not be permitted to use HwBinder
+neverallow { isolated_app_all -isolated_compute_app } hwbinder_device:chr_file *;
+neverallow { isolated_app_all -isolated_compute_app } *:hwservice_manager *;
+
+# Isolated apps must not be permitted to use VndBinder
+neverallow isolated_app_all vndbinder_device:chr_file *;
+
+# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager
+# except the find actions for services allowlisted below.
+neverallow { isolated_app_all -isolated_compute_app } *:service_manager ~find;
+
+# b/17487348
+# Isolated apps can only access three services,
+# activity_service, display_service, webviewupdate_service.
+neverallow { isolated_app_all -isolated_compute_app } {
+ service_manager_type
+ -activity_service
+ -display_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps shouldn't be able to access the driver directly.
+neverallow { isolated_app_all -isolated_compute_app } gpu_device:chr_file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } execute };
+
+# Do not allow isolated_apps access to /cache
+neverallow isolated_app_all cache_file:dir ~{ { open getattr read search ioctl lock watch watch_reads } };
+neverallow isolated_app_all cache_file:file ~{ read getattr };
+
+# Do not allow isolated_app_all to access external storage, except for files passed
+# via file descriptors (b/32896414).
+neverallow isolated_app_all { storage_file mnt_user_file sdcard_type fuse }:dir ~getattr;
+neverallow isolated_app_all { storage_file mnt_user_file }:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } *;
+neverallow isolated_app_all { sdcard_type fuse }:{ { chr_file blk_file } lnk_file sock_file fifo_file } *;
+neverallow isolated_app_all { sdcard_type fuse }:file ~{ read write append getattr lock map };
+
+# Do not allow USB access
+neverallow isolated_app_all { usb_device usbaccessory_device }:chr_file *;
+
+# Restrict the webview_zygote control socket.
+neverallow isolated_app_all webview_zygote:sock_file write;
+
+# Limit the /sys files which isolated_app_all can access. This is important
+# for controlling isolated_app_all attack surface.
+# TODO (b/266555480): The permission should be guarded by compliance test.
+# Remove the negation for member domains when refactorization is done.
+neverallow { isolated_app_all -isolated_compute_app } {
+ sysfs_type
+ -sysfs_devices_system_cpu
+ -sysfs_transparent_hugepage
+ -sysfs_usb # TODO: check with audio team if needed for isolated_apps (b/28417852)
+ -sysfs_fs_fuse_features
+ -sysfs_fs_incfs_features
+ -sysfs_pgsize_migration
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# No creation of sockets families other than AF_UNIX sockets.
+# List taken from system/sepolicy/public/global_macros - socket_class_set
+# excluding unix_stream_socket and unix_dgram_socket.
+# Many of these are socket families which have never and will never
+# be compiled into the Android kernel.
+neverallow isolated_app_all { self ephemeral_app priv_app sdk_sandbox_all untrusted_app_all }:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket
+ key_socket appletalk_socket netlink_route_socket
+ netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket
+ netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket
+ netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket
+ netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket
+ netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket
+ rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket
+ ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket
+ qipcrtr_socket smc_socket xdp_socket
+} create;
+#line 1 "system/sepolicy/private/isolated_compute_app.te"
+###
+### isolated_compute_apps.
+###
+### This file defines the rules for isolated apps that requires the permission
+### to gather data with service manager and require computational resources to
+### improve the performance to process data under a sandbox. This
+### isolated_compute_app restricts data egress to protect the privacy.
+###
+### TODO(b/266923392): Clean rules for isolated_compute_app characteristics
+###
+
+typeattribute isolated_compute_app coredomain;
+
+
+#line 14
+typeattribute isolated_compute_app appdomain;
+#line 14
+# Label tmpfs objects for all apps.
+#line 14
+type_transition isolated_compute_app tmpfs:file appdomain_tmpfs;
+#line 14
+
+#line 14
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 14
+type isolated_compute_app_userfaultfd;
+#line 14
+type_transition isolated_compute_app isolated_compute_app:anon_inode isolated_compute_app_userfaultfd "[userfaultfd]";
+#line 14
+# Allow domain to create/use userfaultfd anon_inode.
+#line 14
+allow isolated_compute_app isolated_compute_app_userfaultfd:anon_inode { create ioctl read };
+#line 14
+# Suppress errors generate during bugreport
+#line 14
+dontaudit su isolated_compute_app_userfaultfd:anon_inode *;
+#line 14
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 14
+neverallow { domain -isolated_compute_app } isolated_compute_app_userfaultfd:anon_inode *;
+#line 14
+
+#line 14
+allow isolated_compute_app appdomain_tmpfs:file { execute getattr map read write };
+#line 14
+neverallow { isolated_compute_app -runas_app -shell -simpleperf } { domain -isolated_compute_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 14
+neverallow { appdomain -runas_app -shell -simpleperf -isolated_compute_app } isolated_compute_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 14
+# The Android security model guarantees the confidentiality and integrity
+#line 14
+# of application data and execution state. Ptrace bypasses those
+#line 14
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 14
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 14
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 14
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 14
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 14
+# live lock conditions.
+#line 14
+neverallow { domain -isolated_compute_app -crash_dump -runas_app -simpleperf } isolated_compute_app:process ptrace;
+#line 14
+
+
+#line 15
+typeattribute isolated_compute_app isolated_app_all;
+#line 15
+
+
+allow isolated_compute_app isolated_compute_allowed_service:service_manager find;
+allow isolated_compute_app isolated_compute_allowed_device:chr_file { read write ioctl map };
+
+# Enable access to hardware services for camera functionalilites
+
+#line 21
+typeattribute isolated_compute_app halclientdomain;
+#line 21
+typeattribute isolated_compute_app hal_allocator_client;
+#line 21
+
+#line 21
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 21
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 21
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 21
+
+#line 21
+typeattribute isolated_compute_app hal_allocator;
+#line 21
+# Find passthrough HAL implementations
+#line 21
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 21
+
+#line 21
+
+
+#line 22
+# Call the hwservicemanager and transfer references to it.
+#line 22
+allow isolated_compute_app hwservicemanager:binder { call transfer };
+#line 22
+# Allow hwservicemanager to send out callbacks
+#line 22
+allow hwservicemanager isolated_compute_app:binder { call transfer };
+#line 22
+# hwservicemanager performs getpidcon on clients.
+#line 22
+allow hwservicemanager isolated_compute_app:dir search;
+#line 22
+allow hwservicemanager isolated_compute_app:file { read open map };
+#line 22
+allow hwservicemanager isolated_compute_app:process getattr;
+#line 22
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 22
+# all domains in domain.te.
+#line 22
+
+
+
+#line 24
+typeattribute isolated_compute_app halclientdomain;
+#line 24
+typeattribute isolated_compute_app hal_codec2_client;
+#line 24
+
+#line 24
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 24
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 24
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 24
+
+#line 24
+typeattribute isolated_compute_app hal_codec2;
+#line 24
+# Find passthrough HAL implementations
+#line 24
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 24
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 24
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 24
+
+#line 24
+
+
+allow isolated_compute_app dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_compute_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Allow access to the toybox: b/275024392
+allow isolated_compute_app toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Grant GPU access to isolated_compute_app as it is required for acceleration.
+allow isolated_compute_app gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow isolated_compute_app gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow isolated_compute_app sysfs_gpu:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#####
+##### Neverallow
+#####
+
+# Do not allow isolated_compute_app to access hardware service except for the
+# ones necessary for camera service.
+# TODO (b/266555480): The permission should be guarded by compliance test.
+# Remove the negation for member domains when refactorization is done.
+# neverallow isolated_compute_app {
+# hwservice_manager_type
+# -hal_graphics_allocator_hwservice
+# -hal_graphics_mapper_hwservice
+# -hidl_allocator_hwservice
+# -hidl_manager_hwservice
+# -hidl_memory_hwservice
+# }:hwservice_manager *;
+#line 1 "system/sepolicy/private/iw.te"
+type iw, domain, coredomain;
+type iw_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init iw_exec:file { getattr open read execute map };
+#line 4
+allow init iw:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow iw iw_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init iw:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init iw:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init iw_exec:process iw;
+#line 4
+
+#line 4
+
+#line 1 "system/sepolicy/private/kcmdlinectrl.te"
+# kcmdlinectrl is a tool to have the bootloader send kernel commandline flags
+# for enabling dogfood features in the kernel
+type kcmdlinectrl, domain, coredomain;
+type kcmdlinectrl_exec, system_file_type, exec_type, file_type;
+
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init kcmdlinectrl_exec:file { getattr open read execute map };
+#line 6
+allow init kcmdlinectrl:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow kcmdlinectrl kcmdlinectrl_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init kcmdlinectrl:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init kcmdlinectrl:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init kcmdlinectrl_exec:process kcmdlinectrl;
+#line 6
+
+#line 6
+
+
+# for setting kcmdline properties to match the bootloader state.
+
+#line 9
+
+#line 9
+allow kcmdlinectrl property_socket:sock_file write;
+#line 9
+allow kcmdlinectrl init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow kcmdlinectrl kcmdline_prop:property_service set;
+#line 9
+
+#line 9
+allow kcmdlinectrl kcmdline_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+# kcmdlinectrl communicates the request to the bootloader via the misc partition.
+# needs to write to update the request in misc partition, and read to sync
+# back to the property.
+allow kcmdlinectrl misc_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow kcmdlinectrl block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 16
+ allow kcmdlinectrl { metadata_file gsi_metadata_file_type }:dir search;
+#line 16
+ allow kcmdlinectrl gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 16
+ allow kcmdlinectrl { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 16
+
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit kcmdlinectrl sysfs_dt_firmware_android:dir search;
+dontaudit kcmdlinectrl vendor_property_type:file read;
+#line 1 "system/sepolicy/private/kernel.te"
+typeattribute kernel coredomain;
+
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow kernel init_exec:file { getattr open read execute map };
+#line 3
+allow kernel init:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow init init_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+allow init kernel:process sigchld;
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit kernel init:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow kernel init:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition kernel init_exec:process init;
+#line 3
+
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow kernel snapuserd_exec:file { getattr open read execute map };
+#line 4
+allow kernel snapuserd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow snapuserd snapuserd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+allow snapuserd kernel:process sigchld;
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit kernel snapuserd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow kernel snapuserd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition kernel snapuserd_exec:process snapuserd;
+#line 4
+
+
+# Allow the kernel to read otapreopt_chroot's file descriptors and files under
+# /postinstall, as it uses apexd logic to mount APEX packages in /postinstall/apex.
+allow kernel otapreopt_chroot:fd use;
+allow kernel postinstall_file:file read;
+
+# The following sections are for the transition period during a Virtual A/B
+# OTA. Once sepolicy is loaded, snapuserd must be re-launched in the correct
+# context, and with properly labelled devices. This must be done before
+# enabling enforcement, eg, in permissive mode while still in the kernel
+# context.
+allow kernel tmpfs:blk_file { getattr relabelfrom };
+allow kernel tmpfs:chr_file { getattr relabelfrom };
+allow kernel tmpfs:lnk_file { getattr relabelfrom };
+allow kernel tmpfs:dir { open read relabelfrom };
+
+allow kernel block_device:blk_file relabelto;
+allow kernel block_device:lnk_file relabelto;
+allow kernel dm_device:chr_file relabelto;
+allow kernel dm_device:blk_file relabelto;
+allow kernel dm_user_device:dir { read open search relabelto };
+allow kernel dm_user_device:chr_file relabelto;
+allow kernel kmsg_device:chr_file relabelto;
+allow kernel null_device:chr_file relabelto;
+allow kernel random_device:chr_file relabelto;
+allow kernel snapuserd_exec:file relabelto;
+
+allow kernel kmsg_device:chr_file write;
+allow kernel gsid:fd use;
+
+allow kernel self:{ capability cap_userns } sys_nice;
+
+# Root fs.
+
+#line 38
+allow kernel rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 38
+allow kernel rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 38
+
+
+# Used to read androidboot.selinux property
+allow kernel {
+ proc_bootconfig
+ proc_cmdline
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Get SELinux enforcing status.
+allow kernel selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow kernel selinuxfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# Get file contexts during first stage
+allow kernel file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow init relabel itself.
+allow kernel rootfs:file relabelfrom;
+allow kernel init_exec:file relabelto;
+# TODO: investigate why we need this.
+allow kernel init:process share;
+
+# cgroup filesystem initialization prior to setting the cgroup root directory label.
+allow kernel unlabeled:dir search;
+
+# Mount usbfs.
+allow kernel usbfs:filesystem mount;
+allow kernel usbfs:dir search;
+
+# Initial setenforce by init prior to switching to init domain.
+# We use dontaudit instead of allow to prevent a kernel spawned userspace
+# process from turning off SELinux once enabled.
+dontaudit kernel self:security setenforce;
+
+# Write to /proc/1/oom_adj prior to switching to init domain.
+allow kernel self:{ capability cap_userns } sys_resource;
+
+# Init reboot before switching selinux domains under certain error
+# conditions. Allow it.
+# As part of rebooting, init writes "u" to /proc/sysrq-trigger to
+# remount filesystems read-only. /data is not mounted at this point,
+# so we could ignore this. For now, we allow it.
+allow kernel self:{ capability cap_userns } sys_boot;
+allow kernel proc_sysrq:file { open append write lock map };
+
+# Allow writing to /dev/kmsg which was created prior to loading policy.
+allow kernel tmpfs:chr_file write;
+
+# Set checkreqprot by init.rc prior to switching to init domain.
+allow kernel selinuxfs:file write;
+allow kernel self:security setcheckreqprot;
+
+# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
+allow kernel { sdcard_type fuse }:file { read write };
+
+# f_mtp driver accesses files from kernel context.
+allow kernel mediaprovider:fd use;
+
+# Allow the kernel to read OBB files from app directories. (b/17428116)
+# Kernel thread "loop0" reads a vold supplied file descriptor.
+# Fixes CTS tests:
+# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountObbNormal
+# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountTwoObbs
+allow kernel vold:fd use;
+allow kernel { app_data_file privapp_data_file }:file read;
+allow kernel asec_image_file:file read;
+
+# Allow mounting loop device in update_engine_unittests. (b/28319454)
+# and for LTP kernel tests (b/73220071)
+#line 109
+
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow kernel media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow kernel media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access to /data/misc/vold/virtual_disk.
+allow kernel vold_data_file:file { read write };
+
+# Allow the kernel to read APEX file descriptors and (staged) data files;
+# Needed because APEX uses the loopback driver, which issues requests from
+# a kernel thread in earlier kernel version.
+allow kernel apexd:fd use;
+allow kernel {
+ apex_data_file
+ staging_data_file
+ vendor_apex_file
+}:file read;
+# Also allow the kernel to read/write /data/local/tmp files via loop device
+# for ApexTestCases and fiemap_image_test.
+#line 133
+
+
+# Allow the first-stage init (which is running in the kernel domain) to execute the
+# dynamic linker when it re-executes /init to switch into the second stage.
+# Until Linux 4.8, the program interpreter (dynamic linker in this case) is executed
+# before the domain is switched to the target domain. So, we need to allow the kernel
+# domain (the source domain) to execute the dynamic linker (system_file type).
+# TODO(b/110147943) remove these allow rules when we no longer need to support Linux
+# kernel older than 4.8.
+allow kernel system_file:file execute;
+# The label for the dynamic linker is rootfs in the recovery partition. This is because
+# the recovery partition which is rootfs does not support xattr and thus labeling can't be
+# done at build-time. All files are by default labeled as rootfs upon booting.
+#line 148
+
+
+# required by VTS lidbm unit test
+allow kernel appdomain_tmpfs:file { read write };
+
+dontaudit kernel metadata_file:dir search;
+dontaudit kernel ota_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+dontaudit kernel sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+dontaudit kernel sysfs:file { open read write };
+dontaudit kernel sysfs:chr_file { open read write };
+dontaudit kernel dm_device:chr_file ioctl;
+dontaudit kernel self:capability { sys_admin setgid mknod };
+
+dontaudit kernel dm_user_device:dir { write add_name };
+dontaudit kernel dm_user_device:chr_file { create setattr };
+dontaudit kernel tmpfs:lnk_file read;
+dontaudit kernel tmpfs:blk_file { open read };
+
+###
+### neverallow rules
+###
+
+# The initial task starts in the kernel domain (assigned via
+# initial_sid_contexts), but nothing ever transitions to it.
+neverallow * kernel:process { transition dyntransition };
+
+# The kernel domain is never entered via an exec, nor should it
+# ever execute a program outside the rootfs without changing to another domain.
+# If you encounter an execute_no_trans denial on the kernel domain, then
+# possible causes include:
+# - The program is a kernel usermodehelper. In this case, define a domain
+# for the program and domain_auto_trans() to it.
+# - You are running an exploit which switched to the init task credentials
+# and is then trying to exec a shell or other program. You lose!
+neverallow kernel *:file { entrypoint execute_no_trans };
+
+# the kernel should not be accessing files owned by other users.
+# Instead of adding dac_{read_search,override}, fix the unix permissions
+# on files being accessed.
+neverallow kernel self:{ capability cap_userns } { dac_override dac_read_search };
+
+# Nobody should be ptracing kernel threads
+neverallow * kernel:process ptrace;
+#line 1 "system/sepolicy/private/keystore.te"
+typeattribute keystore coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init keystore_exec:file { getattr open read execute map };
+#line 3
+allow init keystore:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow keystore keystore_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init keystore:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init keystore:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init keystore_exec:process keystore;
+#line 3
+
+#line 3
+
+
+# talk to keymaster
+
+#line 6
+typeattribute keystore halclientdomain;
+#line 6
+typeattribute keystore hal_keymaster_client;
+#line 6
+
+#line 6
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 6
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 6
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 6
+
+#line 6
+typeattribute keystore hal_keymaster;
+#line 6
+# Find passthrough HAL implementations
+#line 6
+allow hal_keymaster system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_keymaster vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_keymaster vendor_file:file { read open getattr execute map };
+#line 6
+
+#line 6
+
+
+# talk to confirmationui
+
+#line 9
+typeattribute keystore halclientdomain;
+#line 9
+typeattribute keystore hal_confirmationui_client;
+#line 9
+
+#line 9
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 9
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 9
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 9
+
+#line 9
+typeattribute keystore hal_confirmationui;
+#line 9
+# Find passthrough HAL implementations
+#line 9
+allow hal_confirmationui system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_confirmationui vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_confirmationui vendor_file:file { read open getattr execute map };
+#line 9
+
+#line 9
+
+
+# talk to keymint
+
+#line 12
+typeattribute keystore halclientdomain;
+#line 12
+typeattribute keystore hal_keymint_client;
+#line 12
+
+#line 12
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 12
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 12
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 12
+
+#line 12
+typeattribute keystore hal_keymint;
+#line 12
+# Find passthrough HAL implementations
+#line 12
+allow hal_keymint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_keymint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_keymint vendor_file:file { read open getattr execute map };
+#line 12
+
+#line 12
+
+
+# This is used for the ConfirmationUI async callback.
+allow keystore platform_app:binder call;
+
+# Allow to check whether security logging is enabled.
+
+#line 18
+allow keystore device_logging_prop:file { getattr open read map };
+#line 18
+
+
+# Allow keystore to check if the system is rkp only.
+
+#line 21
+allow keystore remote_prov_prop:file { getattr open read map };
+#line 21
+
+
+# Allow keystore to check whether to post-process RKP certificates
+
+#line 24
+allow keystore remote_prov_cert_prop:file { getattr open read map };
+#line 24
+
+
+# Allow keystore to check rkpd feature flags
+
+#line 27
+allow keystore device_config_remote_key_provisioning_native_prop:file { getattr open read map };
+#line 27
+
+
+# Allow keystore to write to statsd.
+
+#line 30
+allow keystore statsdw_socket:sock_file write;
+#line 30
+allow keystore statsd:unix_dgram_socket sendto;
+#line 30
+
+
+# Keystore need access to the keystore2_key_contexts file to load the keystore key backend.
+allow keystore keystore2_key_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow keystore to listen to changing boot levels
+
+#line 36
+allow keystore keystore_listen_prop:file { getattr open read map };
+#line 36
+
+
+# Keystore needs to transfer binder references to vold so that it
+# can call keystore methods on those references.
+allow keystore vold:binder transfer;
+
+
+#line 42
+
+#line 42
+allow keystore property_socket:sock_file write;
+#line 42
+allow keystore init:unix_stream_socket connectto;
+#line 42
+
+#line 42
+allow keystore keystore_diagnostics_prop:property_service set;
+#line 42
+
+#line 42
+allow keystore keystore_diagnostics_prop:file { getattr open read map };
+#line 42
+
+#line 42
+
+
+# Allow keystore to monitor the `apexd.status` property.
+
+#line 45
+allow keystore apexd_prop:file { getattr open read map };
+#line 45
+
+
+# keystore is using apex_info via libvintf
+
+#line 48
+ allow keystore apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 48
+ allow keystore apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 48
+
+#line 48
+allow keystore vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 48
+allow keystore vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 48
+
+#line 48
+
+
+typeattribute keystore mlstrustedsubject;
+
+#line 51
+# Call the servicemanager and transfer references to it.
+#line 51
+allow keystore servicemanager:binder { call transfer };
+#line 51
+# Allow servicemanager to send out callbacks
+#line 51
+allow servicemanager keystore:binder { call transfer };
+#line 51
+# servicemanager performs getpidcon on clients.
+#line 51
+allow servicemanager keystore:dir search;
+#line 51
+allow servicemanager keystore:file { read open };
+#line 51
+allow servicemanager keystore:process getattr;
+#line 51
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 51
+# all domains in domain.te.
+#line 51
+
+
+#line 52
+typeattribute keystore binderservicedomain;
+#line 52
+
+
+#line 53
+# Call the server domain and optionally transfer references to it.
+#line 53
+allow keystore remote_provisioning_service_server:binder { call transfer };
+#line 53
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 53
+allow remote_provisioning_service_server keystore:binder transfer;
+#line 53
+# Receive and use open files from the server.
+#line 53
+allow keystore remote_provisioning_service_server:fd use;
+#line 53
+
+
+#line 54
+# Call the server domain and optionally transfer references to it.
+#line 54
+allow keystore rkp_cert_processor:binder { call transfer };
+#line 54
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 54
+allow rkp_cert_processor keystore:binder transfer;
+#line 54
+# Receive and use open files from the server.
+#line 54
+allow keystore rkp_cert_processor:fd use;
+#line 54
+
+
+#line 55
+# Call the server domain and optionally transfer references to it.
+#line 55
+allow keystore system_server:binder { call transfer };
+#line 55
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 55
+allow system_server keystore:binder transfer;
+#line 55
+# Receive and use open files from the server.
+#line 55
+allow keystore system_server:fd use;
+#line 55
+
+
+#line 56
+# Call the server domain and optionally transfer references to it.
+#line 56
+allow keystore wificond:binder { call transfer };
+#line 56
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 56
+allow wificond keystore:binder transfer;
+#line 56
+# Receive and use open files from the server.
+#line 56
+allow keystore wificond:fd use;
+#line 56
+
+
+allow keystore keystore_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow keystore keystore_data_file:{ file lnk_file sock_file fifo_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow keystore keystore_exec:file { getattr };
+
+
+#line 62
+ allow keystore keystore_service:service_manager { add find };
+#line 62
+ neverallow { domain -keystore } keystore_service:service_manager add;
+#line 62
+
+#line 62
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 62
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 62
+
+#line 62
+
+allow keystore sec_key_att_app_id_provider_service:service_manager find;
+allow keystore remote_provisioning_service:service_manager find;
+allow keystore rkp_cert_processor_service:service_manager find;
+
+# Allow keystore to communicate to apexd
+allow keystore apex_service:service_manager find;
+allow keystore apexd:binder call;
+
+
+#line 71
+ allow keystore apc_service:service_manager { add find };
+#line 71
+ neverallow { domain -keystore } apc_service:service_manager add;
+#line 71
+
+#line 71
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 71
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 71
+
+#line 71
+
+
+#line 72
+ allow keystore keystore_compat_hal_service:service_manager { add find };
+#line 72
+ neverallow { domain -keystore } keystore_compat_hal_service:service_manager add;
+#line 72
+
+#line 72
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 72
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 72
+
+#line 72
+
+
+#line 73
+ allow keystore authorization_service:service_manager { add find };
+#line 73
+ neverallow { domain -keystore } authorization_service:service_manager add;
+#line 73
+
+#line 73
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 73
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 73
+
+#line 73
+
+
+#line 74
+ allow keystore keystore_maintenance_service:service_manager { add find };
+#line 74
+ neverallow { domain -keystore } keystore_maintenance_service:service_manager add;
+#line 74
+
+#line 74
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 74
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 74
+
+#line 74
+
+
+#line 75
+ allow keystore keystore_metrics_service:service_manager { add find };
+#line 75
+ neverallow { domain -keystore } keystore_metrics_service:service_manager add;
+#line 75
+
+#line 75
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 75
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 75
+
+#line 75
+
+
+#line 76
+ allow keystore legacykeystore_service:service_manager { add find };
+#line 76
+ neverallow { domain -keystore } legacykeystore_service:service_manager add;
+#line 76
+
+#line 76
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 76
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 76
+
+#line 76
+
+
+# Check SELinux permissions.
+
+#line 79
+
+#line 79
+allow keystore selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 79
+allow keystore selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 79
+
+#line 79
+allow keystore selinuxfs:file { open append write lock map };
+#line 79
+allow keystore kernel:security compute_av;
+#line 79
+allow keystore self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 79
+
+
+
+#line 81
+allow keystore cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 81
+allow keystore cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 81
+
+
+#line 82
+allow keystore cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 82
+allow keystore cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 82
+
+
+# The software KeyMint implementation used in km_compat needs
+# to read the vendor security patch level.
+
+#line 86
+allow keystore vendor_security_patch_level_prop:file { getattr open read map };
+#line 86
+;
+
+# Allow keystore to read its vendor configuration
+
+#line 89
+allow keystore keystore_config_prop:file { getattr open read map };
+#line 89
+
+
+###
+### Neverallow rules
+###
+### Protect ourself from others
+###
+
+neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+neverallow { domain -keystore } keystore_data_file:{ file lnk_file sock_file fifo_file } ~{ relabelto getattr };
+
+neverallow { domain -keystore -init } keystore_data_file:dir *;
+neverallow { domain -keystore -init } keystore_data_file:{ file lnk_file sock_file fifo_file } *;
+
+neverallow * keystore:process ptrace;
+
+# Only keystore can set keystore_diagnostics_prop system properties. Since init is allowed to set
+# any system property, an exception is added for init as well.
+neverallow { domain -keystore -init } keystore_diagnostics_prop:property_service set;
+#line 1 "system/sepolicy/private/keystore_keys.te"
+# Specify keystore2_key namespaces in this file.
+# Please keep the names in alphabetical order and comment each new entry.
+
+# A keystore2_key namespace for the shell domain. Mainly used for native tests.
+type shell_key, keystore2_key_type;
+
+# A keystore2 namespace for the su domain. Mainly used for native tests.
+type su_key, keystore2_key_type;
+
+# A keystore2 namespace for vold. Vold need special permission to handle
+# its own Keymint blobs.
+type vold_key, keystore2_key_type;
+
+# A keystore2 namespace for the on-device signing daemon.
+type odsign_key, keystore2_key_type;
+
+# A keystore2 namespace for LockSettingsService.
+type locksettings_key, keystore2_key_type;
+
+# A keystore2 namespace for resume on reboot.
+type resume_on_reboot_key, keystore2_key_type;
+
+#line 1 "system/sepolicy/private/linkerconfig.te"
+type linkerconfig, domain, coredomain;
+type linkerconfig_exec, exec_type, file_type, system_file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init linkerconfig_exec:file { getattr open read execute map };
+#line 4
+allow init linkerconfig:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow linkerconfig linkerconfig_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init linkerconfig:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init linkerconfig:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init linkerconfig_exec:process linkerconfig;
+#line 4
+
+#line 4
+
+
+## Read and write linkerconfig subdirectory.
+allow linkerconfig linkerconfig_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow linkerconfig linkerconfig_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow linkerconfig to log to the kernel.
+allow linkerconfig kmsg_device:chr_file { open append write lock map };
+
+# Allow linkerconfig to be invoked with logwrapper from init.
+allow linkerconfig devpts:chr_file { getattr ioctl read write };
+
+# Allow linkerconfig to scan for apex modules
+allow linkerconfig apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow linkerconfig to read apex-info-list.xml
+allow linkerconfig apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow linkerconfig to read apex_manifest.pb file from vendor apex
+
+#line 23
+allow linkerconfig vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 23
+allow linkerconfig vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 23
+
+
+# Allow linkerconfig to be called in the otapreopt_chroot
+allow linkerconfig otapreopt_chroot:fd use;
+allow linkerconfig postinstall_apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow linkerconfig postinstall_apex_mnt_dir:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow for use in Pre-reboot Dexopt.
+allow linkerconfig dexopt_chroot_setup:fd use;
+
+neverallow {
+ domain
+ -dexopt_chroot_setup
+ -init
+ -linkerconfig
+ -otapreopt_chroot
+} linkerconfig_exec:file { execute execute_no_trans };
+#line 1 "system/sepolicy/private/linux_vm_setup.te"
+type linux_vm_setup, domain, coredomain;
+type linux_vm_setup_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init linux_vm_setup_exec:file { getattr open read execute map };
+#line 4
+allow init linux_vm_setup:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow linux_vm_setup linux_vm_setup_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init linux_vm_setup:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init linux_vm_setup:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init linux_vm_setup_exec:process linux_vm_setup;
+#line 4
+
+#line 4
+
+#line 6
+
+#line 1 "system/sepolicy/private/llkd.te"
+# llkd Live LocK Daemon
+typeattribute llkd coredomain;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init llkd_exec:file { getattr open read execute map };
+#line 4
+allow init llkd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow llkd llkd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init llkd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init llkd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init llkd_exec:process llkd;
+#line 4
+
+#line 4
+
+
+
+#line 6
+allow llkd llkd_prop:file { getattr open read map };
+#line 6
+
+
+allow llkd self:{ capability cap_userns } kill;
+#line 12
+
+
+# llkd optionally locks itself in memory, to prevent it from being
+# swapped out and unable to discover a kernel in live-lock state.
+allow llkd self:{ capability cap_userns } ipc_lock;
+
+# Send kill signals to _anyone_ suffering from Live Lock
+allow llkd domain:process sigkill;
+
+# read stack to check for Live Lock
+#line 33
+
+
+# live lock watchdog process allowed to look through /proc/
+allow llkd domain:dir { open getattr read search ioctl lock watch watch_reads };
+allow llkd domain:file { getattr open read ioctl lock map watch watch_reads };
+allow llkd domain:lnk_file read;
+# Set /proc/sys/kernel/hung_task_*
+allow llkd proc_hung_task:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# live lock watchdog process allowed to dump process trace and
+# reboot because orderly shutdown may not be possible.
+allow llkd proc_sysrq:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow llkd kmsg_device:chr_file { open append write lock map };
+
+### neverallow rules
+
+neverallow { domain -init } llkd:process { dyntransition transition };
+neverallow { domain } llkd:process ptrace;
+
+# never honor LD_PRELOAD
+neverallow * llkd:process noatsecure;
+#line 1 "system/sepolicy/private/lmkd.te"
+typeattribute lmkd coredomain;
+typeattribute lmkd bpfdomain;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init lmkd_exec:file { getattr open read execute map };
+#line 4
+allow init lmkd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow lmkd lmkd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init lmkd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init lmkd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init lmkd_exec:process lmkd;
+#line 4
+
+#line 4
+
+
+# Set sys.lmk.* properties.
+
+#line 7
+
+#line 7
+allow lmkd property_socket:sock_file write;
+#line 7
+allow lmkd init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow lmkd system_lmk_prop:property_service set;
+#line 7
+
+#line 7
+allow lmkd system_lmk_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+
+# Set lmkd.* properties.
+
+#line 10
+
+#line 10
+allow lmkd property_socket:sock_file write;
+#line 10
+allow lmkd init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow lmkd lmkd_prop:property_service set;
+#line 10
+
+#line 10
+allow lmkd lmkd_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# Get persist.device_config.lmk_native.* properties.
+
+#line 13
+allow lmkd device_config_lmkd_native_prop:file { getattr open read map };
+#line 13
+
+
+# Needed for reading tracepoint ids in order to attach bpf programs.
+allow lmkd debugfs_tracing:file { getattr open read ioctl lock map watch watch_reads };
+allow lmkd self:perf_event { cpu kernel open write };
+
+allow lmkd fs_bpf:file read;
+allow lmkd bpfloader:bpf { map_read map_write prog_run };
+
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow lmkd fs_bpf_memevents:file { read write };
+allow lmkd fs_bpf_memevents:dir search;
+
+allow lmkd self:{ capability cap_userns } { dac_override dac_read_search sys_resource kill };
+
+# lmkd locks itself in memory, to prevent it from being
+# swapped out and unable to kill other memory hogs.
+# system/core commit b28ff9131363f7b4a698990da5748b2a88c3ed35
+# b/16236289
+allow lmkd self:{ capability cap_userns } ipc_lock;
+
+## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns
+## TODO: maybe scope this down?
+
+#line 36
+allow lmkd domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow lmkd domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+
+allow lmkd domain:file write;
+
+## Writes to /sys/module/lowmemorykiller/parameters/minfree
+
+#line 40
+allow lmkd sysfs_lowmemorykiller:dir { open getattr read search ioctl lock watch watch_reads };
+#line 40
+allow lmkd sysfs_lowmemorykiller:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 40
+
+allow lmkd sysfs_lowmemorykiller:file { open append write lock map };
+
+# setsched and send kill signals to any registered process
+allow lmkd domain:process { setsched sigkill };
+# TODO: delete this line b/131761776
+allow lmkd kernel:process { setsched };
+
+# Clean up old cgroups
+allow lmkd cgroup:dir { remove_name rmdir };
+allow lmkd cgroup_v2:dir { remove_name rmdir };
+
+# Allow to read memcg stats
+allow lmkd cgroup:file { getattr open read ioctl lock map watch watch_reads };
+allow lmkd cgroup_v2:file { getattr open read ioctl lock map watch watch_reads };
+
+# Set self to SCHED_FIFO
+allow lmkd self:{ capability cap_userns } sys_nice;
+
+allow lmkd proc_zoneinfo:file { getattr open read ioctl lock map watch watch_reads };
+allow lmkd proc_vmstat:file { getattr open read ioctl lock map watch watch_reads };
+
+# live lock watchdog process allowed to look through /proc/
+allow lmkd domain:dir { search open read };
+allow lmkd domain:file { open read };
+
+# live lock watchdog process allowed to dump process trace and
+# reboot because orderly shutdown may not be possible.
+allow lmkd proc_sysrq:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read /proc/lowmemorykiller
+allow lmkd proc_lowmemorykiller:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /proc/meminfo
+allow lmkd proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /proc/pressure/cpu and /proc/pressure/io
+allow lmkd proc_pressure_cpu:file { getattr open read ioctl lock map watch watch_reads };
+allow lmkd proc_pressure_io:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read/Write /proc/pressure/memory
+allow lmkd proc_pressure_mem:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow lmkd to connect during reinit.
+allow lmkd lmkd_socket:sock_file write;
+
+# Allow lmkd to write to statsd.
+
+#line 87
+allow lmkd statsdw_socket:sock_file write;
+#line 87
+allow lmkd statsd:unix_dgram_socket sendto;
+#line 87
+
+
+### neverallow rules
+
+# never honor LD_PRELOAD
+neverallow * lmkd:process noatsecure;
+neverallow lmkd self:{ capability cap_userns } sys_ptrace;
+neverallow { domain -init -lmkd -vendor_init } lmkd_prop:property_service set;
+neverallow lmkd self:perf_event ~{ cpu kernel open write };
+#line 1 "system/sepolicy/private/logd.te"
+typeattribute logd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init logd_exec:file { getattr open read execute map };
+#line 3
+allow init logd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow logd logd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init logd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init logd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init logd_exec:process logd;
+#line 3
+
+#line 3
+
+
+# Access device logging gating property
+
+#line 6
+allow logd device_logging_prop:file { getattr open read map };
+#line 6
+
+
+# logd is not allowed to write anywhere other than /data/misc/logd, and then
+# only on userdebug or eng builds
+neverallow logd {
+ file_type
+ -runtime_event_log_tags_file
+ # shell_data_file access is needed to dump bugreports
+ -shell_data_file
+
+
+}:file { create write append };
+
+# protect the event-log-tags file
+neverallow {
+ domain
+ -appdomain # covered below
+ -bootstat
+ -dumpstate
+ -init
+ -logd
+
+ -servicemanager
+ -system_server
+ -surfaceflinger
+ -zygote
+} runtime_event_log_tags_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ appdomain
+ -bluetooth
+ -platform_app
+ -priv_app
+ -radio
+ -shell
+
+ -system_app
+} runtime_event_log_tags_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only binder communication between logd and system_server is allowed
+
+#line 46
+# Call the servicemanager and transfer references to it.
+#line 46
+allow logd servicemanager:binder { call transfer };
+#line 46
+# Allow servicemanager to send out callbacks
+#line 46
+allow servicemanager logd:binder { call transfer };
+#line 46
+# servicemanager performs getpidcon on clients.
+#line 46
+allow servicemanager logd:dir search;
+#line 46
+allow servicemanager logd:file { read open };
+#line 46
+allow servicemanager logd:process getattr;
+#line 46
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 46
+# all domains in domain.te.
+#line 46
+
+
+#line 47
+typeattribute logd binderservicedomain;
+#line 47
+
+
+#line 48
+# Call the server domain and optionally transfer references to it.
+#line 48
+allow logd system_server:binder { call transfer };
+#line 48
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 48
+allow system_server logd:binder transfer;
+#line 48
+# Receive and use open files from the server.
+#line 48
+allow logd system_server:fd use;
+#line 48
+
+
+
+#line 50
+ allow logd logd_service:service_manager { add find };
+#line 50
+ neverallow { domain -logd } logd_service:service_manager add;
+#line 50
+
+#line 50
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 50
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 50
+
+#line 50
+
+allow logd logcat_service:service_manager find;
+
+# Read access to pseudo filesystems.
+
+#line 54
+allow logd cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 54
+allow logd cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 54
+
+
+#line 55
+allow logd cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 55
+allow logd cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 55
+
+
+#line 56
+allow logd proc_kmsg:dir { open getattr read search ioctl lock watch watch_reads };
+#line 56
+allow logd proc_kmsg:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 56
+
+
+#line 57
+allow logd proc_meminfo:dir { open getattr read search ioctl lock watch watch_reads };
+#line 57
+allow logd proc_meminfo:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 57
+
+
+allow logd self:{ capability cap_userns } { setuid setgid setpcap sys_nice audit_control };
+allow logd self:{ capability2 cap2_userns } syslog;
+allow logd self:netlink_audit_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_write };
+allow logd kernel:system syslog_read;
+allow logd kmsg_device:chr_file { getattr { open append write lock map } };
+allow logd system_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+allow logd packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+allow logd pstorefs:dir search;
+allow logd pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+#line 72
+
+allow logd runtime_event_log_tags_file:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 75
+allow logd domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 75
+allow logd domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 75
+
+
+allow logd kernel:system syslog_mod;
+
+
+#line 79
+# Group AID_LOG checked by filesystem & logd
+#line 79
+# to permit control commands
+#line 79
+
+#line 79
+allow logd logd_socket:sock_file write;
+#line 79
+allow logd logd:unix_stream_socket connectto;
+#line 79
+
+#line 79
+
+
+#line 80
+allow logd runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 80
+
+
+allow runtime_event_log_tags_file tmpfs:filesystem associate;
+# Typically harmlessly blindly trying to access via liblog
+# event tag mapping while in the untrusted_app domain.
+# Access for that domain is controlled and gated via the
+# event log tag service (albeit at a performance penalty,
+# expected to be locally cached).
+dontaudit domain runtime_event_log_tags_file:file { map open read };
+
+# Logd sets defaults if certain properties are empty.
+
+#line 91
+
+#line 91
+allow logd property_socket:sock_file write;
+#line 91
+allow logd init:unix_stream_socket connectto;
+#line 91
+
+#line 91
+allow logd logd_prop:property_service set;
+#line 91
+
+#line 91
+allow logd logd_prop:file { getattr open read map };
+#line 91
+
+#line 91
+
+
+###
+### Neverallow rules
+###
+### logd should NEVER do any of this
+
+# Block device access.
+neverallow logd dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow logd domain:process ptrace;
+
+# ... and nobody may ptrace me (except on userdebug or eng builds)
+neverallow { domain } logd:process ptrace;
+
+# Write to /system.
+neverallow logd system_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Write to files in /data/data or system files on /data
+neverallow logd {
+ app_data_file_type
+ system_data_file
+ packages_list_file
+ -shell_data_file # for bugreports
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Only init is allowed to enter the logd domain via exec()
+neverallow { domain -init } logd:process transition;
+neverallow * logd:process dyntransition;
+
+# protect the event-log-tags file
+neverallow {
+ domain
+ -init
+ -logd
+} runtime_event_log_tags_file:file { append create link unlink relabelfrom rename setattr write };
+#line 1 "system/sepolicy/private/logpersist.te"
+typeattribute logpersist coredomain;
+
+# android debug log storage in logpersist domains (eng and userdebug only)
+#line 21
+
+
+# logcatd is a shell script that execs logcat with various parameters.
+allow logpersist shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow logpersist logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allowxperm logpersist misc_logd_file:file ioctl {
+ 0xf512
+ 0x40086602
+};
+
+###
+### Neverallow rules
+###
+### logpersist should NEVER do any of this
+
+# Block device access.
+neverallow logpersist dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow logpersist domain:process ptrace;
+
+# Write to files in /data/data or system files on /data except misc_logd_file
+neverallow logpersist { app_data_file_type system_data_file }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Only init should be allowed to enter the logpersist domain via exec()
+# Following is a list of debug domains we know that transition to logpersist
+# neverallow_with_undefined_domains {
+# domain
+# -init # goldfish, logcatd, raft
+# -mmi # bat, mtp8996, msmcobalt
+# -system_app # Smith.apk
+# } logpersist:process transition;
+neverallow * logpersist:process dyntransition;
+
+# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
+neverallow logpersist {
+ file_type
+
+
+}:file { create write append };
+neverallow { domain -init -dumpstate -incidentd } misc_logd_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow { domain -init } misc_logd_file:file { append create link unlink relabelfrom rename setattr write };
+neverallow { domain -init } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
+#line 1 "system/sepolicy/private/lpdumpd.te"
+type lpdumpd, domain, coredomain;
+type lpdumpd_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init lpdumpd_exec:file { getattr open read execute map };
+#line 4
+allow init lpdumpd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow lpdumpd lpdumpd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init lpdumpd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init lpdumpd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init lpdumpd_exec:process lpdumpd;
+#line 4
+
+#line 4
+
+
+# Allow lpdumpd to register itself as a service.
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow lpdumpd servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager lpdumpd:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager lpdumpd:dir search;
+#line 7
+allow servicemanager lpdumpd:file { read open };
+#line 7
+allow servicemanager lpdumpd:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+ allow lpdumpd lpdump_service:service_manager { add find };
+#line 8
+ neverallow { domain -lpdumpd } lpdump_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+
+# Allow lpdumpd to find the super partition block device.
+allow lpdumpd block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow lpdumpd to read super partition metadata.
+allow lpdumpd super_block_device_type:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow lpdumpd to read fstab.
+allow lpdumpd sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+allow lpdumpd sysfs_dt_firmware_android:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 19
+ allow lpdumpd { metadata_file gsi_metadata_file_type }:dir search;
+#line 19
+ allow lpdumpd gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 19
+ allow lpdumpd { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 19
+
+
+# Allow to get A/B slot suffix from device tree or kernel cmdline.
+
+#line 22
+allow lpdumpd sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+#line 22
+allow lpdumpd sysfs_dt_firmware_android:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 22
+;
+allow lpdumpd proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow reading Virtual A/B status information.
+
+#line 26
+allow lpdumpd virtual_ab_prop:file { getattr open read map };
+#line 26
+
+allow lpdumpd metadata_file:dir search;
+allow lpdumpd ota_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } lock };
+allow lpdumpd ota_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+
+### Neverallow rules
+
+# Disallow other domains to get lpdump_service and call lpdumpd.
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+} lpdump_service:service_manager find;
+
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+ -servicemanager
+} lpdumpd:binder call;
+#line 1 "system/sepolicy/private/mdnsd.te"
+# mdns daemon
+
+typeattribute mdnsd coredomain;
+typeattribute mdnsd mlstrustedsubject;
+
+type mdnsd_exec, system_file_type, exec_type, file_type;
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init mdnsd_exec:file { getattr open read execute map };
+#line 7
+allow init mdnsd:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow mdnsd mdnsd_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init mdnsd:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init mdnsd:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init mdnsd_exec:process mdnsd;
+#line 7
+
+#line 7
+
+
+
+#line 9
+typeattribute mdnsd netdomain;
+#line 9
+
+
+# Read from /proc/net
+
+#line 12
+allow mdnsd proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow mdnsd proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+#line 1 "system/sepolicy/private/mediadrmserver.te"
+typeattribute mediadrmserver coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init mediadrmserver_exec:file { getattr open read execute map };
+#line 3
+allow init mediadrmserver:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow mediadrmserver mediadrmserver_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init mediadrmserver:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init mediadrmserver:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init mediadrmserver_exec:process mediadrmserver;
+#line 3
+
+#line 3
+
+
+# allocate and use graphic buffers
+
+#line 6
+typeattribute mediadrmserver halclientdomain;
+#line 6
+typeattribute mediadrmserver hal_graphics_allocator_client;
+#line 6
+
+#line 6
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 6
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 6
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 6
+
+#line 6
+typeattribute mediadrmserver hal_graphics_allocator;
+#line 6
+# Find passthrough HAL implementations
+#line 6
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 6
+
+#line 6
+
+auditallow mediadrmserver hal_graphics_allocator_server:binder call;
+
+typeattribute mediadrmserver mlstrustedsubject;
+
+
+#line 11
+typeattribute mediadrmserver netdomain;
+#line 11
+
+
+#line 12
+# Call the servicemanager and transfer references to it.
+#line 12
+allow mediadrmserver servicemanager:binder { call transfer };
+#line 12
+# Allow servicemanager to send out callbacks
+#line 12
+allow servicemanager mediadrmserver:binder { call transfer };
+#line 12
+# servicemanager performs getpidcon on clients.
+#line 12
+allow servicemanager mediadrmserver:dir search;
+#line 12
+allow servicemanager mediadrmserver:file { read open };
+#line 12
+allow servicemanager mediadrmserver:process getattr;
+#line 12
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 12
+# all domains in domain.te.
+#line 12
+
+
+#line 13
+# Call the server domain and optionally transfer references to it.
+#line 13
+allow mediadrmserver binderservicedomain:binder { call transfer };
+#line 13
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 13
+allow binderservicedomain mediadrmserver:binder transfer;
+#line 13
+# Receive and use open files from the server.
+#line 13
+allow mediadrmserver binderservicedomain:fd use;
+#line 13
+
+
+#line 14
+# Call the server domain and optionally transfer references to it.
+#line 14
+allow mediadrmserver appdomain:binder { call transfer };
+#line 14
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 14
+allow appdomain mediadrmserver:binder transfer;
+#line 14
+# Receive and use open files from the server.
+#line 14
+allow mediadrmserver appdomain:fd use;
+#line 14
+
+
+#line 15
+typeattribute mediadrmserver binderservicedomain;
+#line 15
+
+
+#line 16
+typeattribute mediadrmserver halclientdomain;
+#line 16
+typeattribute mediadrmserver hal_drm_client;
+#line 16
+
+#line 16
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 16
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 16
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 16
+
+#line 16
+typeattribute mediadrmserver hal_drm;
+#line 16
+# Find passthrough HAL implementations
+#line 16
+allow hal_drm system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_drm vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_drm vendor_file:file { read open getattr execute map };
+#line 16
+
+#line 16
+
+
+
+#line 18
+ allow mediadrmserver mediadrmserver_service:service_manager { add find };
+#line 18
+ neverallow { domain -mediadrmserver } mediadrmserver_service:service_manager add;
+#line 18
+
+#line 18
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 18
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 18
+
+#line 18
+
+allow mediadrmserver mediaserver_service:service_manager find;
+allow mediadrmserver mediametrics_service:service_manager find;
+allow mediadrmserver processinfo_service:service_manager find;
+allow mediadrmserver surfaceflinger_service:service_manager find;
+allow mediadrmserver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# TODO(b/80317992): remove
+
+#line 26
+# Call the server domain and optionally transfer references to it.
+#line 26
+allow mediadrmserver hal_omx_server:binder { call transfer };
+#line 26
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 26
+allow hal_omx_server mediadrmserver:binder transfer;
+#line 26
+# Receive and use open files from the server.
+#line 26
+allow mediadrmserver hal_omx_server:fd use;
+#line 26
+
+
+###
+### neverallow rules
+###
+
+# mediadrmserver should never execute any executable without a
+# domain transition
+neverallow mediadrmserver { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 37
+{
+#line 37
+# qualcomm rmnet ioctls
+#line 37
+0x00006900 0x00006902
+#line 37
+# socket ioctls
+#line 37
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 37
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 37
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 37
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 37
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 37
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 37
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 37
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 37
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 37
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 37
+# device and protocol specific ioctls
+#line 37
+0x000089f0-0x000089ff
+#line 37
+0x000089e0-0x000089ef
+#line 37
+# Wireless extension ioctls
+#line 37
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 37
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 37
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 37
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 37
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 37
+0x00008b34 0x00008b35 0x00008b36
+#line 37
+# Dev private ioctl i.e. hardware specific ioctls
+#line 37
+0x00008be0-0x00008bff
+#line 37
+};
+#line 1 "system/sepolicy/private/mediaextractor.te"
+typeattribute mediaextractor coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init mediaextractor_exec:file { getattr open read execute map };
+#line 3
+allow init mediaextractor:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow mediaextractor mediaextractor_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init mediaextractor:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init mediaextractor:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init mediaextractor_exec:process mediaextractor;
+#line 3
+
+#line 3
+
+
+#line 4
+type_transition mediaextractor tmpfs:file mediaextractor_tmpfs;
+#line 4
+allow mediaextractor mediaextractor_tmpfs:file { read write getattr map };
+#line 4
+
+allow mediaextractor appdomain_tmpfs:file { getattr map read write };
+allow mediaextractor mediaserver_tmpfs:file { getattr map read write };
+allow mediaextractor system_server_tmpfs:file { getattr map read write };
+
+
+#line 9
+allow mediaextractor device_config_media_native_prop:file { getattr open read map };
+#line 9
+
+
+#line 10
+allow mediaextractor device_config_swcodec_native_prop:file { getattr open read map };
+#line 10
+
+
+typeattribute mediaextractor mlstrustedsubject;
+
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow mediaextractor servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager mediaextractor:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager mediaextractor:dir search;
+#line 14
+allow servicemanager mediaextractor:file { read open };
+#line 14
+allow servicemanager mediaextractor:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+#line 15
+# Call the server domain and optionally transfer references to it.
+#line 15
+allow mediaextractor binderservicedomain:binder { call transfer };
+#line 15
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 15
+allow binderservicedomain mediaextractor:binder transfer;
+#line 15
+# Receive and use open files from the server.
+#line 15
+allow mediaextractor binderservicedomain:fd use;
+#line 15
+
+
+#line 16
+# Call the server domain and optionally transfer references to it.
+#line 16
+allow mediaextractor appdomain:binder { call transfer };
+#line 16
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 16
+allow appdomain mediaextractor:binder transfer;
+#line 16
+# Receive and use open files from the server.
+#line 16
+allow mediaextractor appdomain:fd use;
+#line 16
+
+
+#line 17
+typeattribute mediaextractor binderservicedomain;
+#line 17
+
+
+
+#line 19
+ allow mediaextractor mediaextractor_service:service_manager { add find };
+#line 19
+ neverallow { domain -mediaextractor } mediaextractor_service:service_manager add;
+#line 19
+
+#line 19
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 19
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 19
+
+#line 19
+
+allow mediaextractor mediametrics_service:service_manager find;
+allow mediaextractor hidl_token_hwservice:hwservice_manager find;
+
+allow mediaextractor system_server:fd use;
+
+
+#line 25
+typeattribute mediaextractor halclientdomain;
+#line 25
+typeattribute mediaextractor hal_cas_client;
+#line 25
+
+#line 25
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 25
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 25
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 25
+
+#line 25
+typeattribute mediaextractor hal_cas;
+#line 25
+# Find passthrough HAL implementations
+#line 25
+allow hal_cas system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_cas vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_cas vendor_file:file { read open getattr execute map };
+#line 25
+
+#line 25
+
+
+#line 26
+typeattribute mediaextractor halclientdomain;
+#line 26
+typeattribute mediaextractor hal_allocator_client;
+#line 26
+
+#line 26
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 26
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 26
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 26
+
+#line 26
+typeattribute mediaextractor hal_allocator;
+#line 26
+# Find passthrough HAL implementations
+#line 26
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 26
+
+#line 26
+
+
+
+#line 28
+allow mediaextractor cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 28
+allow mediaextractor cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 28
+
+
+#line 29
+allow mediaextractor cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 29
+allow mediaextractor cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 29
+
+allow mediaextractor proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 32
+
+#line 32
+allow mediaextractor anr_data_file:file append;
+#line 32
+allow mediaextractor dumpstate:fd use;
+#line 32
+allow mediaextractor incidentd:fd use;
+#line 32
+# TODO: Figure out why write is needed.
+#line 32
+allow mediaextractor dumpstate:fifo_file { append write };
+#line 32
+allow mediaextractor incidentd:fifo_file { append write };
+#line 32
+allow mediaextractor system_server:fifo_file { append write };
+#line 32
+allow mediaextractor tombstoned:unix_stream_socket connectto;
+#line 32
+allow mediaextractor tombstoned:fd use;
+#line 32
+allow mediaextractor tombstoned_crash_socket:sock_file write;
+#line 32
+allow mediaextractor tombstone_data_file:file append;
+#line 32
+
+
+# allow mediaextractor read permissions for file sources
+allow mediaextractor { sdcard_type fuse }:file { getattr read };
+allow mediaextractor media_rw_data_file:file { getattr read };
+allow mediaextractor { app_data_file privapp_data_file }:file { getattr read };
+
+# Read resources from open apk files passed over Binder
+allow mediaextractor apk_data_file:file { read getattr };
+allow mediaextractor asec_apk_file:file { read getattr };
+allow mediaextractor ringtone_file:file { read getattr };
+
+# overlay package access
+allow mediaextractor vendor_overlay_file:file { read map };
+
+# scan extractor library directory to dynamically load extractors
+allow mediaextractor system_file:dir { read open };
+
+###
+### neverallow rules
+###
+
+# mediaextractor should never execute any executable without a
+# domain transition
+neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediaextractor domain:{ udp_socket rawip_socket } *;
+neverallow mediaextractor { domain }:tcp_socket *;
+
+# mediaextractor should not be opening /data files directly. Any files
+# it touches (with a few exceptions) need to be passed to it via a file
+# descriptor opened outside the process.
+neverallow mediaextractor {
+ data_file_type
+ # for loading media extractor plugins
+
+}:file open;
+#line 1 "system/sepolicy/private/mediametrics.te"
+typeattribute mediametrics coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init mediametrics_exec:file { getattr open read execute map };
+#line 3
+allow init mediametrics:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow mediametrics mediametrics_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init mediametrics:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init mediametrics:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init mediametrics_exec:process mediametrics;
+#line 3
+
+#line 3
+
+
+# Needed for stats callback registration to statsd.
+allow mediametrics stats_service:service_manager find;
+allow mediametrics statsmanager_service:service_manager find;
+
+#line 8
+# Call the server domain and optionally transfer references to it.
+#line 8
+allow mediametrics statsd:binder { call transfer };
+#line 8
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 8
+allow statsd mediametrics:binder transfer;
+#line 8
+# Receive and use open files from the server.
+#line 8
+allow mediametrics statsd:fd use;
+#line 8
+
+
+
+#line 10
+# Call the servicemanager and transfer references to it.
+#line 10
+allow mediametrics servicemanager:binder { call transfer };
+#line 10
+# Allow servicemanager to send out callbacks
+#line 10
+allow servicemanager mediametrics:binder { call transfer };
+#line 10
+# servicemanager performs getpidcon on clients.
+#line 10
+allow servicemanager mediametrics:dir search;
+#line 10
+allow servicemanager mediametrics:file { read open };
+#line 10
+allow servicemanager mediametrics:process getattr;
+#line 10
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+
+#line 11
+# Call the server domain and optionally transfer references to it.
+#line 11
+allow mediametrics binderservicedomain:binder { call transfer };
+#line 11
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 11
+allow binderservicedomain mediametrics:binder transfer;
+#line 11
+# Receive and use open files from the server.
+#line 11
+allow mediametrics binderservicedomain:fd use;
+#line 11
+
+
+#line 12
+typeattribute mediametrics binderservicedomain;
+#line 12
+
+
+
+#line 14
+ allow mediametrics mediametrics_service:service_manager { add find };
+#line 14
+ neverallow { domain -mediametrics } mediametrics_service:service_manager add;
+#line 14
+
+#line 14
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 14
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 14
+
+#line 14
+
+
+allow mediametrics system_server:fd use;
+
+
+#line 18
+allow mediametrics cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow mediametrics cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+
+#line 19
+allow mediametrics cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow mediametrics cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 19
+
+allow mediametrics proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# allows interactions with dumpsys to GMScore
+allow mediametrics { app_data_file privapp_data_file }:file write;
+
+# allow access to package manager for uid->apk mapping
+allow mediametrics package_native_service:service_manager find;
+
+# Allow metrics service to send information to statsd socket.
+
+#line 29
+allow mediametrics statsdw_socket:sock_file write;
+#line 29
+allow mediametrics statsd:unix_dgram_socket sendto;
+#line 29
+
+
+###
+### neverallow rules
+###
+
+# mediametrics should never execute any executable without a
+# domain transition
+neverallow mediametrics { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediametrics domain:{ udp_socket rawip_socket } *;
+neverallow mediametrics { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/mediaprovider.te"
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+typeattribute mediaprovider coredomain;
+
+#line 7
+typeattribute mediaprovider appdomain;
+#line 7
+# Label tmpfs objects for all apps.
+#line 7
+type_transition mediaprovider tmpfs:file appdomain_tmpfs;
+#line 7
+
+#line 7
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 7
+type mediaprovider_userfaultfd;
+#line 7
+type_transition mediaprovider mediaprovider:anon_inode mediaprovider_userfaultfd "[userfaultfd]";
+#line 7
+# Allow domain to create/use userfaultfd anon_inode.
+#line 7
+allow mediaprovider mediaprovider_userfaultfd:anon_inode { create ioctl read };
+#line 7
+# Suppress errors generate during bugreport
+#line 7
+dontaudit su mediaprovider_userfaultfd:anon_inode *;
+#line 7
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 7
+neverallow { domain -mediaprovider } mediaprovider_userfaultfd:anon_inode *;
+#line 7
+
+#line 7
+allow mediaprovider appdomain_tmpfs:file { execute getattr map read write };
+#line 7
+neverallow { mediaprovider -runas_app -shell -simpleperf } { domain -mediaprovider }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+neverallow { appdomain -runas_app -shell -simpleperf -mediaprovider } mediaprovider:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+# The Android security model guarantees the confidentiality and integrity
+#line 7
+# of application data and execution state. Ptrace bypasses those
+#line 7
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 7
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 7
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 7
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 7
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 7
+# live lock conditions.
+#line 7
+neverallow { domain -mediaprovider -crash_dump -runas_app -simpleperf } mediaprovider:process ptrace;
+#line 7
+
+
+# DownloadProvider accesses the network.
+
+#line 10
+typeattribute mediaprovider netdomain;
+#line 10
+
+
+# DownloadProvider uses /cache.
+allow mediaprovider cache_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow mediaprovider cache_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow mediaprovider cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+# mediaprovider searches through /cache looking for orphans
+# Ignore denials to /cache/recovery and /cache/backup.
+dontaudit mediaprovider cache_private_backup_file:dir getattr;
+dontaudit mediaprovider cache_recovery_file:dir getattr;
+
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider { mnt_media_rw_file }:dir search;
+
+allow mediaprovider app_api_service:service_manager find;
+allow mediaprovider audioserver_service:service_manager find;
+allow mediaprovider cameraserver_service:service_manager find;
+allow mediaprovider drmserver_service:service_manager find;
+allow mediaprovider mediaextractor_service:service_manager find;
+allow mediaprovider mediaserver_service:service_manager find;
+
+# Allow MediaProvider to read/write cached ringtones (opened by system).
+allow mediaprovider ringtone_file:file { getattr read write };
+
+# MtpServer uses /dev/mtp_usb
+allow mediaprovider mtp_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# MtpServer uses /dev/usb-ffs/mtp
+allow mediaprovider functionfs:dir search;
+allow mediaprovider functionfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm mediaprovider functionfs:file ioctl 0x80096782;
+allowxperm mediaprovider functionfs:file ioctl 0x000067e7;
+
+# MtpServer sets sys.usb.ffs.mtp.ready
+
+#line 45
+allow mediaprovider ffs_config_prop:file { getattr open read map };
+#line 45
+
+
+#line 46
+
+#line 46
+allow mediaprovider property_socket:sock_file write;
+#line 46
+allow mediaprovider init:unix_stream_socket connectto;
+#line 46
+
+#line 46
+allow mediaprovider ffs_control_prop:property_service set;
+#line 46
+
+#line 46
+allow mediaprovider ffs_control_prop:file { getattr open read map };
+#line 46
+
+#line 46
+
+
+# DownloadManager may retrieve DRM status
+
+#line 49
+allow mediaprovider drm_service_config_prop:file { getattr open read map };
+#line 49
+
+#line 1 "system/sepolicy/private/mediaprovider_app.te"
+###
+### A domain for further sandboxing the MediaProvider mainline module.
+###
+type mediaprovider_app, domain, coredomain, bpfdomain;
+
+
+#line 6
+typeattribute mediaprovider_app appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition mediaprovider_app tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type mediaprovider_app_userfaultfd;
+#line 6
+type_transition mediaprovider_app mediaprovider_app:anon_inode mediaprovider_app_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow mediaprovider_app mediaprovider_app_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su mediaprovider_app_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -mediaprovider_app } mediaprovider_app_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow mediaprovider_app appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { mediaprovider_app -runas_app -shell -simpleperf } { domain -mediaprovider_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -mediaprovider_app } mediaprovider_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -mediaprovider_app -crash_dump -runas_app -simpleperf } mediaprovider_app:process ptrace;
+#line 6
+
+
+# Access to /mnt/pass_through.
+
+#line 9
+allow mediaprovider_app mnt_pass_through_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow mediaprovider_app mnt_pass_through_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 9
+
+
+# Allow MediaProvider to host a FUSE daemon for external storage
+allow mediaprovider_app fuse_device:chr_file { read write ioctl getattr };
+
+# Allow MediaProvider to access fuseblk devices for external storage.
+allow mediaprovider_app fuseblk:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow mediaprovider_app fuseblk:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow MediaProvider to read/write media_rw_data_file files and dirs
+allow mediaprovider_app media_userdir_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow mediaprovider_app media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow mediaprovider_app media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# Talk to the DRM service
+allow mediaprovider_app drmserver_service:service_manager find;
+
+# Talk to the MediaServer service
+allow mediaprovider_app mediaserver_service:service_manager find;
+
+# Talk to the AudioServer service
+allow mediaprovider_app audioserver_service:service_manager find;
+
+# Talk to the MediaCodec APIs that log media metrics
+allow mediaprovider_app mediametrics_service:service_manager find;
+
+# Talk to regular app services
+allow mediaprovider_app app_api_service:service_manager find;
+
+# Talk to the GPU service
+
+#line 39
+# Call the server domain and optionally transfer references to it.
+#line 39
+allow mediaprovider_app gpuservice:binder { call transfer };
+#line 39
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 39
+allow gpuservice mediaprovider_app:binder transfer;
+#line 39
+# Receive and use open files from the server.
+#line 39
+allow mediaprovider_app gpuservice:fd use;
+#line 39
+
+
+# Talk to statsd
+allow mediaprovider_app statsmanager_service:service_manager find;
+
+#line 43
+# Call the server domain and optionally transfer references to it.
+#line 43
+allow mediaprovider_app statsd:binder { call transfer };
+#line 43
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 43
+allow statsd mediaprovider_app:binder transfer;
+#line 43
+# Receive and use open files from the server.
+#line 43
+allow mediaprovider_app statsd:fd use;
+#line 43
+
+
+# read pipe-max-size configuration
+allow mediaprovider_app proc_pipe_conf:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow MediaProvider to set extended attributes (such as quota project ID)
+# on media files.
+allowxperm mediaprovider_app media_rw_data_file:{ dir file } ioctl {
+ 0x801c581f
+ 0x401c5820
+ 0x80086601
+ 0x40086602
+};
+
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider_app { mnt_media_rw_file }:dir search;
+
+allow mediaprovider_app proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+#Allow MediaProvider to see if sdcardfs is in use
+
+#line 63
+allow mediaprovider_app storage_config_prop:file { getattr open read map };
+#line 63
+
+
+
+#line 65
+allow mediaprovider_app drm_service_config_prop:file { getattr open read map };
+#line 65
+
+
+allow mediaprovider_app gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow mediaprovider_app gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+dontaudit mediaprovider_app sysfs_vendor_sched:dir search;
+dontaudit mediaprovider_app sysfs_vendor_sched:file { open append write lock map };
+
+# bpfprog access for FUSE BPF
+allow mediaprovider_app fs_bpf:file read;
+allow mediaprovider_app bpfloader:bpf { map_read map_write prog_run };
+
+# boot animations on oem are stored with specific label
+allow mediaprovider_app bootanim_oem_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/mediaserver.te"
+typeattribute mediaserver coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init mediaserver_exec:file { getattr open read execute map };
+#line 3
+allow init mediaserver:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow mediaserver mediaserver_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init mediaserver:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init mediaserver:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init mediaserver_exec:process mediaserver;
+#line 3
+
+#line 3
+
+
+#line 4
+type_transition mediaserver tmpfs:file mediaserver_tmpfs;
+#line 4
+allow mediaserver mediaserver_tmpfs:file { read write getattr map };
+#line 4
+
+allow mediaserver appdomain_tmpfs:file { getattr map read write };
+
+# allocate and use graphic buffers
+
+#line 8
+typeattribute mediaserver halclientdomain;
+#line 8
+typeattribute mediaserver hal_graphics_allocator_client;
+#line 8
+
+#line 8
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 8
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 8
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 8
+
+#line 8
+typeattribute mediaserver hal_graphics_allocator;
+#line 8
+# Find passthrough HAL implementations
+#line 8
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 8
+
+#line 8
+
+
+#line 9
+typeattribute mediaserver halclientdomain;
+#line 9
+typeattribute mediaserver hal_configstore_client;
+#line 9
+
+#line 9
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 9
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 9
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 9
+
+#line 9
+typeattribute mediaserver hal_configstore;
+#line 9
+# Find passthrough HAL implementations
+#line 9
+allow hal_configstore system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_configstore vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_configstore vendor_file:file { read open getattr execute map };
+#line 9
+
+#line 9
+
+
+#line 10
+typeattribute mediaserver halclientdomain;
+#line 10
+typeattribute mediaserver hal_drm_client;
+#line 10
+
+#line 10
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 10
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 10
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 10
+
+#line 10
+typeattribute mediaserver hal_drm;
+#line 10
+# Find passthrough HAL implementations
+#line 10
+allow hal_drm system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 10
+allow hal_drm vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 10
+allow hal_drm vendor_file:file { read open getattr execute map };
+#line 10
+
+#line 10
+
+
+#line 11
+typeattribute mediaserver halclientdomain;
+#line 11
+typeattribute mediaserver hal_omx_client;
+#line 11
+
+#line 11
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 11
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 11
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 11
+
+#line 11
+typeattribute mediaserver hal_omx;
+#line 11
+# Find passthrough HAL implementations
+#line 11
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 11
+
+#line 11
+
+
+#line 12
+typeattribute mediaserver halclientdomain;
+#line 12
+typeattribute mediaserver hal_codec2_client;
+#line 12
+
+#line 12
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 12
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 12
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 12
+
+#line 12
+typeattribute mediaserver hal_codec2;
+#line 12
+# Find passthrough HAL implementations
+#line 12
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 12
+
+#line 12
+
+
+
+#line 14
+
+#line 14
+allow mediaserver property_socket:sock_file write;
+#line 14
+allow mediaserver init:unix_stream_socket connectto;
+#line 14
+
+#line 14
+allow mediaserver audio_prop:property_service set;
+#line 14
+
+#line 14
+allow mediaserver audio_prop:file { getattr open read map };
+#line 14
+
+#line 14
+
+
+
+#line 16
+allow mediaserver drm_service_config_prop:file { getattr open read map };
+#line 16
+
+
+#line 17
+allow mediaserver media_config_prop:file { getattr open read map };
+#line 17
+
+
+# Allow MediaCodec running on mediaserver to read media_native flags
+
+#line 20
+allow mediaserver device_config_media_native_prop:file { getattr open read map };
+#line 20
+
+
+# Allow mediaserver to start media.transcoding service via ctl.start.
+
+#line 23
+
+#line 23
+allow mediaserver property_socket:sock_file write;
+#line 23
+allow mediaserver init:unix_stream_socket connectto;
+#line 23
+
+#line 23
+allow mediaserver ctl_mediatranscoding_prop:property_service set;
+#line 23
+
+#line 23
+allow mediaserver ctl_mediatranscoding_prop:file { getattr open read map };
+#line 23
+
+#line 23
+;
+
+# Allow mediaserver to read SDK sandbox data files
+allow mediaserver sdk_sandbox_data_file:file { getattr read };
+
+# Needed for stats callback registration to statsd.
+allow mediaserver stats_service:service_manager find;
+allow mediaserver statsmanager_service:service_manager find;
+
+#line 31
+# Call the server domain and optionally transfer references to it.
+#line 31
+allow mediaserver statsd:binder { call transfer };
+#line 31
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 31
+allow statsd mediaserver:binder transfer;
+#line 31
+# Receive and use open files from the server.
+#line 31
+allow mediaserver statsd:fd use;
+#line 31
+
+
+# Allow mediaserver to communicate with Surface provided
+# by virtual camera.
+
+#line 35
+# Call the server domain and optionally transfer references to it.
+#line 35
+allow mediaserver virtual_camera:binder { call transfer };
+#line 35
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 35
+allow virtual_camera mediaserver:binder transfer;
+#line 35
+# Receive and use open files from the server.
+#line 35
+allow mediaserver virtual_camera:fd use;
+#line 35
+
+
+typeattribute mediaserver mlstrustedsubject;
+
+
+#line 39
+typeattribute mediaserver netdomain;
+#line 39
+
+
+
+#line 41
+allow mediaserver sdcard_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow mediaserver sdcard_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 41
+
+
+#line 42
+allow mediaserver fuse:dir { open getattr read search ioctl lock watch watch_reads };
+#line 42
+allow mediaserver fuse:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 42
+
+
+#line 43
+allow mediaserver cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 43
+allow mediaserver cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 43
+
+
+#line 44
+allow mediaserver cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 44
+allow mediaserver cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 44
+
+
+# stat /proc/self
+allow mediaserver proc:lnk_file getattr;
+
+# open /vendor/lib/mediadrm
+allow mediaserver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 55
+
+
+
+#line 57
+# Call the servicemanager and transfer references to it.
+#line 57
+allow mediaserver servicemanager:binder { call transfer };
+#line 57
+# Allow servicemanager to send out callbacks
+#line 57
+allow servicemanager mediaserver:binder { call transfer };
+#line 57
+# servicemanager performs getpidcon on clients.
+#line 57
+allow servicemanager mediaserver:dir search;
+#line 57
+allow servicemanager mediaserver:file { read open };
+#line 57
+allow servicemanager mediaserver:process getattr;
+#line 57
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 57
+# all domains in domain.te.
+#line 57
+
+
+#line 58
+# Call the server domain and optionally transfer references to it.
+#line 58
+allow mediaserver binderservicedomain:binder { call transfer };
+#line 58
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 58
+allow binderservicedomain mediaserver:binder transfer;
+#line 58
+# Receive and use open files from the server.
+#line 58
+allow mediaserver binderservicedomain:fd use;
+#line 58
+
+
+#line 59
+# Call the server domain and optionally transfer references to it.
+#line 59
+allow mediaserver appdomain:binder { call transfer };
+#line 59
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 59
+allow appdomain mediaserver:binder transfer;
+#line 59
+# Receive and use open files from the server.
+#line 59
+allow mediaserver appdomain:fd use;
+#line 59
+
+
+#line 60
+typeattribute mediaserver binderservicedomain;
+#line 60
+
+
+allow mediaserver media_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow mediaserver media_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow mediaserver { app_data_file privapp_data_file }:file { append getattr ioctl lock map read write };
+allow mediaserver { sdcard_type fuse }:file write;
+allow mediaserver gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow mediaserver gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow mediaserver video_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow mediaserver video_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read resources from open apk files passed over Binder.
+allow mediaserver apk_data_file:file { read getattr };
+allow mediaserver asec_apk_file:file { read getattr };
+allow mediaserver ringtone_file:file { read getattr };
+
+# Read /data/data/com.android.providers.telephony files passed over Binder.
+allow mediaserver radio_data_file:file { read getattr };
+
+# Use pipes passed over Binder from app domains.
+allow mediaserver appdomain:fifo_file { getattr read write };
+
+allow mediaserver rpmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Inter System processes communicate over named pipe (FIFO)
+allow mediaserver system_server:fifo_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 87
+allow mediaserver media_rw_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 87
+allow mediaserver media_rw_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 87
+
+
+# Grant access to read files on appfuse.
+allow mediaserver app_fuse_file:file { read getattr };
+
+# Needed on some devices for playing DRM protected content,
+# but seems expected and appropriate for all devices.
+
+#line 94
+allow mediaserver drmserver_socket:sock_file write;
+#line 94
+allow mediaserver drmserver:unix_stream_socket connectto;
+#line 94
+
+
+# Needed on some devices for playing audio on paired BT device,
+# but seems appropriate for all devices.
+
+#line 98
+allow mediaserver bluetooth_socket:sock_file write;
+#line 98
+allow mediaserver bluetooth:unix_stream_socket connectto;
+#line 98
+
+
+# Needed for mediaserver to send information to statsd socket.
+
+#line 101
+allow mediaserver statsdw_socket:sock_file write;
+#line 101
+allow mediaserver statsd:unix_dgram_socket sendto;
+#line 101
+
+
+
+#line 103
+ allow mediaserver mediaserver_service:service_manager { add find };
+#line 103
+ neverallow { domain -mediaserver } mediaserver_service:service_manager add;
+#line 103
+
+#line 103
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 103
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 103
+
+#line 103
+
+allow mediaserver activity_service:service_manager find;
+allow mediaserver appops_service:service_manager find;
+allow mediaserver audio_service:service_manager find;
+allow mediaserver audioserver_service:service_manager find;
+allow mediaserver cameraserver_service:service_manager find;
+allow mediaserver batterystats_service:service_manager find;
+allow mediaserver drmserver_service:service_manager find;
+allow mediaserver mediaextractor_service:service_manager find;
+allow mediaserver mediametrics_service:service_manager find;
+allow mediaserver media_session_service:service_manager find;
+allow mediaserver package_native_service:service_manager find;
+allow mediaserver permission_service:service_manager find;
+allow mediaserver permission_checker_service:service_manager find;
+allow mediaserver power_service:service_manager find;
+allow mediaserver processinfo_service:service_manager find;
+allow mediaserver scheduling_policy_service:service_manager find;
+allow mediaserver surfaceflinger_service:service_manager find;
+
+# for ModDrm/MediaPlayer
+allow mediaserver mediadrmserver_service:service_manager find;
+
+# For hybrid interfaces
+allow mediaserver hidl_token_hwservice:hwservice_manager find;
+
+# /oem access
+allow mediaserver oemfs:dir search;
+allow mediaserver oemfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# /oem boot animation file
+allow mediaserver bootanim_oem_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# /vendor apk access
+allow mediaserver vendor_app_file:file { read map getattr };
+
+
+#line 138
+ allow drmserver mediaserver:dir search;
+#line 138
+ allow drmserver mediaserver:file { read open };
+#line 138
+ allow drmserver mediaserver:process getattr;
+#line 138
+
+allow mediaserver drmserver:drmservice {
+ consumeRights
+ setPlaybackStatus
+ openDecryptSession
+ closeDecryptSession
+ initializeDecryptUnit
+ decrypt
+ finalizeDecryptUnit
+ pread
+};
+
+# only allow unprivileged socket ioctl commands
+allowxperm mediaserver self:{ rawip_socket tcp_socket udp_socket }
+ ioctl {
+#line 152
+{
+#line 152
+# Socket ioctls for gathering information about the interface
+#line 152
+0x00008906 0x00008907
+#line 152
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 152
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 152
+# Wireless extension ioctls. Primarily get functions.
+#line 152
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 152
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 152
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 152
+} {
+#line 152
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 152
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 152
+} };
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow mediaserver media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow mediaserver media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access to media in /data/preloads
+allow mediaserver preloads_media_file:file { getattr read ioctl };
+
+allow mediaserver ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow mediaserver dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow mediaserver dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow mediaserver hal_graphics_allocator:fd use;
+allow mediaserver hal_graphics_composer:fd use;
+allow mediaserver hal_camera:fd use;
+
+allow mediaserver system_server:fd use;
+
+# b/120491318 allow mediaserver to access void:fd
+allow mediaserver vold:fd use;
+
+# overlay package access
+allow mediaserver vendor_overlay_file:file { read getattr map };
+
+
+#line 178
+typeattribute mediaserver halclientdomain;
+#line 178
+typeattribute mediaserver hal_allocator_client;
+#line 178
+
+#line 178
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 178
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 178
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 178
+
+#line 178
+typeattribute mediaserver hal_allocator;
+#line 178
+# Find passthrough HAL implementations
+#line 178
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 178
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 178
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 178
+
+#line 178
+
+
+###
+### neverallow rules
+###
+
+# mediaserver should never execute any executable without a
+# domain transition
+neverallow mediaserver { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediaserver domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 189
+{
+#line 189
+# qualcomm rmnet ioctls
+#line 189
+0x00006900 0x00006902
+#line 189
+# socket ioctls
+#line 189
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 189
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 189
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 189
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 189
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 189
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 189
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 189
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 189
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 189
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 189
+# device and protocol specific ioctls
+#line 189
+0x000089f0-0x000089ff
+#line 189
+0x000089e0-0x000089ef
+#line 189
+# Wireless extension ioctls
+#line 189
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 189
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 189
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 189
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 189
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 189
+0x00008b34 0x00008b35 0x00008b36
+#line 189
+# Dev private ioctl i.e. hardware specific ioctls
+#line 189
+0x00008be0-0x00008bff
+#line 189
+};
+#line 1 "system/sepolicy/private/mediaswcodec.te"
+typeattribute mediaswcodec coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init mediaswcodec_exec:file { getattr open read execute map };
+#line 3
+allow init mediaswcodec:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow mediaswcodec mediaswcodec_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init mediaswcodec:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init mediaswcodec:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init mediaswcodec_exec:process mediaswcodec;
+#line 3
+
+#line 3
+
+
+
+#line 5
+allow mediaswcodec device_config_media_native_prop:file { getattr open read map };
+#line 5
+
+
+#line 6
+allow mediaswcodec device_config_swcodec_native_prop:file { getattr open read map };
+#line 6
+
+
+
+#line 8
+typeattribute mediaswcodec halserverdomain;
+#line 8
+typeattribute mediaswcodec hal_codec2_server;
+#line 8
+typeattribute mediaswcodec hal_codec2;
+#line 8
+
+
+# mediaswcodec may use an input surface from a different Codec2 service or an
+# OMX service
+
+#line 12
+typeattribute mediaswcodec halclientdomain;
+#line 12
+typeattribute mediaswcodec hal_codec2_client;
+#line 12
+
+#line 12
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 12
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 12
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 12
+
+#line 12
+typeattribute mediaswcodec hal_codec2;
+#line 12
+# Find passthrough HAL implementations
+#line 12
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 12
+
+#line 12
+
+
+#line 13
+typeattribute mediaswcodec halclientdomain;
+#line 13
+typeattribute mediaswcodec hal_omx_client;
+#line 13
+
+#line 13
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 13
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 13
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 13
+
+#line 13
+typeattribute mediaswcodec hal_omx;
+#line 13
+# Find passthrough HAL implementations
+#line 13
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 13
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 13
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 13
+
+#line 13
+
+
+
+#line 15
+typeattribute mediaswcodec halclientdomain;
+#line 15
+typeattribute mediaswcodec hal_allocator_client;
+#line 15
+
+#line 15
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 15
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 15
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 15
+
+#line 15
+typeattribute mediaswcodec hal_allocator;
+#line 15
+# Find passthrough HAL implementations
+#line 15
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 15
+
+#line 15
+
+
+#line 16
+typeattribute mediaswcodec halclientdomain;
+#line 16
+typeattribute mediaswcodec hal_graphics_allocator_client;
+#line 16
+
+#line 16
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 16
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 16
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 16
+
+#line 16
+typeattribute mediaswcodec hal_graphics_allocator;
+#line 16
+# Find passthrough HAL implementations
+#line 16
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 16
+
+#line 16
+
+
+# get aac_drc_* properties
+
+#line 19
+allow mediaswcodec aac_drc_prop:file { getattr open read map };
+#line 19
+
+
+
+#line 21
+
+#line 21
+allow mediaswcodec anr_data_file:file append;
+#line 21
+allow mediaswcodec dumpstate:fd use;
+#line 21
+allow mediaswcodec incidentd:fd use;
+#line 21
+# TODO: Figure out why write is needed.
+#line 21
+allow mediaswcodec dumpstate:fifo_file { append write };
+#line 21
+allow mediaswcodec incidentd:fifo_file { append write };
+#line 21
+allow mediaswcodec system_server:fifo_file { append write };
+#line 21
+allow mediaswcodec tombstoned:unix_stream_socket connectto;
+#line 21
+allow mediaswcodec tombstoned:fd use;
+#line 21
+allow mediaswcodec tombstoned_crash_socket:sock_file write;
+#line 21
+allow mediaswcodec tombstone_data_file:file append;
+#line 21
+
+
+allow mediaswcodec dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow mediaswcodec dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow mediaswcodec gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow mediaswcodec gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+###
+### Neverallow rules
+###
+
+# mediaswcodec_server should never execute any executable without a
+# domain transition
+neverallow mediaswcodec { file_type fs_type }:file execute_no_trans;
+
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediaswcodec domain:{ udp_socket rawip_socket } *;
+neverallow mediaswcodec { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/mediatranscoding.te"
+# mediatranscoding - daemon for transcoding video and image.
+type mediatranscoding_exec, system_file_type, exec_type, file_type;
+type mediatranscoding_tmpfs, file_type;
+typeattribute mediatranscoding coredomain;
+
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init mediatranscoding_exec:file { getattr open read execute map };
+#line 6
+allow init mediatranscoding:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow mediatranscoding mediatranscoding_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init mediatranscoding:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init mediatranscoding:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init mediatranscoding_exec:process mediatranscoding;
+#line 6
+
+#line 6
+
+
+#line 7
+type_transition mediatranscoding tmpfs:file mediatranscoding_tmpfs;
+#line 7
+allow mediatranscoding mediatranscoding_tmpfs:file { read write getattr map };
+#line 7
+
+allow mediatranscoding appdomain_tmpfs:file { getattr map read write };
+
+
+#line 10
+# Call the servicemanager and transfer references to it.
+#line 10
+allow mediatranscoding servicemanager:binder { call transfer };
+#line 10
+# Allow servicemanager to send out callbacks
+#line 10
+allow servicemanager mediatranscoding:binder { call transfer };
+#line 10
+# servicemanager performs getpidcon on clients.
+#line 10
+allow servicemanager mediatranscoding:dir search;
+#line 10
+allow servicemanager mediatranscoding:file { read open };
+#line 10
+allow servicemanager mediatranscoding:process getattr;
+#line 10
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+
+#line 11
+# Call the server domain and optionally transfer references to it.
+#line 11
+allow mediatranscoding binderservicedomain:binder { call transfer };
+#line 11
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 11
+allow binderservicedomain mediatranscoding:binder transfer;
+#line 11
+# Receive and use open files from the server.
+#line 11
+allow mediatranscoding binderservicedomain:fd use;
+#line 11
+
+
+#line 12
+# Call the server domain and optionally transfer references to it.
+#line 12
+allow mediatranscoding appdomain:binder { call transfer };
+#line 12
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 12
+allow appdomain mediatranscoding:binder transfer;
+#line 12
+# Receive and use open files from the server.
+#line 12
+allow mediatranscoding appdomain:fd use;
+#line 12
+
+
+#line 13
+typeattribute mediatranscoding binderservicedomain;
+#line 13
+
+
+
+#line 15
+ allow mediatranscoding mediatranscoding_service:service_manager { add find };
+#line 15
+ neverallow { domain -mediatranscoding } mediatranscoding_service:service_manager add;
+#line 15
+
+#line 15
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 15
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 15
+
+#line 15
+
+
+
+#line 17
+typeattribute mediatranscoding halclientdomain;
+#line 17
+typeattribute mediatranscoding hal_graphics_allocator_client;
+#line 17
+
+#line 17
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 17
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 17
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 17
+
+#line 17
+typeattribute mediatranscoding hal_graphics_allocator;
+#line 17
+# Find passthrough HAL implementations
+#line 17
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 17
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 17
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 17
+
+#line 17
+
+
+#line 18
+typeattribute mediatranscoding halclientdomain;
+#line 18
+typeattribute mediatranscoding hal_configstore_client;
+#line 18
+
+#line 18
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 18
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 18
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 18
+
+#line 18
+typeattribute mediatranscoding hal_configstore;
+#line 18
+# Find passthrough HAL implementations
+#line 18
+allow hal_configstore system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_configstore vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_configstore vendor_file:file { read open getattr execute map };
+#line 18
+
+#line 18
+
+
+#line 19
+typeattribute mediatranscoding halclientdomain;
+#line 19
+typeattribute mediatranscoding hal_omx_client;
+#line 19
+
+#line 19
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 19
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 19
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 19
+
+#line 19
+typeattribute mediatranscoding hal_omx;
+#line 19
+# Find passthrough HAL implementations
+#line 19
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 19
+
+#line 19
+
+
+#line 20
+typeattribute mediatranscoding halclientdomain;
+#line 20
+typeattribute mediatranscoding hal_codec2_client;
+#line 20
+
+#line 20
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 20
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 20
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 20
+
+#line 20
+typeattribute mediatranscoding hal_codec2;
+#line 20
+# Find passthrough HAL implementations
+#line 20
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 20
+
+#line 20
+
+
+#line 21
+typeattribute mediatranscoding halclientdomain;
+#line 21
+typeattribute mediatranscoding hal_allocator_client;
+#line 21
+
+#line 21
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 21
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 21
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 21
+
+#line 21
+typeattribute mediatranscoding hal_allocator;
+#line 21
+# Find passthrough HAL implementations
+#line 21
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 21
+
+#line 21
+
+
+allow mediatranscoding mediaserver_service:service_manager find;
+allow mediatranscoding mediametrics_service:service_manager find;
+allow mediatranscoding mediaextractor_service:service_manager find;
+allow mediatranscoding package_native_service:service_manager find;
+allow mediatranscoding thermal_service:service_manager find;
+
+allow mediatranscoding system_server:fd use;
+allow mediatranscoding activity_service:service_manager find;
+
+# allow mediatranscoding service read/write permissions for file sources
+allow mediatranscoding sdcardfs:file { getattr read write };
+allow mediatranscoding media_rw_data_file:file { getattr read write };
+allow mediatranscoding apk_data_file:file { getattr read };
+allow mediatranscoding app_data_file:file { getattr read write };
+allow mediatranscoding shell_data_file:file { getattr read write };
+
+# allow mediatranscoding service write permission to statsd socket
+
+#line 40
+allow mediatranscoding statsdw_socket:sock_file write;
+#line 40
+allow mediatranscoding statsd:unix_dgram_socket sendto;
+#line 40
+
+
+# Allow mediatranscoding to access the DMA-BUF system heap
+allow mediatranscoding dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+allow mediatranscoding gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow mediatranscoding gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow mediatranscoding service to access media-related system properties
+
+#line 49
+allow mediatranscoding media_config_prop:file { getattr open read map };
+#line 49
+
+
+# mediatranscoding should never execute any executable without a
+# domain transition
+neverallow mediatranscoding { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediatranscoding domain:{ udp_socket rawip_socket } *;
+neverallow mediatranscoding { domain }:tcp_socket *;
+#line 1 "system/sepolicy/private/mediatuner.te"
+# mediatuner - mediatuner daemon
+type mediatuner, domain;
+type mediatuner_exec, system_file_type, exec_type, file_type;
+
+typeattribute mediatuner coredomain;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init mediatuner_exec:file { getattr open read execute map };
+#line 7
+allow init mediatuner:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow mediatuner mediatuner_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init mediatuner:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init mediatuner:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init mediatuner_exec:process mediatuner;
+#line 7
+
+#line 7
+
+
+#line 8
+typeattribute mediatuner halclientdomain;
+#line 8
+typeattribute mediatuner hal_tv_tuner_client;
+#line 8
+
+#line 8
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 8
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 8
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 8
+
+#line 8
+typeattribute mediatuner hal_tv_tuner;
+#line 8
+# Find passthrough HAL implementations
+#line 8
+allow hal_tv_tuner system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow hal_tv_tuner vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow hal_tv_tuner vendor_file:file { read open getattr execute map };
+#line 8
+
+#line 8
+
+
+
+#line 10
+# Call the servicemanager and transfer references to it.
+#line 10
+allow mediatuner servicemanager:binder { call transfer };
+#line 10
+# Allow servicemanager to send out callbacks
+#line 10
+allow servicemanager mediatuner:binder { call transfer };
+#line 10
+# servicemanager performs getpidcon on clients.
+#line 10
+allow servicemanager mediatuner:dir search;
+#line 10
+allow servicemanager mediatuner:file { read open };
+#line 10
+allow servicemanager mediatuner:process getattr;
+#line 10
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 10
+# all domains in domain.te.
+#line 10
+
+
+#line 11
+# Call the server domain and optionally transfer references to it.
+#line 11
+allow mediatuner appdomain:binder { call transfer };
+#line 11
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 11
+allow appdomain mediatuner:binder transfer;
+#line 11
+# Receive and use open files from the server.
+#line 11
+allow mediatuner appdomain:fd use;
+#line 11
+
+
+#line 12
+typeattribute mediatuner binderservicedomain;
+#line 12
+
+
+
+#line 14
+ allow mediatuner mediatuner_service:service_manager { add find };
+#line 14
+ neverallow { domain -mediatuner } mediatuner_service:service_manager add;
+#line 14
+
+#line 14
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 14
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 14
+
+#line 14
+
+allow mediatuner system_server:fd use;
+allow mediatuner tv_tuner_resource_mgr_service:service_manager find;
+allow mediatuner package_native_service:service_manager find;
+
+#line 18
+# Call the server domain and optionally transfer references to it.
+#line 18
+allow mediatuner system_server:binder { call transfer };
+#line 18
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 18
+allow system_server mediatuner:binder transfer;
+#line 18
+# Receive and use open files from the server.
+#line 18
+allow mediatuner system_server:fd use;
+#line 18
+
+
+# Read ro.tuner.lazyhal
+
+#line 21
+allow mediatuner tuner_config_prop:file { getattr open read map };
+#line 21
+
+
+# Read tuner.server.enable
+
+#line 24
+allow mediatuner tuner_server_ctl_prop:file { getattr open read map };
+#line 24
+
+
+###
+### neverallow rules
+###
+
+# mediatuner should never execute any executable without a
+# domain transition
+neverallow mediatuner { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediatuner domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 35
+{
+#line 35
+# qualcomm rmnet ioctls
+#line 35
+0x00006900 0x00006902
+#line 35
+# socket ioctls
+#line 35
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 35
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 35
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 35
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 35
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 35
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 35
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 35
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 35
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 35
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 35
+# device and protocol specific ioctls
+#line 35
+0x000089f0-0x000089ff
+#line 35
+0x000089e0-0x000089ef
+#line 35
+# Wireless extension ioctls
+#line 35
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 35
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 35
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 35
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 35
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 35
+0x00008b34 0x00008b35 0x00008b36
+#line 35
+# Dev private ioctl i.e. hardware specific ioctls
+#line 35
+0x00008be0-0x00008bff
+#line 35
+};
+
+#line 1 "system/sepolicy/private/memcgv2_activation_depth.te"
+# The memcgv2_activation_depth.sh script run by init.
+
+type memcgv2_activation_depth, domain, coredomain;
+type memcgv2_activation_depth_exec, system_file_type, exec_type, file_type;
+
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init memcgv2_activation_depth_exec:file { getattr open read execute map };
+#line 6
+allow init memcgv2_activation_depth:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow memcgv2_activation_depth memcgv2_activation_depth_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init memcgv2_activation_depth:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init memcgv2_activation_depth:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init memcgv2_activation_depth_exec:process memcgv2_activation_depth;
+#line 6
+
+#line 6
+
+
+# required permissions to run the script from init
+allow memcgv2_activation_depth shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow memcgv2_activation_depth system_file:file { getattr execute execute_no_trans map };
+allow memcgv2_activation_depth toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# for system default max activation depth
+allow memcgv2_activation_depth cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# /metadata/libprocessgroup/*
+allow memcgv2_activation_depth libprocessgroup_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow memcgv2_activation_depth libprocessgroup_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# /sys/fs/cgroup/cgroup.controllers
+# /sys/fs/cgroup/**/cgroup.subtree_control
+allow memcgv2_activation_depth cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+allow memcgv2_activation_depth cgroup_v2:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# For reboot, when reducing the depth override
+
+#line 26
+
+#line 26
+allow memcgv2_activation_depth property_socket:sock_file write;
+#line 26
+allow memcgv2_activation_depth init:unix_stream_socket connectto;
+#line 26
+
+#line 26
+allow memcgv2_activation_depth powerctl_prop:property_service set;
+#line 26
+
+#line 26
+allow memcgv2_activation_depth powerctl_prop:file { getattr open read map };
+#line 26
+
+#line 26
+
+#line 1 "system/sepolicy/private/microfuchsiad.te"
+
+#line 1
+ type microfuchsiad, domain, coredomain;
+#line 1
+ type microfuchsiad_exec, system_file_type, exec_type, file_type;
+#line 1
+
+#line 1
+ # Host dynamic AIDL services
+#line 1
+
+#line 1
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow init microfuchsiad_exec:file { getattr open read execute map };
+#line 1
+allow init microfuchsiad:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow microfuchsiad microfuchsiad_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit init microfuchsiad:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow init microfuchsiad:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition init microfuchsiad_exec:process microfuchsiad;
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+# Call the servicemanager and transfer references to it.
+#line 1
+allow microfuchsiad servicemanager:binder { call transfer };
+#line 1
+# Allow servicemanager to send out callbacks
+#line 1
+allow servicemanager microfuchsiad:binder { call transfer };
+#line 1
+# servicemanager performs getpidcon on clients.
+#line 1
+allow servicemanager microfuchsiad:dir search;
+#line 1
+allow servicemanager microfuchsiad:file { read open };
+#line 1
+allow servicemanager microfuchsiad:process getattr;
+#line 1
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 1
+# all domains in domain.te.
+#line 1
+
+#line 1
+
+#line 1
+ allow microfuchsiad microfuchsia_service:service_manager { add find };
+#line 1
+ neverallow { domain -microfuchsiad } microfuchsia_service:service_manager add;
+#line 1
+
+#line 1
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 1
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ # Call back into system server
+#line 1
+
+#line 1
+# Call the server domain and optionally transfer references to it.
+#line 1
+allow microfuchsiad system_server:binder { call transfer };
+#line 1
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1
+allow system_server microfuchsiad:binder transfer;
+#line 1
+# Receive and use open files from the server.
+#line 1
+allow microfuchsiad system_server:fd use;
+#line 1
+
+#line 1
+
+#line 1
+ # Start a VM
+#line 1
+
+#line 1
+# Transition to virtualizationmanager when the client executes it.
+#line 1
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow microfuchsiad virtualizationmanager_exec:file { getattr open read execute map };
+#line 1
+allow microfuchsiad virtualizationmanager:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+allow virtualizationmanager microfuchsiad:process sigchld;
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit microfuchsiad virtualizationmanager:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow microfuchsiad virtualizationmanager:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition microfuchsiad virtualizationmanager_exec:process virtualizationmanager;
+#line 1
+
+#line 1
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 1
+allow { virtualizationmanager crosvm } microfuchsiad:unix_stream_socket { ioctl getattr read write };
+#line 1
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 1
+allow { virtualizationmanager crosvm } microfuchsiad:fd use;
+#line 1
+# Let the client use file descriptors created by virtualizationmanager.
+#line 1
+allow microfuchsiad virtualizationmanager:fd use;
+#line 1
+# Allow piping console log to the client
+#line 1
+allow { virtualizationmanager crosvm } microfuchsiad:fifo_file { ioctl getattr read write };
+#line 1
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 1
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 1
+# the client can only connect to VMs that it owns.
+#line 1
+allow microfuchsiad virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 1
+# Allow client to inspect hypervisor capabilities
+#line 1
+
+#line 1
+allow microfuchsiad hypervisor_prop:file { getattr open read map };
+#line 1
+
+#line 1
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 1
+allow microfuchsiad virtualizationservice_data_file:file { getattr read };
+#line 1
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 1
+allow virtualizationmanager microfuchsiad:dir search;
+#line 1
+allow virtualizationmanager microfuchsiad:file read;
+#line 1
+allow virtualizationmanager microfuchsiad:lnk_file read;
+#line 1
+
+#line 1
+
+#line 1
+ # Create pty devices
+#line 1
+ allow microfuchsiad devpts:chr_file { read write open getattr ioctl };
+#line 18
+
+#line 1 "system/sepolicy/private/migrate_legacy_obb_data.te"
+type migrate_legacy_obb_data, domain, coredomain;
+type migrate_legacy_obb_data_exec, system_file_type, exec_type, file_type;
+
+allow migrate_legacy_obb_data media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow migrate_legacy_obb_data media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow migrate_legacy_obb_data shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allow migrate_legacy_obb_data toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allow migrate_legacy_obb_data self:capability { chown dac_override dac_read_search fowner fsetid };
+
+allow migrate_legacy_obb_data mnt_user_file:dir search;
+allow migrate_legacy_obb_data mnt_user_file:lnk_file read;
+allow migrate_legacy_obb_data storage_file:dir search;
+allow migrate_legacy_obb_data storage_file:lnk_file read;
+
+allow migrate_legacy_obb_data sdcard_type:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow migrate_legacy_obb_data sdcard_type:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# TODO: This should not be necessary. We don't deliberately hand over
+# any open file descriptors to this domain, so anything that triggers this
+# should be a candidate for O_CLOEXEC.
+allow migrate_legacy_obb_data installd:fd use;
+
+# This rule is required to let this process read /proc/{parent_pid}/mount.
+# TODO: Why is this required ?
+allow migrate_legacy_obb_data installd:file read;
+#line 1 "system/sepolicy/private/misctrl.te"
+# binary for generic misc partition management
+type misctrl, domain, coredomain;
+type misctrl_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init misctrl_exec:file { getattr open read execute map };
+#line 5
+allow init misctrl:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow misctrl misctrl_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init misctrl:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init misctrl:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init misctrl_exec:process misctrl;
+#line 5
+
+#line 5
+
+
+allow misctrl misc_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow misctrl block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 9
+ allow misctrl { metadata_file gsi_metadata_file_type }:dir search;
+#line 9
+ allow misctrl gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 9
+ allow misctrl { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 9
+
+
+
+#line 11
+
+#line 11
+allow misctrl property_socket:sock_file write;
+#line 11
+allow misctrl init:unix_stream_socket connectto;
+#line 11
+
+#line 11
+allow misctrl misctrl_prop:property_service set;
+#line 11
+
+#line 11
+allow misctrl misctrl_prop:file { getattr open read map };
+#line 11
+
+#line 11
+
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit misctrl sysfs_dt_firmware_android:dir search;
+dontaudit misctrl vendor_property_type:file read;
+#line 1 "system/sepolicy/private/mlstrustedsubject.te"
+# MLS override can't be used to access private app data.
+
+# Apps should not normally be mlstrustedsubject, but if they must be
+# they cannot use this to access app private data files; their own app
+# data files must use a different label.
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+} {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:file ~{ read write map getattr ioctl lock append };
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+} {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:dir ~{ read getattr search };
+
+
+#line 27
+ neverallow {
+#line 27
+ mlstrustedsubject
+#line 27
+ -artd # compile secondary dex files
+#line 27
+ -installd
+#line 27
+ -vold # encryption of storage areas
+#line 27
+ -vold_prepare_subdirs # creation of storage area directories
+#line 27
+ } { storage_area_dir storage_area_app_dir }:dir ~{ read getattr search };
+#line 35
+
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+ -system_server
+ -adbd
+ -runas
+ -zygote
+} {
+ app_data_file
+ privapp_data_file
+ storage_area_content_file
+}:dir { read getattr search };
+
+
+#line 51
+ neverallow {
+#line 51
+ mlstrustedsubject
+#line 51
+ -artd # compile secondary dex files
+#line 51
+ -installd
+#line 51
+ -system_server
+#line 51
+ -adbd
+#line 51
+ -runas
+#line 51
+ -vold # encryption of storage area directories
+#line 51
+ -vold_prepare_subdirs # creation of storage area directories
+#line 51
+ -zygote
+#line 51
+ } { storage_area_dir storage_area_app_dir }:dir { read getattr search };
+#line 63
+
+#line 1 "system/sepolicy/private/mm_events.te"
+type mm_events, domain, coredomain;
+type mm_events_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init mm_events_exec:file { getattr open read execute map };
+#line 4
+allow init mm_events:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow mm_events mm_events_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init mm_events:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init mm_events:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init mm_events_exec:process mm_events;
+#line 4
+
+#line 4
+
+
+allow mm_events shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow running the sleep command to rate limit attempts
+# to arm mm_events on failure.
+allow mm_events toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allow mm_events perfetto_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+
+#line 14
+# Allow the necessary permissions.
+#line 14
+
+#line 14
+# Old domain may exec the file and transition to the new domain.
+#line 14
+allow mm_events perfetto_exec:file { getattr open read execute map };
+#line 14
+allow mm_events perfetto:process transition;
+#line 14
+# New domain is entered by executing the file.
+#line 14
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 14
+# New domain can send SIGCHLD to its caller.
+#line 14
+allow perfetto mm_events:process sigchld;
+#line 14
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 14
+dontaudit mm_events perfetto:process noatsecure;
+#line 14
+# XXX dontaudit candidate but requires further study.
+#line 14
+allow mm_events perfetto:process { siginh rlimitinh };
+#line 14
+
+#line 14
+# Make the transition occur by default.
+#line 14
+type_transition mm_events perfetto_exec:process perfetto;
+#line 14
+
+#line 1 "system/sepolicy/private/mmd.te"
+# mmd memory management daemon
+type mmd, domain;
+typeattribute mmd coredomain;
+type mmd_exec, system_file_type, exec_type, file_type;
+
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init mmd_exec:file { getattr open read execute map };
+#line 6
+allow init mmd:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow mmd mmd_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init mmd:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init mmd:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init mmd_exec:process mmd;
+#line 6
+
+#line 6
+
+
+# Set mmd.enabled_aconfig properties.
+
+#line 9
+
+#line 9
+allow mmd property_socket:sock_file write;
+#line 9
+allow mmd init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow mmd mmd_prop:property_service set;
+#line 9
+
+#line 9
+allow mmd mmd_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+#line 10
+allow mmd device_config_mmd_native_prop:file { getattr open read map };
+#line 10
+
+
+# mmd binder setup
+
+#line 13
+ allow mmd mmd_service:service_manager { add find };
+#line 13
+ neverallow { domain -mmd } mmd_service:service_manager add;
+#line 13
+
+#line 13
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 13
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 13
+
+#line 13
+
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow mmd servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager mmd:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager mmd:dir search;
+#line 14
+allow servicemanager mmd:file { read open };
+#line 14
+allow servicemanager mmd:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+# Read /proc/swaps
+allow mmd proc_swaps:file { getattr open read ioctl lock map watch watch_reads };
+
+# zram sysfs access
+allow mmd sysfs_zram:dir search;
+allow mmd sysfs_zram:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# procfs
+allow mmd proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# mkswap /dev/block/zram command
+allow mmd block_device:dir search;
+allow mmd swap_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# swapon syscall
+allow mmd self:capability sys_admin;
+#line 1 "system/sepolicy/private/modprobe.te"
+typeattribute modprobe coredomain;
+
+allow modprobe proc_modules:file { getattr open read ioctl lock map watch watch_reads };
+allow modprobe proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+allow modprobe self:{ capability cap_userns } sys_module;
+allow modprobe kernel:key search;
+allow modprobe system_dlkm_file:dir search;
+allow modprobe system_dlkm_file:file { getattr open read ioctl lock map watch watch_reads };
+allow modprobe system_dlkm_file:system module_load;
+#line 13
+
+#line 1 "system/sepolicy/private/mtectrl.te"
+# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader.
+type mtectrl, domain, coredomain;
+type mtectrl_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init mtectrl_exec:file { getattr open read execute map };
+#line 5
+allow init mtectrl:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow mtectrl mtectrl_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init mtectrl:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init mtectrl:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init mtectrl_exec:process mtectrl;
+#line 5
+
+#line 5
+
+
+# to set the sys prop to match the bootloader message state.
+
+#line 8
+
+#line 8
+allow mtectrl property_socket:sock_file write;
+#line 8
+allow mtectrl init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow mtectrl arm64_memtag_prop:property_service set;
+#line 8
+
+#line 8
+allow mtectrl arm64_memtag_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+# mtectrl communicates the request to the bootloader via the misc partition.
+# needs to write to update the request in misc partition, and read to sync
+# back to the property.
+allow mtectrl misc_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow mtectrl block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 15
+ allow mtectrl { metadata_file gsi_metadata_file_type }:dir search;
+#line 15
+ allow mtectrl gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 15
+ allow mtectrl { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit mtectrl sysfs_dt_firmware_android:dir search;
+dontaudit mtectrl vendor_property_type:file read;
+#line 1 "system/sepolicy/private/net.te"
+# Bind to ports.
+allow {netdomain -ephemeral_app -sdk_sandbox_all} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind;
+allow {netdomain -ephemeral_app -sdk_sandbox_all} port_type:udp_socket name_bind;
+allow {netdomain -ephemeral_app -sdk_sandbox_all} port_type:tcp_socket name_bind;
+
+# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
+# untrusted_apps.
+# b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from
+# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere
+# to avoid app-compat breakage.
+allow {
+ netdomain
+ -ephemeral_app
+ -mediaprovider
+ -priv_app
+ -sdk_sandbox_all
+ -untrusted_app_all
+} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };
+
+###
+### Domain with network access
+###
+
+# Use network sockets.
+allow netdomain self:tcp_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+allow netdomain self:{ icmp_socket udp_socket rawip_socket } { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Connect to ports.
+allow netdomain port_type:tcp_socket name_connect;
+# See changes to the routing table.
+allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
+
+# Talks to netd via dnsproxyd socket.
+
+#line 34
+allow netdomain dnsproxyd_socket:sock_file write;
+#line 34
+allow netdomain netd:unix_stream_socket connectto;
+#line 34
+
+
+# Talks to netd via fwmarkd socket.
+
+#line 37
+allow netdomain fwmarkd_socket:sock_file write;
+#line 37
+allow netdomain netd:unix_stream_socket connectto;
+#line 37
+
+#line 1 "system/sepolicy/private/netd.te"
+typeattribute netd coredomain;
+typeattribute netd bpfdomain;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init netd_exec:file { getattr open read execute map };
+#line 4
+allow init netd:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow netd netd_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init netd:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init netd:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init netd_exec:process netd;
+#line 4
+
+#line 4
+
+
+# Allow netd to spawn dnsmasq in it's own domain
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow netd dnsmasq_exec:file { getattr open read execute map };
+#line 7
+allow netd dnsmasq:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow dnsmasq dnsmasq_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+allow dnsmasq netd:process sigchld;
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit netd dnsmasq:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow netd dnsmasq:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition netd dnsmasq_exec:process dnsmasq;
+#line 7
+
+
+allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:dir search;
+allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read };
+allow netd { fs_bpf fs_bpf_netd_shared }:file write;
+
+# give netd permission to setup iptables rule with xt_bpf, attach program to cgroup,
+# create maps, and read/write maps created by bpfloader, itself and NS/SS mainline networking
+allow netd bpfloader:bpf prog_run;
+allow netd self:bpf map_create;
+allow netd { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
+# TODO: Remove this after we remove all bpf interactions from netd.
+allow netd self:key_socket create;
+
+
+#line 24
+
+#line 24
+allow netd property_socket:sock_file write;
+#line 24
+allow netd init:unix_stream_socket connectto;
+#line 24
+
+#line 24
+allow netd ctl_mdnsd_prop:property_service set;
+#line 24
+
+#line 24
+allow netd ctl_mdnsd_prop:file { getattr open read map };
+#line 24
+
+#line 24
+
+
+#line 25
+
+#line 25
+allow netd property_socket:sock_file write;
+#line 25
+allow netd init:unix_stream_socket connectto;
+#line 25
+
+#line 25
+allow netd netd_stable_secret_prop:property_service set;
+#line 25
+
+#line 25
+allow netd netd_stable_secret_prop:file { getattr open read map };
+#line 25
+
+#line 25
+
+
+
+#line 27
+allow netd adbd_config_prop:file { getattr open read map };
+#line 27
+
+
+#line 28
+allow netd hwservicemanager_prop:file { getattr open read map };
+#line 28
+
+
+#line 29
+allow netd device_config_netd_native_prop:file { getattr open read map };
+#line 29
+
+
+# Allow netd to write to statsd.
+
+#line 32
+allow netd statsdw_socket:sock_file write;
+#line 32
+allow netd statsd:unix_dgram_socket sendto;
+#line 32
+
+
+# Allow netd to send callbacks to network_stack
+
+#line 35
+# Call the server domain and optionally transfer references to it.
+#line 35
+allow netd network_stack:binder { call transfer };
+#line 35
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 35
+allow network_stack netd:binder transfer;
+#line 35
+# Receive and use open files from the server.
+#line 35
+allow netd network_stack:fd use;
+#line 35
+
+
+# Allow netd to send dump info to dumpstate
+allow netd dumpstate:fd use;
+allow netd dumpstate:fifo_file { getattr write };
+
+
+#line 41
+typeattribute netd netdomain;
+#line 41
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 43
+allow netd mdnsd_socket:sock_file write;
+#line 43
+allow netd mdnsd:unix_stream_socket connectto;
+#line 43
+
+# in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls.
+allowxperm netd self:udp_socket ioctl
+#line 45
+{
+#line 45
+# qualcomm rmnet ioctls
+#line 45
+0x00006900 0x00006902
+#line 45
+# socket ioctls
+#line 45
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 45
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 45
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 45
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 45
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 45
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 45
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 45
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 45
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 45
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 45
+# device and protocol specific ioctls
+#line 45
+0x000089f0-0x000089ff
+#line 45
+0x000089e0-0x000089ef
+#line 45
+# Wireless extension ioctls
+#line 45
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 45
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 45
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 45
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 45
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 45
+0x00008b34 0x00008b35 0x00008b36
+#line 45
+# Dev private ioctl i.e. hardware specific ioctls
+#line 45
+0x00008be0-0x00008bff
+#line 45
+};
+
+
+#line 47
+allow netd cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 47
+allow netd cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 47
+
+
+allow netd system_server:fd use;
+
+allow netd self:{ capability cap_userns } { net_admin net_raw net_bind_service kill };
+# Note: fsetid is deliberately not included above. fsetid checks are
+# triggered by chmod on a directory or file owned by a group other
+# than one of the groups assigned to the current process to see if
+# the setgid bit should be cleared, regardless of whether the setgid
+# bit was even set. We do not appear to truly need this capability
+# for netd to operate.
+dontaudit netd self:{ capability cap_userns } fsetid;
+
+# Allow netd to open /dev/tun, set it up and pass it to clatd
+allow netd tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm netd tun_device:chr_file ioctl { 0x800454d2 0x400454ca };
+allow netd self:tun_socket create;
+
+allow netd self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netd self:netlink_route_socket nlmsg_write;
+allow netd self:netlink_nflog_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netd self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netd self:netlink_tcpdiag_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_read nlmsg_write };
+allow netd self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netd self:netlink_netfilter_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netd shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow netd system_file:file { getattr execute execute_no_trans map };
+allow netd vendor_file:file { getattr execute execute_no_trans map };
+allow netd devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't
+# exist, suppress the denial.
+allow netd system_file:file lock;
+dontaudit netd system_file:dir write;
+
+
+#line 82
+allow netd proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 82
+allow netd proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 82
+
+# For /proc/sys/net/ipv[46]/route/flush.
+allow netd proc_net_type:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Enables PppController and interface enumeration (among others)
+allow netd sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 88
+allow netd sysfs_net:dir { open getattr read search ioctl lock watch watch_reads };
+#line 88
+allow netd sysfs_net:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 88
+
+
+# Allows setting interface MTU
+allow netd sysfs_net:file { open append write lock map };
+
+# TODO: added to match above sysfs rule. Remove me?
+allow netd sysfs_usb:file write;
+
+
+#line 96
+allow netd cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 96
+allow netd cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 96
+
+
+# TODO: netd previously thought it needed these permissions to do WiFi related
+# work. However, after all the WiFi stuff is gone, we still need them.
+# Why?
+allow netd self:{ capability cap_userns } { dac_override dac_read_search chown };
+
+# Needed to update /data/misc/net/rt_tables
+allow netd net_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow netd net_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow netd self:{ capability cap_userns } fowner;
+
+# Needed to lock the iptables lock.
+allow netd system_file:file lock;
+
+# Allow netd to spawn dnsmasq in it's own domain
+allow netd dnsmasq:process { sigkill signal };
+
+# Allow netd to publish a binder service and make binder calls.
+
+#line 115
+# Call the servicemanager and transfer references to it.
+#line 115
+allow netd servicemanager:binder { call transfer };
+#line 115
+# Allow servicemanager to send out callbacks
+#line 115
+allow servicemanager netd:binder { call transfer };
+#line 115
+# servicemanager performs getpidcon on clients.
+#line 115
+allow servicemanager netd:dir search;
+#line 115
+allow servicemanager netd:file { read open };
+#line 115
+allow servicemanager netd:process getattr;
+#line 115
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 115
+# all domains in domain.te.
+#line 115
+
+
+#line 116
+ allow netd netd_service:service_manager { add find };
+#line 116
+ neverallow { domain -netd } netd_service:service_manager add;
+#line 116
+
+#line 116
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 116
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 116
+
+#line 116
+
+
+#line 117
+ allow netd dnsresolver_service:service_manager { add find };
+#line 117
+ neverallow { domain -netd } dnsresolver_service:service_manager add;
+#line 117
+
+#line 117
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 117
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 117
+
+#line 117
+
+
+#line 118
+ allow netd mdns_service:service_manager { add find };
+#line 118
+ neverallow { domain -netd } mdns_service:service_manager add;
+#line 118
+
+#line 118
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 118
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 118
+
+#line 118
+
+allow netd dumpstate:fifo_file { getattr write };
+
+# Allow netd to call into the system server so it can check permissions.
+allow netd system_server:binder call;
+allow netd permission_service:service_manager find;
+
+# Allow netd to talk to the framework service which collects netd events.
+allow netd netd_listener_service:service_manager find;
+
+# Allow netd to operate on sockets that are passed to it.
+allow netd netdomain:{
+ icmp_socket
+ tcp_socket
+ udp_socket
+ rawip_socket
+ tun_socket
+} { read write getattr setattr getopt setopt };
+allow netd netdomain:fd use;
+
+# give netd permission to read and write netlink xfrm
+allow netd self:netlink_xfrm_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_write nlmsg_read };
+
+# Allow netd to register as hal server.
+
+#line 142
+ allow netd system_net_netd_hwservice:hwservice_manager { add find };
+#line 142
+ allow netd hidl_base_hwservice:hwservice_manager add;
+#line 142
+ neverallow { domain -netd } system_net_netd_hwservice:hwservice_manager add;
+#line 142
+
+
+#line 143
+# Call the hwservicemanager and transfer references to it.
+#line 143
+allow netd hwservicemanager:binder { call transfer };
+#line 143
+# Allow hwservicemanager to send out callbacks
+#line 143
+allow hwservicemanager netd:binder { call transfer };
+#line 143
+# hwservicemanager performs getpidcon on clients.
+#line 143
+allow hwservicemanager netd:dir search;
+#line 143
+allow hwservicemanager netd:file { read open map };
+#line 143
+allow hwservicemanager netd:process getattr;
+#line 143
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 143
+# all domains in domain.te.
+#line 143
+
+
+# AIDL hal server
+
+#line 146
+# Call the server domain and optionally transfer references to it.
+#line 146
+allow system_net_netd_service servicemanager:binder { call transfer };
+#line 146
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 146
+allow servicemanager system_net_netd_service:binder transfer;
+#line 146
+# Receive and use open files from the server.
+#line 146
+allow system_net_netd_service servicemanager:fd use;
+#line 146
+
+
+#line 147
+ allow netd system_net_netd_service:service_manager { add find };
+#line 147
+ neverallow { domain -netd } system_net_netd_service:service_manager add;
+#line 147
+
+#line 147
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 147
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 147
+
+#line 147
+
+
+###
+### Neverallow rules
+###
+### netd should NEVER do any of this
+
+# Block device access.
+neverallow netd dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow netd { domain }:process ptrace;
+
+# Write to /system.
+neverallow netd system_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Write to files in /data/data or system files on /data
+neverallow netd { app_data_file_type system_data_file }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# only system_server, dumpstate and network stack app may find netd service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} netd_service:service_manager find;
+
+# only system_server, dumpstate and network stack app may find dnsresolver service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} dnsresolver_service:service_manager find;
+
+# only system_server, dumpstate and network stack app may find mdns service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} mdns_service:service_manager find;
+
+# apps may not interact with netd over binder.
+neverallow { appdomain -network_stack } netd:binder call;
+neverallow netd { appdomain -network_stack }:binder call;
+
+# If an already existing file is opened with O_CREATE, the kernel might generate
+# a false report of a create denial. Silence these denials and make sure that
+# inappropriate permissions are not granted.
+neverallow netd proc_net:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+dontaudit netd proc_net:dir write;
+
+neverallow netd sysfs_net:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+dontaudit netd sysfs_net:dir write;
+
+# Netd should not have SYS_ADMIN privs.
+neverallow netd self:capability sys_admin;
+dontaudit netd self:capability sys_admin;
+
+# Netd should not have SYS_MODULE privs, nor should it be requesting module loads
+# (things it requires should be built directly into the kernel)
+dontaudit netd self:capability sys_module;
+
+dontaudit netd appdomain:unix_stream_socket { read write };
+
+# persist.netd.stable_secret contains RFC 7217 secret key which should never be
+# leaked to other processes. Make sure it never leaks.
+neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
+# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
+neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
+#line 1 "system/sepolicy/private/netutils_wrapper.te"
+typeattribute netutils_wrapper coredomain;
+typeattribute netutils_wrapper bpfdomain;
+
+
+#line 4
+allow netutils_wrapper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 4
+allow netutils_wrapper system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 4
+;
+
+# For netutils (ip, iptables, tc)
+allow netutils_wrapper self:{ capability cap_userns } net_raw;
+
+allow netutils_wrapper system_file:file { execute execute_no_trans };
+allow netutils_wrapper proc_net_type:file { open read getattr };
+allow netutils_wrapper self:rawip_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netutils_wrapper self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow netutils_wrapper self:{ capability cap_userns } net_admin;
+# ip utils need everything but ioctl
+allow netutils_wrapper self:netlink_route_socket ~ioctl;
+allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
+
+# For netutils (ndc) to be able to talk to netd
+allow netutils_wrapper netd_service:service_manager find;
+allow netutils_wrapper dnsresolver_service:service_manager find;
+allow netutils_wrapper mdns_service:service_manager find;
+
+#line 22
+# Call the servicemanager and transfer references to it.
+#line 22
+allow netutils_wrapper servicemanager:binder { call transfer };
+#line 22
+# Allow servicemanager to send out callbacks
+#line 22
+allow servicemanager netutils_wrapper:binder { call transfer };
+#line 22
+# servicemanager performs getpidcon on clients.
+#line 22
+allow servicemanager netutils_wrapper:dir search;
+#line 22
+allow servicemanager netutils_wrapper:file { read open };
+#line 22
+allow servicemanager netutils_wrapper:process getattr;
+#line 22
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 22
+# all domains in domain.te.
+#line 22
+;
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow netutils_wrapper netd:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow netd netutils_wrapper:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow netutils_wrapper netd:fd use;
+#line 23
+;
+
+# For vendor code that update the iptables rules at runtime. They need to reload
+# the whole chain including the xt_bpf rules. They need to access to the pinned
+# program when reloading the rule.
+allow netutils_wrapper { fs_bpf fs_bpf_netd_shared fs_bpf_vendor }:dir search;
+allow netutils_wrapper { fs_bpf fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read };
+allow netutils_wrapper { fs_bpf }:file write;
+allow netutils_wrapper bpfloader:bpf prog_run;
+
+# For /data/misc/net access to ndc and ip
+
+#line 34
+allow netutils_wrapper net_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 34
+allow netutils_wrapper net_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 34
+
+
+
+#line 36
+# Allow the necessary permissions.
+#line 36
+
+#line 36
+# Old domain may exec the file and transition to the new domain.
+#line 36
+allow {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+} netutils_wrapper_exec:file { getattr open read execute map };
+#line 36
+allow {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+} netutils_wrapper:process transition;
+#line 36
+# New domain is entered by executing the file.
+#line 36
+allow netutils_wrapper netutils_wrapper_exec:file { entrypoint open read execute getattr map };
+#line 36
+# New domain can send SIGCHLD to its caller.
+#line 36
+allow netutils_wrapper {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+}:process sigchld;
+#line 36
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 36
+dontaudit {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+} netutils_wrapper:process noatsecure;
+#line 36
+# XXX dontaudit candidate but requires further study.
+#line 36
+allow {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+} netutils_wrapper:process { siginh rlimitinh };
+#line 36
+
+#line 36
+# Make the transition occur by default.
+#line 36
+type_transition {
+#line 36
+ domain
+#line 36
+ -coredomain
+#line 36
+ -appdomain
+#line 36
+} netutils_wrapper_exec:process netutils_wrapper;
+#line 40
+
+
+###
+### Neverallow rules
+###
+
+# suppress spurious denials
+dontaudit netutils_wrapper self:{ capability cap_userns } sys_resource;
+dontaudit netutils_wrapper sysfs_type:file read;
+
+# netutils wrapper may only use the following capabilities.
+neverallow netutils_wrapper self:{ capability cap_userns } ~{ net_admin net_raw };
+
+neverallow domain netutils_wrapper_exec:file execute_no_trans;
+#line 1 "system/sepolicy/private/network_stack.te"
+# Networking service app
+typeattribute network_stack coredomain;
+typeattribute network_stack mlstrustedsubject;
+typeattribute network_stack bpfdomain;
+
+
+#line 6
+typeattribute network_stack appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition network_stack tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type network_stack_userfaultfd;
+#line 6
+type_transition network_stack network_stack:anon_inode network_stack_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow network_stack network_stack_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su network_stack_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -network_stack } network_stack_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow network_stack appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { network_stack -runas_app -shell -simpleperf } { domain -network_stack }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -network_stack } network_stack:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -network_stack -crash_dump -runas_app -simpleperf } network_stack:process ptrace;
+#line 6
+;
+
+#line 7
+typeattribute network_stack netdomain;
+#line 7
+;
+
+allow network_stack self:{ capability cap_userns } {
+ net_admin
+ net_bind_service
+ net_broadcast
+ net_raw
+};
+
+allow network_stack self:{ capability2 cap2_userns } wake_alarm;
+
+# Allow access to net_admin ioctl, DHCP server uses SIOCSARP
+allowxperm network_stack self:udp_socket ioctl
+#line 19
+{
+#line 19
+# qualcomm rmnet ioctls
+#line 19
+0x00006900 0x00006902
+#line 19
+# socket ioctls
+#line 19
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 19
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 19
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 19
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 19
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 19
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 19
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 19
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 19
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 19
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 19
+# device and protocol specific ioctls
+#line 19
+0x000089f0-0x000089ff
+#line 19
+0x000089e0-0x000089ef
+#line 19
+# Wireless extension ioctls
+#line 19
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 19
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 19
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 19
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 19
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 19
+0x00008b34 0x00008b35 0x00008b36
+#line 19
+# Dev private ioctl i.e. hardware specific ioctls
+#line 19
+0x00008be0-0x00008bff
+#line 19
+};
+
+# The DhcpClient uses packet_sockets
+allow network_stack self:packet_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Monitor neighbors via netlink.
+allow network_stack self:netlink_route_socket nlmsg_write;
+
+# Use netlink uevent sockets.
+allow network_stack self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# give network_stack the same netlink permissions as netd
+allow network_stack self:netlink_nflog_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow network_stack self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow network_stack self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+allow network_stack app_api_service:service_manager find;
+allow network_stack dnsresolver_service:service_manager find;
+allow network_stack mdns_service:service_manager find;
+allow network_stack netd_service:service_manager find;
+allow network_stack network_watchlist_service:service_manager find;
+allow network_stack radio_service:service_manager find;
+allow network_stack system_config_service:service_manager find;
+allow network_stack radio_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow network_stack radio_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 45
+# Call the server domain and optionally transfer references to it.
+#line 45
+allow network_stack netd:binder { call transfer };
+#line 45
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 45
+allow netd network_stack:binder transfer;
+#line 45
+# Receive and use open files from the server.
+#line 45
+allow network_stack netd:fd use;
+#line 45
+;
+
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
+allow network_stack self:key_socket create;
+# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
+# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
+dontaudit network_stack self:key_socket getopt;
+
+# Grant read permission of connectivity namespace system property prefix.
+
+#line 55
+allow network_stack device_config_connectivity_prop:file { getattr open read map };
+#line 55
+
+
+# Create/use netlink_tcpdiag_socket to get tcp info
+allow network_stack self:netlink_tcpdiag_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_read nlmsg_write };
+############### Tethering Service app - Tethering.apk ##############
+
+#line 60
+typeattribute network_stack halclientdomain;
+#line 60
+typeattribute network_stack hal_tetheroffload_client;
+#line 60
+
+#line 60
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 60
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 60
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 60
+
+#line 60
+typeattribute network_stack hal_tetheroffload;
+#line 60
+# Find passthrough HAL implementations
+#line 60
+allow hal_tetheroffload system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 60
+allow hal_tetheroffload vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 60
+allow hal_tetheroffload vendor_file:file { read open getattr execute map };
+#line 60
+
+#line 60
+
+# Create and share netlink_netfilter_sockets for tetheroffload.
+allow network_stack self:netlink_netfilter_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow network_stack network_stack_service:service_manager find;
+# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF.
+allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search;
+allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write };
+allow network_stack bpfloader:bpf prog_run;
+allow network_stack self:bpf map_create;
+allow network_stack { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+
+# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace
+
+#line 72
+allow network_stack device_config_tethering_u_or_later_native_prop:file { getattr open read map };
+#line 72
+
+
+# Use XFRM (IPsec) netlink sockets
+allow network_stack self:netlink_xfrm_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_write nlmsg_read };
+
+# tun device used for 3rd party vpn apps and test network manager
+allow network_stack tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm network_stack tun_device:chr_file ioctl { 0x800454d2 0x400454ca 0x400454cd 0x400454e2 };
+
+############### NEVER ALLOW RULES
+# This place is as good as any for these rules,
+# and it is probably the most appropriate because
+# network_stack itself is entirely mainline code.
+
+# T+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_net_private' programs/maps.
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file *;
+
+# T+: Only the bpfloader, network_stack and system_server should ever touch 'fs_bpf_net_shared' programs/maps.
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~getattr;
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file *;
+
+# T+: Only the bpfloader, netd, network_stack and system_server should ever touch 'fs_bpf_netd_readonly' programs/maps.
+# netd's access should be readonly
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~getattr;
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file *;
+neverallow netd fs_bpf_netd_readonly:file write;
+
+# T+: Only the bpfloader, netd, netutils_wrapper, network_stack and system_server should ever touch 'fs_bpf_netd_shared' programs/maps.
+# netutils_wrapper requires access to be able to run iptables and only needs readonly access
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~getattr;
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file *;
+neverallow netutils_wrapper fs_bpf_netd_shared:file write;
+
+# S+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps.
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file *;
+#line 1 "system/sepolicy/private/nfc.te"
+# nfc subsystem
+typeattribute nfc coredomain, mlstrustedsubject;
+
+#line 3
+typeattribute nfc appdomain;
+#line 3
+# Label tmpfs objects for all apps.
+#line 3
+type_transition nfc tmpfs:file appdomain_tmpfs;
+#line 3
+
+#line 3
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 3
+type nfc_userfaultfd;
+#line 3
+type_transition nfc nfc:anon_inode nfc_userfaultfd "[userfaultfd]";
+#line 3
+# Allow domain to create/use userfaultfd anon_inode.
+#line 3
+allow nfc nfc_userfaultfd:anon_inode { create ioctl read };
+#line 3
+# Suppress errors generate during bugreport
+#line 3
+dontaudit su nfc_userfaultfd:anon_inode *;
+#line 3
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 3
+neverallow { domain -nfc } nfc_userfaultfd:anon_inode *;
+#line 3
+
+#line 3
+allow nfc appdomain_tmpfs:file { execute getattr map read write };
+#line 3
+neverallow { nfc -runas_app -shell -simpleperf } { domain -nfc }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+neverallow { appdomain -runas_app -shell -simpleperf -nfc } nfc:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+# The Android security model guarantees the confidentiality and integrity
+#line 3
+# of application data and execution state. Ptrace bypasses those
+#line 3
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 3
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 3
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 3
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 3
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 3
+# live lock conditions.
+#line 3
+neverallow { domain -nfc -crash_dump -runas_app -simpleperf } nfc:process ptrace;
+#line 3
+
+
+#line 4
+typeattribute nfc netdomain;
+#line 4
+
+
+
+#line 6
+typeattribute nfc binderservicedomain;
+#line 6
+
+
+#line 7
+ allow nfc nfc_service:service_manager { add find };
+#line 7
+ neverallow { domain -nfc } nfc_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+
+
+#line 9
+typeattribute nfc halclientdomain;
+#line 9
+typeattribute nfc hal_nfc_client;
+#line 9
+
+#line 9
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 9
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 9
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 9
+
+#line 9
+typeattribute nfc hal_nfc;
+#line 9
+# Find passthrough HAL implementations
+#line 9
+allow hal_nfc system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_nfc vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_nfc vendor_file:file { read open getattr execute map };
+#line 9
+
+#line 9
+
+
+# Data file accesses.
+allow nfc nfc_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow nfc nfc_data_file:{ file lnk_file sock_file fifo_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow nfc nfc_logs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow nfc nfc_logs_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# SoundPool loading and playback
+allow nfc audioserver_service:service_manager find;
+allow nfc drmserver_service:service_manager find;
+allow nfc mediametrics_service:service_manager find;
+allow nfc mediaextractor_service:service_manager find;
+allow nfc mediaserver_service:service_manager find;
+
+allow nfc radio_service:service_manager find;
+allow nfc app_api_service:service_manager find;
+allow nfc system_api_service:service_manager find;
+allow nfc vr_manager_service:service_manager find;
+allow nfc secure_element_service:service_manager find;
+
+
+#line 30
+
+#line 30
+allow nfc property_socket:sock_file write;
+#line 30
+allow nfc init:unix_stream_socket connectto;
+#line 30
+
+#line 30
+allow nfc nfc_prop:property_service set;
+#line 30
+
+#line 30
+allow nfc nfc_prop:file { getattr open read map };
+#line 30
+
+#line 30
+;
+
+# already open bugreport file descriptors may be shared with
+# the nfc process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow nfc shell_data_file:file read;
+
+# Allow to check whether security logging is enabled.
+
+#line 38
+allow nfc device_logging_prop:file { getattr open read map };
+#line 38
+
+#line 1 "system/sepolicy/private/odrefresh.te"
+# odrefresh
+type odrefresh, domain, coredomain, artd_subprocess_type;
+type odrefresh_exec, system_file_type, exec_type, file_type;
+
+# Allow odrefresh to create files and directories for on device signing.
+allow odrefresh apex_module_data_file:dir { getattr search };
+allow odrefresh apex_art_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelfrom };
+allow odrefresh apex_art_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelto } ;
+
+# Allow odrefresh to create data files (typically for metrics before statsd starts).
+allow odrefresh odrefresh_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow odrefresh odrefresh_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 14
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 14
+type odrefresh_userfaultfd;
+#line 14
+type_transition odrefresh odrefresh:anon_inode odrefresh_userfaultfd "[userfaultfd]";
+#line 14
+# Allow domain to create/use userfaultfd anon_inode.
+#line 14
+allow odrefresh odrefresh_userfaultfd:anon_inode { create ioctl read };
+#line 14
+# Suppress errors generate during bugreport
+#line 14
+dontaudit su odrefresh_userfaultfd:anon_inode *;
+#line 14
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 14
+neverallow { domain -odrefresh } odrefresh_userfaultfd:anon_inode *;
+#line 14
+
+
+# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
+# sets up files here and passes file descriptors for dex2oat to write to.
+allow odrefresh apex_art_staging_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow odrefresh apex_art_staging_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } relabelfrom };
+
+# Run dex2oat in its own sandbox.
+
+#line 22
+# Allow the necessary permissions.
+#line 22
+
+#line 22
+# Old domain may exec the file and transition to the new domain.
+#line 22
+allow odrefresh dex2oat_exec:file { getattr open read execute map };
+#line 22
+allow odrefresh dex2oat:process transition;
+#line 22
+# New domain is entered by executing the file.
+#line 22
+allow dex2oat dex2oat_exec:file { entrypoint open read execute getattr map };
+#line 22
+# New domain can send SIGCHLD to its caller.
+#line 22
+allow dex2oat odrefresh:process sigchld;
+#line 22
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 22
+dontaudit odrefresh dex2oat:process noatsecure;
+#line 22
+# XXX dontaudit candidate but requires further study.
+#line 22
+allow odrefresh dex2oat:process { siginh rlimitinh };
+#line 22
+
+#line 22
+# Make the transition occur by default.
+#line 22
+type_transition odrefresh dex2oat_exec:process dex2oat;
+#line 22
+
+
+# Allow odrefresh to kill dex2oat if compilation times out.
+allow odrefresh dex2oat:process sigkill;
+
+# Use devpts and fd from odsign (which exec()'s odrefresh)
+allow odrefresh odsign_devpts:chr_file { read write };
+allow odrefresh odsign:fd use;
+
+# Allow odrefresh to read /apex/apex-info-list.xml to determine
+# whether current apex is in /system or /data.
+allow odrefresh apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow updating boot animation status.
+
+#line 36
+
+#line 36
+allow odrefresh property_socket:sock_file write;
+#line 36
+allow odrefresh init:unix_stream_socket connectto;
+#line 36
+
+#line 36
+allow odrefresh bootanim_system_prop:property_service set;
+#line 36
+
+#line 36
+allow odrefresh bootanim_system_prop:file { getattr open read map };
+#line 36
+
+#line 36
+
+
+# Allow query ART device config properties
+
+#line 39
+allow odrefresh device_config_runtime_native_prop:file { getattr open read map };
+#line 39
+
+
+#line 40
+allow odrefresh device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 40
+
+
+# Do not audit unused resources from parent processes (adb, shell, su).
+# These appear to be unnecessary for odrefresh.
+dontaudit odrefresh { adbd shell }:fd use;
+dontaudit odrefresh devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+dontaudit odrefresh adbd:unix_stream_socket { getattr read write };
+
+# Read access to SELinux context files, for restorecon.
+allow odrefresh file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow odrefresh seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Check validity of SELinux context, for restorecon.
+
+#line 53
+
+#line 53
+allow odrefresh selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 53
+allow odrefresh selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 53
+
+#line 53
+allow odrefresh selinuxfs:file { open append write lock map };
+#line 53
+allow odrefresh kernel:security check_context;
+#line 53
+
+
+# odrefresh iterates over all properties to find the ones that it's interested
+# in. It's okay to ignore denials on other properties.
+dontaudit odrefresh property_type:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow to be called by artd in Pre-reboot Dexopt.
+allow odrefresh artd:fd use;
+
+# Neverallow rules.
+
+# No other processes should be creating files in the staging area.
+neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_file:file open;
+
+# No processes other than init, odrefresh, system_server, and artd access
+# odrefresh_data_files.
+# Among those, artd only needs to bind-mount /data/misc/odrefresh, but doesn't
+# need to access the files.
+neverallow { domain -init -odrefresh -system_server -artd } odrefresh_data_file:dir *;
+neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
+#line 1 "system/sepolicy/private/odsign.te"
+# odsign - on-device signing.
+type odsign, domain;
+
+# odsign - Binary for signing ART artifacts.
+typeattribute odsign coredomain;
+
+type odsign_exec, exec_type, file_type, system_file_type;
+
+# Allow init to start odsign
+
+#line 10
+
+#line 10
+# Allow the necessary permissions.
+#line 10
+
+#line 10
+# Old domain may exec the file and transition to the new domain.
+#line 10
+allow init odsign_exec:file { getattr open read execute map };
+#line 10
+allow init odsign:process transition;
+#line 10
+# New domain is entered by executing the file.
+#line 10
+allow odsign odsign_exec:file { entrypoint open read execute getattr map };
+#line 10
+# New domain can send SIGCHLD to its caller.
+#line 10
+
+#line 10
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 10
+dontaudit init odsign:process noatsecure;
+#line 10
+# XXX dontaudit candidate but requires further study.
+#line 10
+allow init odsign:process { siginh rlimitinh };
+#line 10
+
+#line 10
+# Make the transition occur by default.
+#line 10
+type_transition init odsign_exec:process odsign;
+#line 10
+
+#line 10
+
+
+# Allow using persistent storage in /data/odsign
+allow odsign odsign_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow odsign odsign_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow using persistent storage in /data/odsign/metrics - to add metrics related files
+allow odsign odsign_metrics_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow odsign odsign_metrics_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Create and use pty created by android_fork_execvp().
+
+#line 21
+# Each domain gets a unique devpts type.
+#line 21
+type odsign_devpts, fs_type;
+#line 21
+# Label the pty with the unique type when created.
+#line 21
+type_transition odsign devpts:chr_file odsign_devpts;
+#line 21
+# Allow use of the pty after creation.
+#line 21
+allow odsign odsign_devpts:chr_file { open getattr read write ioctl };
+#line 21
+allowxperm odsign odsign_devpts:chr_file ioctl {
+#line 21
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 21
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 21
+};
+#line 21
+# TIOCSTI is only ever used for exploits. Block it.
+#line 21
+# b/33073072, b/7530569
+#line 21
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+#line 21
+neverallowxperm * odsign_devpts:chr_file ioctl 0x00005412;
+#line 21
+# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
+#line 21
+# allowed to everyone via domain.te.
+#line 21
+
+
+# FS_IOC_ENABLE_VERITY and FS_IOC_MEASURE_VERITY on ART data files
+allowxperm odsign apex_art_data_file:file ioctl {
+ 0x6685 0x6686 0x80086601
+};
+
+# talk to binder services (for keystore)
+
+#line 29
+# Call the servicemanager and transfer references to it.
+#line 29
+allow odsign servicemanager:binder { call transfer };
+#line 29
+# Allow servicemanager to send out callbacks
+#line 29
+allow servicemanager odsign:binder { call transfer };
+#line 29
+# servicemanager performs getpidcon on clients.
+#line 29
+allow servicemanager odsign:dir search;
+#line 29
+allow servicemanager odsign:file { read open };
+#line 29
+allow servicemanager odsign:process getattr;
+#line 29
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 29
+# all domains in domain.te.
+#line 29
+;
+
+# talk to keystore specifically
+
+#line 32
+ allow keystore odsign:dir search;
+#line 32
+ allow keystore odsign:file { read open };
+#line 32
+ allow keystore odsign:process getattr;
+#line 32
+ allow odsign apc_service:service_manager find;
+#line 32
+ allow odsign keystore_service:service_manager find;
+#line 32
+ allow odsign legacykeystore_service:service_manager find;
+#line 32
+
+#line 32
+# Call the server domain and optionally transfer references to it.
+#line 32
+allow odsign keystore:binder { call transfer };
+#line 32
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 32
+allow keystore odsign:binder transfer;
+#line 32
+# Receive and use open files from the server.
+#line 32
+allow odsign keystore:fd use;
+#line 32
+
+#line 32
+
+#line 32
+# Call the server domain and optionally transfer references to it.
+#line 32
+allow keystore odsign:binder { call transfer };
+#line 32
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 32
+allow odsign keystore:binder transfer;
+#line 32
+# Receive and use open files from the server.
+#line 32
+allow keystore odsign:fd use;
+#line 32
+
+#line 32
+;
+
+# Use our dedicated keystore key
+allow odsign odsign_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ use
+};
+
+# talk to keymaster
+
+#line 43
+typeattribute odsign halclientdomain;
+#line 43
+typeattribute odsign hal_keymaster_client;
+#line 43
+
+#line 43
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 43
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 43
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 43
+
+#line 43
+typeattribute odsign hal_keymaster;
+#line 43
+# Find passthrough HAL implementations
+#line 43
+allow hal_keymaster system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 43
+allow hal_keymaster vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 43
+allow hal_keymaster vendor_file:file { read open getattr execute map };
+#line 43
+
+#line 43
+
+
+# For ART apex data dir access
+allow odsign apex_module_data_file:dir { getattr search };
+
+allow odsign apex_art_data_file:dir { { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } rmdir rename };
+allow odsign apex_art_data_file:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } unlink };
+
+# Run odrefresh to refresh ART artifacts
+
+#line 52
+# Allow the necessary permissions.
+#line 52
+
+#line 52
+# Old domain may exec the file and transition to the new domain.
+#line 52
+allow odsign odrefresh_exec:file { getattr open read execute map };
+#line 52
+allow odsign odrefresh:process transition;
+#line 52
+# New domain is entered by executing the file.
+#line 52
+allow odrefresh odrefresh_exec:file { entrypoint open read execute getattr map };
+#line 52
+# New domain can send SIGCHLD to its caller.
+#line 52
+allow odrefresh odsign:process sigchld;
+#line 52
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 52
+dontaudit odsign odrefresh:process noatsecure;
+#line 52
+# XXX dontaudit candidate but requires further study.
+#line 52
+allow odsign odrefresh:process { siginh rlimitinh };
+#line 52
+
+#line 52
+# Make the transition occur by default.
+#line 52
+type_transition odsign odrefresh_exec:process odrefresh;
+#line 52
+
+
+# Run compos_verify to verify CompOs signatures
+
+#line 55
+# Allow the necessary permissions.
+#line 55
+
+#line 55
+# Old domain may exec the file and transition to the new domain.
+#line 55
+allow odsign compos_verify_exec:file { getattr open read execute map };
+#line 55
+allow odsign compos_verify:process transition;
+#line 55
+# New domain is entered by executing the file.
+#line 55
+allow compos_verify compos_verify_exec:file { entrypoint open read execute getattr map };
+#line 55
+# New domain can send SIGCHLD to its caller.
+#line 55
+allow compos_verify odsign:process sigchld;
+#line 55
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 55
+dontaudit odsign compos_verify:process noatsecure;
+#line 55
+# XXX dontaudit candidate but requires further study.
+#line 55
+allow odsign compos_verify:process { siginh rlimitinh };
+#line 55
+
+#line 55
+# Make the transition occur by default.
+#line 55
+type_transition odsign compos_verify_exec:process compos_verify;
+#line 55
+
+
+# only odsign can set odsign sysprop
+
+#line 58
+
+#line 58
+allow odsign property_socket:sock_file write;
+#line 58
+allow odsign init:unix_stream_socket connectto;
+#line 58
+
+#line 58
+allow odsign odsign_prop:property_service set;
+#line 58
+
+#line 58
+allow odsign odsign_prop:file { getattr open read map };
+#line 58
+
+#line 58
+
+neverallow { domain -odsign -init } odsign_prop:property_service set;
+
+# Allow odsign to stop itself
+
+#line 62
+
+#line 62
+allow odsign property_socket:sock_file write;
+#line 62
+allow odsign init:unix_stream_socket connectto;
+#line 62
+
+#line 62
+allow odsign ctl_odsign_prop:property_service set;
+#line 62
+
+#line 62
+allow odsign ctl_odsign_prop:file { getattr open read map };
+#line 62
+
+#line 62
+
+
+# Neverallows
+neverallow { domain -odsign -init} odsign_data_file:dir ~search;
+neverallow { domain -odsign -init} odsign_data_file:file *;
+#line 1 "system/sepolicy/private/ot_ctl.te"
+#
+# ot-ctl is a command line tool for controlling ot-daemon
+#
+
+type ot_ctl, domain, coredomain;
+type ot_ctl_exec, exec_type, file_type, system_file_type;
+
+# ot-ctl is available in only userdebug or eng build
+#line 12
+
+#line 1 "system/sepolicy/private/ot_daemon.te"
+#
+# ot_daemon is the native Thread network stack on the host (Android) side.
+# Refer to https://www.threadgroup.org for Thread network knowledge.
+#
+
+# ot_daemon
+type ot_daemon, domain, coredomain;
+type ot_daemon_exec, exec_type, file_type, system_file_type;
+
+# Allow init ot_daemon
+
+#line 11
+
+#line 11
+# Allow the necessary permissions.
+#line 11
+
+#line 11
+# Old domain may exec the file and transition to the new domain.
+#line 11
+allow init ot_daemon_exec:file { getattr open read execute map };
+#line 11
+allow init ot_daemon:process transition;
+#line 11
+# New domain is entered by executing the file.
+#line 11
+allow ot_daemon ot_daemon_exec:file { entrypoint open read execute getattr map };
+#line 11
+# New domain can send SIGCHLD to its caller.
+#line 11
+
+#line 11
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 11
+dontaudit init ot_daemon:process noatsecure;
+#line 11
+# XXX dontaudit candidate but requires further study.
+#line 11
+allow init ot_daemon:process { siginh rlimitinh };
+#line 11
+
+#line 11
+# Make the transition occur by default.
+#line 11
+type_transition init ot_daemon_exec:process ot_daemon;
+#line 11
+
+#line 11
+
+# Allow the ot_daemon to use the net domain.
+
+#line 13
+typeattribute ot_daemon netdomain;
+#line 13
+
+
+# Allow ot_daemon to find /data/misc/apexdata/com.android.tethering
+allow ot_daemon apex_module_data_file:dir search;
+
+# Allow the ot_daemon to access files and subdirectories under
+# /data/misc/apexdata/com\.android\.tethering
+allow ot_daemon apex_tethering_data_file:dir {create { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } }};
+allow ot_daemon apex_tethering_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow OT daemon to read/write the Thread tunnel interface
+allow ot_daemon tun_device:chr_file {read write};
+
+# Allow OT daemon to read/write on the socket created by System Server
+allow ot_daemon system_server:rawip_socket { read getattr write setattr lock append bind connect getopt setopt shutdown map };
+
+# Allow OT daemon to read/write on the UDP sockets created by system server
+allow ot_daemon system_server:udp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+
+
+#line 32
+typeattribute ot_daemon halclientdomain;
+#line 32
+typeattribute ot_daemon hal_threadnetwork_client;
+#line 32
+
+#line 32
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 32
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 32
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 32
+
+#line 32
+typeattribute ot_daemon hal_threadnetwork;
+#line 32
+# Find passthrough HAL implementations
+#line 32
+allow hal_threadnetwork system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow hal_threadnetwork vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow hal_threadnetwork vendor_file:file { read open getattr execute map };
+#line 32
+
+#line 32
+
+
+# Only ot_daemon can publish the binder service
+
+#line 35
+# Call the servicemanager and transfer references to it.
+#line 35
+allow ot_daemon servicemanager:binder { call transfer };
+#line 35
+# Allow servicemanager to send out callbacks
+#line 35
+allow servicemanager ot_daemon:binder { call transfer };
+#line 35
+# servicemanager performs getpidcon on clients.
+#line 35
+allow servicemanager ot_daemon:dir search;
+#line 35
+allow servicemanager ot_daemon:file { read open };
+#line 35
+allow servicemanager ot_daemon:process getattr;
+#line 35
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 35
+# all domains in domain.te.
+#line 35
+
+
+#line 36
+ allow ot_daemon ot_daemon_service:service_manager { add find };
+#line 36
+ neverallow { domain -ot_daemon } ot_daemon_service:service_manager add;
+#line 36
+
+#line 36
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 36
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 36
+
+#line 36
+
+
+#line 37
+# Call the server domain and optionally transfer references to it.
+#line 37
+allow ot_daemon system_server:binder { call transfer };
+#line 37
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 37
+allow system_server ot_daemon:binder transfer;
+#line 37
+# Receive and use open files from the server.
+#line 37
+allow ot_daemon system_server:fd use;
+#line 37
+
+
+# Allow OT daemon to write to statsd
+
+#line 40
+allow ot_daemon statsdw_socket:sock_file write;
+#line 40
+allow ot_daemon statsd:unix_dgram_socket sendto;
+#line 40
+
+
+# For collecting bugreports.
+allow ot_daemon dumpstate:fd use;
+allow ot_daemon dumpstate:fifo_file write;
+
+# ot-daemon socket is for only ot-daemon and ot-ctl
+neverallow {
+ domain
+ -ot_daemon
+
+ -init
+ -vendor_init
+} ot_daemon_socket:sock_file *;
+#line 1 "system/sepolicy/private/otapreopt_chroot.te"
+# otapreopt_chroot executable
+type otapreopt_chroot, domain;
+typeattribute otapreopt_chroot coredomain;
+type otapreopt_chroot_exec, exec_type, file_type, system_file_type;
+
+# Chroot preparation and execution.
+# We need to create an unshared mount namespace, and then mount /data.
+allow otapreopt_chroot postinstall_file:dir { search mounton };
+allow otapreopt_chroot apex_mnt_dir:dir mounton;
+allow otapreopt_chroot device:dir mounton;
+allow otapreopt_chroot linkerconfig_file:dir mounton;
+allow otapreopt_chroot rootfs:dir mounton;
+allow otapreopt_chroot sysfs:dir mounton;
+allow otapreopt_chroot system_data_root_file:dir mounton;
+allow otapreopt_chroot system_file:dir mounton;
+allow otapreopt_chroot vendor_file:dir mounton;
+allow otapreopt_chroot self:{ capability cap_userns } { sys_admin sys_chroot };
+
+# This is required to mount /vendor and mount/unmount ext4 images from
+# APEX packages in /postinstall/apex.
+allow otapreopt_chroot block_device:dir search;
+allow otapreopt_chroot labeledfs:filesystem { mount unmount };
+# This is required for dynamic partitions.
+allow otapreopt_chroot dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# This is required to unmount flattened APEX packages under
+# /postinstall/system/apex (which are bind-mounted in /postinstall/apex).
+allow otapreopt_chroot postinstall_file:filesystem unmount;
+# Mounting /vendor can have this side-effect. Ignore denial.
+dontaudit otapreopt_chroot kernel:process setsched;
+
+# Allow otapreopt_chroot to read SELinux policy files.
+allow otapreopt_chroot file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex.
+allow otapreopt_chroot postinstall_file:dir { open getattr read search ioctl lock watch watch_reads };
+# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property.
+
+#line 38
+allow otapreopt_chroot apexd_prop:file { getattr open read map };
+#line 38
+
+
+# Allow otapreopt to use file descriptors from update-engine and the postinstall
+# script. It will read dexopt commands from stdin and write progress to stdout.
+allow otapreopt_chroot postinstall:fd use;
+allow otapreopt_chroot postinstall:fifo_file { read write getattr };
+allow otapreopt_chroot update_engine:fd use;
+allow otapreopt_chroot update_engine:fifo_file write;
+
+# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
+
+#line 48
+# Allow the necessary permissions.
+#line 48
+
+#line 48
+# Old domain may exec the file and transition to the new domain.
+#line 48
+allow otapreopt_chroot postinstall_dexopt_exec:file { getattr open read execute map };
+#line 48
+allow otapreopt_chroot postinstall_dexopt:process transition;
+#line 48
+# New domain is entered by executing the file.
+#line 48
+allow postinstall_dexopt postinstall_dexopt_exec:file { entrypoint open read execute getattr map };
+#line 48
+# New domain can send SIGCHLD to its caller.
+#line 48
+allow postinstall_dexopt otapreopt_chroot:process sigchld;
+#line 48
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 48
+dontaudit otapreopt_chroot postinstall_dexopt:process noatsecure;
+#line 48
+# XXX dontaudit candidate but requires further study.
+#line 48
+allow otapreopt_chroot postinstall_dexopt:process { siginh rlimitinh };
+#line 48
+
+#line 48
+# Make the transition occur by default.
+#line 48
+type_transition otapreopt_chroot postinstall_dexopt_exec:process postinstall_dexopt;
+#line 48
+
+
+#line 49
+# Allow the necessary permissions.
+#line 49
+
+#line 49
+# Old domain may exec the file and transition to the new domain.
+#line 49
+allow otapreopt_chroot linkerconfig_exec:file { getattr open read execute map };
+#line 49
+allow otapreopt_chroot linkerconfig:process transition;
+#line 49
+# New domain is entered by executing the file.
+#line 49
+allow linkerconfig linkerconfig_exec:file { entrypoint open read execute getattr map };
+#line 49
+# New domain can send SIGCHLD to its caller.
+#line 49
+allow linkerconfig otapreopt_chroot:process sigchld;
+#line 49
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 49
+dontaudit otapreopt_chroot linkerconfig:process noatsecure;
+#line 49
+# XXX dontaudit candidate but requires further study.
+#line 49
+allow otapreopt_chroot linkerconfig:process { siginh rlimitinh };
+#line 49
+
+#line 49
+# Make the transition occur by default.
+#line 49
+type_transition otapreopt_chroot linkerconfig_exec:process linkerconfig;
+#line 49
+
+
+#line 50
+# Allow the necessary permissions.
+#line 50
+
+#line 50
+# Old domain may exec the file and transition to the new domain.
+#line 50
+allow otapreopt_chroot apexd_exec:file { getattr open read execute map };
+#line 50
+allow otapreopt_chroot apexd:process transition;
+#line 50
+# New domain is entered by executing the file.
+#line 50
+allow apexd apexd_exec:file { entrypoint open read execute getattr map };
+#line 50
+# New domain can send SIGCHLD to its caller.
+#line 50
+allow apexd otapreopt_chroot:process sigchld;
+#line 50
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 50
+dontaudit otapreopt_chroot apexd:process noatsecure;
+#line 50
+# XXX dontaudit candidate but requires further study.
+#line 50
+allow otapreopt_chroot apexd:process { siginh rlimitinh };
+#line 50
+
+#line 50
+# Make the transition occur by default.
+#line 50
+type_transition otapreopt_chroot apexd_exec:process apexd;
+#line 50
+
+
+# Allow otapreopt_chroot to control linkerconfig
+allow otapreopt_chroot linkerconfig_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow otapreopt_chroot linkerconfig_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow otapreopt_chroot to create loop devices with /dev/loop-control.
+allow otapreopt_chroot loop_control_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# Allow otapreopt_chroot to access loop devices.
+allow otapreopt_chroot loop_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm otapreopt_chroot loop_device:blk_file ioctl {
+ 0x00004c0a
+ 0x00004c05
+ 0x00004c04
+ 0x00004c00
+ 0x00004c09
+ 0x00004c08
+ 0x00004c01
+ 0x00001261
+};
+
+# Allow otapreopt_chroot to configure read-ahead of loop devices.
+allow otapreopt_chroot sysfs_loop:dir { open getattr read search ioctl lock watch watch_reads };
+allow otapreopt_chroot sysfs_loop:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
+allow otapreopt_chroot tmpfs:filesystem mount;
+# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
+allow otapreopt_chroot tmpfs:dir relabelfrom;
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
+
+# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow otapreopt_chroot postinstall_apex_mnt_dir:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
+
+# Allow otapreopt_chroot to access /dev/block (needed to detach loop
+# devices used by ext4 images from APEX packages).
+allow otapreopt_chroot block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow to access the linker through the symlink.
+allow otapreopt_chroot postinstall_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow otapreopt_chroot to read ro.cold_boot_done prop.
+# This is a temporary solution to make sure that otapreopt_chroot doesn't block indefinetelly.
+# TODO(b/165948777): remove this once otapreopt_chroot is migrated to libapexmount.
+
+#line 97
+allow otapreopt_chroot cold_boot_done_prop:file { getattr open read map };
+#line 97
+
+
+# allow otapreopt_chroot to run the linkerconfig from the new image.
+allow otapreopt_chroot linkerconfig_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 1 "system/sepolicy/private/otapreopt_slot.te"
+# This command set moves the artifact corresponding to the current slot
+# from /data/ota to /data/dalvik-cache.
+
+type otapreopt_slot, domain, mlstrustedsubject, coredomain;
+type otapreopt_slot_exec, system_file_type, exec_type, file_type;
+
+# Technically not a daemon but we do want the transition from init domain to
+# cppreopts to occur.
+
+#line 9
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow init otapreopt_slot_exec:file { getattr open read execute map };
+#line 9
+allow init otapreopt_slot:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow otapreopt_slot otapreopt_slot_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit init otapreopt_slot:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow init otapreopt_slot:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition init otapreopt_slot_exec:process otapreopt_slot;
+#line 9
+
+#line 9
+
+
+# The otapreopt_slot renames the OTA dalvik-cache to the regular dalvik-cache, and cleans up
+# the directory afterwards. For logging of aggregate size, we need getattr.
+allow otapreopt_slot ota_data_file:dir { { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } rename reparent rmdir };
+allow otapreopt_slot ota_data_file:{ file lnk_file } getattr;
+# (du follows symlinks)
+allow otapreopt_slot ota_data_file:lnk_file read;
+
+# Delete old content of the dalvik-cache.
+allow otapreopt_slot dalvikcache_data_file:dir { add_name getattr open read remove_name rmdir search write };
+allow otapreopt_slot dalvikcache_data_file:file { getattr unlink };
+allow otapreopt_slot dalvikcache_data_file:lnk_file { getattr read unlink };
+
+# Allow cppreopts to execute itself using #!/system/bin/sh
+allow otapreopt_slot shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow running the mv and rm/rmdir commands using otapreopt_slot permissions.
+# Needed so we can move artifacts into /data/dalvik-cache/dalvik-cache.
+allow otapreopt_slot toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 1 "system/sepolicy/private/perfetto.te"
+# Perfetto command-line client. Can be used only from the domains that are
+# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto).
+# This command line client accesses the privileged socket of the traced
+# daemon.
+
+type perfetto_exec, system_file_type, exec_type, file_type;
+type perfetto_tmpfs, file_type;
+
+
+#line 9
+type_transition perfetto tmpfs:file perfetto_tmpfs;
+#line 9
+allow perfetto perfetto_tmpfs:file { read write getattr map };
+#line 9
+;
+
+# Allow init to start a trace (for perfetto_boottrace).
+
+#line 12
+
+#line 12
+# Allow the necessary permissions.
+#line 12
+
+#line 12
+# Old domain may exec the file and transition to the new domain.
+#line 12
+allow init perfetto_exec:file { getattr open read execute map };
+#line 12
+allow init perfetto:process transition;
+#line 12
+# New domain is entered by executing the file.
+#line 12
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 12
+# New domain can send SIGCHLD to its caller.
+#line 12
+
+#line 12
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 12
+dontaudit init perfetto:process noatsecure;
+#line 12
+# XXX dontaudit candidate but requires further study.
+#line 12
+allow init perfetto:process { siginh rlimitinh };
+#line 12
+
+#line 12
+# Make the transition occur by default.
+#line 12
+type_transition init perfetto_exec:process perfetto;
+#line 12
+
+#line 12
+
+
+# Allow to access traced's privileged consumer socket.
+
+#line 15
+allow perfetto traced_consumer_socket:sock_file write;
+#line 15
+allow perfetto traced:unix_stream_socket connectto;
+#line 15
+
+
+# Connect to the Perfetto traced daemon as a producer. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+
+#line 19
+ allow perfetto traced:fd use;
+#line 19
+ allow perfetto traced_tmpfs:file { read write getattr map };
+#line 19
+
+#line 19
+allow perfetto traced_producer_socket:sock_file write;
+#line 19
+allow perfetto traced:unix_stream_socket connectto;
+#line 19
+
+#line 19
+
+#line 19
+ # Also allow the service to use the producer file descriptors. This is
+#line 19
+ # necessary when the producer is creating the shared memory, as it will be
+#line 19
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 19
+ allow traced perfetto:fd use;
+#line 19
+
+
+# Allow to write and unlink traces into /data/misc/perfetto-traces.
+allow perfetto perfetto_traces_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow perfetto perfetto_traces_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow to write and unlink trace into /data/misc/perfetto-traces/bugreport*
+allow perfetto perfetto_traces_bugreport_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow perfetto perfetto_traces_bugreport_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Allow to write and unlink traces into /data/misc/perfetto-traces/profiling.
+allow perfetto perfetto_traces_profiling_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow perfetto perfetto_traces_profiling_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow perfetto to access the proxy service for reporting traces.
+allow perfetto tracingproxy_service:service_manager find;
+
+#line 35
+# Call the servicemanager and transfer references to it.
+#line 35
+allow perfetto servicemanager:binder { call transfer };
+#line 35
+# Allow servicemanager to send out callbacks
+#line 35
+allow servicemanager perfetto:binder { call transfer };
+#line 35
+# servicemanager performs getpidcon on clients.
+#line 35
+allow servicemanager perfetto:dir search;
+#line 35
+allow servicemanager perfetto:file { read open };
+#line 35
+allow servicemanager perfetto:process getattr;
+#line 35
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 35
+# all domains in domain.te.
+#line 35
+
+
+#line 36
+# Call the server domain and optionally transfer references to it.
+#line 36
+allow perfetto system_server:binder { call transfer };
+#line 36
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 36
+allow system_server perfetto:binder transfer;
+#line 36
+# Receive and use open files from the server.
+#line 36
+allow perfetto system_server:fd use;
+#line 36
+
+
+# Allow perfetto to read the trace config from /data/misc/perfetto-configs.
+# shell and adb can write files into that directory.
+allow perfetto perfetto_configs_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow perfetto perfetto_configs_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow perfetto to read the trace config from /system/etc/perfetto.
+allow perfetto system_perfetto_config_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow perfetto system_perfetto_config_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow perfetto to read the trace config from statsd, mm_events and shell
+# (both root and non-root) on stdin and also to write the resulting trace to
+# stdout.
+allow perfetto { statsd mm_events shell su }:fd use;
+allow perfetto { statsd mm_events shell su system_server }:fifo_file { getattr read write ioctl };
+
+# Allow to communicate use, read and write over the adb connection.
+allow perfetto adbd:fd use;
+allow perfetto adbd:unix_stream_socket { read write };
+
+# Allow adbd to reap perfetto.
+allow perfetto adbd:process { sigchld };
+
+# Allow perfetto to write to statsd.
+
+#line 61
+allow perfetto statsdw_socket:sock_file write;
+#line 61
+allow perfetto statsd:unix_dgram_socket sendto;
+#line 61
+
+
+# Allow to access /dev/pts when launched in an adb shell.
+allow perfetto devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow perfetto to ask incidentd to start a report.
+# TODO(lalitm): remove all incidentd rules when proxy service is stable.
+allow perfetto incident_service:service_manager find;
+
+#line 69
+# Call the server domain and optionally transfer references to it.
+#line 69
+allow perfetto incidentd:binder { call transfer };
+#line 69
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 69
+allow incidentd perfetto:binder transfer;
+#line 69
+# Receive and use open files from the server.
+#line 69
+allow perfetto incidentd:fd use;
+#line 69
+
+
+# perfetto log formatter calls isatty() on its stderr. Denial when running
+# under adbd is harmless. Avoid generating denial logs.
+dontaudit perfetto adbd:unix_stream_socket getattr;
+dontauditxperm perfetto adbd:unix_stream_socket ioctl {
+#line 74
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 74
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 74
+};
+# As above, when adbd is running in "su" domain (only the ioctl is denied in
+# practice).
+dontauditxperm perfetto su:unix_stream_socket ioctl {
+#line 77
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 77
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 77
+};
+# Similarly, CTS tests end up hitting a denial on shell pipes.
+dontauditxperm perfetto shell:fifo_file ioctl {
+#line 79
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 79
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 79
+};
+
+###
+### Neverallow rules
+###
+
+# Disallow anyone else from being able to handle traces except selected system
+# components.
+neverallow {
+ domain
+ -init # The creator of the folder.
+ -perfetto # The owner of the folder.
+ -adbd # For pulling traces.
+ -shell # For devepment purposes.
+ -traced # For write_into_file traces.
+ -dumpstate # For attaching traces to bugreports.
+ -incidentd # For receiving reported traces. TODO(lalitm): remove this.
+ -priv_app # For stating traces for bug-report UI.
+ -system_server # For accessing traces started by profiling apis.
+ -trace_redactor # For accessing traces to be redacted.
+} perfetto_traces_data_file:dir *;
+neverallow {
+ domain
+ -init # The creator of the folder.
+ -perfetto # The owner of the folder.
+ -adbd # For pulling traces.
+ -shell # For devepment purposes.
+ -traced # For write_into_file traces.
+ -incidentd # For receiving reported traces. TODO(lalitm): remove this.
+ -trace_redactor # For redacting trace files.
+} perfetto_traces_data_file:file ~{ getattr read };
+
+### perfetto should NEVER do any of the following
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow perfetto self:process execmem;
+
+# Block device access.
+neverallow perfetto dev_type:blk_file { read write };
+
+# ptrace any other process
+neverallow perfetto domain:process ptrace;
+
+# Disallows access to other /data files.
+neverallow perfetto {
+ data_file_type
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
+ # neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+ -perfetto_traces_data_file
+ -perfetto_traces_bugreport_data_file
+ -perfetto_traces_profiling_data_file
+ -perfetto_configs_data_file
+
+}:dir *;
+neverallow perfetto {
+ system_data_file
+ -perfetto_traces_data_file
+ -perfetto_traces_profiling_data_file
+}:dir ~{ getattr search };
+neverallow perfetto {
+ data_file_type
+ -perfetto_traces_data_file
+ -perfetto_traces_bugreport_data_file
+ -perfetto_traces_profiling_data_file
+ -perfetto_configs_data_file
+
+}:file ~write;
+#line 1 "system/sepolicy/private/performanced.te"
+typeattribute performanced coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init performanced_exec:file { getattr open read execute map };
+#line 3
+allow init performanced:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow performanced performanced_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init performanced:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init performanced:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init performanced_exec:process performanced;
+#line 3
+
+#line 3
+
+
+# Needed to check for app permissions.
+
+#line 6
+# Call the servicemanager and transfer references to it.
+#line 6
+allow performanced servicemanager:binder { call transfer };
+#line 6
+# Allow servicemanager to send out callbacks
+#line 6
+allow servicemanager performanced:binder { call transfer };
+#line 6
+# servicemanager performs getpidcon on clients.
+#line 6
+allow servicemanager performanced:dir search;
+#line 6
+allow servicemanager performanced:file { read open };
+#line 6
+allow servicemanager performanced:process getattr;
+#line 6
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 6
+# all domains in domain.te.
+#line 6
+
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow performanced system_server:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow system_server performanced:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow performanced system_server:fd use;
+#line 7
+
+allow performanced permission_service:service_manager find;
+
+
+#line 10
+# Mark the server domain as a PDX server.
+#line 10
+typeattribute performanced pdx_performance_client_server_type;
+#line 10
+# Allow the init process to create the initial endpoint socket.
+#line 10
+allow init pdx_performance_client_endpoint_socket_type:unix_stream_socket { create bind };
+#line 10
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 10
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 10
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 10
+allow performanced pdx_performance_client_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 10
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 10
+allow performanced self:process setsockcreate;
+#line 10
+# Allow the server domain to create a client channel socket.
+#line 10
+allow performanced pdx_performance_client_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 10
+# Prevent other processes from claiming to be a server for the same service.
+#line 10
+neverallow {domain -performanced} pdx_performance_client_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 10
+
+
+# TODO: use file caps to obtain sys_nice instead of setuid / setgid.
+allow performanced self:{ capability cap_userns } { setuid setgid sys_nice };
+
+# Access /proc to validate we're only affecting threads in the same thread group.
+# Performanced also shields unbound kernel threads. It scans every task in the
+# root cpu set, but only affects the kernel threads.
+
+#line 18
+allow performanced { appdomain bufferhubd kernel surfaceflinger }:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow performanced { appdomain bufferhubd kernel surfaceflinger }:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+dontaudit performanced domain:dir read;
+allow performanced { appdomain bufferhubd kernel surfaceflinger }:process setsched;
+
+# These /proc accesses only show up in permissive mode but they
+# generate a lot of noise in the log.
+#line 27
+
+
+# Access /dev/cpuset/cpuset.cpus
+
+#line 30
+allow performanced cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 30
+allow performanced cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 30
+
+
+#line 31
+allow performanced cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 31
+allow performanced cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 31
+
+#line 1 "system/sepolicy/private/permissioncontroller_app.te"
+###
+### A domain for further sandboxing the GooglePermissionController app.
+###
+type permissioncontroller_app, domain, coredomain;
+
+
+#line 6
+typeattribute permissioncontroller_app appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition permissioncontroller_app tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type permissioncontroller_app_userfaultfd;
+#line 6
+type_transition permissioncontroller_app permissioncontroller_app:anon_inode permissioncontroller_app_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow permissioncontroller_app permissioncontroller_app_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su permissioncontroller_app_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -permissioncontroller_app } permissioncontroller_app_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow permissioncontroller_app appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { permissioncontroller_app -runas_app -shell -simpleperf } { domain -permissioncontroller_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -permissioncontroller_app } permissioncontroller_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -permissioncontroller_app -crash_dump -runas_app -simpleperf } permissioncontroller_app:process ptrace;
+#line 6
+
+
+allow permissioncontroller_app app_api_service:service_manager find;
+allow permissioncontroller_app system_api_service:service_manager find;
+
+# Allow interaction with gpuservice
+
+#line 12
+# Call the server domain and optionally transfer references to it.
+#line 12
+allow permissioncontroller_app gpuservice:binder { call transfer };
+#line 12
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 12
+allow gpuservice permissioncontroller_app:binder transfer;
+#line 12
+# Receive and use open files from the server.
+#line 12
+allow permissioncontroller_app gpuservice:fd use;
+#line 12
+
+
+allow permissioncontroller_app radio_service:service_manager find;
+
+# Allow the app to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow permissioncontroller_app incident_service:service_manager find;
+
+#line 19
+# Call the server domain and optionally transfer references to it.
+#line 19
+allow permissioncontroller_app incidentd:binder { call transfer };
+#line 19
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 19
+allow incidentd permissioncontroller_app:binder transfer;
+#line 19
+# Receive and use open files from the server.
+#line 19
+allow permissioncontroller_app incidentd:fd use;
+#line 19
+
+allow permissioncontroller_app incidentd:fifo_file { read write };
+
+allow permissioncontroller_app gpu_device:dir search;
+#line 1 "system/sepolicy/private/platform_app.te"
+###
+### Apps signed with the platform key.
+###
+
+typeattribute platform_app coredomain;
+
+
+#line 7
+typeattribute platform_app appdomain;
+#line 7
+# Label tmpfs objects for all apps.
+#line 7
+type_transition platform_app tmpfs:file appdomain_tmpfs;
+#line 7
+
+#line 7
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 7
+type platform_app_userfaultfd;
+#line 7
+type_transition platform_app platform_app:anon_inode platform_app_userfaultfd "[userfaultfd]";
+#line 7
+# Allow domain to create/use userfaultfd anon_inode.
+#line 7
+allow platform_app platform_app_userfaultfd:anon_inode { create ioctl read };
+#line 7
+# Suppress errors generate during bugreport
+#line 7
+dontaudit su platform_app_userfaultfd:anon_inode *;
+#line 7
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 7
+neverallow { domain -platform_app } platform_app_userfaultfd:anon_inode *;
+#line 7
+
+#line 7
+allow platform_app appdomain_tmpfs:file { execute getattr map read write };
+#line 7
+neverallow { platform_app -runas_app -shell -simpleperf } { domain -platform_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+neverallow { appdomain -runas_app -shell -simpleperf -platform_app } platform_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+# The Android security model guarantees the confidentiality and integrity
+#line 7
+# of application data and execution state. Ptrace bypasses those
+#line 7
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 7
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 7
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 7
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 7
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 7
+# live lock conditions.
+#line 7
+neverallow { domain -platform_app -crash_dump -runas_app -simpleperf } platform_app:process ptrace;
+#line 7
+
+
+# Access the network.
+
+#line 10
+typeattribute platform_app netdomain;
+#line 10
+
+# Access bluetooth.
+
+#line 12
+typeattribute platform_app bluetoothdomain;
+#line 12
+
+# Read from /data/local/tmp or /data/data/com.android.shell.
+allow platform_app shell_data_file:dir search;
+allow platform_app shell_data_file:file { open getattr read };
+allow platform_app icon_file:file { open getattr read };
+# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
+# created by system server.
+allow platform_app { apk_tmp_file apk_private_tmp_file }:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow platform_app { apk_tmp_file apk_private_tmp_file }:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow platform_app apk_private_data_file:dir search;
+# ASEC
+allow platform_app asec_apk_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow platform_app asec_apk_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access to /data/media.
+allow platform_app media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow platform_app media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Write to /cache.
+allow platform_app cache_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow platform_app cache_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Direct access to vold-mounted storage under /mnt/media_rw
+# This is a performance optimization that allows platform apps to bypass the FUSE layer
+allow platform_app mnt_media_rw_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow platform_app sdcard_type:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow platform_app sdcard_type:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# com.android.systemui
+allow platform_app rootfs:dir getattr;
+
+#line 42
+allow platform_app radio_cdma_ecm_prop:file { getattr open read map };
+#line 42
+
+#line 45
+
+neverallow { domain -init -dumpstate } persist_wm_debug_prop:property_service set;
+
+#line 50
+
+#line 53
+
+
+#line 54
+
+#line 54
+allow platform_app property_socket:sock_file write;
+#line 54
+allow platform_app init:unix_stream_socket connectto;
+#line 54
+
+#line 54
+allow platform_app debug_tracing_desktop_mode_visible_tasks_prop:property_service set;
+#line 54
+
+#line 54
+allow platform_app debug_tracing_desktop_mode_visible_tasks_prop:file { getattr open read map };
+#line 54
+
+#line 54
+
+
+# com.android.captiveportallogin reads /proc/vmstat
+allow platform_app {
+ proc_vmstat
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# /proc/net access.
+# TODO(b/9496886) Audit access for removal.
+
+#line 63
+allow platform_app proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 63
+allow platform_app proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 63
+
+#line 66
+
+
+# Allow sharing traces to betterbug from /data/misc/wmtrace.
+#line 72
+
+
+# Allow writing and removing wmshell protolog in /data/misc/wmtrace.
+#line 78
+
+
+
+# To exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe. Allow to access traced's privileged consumer socket.
+#line 86
+
+
+allow platform_app audioserver_service:service_manager find;
+allow platform_app cameraserver_service:service_manager find;
+allow platform_app drmserver_service:service_manager find;
+allow platform_app mediaserver_service:service_manager find;
+allow platform_app mediametrics_service:service_manager find;
+allow platform_app mediaextractor_service:service_manager find;
+allow platform_app mediadrmserver_service:service_manager find;
+allow platform_app persistent_data_block_service:service_manager find;
+allow platform_app radio_service:service_manager find;
+allow platform_app thermal_service:service_manager find;
+allow platform_app app_api_service:service_manager find;
+allow platform_app system_api_service:service_manager find;
+allow platform_app vr_manager_service:service_manager find;
+allow platform_app stats_service:service_manager find;
+allow platform_app tradeinmode_service:service_manager find;
+
+# Allow platform apps to log via statsd.
+
+#line 105
+# Call the server domain and optionally transfer references to it.
+#line 105
+allow platform_app statsd:binder { call transfer };
+#line 105
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 105
+allow statsd platform_app:binder transfer;
+#line 105
+# Receive and use open files from the server.
+#line 105
+allow platform_app statsd:fd use;
+#line 105
+
+
+# Allow platform applications to find and call artd for testing
+#line 111
+
+
+# Access to /data/preloads
+allow platform_app preloads_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow platform_app preloads_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow platform_app preloads_media_file:file { getattr open read ioctl lock map watch watch_reads };
+allow platform_app preloads_media_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 119
+allow platform_app runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 119
+
+
+# allow platform apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow platform_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow platform apps to connect to the property service
+
+#line 127
+
+#line 127
+allow platform_app property_socket:sock_file write;
+#line 127
+allow platform_app init:unix_stream_socket connectto;
+#line 127
+
+#line 127
+allow platform_app test_boot_reason_prop:property_service set;
+#line 127
+
+#line 127
+allow platform_app test_boot_reason_prop:file { getattr open read map };
+#line 127
+
+#line 127
+
+
+# allow platform apps to read keyguard.no_require_sim
+
+#line 130
+allow platform_app keyguard_config_prop:file { getattr open read map };
+#line 130
+
+
+# allow platform apps to read qemu.hw.mainkeys
+
+#line 133
+allow platform_app qemu_hw_prop:file { getattr open read map };
+#line 133
+
+
+# allow platform apps to read sys.boot.reason.last
+
+#line 136
+allow platform_app last_boot_reason_prop:file { getattr open read map };
+#line 136
+
+
+# allow platform apps to create symbolic link
+allow platform_app app_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# suppress denials caused by debugfs_tracing
+dontaudit platform_app debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow platform apps to create VMs
+
+#line 145
+# Transition to virtualizationmanager when the client executes it.
+#line 145
+
+#line 145
+# Allow the necessary permissions.
+#line 145
+
+#line 145
+# Old domain may exec the file and transition to the new domain.
+#line 145
+allow platform_app virtualizationmanager_exec:file { getattr open read execute map };
+#line 145
+allow platform_app virtualizationmanager:process transition;
+#line 145
+# New domain is entered by executing the file.
+#line 145
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 145
+# New domain can send SIGCHLD to its caller.
+#line 145
+allow virtualizationmanager platform_app:process sigchld;
+#line 145
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 145
+dontaudit platform_app virtualizationmanager:process noatsecure;
+#line 145
+# XXX dontaudit candidate but requires further study.
+#line 145
+allow platform_app virtualizationmanager:process { siginh rlimitinh };
+#line 145
+
+#line 145
+# Make the transition occur by default.
+#line 145
+type_transition platform_app virtualizationmanager_exec:process virtualizationmanager;
+#line 145
+
+#line 145
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 145
+allow { virtualizationmanager crosvm } platform_app:unix_stream_socket { ioctl getattr read write };
+#line 145
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 145
+allow { virtualizationmanager crosvm } platform_app:fd use;
+#line 145
+# Let the client use file descriptors created by virtualizationmanager.
+#line 145
+allow platform_app virtualizationmanager:fd use;
+#line 145
+# Allow piping console log to the client
+#line 145
+allow { virtualizationmanager crosvm } platform_app:fifo_file { ioctl getattr read write };
+#line 145
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 145
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 145
+# the client can only connect to VMs that it owns.
+#line 145
+allow platform_app virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 145
+# Allow client to inspect hypervisor capabilities
+#line 145
+
+#line 145
+allow platform_app hypervisor_prop:file { getattr open read map };
+#line 145
+
+#line 145
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 145
+allow platform_app virtualizationservice_data_file:file { getattr read };
+#line 145
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 145
+allow virtualizationmanager platform_app:dir search;
+#line 145
+allow virtualizationmanager platform_app:file read;
+#line 145
+allow virtualizationmanager platform_app:lnk_file read;
+#line 145
+
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -init } persist_sysui_builder_extras_prop:property_service set;
+
+# app domains which access /dev/fuse should not run as platform_app
+neverallow platform_app fuse_device:chr_file *;
+#line 1 "system/sepolicy/private/postinstall.te"
+typeattribute postinstall coredomain;
+type postinstall_exec, system_file_type, exec_type, file_type;
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow postinstall otapreopt_chroot_exec:file { getattr open read execute map };
+#line 3
+allow postinstall otapreopt_chroot:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow otapreopt_chroot otapreopt_chroot_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+allow otapreopt_chroot postinstall:process sigchld;
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit postinstall otapreopt_chroot:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow postinstall otapreopt_chroot:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition postinstall otapreopt_chroot_exec:process otapreopt_chroot;
+#line 3
+
+
+allow postinstall rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow invoking `pm` shell commands.
+allow postinstall package_service:service_manager find;
+
+# Allow postinstall to write to its stdout/stderr when redirected via pipes to
+# update_engine.
+allow postinstall update_engine_common:fd use;
+allow postinstall update_engine_common:fifo_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow postinstall to read and execute directories and files in the same
+# mounted location.
+allow postinstall postinstall_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow postinstall postinstall_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow postinstall postinstall_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow postinstall to execute the shell or other system executables.
+allow postinstall shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow postinstall system_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow postinstall toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow postinstall to execute shell in recovery.
+#line 29
+
+
+#
+# For OTA dexopt.
+#
+
+# Allow postinstall scripts to talk to the system server.
+
+#line 36
+# Call the servicemanager and transfer references to it.
+#line 36
+allow postinstall servicemanager:binder { call transfer };
+#line 36
+# Allow servicemanager to send out callbacks
+#line 36
+allow servicemanager postinstall:binder { call transfer };
+#line 36
+# servicemanager performs getpidcon on clients.
+#line 36
+allow servicemanager postinstall:dir search;
+#line 36
+allow servicemanager postinstall:file { read open };
+#line 36
+allow servicemanager postinstall:process getattr;
+#line 36
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 36
+# all domains in domain.te.
+#line 36
+
+
+#line 37
+# Call the server domain and optionally transfer references to it.
+#line 37
+allow postinstall system_server:binder { call transfer };
+#line 37
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 37
+allow system_server postinstall:binder transfer;
+#line 37
+# Receive and use open files from the server.
+#line 37
+allow postinstall system_server:fd use;
+#line 37
+
+
+# Need to talk to the otadexopt service.
+allow postinstall otadexopt_service:service_manager find;
+
+# Allow postinstall scripts to trigger f2fs garbage collection
+allow postinstall sysfs_fs_f2fs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow postinstall sysfs_fs_f2fs:dir { open getattr read search ioctl lock watch watch_reads };
+
+###
+### Neverallow rules
+###
+
+# No domain other than update_engine and recovery (via update_engine_sideload)
+# should transition to postinstall, as it is only meant to run during the
+# update.
+neverallow { domain -update_engine -recovery } postinstall:process { transition dyntransition };
+#line 1 "system/sepolicy/private/postinstall_dexopt.te"
+# Domain for the otapreopt executable, running under postinstall_dexopt
+#
+# Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such,
+# this is derived and adapted from installd.te.
+
+type postinstall_dexopt, domain, coredomain, mlstrustedsubject;
+type postinstall_dexopt_exec, system_file_type, exec_type, file_type;
+type postinstall_dexopt_tmpfs, file_type;
+
+# Run dex2oat/patchoat in its own sandbox.
+# We have to manually transition, as we don't have an entrypoint.
+# - Case where dex2oat is in a non-flattened APEX, which has retained
+# the correct type (`dex2oat_exec`).
+
+#line 14
+# Allow the necessary permissions.
+#line 14
+
+#line 14
+# Old domain may exec the file and transition to the new domain.
+#line 14
+allow postinstall_dexopt dex2oat_exec:file { getattr open read execute map };
+#line 14
+allow postinstall_dexopt dex2oat:process transition;
+#line 14
+# New domain is entered by executing the file.
+#line 14
+allow dex2oat dex2oat_exec:file { entrypoint open read execute getattr map };
+#line 14
+# New domain can send SIGCHLD to its caller.
+#line 14
+allow dex2oat postinstall_dexopt:process sigchld;
+#line 14
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 14
+dontaudit postinstall_dexopt dex2oat:process noatsecure;
+#line 14
+# XXX dontaudit candidate but requires further study.
+#line 14
+allow postinstall_dexopt dex2oat:process { siginh rlimitinh };
+#line 14
+
+#line 14
+# Make the transition occur by default.
+#line 14
+type_transition postinstall_dexopt dex2oat_exec:process dex2oat;
+#line 14
+
+# - Case where dex2oat is in a flattened APEX, which has been tagged
+# with the `postinstall_file` type by update_engine.
+
+#line 17
+# Allow the necessary permissions.
+#line 17
+
+#line 17
+# Old domain may exec the file and transition to the new domain.
+#line 17
+allow postinstall_dexopt postinstall_file:file { getattr open read execute map };
+#line 17
+allow postinstall_dexopt dex2oat:process transition;
+#line 17
+# New domain is entered by executing the file.
+#line 17
+allow dex2oat postinstall_file:file { entrypoint open read execute getattr map };
+#line 17
+# New domain can send SIGCHLD to its caller.
+#line 17
+allow dex2oat postinstall_dexopt:process sigchld;
+#line 17
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 17
+dontaudit postinstall_dexopt dex2oat:process noatsecure;
+#line 17
+# XXX dontaudit candidate but requires further study.
+#line 17
+allow postinstall_dexopt dex2oat:process { siginh rlimitinh };
+#line 17
+
+#line 17
+# Make the transition occur by default.
+#line 17
+type_transition postinstall_dexopt postinstall_file:process dex2oat;
+#line 17
+
+
+# Run derive_classpath to get the current BCP.
+
+#line 20
+# Allow the necessary permissions.
+#line 20
+
+#line 20
+# Old domain may exec the file and transition to the new domain.
+#line 20
+allow postinstall_dexopt derive_classpath_exec:file { getattr open read execute map };
+#line 20
+allow postinstall_dexopt derive_classpath:process transition;
+#line 20
+# New domain is entered by executing the file.
+#line 20
+allow derive_classpath derive_classpath_exec:file { entrypoint open read execute getattr map };
+#line 20
+# New domain can send SIGCHLD to its caller.
+#line 20
+allow derive_classpath postinstall_dexopt:process sigchld;
+#line 20
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 20
+dontaudit postinstall_dexopt derive_classpath:process noatsecure;
+#line 20
+# XXX dontaudit candidate but requires further study.
+#line 20
+allow postinstall_dexopt derive_classpath:process { siginh rlimitinh };
+#line 20
+
+#line 20
+# Make the transition occur by default.
+#line 20
+type_transition postinstall_dexopt derive_classpath_exec:process derive_classpath;
+#line 20
+
+# Allow postinstall_dexopt to make a tempfile for derive_classpath to write into
+
+#line 22
+type_transition postinstall_dexopt tmpfs:file postinstall_dexopt_tmpfs;
+#line 22
+allow postinstall_dexopt postinstall_dexopt_tmpfs:file { read write getattr map };
+#line 22
+;
+allow postinstall_dexopt postinstall_dexopt_tmpfs:file open;
+
+allow postinstall_dexopt self:{ capability cap_userns } { chown dac_override dac_read_search fowner fsetid setgid setuid };
+
+allow postinstall_dexopt postinstall_file:filesystem getattr;
+allow postinstall_dexopt postinstall_file:dir { getattr read search };
+allow postinstall_dexopt postinstall_file:lnk_file { getattr read };
+allow postinstall_dexopt proc_filesystems:file { getattr open read };
+allow postinstall_dexopt rootfs:file { getattr open read ioctl lock map watch watch_reads };
+
+allow postinstall_dexopt tmpfs:file read;
+
+# Allow access odsign verification status
+
+#line 36
+allow postinstall_dexopt odsign_prop:file { getattr open read map };
+#line 36
+
+
+# Allow access to /postinstall/apex.
+allow postinstall_dexopt postinstall_apex_mnt_dir:dir { getattr search };
+
+# Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
+# here and having to relabel the directory.
+
+# Read app data (APKs) as input to dex2oat.
+
+#line 45
+allow postinstall_dexopt apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 45
+allow postinstall_dexopt apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 45
+
+# Read vendor app data (APKs) as input to dex2oat.
+
+#line 47
+allow postinstall_dexopt vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 47
+allow postinstall_dexopt vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 47
+
+# Read vendor overlay files (APKs) as input to dex2oat.
+
+#line 49
+allow postinstall_dexopt vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 49
+allow postinstall_dexopt vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 49
+
+# Vendor overlay can be found in vendor apex
+allow postinstall_dexopt vendor_apex_metadata_file:dir { getattr search };
+# Access to app oat directory.
+
+#line 53
+allow postinstall_dexopt dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 53
+allow postinstall_dexopt dalvikcache_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 53
+
+
+# Read profile data.
+allow postinstall_dexopt { user_profile_root_file user_profile_data_file }:dir { getattr search };
+allow postinstall_dexopt user_profile_data_file:file { getattr open read ioctl lock map watch watch_reads };
+# Suppress deletion denial (we do not want to update the profile).
+dontaudit postinstall_dexopt user_profile_data_file:file { write };
+
+# Write to /data/ota(/*). Create symlinks in /data/ota(/*)
+allow postinstall_dexopt ota_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow postinstall_dexopt ota_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow postinstall_dexopt ota_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Need to write .b files, which are dalvikcache_data_file, not ota_data_file.
+# TODO: See whether we can apply ota_data_file?
+allow postinstall_dexopt dalvikcache_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow postinstall_dexopt dalvikcache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow labeling of files under /data/app/com.example/oat/
+# TODO: Restrict to .b suffix?
+allow postinstall_dexopt dalvikcache_data_file:dir relabelto;
+allow postinstall_dexopt dalvikcache_data_file:file { relabelto link };
+
+# Check validity of SELinux context before use.
+
+#line 77
+
+#line 77
+allow postinstall_dexopt selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 77
+allow postinstall_dexopt selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 77
+
+#line 77
+allow postinstall_dexopt selinuxfs:file { open append write lock map };
+#line 77
+allow postinstall_dexopt kernel:security check_context;
+#line 77
+
+
+#line 78
+
+#line 78
+allow postinstall_dexopt selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 78
+allow postinstall_dexopt selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 78
+
+#line 78
+allow postinstall_dexopt selinuxfs:file { open append write lock map };
+#line 78
+allow postinstall_dexopt kernel:security compute_av;
+#line 78
+allow postinstall_dexopt self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 78
+
+
+
+# Postinstall wants to know about our child.
+allow postinstall_dexopt postinstall:process sigchld;
+
+# Allow otapreopt to use file descriptors from otapreopt_chroot.
+# TODO: Probably we can actually close file descriptors...
+allow postinstall_dexopt otapreopt_chroot:fd use;
+
+# Allow postinstall_dexopt to access the runtime feature flag properties.
+
+#line 89
+allow postinstall_dexopt device_config_runtime_native_prop:file { getattr open read map };
+#line 89
+
+
+#line 90
+allow postinstall_dexopt device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 90
+
+#line 1 "system/sepolicy/private/prefetch.te"
+type prefetch, coredomain, domain;
+type prefetch_exec, exec_type, file_type, system_file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init prefetch_exec:file { getattr open read execute map };
+#line 4
+allow init prefetch:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow prefetch prefetch_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init prefetch:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init prefetch:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init prefetch_exec:process prefetch;
+#line 4
+
+#line 4
+
+
+# Allow prefetch to start recording by enabling tracing event under
+# /sys/kernel/tracing/events/filemap/mm_filemap_add_to_page_cache
+allow prefetch debugfs_tracing_instances:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow prefetch debugfs_tracing_instances:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow to read/write/create/delete to storage prefetch record files
+allow prefetch metadata_file:dir search;
+allow prefetch prefetch_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow prefetch prefetch_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 16
+allow prefetch prefetch_boot_prop:file { getattr open read map };
+#line 16
+;
+
+#line 17
+
+#line 17
+allow prefetch property_socket:sock_file write;
+#line 17
+allow prefetch init:unix_stream_socket connectto;
+#line 17
+
+#line 17
+allow prefetch prefetch_service_prop:property_service set;
+#line 17
+
+#line 17
+allow prefetch prefetch_service_prop:file { getattr open read map };
+#line 17
+
+#line 17
+;
+
+# Disallow other domains controlling prefetch service.
+neverallow {
+ domain
+ -init
+ -shell
+} ctl_prefetch_prop:property_service set;
+#line 1 "system/sepolicy/private/preloads_copy.te"
+type preloads_copy, domain, coredomain;
+type preloads_copy_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init preloads_copy_exec:file { getattr open read execute map };
+#line 4
+allow init preloads_copy:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow preloads_copy preloads_copy_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init preloads_copy:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init preloads_copy:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init preloads_copy_exec:process preloads_copy;
+#line 4
+
+#line 4
+
+
+allow preloads_copy shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow preloads_copy toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow preloads_copy preloads_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow preloads_copy preloads_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow preloads_copy preloads_media_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow preloads_copy preloads_media_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow to copy from /postinstall
+allow preloads_copy system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Silence the denial when /postinstall cannot be mounted, e.g., system_other
+# is wiped, but preloads_copy.sh still runs.
+dontaudit preloads_copy postinstall_mnt_dir:dir search;
+#line 1 "system/sepolicy/private/preopt2cachename.te"
+# preopt2cachename executable
+#
+# This executable translates names from the preopted versions the build system
+# creates to the names the runtime expects in the data directory.
+
+type preopt2cachename, domain, coredomain;
+type preopt2cachename_exec, system_file_type, exec_type, file_type;
+
+# Allow write to stdout.
+allow preopt2cachename cppreopts:fd use;
+allow preopt2cachename cppreopts:fifo_file { getattr read write };
+
+# Allow write to logcat.
+allow preopt2cachename proc_net_type:file { getattr open read ioctl lock map watch watch_reads };
+#line 17
+
+#line 1 "system/sepolicy/private/priv_app.te"
+###
+### A domain for further sandboxing privileged apps.
+###
+
+typeattribute priv_app coredomain;
+
+#line 6
+typeattribute priv_app appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition priv_app tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type priv_app_userfaultfd;
+#line 6
+type_transition priv_app priv_app:anon_inode priv_app_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow priv_app priv_app_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su priv_app_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -priv_app } priv_app_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow priv_app appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { priv_app -runas_app -shell -simpleperf } { domain -priv_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -priv_app } priv_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -priv_app -crash_dump -runas_app -simpleperf } priv_app:process ptrace;
+#line 6
+
+
+# Access the network.
+
+#line 9
+typeattribute priv_app netdomain;
+#line 9
+
+# Access bluetooth.
+
+#line 11
+typeattribute priv_app bluetoothdomain;
+#line 11
+
+
+# Allow the allocation and use of ptys
+# Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
+
+#line 15
+# Each domain gets a unique devpts type.
+#line 15
+type priv_app_devpts, fs_type;
+#line 15
+# Label the pty with the unique type when created.
+#line 15
+type_transition priv_app devpts:chr_file priv_app_devpts;
+#line 15
+# Allow use of the pty after creation.
+#line 15
+allow priv_app priv_app_devpts:chr_file { open getattr read write ioctl };
+#line 15
+allowxperm priv_app priv_app_devpts:chr_file ioctl {
+#line 15
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 15
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 15
+};
+#line 15
+# TIOCSTI is only ever used for exploits. Block it.
+#line 15
+# b/33073072, b/7530569
+#line 15
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+#line 15
+neverallowxperm * priv_app_devpts:chr_file ioctl 0x00005412;
+#line 15
+# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
+#line 15
+# allowed to everyone via domain.te.
+#line 15
+
+
+# Allow loading executable code from writable priv-app home
+# directories. This is a W^X violation, however, it needs
+# to be supported for now for the following reasons.
+# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
+# 1) com.android.opengl.shaders_cache
+# 2) com.android.skia.shaders_cache
+# 3) com.android.renderscript.cache
+# * /data/user_de/0/com.google.android.gms/app_chimera
+# TODO: Tighten (b/112357170)
+allow priv_app privapp_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow priv_app system_linker_exec:file execute_no_trans;
+
+allow priv_app privapp_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Priv apps can find services that expose both @SystemAPI and normal APIs.
+allow priv_app app_api_service:service_manager find;
+allow priv_app system_api_service:service_manager find;
+
+allow priv_app audioserver_service:service_manager find;
+allow priv_app cameraserver_service:service_manager find;
+allow priv_app drmserver_service:service_manager find;
+allow priv_app mediadrmserver_service:service_manager find;
+allow priv_app mediaextractor_service:service_manager find;
+allow priv_app mediametrics_service:service_manager find;
+allow priv_app mediaserver_service:service_manager find;
+allow priv_app music_recognition_service:service_manager find;
+allow priv_app network_watchlist_service:service_manager find;
+allow priv_app nfc_service:service_manager find;
+allow priv_app oem_lock_service:service_manager find;
+allow priv_app persistent_data_block_service:service_manager find;
+allow priv_app radio_service:service_manager find;
+allow priv_app recovery_service:service_manager find;
+allow priv_app stats_service:service_manager find;
+
+# Write to /cache.
+allow priv_app { cache_file cache_recovery_file }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow priv_app { cache_file cache_recovery_file }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow priv_app cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Access to /data/media.
+allow priv_app media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow priv_app media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow priv_app shell_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow priv_app shell_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow traceur to pass file descriptors through a content provider to betterbug
+allow priv_app trace_data_file:file { getattr read };
+
+# Allow betterbug to read profile reports generated by profcollect.
+#line 75
+
+
+# Allow the bug reporting frontend to read the presence and timestamp of the
+# trace attached to the bugreport (but not its contents, which will go in the
+# usual bugreport .zip file). This is used by the bug reporting UI to tell if
+# the bugreport will contain a system trace or not while the bugreport is still
+# in progress.
+allow priv_app wm_trace_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow priv_app wm_trace_data_file:file getattr;
+allow priv_app perfetto_traces_bugreport_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow priv_app perfetto_traces_bugreport_data_file:file { getattr };
+# Required to traverse the parent dir (/data/misc/perfetto-traces).
+allow priv_app perfetto_traces_data_file:dir { search };
+
+# Allow priv apps (e.g. BetterBug) to receive Perfetto traces through
+# the framework (i.e. TracingServiceProxy) and sendfile them into their private
+# directories for reporting when network and battery conditions are
+# appropriate.
+allow priv_app perfetto:fd use;
+allow priv_app perfetto_traces_data_file:file { read getattr };
+
+# Allow verifier to access staged apks.
+allow priv_app { apk_tmp_file apk_private_tmp_file }:dir { open getattr read search ioctl lock watch watch_reads };
+allow priv_app { apk_tmp_file apk_private_tmp_file }:file { getattr open read ioctl lock map watch watch_reads };
+allowxperm priv_app { apk_tmp_file apk_private_tmp_file }:file ioctl 0x6686;
+
+# For AppFuse.
+allow priv_app vold:fd use;
+allow priv_app fuse_device:chr_file { read write };
+
+# /proc access
+allow priv_app {
+ proc_vmstat
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+allow priv_app sysfs_type:dir search;
+# Read access to /sys/block/zram*/mm_stat
+
+#line 112
+allow priv_app sysfs_zram:dir { open getattr read search ioctl lock watch watch_reads };
+#line 112
+allow priv_app sysfs_zram:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 112
+
+
+
+#line 114
+allow priv_app rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 114
+allow priv_app rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 114
+
+
+# Allow com.android.vending to communicate with statsd.
+
+#line 117
+# Call the server domain and optionally transfer references to it.
+#line 117
+allow priv_app statsd:binder { call transfer };
+#line 117
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 117
+allow statsd priv_app:binder transfer;
+#line 117
+# Receive and use open files from the server.
+#line 117
+allow priv_app statsd:fd use;
+#line 117
+
+
+# Allow Phone to read/write cached ringtones (opened by system).
+allow priv_app ringtone_file:file { getattr read write };
+
+# Access to /data/preloads
+allow priv_app preloads_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow priv_app preloads_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow priv_app preloads_media_file:file { getattr open read ioctl lock map watch watch_reads };
+allow priv_app preloads_media_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 128
+allow priv_app runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 128
+
+
+# Allow priv_apps to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow priv_app incident_service:service_manager find;
+
+#line 133
+# Call the server domain and optionally transfer references to it.
+#line 133
+allow priv_app incidentd:binder { call transfer };
+#line 133
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 133
+allow incidentd priv_app:binder transfer;
+#line 133
+# Receive and use open files from the server.
+#line 133
+allow priv_app incidentd:fd use;
+#line 133
+
+allow priv_app incidentd:fifo_file { read write };
+
+# Allow priv_apps to check whether Dynamic System Update is enabled
+
+#line 137
+allow priv_app dynamic_system_prop:file { getattr open read map };
+#line 137
+
+
+# Allow privileged apps to read trade in mode property
+
+#line 140
+allow priv_app adbd_tradeinmode_prop:file { getattr open read map };
+#line 140
+
+
+# suppress denials for non-API accesses.
+dontaudit priv_app exec_type:file getattr;
+dontaudit priv_app device:dir read;
+dontaudit priv_app fs_bpf:dir search;
+dontaudit priv_app net_dns_prop:file read;
+dontaudit priv_app proc:file read;
+dontaudit priv_app proc_interrupts:file read;
+dontaudit priv_app proc_modules:file read;
+dontaudit priv_app proc_net:file read;
+dontaudit priv_app proc_stat:file read;
+dontaudit priv_app proc_version:file read;
+dontaudit priv_app sysfs:dir read;
+dontaudit priv_app sysfs:file read;
+dontaudit priv_app sysfs_android_usb:file read;
+dontaudit priv_app sysfs_dm:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit priv_app { wifi_prop wifi_config_prop wifi_hal_prop }:file read;
+
+# allow privileged apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow priv_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow apps like Phonesky to check the file signature of an apk installed on
+# the Incremental File System, fill missing blocks and get the app status and loading progress
+allowxperm priv_app apk_data_file:file ioctl {
+ 0x0000671f
+ 0x00006720
+ 0x00006724
+ 0x00006722
+};
+
+# allow privileged data loader apps (e.g. com.android.vending) to read logs from Incremental File System
+allow priv_app incremental_control_file:file { read getattr ioctl };
+
+# allow apps like Phonesky to request permission to fill blocks of an apk file
+# on the Incremental File System.
+allowxperm priv_app incremental_control_file:file ioctl 0x00006721;
+
+# allow privileged apps to read the vendor property that indicates if Incremental File System is enabled
+
+#line 181
+allow priv_app incremental_prop:file { getattr open read map };
+#line 181
+
+
+# allow privileged apps to read the device config flags.
+
+#line 184
+allow priv_app device_config_aconfig_flags_prop:file { getattr open read map };
+#line 184
+
+
+# allow privileged apps to read boot reason property
+
+#line 187
+allow priv_app system_boot_reason_prop:file { getattr open read map };
+#line 187
+
+
+# Required for Phonesky to be able to read APEX files under /data/apex/active/.
+allow priv_app apex_data_file:dir search;
+allow priv_app staging_data_file:file { getattr open read ioctl lock map watch watch_reads };
+# Required for Phonesky to be able to read staged files under /data/app-staging.
+allow priv_app staging_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow com.android.vending to access files under vendor/apex as well as system apex files.
+# This is required for com.android.vending to handle APEXes for e.g. delta patch optimization.
+allow priv_app vendor_apex_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow priv_app vendor_apex_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow priv app to access the system app data files for ContentProvider case.
+allow priv_app system_app_data_file:file { read getattr };
+
+# Allow the renderscript compiler to be run.
+
+#line 204
+# Allow the necessary permissions.
+#line 204
+
+#line 204
+# Old domain may exec the file and transition to the new domain.
+#line 204
+allow priv_app rs_exec:file { getattr open read execute map };
+#line 204
+allow priv_app rs:process transition;
+#line 204
+# New domain is entered by executing the file.
+#line 204
+allow rs rs_exec:file { entrypoint open read execute getattr map };
+#line 204
+# New domain can send SIGCHLD to its caller.
+#line 204
+allow rs priv_app:process sigchld;
+#line 204
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 204
+dontaudit priv_app rs:process noatsecure;
+#line 204
+# XXX dontaudit candidate but requires further study.
+#line 204
+allow priv_app rs:process { siginh rlimitinh };
+#line 204
+
+#line 204
+# Make the transition occur by default.
+#line 204
+type_transition priv_app rs_exec:process rs;
+#line 204
+
+
+# Allow loading and deleting executable shared libraries
+# within an application home directory. Such shared libraries would be
+# created by things like renderscript or via other mechanisms.
+allow priv_app app_exec_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute unlink };
+
+# Allow privileged apps to create a VM. Note that access is still
+# guarded with the `android.permission.MANAGE_VIRTUAL_MACHINE`
+# permission.
+
+#line 214
+# Transition to virtualizationmanager when the client executes it.
+#line 214
+
+#line 214
+# Allow the necessary permissions.
+#line 214
+
+#line 214
+# Old domain may exec the file and transition to the new domain.
+#line 214
+allow priv_app virtualizationmanager_exec:file { getattr open read execute map };
+#line 214
+allow priv_app virtualizationmanager:process transition;
+#line 214
+# New domain is entered by executing the file.
+#line 214
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 214
+# New domain can send SIGCHLD to its caller.
+#line 214
+allow virtualizationmanager priv_app:process sigchld;
+#line 214
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 214
+dontaudit priv_app virtualizationmanager:process noatsecure;
+#line 214
+# XXX dontaudit candidate but requires further study.
+#line 214
+allow priv_app virtualizationmanager:process { siginh rlimitinh };
+#line 214
+
+#line 214
+# Make the transition occur by default.
+#line 214
+type_transition priv_app virtualizationmanager_exec:process virtualizationmanager;
+#line 214
+
+#line 214
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 214
+allow { virtualizationmanager crosvm } priv_app:unix_stream_socket { ioctl getattr read write };
+#line 214
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 214
+allow { virtualizationmanager crosvm } priv_app:fd use;
+#line 214
+# Let the client use file descriptors created by virtualizationmanager.
+#line 214
+allow priv_app virtualizationmanager:fd use;
+#line 214
+# Allow piping console log to the client
+#line 214
+allow { virtualizationmanager crosvm } priv_app:fifo_file { ioctl getattr read write };
+#line 214
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 214
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 214
+# the client can only connect to VMs that it owns.
+#line 214
+allow priv_app virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 214
+# Allow client to inspect hypervisor capabilities
+#line 214
+
+#line 214
+allow priv_app hypervisor_prop:file { getattr open read map };
+#line 214
+
+#line 214
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 214
+allow priv_app virtualizationservice_data_file:file { getattr read };
+#line 214
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 214
+allow virtualizationmanager priv_app:dir search;
+#line 214
+allow virtualizationmanager priv_app:file read;
+#line 214
+allow virtualizationmanager priv_app:lnk_file read;
+#line 214
+
+
+###
+### neverallow rules
+###
+
+# Receive or send uevent messages.
+neverallow priv_app domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow priv_app domain:netlink_socket *;
+
+# Read or write kernel printk buffer
+neverallow priv_app kmsg_device:chr_file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow priv_app debugfs_type:file read;
+
+# Do not allow privileged apps to register services.
+# Only trusted components of Android should be registering
+# services.
+neverallow priv_app service_manager_type:service_manager add;
+
+# Do not allow privileged apps to connect to the property service
+# or set properties. b/10243159
+neverallow priv_app property_socket:sock_file write;
+neverallow priv_app init:unix_stream_socket connectto;
+neverallow priv_app property_type:property_service set;
+
+# Do not allow priv_app to be assigned mlstrustedsubject.
+# This would undermine the per-user isolation model being
+# enforced via levelFrom=user in seapp_contexts and the mls
+# constraints. As there is no direct way to specify a neverallow
+# on attribute assignment, this relies on the fact that fork
+# permission only makes sense within a domain (hence should
+# never be granted to any other domain within mlstrustedsubject)
+# and priv_app is allowed fork permission to itself.
+neverallow priv_app mlstrustedsubject:process fork;
+
+# Do not allow priv_app to hard link to any files.
+# In particular, if priv_app links to other app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure priv_app never has this
+# capability.
+neverallow priv_app file_type:file link;
+
+# priv apps should not be able to open trace data files, they should depend
+# upon traceur to pass a file descriptor which they can then read
+neverallow priv_app trace_data_file:dir *;
+neverallow priv_app trace_data_file:file { { append create link unlink relabelfrom rename setattr write } open };
+
+# Do not allow priv_app access to cgroups.
+neverallow priv_app cgroup:file *;
+neverallow priv_app cgroup_v2:file *;
+
+# Do not allow loading executable code from non-privileged
+# application home directories. Code loading across a security boundary
+# is dangerous and allows a full compromise of a privileged process
+# by an unprivileged process. b/112357170
+neverallow priv_app { app_data_file_type -privapp_data_file }:file { execute execute_no_trans };
+
+# Do not follow any app provided symlinks
+neverallow priv_app { app_data_file_type -privapp_data_file }:lnk_file { open read getattr };
+
+# Do not allow getting permission-protected network information from sysfs.
+neverallow priv_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm priv_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl
+#line 285
+{
+#line 285
+# qualcomm rmnet ioctls
+#line 285
+0x00006900 0x00006902
+#line 285
+# socket ioctls
+#line 285
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 285
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 285
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 285
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 285
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 285
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 285
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 285
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 285
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 285
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 285
+# device and protocol specific ioctls
+#line 285
+0x000089f0-0x000089ff
+#line 285
+0x000089e0-0x000089ef
+#line 285
+# Wireless extension ioctls
+#line 285
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 285
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 285
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 285
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 285
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 285
+0x00008b34 0x00008b35 0x00008b36
+#line 285
+# Dev private ioctl i.e. hardware specific ioctls
+#line 285
+0x00008be0-0x00008bff
+#line 285
+};
+neverallow priv_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow priv_app *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
+#line 1 "system/sepolicy/private/prng_seeder.te"
+# PRNG seeder daemon
+# Started from early init, maintains a FIPS approved DRBG which it periodically reseeds from
+# /dev/hw_random. When BoringSSL (libcrypto) in other processes needs seeding data for its
+# internal DRBGs it will connect to /dev/socket/prng_seeder and the daemon will write a
+# fixed size block of entropy then disconnect. No other IO is performed.
+typeattribute prng_seeder coredomain;
+
+# mlstrustedsubject required in order to allow connections from trusted app domains.
+typeattribute prng_seeder mlstrustedsubject;
+
+type prng_seeder_exec, system_file_type, exec_type, file_type;
+
+#line 12
+
+#line 12
+# Allow the necessary permissions.
+#line 12
+
+#line 12
+# Old domain may exec the file and transition to the new domain.
+#line 12
+allow init prng_seeder_exec:file { getattr open read execute map };
+#line 12
+allow init prng_seeder:process transition;
+#line 12
+# New domain is entered by executing the file.
+#line 12
+allow prng_seeder prng_seeder_exec:file { entrypoint open read execute getattr map };
+#line 12
+# New domain can send SIGCHLD to its caller.
+#line 12
+
+#line 12
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 12
+dontaudit init prng_seeder:process noatsecure;
+#line 12
+# XXX dontaudit candidate but requires further study.
+#line 12
+allow init prng_seeder:process { siginh rlimitinh };
+#line 12
+
+#line 12
+# Make the transition occur by default.
+#line 12
+type_transition init prng_seeder_exec:process prng_seeder;
+#line 12
+
+#line 12
+
+
+# Socket open and listen are performed by init.
+allow prng_seeder prng_seeder:unix_stream_socket { read write getattr accept };
+allow prng_seeder hw_random_device:chr_file { read open };
+allow prng_seeder kmsg_debug_device:chr_file { { open append write lock map } getattr ioctl };
+#line 1 "system/sepolicy/private/profcollectd.te"
+# profcollectd - hardware profile collection daemon
+type profcollectd, domain, coredomain, mlstrustedsubject;
+type profcollectd_exec, system_file_type, exec_type, file_type;
+
+#line 69
+
+#line 1 "system/sepolicy/private/profman.te"
+typeattribute profman coredomain;
+typeattribute profman artd_subprocess_type;
+
+# Allow profman to read APKs and profile files next to them by FDs passed from
+# other programs. In addition, allow profman to acquire flocks on those files.
+allow profman {
+ system_file
+ apk_data_file
+ apk_tmp_file
+ vendor_app_file
+}:file { getattr read map lock };
+
+# Allow profman to use file descriptors passed from privileged programs.
+allow profman { artd installd }:fd use;
+
+# Allow profman to read from memfd created by artd.
+# profman needs to read the embedded profile that artd extracts from an APK,
+# which is passed by a memfd.
+allow profman artd_tmpfs:file { getattr read map lock };
+
+allow profman user_profile_data_file:file { getattr read write lock map };
+
+# Dumping profile info opens the application APK file for pretty printing.
+allow profman asec_apk_file:file { read map };
+allow profman apk_data_file:file { getattr read map };
+allow profman apk_data_file:dir { getattr read search };
+allow profman apk_tmp_file:dir { getattr read search };
+
+allow profman oemfs:file { read map };
+# Reading an APK opens a ZipArchive, which unpack to tmpfs.
+allow profman tmpfs:file { read map };
+allow profman profman_dump_data_file:file { write map };
+
+# Allow profman to analyze profiles for the secondary dex files. These
+# are application dex files reported back to the framework when using
+# BaseDexClassLoader.
+allow profman { privapp_data_file app_data_file }:file { getattr read write lock map };
+allow profman { privapp_data_file app_data_file }:dir { getattr read search };
+
+# Allow query ART device config properties
+
+#line 41
+allow profman device_config_runtime_native_prop:file { getattr open read map };
+#line 41
+
+
+#line 42
+allow profman device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 42
+
+
+###
+### neverallow rules
+###
+
+neverallow profman app_data_file_type:{ file lnk_file sock_file fifo_file } open;
+#line 1 "system/sepolicy/private/property.te"
+# Properties used only in /system
+
+#line 2
+
+#line 2
+ type adbd_prop, property_type, system_property_type, system_internal_property_type;
+#line 2
+
+#line 2
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 2
+
+#line 2
+ neverallow { domain -coredomain } adbd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 2
+
+#line 2
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 2
+
+#line 2
+
+
+#line 3
+
+#line 3
+ type adbd_tradeinmode_prop, property_type, system_property_type, system_internal_property_type;
+#line 3
+
+#line 3
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 3
+
+#line 3
+ neverallow { domain -coredomain } adbd_tradeinmode_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+
+#line 3
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 3
+
+#line 3
+
+
+#line 4
+
+#line 4
+ type apexd_payload_metadata_prop, property_type, system_property_type, system_internal_property_type;
+#line 4
+
+#line 4
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 4
+
+#line 4
+ neverallow { domain -coredomain } apexd_payload_metadata_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 4
+
+#line 4
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 4
+
+#line 4
+
+
+#line 5
+
+#line 5
+ type ctl_snapuserd_prop, property_type, system_property_type, system_internal_property_type;
+#line 5
+
+#line 5
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 5
+
+#line 5
+ neverallow { domain -coredomain } ctl_snapuserd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 5
+
+#line 5
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 5
+
+#line 5
+
+
+#line 6
+
+#line 6
+ type ctl_prefetch_prop, property_type, system_property_type, system_internal_property_type;
+#line 6
+
+#line 6
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 6
+
+#line 6
+ neverallow { domain -coredomain } ctl_prefetch_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+
+#line 6
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+ type ctl_uprobestats_prop, property_type, system_property_type, system_internal_property_type;
+#line 7
+
+#line 7
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 7
+
+#line 7
+ neverallow { domain -coredomain } ctl_uprobestats_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+
+#line 7
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 7
+
+#line 7
+
+
+#line 8
+
+#line 8
+ type crashrecovery_prop, property_type, system_property_type, system_internal_property_type;
+#line 8
+
+#line 8
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 8
+
+#line 8
+ neverallow { domain -coredomain } crashrecovery_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 8
+
+#line 8
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 8
+
+#line 8
+
+
+#line 9
+
+#line 9
+ type debug_tracing_desktop_mode_visible_tasks_prop, property_type, system_property_type, system_internal_property_type;
+#line 9
+
+#line 9
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 9
+
+#line 9
+ neverallow { domain -coredomain } debug_tracing_desktop_mode_visible_tasks_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+
+#line 9
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+ type device_config_core_experiments_team_internal_prop, property_type, system_property_type, system_internal_property_type;
+#line 10
+
+#line 10
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 10
+
+#line 10
+ neverallow { domain -coredomain } device_config_core_experiments_team_internal_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 10
+
+#line 10
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+ type device_config_lmkd_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 11
+
+#line 11
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 11
+
+#line 11
+ neverallow { domain -coredomain } device_config_lmkd_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 11
+
+#line 11
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 11
+
+#line 11
+
+
+#line 12
+
+#line 12
+ type device_config_mglru_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 12
+
+#line 12
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 12
+
+#line 12
+ neverallow { domain -coredomain } device_config_mglru_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 12
+
+#line 12
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 12
+
+#line 12
+
+
+#line 13
+
+#line 13
+ type device_config_mmd_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 13
+
+#line 13
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 13
+
+#line 13
+ neverallow { domain -coredomain } device_config_mmd_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+
+#line 13
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 13
+
+#line 13
+
+
+#line 14
+
+#line 14
+ type device_config_profcollect_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 14
+
+#line 14
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 14
+
+#line 14
+ neverallow { domain -coredomain } device_config_profcollect_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 14
+
+#line 14
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 14
+
+#line 14
+
+
+#line 15
+
+#line 15
+ type device_config_remote_key_provisioning_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 15
+
+#line 15
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+ neverallow { domain -coredomain } device_config_remote_key_provisioning_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+
+#line 15
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 15
+
+#line 15
+
+
+#line 16
+
+#line 16
+ type device_config_statsd_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 16
+
+#line 16
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 16
+
+#line 16
+ neverallow { domain -coredomain } device_config_statsd_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 16
+
+#line 16
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 16
+
+#line 16
+
+
+#line 17
+
+#line 17
+ type device_config_statsd_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 17
+
+#line 17
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 17
+
+#line 17
+ neverallow { domain -coredomain } device_config_statsd_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 17
+
+#line 17
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 17
+
+#line 17
+
+
+#line 18
+
+#line 18
+ type device_config_storage_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 18
+
+#line 18
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 18
+
+#line 18
+ neverallow { domain -coredomain } device_config_storage_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 18
+
+#line 18
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 18
+
+#line 18
+
+
+#line 19
+
+#line 19
+ type device_config_sys_traced_prop, property_type, system_property_type, system_internal_property_type;
+#line 19
+
+#line 19
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 19
+
+#line 19
+ neverallow { domain -coredomain } device_config_sys_traced_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 19
+
+#line 19
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 19
+
+#line 19
+
+
+#line 20
+
+#line 20
+ type device_config_window_manager_native_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 20
+
+#line 20
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 20
+
+#line 20
+ neverallow { domain -coredomain } device_config_window_manager_native_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 20
+
+#line 20
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 20
+
+#line 20
+
+
+#line 21
+
+#line 21
+ type device_config_configuration_prop, property_type, system_property_type, system_internal_property_type;
+#line 21
+
+#line 21
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 21
+
+#line 21
+ neverallow { domain -coredomain } device_config_configuration_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 21
+
+#line 21
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 21
+
+#line 21
+
+
+#line 22
+
+#line 22
+ type device_config_connectivity_prop, property_type, system_property_type, system_internal_property_type;
+#line 22
+
+#line 22
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 22
+
+#line 22
+ neverallow { domain -coredomain } device_config_connectivity_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 22
+
+#line 22
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 22
+
+#line 22
+
+
+#line 23
+
+#line 23
+ type device_config_swcodec_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 23
+
+#line 23
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 23
+
+#line 23
+ neverallow { domain -coredomain } device_config_swcodec_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 23
+
+#line 23
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 23
+
+#line 23
+
+
+#line 24
+
+#line 24
+ type device_config_tethering_u_or_later_native_prop, property_type, system_property_type, system_internal_property_type;
+#line 24
+
+#line 24
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 24
+
+#line 24
+ neverallow { domain -coredomain } device_config_tethering_u_or_later_native_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 24
+
+#line 24
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 24
+
+#line 24
+
+
+#line 25
+
+#line 25
+ type dmesgd_start_prop, property_type, system_property_type, system_internal_property_type;
+#line 25
+
+#line 25
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 25
+
+#line 25
+ neverallow { domain -coredomain } dmesgd_start_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 25
+
+#line 25
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 25
+
+#line 25
+
+
+#line 26
+
+#line 26
+ type fastbootd_protocol_prop, property_type, system_property_type, system_internal_property_type;
+#line 26
+
+#line 26
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 26
+
+#line 26
+ neverallow { domain -coredomain } fastbootd_protocol_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 26
+
+#line 26
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 26
+
+#line 26
+
+
+#line 27
+
+#line 27
+ type gsid_prop, property_type, system_property_type, system_internal_property_type;
+#line 27
+
+#line 27
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 27
+
+#line 27
+ neverallow { domain -coredomain } gsid_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 27
+
+#line 27
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 27
+
+#line 27
+
+
+#line 28
+
+#line 28
+ type init_perf_lsm_hooks_prop, property_type, system_property_type, system_internal_property_type;
+#line 28
+
+#line 28
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 28
+
+#line 28
+ neverallow { domain -coredomain } init_perf_lsm_hooks_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 28
+
+#line 28
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 28
+
+#line 28
+
+
+#line 29
+
+#line 29
+ type init_service_status_private_prop, property_type, system_property_type, system_internal_property_type;
+#line 29
+
+#line 29
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 29
+
+#line 29
+ neverallow { domain -coredomain } init_service_status_private_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 29
+
+#line 29
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 29
+
+#line 29
+
+
+#line 30
+
+#line 30
+ type init_storage_prop, property_type, system_property_type, system_internal_property_type;
+#line 30
+
+#line 30
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 30
+
+#line 30
+ neverallow { domain -coredomain } init_storage_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 30
+
+#line 30
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 30
+
+#line 30
+
+
+#line 31
+
+#line 31
+ type init_svc_debug_prop, property_type, system_property_type, system_internal_property_type;
+#line 31
+
+#line 31
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 31
+
+#line 31
+ neverallow { domain -coredomain } init_svc_debug_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 31
+
+#line 31
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 31
+
+#line 31
+
+
+#line 32
+
+#line 32
+ type kcmdline_prop, property_type, system_property_type, system_internal_property_type;
+#line 32
+
+#line 32
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 32
+
+#line 32
+ neverallow { domain -coredomain } kcmdline_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 32
+
+#line 32
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 32
+
+#line 32
+
+
+#line 33
+
+#line 33
+ type keystore_diagnostics_prop, property_type, system_property_type, system_internal_property_type;
+#line 33
+
+#line 33
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 33
+
+#line 33
+ neverallow { domain -coredomain } keystore_diagnostics_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 33
+
+#line 33
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 33
+
+#line 33
+
+
+#line 34
+
+#line 34
+ type keystore_listen_prop, property_type, system_property_type, system_internal_property_type;
+#line 34
+
+#line 34
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 34
+
+#line 34
+ neverallow { domain -coredomain } keystore_listen_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 34
+
+#line 34
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 34
+
+#line 34
+
+
+#line 35
+
+#line 35
+ type last_boot_reason_prop, property_type, system_property_type, system_internal_property_type;
+#line 35
+
+#line 35
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 35
+
+#line 35
+ neverallow { domain -coredomain } last_boot_reason_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 35
+
+#line 35
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 35
+
+#line 35
+
+
+#line 36
+
+#line 36
+ type localization_prop, property_type, system_property_type, system_internal_property_type;
+#line 36
+
+#line 36
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 36
+
+#line 36
+ neverallow { domain -coredomain } localization_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 36
+
+#line 36
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 36
+
+#line 36
+
+
+#line 37
+
+#line 37
+ type logd_auditrate_prop, property_type, system_property_type, system_internal_property_type;
+#line 37
+
+#line 37
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 37
+
+#line 37
+ neverallow { domain -coredomain } logd_auditrate_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 37
+
+#line 37
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 37
+
+#line 37
+
+
+#line 38
+
+#line 38
+ type lower_kptr_restrict_prop, property_type, system_property_type, system_internal_property_type;
+#line 38
+
+#line 38
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 38
+
+#line 38
+ neverallow { domain -coredomain } lower_kptr_restrict_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 38
+
+#line 38
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 38
+
+#line 38
+
+
+#line 39
+
+#line 39
+ type mmd_prop, property_type, system_property_type, system_internal_property_type;
+#line 39
+
+#line 39
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 39
+
+#line 39
+ neverallow { domain -coredomain } mmd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 39
+
+#line 39
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 39
+
+#line 39
+
+
+#line 40
+
+#line 40
+ type net_464xlat_fromvendor_prop, property_type, system_property_type, system_internal_property_type;
+#line 40
+
+#line 40
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 40
+
+#line 40
+ neverallow { domain -coredomain } net_464xlat_fromvendor_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 40
+
+#line 40
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 40
+
+#line 40
+
+
+#line 41
+
+#line 41
+ type net_connectivity_prop, property_type, system_property_type, system_internal_property_type;
+#line 41
+
+#line 41
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 41
+
+#line 41
+ neverallow { domain -coredomain } net_connectivity_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 41
+
+#line 41
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 41
+
+#line 41
+
+
+#line 42
+
+#line 42
+ type netd_stable_secret_prop, property_type, system_property_type, system_internal_property_type;
+#line 42
+
+#line 42
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 42
+
+#line 42
+ neverallow { domain -coredomain } netd_stable_secret_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 42
+
+#line 42
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 42
+
+#line 42
+
+
+#line 43
+
+#line 43
+ type next_boot_prop, property_type, system_property_type, system_internal_property_type;
+#line 43
+
+#line 43
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 43
+
+#line 43
+ neverallow { domain -coredomain } next_boot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 43
+
+#line 43
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 43
+
+#line 43
+
+
+#line 44
+
+#line 44
+ type odsign_prop, property_type, system_property_type, system_internal_property_type;
+#line 44
+
+#line 44
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 44
+
+#line 44
+ neverallow { domain -coredomain } odsign_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 44
+
+#line 44
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 44
+
+#line 44
+
+
+#line 45
+
+#line 45
+ type misctrl_prop, property_type, system_property_type, system_internal_property_type;
+#line 45
+
+#line 45
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 45
+
+#line 45
+ neverallow { domain -coredomain } misctrl_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 45
+
+#line 45
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 45
+
+#line 45
+
+
+#line 46
+
+#line 46
+ type perf_drop_caches_prop, property_type, system_property_type, system_internal_property_type;
+#line 46
+
+#line 46
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 46
+
+#line 46
+ neverallow { domain -coredomain } perf_drop_caches_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 46
+
+#line 46
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 46
+
+#line 46
+
+
+#line 47
+
+#line 47
+ type pm_prop, property_type, system_property_type, system_internal_property_type;
+#line 47
+
+#line 47
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 47
+
+#line 47
+ neverallow { domain -coredomain } pm_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 47
+
+#line 47
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 47
+
+#line 47
+
+
+#line 48
+
+#line 48
+ type prefetch_service_prop, property_type, system_property_type, system_internal_property_type;
+#line 48
+
+#line 48
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 48
+
+#line 48
+ neverallow { domain -coredomain } prefetch_service_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 48
+
+#line 48
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 48
+
+#line 48
+
+
+#line 49
+
+#line 49
+ type profcollectd_node_id_prop, property_type, system_property_type, system_internal_property_type;
+#line 49
+
+#line 49
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 49
+
+#line 49
+ neverallow { domain -coredomain } profcollectd_node_id_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 49
+
+#line 49
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 49
+
+#line 49
+
+
+#line 50
+
+#line 50
+ type radio_cdma_ecm_prop, property_type, system_property_type, system_internal_property_type;
+#line 50
+
+#line 50
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 50
+
+#line 50
+ neverallow { domain -coredomain } radio_cdma_ecm_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 50
+
+#line 50
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 50
+
+#line 50
+
+
+#line 51
+
+#line 51
+ type remote_prov_prop, property_type, system_property_type, system_internal_property_type;
+#line 51
+
+#line 51
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 51
+
+#line 51
+ neverallow { domain -coredomain } remote_prov_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 51
+
+#line 51
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 51
+
+#line 51
+
+
+#line 52
+
+#line 52
+ type remote_prov_cert_prop, property_type, system_property_type, system_internal_property_type;
+#line 52
+
+#line 52
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 52
+
+#line 52
+ neverallow { domain -coredomain } remote_prov_cert_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 52
+
+#line 52
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 52
+
+#line 52
+
+
+#line 53
+
+#line 53
+ type rollback_test_prop, property_type, system_property_type, system_internal_property_type;
+#line 53
+
+#line 53
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 53
+
+#line 53
+ neverallow { domain -coredomain } rollback_test_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 53
+
+#line 53
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 53
+
+#line 53
+
+
+#line 54
+
+#line 54
+ type setupwizard_prop, property_type, system_property_type, system_internal_property_type;
+#line 54
+
+#line 54
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 54
+
+#line 54
+ neverallow { domain -coredomain } setupwizard_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 54
+
+#line 54
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 54
+
+#line 54
+
+
+#line 55
+
+#line 55
+ type snapshotctl_prop, property_type, system_property_type, system_internal_property_type;
+#line 55
+
+#line 55
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 55
+
+#line 55
+ neverallow { domain -coredomain } snapshotctl_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 55
+
+#line 55
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 55
+
+#line 55
+
+
+#line 56
+
+#line 56
+ type snapuserd_prop, property_type, system_property_type, system_internal_property_type;
+#line 56
+
+#line 56
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 56
+
+#line 56
+ neverallow { domain -coredomain } snapuserd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 56
+
+#line 56
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 56
+
+#line 56
+
+
+#line 57
+
+#line 57
+ type system_adbd_prop, property_type, system_property_type, system_internal_property_type;
+#line 57
+
+#line 57
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 57
+
+#line 57
+ neverallow { domain -coredomain } system_adbd_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 57
+
+#line 57
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 57
+
+#line 57
+
+
+#line 58
+
+#line 58
+ type system_audio_config_prop, property_type, system_property_type, system_internal_property_type;
+#line 58
+
+#line 58
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 58
+
+#line 58
+ neverallow { domain -coredomain } system_audio_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 58
+
+#line 58
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 58
+
+#line 58
+
+
+#line 59
+
+#line 59
+ type timezone_metadata_prop, property_type, system_property_type, system_internal_property_type;
+#line 59
+
+#line 59
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 59
+
+#line 59
+ neverallow { domain -coredomain } timezone_metadata_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 59
+
+#line 59
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 59
+
+#line 59
+
+
+#line 60
+
+#line 60
+ type traced_perf_enabled_prop, property_type, system_property_type, system_internal_property_type;
+#line 60
+
+#line 60
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 60
+
+#line 60
+ neverallow { domain -coredomain } traced_perf_enabled_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 60
+
+#line 60
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 60
+
+#line 60
+
+
+#line 61
+
+#line 61
+ type uprobestats_start_with_config_prop, property_type, system_property_type, system_internal_property_type;
+#line 61
+
+#line 61
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 61
+
+#line 61
+ neverallow { domain -coredomain } uprobestats_start_with_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 61
+
+#line 61
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 61
+
+#line 61
+
+
+#line 62
+
+#line 62
+ type tuner_server_ctl_prop, property_type, system_property_type, system_internal_property_type;
+#line 62
+
+#line 62
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 62
+
+#line 62
+ neverallow { domain -coredomain } tuner_server_ctl_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 62
+
+#line 62
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 62
+
+#line 62
+
+
+#line 63
+
+#line 63
+ type userspace_reboot_log_prop, property_type, system_property_type, system_internal_property_type;
+#line 63
+
+#line 63
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 63
+
+#line 63
+ neverallow { domain -coredomain } userspace_reboot_log_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 63
+
+#line 63
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 63
+
+#line 63
+
+
+#line 64
+
+#line 64
+ type userspace_reboot_test_prop, property_type, system_property_type, system_internal_property_type;
+#line 64
+
+#line 64
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 64
+
+#line 64
+ neverallow { domain -coredomain } userspace_reboot_test_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 64
+
+#line 64
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 64
+
+#line 64
+
+
+#line 65
+
+#line 65
+ type verity_status_prop, property_type, system_property_type, system_internal_property_type;
+#line 65
+
+#line 65
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 65
+
+#line 65
+ neverallow { domain -coredomain } verity_status_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 65
+
+#line 65
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 65
+
+#line 65
+
+
+#line 66
+
+#line 66
+ type zygote_wrap_prop, property_type, system_property_type, system_internal_property_type;
+#line 66
+
+#line 66
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 66
+
+#line 66
+ neverallow { domain -coredomain } zygote_wrap_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 66
+
+#line 66
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 66
+
+#line 66
+
+
+#line 67
+
+#line 67
+ type ctl_mediatranscoding_prop, property_type, system_property_type, system_internal_property_type;
+#line 67
+
+#line 67
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 67
+
+#line 67
+ neverallow { domain -coredomain } ctl_mediatranscoding_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 67
+
+#line 67
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 67
+
+#line 67
+
+
+#line 68
+
+#line 68
+ type ctl_odsign_prop, property_type, system_property_type, system_internal_property_type;
+#line 68
+
+#line 68
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 68
+
+#line 68
+ neverallow { domain -coredomain } ctl_odsign_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 68
+
+#line 68
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 68
+
+#line 68
+
+
+#line 69
+
+#line 69
+ type virtualizationservice_prop, property_type, system_property_type, system_internal_property_type;
+#line 69
+
+#line 69
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 69
+
+#line 69
+ neverallow { domain -coredomain } virtualizationservice_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 69
+
+#line 69
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 69
+
+#line 69
+
+
+#line 70
+
+#line 70
+ type ctl_apex_load_prop, property_type, system_property_type, system_internal_property_type;
+#line 70
+
+#line 70
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 70
+
+#line 70
+ neverallow { domain -coredomain } ctl_apex_load_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 70
+
+#line 70
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 70
+
+#line 70
+
+
+#line 71
+
+#line 71
+ type sensors_config_prop, property_type, system_property_type, system_internal_property_type;
+#line 71
+
+#line 71
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 71
+
+#line 71
+ neverallow { domain -coredomain } sensors_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 71
+
+#line 71
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 71
+
+#line 71
+
+
+#line 72
+
+#line 72
+ type hypervisor_pvmfw_prop, property_type, system_property_type, system_internal_property_type;
+#line 72
+
+#line 72
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 72
+
+#line 72
+ neverallow { domain -coredomain } hypervisor_pvmfw_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 72
+
+#line 72
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 72
+
+#line 72
+
+
+#line 73
+
+#line 73
+ type hypervisor_virtualizationmanager_prop, property_type, system_property_type, system_internal_property_type;
+#line 73
+
+#line 73
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 73
+
+#line 73
+ neverallow { domain -coredomain } hypervisor_virtualizationmanager_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 73
+
+#line 73
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 73
+
+#line 73
+
+
+#line 74
+
+#line 74
+ type game_manager_config_prop, property_type, system_property_type, system_internal_property_type;
+#line 74
+
+#line 74
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 74
+
+#line 74
+ neverallow { domain -coredomain } game_manager_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 74
+
+#line 74
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 74
+
+#line 74
+
+
+#line 75
+
+#line 75
+ type hidl_memory_prop, property_type, system_property_type, system_internal_property_type;
+#line 75
+
+#line 75
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 75
+
+#line 75
+ neverallow { domain -coredomain } hidl_memory_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 75
+
+#line 75
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 75
+
+#line 75
+
+
+#line 76
+
+#line 76
+ type suspend_debug_prop, property_type, system_property_type, system_internal_property_type;
+#line 76
+
+#line 76
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 76
+
+#line 76
+ neverallow { domain -coredomain } suspend_debug_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 76
+
+#line 76
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 76
+
+#line 76
+
+
+#line 77
+
+#line 77
+ type system_service_enable_prop, property_type, system_property_type, system_internal_property_type;
+#line 77
+
+#line 77
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 77
+
+#line 77
+ neverallow { domain -coredomain } system_service_enable_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 77
+
+#line 77
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 77
+
+#line 77
+
+
+#line 78
+
+#line 78
+ type ctl_artd_pre_reboot_prop, property_type, system_property_type, system_internal_property_type;
+#line 78
+
+#line 78
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 78
+
+#line 78
+ neverallow { domain -coredomain } ctl_artd_pre_reboot_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 78
+
+#line 78
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 78
+
+#line 78
+
+
+#line 79
+
+#line 79
+ type trusty_security_vm_sys_prop, property_type, system_property_type, system_internal_property_type;
+#line 79
+
+#line 79
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 79
+
+#line 79
+ neverallow { domain -coredomain } trusty_security_vm_sys_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 79
+
+#line 79
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 79
+
+#line 79
+
+
+#line 80
+
+#line 80
+ type hint_manager_config_prop, property_type, system_property_type, system_internal_property_type;
+#line 80
+
+#line 80
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 80
+
+#line 80
+ neverallow { domain -coredomain } hint_manager_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 80
+
+#line 80
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 80
+
+#line 80
+
+
+# Properties which can't be written outside system
+
+#line 83
+
+#line 83
+ type bionic_linker_16kb_app_compat_prop, property_type, system_property_type, system_restricted_property_type;
+#line 83
+
+#line 83
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 83
+
+#line 83
+ neverallow { domain -coredomain } bionic_linker_16kb_app_compat_prop:property_service set;
+#line 83
+
+#line 83
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 83
+
+#line 83
+
+
+#line 84
+
+#line 84
+ type device_config_virtualization_framework_native_prop, property_type, system_property_type, system_restricted_property_type;
+#line 84
+
+#line 84
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 84
+
+#line 84
+ neverallow { domain -coredomain } device_config_virtualization_framework_native_prop:property_service set;
+#line 84
+
+#line 84
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 84
+
+#line 84
+
+
+#line 85
+
+#line 85
+ type fstype_prop, property_type, system_property_type, system_restricted_property_type;
+#line 85
+
+#line 85
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 85
+
+#line 85
+ neverallow { domain -coredomain } fstype_prop:property_service set;
+#line 85
+
+#line 85
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 85
+
+#line 85
+
+
+#line 86
+
+#line 86
+ type log_file_logger_prop, property_type, system_property_type, system_restricted_property_type;
+#line 86
+
+#line 86
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 86
+
+#line 86
+ neverallow { domain -coredomain } log_file_logger_prop:property_service set;
+#line 86
+
+#line 86
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 86
+
+#line 86
+
+
+#line 87
+
+#line 87
+ type persist_sysui_builder_extras_prop, property_type, system_property_type, system_restricted_property_type;
+#line 87
+
+#line 87
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 87
+
+#line 87
+ neverallow { domain -coredomain } persist_sysui_builder_extras_prop:property_service set;
+#line 87
+
+#line 87
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 87
+
+#line 87
+
+
+#line 88
+
+#line 88
+ type persist_sysui_ranking_update_prop, property_type, system_property_type, system_restricted_property_type;
+#line 88
+
+#line 88
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 88
+
+#line 88
+ neverallow { domain -coredomain } persist_sysui_ranking_update_prop:property_service set;
+#line 88
+
+#line 88
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 88
+
+#line 88
+
+
+#line 89
+
+#line 89
+ type page_size_prop, property_type, system_property_type, system_restricted_property_type;
+#line 89
+
+#line 89
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 89
+
+#line 89
+ neverallow { domain -coredomain } page_size_prop:property_service set;
+#line 89
+
+#line 89
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 89
+
+#line 89
+
+
+#line 90
+
+#line 90
+ type pm_16kb_app_compat_prop, property_type, system_property_type, system_restricted_property_type;
+#line 90
+
+#line 90
+ # BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 90
+
+#line 90
+ neverallow { domain -coredomain } pm_16kb_app_compat_prop:property_service set;
+#line 90
+
+#line 90
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 90
+
+#line 90
+
+
+
+# Properties with no restrictions
+#line 98
+
+
+# These types will be public starting at board api 202504
+#line 104
+
+
+# These types will be public starting at board api 202504
+#line 109
+
+
+# Properties which should only be written by vendor_init
+
+#line 112
+
+#line 112
+ type avf_virtualizationservice_prop, property_type, system_property_type, system_public_property_type;
+#line 112
+
+#line 112
+
+#line 112
+
+#line 112
+allow vendor_init property_socket:sock_file write;
+#line 112
+allow vendor_init init:unix_stream_socket connectto;
+#line 112
+
+#line 112
+allow vendor_init avf_virtualizationservice_prop:property_service set;
+#line 112
+
+#line 112
+allow vendor_init avf_virtualizationservice_prop:file { getattr open read map };
+#line 112
+
+#line 112
+
+#line 112
+ neverallow { domain -init -vendor_init } avf_virtualizationservice_prop:property_service set;
+#line 112
+
+
+#line 113
+
+#line 113
+ type high_barometer_quality_prop, property_type, system_property_type, system_public_property_type;
+#line 113
+
+#line 113
+
+#line 113
+
+#line 113
+allow vendor_init property_socket:sock_file write;
+#line 113
+allow vendor_init init:unix_stream_socket connectto;
+#line 113
+
+#line 113
+allow vendor_init high_barometer_quality_prop:property_service set;
+#line 113
+
+#line 113
+allow vendor_init high_barometer_quality_prop:file { getattr open read map };
+#line 113
+
+#line 113
+
+#line 113
+ neverallow { domain -init -vendor_init } high_barometer_quality_prop:property_service set;
+#line 113
+
+
+#line 114
+
+#line 114
+ type prefetch_boot_prop, property_type, system_property_type, system_public_property_type;
+#line 114
+
+#line 114
+
+#line 114
+
+#line 114
+allow vendor_init property_socket:sock_file write;
+#line 114
+allow vendor_init init:unix_stream_socket connectto;
+#line 114
+
+#line 114
+allow vendor_init prefetch_boot_prop:property_service set;
+#line 114
+
+#line 114
+allow vendor_init prefetch_boot_prop:file { getattr open read map };
+#line 114
+
+#line 114
+
+#line 114
+ neverallow { domain -init -vendor_init } prefetch_boot_prop:property_service set;
+#line 114
+
+
+#line 115
+
+#line 115
+ type widevine_sys_vendor_prop, property_type, system_property_type, system_public_property_type;
+#line 115
+
+#line 115
+
+#line 115
+
+#line 115
+allow vendor_init property_socket:sock_file write;
+#line 115
+allow vendor_init init:unix_stream_socket connectto;
+#line 115
+
+#line 115
+allow vendor_init widevine_sys_vendor_prop:property_service set;
+#line 115
+
+#line 115
+allow vendor_init widevine_sys_vendor_prop:file { getattr open read map };
+#line 115
+
+#line 115
+
+#line 115
+ neverallow { domain -init -vendor_init } widevine_sys_vendor_prop:property_service set;
+#line 115
+
+
+typeattribute log_prop log_property_type;
+typeattribute log_tag_prop log_property_type;
+typeattribute wifi_log_prop log_property_type;
+
+allow property_type tmpfs:filesystem associate;
+
+# core_property_type should not be used for new properties or
+# device specific properties. Properties with this attribute
+# are readable to everyone, which is overly broad and should
+# be avoided.
+# New properties should have appropriate read / write access
+# control rules written.
+
+typeattribute audio_prop core_property_type;
+typeattribute config_prop core_property_type;
+typeattribute cppreopt_prop core_property_type;
+typeattribute dalvik_prop core_property_type;
+typeattribute debuggerd_prop core_property_type;
+typeattribute debug_prop core_property_type;
+typeattribute dhcp_prop core_property_type;
+typeattribute dumpstate_prop core_property_type;
+typeattribute logd_prop core_property_type;
+typeattribute net_radio_prop core_property_type;
+typeattribute nfc_prop core_property_type;
+typeattribute ota_prop core_property_type;
+typeattribute pan_result_prop core_property_type;
+typeattribute persist_debug_prop core_property_type;
+typeattribute powerctl_prop core_property_type;
+typeattribute radio_prop core_property_type;
+typeattribute restorecon_prop core_property_type;
+typeattribute shell_prop core_property_type;
+typeattribute system_prop core_property_type;
+typeattribute usb_prop core_property_type;
+typeattribute vold_prop core_property_type;
+
+typeattribute dalvik_config_prop dalvik_config_prop_type;
+typeattribute dalvik_dynamic_config_prop dalvik_config_prop_type;
+
+###
+### Neverallow rules
+###
+
+# BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 159
+
+#line 159
+
+#line 159
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 159
+
+#line 159
+ neverallow domain {
+#line 159
+ property_type
+#line 159
+ -system_property_type
+#line 159
+ -system_property_type
+#line 159
+ -vendor_property_type
+#line 159
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 159
+
+#line 159
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 159
+
+#line 159
+
+#line 159
+neverallow { domain -coredomain } {
+#line 159
+ system_property_type
+#line 159
+ system_internal_property_type
+#line 159
+ -system_restricted_property_type
+#line 159
+ -system_public_property_type
+#line 159
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 159
+
+#line 159
+neverallow { domain -coredomain } {
+#line 159
+ system_property_type
+#line 159
+ -system_public_property_type
+#line 159
+}:property_service set;
+#line 159
+
+#line 159
+# init is in coredomain, but should be able to read/write all props.
+#line 159
+# dumpstate is also in coredomain, but should be able to read all props.
+#line 159
+neverallow { coredomain -init -dumpstate } {
+#line 159
+ vendor_property_type
+#line 159
+ vendor_internal_property_type
+#line 159
+ -vendor_restricted_property_type
+#line 159
+ -vendor_public_property_type
+#line 159
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 159
+
+#line 159
+neverallow { coredomain -init } {
+#line 159
+ vendor_property_type
+#line 159
+ -vendor_public_property_type
+#line 159
+}:property_service set;
+#line 159
+
+#line 159
+
+#line 159
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+#line 196
+
+
+# There is no need to perform ioctl or advisory locking operations on
+# property files. If this neverallow is being triggered, it is
+# likely that the policy is using r_file_perms directly instead of
+# the get_prop() macro.
+neverallow domain property_type:file { ioctl lock };
+
+neverallow * {
+ core_property_type
+ -audio_prop
+ -config_prop
+ -cppreopt_prop
+ -dalvik_prop
+ -debuggerd_prop
+ -debug_prop
+ -dhcp_prop
+ -dumpstate_prop
+ -fingerprint_prop
+ -logd_prop
+ -net_radio_prop
+ -nfc_prop
+ -ota_prop
+ -pan_result_prop
+ -persist_debug_prop
+ -powerctl_prop
+ -radio_prop
+ -restorecon_prop
+ -shell_prop
+ -system_prop
+ -usb_prop
+ -vold_prop
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# sigstop property is only used for debugging; should only be set by su which is permissive
+# for userdebug/eng
+neverallow {
+ domain
+ -init
+ -vendor_init
+} ctl_sigstop_prop:property_service set;
+
+# Don't audit legacy ctl. property handling. We only want the newer permission check to appear
+# in the audit log
+dontaudit domain {
+ ctl_bootanim_prop
+ ctl_bugreport_prop
+ ctl_console_prop
+ ctl_default_prop
+ ctl_dumpstate_prop
+ ctl_fuse_prop
+ ctl_mdnsd_prop
+ ctl_rildaemon_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -extra_free_kbytes
+} init_storage_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} init_svc_debug_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -dumpstate
+
+} init_svc_debug_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# DO NOT ADD: compat risk
+neverallow {
+ domain
+ -init
+ -crash_dump
+ -dumpstate
+ -misctrl
+ -statsd
+
+} misctrl_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow {
+ domain
+ -init
+ -misctrl
+
+} misctrl_prop:property_service set;
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 286
+
+#line 286
+# Prevent properties from being set
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ core_property_type
+#line 286
+ extended_core_property_type
+#line 286
+ exported_config_prop
+#line 286
+ exported_default_prop
+#line 286
+ exported_dumpstate_prop
+#line 286
+ exported_system_prop
+#line 286
+ exported3_system_prop
+#line 286
+ usb_control_prop
+#line 286
+ -nfc_prop
+#line 286
+ -powerctl_prop
+#line 286
+ -radio_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -hal_nfc_server
+#line 286
+ } {
+#line 286
+ nfc_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -hal_telephony_server
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ radio_control_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -hal_telephony_server
+#line 286
+ } {
+#line 286
+ radio_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -bluetooth
+#line 286
+ -hal_bluetooth_server
+#line 286
+ } {
+#line 286
+ bluetooth_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -bluetooth
+#line 286
+ -hal_bluetooth_server
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ exported_bluetooth_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -hal_camera_server
+#line 286
+ -cameraserver
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ exported_camera_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -hal_wifi_server
+#line 286
+ -wificond
+#line 286
+ } {
+#line 286
+ wifi_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -init
+#line 286
+ -dumpstate
+#line 286
+ -hal_wifi_server
+#line 286
+ -wificond
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ wifi_hal_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+# Prevent properties from being read
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ core_property_type
+#line 286
+ dalvik_config_prop_type
+#line 286
+ extended_core_property_type
+#line 286
+ exported3_system_prop
+#line 286
+ systemsound_config_prop
+#line 286
+ -debug_prop
+#line 286
+ -logd_prop
+#line 286
+ -nfc_prop
+#line 286
+ -powerctl_prop
+#line 286
+ -radio_prop
+#line 286
+ -dalvik_dynamic_config_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -vendor_init
+#line 286
+ -hal_power_server
+#line 286
+ } dalvik_dynamic_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -hal_nfc_server
+#line 286
+ } {
+#line 286
+ nfc_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -appdomain
+#line 286
+ -hal_telephony_server
+#line 286
+ } {
+#line 286
+ radio_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -bluetooth
+#line 286
+ -hal_bluetooth_server
+#line 286
+ } {
+#line 286
+ bluetooth_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -hal_wifi_server
+#line 286
+ -wificond
+#line 286
+ } {
+#line 286
+ wifi_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -coredomain
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ suspend_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -init
+#line 286
+ } {
+#line 286
+ suspend_debug_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -init
+#line 286
+ -vendor_init
+#line 286
+ } {
+#line 286
+ high_barometer_quality_prop
+#line 286
+ }:property_service set;
+#line 286
+
+#line 286
+ neverallow {
+#line 286
+ domain
+#line 286
+ -init
+#line 286
+ -dumpstate
+#line 286
+
+#line 286
+ } {
+#line 286
+ suspend_debug_prop
+#line 286
+ }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 286
+
+#line 286
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 479
+
+
+dontaudit system_suspend suspend_debug_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 483
+
+#line 483
+ # Neverallow coredomain to set vendor properties
+#line 483
+ neverallow {
+#line 483
+ coredomain
+#line 483
+ -init
+#line 483
+ -system_writes_vendor_properties_violators
+#line 483
+ } {
+#line 483
+ property_type
+#line 483
+ -system_property_type
+#line 483
+ -extended_core_property_type
+#line 483
+ }:property_service set;
+#line 483
+
+#line 483
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+#line 494
+
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ ffs_config_prop
+ ffs_control_prop
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -system_server
+} {
+ userspace_reboot_log_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init and system_server to set system_adbd_prop
+ domain
+ -init
+ -system_server
+} {
+ system_adbd_prop
+}:property_service set;
+
+# Let (vendor_)init, adbd, and system_server set service.adb.tcp.port
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -adbd
+ -adbd_tradeinmode
+ -system_server
+} {
+ adbd_config_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init and adbd to set adbd_prop
+ domain
+ -init
+ -adbd
+ -adbd_tradeinmode
+} {
+ adbd_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init to set apexd_payload_metadata_prop
+ domain
+ -init
+} {
+ apexd_payload_metadata_prop
+}:property_service set;
+
+
+neverallow {
+ # Only allow init and shell to set userspace_reboot_test_prop
+ domain
+ -init
+ -shell
+} {
+ userspace_reboot_test_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} {
+ surfaceflinger_color_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+} {
+ libc_debug_prop
+}:property_service set;
+
+# Allow the shell to set MTE & GWP-ASan props, so that non-root users with adb
+# shell access can control the settings on their device. Allow system apps to
+# set MTE props, so Developer Options can set them.
+neverallow {
+ domain
+ -init
+ -shell
+ -system_app
+ -system_server
+ -mtectrl
+} {
+ arm64_memtag_prop
+ gwp_asan_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+ -kcmdlinectrl
+} {
+ kcmdline_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} zram_control_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} dalvik_runtime_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ usb_config_prop
+ usb_control_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+} {
+ provisioned_prop
+ retaildemo_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ provisioned_prop
+ retaildemo_prop
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+} {
+ init_service_status_private_prop
+ init_service_status_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -radio
+ -appdomain
+ -hal_telephony_server
+ -vendor_init
+} telephony_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} {
+ graphics_config_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -surfaceflinger
+} {
+ surfaceflinger_display_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_init
+} packagemanager_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} keyguard_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+} {
+ localization_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_app
+} oem_unlock_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} storagemanager_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -appdomain
+} sendbug_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -appdomain
+} camera_calibration_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -hal_dumpstate_server
+ -vendor_init
+} hal_dumpstate_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+
+
+
+
+} {
+ lower_kptr_restrict_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+} zygote_wrap_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} verity_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} setupwizard_mode_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} setupwizard_prop:property_service set;
+
+# ro.product.property_source_order is useless after initialization of ro.product.* props.
+# So making it accessible only from init and vendor_init.
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -vendor_init
+} build_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -shell
+} sqlite_log_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -appdomain
+} sqlite_log_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+} default_prop:property_service set;
+
+# Only one of system_property_type and vendor_property_type can be assigned.
+# Property types having both attributes won't be accessible from anywhere.
+neverallow domain system_and_vendor_property_type:{file property_service} *;
+
+neverallow {
+ domain
+ -init
+ -keystore
+ -shell
+ -system_server
+ -rkpdapp
+} remote_prov_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} remote_prov_cert_prop:property_service set;
+
+neverallow {
+ # Only allow init and shell to set rollback_test_prop
+ domain
+ -init
+ -shell
+} rollback_test_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -apexd
+} ctl_apex_load_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -init
+ -dumpstate
+ -apexd
+} ctl_apex_load_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -apexd
+} apex_ready_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -dumpstate
+ -apexd
+ -vendor_init
+} apex_ready_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ # Only allow init and profcollectd to access profcollectd_node_id_prop
+ domain
+ -init
+ -dumpstate
+ -profcollectd
+} profcollectd_node_id_prop:file { getattr open read ioctl lock map watch watch_reads };
+
+neverallow {
+ domain
+ -init
+} log_file_logger_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} usb_uvc_enabled_prop:property_service set;
+
+# Disallow non system apps from reading ro.usb.uvc.enabled
+neverallow {
+ appdomain
+ -system_app
+ -device_as_webcam
+} usb_uvc_enabled_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} pm_archiving_enabled_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+
+} bionic_linker_16kb_app_compat_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+
+} pm_16kb_app_compat_prop:property_service set;
+#line 1 "system/sepolicy/private/radio.te"
+typeattribute radio coredomain, mlstrustedsubject;
+
+
+#line 3
+typeattribute radio appdomain;
+#line 3
+# Label tmpfs objects for all apps.
+#line 3
+type_transition radio tmpfs:file appdomain_tmpfs;
+#line 3
+
+#line 3
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 3
+type radio_userfaultfd;
+#line 3
+type_transition radio radio:anon_inode radio_userfaultfd "[userfaultfd]";
+#line 3
+# Allow domain to create/use userfaultfd anon_inode.
+#line 3
+allow radio radio_userfaultfd:anon_inode { create ioctl read };
+#line 3
+# Suppress errors generate during bugreport
+#line 3
+dontaudit su radio_userfaultfd:anon_inode *;
+#line 3
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 3
+neverallow { domain -radio } radio_userfaultfd:anon_inode *;
+#line 3
+
+#line 3
+allow radio appdomain_tmpfs:file { execute getattr map read write };
+#line 3
+neverallow { radio -runas_app -shell -simpleperf } { domain -radio }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+neverallow { appdomain -runas_app -shell -simpleperf -radio } radio:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+# The Android security model guarantees the confidentiality and integrity
+#line 3
+# of application data and execution state. Ptrace bypasses those
+#line 3
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 3
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 3
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 3
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 3
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 3
+# live lock conditions.
+#line 3
+neverallow { domain -radio -crash_dump -runas_app -simpleperf } radio:process ptrace;
+#line 3
+
+
+
+#line 5
+allow radio runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 5
+
+
+# Property service
+
+#line 8
+
+#line 8
+allow radio property_socket:sock_file write;
+#line 8
+allow radio init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow radio radio_control_prop:property_service set;
+#line 8
+
+#line 8
+allow radio radio_control_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+#line 9
+
+#line 9
+allow radio property_socket:sock_file write;
+#line 9
+allow radio init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow radio radio_prop:property_service set;
+#line 9
+
+#line 9
+allow radio radio_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+#line 10
+
+#line 10
+allow radio property_socket:sock_file write;
+#line 10
+allow radio init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow radio net_radio_prop:property_service set;
+#line 10
+
+#line 10
+allow radio net_radio_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+#line 11
+
+#line 11
+allow radio property_socket:sock_file write;
+#line 11
+allow radio init:unix_stream_socket connectto;
+#line 11
+
+#line 11
+allow radio telephony_status_prop:property_service set;
+#line 11
+
+#line 11
+allow radio telephony_status_prop:file { getattr open read map };
+#line 11
+
+#line 11
+
+
+#line 12
+
+#line 12
+allow radio property_socket:sock_file write;
+#line 12
+allow radio init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow radio radio_cdma_ecm_prop:property_service set;
+#line 12
+
+#line 12
+allow radio radio_cdma_ecm_prop:file { getattr open read map };
+#line 12
+
+#line 12
+
+
+# ctl interface
+
+#line 15
+
+#line 15
+allow radio property_socket:sock_file write;
+#line 15
+allow radio init:unix_stream_socket connectto;
+#line 15
+
+#line 15
+allow radio ctl_rildaemon_prop:property_service set;
+#line 15
+
+#line 15
+allow radio ctl_rildaemon_prop:file { getattr open read map };
+#line 15
+
+#line 15
+
+
+# Telephony code contains time / time zone detection logic so it reads the associated properties.
+
+#line 18
+allow radio time_prop:file { getattr open read map };
+#line 18
+
+
+# allow telephony to access platform compat to log permission denials
+allow radio platform_compat_service:service_manager find;
+
+allow radio uce_service:service_manager find;
+
+# Manage /data/misc/emergencynumberdb
+allow radio emergency_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow radio emergency_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow telephony to access related cache properties
+
+#line 30
+
+#line 30
+allow radio property_socket:sock_file write;
+#line 30
+allow radio init:unix_stream_socket connectto;
+#line 30
+
+#line 30
+allow radio binder_cache_telephony_server_prop:property_service set;
+#line 30
+
+#line 30
+allow radio binder_cache_telephony_server_prop:file { getattr open read map };
+#line 30
+
+#line 30
+;
+
+# allow sending pulled atoms to statsd
+
+#line 33
+# Call the server domain and optionally transfer references to it.
+#line 33
+allow radio statsd:binder { call transfer };
+#line 33
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 33
+allow statsd radio:binder transfer;
+#line 33
+# Receive and use open files from the server.
+#line 33
+allow radio statsd:fd use;
+#line 33
+
+
+
+#line 35
+typeattribute radio netdomain;
+#line 35
+
+
+#line 36
+typeattribute radio bluetoothdomain;
+#line 36
+
+
+#line 37
+typeattribute radio binderservicedomain;
+#line 37
+
+
+# Talks to hal_telephony_server via the rild socket only for devices without full treble
+
+#line 40
+allow radio rild_socket:sock_file write;
+#line 40
+allow radio hal_telephony_server:unix_stream_socket connectto;
+#line 40
+
+
+# Data file accesses.
+allow radio radio_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow radio radio_data_file:{ file lnk_file sock_file fifo_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow radio radio_core_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow radio radio_core_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow radio net_data_file:dir search;
+allow radio net_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 51
+ allow radio radio_service:service_manager { add find };
+#line 51
+ neverallow { domain -radio } radio_service:service_manager add;
+#line 51
+
+#line 51
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 51
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 51
+
+#line 51
+
+allow radio audioserver_service:service_manager find;
+allow radio cameraserver_service:service_manager find;
+allow radio drmserver_service:service_manager find;
+allow radio mediaserver_service:service_manager find;
+allow radio nfc_service:service_manager find;
+allow radio app_api_service:service_manager find;
+allow radio system_api_service:service_manager find;
+allow radio timedetector_service:service_manager find;
+allow radio timezonedetector_service:service_manager find;
+
+# Perform HwBinder IPC.
+
+#line 63
+# Call the hwservicemanager and transfer references to it.
+#line 63
+allow radio hwservicemanager:binder { call transfer };
+#line 63
+# Allow hwservicemanager to send out callbacks
+#line 63
+allow hwservicemanager radio:binder { call transfer };
+#line 63
+# hwservicemanager performs getpidcon on clients.
+#line 63
+allow hwservicemanager radio:dir search;
+#line 63
+allow hwservicemanager radio:file { read open map };
+#line 63
+allow hwservicemanager radio:process getattr;
+#line 63
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 63
+# all domains in domain.te.
+#line 63
+
+
+#line 64
+typeattribute radio halclientdomain;
+#line 64
+typeattribute radio hal_telephony_client;
+#line 64
+
+#line 64
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 64
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 64
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 64
+
+#line 64
+typeattribute radio hal_telephony;
+#line 64
+# Find passthrough HAL implementations
+#line 64
+allow hal_telephony system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 64
+allow hal_telephony vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 64
+allow hal_telephony vendor_file:file { read open getattr execute map };
+#line 64
+
+#line 64
+
+
+# Used by TelephonyManager
+allow radio proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -radio -init }
+ binder_cache_telephony_server_prop:property_service set;
+#line 1 "system/sepolicy/private/recovery.te"
+typeattribute recovery coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise recovery is only allowed the domain rules.
+#line 185
+
+
+###
+### neverallow rules
+###
+
+# Recovery should never touch /data.
+#
+# In particular, if /data is encrypted, it is not accessible
+# to recovery anyway.
+#
+# For now, we only enforce write/execute restrictions, as domain.te
+# contains a number of read-only rules that apply to all
+# domains, including recovery.
+#
+# TODO: tighten this up further.
+neverallow recovery {
+ data_file_type
+ -cache_file
+ -cache_recovery_file
+
+}:file { { append create link unlink relabelfrom rename setattr write } { execute execute_no_trans } };
+neverallow recovery {
+ data_file_type
+ -cache_file
+ -cache_recovery_file
+
+}:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+#line 1 "system/sepolicy/private/recovery_persist.te"
+typeattribute recovery_persist coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init recovery_persist_exec:file { getattr open read execute map };
+#line 3
+allow init recovery_persist:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow recovery_persist recovery_persist_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init recovery_persist:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init recovery_persist:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init recovery_persist_exec:process recovery_persist;
+#line 3
+
+#line 3
+
+
+allow recovery_persist pstorefs:dir search;
+allow recovery_persist pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+
+allow recovery_persist recovery_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow recovery_persist recovery_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+allow recovery_persist cache_file:dir search;
+allow recovery_persist cache_file:lnk_file read;
+allow recovery_persist cache_recovery_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow recovery_persist cache_recovery_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+
+###
+### Neverallow rules
+###
+### recovery_persist should NEVER do any of this
+
+# Block device access.
+neverallow recovery_persist dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow recovery_persist domain:process ptrace;
+
+# Write to /system.
+neverallow recovery_persist system_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Write to files in /data/data
+neverallow recovery_persist { app_data_file_type system_data_file }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# recovery_persist is not allowed to write anywhere other than recovery_data_file
+neverallow recovery_persist {
+ file_type
+ -recovery_data_file
+
+
+}:file write;
+#line 1 "system/sepolicy/private/recovery_refresh.te"
+typeattribute recovery_refresh coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init recovery_refresh_exec:file { getattr open read execute map };
+#line 3
+allow init recovery_refresh:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow recovery_refresh recovery_refresh_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init recovery_refresh:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init recovery_refresh:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init recovery_refresh_exec:process recovery_refresh;
+#line 3
+
+#line 3
+
+
+allow recovery_refresh pstorefs:dir search;
+allow recovery_refresh pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+# NB: domain inherits write_logd which hands us write to pmsg_device
+
+###
+### Neverallow rules
+###
+### recovery_refresh should NEVER do any of this
+
+# Block device access.
+neverallow recovery_refresh dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow recovery_refresh domain:process ptrace;
+
+# Write to /system.
+neverallow recovery_refresh system_file_type:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# Write to files in /data/data or system files on /data
+neverallow recovery_refresh { app_data_file_type system_data_file }:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
+
+# recovery_refresh is not allowed to write anywhere
+neverallow recovery_refresh {
+ file_type
+
+
+}:file write;
+#line 1 "system/sepolicy/private/remote_provisioning_service_server.te"
+# This service is hosted by system server, and provides a stable aidl
+# front-end for a mainline module that is loaded into system server.
+
+#line 3
+ allow remote_provisioning_service_server remote_provisioning_service:service_manager { add find };
+#line 3
+ neverallow { domain -remote_provisioning_service_server } remote_provisioning_service:service_manager add;
+#line 3
+
+#line 3
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 3
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 3
+
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow remote_provisioning_service_server servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager remote_provisioning_service_server:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager remote_provisioning_service_server:dir search;
+#line 5
+allow servicemanager remote_provisioning_service_server:file { read open };
+#line 5
+allow servicemanager remote_provisioning_service_server:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+#line 1 "system/sepolicy/private/remount.te"
+type remount, domain, coredomain;
+type remount_exec, system_file_type, exec_type, file_type;
+
+#line 25
+
+#line 1 "system/sepolicy/private/rkp_cert_processor.te"
+# Cert processor service
+type rkp_cert_processor, domain, coredomain;
+type rkp_cert_processor_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init rkp_cert_processor_exec:file { getattr open read execute map };
+#line 5
+allow init rkp_cert_processor:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow rkp_cert_processor rkp_cert_processor_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init rkp_cert_processor:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init rkp_cert_processor:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init rkp_cert_processor_exec:process rkp_cert_processor;
+#line 5
+
+#line 5
+
+
+#line 6
+typeattribute rkp_cert_processor netdomain;
+#line 6
+
+
+
+#line 8
+# Call the servicemanager and transfer references to it.
+#line 8
+allow rkp_cert_processor servicemanager:binder { call transfer };
+#line 8
+# Allow servicemanager to send out callbacks
+#line 8
+allow servicemanager rkp_cert_processor:binder { call transfer };
+#line 8
+# servicemanager performs getpidcon on clients.
+#line 8
+allow servicemanager rkp_cert_processor:dir search;
+#line 8
+allow servicemanager rkp_cert_processor:file { read open };
+#line 8
+allow servicemanager rkp_cert_processor:process getattr;
+#line 8
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 8
+# all domains in domain.te.
+#line 8
+
+
+#line 9
+# Call the server domain and optionally transfer references to it.
+#line 9
+allow rkp_cert_processor system_server:binder { call transfer };
+#line 9
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 9
+allow system_server rkp_cert_processor:binder transfer;
+#line 9
+# Receive and use open files from the server.
+#line 9
+allow rkp_cert_processor system_server:fd use;
+#line 9
+
+
+
+#line 11
+ allow rkp_cert_processor rkp_cert_processor_service:service_manager { add find };
+#line 11
+ neverallow { domain -rkp_cert_processor } rkp_cert_processor_service:service_manager add;
+#line 11
+
+#line 11
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 11
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 11
+
+#line 11
+
+
+
+#line 13
+ allow rkp_cert_processor system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 13
+ allow rkp_cert_processor system_bootstrap_lib_file:file { execute read open getattr map };
+#line 13
+
+
+allow rkp_cert_processor package_native_service:service_manager find;
+#line 1 "system/sepolicy/private/rkpd.te"
+# Policies for Remote Key Provisioning Daemon (rkpd)
+type rkpd, domain;
+type rkpd_exec, system_file_type, exec_type, file_type;
+
+typeattribute rkpd coredomain;
+
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow rkpd servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager rkpd:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager rkpd:dir search;
+#line 7
+allow servicemanager rkpd:file { read open };
+#line 7
+allow servicemanager rkpd:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+typeattribute rkpd binderservicedomain;
+#line 8
+
+
+
+#line 10
+
+#line 10
+# Allow the necessary permissions.
+#line 10
+
+#line 10
+# Old domain may exec the file and transition to the new domain.
+#line 10
+allow init rkpd_exec:file { getattr open read execute map };
+#line 10
+allow init rkpd:process transition;
+#line 10
+# New domain is entered by executing the file.
+#line 10
+allow rkpd rkpd_exec:file { entrypoint open read execute getattr map };
+#line 10
+# New domain can send SIGCHLD to its caller.
+#line 10
+
+#line 10
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 10
+dontaudit init rkpd:process noatsecure;
+#line 10
+# XXX dontaudit candidate but requires further study.
+#line 10
+allow init rkpd:process { siginh rlimitinh };
+#line 10
+
+#line 10
+# Make the transition occur by default.
+#line 10
+type_transition init rkpd_exec:process rkpd;
+#line 10
+
+#line 10
+
+
+
+#line 12
+ allow rkpd rkpd_registrar_service:service_manager { add find };
+#line 12
+ neverallow { domain -rkpd } rkpd_registrar_service:service_manager add;
+#line 12
+
+#line 12
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 12
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 12
+
+#line 12
+
+
+#line 13
+ allow rkpd rkpd_refresh_service:service_manager { add find };
+#line 13
+ neverallow { domain -rkpd } rkpd_refresh_service:service_manager add;
+#line 13
+
+#line 13
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 13
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 13
+
+#line 13
+
+
+
+#line 15
+allow rkpd device_config_remote_key_provisioning_native_prop:file { getattr open read map };
+#line 15
+
+#line 1 "system/sepolicy/private/rkpd_app.te"
+###
+### A domain for sandboxing the remote key provisioning daemon
+### app that is shipped via mainline.
+###
+typeattribute rkpdapp coredomain;
+
+
+#line 7
+typeattribute rkpdapp appdomain;
+#line 7
+# Label tmpfs objects for all apps.
+#line 7
+type_transition rkpdapp tmpfs:file appdomain_tmpfs;
+#line 7
+
+#line 7
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 7
+type rkpdapp_userfaultfd;
+#line 7
+type_transition rkpdapp rkpdapp:anon_inode rkpdapp_userfaultfd "[userfaultfd]";
+#line 7
+# Allow domain to create/use userfaultfd anon_inode.
+#line 7
+allow rkpdapp rkpdapp_userfaultfd:anon_inode { create ioctl read };
+#line 7
+# Suppress errors generate during bugreport
+#line 7
+dontaudit su rkpdapp_userfaultfd:anon_inode *;
+#line 7
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 7
+neverallow { domain -rkpdapp } rkpdapp_userfaultfd:anon_inode *;
+#line 7
+
+#line 7
+allow rkpdapp appdomain_tmpfs:file { execute getattr map read write };
+#line 7
+neverallow { rkpdapp -runas_app -shell -simpleperf } { domain -rkpdapp }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+neverallow { appdomain -runas_app -shell -simpleperf -rkpdapp } rkpdapp:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 7
+# The Android security model guarantees the confidentiality and integrity
+#line 7
+# of application data and execution state. Ptrace bypasses those
+#line 7
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 7
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 7
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 7
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 7
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 7
+# live lock conditions.
+#line 7
+neverallow { domain -rkpdapp -crash_dump -runas_app -simpleperf } rkpdapp:process ptrace;
+#line 7
+
+
+#line 8
+typeattribute rkpdapp netdomain;
+#line 8
+
+
+# RKPD needs to be able to call the remote provisioning HALs
+
+#line 11
+typeattribute rkpdapp halclientdomain;
+#line 11
+typeattribute rkpdapp hal_keymint_client;
+#line 11
+
+#line 11
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 11
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 11
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 11
+
+#line 11
+typeattribute rkpdapp hal_keymint;
+#line 11
+# Find passthrough HAL implementations
+#line 11
+allow hal_keymint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_keymint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+allow hal_keymint vendor_file:file { read open getattr execute map };
+#line 11
+
+#line 11
+
+
+#line 12
+typeattribute rkpdapp halclientdomain;
+#line 12
+typeattribute rkpdapp hal_remotelyprovisionedcomponent_avf_client;
+#line 12
+
+#line 12
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 12
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 12
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 12
+
+#line 12
+typeattribute rkpdapp hal_remotelyprovisionedcomponent_avf;
+#line 12
+# Find passthrough HAL implementations
+#line 12
+allow hal_remotelyprovisionedcomponent_avf system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_remotelyprovisionedcomponent_avf vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 12
+allow hal_remotelyprovisionedcomponent_avf vendor_file:file { read open getattr execute map };
+#line 12
+
+#line 12
+
+
+# Grant access to certain system properties related to RKP
+
+#line 15
+allow rkpdapp device_config_remote_key_provisioning_native_prop:file { getattr open read map };
+#line 15
+
+
+#line 16
+
+#line 16
+allow rkpdapp property_socket:sock_file write;
+#line 16
+allow rkpdapp init:unix_stream_socket connectto;
+#line 16
+
+#line 16
+allow rkpdapp remote_prov_prop:property_service set;
+#line 16
+
+#line 16
+allow rkpdapp remote_prov_prop:file { getattr open read map };
+#line 16
+
+#line 16
+
+
+# Grant access to the normal services that are available to all apps
+allow rkpdapp app_api_service:service_manager find;
+
+# Grant access to media.metrics service, needed for widevine. This
+# access is granted to all other apps already (e.g. untrusted_app_all).
+allow rkpdapp mediametrics_service:service_manager find;
+
+# Grant access to statsd
+allow rkpdapp statsmanager_service:service_manager find;
+
+#line 27
+# Call the server domain and optionally transfer references to it.
+#line 27
+allow rkpdapp statsd:binder { call transfer };
+#line 27
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 27
+allow statsd rkpdapp:binder transfer;
+#line 27
+# Receive and use open files from the server.
+#line 27
+allow rkpdapp statsd:fd use;
+#line 27
+
+#line 1 "system/sepolicy/private/rootdisk_sysdev.te"
+allow rootdisk_sysdev sysfs:filesystem associate;
+#line 1 "system/sepolicy/private/rs.te"
+# Any files which would have been created as app_data_file and
+# privapp_data_file will be created as app_exec_data_file instead.
+allow rs { app_data_file privapp_data_file }:dir { { open getattr read search ioctl lock watch watch_reads } add_name write };
+allow rs app_exec_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+type_transition rs app_data_file:file app_exec_data_file;
+type_transition rs privapp_data_file:file app_exec_data_file;
+
+# Follow /data/user/0 symlink
+allow rs system_data_file:lnk_file read;
+
+# Read files from the app home directory.
+allow rs { app_data_file privapp_data_file }:file { getattr open read ioctl lock map watch watch_reads };
+allow rs { app_data_file privapp_data_file }:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Cleanup app_exec_data_file files in the app home directory.
+allow rs { app_data_file privapp_data_file }:dir remove_name;
+
+# Use vendor resources
+allow rs vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 20
+allow rs vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow rs vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 20
+
+
+#line 21
+allow rs vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow rs vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 21
+
+# Vendor overlay can be found in vendor apex
+allow rs vendor_apex_metadata_file:dir { getattr search };
+
+# Read contents of app apks
+
+#line 26
+allow rs apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow rs apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 26
+
+
+allow rs gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow rs ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow rs same_process_hal_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# File descriptors passed from app to renderscript
+allow rs { untrusted_app_all ephemeral_app priv_app }:fd use;
+
+# See b/291211299. Since rs is deprecated, this shouldn't be too dangerous, since new
+# renderscript usages shouldn't be popping up.
+dontaudit rs { zygote surfaceflinger hal_graphics_allocator }:fd use;
+
+# rs can access app data, so ensure it can only be entered via an app domain and cannot have
+# CAP_DAC_OVERRIDE.
+neverallow rs rs:{ capability capability2 cap_userns cap2_userns } *;
+neverallow { domain -appdomain } rs:process { dyntransition transition };
+neverallow rs { domain -crash_dump }:process { dyntransition transition };
+neverallow rs app_data_file_type:{ { chr_file blk_file } { file lnk_file sock_file fifo_file } } ~{ getattr open read ioctl lock map watch watch_reads };
+# rs should never use network sockets
+neverallow rs *:{ icmp_socket rawip_socket tcp_socket udp_socket } *;
+#line 1 "system/sepolicy/private/rss_hwm_reset.te"
+type rss_hwm_reset_exec, system_file_type, exec_type, file_type;
+
+# Start rss_hwm_reset from init.
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init rss_hwm_reset_exec:file { getattr open read execute map };
+#line 4
+allow init rss_hwm_reset:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow rss_hwm_reset rss_hwm_reset_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init rss_hwm_reset:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init rss_hwm_reset:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init rss_hwm_reset_exec:process rss_hwm_reset;
+#line 4
+
+#line 4
+
+
+# Search /proc/pid directories.
+allow rss_hwm_reset domain:dir search;
+
+# Write to /proc/pid/clear_refs of other processes.
+# /proc/pid/clear_refs is S_IWUSER, see: fs/proc/base.c
+allow rss_hwm_reset self:{ capability cap_userns } { dac_override };
+
+# Write to /prc/pid/clear_refs.
+allow rss_hwm_reset domain:file { open append write lock map };
+#line 1 "system/sepolicy/private/runas.te"
+typeattribute runas coredomain;
+
+# ndk-gdb invokes adb shell run-as.
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow shell runas_exec:file { getattr open read execute map };
+#line 4
+allow shell runas:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow runas runas_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+allow runas shell:process sigchld;
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit shell runas:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow shell runas:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition shell runas_exec:process runas;
+#line 4
+
+
+allow runas adbd:fd use;
+allow runas adbd:process sigchld;
+allow runas adbd:unix_stream_socket { read write };
+allow runas shell:fd use;
+allow runas shell:fifo_file { read write };
+allow runas shell:unix_stream_socket { read write };
+allow runas devpts:chr_file { read write ioctl };
+allow runas shell_data_file:file { read write };
+
+# run-as reads package information.
+allow runas system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow runas system_data_file:lnk_file getattr;
+allow runas packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# The app's data dir may be accessed through a symlink.
+allow runas system_data_file:lnk_file read;
+
+# run-as checks and changes to the app data dir.
+dontaudit runas self:{ capability cap_userns } { dac_override dac_read_search };
+allow runas app_data_file:dir { getattr search };
+
+# run-as switches to the app UID/GID.
+allow runas self:{ capability cap_userns } { setuid setgid };
+
+# run-as switches to the app security context.
+
+#line 31
+
+#line 31
+allow runas selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 31
+allow runas selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 31
+
+#line 31
+allow runas selinuxfs:file { open append write lock map };
+#line 31
+allow runas kernel:security check_context;
+#line 31
+ # validate context
+allow runas self:process setcurrent;
+allow runas { appdomain -system_app }:process dyntransition; # setcon
+
+# runas/libselinux needs access to seapp_contexts_file to
+# determine which domain to transition to.
+allow runas seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### neverallow rules
+###
+
+# run-as cannot have capabilities other than CAP_SETUID and CAP_SETGID
+neverallow runas self:{ capability cap_userns } ~{ setuid setgid };
+neverallow runas self:{ capability2 cap2_userns } *;
+#line 1 "system/sepolicy/private/runas_app.te"
+typeattribute runas_app coredomain;
+
+
+#line 3
+typeattribute runas_app appdomain;
+#line 3
+# Label tmpfs objects for all apps.
+#line 3
+type_transition runas_app tmpfs:file appdomain_tmpfs;
+#line 3
+
+#line 3
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 3
+type runas_app_userfaultfd;
+#line 3
+type_transition runas_app runas_app:anon_inode runas_app_userfaultfd "[userfaultfd]";
+#line 3
+# Allow domain to create/use userfaultfd anon_inode.
+#line 3
+allow runas_app runas_app_userfaultfd:anon_inode { create ioctl read };
+#line 3
+# Suppress errors generate during bugreport
+#line 3
+dontaudit su runas_app_userfaultfd:anon_inode *;
+#line 3
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 3
+neverallow { domain -runas_app } runas_app_userfaultfd:anon_inode *;
+#line 3
+
+#line 3
+allow runas_app appdomain_tmpfs:file { execute getattr map read write };
+#line 3
+neverallow { runas_app -runas_app -shell -simpleperf } { domain -runas_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+neverallow { appdomain -runas_app -shell -simpleperf -runas_app } runas_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+# The Android security model guarantees the confidentiality and integrity
+#line 3
+# of application data and execution state. Ptrace bypasses those
+#line 3
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 3
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 3
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 3
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 3
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 3
+# live lock conditions.
+#line 3
+neverallow { domain -runas_app -crash_dump -runas_app -simpleperf } runas_app:process ptrace;
+#line 3
+
+
+#line 4
+typeattribute runas_app untrusted_app_all;
+#line 4
+
+
+#line 5
+typeattribute runas_app netdomain;
+#line 5
+
+
+#line 6
+typeattribute runas_app bluetoothdomain;
+#line 6
+
+
+# The ability to call exec() on files in the apps home directories
+# when using run-as on a debuggable app. Used to run lldb/ndk-gdb/simpleperf,
+# which are copied to the apps home directories.
+allow runas_app app_data_file:file execute_no_trans;
+
+# Allow lldb/ndk-gdb/simpleperf to read maps of debuggable app processes.
+
+#line 14
+allow runas_app untrusted_app_all:dir { open getattr read search ioctl lock watch watch_reads };
+#line 14
+allow runas_app untrusted_app_all:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 14
+
+
+# Allow lldb/ndk-gdb/simpleperf to ptrace attach to debuggable app processes.
+allow runas_app untrusted_app_all:process { ptrace sigkill signal sigstop };
+allow runas_app untrusted_app_all:unix_stream_socket connectto;
+
+# Allow executing system image simpleperf without a domain transition.
+allow runas_app simpleperf_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective process, most of which this domain is not
+# allowed to see.
+dontaudit runas_app domain:dir search;
+
+# Allow runas_app to call perf_event_open for profiling debuggable app
+# processes, but not the whole system.
+allow runas_app self:perf_event { open read write kernel };
+neverallow runas_app self:perf_event ~{ open read write kernel };
+
+# Suppress bionic loader denial /data/local/tests directories.
+dontaudit runas_app shell_test_data_file:dir search;
+#line 1 "system/sepolicy/private/scheduler_service_server.te"
+
+#line 1
+ allow scheduler_service_server fwk_scheduler_hwservice:hwservice_manager { add find };
+#line 1
+ allow scheduler_service_server hidl_base_hwservice:hwservice_manager add;
+#line 1
+ neverallow { domain -scheduler_service_server } fwk_scheduler_hwservice:hwservice_manager add;
+#line 1
+
+#line 1 "system/sepolicy/private/sdcardd.te"
+typeattribute sdcardd coredomain;
+
+type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
+
+allow sdcardd cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow sdcardd cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow sdcardd fuse_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow sdcardd rootfs:dir mounton; # TODO: deprecated in M
+allow sdcardd sdcardfs:filesystem remount;
+allow sdcardd tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow sdcardd mnt_media_rw_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow sdcardd storage_file:dir search;
+allow sdcardd storage_stub_file:dir { search mounton };
+allow sdcardd { sdcard_type fuse }:filesystem { mount unmount };
+allow sdcardd self:{ capability cap_userns } { setuid setgid dac_override dac_read_search sys_admin sys_resource };
+
+allow sdcardd { sdcard_type fuse }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow sdcardd { sdcard_type fuse }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow sdcardd media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow sdcardd media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read /data/system/packages.list.
+allow sdcardd system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow sdcardd packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /data/misc/installd/layout_version
+allow sdcardd install_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow sdcardd install_data_file:dir search;
+
+# Allow stdin/out back to vold
+allow sdcardd vold:fd use;
+allow sdcardd vold:fifo_file { read write getattr };
+
+# Allow running on top of expanded storage
+allow sdcardd mnt_expand_file:dir search;
+
+# access /proc/filesystems
+allow sdcardd proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### neverallow rules
+###
+
+# The sdcard daemon should no longer be started from init
+neverallow init sdcardd_exec:file execute;
+neverallow init sdcardd:process { transition dyntransition };
+#line 1 "system/sepolicy/private/sdk_sandbox_34.te"
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for targetSdkVersion=34.
+type sdk_sandbox_34, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
+
+
+#line 8
+typeattribute sdk_sandbox_34 netdomain;
+#line 8
+
+
+#line 9
+typeattribute sdk_sandbox_34 appdomain;
+#line 9
+# Label tmpfs objects for all apps.
+#line 9
+type_transition sdk_sandbox_34 tmpfs:file appdomain_tmpfs;
+#line 9
+
+#line 9
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 9
+type sdk_sandbox_34_userfaultfd;
+#line 9
+type_transition sdk_sandbox_34 sdk_sandbox_34:anon_inode sdk_sandbox_34_userfaultfd "[userfaultfd]";
+#line 9
+# Allow domain to create/use userfaultfd anon_inode.
+#line 9
+allow sdk_sandbox_34 sdk_sandbox_34_userfaultfd:anon_inode { create ioctl read };
+#line 9
+# Suppress errors generate during bugreport
+#line 9
+dontaudit su sdk_sandbox_34_userfaultfd:anon_inode *;
+#line 9
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 9
+neverallow { domain -sdk_sandbox_34 } sdk_sandbox_34_userfaultfd:anon_inode *;
+#line 9
+
+#line 9
+allow sdk_sandbox_34 appdomain_tmpfs:file { execute getattr map read write };
+#line 9
+neverallow { sdk_sandbox_34 -runas_app -shell -simpleperf } { domain -sdk_sandbox_34 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+neverallow { appdomain -runas_app -shell -simpleperf -sdk_sandbox_34 } sdk_sandbox_34:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+# The Android security model guarantees the confidentiality and integrity
+#line 9
+# of application data and execution state. Ptrace bypasses those
+#line 9
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 9
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 9
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 9
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 9
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 9
+# live lock conditions.
+#line 9
+neverallow { domain -sdk_sandbox_34 -crash_dump -runas_app -simpleperf } sdk_sandbox_34:process ptrace;
+#line 9
+
+#line 1 "system/sepolicy/private/sdk_sandbox_all.te"
+###
+### sdk_sandbox_all
+###
+### This file defines the rules shared by all sdk_sandbox_all domains.
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The sdk_sandbox_all_all attribute is assigned to all default
+### seapp_contexts for any app with UID between FIRST_SDK_SANDBOX_UID (20000)
+### and LAST_SDK_SANDBOX_UID (29999) if the app has no specific seinfo
+### value as determined from mac_permissions.xml.
+
+allow sdk_sandbox_all system_linker_exec:file execute_no_trans;
+
+# Required to read CTS tests data from the shell_data_file location.
+allow sdk_sandbox_all shell_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow sdk_sandbox_all shell_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# allow sdk sandbox to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow sdk_sandbox_all system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow sandbox to search in sdk system server directory
+# additionally, for webview to work, getattr has been permitted
+allow sdk_sandbox_all sdk_sandbox_system_data_file:dir { getattr search };
+# allow sandbox to create files and dirs in sdk data directory
+allow sdk_sandbox_all sdk_sandbox_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow sdk_sandbox_all sdk_sandbox_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow apps to pass open fds to the sdk sandbox
+allow sdk_sandbox_all { app_data_file privapp_data_file }:file { getattr read };
+
+###
+### neverallow rules
+###
+
+neverallow sdk_sandbox_all app_data_file_type:file { execute execute_no_trans };
+
+# Receive or send uevent messages.
+neverallow sdk_sandbox_all domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow sdk_sandbox_all domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow sdk_sandbox_all debugfs_type:file read;
+
+# execute gpu_device
+neverallow sdk_sandbox_all gpu_device:chr_file execute;
+
+# access files in /sys with the default sysfs label
+neverallow sdk_sandbox_all sysfs:file *;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow sdk_sandbox_all proc:file { { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads } { execute execute_no_trans } };
+
+# Directly access external storage
+neverallow sdk_sandbox_all { sdcard_type media_rw_data_file }:file {open create};
+neverallow sdk_sandbox_all { sdcard_type media_rw_data_file }:dir search;
+
+# Avoid reads to proc_net, it contains too much device wide information about
+# ongoing connections.
+neverallow sdk_sandbox_all proc_net:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file
+# TODO(b/280514080): shell_data_file shouldn't be allowed here
+neverallow sdk_sandbox_all { app_data_file_type -sdk_sandbox_data_file -shell_data_file -radio_data_file }:dir { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow sdk_sandbox_all { app_data_file_type -sdk_sandbox_data_file -shell_data_file -radio_data_file }:file ~{ getattr read };
+
+# SDK sandbox processes don't have any access to external storage
+neverallow sdk_sandbox_all { media_rw_data_file }:dir { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+neverallow sdk_sandbox_all { media_rw_data_file }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow { sdk_sandbox_all } tmpfs:dir { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow sdk_sandbox_all hal_drm_service:service_manager find;
+
+# Only certain system components should have access to sdk_sandbox_system_data_file
+# sdk_sandbox only needs search. Restricted in follow up neverallow rule.
+neverallow {
+ domain
+ -init
+ -installd
+ -system_server
+ -vold_prepare_subdirs
+} sdk_sandbox_system_data_file:dir { relabelfrom };
+
+neverallow {
+ domain
+ -init
+ -installd
+ -sdk_sandbox_all
+ -system_server
+ -vold_prepare_subdirs
+ -zygote
+} sdk_sandbox_system_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+
+# Only certain system components should have access to sdk_sandbox_all_system_data_file
+# sdk_sandbox_all only needs search. Restricted in follow up neverallow rule.
+neverallow {
+ domain
+ -init
+ -installd
+ -system_server
+ -vold_prepare_subdirs
+} sdk_sandbox_system_data_file:dir { relabelfrom };
+
+neverallow {
+ domain
+ -init
+ -installd
+ -sdk_sandbox_all
+ -system_server
+ -vold_prepare_subdirs
+ -zygote
+} sdk_sandbox_system_data_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+
+# sdk_sandbox_all only needs to traverse through the sdk_sandbox_all_system_data_file
+neverallow sdk_sandbox_all sdk_sandbox_system_data_file:dir ~{ getattr search };
+
+# Only dirs should be created at sdk_sandbox_all_system_data_file level
+neverallow { domain -init } sdk_sandbox_system_data_file:file *;
+
+# Restrict unix stream sockets for IPC.
+neverallow sdk_sandbox_all {
+ domain
+ -sdk_sandbox_all
+ -netd
+ -logd
+ -adbd
+
+ # needed for profiling
+ -traced
+ -traced_perf
+ -heapprofd
+ # fallback crash handling for processes that can't exec crash_dump.
+ -tombstoned
+ # needed to connect to PRNG seeder daemon.
+ -prng_seeder
+}:unix_stream_socket connectto;
+neverallow {
+ domain
+ -adbd
+ -sdk_sandbox_all
+} sdk_sandbox_all:unix_stream_socket connectto;
+#line 1 "system/sepolicy/private/sdk_sandbox_audit.te"
+###
+### SDK Sandbox process.
+###
+### This file defines the audit sdk sandbox security policy for
+### the set of restrictions proposed for the next SDK level.
+###
+### The sdk_sandbox_audit domain has the same rules as the
+### sdk_sandbox_current domain and additional auditing rules
+### for the accesses we are considering forbidding in the upcoming
+### sdk_sandbox_next domain.
+type sdk_sandbox_audit, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
+
+
+#line 13
+typeattribute sdk_sandbox_audit netdomain;
+#line 13
+
+
+#line 14
+typeattribute sdk_sandbox_audit appdomain;
+#line 14
+# Label tmpfs objects for all apps.
+#line 14
+type_transition sdk_sandbox_audit tmpfs:file appdomain_tmpfs;
+#line 14
+
+#line 14
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 14
+type sdk_sandbox_audit_userfaultfd;
+#line 14
+type_transition sdk_sandbox_audit sdk_sandbox_audit:anon_inode sdk_sandbox_audit_userfaultfd "[userfaultfd]";
+#line 14
+# Allow domain to create/use userfaultfd anon_inode.
+#line 14
+allow sdk_sandbox_audit sdk_sandbox_audit_userfaultfd:anon_inode { create ioctl read };
+#line 14
+# Suppress errors generate during bugreport
+#line 14
+dontaudit su sdk_sandbox_audit_userfaultfd:anon_inode *;
+#line 14
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 14
+neverallow { domain -sdk_sandbox_audit } sdk_sandbox_audit_userfaultfd:anon_inode *;
+#line 14
+
+#line 14
+allow sdk_sandbox_audit appdomain_tmpfs:file { execute getattr map read write };
+#line 14
+neverallow { sdk_sandbox_audit -runas_app -shell -simpleperf } { domain -sdk_sandbox_audit }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 14
+neverallow { appdomain -runas_app -shell -simpleperf -sdk_sandbox_audit } sdk_sandbox_audit:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 14
+# The Android security model guarantees the confidentiality and integrity
+#line 14
+# of application data and execution state. Ptrace bypasses those
+#line 14
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 14
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 14
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 14
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 14
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 14
+# live lock conditions.
+#line 14
+neverallow { domain -sdk_sandbox_audit -crash_dump -runas_app -simpleperf } sdk_sandbox_audit:process ptrace;
+#line 14
+
+
+# Auditallow rules for accesses that are currently allowed but we
+# might remove in the future.
+
+auditallow sdk_sandbox_audit {
+ cameraserver_service
+ ephemeral_app_api_service
+ mediadrmserver_service
+ radio_service
+}:service_manager find;
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+#line 1 "system/sepolicy/private/sdk_sandbox_current.te"
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for the current SDK level.
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow sdk_sandbox_current {
+ activity_service
+ activity_task_service
+ appops_service
+ audio_service
+ audioserver_service
+ batteryproperties_service
+ batterystats_service
+ cameraserver_service
+ connectivity_service
+ connmetrics_service
+ deviceidle_service
+ display_service
+ dropbox_service
+ ephemeral_app_api_service
+ font_service
+ game_service
+ gpu_service
+ graphicsstats_service
+ hardware_properties_service
+ hint_service
+ imms_service
+ input_method_service
+ input_service
+ IProxyService_service
+ ipsec_service
+ launcherapps_service
+ legacy_permission_service
+ light_service
+ locale_service
+ media_communication_service
+ mediadrmserver_service
+ mediaextractor_service
+ mediametrics_service
+ media_projection_service
+ media_router_service
+ mediaserver_service
+ media_session_service
+ memtrackproxy_service
+ midi_service
+ netpolicy_service
+ netstats_service
+ network_management_service
+ notification_service
+ package_service
+ permission_checker_service
+ permission_service
+ permissionmgr_service
+ platform_compat_service
+ power_service
+ procstats_service
+ radio_service
+ registry_service
+ restrictions_service
+ rttmanager_service
+ search_service
+ selection_toolbar_service
+ sensor_privacy_service
+ sensorservice_service
+ servicediscovery_service
+ settings_service
+ speech_recognition_service
+ statusbar_service
+ storagestats_service
+ surfaceflinger_service
+ telecom_service
+ tethering_service
+ textclassification_service
+ textservices_service
+ texttospeech_service
+ thermal_service
+ translation_service
+ tv_iapp_service
+ tv_input_service
+ uimode_service
+ vcn_management_service
+ webviewupdate_service
+}:service_manager find;
+
+#line 1 "system/sepolicy/private/sdk_sandbox_next.te"
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for a test set of restrictions. These restrictions will be adapted
+### with modifications, into the set of restrictions for the next SDK
+### level.
+type sdk_sandbox_next, domain, coredomain, sdk_sandbox_all;
+
+
+#line 10
+typeattribute sdk_sandbox_next netdomain;
+#line 10
+
+
+#line 11
+typeattribute sdk_sandbox_next appdomain;
+#line 11
+# Label tmpfs objects for all apps.
+#line 11
+type_transition sdk_sandbox_next tmpfs:file appdomain_tmpfs;
+#line 11
+
+#line 11
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 11
+type sdk_sandbox_next_userfaultfd;
+#line 11
+type_transition sdk_sandbox_next sdk_sandbox_next:anon_inode sdk_sandbox_next_userfaultfd "[userfaultfd]";
+#line 11
+# Allow domain to create/use userfaultfd anon_inode.
+#line 11
+allow sdk_sandbox_next sdk_sandbox_next_userfaultfd:anon_inode { create ioctl read };
+#line 11
+# Suppress errors generate during bugreport
+#line 11
+dontaudit su sdk_sandbox_next_userfaultfd:anon_inode *;
+#line 11
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 11
+neverallow { domain -sdk_sandbox_next } sdk_sandbox_next_userfaultfd:anon_inode *;
+#line 11
+
+#line 11
+allow sdk_sandbox_next appdomain_tmpfs:file { execute getattr map read write };
+#line 11
+neverallow { sdk_sandbox_next -runas_app -shell -simpleperf } { domain -sdk_sandbox_next }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 11
+neverallow { appdomain -runas_app -shell -simpleperf -sdk_sandbox_next } sdk_sandbox_next:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 11
+# The Android security model guarantees the confidentiality and integrity
+#line 11
+# of application data and execution state. Ptrace bypasses those
+#line 11
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 11
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 11
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 11
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 11
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 11
+# live lock conditions.
+#line 11
+neverallow { domain -sdk_sandbox_next -crash_dump -runas_app -simpleperf } sdk_sandbox_next:process ptrace;
+#line 11
+
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow sdk_sandbox_next {
+ activity_service
+ activity_task_service
+ appops_service
+ audio_service
+ audioserver_service
+ batteryproperties_service
+ batterystats_service
+ connectivity_service
+ connmetrics_service
+ deviceidle_service
+ display_service
+ dropbox_service
+ font_service
+ game_service
+ gpu_service
+ graphicsstats_service
+ hardware_properties_service
+ hint_service
+ imms_service
+ input_method_service
+ input_service
+ IProxyService_service
+ ipsec_service
+ launcherapps_service
+ legacy_permission_service
+ light_service
+ locale_service
+ media_communication_service
+ mediaextractor_service
+ mediametrics_service
+ media_projection_service
+ media_router_service
+ mediaserver_service
+ media_session_service
+ memtrackproxy_service
+ midi_service
+ netpolicy_service
+ netstats_service
+ network_management_service
+ notification_service
+ package_service
+ permission_checker_service
+ permission_service
+ permissionmgr_service
+ platform_compat_service
+ power_service
+ procstats_service
+ registry_service
+ restrictions_service
+ rttmanager_service
+ search_service
+ selection_toolbar_service
+ sensor_privacy_service
+ sensorservice_service
+ servicediscovery_service
+ settings_service
+ speech_recognition_service
+ statusbar_service
+ storagestats_service
+ surfaceflinger_service
+ telecom_service
+ tethering_service
+ textclassification_service
+ textservices_service
+ texttospeech_service
+ thermal_service
+ translation_service
+ tv_iapp_service
+ tv_input_service
+ uimode_service
+ vcn_management_service
+ webviewupdate_service
+}:service_manager find;
+
+#line 1 "system/sepolicy/private/secure_element.te"
+# secure element subsystem
+typeattribute secure_element coredomain;
+
+#line 3
+typeattribute secure_element appdomain;
+#line 3
+# Label tmpfs objects for all apps.
+#line 3
+type_transition secure_element tmpfs:file appdomain_tmpfs;
+#line 3
+
+#line 3
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 3
+type secure_element_userfaultfd;
+#line 3
+type_transition secure_element secure_element:anon_inode secure_element_userfaultfd "[userfaultfd]";
+#line 3
+# Allow domain to create/use userfaultfd anon_inode.
+#line 3
+allow secure_element secure_element_userfaultfd:anon_inode { create ioctl read };
+#line 3
+# Suppress errors generate during bugreport
+#line 3
+dontaudit su secure_element_userfaultfd:anon_inode *;
+#line 3
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 3
+neverallow { domain -secure_element } secure_element_userfaultfd:anon_inode *;
+#line 3
+
+#line 3
+allow secure_element appdomain_tmpfs:file { execute getattr map read write };
+#line 3
+neverallow { secure_element -runas_app -shell -simpleperf } { domain -secure_element }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+neverallow { appdomain -runas_app -shell -simpleperf -secure_element } secure_element:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+# The Android security model guarantees the confidentiality and integrity
+#line 3
+# of application data and execution state. Ptrace bypasses those
+#line 3
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 3
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 3
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 3
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 3
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 3
+# live lock conditions.
+#line 3
+neverallow { domain -secure_element -crash_dump -runas_app -simpleperf } secure_element:process ptrace;
+#line 3
+
+
+
+#line 5
+typeattribute secure_element binderservicedomain;
+#line 5
+
+
+#line 6
+ allow secure_element secure_element_service:service_manager { add find };
+#line 6
+ neverallow { domain -secure_element } secure_element_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+
+allow secure_element app_api_service:service_manager find;
+
+#line 9
+typeattribute secure_element halclientdomain;
+#line 9
+typeattribute secure_element hal_secure_element_client;
+#line 9
+
+#line 9
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 9
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 9
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 9
+
+#line 9
+typeattribute secure_element hal_secure_element;
+#line 9
+# Find passthrough HAL implementations
+#line 9
+allow hal_secure_element system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_secure_element vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 9
+allow hal_secure_element vendor_file:file { read open getattr execute map };
+#line 9
+
+#line 9
+
+
+# already open bugreport file descriptors may be shared with
+# the secure element process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow secure_element shell_data_file:file read;
+
+allow secure_element vendor_uuid_mapping_config_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/sensor_service_server.te"
+
+#line 1
+ allow sensor_service_server fwk_sensor_hwservice:hwservice_manager { add find };
+#line 1
+ allow sensor_service_server hidl_base_hwservice:hwservice_manager add;
+#line 1
+ neverallow { domain -sensor_service_server } fwk_sensor_hwservice:hwservice_manager add;
+#line 1
+
+#line 1 "system/sepolicy/private/service.te"
+type ambient_context_service, app_api_service, system_server_service, service_manager_type;
+type authentication_policy_service, system_api_service, system_server_service, service_manager_type;
+
+# These types will be public starting at board api 202504
+#line 7
+
+type attention_service, system_server_service, service_manager_type;
+type bg_install_control_service, system_api_service, system_server_service, service_manager_type;
+type compos_service, service_manager_type;
+type communal_service, app_api_service, system_server_service, service_manager_type;
+type dynamic_system_service, system_api_service, system_server_service, service_manager_type;
+type feature_flags_service, app_api_service, system_server_service, service_manager_type;
+type fwk_devicestate_service, system_server_service, service_manager_type;
+type gsi_service, service_manager_type;
+type incidentcompanion_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type logcat_service, system_server_service, service_manager_type;
+type logd_service, service_manager_type;
+type mediatuner_service, app_api_service, service_manager_type;
+type mmd_service, service_manager_type;
+type on_device_intelligence_service, app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type profcollectd_service, service_manager_type;
+type protolog_configuration_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type resolver_service, system_server_service, service_manager_type;
+type rkpd_registrar_service, service_manager_type;
+type rkpd_refresh_service, service_manager_type;
+type rkp_cert_processor_service, service_manager_type;
+type safety_center_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type stats_service, service_manager_type;
+type statsbootstrap_service, system_server_service, service_manager_type;
+type statscompanion_service, system_server_service, service_manager_type;
+type statsmanager_service, system_api_service, system_server_service, service_manager_type;
+#line 35
+
+
+#line 39
+
+
+#line 43
+
+type tracingproxy_service, system_server_service, service_manager_type;
+type tradeinmode_service, system_server_service, service_manager_type;
+type transparency_service, system_server_service, service_manager_type;
+
+
+#line 48
+ type vfio_handler_service, service_manager_type;
+#line 50
+
+
+#line 51
+ type virtualization_maintenance_service, service_manager_type;
+#line 53
+
+
+#line 54
+ type vm_tethering_service, system_server_service, service_manager_type;
+#line 54
+ type vmnic_service, service_manager_type;
+#line 57
+
+
+#line 58
+ type microfuchsia_service, service_manager_type;
+#line 60
+
+
+type uce_service, service_manager_type;
+type fwk_vold_service, service_manager_type;
+type wearable_sensing_service, app_api_service, system_server_service, service_manager_type;
+type wifi_mainline_supplicant_service, service_manager_type;
+type dynamic_instrumentation_service, app_api_service, system_server_service, service_manager_type;
+type advanced_protection_service, app_api_service, system_server_service, service_manager_type;
+
+
+#line 69
+ type ranging_service, app_api_service, system_server_service, service_manager_type;
+#line 71
+
+
+#line 75
+
+
+###
+### Neverallow rules
+###
+
+# servicemanager handles registering or looking up named services.
+# It does not make sense to register or lookup something which is not a service.
+# Trigger a compile error if this occurs.
+neverallow domain ~{ service_manager_type vndservice_manager_type }:service_manager { add find };
+#line 1 "system/sepolicy/private/servicemanager.te"
+typeattribute servicemanager coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init servicemanager_exec:file { getattr open read execute map };
+#line 3
+allow init servicemanager:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow servicemanager servicemanager_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init servicemanager:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init servicemanager:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init servicemanager_exec:process servicemanager;
+#line 3
+
+#line 3
+
+
+
+#line 5
+allow servicemanager runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 5
+
+
+
+#line 7
+
+#line 7
+allow servicemanager property_socket:sock_file write;
+#line 7
+allow servicemanager init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow servicemanager ctl_interface_start_prop:property_service set;
+#line 7
+
+#line 7
+allow servicemanager ctl_interface_start_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+
+#line 8
+
+#line 8
+allow servicemanager property_socket:sock_file write;
+#line 8
+allow servicemanager init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow servicemanager servicemanager_prop:property_service set;
+#line 8
+
+#line 8
+allow servicemanager servicemanager_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+# servicemanager is using bootstrap bionic
+
+#line 11
+ allow servicemanager system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 11
+ allow servicemanager system_bootstrap_lib_file:file { execute read open getattr map };
+#line 11
+
+
+# servicemanager is using apex_info via libvintf
+
+#line 14
+ allow servicemanager apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+#line 14
+ allow servicemanager apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 14
+
+#line 14
+allow servicemanager vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 14
+allow servicemanager vendor_apex_metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 14
+
+#line 14
+
+
+# Note that we do not use the binder_* macros here.
+# servicemanager is unique in that it only provides
+# name service (aka context manager) for Binder.
+# As such, it only ever receives and transfers other references
+# created by other domains. It never passes its own references
+# or initiates a Binder IPC.
+allow servicemanager self:binder set_context_mgr;
+allow servicemanager {
+ domain
+ -init
+ -vendor_init
+ -hwservicemanager
+ -vndservicemanager
+}:binder transfer;
+
+allow servicemanager service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow servicemanager vendor_service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# nonplat_service_contexts only accessible on non full-treble devices
+allow servicemanager vendor_service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 38
+ allow servicemanager service_manager_service:service_manager { add find };
+#line 38
+ neverallow { domain -servicemanager } service_manager_service:service_manager add;
+#line 38
+
+#line 38
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 38
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 38
+
+#line 38
+
+allow servicemanager dumpstate:fd use;
+allow servicemanager dumpstate:fifo_file write;
+
+# Check SELinux permissions.
+
+#line 43
+
+#line 43
+allow servicemanager selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 43
+allow servicemanager selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 43
+
+#line 43
+allow servicemanager selinuxfs:file { open append write lock map };
+#line 43
+allow servicemanager kernel:security compute_av;
+#line 43
+allow servicemanager self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 43
+
+
+allow servicemanager kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 47
+ allow servicemanager traced:fd use;
+#line 47
+ allow servicemanager traced_tmpfs:file { read write getattr map };
+#line 47
+
+#line 47
+allow servicemanager traced_producer_socket:sock_file write;
+#line 47
+allow servicemanager traced:unix_stream_socket connectto;
+#line 47
+
+#line 47
+
+#line 47
+ # Also allow the service to use the producer file descriptors. This is
+#line 47
+ # necessary when the producer is creating the shared memory, as it will be
+#line 47
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 47
+ allow traced servicemanager:fd use;
+#line 47
+
+
+#line 52
+
+#line 1 "system/sepolicy/private/sgdisk.te"
+typeattribute sgdisk coredomain;
+
+# Allowed to read/write low-level partition tables
+allow sgdisk block_device:dir search;
+allow sgdisk vold_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# HDIO_GETGEO needed to get the number of disk heads
+# on vold_device. How quaint.
+allowxperm sgdisk vold_device:blk_file ioctl { 0x00000301 };
+# sgdisk also uses BLKGETSIZE and BLKGETSIZE64. BLKGETSIZE64
+# is granted to all block device users in domain.te, so
+# no need to mention it here. sgdisk should not be
+# using the BLKGETSIZE ioctl as it is useless for devices over
+# 2T in size, but we allow it for now and hope that sgdisk
+# will fix their bug.
+allowxperm sgdisk vold_device:blk_file ioctl { 0x00001260 };
+# Force a re-read of the partition table.
+allowxperm sgdisk vold_device:blk_file ioctl { 0x0000125f };
+# Allow reading of the physical block size.
+allowxperm sgdisk vold_device:blk_file ioctl { 0x0000127b };
+
+# Inherit and use pty created by android_fork_execvp()
+allow sgdisk devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow sgdisk vold:fd use;
+allow sgdisk vold:fifo_file { read write getattr };
+
+# Used to probe kernel to reload partition tables
+allow sgdisk self:{ capability cap_userns } sys_admin;
+
+###
+### Neverallow rules
+###
+
+# Only allow entry from vold
+neverallow { domain -vold } sgdisk:process transition;
+neverallow * sgdisk:process dyntransition;
+neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
+#line 1 "system/sepolicy/private/shared_relro.te"
+typeattribute shared_relro coredomain;
+
+# The shared relro process is a Java program forked from the zygote, so it
+# inherits from app to get basic permissions it needs to run.
+
+#line 5
+typeattribute shared_relro appdomain;
+#line 5
+# Label tmpfs objects for all apps.
+#line 5
+type_transition shared_relro tmpfs:file appdomain_tmpfs;
+#line 5
+
+#line 5
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 5
+type shared_relro_userfaultfd;
+#line 5
+type_transition shared_relro shared_relro:anon_inode shared_relro_userfaultfd "[userfaultfd]";
+#line 5
+# Allow domain to create/use userfaultfd anon_inode.
+#line 5
+allow shared_relro shared_relro_userfaultfd:anon_inode { create ioctl read };
+#line 5
+# Suppress errors generate during bugreport
+#line 5
+dontaudit su shared_relro_userfaultfd:anon_inode *;
+#line 5
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 5
+neverallow { domain -shared_relro } shared_relro_userfaultfd:anon_inode *;
+#line 5
+
+#line 5
+allow shared_relro appdomain_tmpfs:file { execute getattr map read write };
+#line 5
+neverallow { shared_relro -runas_app -shell -simpleperf } { domain -shared_relro }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 5
+neverallow { appdomain -runas_app -shell -simpleperf -shared_relro } shared_relro:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 5
+# The Android security model guarantees the confidentiality and integrity
+#line 5
+# of application data and execution state. Ptrace bypasses those
+#line 5
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 5
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 5
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 5
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 5
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 5
+# live lock conditions.
+#line 5
+neverallow { domain -shared_relro -crash_dump -runas_app -simpleperf } shared_relro:process ptrace;
+#line 5
+
+
+allow shared_relro shared_relro_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow shared_relro shared_relro_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow shared_relro activity_service:service_manager find;
+allow shared_relro webviewupdate_service:service_manager find;
+allow shared_relro package_service:service_manager find;
+
+# StrictMode may attempt to find this service, failure is harmless.
+dontaudit shared_relro network_management_service:service_manager find;
+#line 1 "system/sepolicy/private/shell.te"
+typeattribute shell coredomain, mlstrustedsubject;
+
+# allow shell input injection
+allow shell uhid_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# systrace support - allow atrace to run
+allow shell debugfs_tracing_debug:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell debugfs_tracing:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow shell debugfs_trace_marker:file getattr;
+allow shell atrace_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 15
+
+
+# read config.gz for CTS purposes
+allow shell config_gz:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow reading tombstones. users can already use bugreports to get those.
+allow shell tombstone_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell tombstone_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Run app_process.
+# XXX Transition into its own domain?
+
+#line 26
+typeattribute shell appdomain;
+#line 26
+# Label tmpfs objects for all apps.
+#line 26
+type_transition shell tmpfs:file appdomain_tmpfs;
+#line 26
+
+#line 26
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 26
+type shell_userfaultfd;
+#line 26
+type_transition shell shell:anon_inode shell_userfaultfd "[userfaultfd]";
+#line 26
+# Allow domain to create/use userfaultfd anon_inode.
+#line 26
+allow shell shell_userfaultfd:anon_inode { create ioctl read };
+#line 26
+# Suppress errors generate during bugreport
+#line 26
+dontaudit su shell_userfaultfd:anon_inode *;
+#line 26
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 26
+neverallow { domain -shell } shell_userfaultfd:anon_inode *;
+#line 26
+
+#line 26
+allow shell appdomain_tmpfs:file { execute getattr map read write };
+#line 26
+neverallow { shell -runas_app -shell -simpleperf } { domain -shell }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 26
+neverallow { appdomain -runas_app -shell -simpleperf -shell } shell:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 26
+# The Android security model guarantees the confidentiality and integrity
+#line 26
+# of application data and execution state. Ptrace bypasses those
+#line 26
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 26
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 26
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 26
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 26
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 26
+# live lock conditions.
+#line 26
+neverallow { domain -shell -crash_dump -runas_app -simpleperf } shell:process ptrace;
+#line 26
+
+
+# allow shell to call dumpsys storaged
+
+#line 29
+# Call the server domain and optionally transfer references to it.
+#line 29
+allow shell storaged:binder { call transfer };
+#line 29
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 29
+allow storaged shell:binder transfer;
+#line 29
+# Receive and use open files from the server.
+#line 29
+allow shell storaged:fd use;
+#line 29
+
+
+# Perform SELinux access checks, needed for CTS
+
+#line 32
+
+#line 32
+allow shell selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow shell selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+#line 32
+allow shell selinuxfs:file { open append write lock map };
+#line 32
+allow shell kernel:security compute_av;
+#line 32
+allow shell self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 32
+
+
+#line 33
+
+#line 33
+allow shell selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 33
+allow shell selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 33
+
+#line 33
+allow shell selinuxfs:file { open append write lock map };
+#line 33
+allow shell kernel:security check_context;
+#line 33
+
+
+# Control Perfetto traced and obtain traces from it.
+# Needed for Studio and debugging.
+
+#line 37
+allow shell traced_consumer_socket:sock_file write;
+#line 37
+allow shell traced:unix_stream_socket connectto;
+#line 37
+
+
+# Allow shell binaries to write trace data to Perfetto. Used for testing and
+# cmdline utils.
+
+#line 41
+ allow shell traced:fd use;
+#line 41
+ allow shell traced_tmpfs:file { read write getattr map };
+#line 41
+
+#line 41
+allow shell traced_producer_socket:sock_file write;
+#line 41
+allow shell traced:unix_stream_socket connectto;
+#line 41
+
+#line 41
+
+#line 41
+ # Also allow the service to use the producer file descriptors. This is
+#line 41
+ # necessary when the producer is creating the shared memory, as it will be
+#line 41
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 41
+ allow traced shell:fd use;
+#line 41
+
+
+
+#line 43
+# Allow the necessary permissions.
+#line 43
+
+#line 43
+# Old domain may exec the file and transition to the new domain.
+#line 43
+allow shell vendor_shell_exec:file { getattr open read execute map };
+#line 43
+allow shell vendor_shell:process transition;
+#line 43
+# New domain is entered by executing the file.
+#line 43
+allow vendor_shell vendor_shell_exec:file { entrypoint open read execute getattr map };
+#line 43
+# New domain can send SIGCHLD to its caller.
+#line 43
+allow vendor_shell shell:process sigchld;
+#line 43
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 43
+dontaudit shell vendor_shell:process noatsecure;
+#line 43
+# XXX dontaudit candidate but requires further study.
+#line 43
+allow shell vendor_shell:process { siginh rlimitinh };
+#line 43
+
+#line 43
+# Make the transition occur by default.
+#line 43
+type_transition shell vendor_shell_exec:process vendor_shell;
+#line 43
+
+
+# Allow shell to execute tradeinmode for testing.
+
+#line 46
+# Allow the necessary permissions.
+#line 46
+
+#line 46
+# Old domain may exec the file and transition to the new domain.
+#line 46
+allow shell tradeinmode_exec:file { getattr open read execute map };
+#line 46
+allow shell tradeinmode:process transition;
+#line 46
+# New domain is entered by executing the file.
+#line 46
+allow tradeinmode tradeinmode_exec:file { entrypoint open read execute getattr map };
+#line 46
+# New domain can send SIGCHLD to its caller.
+#line 46
+allow tradeinmode shell:process sigchld;
+#line 46
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 46
+dontaudit shell tradeinmode:process noatsecure;
+#line 46
+# XXX dontaudit candidate but requires further study.
+#line 46
+allow shell tradeinmode:process { siginh rlimitinh };
+#line 46
+
+#line 46
+# Make the transition occur by default.
+#line 46
+type_transition shell tradeinmode_exec:process tradeinmode;
+#line 46
+
+
+# Allow shell binaries to exec the perfetto cmdline util and have that
+# transition into its own domain, so that it behaves consistently to
+# when exec()-d by statsd.
+
+#line 51
+# Allow the necessary permissions.
+#line 51
+
+#line 51
+# Old domain may exec the file and transition to the new domain.
+#line 51
+allow shell perfetto_exec:file { getattr open read execute map };
+#line 51
+allow shell perfetto:process transition;
+#line 51
+# New domain is entered by executing the file.
+#line 51
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 51
+# New domain can send SIGCHLD to its caller.
+#line 51
+allow perfetto shell:process sigchld;
+#line 51
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 51
+dontaudit shell perfetto:process noatsecure;
+#line 51
+# XXX dontaudit candidate but requires further study.
+#line 51
+allow shell perfetto:process { siginh rlimitinh };
+#line 51
+
+#line 51
+# Make the transition occur by default.
+#line 51
+type_transition shell perfetto_exec:process perfetto;
+#line 51
+
+# Allow to send SIGINT to perfetto when daemonized.
+allow shell perfetto:process signal;
+
+# Allow shell to run adb shell cmd stats commands. Needed for CTS.
+
+#line 56
+# Call the server domain and optionally transfer references to it.
+#line 56
+allow shell statsd:binder { call transfer };
+#line 56
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 56
+allow statsd shell:binder transfer;
+#line 56
+# Receive and use open files from the server.
+#line 56
+allow shell statsd:fd use;
+#line 56
+;
+
+# Allow shell to read and unlink traces stored in /data/misc/a11ytraces.
+#line 62
+
+
+# Allow shell to read and unlink traces stored in /data/misc/perfetto-traces.
+allow shell perfetto_traces_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow shell perfetto_traces_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+# ... and /data/misc/perfetto-traces/bugreport/ .
+allow shell perfetto_traces_bugreport_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow shell perfetto_traces_bugreport_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+
+# Allow shell to create/remove configs stored in /data/misc/perfetto-configs.
+allow shell perfetto_configs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow shell perfetto_configs_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow shell to run adb shell cmd gpu commands.
+
+#line 76
+# Call the server domain and optionally transfer references to it.
+#line 76
+allow shell gpuservice:binder { call transfer };
+#line 76
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 76
+allow gpuservice shell:binder transfer;
+#line 76
+# Receive and use open files from the server.
+#line 76
+allow shell gpuservice:fd use;
+#line 76
+;
+
+# Allow shell to use atrace HAL
+
+#line 79
+typeattribute shell halclientdomain;
+#line 79
+typeattribute shell hal_atrace_client;
+#line 79
+
+#line 79
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 79
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 79
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 79
+
+#line 79
+typeattribute shell hal_atrace;
+#line 79
+# Find passthrough HAL implementations
+#line 79
+allow hal_atrace system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 79
+allow hal_atrace vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 79
+allow hal_atrace vendor_file:file { read open getattr execute map };
+#line 79
+
+#line 79
+
+
+# For hostside tests such as CTS listening ports test.
+allow shell proc_net_tcp_udp:file { getattr open read ioctl lock map watch watch_reads };
+
+# The dl.exec_linker* tests need to execute /system/bin/linker
+# b/124789393
+allow shell system_linker_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Renderscript host side tests depend on being able to execute
+# /system/bin/bcc (b/126388046)
+allow shell rs_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow (host-driven) ART run-tests to execute dex2oat, in order to
+# check ART's compiler.
+allow shell dex2oat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow shell dex2oat_exec:lnk_file read;
+
+# Allow shell to start and comminicate with lpdumpd.
+
+#line 98
+
+#line 98
+allow shell property_socket:sock_file write;
+#line 98
+allow shell init:unix_stream_socket connectto;
+#line 98
+
+#line 98
+allow shell lpdumpd_prop:property_service set;
+#line 98
+
+#line 98
+allow shell lpdumpd_prop:file { getattr open read map };
+#line 98
+
+#line 98
+;
+
+#line 99
+# Call the server domain and optionally transfer references to it.
+#line 99
+allow shell lpdumpd:binder { call transfer };
+#line 99
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 99
+allow lpdumpd shell:binder transfer;
+#line 99
+# Receive and use open files from the server.
+#line 99
+allow shell lpdumpd:fd use;
+#line 99
+
+
+# Allow shell to set and read value of properties used for CTS tests of
+# userspace reboot
+
+#line 103
+
+#line 103
+allow shell property_socket:sock_file write;
+#line 103
+allow shell init:unix_stream_socket connectto;
+#line 103
+
+#line 103
+allow shell userspace_reboot_test_prop:property_service set;
+#line 103
+
+#line 103
+allow shell userspace_reboot_test_prop:file { getattr open read map };
+#line 103
+
+#line 103
+
+
+# Allow shell to set this property to disable charging.
+
+#line 106
+
+#line 106
+allow shell property_socket:sock_file write;
+#line 106
+allow shell init:unix_stream_socket connectto;
+#line 106
+
+#line 106
+allow shell power_debug_prop:property_service set;
+#line 106
+
+#line 106
+allow shell power_debug_prop:file { getattr open read map };
+#line 106
+
+#line 106
+
+
+# Allow shell to set this property used for rollback tests
+
+#line 109
+
+#line 109
+allow shell property_socket:sock_file write;
+#line 109
+allow shell init:unix_stream_socket connectto;
+#line 109
+
+#line 109
+allow shell rollback_test_prop:property_service set;
+#line 109
+
+#line 109
+allow shell rollback_test_prop:file { getattr open read map };
+#line 109
+
+#line 109
+
+
+# Allow shell to set RKP properties for testing purposes
+
+#line 112
+
+#line 112
+allow shell property_socket:sock_file write;
+#line 112
+allow shell init:unix_stream_socket connectto;
+#line 112
+
+#line 112
+allow shell remote_prov_prop:property_service set;
+#line 112
+
+#line 112
+allow shell remote_prov_prop:file { getattr open read map };
+#line 112
+
+#line 112
+
+
+# Allow shell to enable 16 KB backcompat globally.
+
+#line 115
+
+#line 115
+allow shell property_socket:sock_file write;
+#line 115
+allow shell init:unix_stream_socket connectto;
+#line 115
+
+#line 115
+allow shell bionic_linker_16kb_app_compat_prop:property_service set;
+#line 115
+
+#line 115
+allow shell bionic_linker_16kb_app_compat_prop:file { getattr open read map };
+#line 115
+
+#line 115
+
+
+# Allow shell to disable compat in package manager
+
+#line 118
+
+#line 118
+allow shell property_socket:sock_file write;
+#line 118
+allow shell init:unix_stream_socket connectto;
+#line 118
+
+#line 118
+allow shell pm_16kb_app_compat_prop:property_service set;
+#line 118
+
+#line 118
+allow shell pm_16kb_app_compat_prop:file { getattr open read map };
+#line 118
+
+#line 118
+
+
+# Allow shell to get encryption policy of /data/local/tmp/, for CTS
+allowxperm shell shell_data_file:dir ioctl {
+ 0x400c6615
+ 0xc0096616
+};
+
+# Allow shell to execute simpleperf without a domain transition.
+allow shell simpleperf_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 138
+
+
+# Allow shell to run remount command.
+allow shell remount_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow shell to call perf_event_open for profiling other shell processes, but
+# not the whole system.
+allow shell self:perf_event { open read write kernel };
+
+# Allow shell to read microdroid vendor image
+
+#line 148
+allow shell vendor_microdroid_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 148
+allow shell vendor_microdroid_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 148
+
+
+# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
+allow shell apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell vendor_apex_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell vendor_apex_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell vendor_apex_metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow shell to read updated APEXes under /data/apex
+allow shell apex_data_file:dir search;
+allow shell staging_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Set properties.
+
+#line 161
+
+#line 161
+allow shell property_socket:sock_file write;
+#line 161
+allow shell init:unix_stream_socket connectto;
+#line 161
+
+#line 161
+allow shell shell_prop:property_service set;
+#line 161
+
+#line 161
+allow shell shell_prop:file { getattr open read map };
+#line 161
+
+#line 161
+
+
+#line 162
+
+#line 162
+allow shell property_socket:sock_file write;
+#line 162
+allow shell init:unix_stream_socket connectto;
+#line 162
+
+#line 162
+allow shell ctl_bugreport_prop:property_service set;
+#line 162
+
+#line 162
+allow shell ctl_bugreport_prop:file { getattr open read map };
+#line 162
+
+#line 162
+
+
+#line 163
+
+#line 163
+allow shell property_socket:sock_file write;
+#line 163
+allow shell init:unix_stream_socket connectto;
+#line 163
+
+#line 163
+allow shell ctl_dumpstate_prop:property_service set;
+#line 163
+
+#line 163
+allow shell ctl_dumpstate_prop:file { getattr open read map };
+#line 163
+
+#line 163
+
+
+#line 164
+
+#line 164
+allow shell property_socket:sock_file write;
+#line 164
+allow shell init:unix_stream_socket connectto;
+#line 164
+
+#line 164
+allow shell dumpstate_prop:property_service set;
+#line 164
+
+#line 164
+allow shell dumpstate_prop:file { getattr open read map };
+#line 164
+
+#line 164
+
+
+#line 165
+
+#line 165
+allow shell property_socket:sock_file write;
+#line 165
+allow shell init:unix_stream_socket connectto;
+#line 165
+
+#line 165
+allow shell exported_dumpstate_prop:property_service set;
+#line 165
+
+#line 165
+allow shell exported_dumpstate_prop:file { getattr open read map };
+#line 165
+
+#line 165
+
+
+#line 166
+
+#line 166
+allow shell property_socket:sock_file write;
+#line 166
+allow shell init:unix_stream_socket connectto;
+#line 166
+
+#line 166
+allow shell debug_prop:property_service set;
+#line 166
+
+#line 166
+allow shell debug_prop:file { getattr open read map };
+#line 166
+
+#line 166
+
+
+#line 167
+
+#line 167
+allow shell property_socket:sock_file write;
+#line 167
+allow shell init:unix_stream_socket connectto;
+#line 167
+
+#line 167
+allow shell perf_drop_caches_prop:property_service set;
+#line 167
+
+#line 167
+allow shell perf_drop_caches_prop:file { getattr open read map };
+#line 167
+
+#line 167
+
+
+#line 168
+
+#line 168
+allow shell property_socket:sock_file write;
+#line 168
+allow shell init:unix_stream_socket connectto;
+#line 168
+
+#line 168
+allow shell powerctl_prop:property_service set;
+#line 168
+
+#line 168
+allow shell powerctl_prop:file { getattr open read map };
+#line 168
+
+#line 168
+
+
+#line 169
+
+#line 169
+allow shell property_socket:sock_file write;
+#line 169
+allow shell init:unix_stream_socket connectto;
+#line 169
+
+#line 169
+allow shell log_tag_prop:property_service set;
+#line 169
+
+#line 169
+allow shell log_tag_prop:file { getattr open read map };
+#line 169
+
+#line 169
+
+
+#line 170
+
+#line 170
+allow shell property_socket:sock_file write;
+#line 170
+allow shell init:unix_stream_socket connectto;
+#line 170
+
+#line 170
+allow shell wifi_log_prop:property_service set;
+#line 170
+
+#line 170
+allow shell wifi_log_prop:file { getattr open read map };
+#line 170
+
+#line 170
+
+# Allow shell to start/stop traced via the persist.traced.enable
+# property (which also takes care of /data/misc initialization).
+
+#line 173
+
+#line 173
+allow shell property_socket:sock_file write;
+#line 173
+allow shell init:unix_stream_socket connectto;
+#line 173
+
+#line 173
+allow shell traced_enabled_prop:property_service set;
+#line 173
+
+#line 173
+allow shell traced_enabled_prop:file { getattr open read map };
+#line 173
+
+#line 173
+
+# adjust SELinux audit rates
+
+#line 175
+
+#line 175
+allow shell property_socket:sock_file write;
+#line 175
+allow shell init:unix_stream_socket connectto;
+#line 175
+
+#line 175
+allow shell logd_auditrate_prop:property_service set;
+#line 175
+
+#line 175
+allow shell logd_auditrate_prop:file { getattr open read map };
+#line 175
+
+#line 175
+
+# adjust is_loggable properties
+
+# logpersist script
+
+# Allow shell to start/stop heapprofd via the persist.heapprofd.enable
+# property.
+
+#line 182
+
+#line 182
+allow shell property_socket:sock_file write;
+#line 182
+allow shell init:unix_stream_socket connectto;
+#line 182
+
+#line 182
+allow shell heapprofd_enabled_prop:property_service set;
+#line 182
+
+#line 182
+allow shell heapprofd_enabled_prop:file { getattr open read map };
+#line 182
+
+#line 182
+
+# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
+# property.
+
+#line 185
+
+#line 185
+allow shell property_socket:sock_file write;
+#line 185
+allow shell init:unix_stream_socket connectto;
+#line 185
+
+#line 185
+allow shell traced_perf_enabled_prop:property_service set;
+#line 185
+
+#line 185
+allow shell traced_perf_enabled_prop:file { getattr open read map };
+#line 185
+
+#line 185
+
+# Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
+
+#line 187
+
+#line 187
+allow shell property_socket:sock_file write;
+#line 187
+allow shell init:unix_stream_socket connectto;
+#line 187
+
+#line 187
+allow shell ctl_gsid_prop:property_service set;
+#line 187
+
+#line 187
+allow shell ctl_gsid_prop:file { getattr open read map };
+#line 187
+
+#line 187
+
+
+#line 188
+
+#line 188
+allow shell property_socket:sock_file write;
+#line 188
+allow shell init:unix_stream_socket connectto;
+#line 188
+
+#line 188
+allow shell ctl_snapuserd_prop:property_service set;
+#line 188
+
+#line 188
+allow shell ctl_snapuserd_prop:file { getattr open read map };
+#line 188
+
+#line 188
+
+# Allow shell to start/stop prefetch
+
+#line 190
+
+#line 190
+allow shell property_socket:sock_file write;
+#line 190
+allow shell init:unix_stream_socket connectto;
+#line 190
+
+#line 190
+allow shell ctl_prefetch_prop:property_service set;
+#line 190
+
+#line 190
+allow shell ctl_prefetch_prop:file { getattr open read map };
+#line 190
+
+#line 190
+
+# Allow shell to enable Dynamic System Update
+
+#line 192
+
+#line 192
+allow shell property_socket:sock_file write;
+#line 192
+allow shell init:unix_stream_socket connectto;
+#line 192
+
+#line 192
+allow shell dynamic_system_prop:property_service set;
+#line 192
+
+#line 192
+allow shell dynamic_system_prop:file { getattr open read map };
+#line 192
+
+#line 192
+
+# Allow shell to mock an OTA using persist.pm.mock-upgrade
+
+#line 194
+
+#line 194
+allow shell property_socket:sock_file write;
+#line 194
+allow shell init:unix_stream_socket connectto;
+#line 194
+
+#line 194
+allow shell mock_ota_prop:property_service set;
+#line 194
+
+#line 194
+allow shell mock_ota_prop:file { getattr open read map };
+#line 194
+
+#line 194
+
+
+# Read device's serial number from system properties
+
+#line 197
+allow shell serialno_prop:file { getattr open read map };
+#line 197
+
+
+# Allow shell to read the vendor security patch level for CTS
+
+#line 200
+allow shell vendor_security_patch_level_prop:file { getattr open read map };
+#line 200
+
+
+# Read state of logging-related properties
+
+#line 203
+allow shell device_logging_prop:file { getattr open read map };
+#line 203
+
+
+# Read state of boot reason properties
+
+#line 206
+allow shell bootloader_boot_reason_prop:file { getattr open read map };
+#line 206
+
+
+#line 207
+allow shell last_boot_reason_prop:file { getattr open read map };
+#line 207
+
+
+#line 208
+allow shell system_boot_reason_prop:file { getattr open read map };
+#line 208
+
+
+# Allow shell to execute the remote key provisioning factory tool
+
+#line 211
+# Call the server domain and optionally transfer references to it.
+#line 211
+allow shell hal_keymint:binder { call transfer };
+#line 211
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 211
+allow hal_keymint shell:binder transfer;
+#line 211
+# Receive and use open files from the server.
+#line 211
+allow shell hal_keymint:fd use;
+#line 211
+
+# Allow shell to run the AVF RKP HAL during the execution of the remote key
+# provisioning factory tool.
+# TODO(b/351113293): Remove this once the AVF RKP HAL registration is moved to
+# a separate process.
+
+#line 216
+# Call the server domain and optionally transfer references to it.
+#line 216
+allow shell virtualizationservice:binder { call transfer };
+#line 216
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 216
+allow virtualizationservice shell:binder transfer;
+#line 216
+# Receive and use open files from the server.
+#line 216
+allow shell virtualizationservice:fd use;
+#line 216
+
+# Allow the shell to inspect whether AVF remote attestation is supported
+# through the system property.
+
+#line 219
+allow shell avf_virtualizationservice_prop:file { getattr open read map };
+#line 219
+
+
+# Allow reading the outcome of perf_event_open LSM support test for CTS.
+
+#line 222
+allow shell init_perf_lsm_hooks_prop:file { getattr open read map };
+#line 222
+
+
+# Allow shell to read boot image timestamps and fingerprints.
+
+#line 225
+allow shell build_bootimage_prop:file { getattr open read map };
+#line 225
+
+
+# Allow shell to read odsign verification properties
+
+#line 228
+allow shell odsign_prop:file { getattr open read map };
+#line 228
+
+
+
+
+# Allow shell to read the keystore key contexts files. Used by native tests to test label lookup.
+allow shell keystore2_key_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow shell to access the keystore2_key namespace shell_key. Mainly used for native tests.
+allow shell shell_key:keystore2_key { delete rebind use get_info update };
+
+# Allow shell to open and execute memfd files for minijail unit tests.
+#line 241
+
+
+# Allow shell to write db.log.detailed, db.log.slow_query_threshold*
+
+#line 244
+
+#line 244
+allow shell property_socket:sock_file write;
+#line 244
+allow shell init:unix_stream_socket connectto;
+#line 244
+
+#line 244
+allow shell sqlite_log_prop:property_service set;
+#line 244
+
+#line 244
+allow shell sqlite_log_prop:file { getattr open read map };
+#line 244
+
+#line 244
+
+
+# Allow shell to write MTE properties even on user builds.
+
+#line 247
+
+#line 247
+allow shell property_socket:sock_file write;
+#line 247
+allow shell init:unix_stream_socket connectto;
+#line 247
+
+#line 247
+allow shell arm64_memtag_prop:property_service set;
+#line 247
+
+#line 247
+allow shell arm64_memtag_prop:file { getattr open read map };
+#line 247
+
+#line 247
+
+
+#line 248
+
+#line 248
+allow shell property_socket:sock_file write;
+#line 248
+allow shell init:unix_stream_socket connectto;
+#line 248
+
+#line 248
+allow shell permissive_mte_prop:property_service set;
+#line 248
+
+#line 248
+allow shell permissive_mte_prop:file { getattr open read map };
+#line 248
+
+#line 248
+
+
+# Allow shell to write kcmdline properties even on user builds.
+
+#line 251
+
+#line 251
+allow shell property_socket:sock_file write;
+#line 251
+allow shell init:unix_stream_socket connectto;
+#line 251
+
+#line 251
+allow shell kcmdline_prop:property_service set;
+#line 251
+
+#line 251
+allow shell kcmdline_prop:file { getattr open read map };
+#line 251
+
+#line 251
+
+
+# Allow shell to read the dm-verity props on user builds.
+
+#line 254
+allow shell verity_status_prop:file { getattr open read map };
+#line 254
+
+
+# Allow shell to read Virtual A/B related properties
+
+#line 257
+allow shell virtual_ab_prop:file { getattr open read map };
+#line 257
+
+
+# Allow ReadDefaultFstab() for CTS.
+
+#line 260
+ allow shell { metadata_file gsi_metadata_file_type }:dir search;
+#line 260
+ allow shell gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 260
+ allow shell { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 260
+
+
+# Allow shell read access to /apex/apex-info-list.xml for CTS.
+allow shell apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Let the shell user call virtualizationservice (and
+# virtualizationservice call back to shell) for debugging.
+
+#line 267
+# Transition to virtualizationmanager when the client executes it.
+#line 267
+
+#line 267
+# Allow the necessary permissions.
+#line 267
+
+#line 267
+# Old domain may exec the file and transition to the new domain.
+#line 267
+allow shell virtualizationmanager_exec:file { getattr open read execute map };
+#line 267
+allow shell virtualizationmanager:process transition;
+#line 267
+# New domain is entered by executing the file.
+#line 267
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 267
+# New domain can send SIGCHLD to its caller.
+#line 267
+allow virtualizationmanager shell:process sigchld;
+#line 267
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 267
+dontaudit shell virtualizationmanager:process noatsecure;
+#line 267
+# XXX dontaudit candidate but requires further study.
+#line 267
+allow shell virtualizationmanager:process { siginh rlimitinh };
+#line 267
+
+#line 267
+# Make the transition occur by default.
+#line 267
+type_transition shell virtualizationmanager_exec:process virtualizationmanager;
+#line 267
+
+#line 267
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 267
+allow { virtualizationmanager crosvm } shell:unix_stream_socket { ioctl getattr read write };
+#line 267
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 267
+allow { virtualizationmanager crosvm } shell:fd use;
+#line 267
+# Let the client use file descriptors created by virtualizationmanager.
+#line 267
+allow shell virtualizationmanager:fd use;
+#line 267
+# Allow piping console log to the client
+#line 267
+allow { virtualizationmanager crosvm } shell:fifo_file { ioctl getattr read write };
+#line 267
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 267
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 267
+# the client can only connect to VMs that it owns.
+#line 267
+allow shell virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 267
+# Allow client to inspect hypervisor capabilities
+#line 267
+
+#line 267
+allow shell hypervisor_prop:file { getattr open read map };
+#line 267
+
+#line 267
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 267
+allow shell virtualizationservice_data_file:file { getattr read };
+#line 267
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 267
+allow virtualizationmanager shell:dir search;
+#line 267
+allow virtualizationmanager shell:file read;
+#line 267
+allow virtualizationmanager shell:lnk_file read;
+#line 267
+
+
+# Allow shell to set persist.wm.debug properties
+
+
+# Allow shell to write GWP-ASan properties even on user builds.
+
+#line 273
+
+#line 273
+allow shell property_socket:sock_file write;
+#line 273
+allow shell init:unix_stream_socket connectto;
+#line 273
+
+#line 273
+allow shell gwp_asan_prop:property_service set;
+#line 273
+
+#line 273
+allow shell gwp_asan_prop:file { getattr open read map };
+#line 273
+
+#line 273
+
+
+# Allow shell to set persist.sysui.notification.builder_extras_override property
+
+# Allow shell to set persist.sysui.notification.ranking_update_ashmem property
+
+
+# Allow shell to read the build properties for attestation feature
+
+#line 281
+allow shell build_attestation_prop:file { getattr open read map };
+#line 281
+
+
+# Allow shell to execute oatdump.
+# TODO (b/350628688): Remove this once it's safe to do so.
+allow shell oatdump_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Create and use network sockets.
+
+#line 288
+typeattribute shell netdomain;
+#line 288
+
+
+# logcat
+
+#line 291
+allow shell logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 291
+
+#line 291
+allow shell logdr_socket:sock_file write;
+#line 291
+allow shell logd:unix_stream_socket connectto;
+#line 291
+
+#line 291
+
+
+#line 292
+# Group AID_LOG checked by filesystem & logd
+#line 292
+# to permit control commands
+#line 292
+
+#line 292
+allow shell logd_socket:sock_file write;
+#line 292
+allow shell logd:unix_stream_socket connectto;
+#line 292
+
+#line 292
+
+
+#line 293
+allow shell logd_prop:file { getattr open read map };
+#line 293
+
+# logcat -L (directly, or via dumpstate)
+allow shell pstorefs:dir search;
+allow shell pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+
+# Root fs.
+allow shell rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# read files in /data/anr
+allow shell anr_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell anr_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /data/local/tmp.
+allow shell shell_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow shell shell_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow shell shell_data_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow shell shell_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access /data/local/tests.
+allow shell shell_test_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow shell shell_test_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow shell shell_test_data_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow shell shell_test_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow shell shell_test_data_file:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read and delete from /data/local/traces.
+allow shell trace_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow shell trace_data_file:dir { { open getattr read search ioctl lock watch watch_reads } remove_name write };
+
+# Access /data/misc/profman.
+allow shell profman_dump_data_file:dir { write remove_name { open getattr read search ioctl lock watch watch_reads } };
+allow shell profman_dump_data_file:file { unlink { getattr open read ioctl lock map watch watch_reads } };
+
+# Read/execute files in /data/nativetest
+#line 330
+
+
+# adb bugreport
+
+#line 333
+allow shell dumpstate_socket:sock_file write;
+#line 333
+allow shell dumpstate:unix_stream_socket connectto;
+#line 333
+
+
+allow shell devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow shell tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow shell console_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow shell input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell input_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 342
+allow shell system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 342
+allow shell system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 342
+
+allow shell system_file:file { getattr execute execute_no_trans map };
+allow shell toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow shell shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow shell zygote_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 352
+
+
+# allow shell access to services
+allow shell servicemanager:service_manager list;
+# don't allow shell to access GateKeeper service
+# TODO: why is this so broad? Tightening candidate? It needs at list:
+# - dumpstate_service (so it can receive dumpstate progress updates)
+allow shell {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -gatekeeper_service
+ -hal_keymint_service
+ -hal_secureclock_service
+ -hal_sharedsecret_service
+ -incident_service
+ -installd_service
+ -mdns_service
+ -netd_service
+ -system_suspend_control_internal_service
+ -system_suspend_control_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+ -virtualization_service
+}:service_manager find;
+allow shell dumpstate:binder call;
+
+# allow shell to get information from hwservicemanager
+# for instance, listing hardware services with lshal
+
+#line 382
+# Call the hwservicemanager and transfer references to it.
+#line 382
+allow shell hwservicemanager:binder { call transfer };
+#line 382
+# Allow hwservicemanager to send out callbacks
+#line 382
+allow hwservicemanager shell:binder { call transfer };
+#line 382
+# hwservicemanager performs getpidcon on clients.
+#line 382
+allow hwservicemanager shell:dir search;
+#line 382
+allow hwservicemanager shell:file { read open map };
+#line 382
+allow hwservicemanager shell:process getattr;
+#line 382
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 382
+# all domains in domain.te.
+#line 382
+
+allow shell hwservicemanager:hwservice_manager list;
+
+# allow shell to look through /proc/ for lsmod, ps, top, netstat, vmstat.
+
+#line 386
+allow shell proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 386
+allow shell proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 386
+
+
+allow shell {
+ proc_asound
+ proc_cgroups
+ proc_filesystems
+ proc_interrupts
+ proc_loadavg # b/124024827
+ proc_meminfo
+ proc_modules
+ proc_pid_max
+ proc_slabinfo
+ proc_stat
+ proc_timer
+ proc_uptime
+ proc_version
+ proc_vmstat
+ proc_zoneinfo
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow listing network interfaces under /sys/class/net.
+allow shell sysfs_net:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 409
+allow shell cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 409
+allow shell cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 409
+
+allow shell cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell vendor_cgroup_desc_file:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 412
+allow shell cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 412
+allow shell cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 412
+
+allow shell domain:dir { search open read getattr };
+allow shell domain:{ file lnk_file } { open read getattr };
+
+# statvfs() of /proc and other labeled filesystems
+# (yaffs2, jffs2, ext2, ext3, ext4, xfs, btrfs, f2fs, squashfs, overlay)
+allow shell { proc labeledfs }:filesystem getattr;
+
+# stat() of /dev
+allow shell device:dir getattr;
+
+# allow shell to read /proc/pid/attr/current for ps -Z
+allow shell domain:process getattr;
+
+# Allow pulling the SELinux policy for CTS purposes
+allow shell selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell selinuxfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# enable shell domain to read/write files/dirs for bootchart data
+# User will creates the start and stop file via adb shell
+# and read other files created by init process under /data/bootchart
+allow shell bootchart_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow shell bootchart_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Make sure strace works for the non-privileged shell user
+allow shell self:process ptrace;
+
+# allow shell to get battery info
+allow shell sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell sysfs_batteryinfo:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell sysfs_batteryinfo:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow reads (but not writes) of the MGLRU state
+allow shell sysfs_lru_gen_enabled:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow reads (but not writes) of mem_sleep to determine suspend mechanism
+allow shell sysfs_mem_sleep:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow communicating with the VM terminal.
+#line 454
+
+
+# Allow CTS to check whether AVF debug policy is installed
+allow shell { proc_dt_avf sysfs_dt_avf }:dir search;
+
+# Allow access to ion memory allocation device.
+allow shell ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+#
+# filesystem test for insecure chr_file's is done
+# via a host side test
+#
+allow shell dev_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow shell dev_type:chr_file getattr;
+
+# /dev/fd is a symlink
+allow shell proc:lnk_file getattr;
+
+#
+# filesystem test for insucre blk_file's is done
+# via hostside test
+#
+allow shell dev_type:blk_file getattr;
+
+# read selinux policy files
+allow shell file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell property_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell sepolicy_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow shell to start up vendor shell
+allow shell vendor_shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+
+#line 488
+ allow shell linux_vm_setup_exec:file { entrypoint { getattr open read ioctl lock map watch watch_reads } };
+#line 490
+
+
+allow shell tee_service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow shell test_pkvm_tee_service:tee_service use;
+
+# Everything is labeled as rootfs in recovery mode. Allow shell to
+# execute them.
+#line 499
+
+
+###
+### Neverallow rules
+###
+
+# Do not allow shell to talk directly to security HAL services other than
+# hal_remotelyprovisionedcomponent_service
+neverallow shell {
+ hal_keymint_service
+ hal_secureclock_service
+ hal_sharedsecret_service
+ virtualization_service
+}:service_manager find;
+
+# Do not allow shell to hard link to any files.
+# In particular, if shell hard links to app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure the shell user never has this
+# capability.
+neverallow shell file_type:file link;
+
+# Do not allow privileged socket ioctl commands
+neverallowxperm shell domain:{ rawip_socket tcp_socket udp_socket } ioctl
+#line 523
+{
+#line 523
+# qualcomm rmnet ioctls
+#line 523
+0x00006900 0x00006902
+#line 523
+# socket ioctls
+#line 523
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 523
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 523
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 523
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 523
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 523
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 523
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 523
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 523
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 523
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 523
+# device and protocol specific ioctls
+#line 523
+0x000089f0-0x000089ff
+#line 523
+0x000089e0-0x000089ef
+#line 523
+# Wireless extension ioctls
+#line 523
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 523
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 523
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 523
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 523
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 523
+0x00008b34 0x00008b35 0x00008b36
+#line 523
+# Dev private ioctl i.e. hardware specific ioctls
+#line 523
+0x00008be0-0x00008bff
+#line 523
+};
+
+# limit shell access to sensitive char drivers to
+# only getattr required for host side test.
+neverallow shell {
+ fuse_device
+ hw_random_device
+ port_device
+}:chr_file ~getattr;
+
+# Limit shell to only getattr on blk devices for host side tests.
+neverallow shell dev_type:blk_file ~getattr;
+
+# b/30861057: Shell access to existing input devices is an abuse
+# vector. The shell user can inject events that look like they
+# originate from the touchscreen etc.
+# Everyone should have already moved to UiAutomation#injectInputEvent
+# if they are running instrumentation tests (i.e. CTS), Monkey for
+# their stress tests, and the input command (adb shell input ...) for
+# injecting swipes and things.
+neverallow shell input_device:chr_file { append create link unlink relabelfrom rename setattr write };
+
+neverallow shell self:perf_event ~{ open read write kernel };
+
+# Never allow others to set or get the perf.drop_caches property.
+neverallow { domain -shell -init } perf_drop_caches_prop:property_service set;
+neverallow { domain -shell -init -dumpstate } perf_drop_caches_prop:file read;
+#line 1 "system/sepolicy/private/simpleperf.te"
+# Domain used when running /system/bin/simpleperf to profile a specific app.
+# Entered either by the app itself exec-ing the binary, or through
+# simpleperf_app_runner (with shell as its origin). Certain other domains
+# (runas_app, shell) can also exec this binary without a domain transition.
+typeattribute simpleperf coredomain;
+type simpleperf_exec, system_file_type, exec_type, file_type;
+
+# Define apps that can be marked debuggable/profileable and be profiled by simpleperf.
+#line 15
+
+
+
+#line 17
+# Allow the necessary permissions.
+#line 17
+
+#line 17
+# Old domain may exec the file and transition to the new domain.
+#line 17
+allow { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app } simpleperf_exec:file { getattr open read execute map };
+#line 17
+allow { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app } simpleperf:process transition;
+#line 17
+# New domain is entered by executing the file.
+#line 17
+allow simpleperf simpleperf_exec:file { entrypoint open read execute getattr map };
+#line 17
+# New domain can send SIGCHLD to its caller.
+#line 17
+allow simpleperf { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app }:process sigchld;
+#line 17
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 17
+dontaudit { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app } simpleperf:process noatsecure;
+#line 17
+# XXX dontaudit candidate but requires further study.
+#line 17
+allow { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app } simpleperf:process { siginh rlimitinh };
+#line 17
+
+#line 17
+# Make the transition occur by default.
+#line 17
+type_transition { {
+#line 17
+ ephemeral_app
+#line 17
+ isolated_app
+#line 17
+ platform_app
+#line 17
+ priv_app
+#line 17
+ untrusted_app_all
+#line 17
+} -runas_app } simpleperf_exec:process simpleperf;
+#line 17
+
+
+# When running in this domain, simpleperf is scoped to profiling an individual
+# app. The necessary MAC permissions for profiling are more maintainable and
+# consistent if simpleperf is marked as an app domain as well (as, for example,
+# it will then see the same set of system libraries as the app).
+
+#line 23
+typeattribute simpleperf appdomain;
+#line 23
+# Label tmpfs objects for all apps.
+#line 23
+type_transition simpleperf tmpfs:file appdomain_tmpfs;
+#line 23
+
+#line 23
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 23
+type simpleperf_userfaultfd;
+#line 23
+type_transition simpleperf simpleperf:anon_inode simpleperf_userfaultfd "[userfaultfd]";
+#line 23
+# Allow domain to create/use userfaultfd anon_inode.
+#line 23
+allow simpleperf simpleperf_userfaultfd:anon_inode { create ioctl read };
+#line 23
+# Suppress errors generate during bugreport
+#line 23
+dontaudit su simpleperf_userfaultfd:anon_inode *;
+#line 23
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 23
+neverallow { domain -simpleperf } simpleperf_userfaultfd:anon_inode *;
+#line 23
+
+#line 23
+allow simpleperf appdomain_tmpfs:file { execute getattr map read write };
+#line 23
+neverallow { simpleperf -runas_app -shell -simpleperf } { domain -simpleperf }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 23
+neverallow { appdomain -runas_app -shell -simpleperf -simpleperf } simpleperf:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 23
+# The Android security model guarantees the confidentiality and integrity
+#line 23
+# of application data and execution state. Ptrace bypasses those
+#line 23
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 23
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 23
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 23
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 23
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 23
+# live lock conditions.
+#line 23
+neverallow { domain -simpleperf -crash_dump -runas_app -simpleperf } simpleperf:process ptrace;
+#line 23
+
+
+#line 24
+typeattribute simpleperf untrusted_app_all;
+#line 24
+
+
+# Allow ptrace attach to the target app, for reading JIT debug info (using
+# process_vm_readv) during unwinding and symbolization.
+allow simpleperf {
+#line 28
+ ephemeral_app
+#line 28
+ isolated_app
+#line 28
+ platform_app
+#line 28
+ priv_app
+#line 28
+ untrusted_app_all
+#line 28
+}:process ptrace;
+
+# Allow using perf_event_open syscall for profiling the target app.
+allow simpleperf self:perf_event { open read write kernel };
+
+# Allow /proc/<pid> access for the target app (for example, when trying to
+# discover it by cmdline).
+
+#line 35
+allow simpleperf {
+#line 35
+ ephemeral_app
+#line 35
+ isolated_app
+#line 35
+ platform_app
+#line 35
+ priv_app
+#line 35
+ untrusted_app_all
+#line 35
+}:dir { open getattr read search ioctl lock watch watch_reads };
+#line 35
+allow simpleperf {
+#line 35
+ ephemeral_app
+#line 35
+ isolated_app
+#line 35
+ platform_app
+#line 35
+ priv_app
+#line 35
+ untrusted_app_all
+#line 35
+}:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 35
+
+
+# Allow apps signalling simpleperf domain, which is the domain that the simpleperf
+# profiler runs as when executed by the app. The signals are used to control
+# the profiler (which would be profiling the app that is sending the signal).
+allow {
+#line 40
+ ephemeral_app
+#line 40
+ isolated_app
+#line 40
+ platform_app
+#line 40
+ priv_app
+#line 40
+ untrusted_app_all
+#line 40
+} simpleperf:process signal;
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective processes, most of which this domain is
+# not allowed to see.
+dontaudit simpleperf domain:dir search;
+
+# Neverallows:
+
+# Profiling must be confined to the scope of an individual app.
+neverallow simpleperf self:perf_event ~{ open read write kernel };
+#line 1 "system/sepolicy/private/simpleperf_app_runner.te"
+typeattribute simpleperf_app_runner coredomain;
+
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow shell simpleperf_app_runner_exec:file { getattr open read execute map };
+#line 3
+allow shell simpleperf_app_runner:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow simpleperf_app_runner simpleperf_app_runner_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+allow simpleperf_app_runner shell:process sigchld;
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit shell simpleperf_app_runner:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow shell simpleperf_app_runner:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition shell simpleperf_app_runner_exec:process simpleperf_app_runner;
+#line 3
+
+
+# run simpleperf_app_runner in adb shell.
+allow simpleperf_app_runner adbd:fd use;
+allow simpleperf_app_runner shell:fd use;
+allow simpleperf_app_runner devpts:chr_file { read write ioctl };
+
+# simpleperf_app_runner reads package information.
+allow simpleperf_app_runner system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow simpleperf_app_runner system_data_file:lnk_file getattr;
+allow simpleperf_app_runner packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# The app's data dir may be accessed through a symlink.
+allow simpleperf_app_runner system_data_file:lnk_file read;
+
+# simpleperf_app_runner switches to the app UID/GID.
+allow simpleperf_app_runner self:{ capability cap_userns } { setuid setgid };
+
+# simpleperf_app_runner switches to the app security context.
+
+#line 22
+
+#line 22
+allow simpleperf_app_runner selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 22
+allow simpleperf_app_runner selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 22
+
+#line 22
+allow simpleperf_app_runner selinuxfs:file { open append write lock map };
+#line 22
+allow simpleperf_app_runner kernel:security check_context;
+#line 22
+ # validate context
+allow simpleperf_app_runner self:process setcurrent;
+allow simpleperf_app_runner { ephemeral_app isolated_app platform_app priv_app untrusted_app_all }:process dyntransition; # setcon
+
+# simpleperf_app_runner/libselinux needs access to seapp_contexts_file to
+# determine which domain to transition to.
+allow simpleperf_app_runner seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# simpleperf_app_runner passes pipe fds.
+# simpleperf_app_runner writes app type (debuggable or profileable) to pipe fds.
+allow simpleperf_app_runner shell:fifo_file { read write };
+
+# simpleperf_app_runner checks shell data paths.
+# simpleperf_app_runner passes shell data fds.
+allow simpleperf_app_runner shell_data_file:dir { getattr search };
+allow simpleperf_app_runner shell_data_file:file { getattr write };
+
+###
+### neverallow rules
+###
+
+# simpleperf_app_runner cannot have capabilities other than CAP_SETUID and CAP_SETGID
+neverallow simpleperf_app_runner self:{ capability cap_userns } ~{ setuid setgid };
+neverallow simpleperf_app_runner self:{ capability2 cap2_userns } *;
+#line 1 "system/sepolicy/private/simpleperf_boot.te"
+# Domain used when running /system/bin/simpleperf to record boot-time profiles.
+# It is started by init process. It's only available on userdebug/eng build.
+
+type simpleperf_boot, domain, coredomain, mlstrustedsubject;
+
+# /data/simpleperf_boot_data, used to store boot-time profiles.
+type simpleperf_boot_data_file, file_type;
+
+#line 59
+
+#line 1 "system/sepolicy/private/slideshow.te"
+typeattribute slideshow coredomain;
+
+allow slideshow kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+#line 4
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 4
+# deprecated.
+#line 4
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 4
+allow slideshow sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 4
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 4
+allow slideshow self:{ capability2 cap2_userns } block_suspend;
+#line 4
+# system_suspend permissions
+#line 4
+
+#line 4
+# Call the server domain and optionally transfer references to it.
+#line 4
+allow slideshow system_suspend_server:binder { call transfer };
+#line 4
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 4
+allow system_suspend_server slideshow:binder transfer;
+#line 4
+# Receive and use open files from the server.
+#line 4
+allow slideshow system_suspend_server:fd use;
+#line 4
+
+#line 4
+allow slideshow system_suspend_hwservice:hwservice_manager find;
+#line 4
+# halclientdomain permissions
+#line 4
+
+#line 4
+# Call the hwservicemanager and transfer references to it.
+#line 4
+allow slideshow hwservicemanager:binder { call transfer };
+#line 4
+# Allow hwservicemanager to send out callbacks
+#line 4
+allow hwservicemanager slideshow:binder { call transfer };
+#line 4
+# hwservicemanager performs getpidcon on clients.
+#line 4
+allow hwservicemanager slideshow:dir search;
+#line 4
+allow hwservicemanager slideshow:file { read open map };
+#line 4
+allow hwservicemanager slideshow:process getattr;
+#line 4
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+#line 4
+
+#line 4
+allow slideshow hwservicemanager_prop:file { getattr open read map };
+#line 4
+
+#line 4
+allow slideshow hidl_manager_hwservice:hwservice_manager find;
+#line 4
+# AIDL suspend hal permissions
+#line 4
+allow slideshow hal_system_suspend_service:service_manager find;
+#line 4
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow slideshow servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager slideshow:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager slideshow:dir search;
+#line 4
+allow servicemanager slideshow:file { read open };
+#line 4
+allow servicemanager slideshow:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+#line 4
+
+allow slideshow device:dir { open getattr read search ioctl lock watch watch_reads };
+allow slideshow self:{ capability cap_userns } sys_tty_config;
+allow slideshow graphics_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow slideshow graphics_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow slideshow input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow slideshow input_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow slideshow tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/snapshotctl.te"
+type snapshotctl, domain, coredomain;
+type snapshotctl_exec, system_file_type, exec_type, file_type;
+
+# Allow init to run snapshotctl and do auto domain transfer.
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init snapshotctl_exec:file { getattr open read execute map };
+#line 5
+allow init snapshotctl:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow snapshotctl snapshotctl_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init snapshotctl:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init snapshotctl:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init snapshotctl_exec:process snapshotctl;
+#line 5
+
+#line 5
+;
+
+# Allow to start gsid service.
+
+#line 8
+
+#line 8
+allow snapshotctl property_socket:sock_file write;
+#line 8
+allow snapshotctl init:unix_stream_socket connectto;
+#line 8
+
+#line 8
+allow snapshotctl ctl_gsid_prop:property_service set;
+#line 8
+
+#line 8
+allow snapshotctl ctl_gsid_prop:file { getattr open read map };
+#line 8
+
+#line 8
+
+
+# Allow to talk to gsid.
+
+#line 11
+# Call the servicemanager and transfer references to it.
+#line 11
+allow snapshotctl servicemanager:binder { call transfer };
+#line 11
+# Allow servicemanager to send out callbacks
+#line 11
+allow servicemanager snapshotctl:binder { call transfer };
+#line 11
+# servicemanager performs getpidcon on clients.
+#line 11
+allow servicemanager snapshotctl:dir search;
+#line 11
+allow servicemanager snapshotctl:file { read open };
+#line 11
+allow servicemanager snapshotctl:process getattr;
+#line 11
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 11
+# all domains in domain.te.
+#line 11
+
+allow snapshotctl gsi_service:service_manager find;
+
+#line 13
+# Call the server domain and optionally transfer references to it.
+#line 13
+allow snapshotctl gsid:binder { call transfer };
+#line 13
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 13
+allow gsid snapshotctl:binder transfer;
+#line 13
+# Receive and use open files from the server.
+#line 13
+allow snapshotctl gsid:fd use;
+#line 13
+
+
+# Allow to create/read/write/delete OTA metadata files for snapshot status and COW file status.
+allow snapshotctl metadata_file:dir search;
+allow snapshotctl ota_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow snapshotctl ota_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow to get A/B slot suffix from device tree or kernel cmdline.
+
+#line 21
+allow snapshotctl sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow snapshotctl sysfs_dt_firmware_android:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 21
+;
+allow snapshotctl proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+
+# Needed to (re-)map logical partitions.
+allow snapshotctl block_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow snapshotctl super_block_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Interact with device-mapper to collapse snapshots.
+allow snapshotctl dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Needed to mutate device-mapper nodes.
+allow snapshotctl self:{ capability cap_userns } sys_admin;
+
+# Snapshotctl talk to boot control HAL to set merge status.
+
+#line 35
+# Call the hwservicemanager and transfer references to it.
+#line 35
+allow snapshotctl hwservicemanager:binder { call transfer };
+#line 35
+# Allow hwservicemanager to send out callbacks
+#line 35
+allow hwservicemanager snapshotctl:binder { call transfer };
+#line 35
+# hwservicemanager performs getpidcon on clients.
+#line 35
+allow hwservicemanager snapshotctl:dir search;
+#line 35
+allow hwservicemanager snapshotctl:file { read open map };
+#line 35
+allow hwservicemanager snapshotctl:process getattr;
+#line 35
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 35
+# all domains in domain.te.
+#line 35
+
+
+#line 36
+typeattribute snapshotctl halclientdomain;
+#line 36
+typeattribute snapshotctl hal_bootctl_client;
+#line 36
+
+#line 36
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 36
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 36
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 36
+
+#line 36
+typeattribute snapshotctl hal_bootctl;
+#line 36
+# Find passthrough HAL implementations
+#line 36
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 36
+
+#line 36
+
+
+# Allow snapshotctl to write to statsd socket.
+
+#line 39
+allow snapshotctl statsdw_socket:sock_file write;
+#line 39
+allow snapshotctl statsd:unix_dgram_socket sendto;
+#line 39
+
+
+# Logging
+#line 45
+
+
+# Allow to read /proc/bootconfig.
+allow snapshotctl proc_bootconfig:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow to control snapuserd.
+
+#line 51
+
+#line 51
+allow snapshotctl property_socket:sock_file write;
+#line 51
+allow snapshotctl init:unix_stream_socket connectto;
+#line 51
+
+#line 51
+allow snapshotctl ctl_snapuserd_prop:property_service set;
+#line 51
+
+#line 51
+allow snapshotctl ctl_snapuserd_prop:file { getattr open read map };
+#line 51
+
+#line 51
+
+
+# Allow to read snapuserd.* properties.
+
+#line 54
+allow snapshotctl snapuserd_prop:file { getattr open read map };
+#line 54
+
+
+# Allow to talk to snapuserd.
+allow snapshotctl snapuserd_socket:sock_file write;
+allow snapshotctl snapuserd:unix_stream_socket { connectto };
+
+# Allow to read /dev/block/dm-* (device-mapper) nodes.
+allow snapshotctl dm_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow to read dm-user control nodes.
+allow snapshotctl dm_user_device:dir search;
+#line 1 "system/sepolicy/private/snapuserd.te"
+# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots.
+type snapuserd, domain;
+type snapuserd_exec, exec_type, file_type, system_file_type;
+
+typeattribute snapuserd coredomain;
+
+
+#line 7
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow init snapuserd_exec:file { getattr open read execute map };
+#line 7
+allow init snapuserd:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow snapuserd snapuserd_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit init snapuserd:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow init snapuserd:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition init snapuserd_exec:process snapuserd;
+#line 7
+
+#line 7
+
+
+allow snapuserd kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow snapuserd to reach block devices in /dev/block.
+allow snapuserd block_device:dir search;
+
+# Read /sys/block to find all the DM directories like (/sys/block/dm-X).
+allow snapuserd sysfs:dir { open read };
+
+# Read /sys/block/dm-X/dm/name (which is a symlink to
+# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between
+# dm-X and dynamic partitions.
+allow snapuserd sysfs_dm:dir { open read search };
+allow snapuserd sysfs_dm:file { getattr open read ioctl lock map watch watch_reads };
+
+# Reading and writing to /dev/block/dm-* (device-mapper) nodes.
+allow snapuserd block_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow snapuserd dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow snapuserd dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Reading and writing to dm-user control nodes.
+allow snapuserd dm_user_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow snapuserd dm_user_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Reading and writing to /dev/socket/snapuserd and snapuserd_proxy.
+allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write };
+allow snapuserd snapuserd_proxy_socket:sock_file write;
+
+# Required for setting GID to system while calling SetTaskProfile() API
+allow snapuserd self:{ capability cap_userns } { setgid };
+
+# This arises due to first-stage init opening /dev/null without F_CLOEXEC
+# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd
+# again, the descriptor leaks into the new process.
+allow snapuserd kernel:fd use;
+
+# snapuserd.* properties
+
+#line 45
+
+#line 45
+allow snapuserd property_socket:sock_file write;
+#line 45
+allow snapuserd init:unix_stream_socket connectto;
+#line 45
+
+#line 45
+allow snapuserd snapuserd_prop:property_service set;
+#line 45
+
+#line 45
+allow snapuserd snapuserd_prop:file { getattr open read map };
+#line 45
+
+#line 45
+
+
+#line 46
+allow snapuserd virtual_ab_prop:file { getattr open read map };
+#line 46
+
+
+# For inotify watching for /dev/socket/snapuserd_proxy to appear.
+allow snapuserd tmpfs:dir { read watch };
+
+# Forbid anything other than snapuserd and init setting snapuserd properties.
+neverallow {
+ domain
+ -snapuserd
+ -init
+} snapuserd_prop:property_service set;
+
+# Allow to read/write/create OTA metadata files
+allow snapuserd metadata_file:dir search;
+allow snapuserd ota_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow snapuserd ota_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# write to /data/misc/snapuserd_log
+allow snapuserd snapuserd_log_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow snapuserd snapuserd_log_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read /proc/stat to determine boot time
+allow snapuserd proc_stat:file { getattr open read ioctl lock map watch watch_reads };
+
+# This capability allows snapuserd to circumvent memlock rlimits while using
+# io_uring. An Alternative would be to up the memlock rlimit for the snapuserd service.
+allow snapuserd self:capability ipc_lock;
+
+#line 73
+# Set up a type_transition to "io_uring" named anonymous inode object.
+#line 73
+type snapuserd_iouring;
+#line 73
+type_transition snapuserd snapuserd:anon_inode snapuserd_iouring "[io_uring]";
+#line 73
+# Allow domain to create/use io_uring anon_inode.
+#line 73
+allow snapuserd snapuserd_iouring:anon_inode { create map read write };
+#line 73
+allow snapuserd self:io_uring sqpoll;
+#line 73
+# Other domains may not use iouring anon_inodes created by this domain.
+#line 73
+neverallow { domain -snapuserd } snapuserd_iouring:anon_inode *;
+#line 73
+# io_uring checks for CAP_IPC_LOCK to determine whether or not to track
+#line 73
+# memory usage per uid against RLIMIT_MEMLOCK. This can lead folks to
+#line 73
+# grant CAP_IPC_LOCK to silence avc denials, which is undesireable.
+#line 73
+dontaudit snapuserd self:{ capability cap_userns } ipc_lock;
+#line 73
+
+
+# Disallow other domains controlling snapuserd.
+neverallow {
+ domain
+ -fastbootd
+ -init
+ -recovery
+ -shell
+ -snapshotctl
+ -update_engine
+} ctl_snapuserd_prop:property_service set;
+#line 1 "system/sepolicy/private/stats.te"
+type stats, domain;
+typeattribute stats coredomain;
+type stats_exec, system_file_type, exec_type, file_type;
+
+# switch to stats domain for stats command
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow shell stats_exec:file { getattr open read execute map };
+#line 6
+allow shell stats:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow stats stats_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+allow stats shell:process sigchld;
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit shell stats:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow shell stats:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition shell stats_exec:process stats;
+#line 6
+
+
+# allow stats access to stdout from its parent shell.
+allow stats shell:fd use;
+
+# allow stats to communicate use, read and write over the adb
+# connection.
+allow stats adbd:fd use;
+allow stats adbd:unix_stream_socket { read write };
+
+# allow adbd to reap stats
+allow stats adbd:process { sigchld };
+
+# Allow the stats command to talk to the statsd over the binder, and get
+# back the stats report data from a ParcelFileDescriptor.
+
+#line 21
+# Call the servicemanager and transfer references to it.
+#line 21
+allow stats servicemanager:binder { call transfer };
+#line 21
+# Allow servicemanager to send out callbacks
+#line 21
+allow servicemanager stats:binder { call transfer };
+#line 21
+# servicemanager performs getpidcon on clients.
+#line 21
+allow servicemanager stats:dir search;
+#line 21
+allow servicemanager stats:file { read open };
+#line 21
+allow servicemanager stats:process getattr;
+#line 21
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 21
+# all domains in domain.te.
+#line 21
+
+allow stats stats_service:service_manager find;
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow stats statsd:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow statsd stats:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow stats statsd:fd use;
+#line 23
+
+allow stats statsd:fifo_file write;
+
+# Only statsd can publish the binder service.
+
+#line 27
+ allow statsd stats_service:service_manager { add find };
+#line 27
+ neverallow { domain -statsd } stats_service:service_manager add;
+#line 27
+
+#line 27
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 27
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 27
+
+#line 27
+
+
+# Allow pipes from (and only from) stats.
+allow statsd stats:fd use;
+allow statsd stats:fifo_file write;
+
+# Allow statsd to call back to stats with status updates.
+
+#line 34
+# Call the server domain and optionally transfer references to it.
+#line 34
+allow statsd stats:binder { call transfer };
+#line 34
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 34
+allow stats statsd:binder transfer;
+#line 34
+# Receive and use open files from the server.
+#line 34
+allow statsd stats:fd use;
+#line 34
+
+
+#line 1 "system/sepolicy/private/stats_service_server.te"
+
+#line 1
+ allow stats_service_server fwk_stats_hwservice:hwservice_manager { add find };
+#line 1
+ allow stats_service_server hidl_base_hwservice:hwservice_manager add;
+#line 1
+ neverallow { domain -stats_service_server } fwk_stats_hwservice:hwservice_manager add;
+#line 1
+
+
+#line 2
+ allow stats_service_server fwk_stats_service:service_manager { add find };
+#line 2
+ neverallow { domain -stats_service_server } fwk_stats_service:service_manager add;
+#line 2
+
+#line 2
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 2
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 2
+
+#line 2
+
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow stats_service_server servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager stats_service_server:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager stats_service_server:dir search;
+#line 4
+allow servicemanager stats_service_server:file { read open };
+#line 4
+allow servicemanager stats_service_server:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+#line 1 "system/sepolicy/private/statsd.te"
+typeattribute statsd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init statsd_exec:file { getattr open read execute map };
+#line 3
+allow init statsd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow statsd statsd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init statsd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init statsd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init statsd_exec:process statsd;
+#line 3
+
+#line 3
+
+
+# Allow to exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe. It allows statsd to capture traces and hand them
+# to Android dropbox.
+allow statsd perfetto_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow statsd perfetto_exec:file { getattr open read execute map };
+#line 9
+allow statsd perfetto:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+allow perfetto statsd:process sigchld;
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit statsd perfetto:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow statsd perfetto:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition statsd perfetto_exec:process perfetto;
+#line 9
+
+
+# Grant statsd with permissions to register the services.
+allow statsd {
+ statscompanion_service
+}:service_manager find;
+
+# Allow incidentd to obtain the statsd incident section.
+allow statsd incidentd:fifo_file write;
+
+# Allow StatsCompanionService to pipe data to statsd.
+allow statsd system_server:fifo_file { read write getattr };
+
+# Allow any app to pipe data to statsd.
+# Access control to all statsd APIs inherit from system_api_service, so
+# appdomain permissions are granted to avoid listing each individual
+# service that can access system_api_service.
+allow statsd appdomain:fifo_file { read write getattr };
+
+# Allow statsd to retrieve SF statistics over binder
+
+#line 29
+# Call the server domain and optionally transfer references to it.
+#line 29
+allow statsd surfaceflinger:binder { call transfer };
+#line 29
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 29
+allow surfaceflinger statsd:binder transfer;
+#line 29
+# Receive and use open files from the server.
+#line 29
+allow statsd surfaceflinger:fd use;
+#line 29
+;
+
+# Allow statsd to read its system properties
+
+#line 32
+allow statsd device_config_statsd_native_prop:file { getattr open read map };
+#line 32
+
+
+#line 33
+allow statsd device_config_statsd_native_boot_prop:file { getattr open read map };
+#line 33
+
+
+# Allow statsd to read misctl properties (for 16 KB)
+
+#line 36
+allow statsd misctrl_prop:file { getattr open read map };
+#line 36
+
+
+# Allow statsd to write uprobestats configs.
+allow statsd uprobestats_configs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow statsd uprobestats_configs_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow statsd to trigger uprobestats via property.
+
+#line 43
+
+#line 43
+allow statsd property_socket:sock_file write;
+#line 43
+allow statsd init:unix_stream_socket connectto;
+#line 43
+
+#line 43
+allow statsd uprobestats_start_with_config_prop:property_service set;
+#line 43
+
+#line 43
+allow statsd uprobestats_start_with_config_prop:file { getattr open read map };
+#line 43
+
+#line 43
+;
+
+# Allow statsd to use io_uring
+
+#line 46
+# Set up a type_transition to "io_uring" named anonymous inode object.
+#line 46
+type statsd_iouring;
+#line 46
+type_transition statsd statsd:anon_inode statsd_iouring "[io_uring]";
+#line 46
+# Allow domain to create/use io_uring anon_inode.
+#line 46
+allow statsd statsd_iouring:anon_inode { create map read write };
+#line 46
+allow statsd self:io_uring sqpoll;
+#line 46
+# Other domains may not use iouring anon_inodes created by this domain.
+#line 46
+neverallow { domain -statsd } statsd_iouring:anon_inode *;
+#line 46
+# io_uring checks for CAP_IPC_LOCK to determine whether or not to track
+#line 46
+# memory usage per uid against RLIMIT_MEMLOCK. This can lead folks to
+#line 46
+# grant CAP_IPC_LOCK to silence avc denials, which is undesireable.
+#line 46
+dontaudit statsd self:{ capability cap_userns } ipc_lock;
+#line 46
+
+
+# Allow statsd to start the uprobestats service.
+
+#line 49
+
+#line 49
+allow statsd property_socket:sock_file write;
+#line 49
+allow statsd init:unix_stream_socket connectto;
+#line 49
+
+#line 49
+allow statsd ctl_uprobestats_prop:property_service set;
+#line 49
+
+#line 49
+allow statsd ctl_uprobestats_prop:file { getattr open read map };
+#line 49
+
+#line 49
+
+
+#line 50
+# Call the servicemanager and transfer references to it.
+#line 50
+allow statsd servicemanager:binder { call transfer };
+#line 50
+# Allow servicemanager to send out callbacks
+#line 50
+allow servicemanager statsd:binder { call transfer };
+#line 50
+# servicemanager performs getpidcon on clients.
+#line 50
+allow servicemanager statsd:dir search;
+#line 50
+allow servicemanager statsd:file { read open };
+#line 50
+allow servicemanager statsd:process getattr;
+#line 50
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 50
+# all domains in domain.te.
+#line 50
+
+
+# Allow statsd to scan through /proc/pid for all processes.
+
+#line 53
+allow statsd domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 53
+allow statsd domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 53
+
+
+# Allow executing files on system, such as running a shell or running:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow statsd devpts:chr_file { getattr ioctl read write };
+allow statsd shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow statsd system_file:file execute_no_trans;
+allow statsd toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 66
+
+
+# Create, read, and write into
+# /data/misc/stats-active-metric
+# /data/misc/stats-data
+# /data/misc/stats-metadata
+# /data/misc/stats-service
+# /data/misc/train-info
+allow statsd stats_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow statsd stats_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow statsd stats_config_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow statsd stats_config_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow statsd to make binder calls to any binder service.
+
+#line 80
+# Call the server domain and optionally transfer references to it.
+#line 80
+allow statsd appdomain:binder { call transfer };
+#line 80
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 80
+allow appdomain statsd:binder transfer;
+#line 80
+# Receive and use open files from the server.
+#line 80
+allow statsd appdomain:fd use;
+#line 80
+
+
+#line 81
+# Call the server domain and optionally transfer references to it.
+#line 81
+allow statsd incidentd:binder { call transfer };
+#line 81
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 81
+allow incidentd statsd:binder transfer;
+#line 81
+# Receive and use open files from the server.
+#line 81
+allow statsd incidentd:fd use;
+#line 81
+
+
+#line 82
+# Call the server domain and optionally transfer references to it.
+#line 82
+allow statsd system_server:binder { call transfer };
+#line 82
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 82
+allow system_server statsd:binder transfer;
+#line 82
+# Receive and use open files from the server.
+#line 82
+allow statsd system_server:fd use;
+#line 82
+
+
+#line 83
+# Call the server domain and optionally transfer references to it.
+#line 83
+allow statsd traced_probes:binder { call transfer };
+#line 83
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 83
+allow traced_probes statsd:binder transfer;
+#line 83
+# Receive and use open files from the server.
+#line 83
+allow statsd traced_probes:fd use;
+#line 83
+
+
+# Allow statsd to interact with gpuservice
+allow statsd gpu_service:service_manager find;
+
+#line 87
+# Call the server domain and optionally transfer references to it.
+#line 87
+allow statsd gpuservice:binder { call transfer };
+#line 87
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 87
+allow gpuservice statsd:binder transfer;
+#line 87
+# Receive and use open files from the server.
+#line 87
+allow statsd gpuservice:fd use;
+#line 87
+
+
+# Allow statsd to interact with keystore to pull atoms
+allow statsd keystore_service:service_manager find;
+
+#line 91
+# Call the server domain and optionally transfer references to it.
+#line 91
+allow statsd keystore:binder { call transfer };
+#line 91
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 91
+allow keystore statsd:binder transfer;
+#line 91
+# Receive and use open files from the server.
+#line 91
+allow statsd keystore:fd use;
+#line 91
+
+
+# Allow statsd to interact with mediametrics
+allow statsd mediametrics_service:service_manager find;
+
+#line 95
+# Call the server domain and optionally transfer references to it.
+#line 95
+allow statsd mediametrics:binder { call transfer };
+#line 95
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 95
+allow mediametrics statsd:binder transfer;
+#line 95
+# Receive and use open files from the server.
+#line 95
+allow statsd mediametrics:fd use;
+#line 95
+
+
+# Allow statsd to interact with mediametrics
+allow statsd mediaserver_service:service_manager find;
+
+#line 99
+# Call the server domain and optionally transfer references to it.
+#line 99
+allow statsd mediaserver:binder { call transfer };
+#line 99
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 99
+allow mediaserver statsd:binder transfer;
+#line 99
+# Receive and use open files from the server.
+#line 99
+allow statsd mediaserver:fd use;
+#line 99
+
+
+# Allow logd access.
+
+#line 102
+allow statsd logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 102
+
+#line 102
+allow statsd logdr_socket:sock_file write;
+#line 102
+allow statsd logd:unix_stream_socket connectto;
+#line 102
+
+#line 102
+
+
+#line 103
+# Group AID_LOG checked by filesystem & logd
+#line 103
+# to permit control commands
+#line 103
+
+#line 103
+allow statsd logd_socket:sock_file write;
+#line 103
+allow statsd logd:unix_stream_socket connectto;
+#line 103
+
+#line 103
+
+
+# Grant statsd with permissions to register the services.
+allow statsd {
+ app_api_service
+ incident_service
+ system_api_service
+}:service_manager find;
+
+# Grant statsd to access health hal to access battery metrics.
+allow statsd hal_health_hwservice:hwservice_manager find;
+
+# Allow statsd to send dump info to dumpstate
+allow statsd dumpstate:fd use;
+allow statsd dumpstate:fifo_file { getattr write };
+
+# Allow access to with hardware layer and process stats.
+allow statsd proc_uid_cputime_showstat:file { getattr open read };
+
+#line 121
+typeattribute statsd halclientdomain;
+#line 121
+typeattribute statsd hal_health_client;
+#line 121
+
+#line 121
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 121
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 121
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 121
+
+#line 121
+typeattribute statsd hal_health;
+#line 121
+# Find passthrough HAL implementations
+#line 121
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 121
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 121
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 121
+
+#line 121
+
+
+#line 122
+typeattribute statsd halclientdomain;
+#line 122
+typeattribute statsd hal_power_client;
+#line 122
+
+#line 122
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 122
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 122
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 122
+
+#line 122
+typeattribute statsd hal_power;
+#line 122
+# Find passthrough HAL implementations
+#line 122
+allow hal_power system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 122
+allow hal_power vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 122
+allow hal_power vendor_file:file { read open getattr execute map };
+#line 122
+
+#line 122
+
+
+#line 123
+typeattribute statsd halclientdomain;
+#line 123
+typeattribute statsd hal_power_stats_client;
+#line 123
+
+#line 123
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 123
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 123
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 123
+
+#line 123
+typeattribute statsd hal_power_stats;
+#line 123
+# Find passthrough HAL implementations
+#line 123
+allow hal_power_stats system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 123
+allow hal_power_stats vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 123
+allow hal_power_stats vendor_file:file { read open getattr execute map };
+#line 123
+
+#line 123
+
+
+#line 124
+typeattribute statsd halclientdomain;
+#line 124
+typeattribute statsd hal_thermal_client;
+#line 124
+
+#line 124
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 124
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 124
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 124
+
+#line 124
+typeattribute statsd hal_thermal;
+#line 124
+# Find passthrough HAL implementations
+#line 124
+allow hal_thermal system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 124
+allow hal_thermal vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 124
+allow hal_thermal vendor_file:file { read open getattr execute map };
+#line 124
+
+#line 124
+
+
+# Allow 'adb shell cmd' to upload configs and download output.
+allow statsd adbd:fd use;
+allow statsd adbd:unix_stream_socket { getattr read write };
+allow statsd shell:fifo_file { getattr read write };
+
+
+#line 131
+allow statsd statsdw_socket:sock_file write;
+#line 131
+allow statsd statsd:unix_dgram_socket sendto;
+#line 131
+
+
+###
+### neverallow rules
+###
+
+# Only statsd and the other root services in limited circumstances.
+# can get to the files in /data/misc/stats-data, /data/misc/stats-service.
+# Other services are prohibitted from accessing the file.
+neverallow { domain -statsd -init -vold } stats_data_file:file *;
+neverallow { domain -statsd -system_server -init -vold } stats_config_data_file:file *;
+
+
+# Limited access to the directory itself.
+neverallow { domain -statsd -init -vold } stats_data_file:dir *;
+neverallow { domain -statsd -system_server -init -vold } stats_config_data_file:dir *;
+#line 1 "system/sepolicy/private/storaged.te"
+# storaged daemon
+type storaged, domain, coredomain, mlstrustedsubject;
+type storaged_exec, system_file_type, exec_type, file_type;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init storaged_exec:file { getattr open read execute map };
+#line 5
+allow init storaged:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow storaged storaged_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init storaged:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init storaged:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init storaged_exec:process storaged;
+#line 5
+
+#line 5
+
+
+# Read access to pseudo filesystems
+
+#line 8
+allow storaged domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 8
+allow storaged domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 8
+
+
+# Read /proc/uid_io/stats
+allow storaged proc_uid_io_stats:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /data/system/packages.list
+allow storaged system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow storaged packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Store storaged proto file
+allow storaged storaged_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow storaged storaged_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 21
+
+#line 27
+
+
+# Needed to provide debug dump output via dumpsys pipes.
+allow storaged shell:fd use;
+allow storaged shell:fifo_file write;
+
+# Needed for GMScore to call dumpsys storaged
+allow storaged priv_app:fd use;
+# b/142672293: No other priv-app should need this allow rule now that GMS core runs in its own domain.
+# Remove after no logs are seen for this rule.
+#line 39
+
+allow storaged gmscore_app:fd use;
+allow storaged { privapp_data_file app_data_file }:file write;
+allow storaged permission_service:service_manager find;
+
+# Binder permissions
+
+#line 45
+ allow storaged storaged_service:service_manager { add find };
+#line 45
+ neverallow { domain -storaged } storaged_service:service_manager add;
+#line 45
+
+#line 45
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 45
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 45
+
+#line 45
+
+
+
+#line 47
+# Call the servicemanager and transfer references to it.
+#line 47
+allow storaged servicemanager:binder { call transfer };
+#line 47
+# Allow servicemanager to send out callbacks
+#line 47
+allow servicemanager storaged:binder { call transfer };
+#line 47
+# servicemanager performs getpidcon on clients.
+#line 47
+allow servicemanager storaged:dir search;
+#line 47
+allow servicemanager storaged:file { read open };
+#line 47
+allow servicemanager storaged:process getattr;
+#line 47
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 47
+# all domains in domain.te.
+#line 47
+
+
+#line 48
+# Call the server domain and optionally transfer references to it.
+#line 48
+allow storaged system_server:binder { call transfer };
+#line 48
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 48
+allow system_server storaged:binder transfer;
+#line 48
+# Receive and use open files from the server.
+#line 48
+allow storaged system_server:fd use;
+#line 48
+
+
+
+#line 50
+typeattribute storaged halclientdomain;
+#line 50
+typeattribute storaged hal_health_client;
+#line 50
+
+#line 50
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 50
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 50
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 50
+
+#line 50
+typeattribute storaged hal_health;
+#line 50
+# Find passthrough HAL implementations
+#line 50
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 50
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 50
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 50
+
+#line 50
+
+
+# Implements a dumpsys interface.
+allow storaged dumpstate:fd use;
+
+# use a subset of the package manager service
+allow storaged package_native_service:service_manager find;
+
+# Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is
+# running as root. See b/35323867 #3.
+dontaudit storaged self:{ capability cap_userns } { dac_override dac_read_search };
+
+# For collecting bugreports.
+allow storaged dumpstate:fifo_file write;
+
+###
+### neverallow
+###
+neverallow storaged domain:process ptrace;
+neverallow storaged self:{ capability capability2 cap_userns cap2_userns } *;
+#line 136 "system/sepolicy/private/su.te"
+
+#line 1 "system/sepolicy/private/surfaceflinger.te"
+# surfaceflinger - display compositor service
+
+typeattribute surfaceflinger coredomain;
+
+type surfaceflinger_exec, system_file_type, exec_type, file_type;
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init surfaceflinger_exec:file { getattr open read execute map };
+#line 6
+allow init surfaceflinger:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow surfaceflinger surfaceflinger_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init surfaceflinger:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init surfaceflinger:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init surfaceflinger_exec:process surfaceflinger;
+#line 6
+
+#line 6
+
+
+#line 7
+type_transition surfaceflinger tmpfs:file surfaceflinger_tmpfs;
+#line 7
+allow surfaceflinger surfaceflinger_tmpfs:file { read write getattr map };
+#line 7
+
+
+typeattribute surfaceflinger mlstrustedsubject;
+typeattribute surfaceflinger display_service_server;
+
+
+#line 12
+allow surfaceflinger runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+
+# Perform HwBinder IPC.
+
+#line 15
+typeattribute surfaceflinger halclientdomain;
+#line 15
+typeattribute surfaceflinger hal_graphics_allocator_client;
+#line 15
+
+#line 15
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 15
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 15
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 15
+
+#line 15
+typeattribute surfaceflinger hal_graphics_allocator;
+#line 15
+# Find passthrough HAL implementations
+#line 15
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 15
+
+#line 15
+
+
+#line 16
+typeattribute surfaceflinger halclientdomain;
+#line 16
+typeattribute surfaceflinger hal_graphics_composer_client;
+#line 16
+
+#line 16
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 16
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 16
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 16
+
+#line 16
+typeattribute surfaceflinger hal_graphics_composer;
+#line 16
+# Find passthrough HAL implementations
+#line 16
+allow hal_graphics_composer system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_graphics_composer vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow hal_graphics_composer vendor_file:file { read open getattr execute map };
+#line 16
+
+#line 16
+
+typeattribute surfaceflinger_tmpfs hal_graphics_composer_client_tmpfs;
+
+#line 18
+typeattribute surfaceflinger halclientdomain;
+#line 18
+typeattribute surfaceflinger hal_codec2_client;
+#line 18
+
+#line 18
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 18
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 18
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 18
+
+#line 18
+typeattribute surfaceflinger hal_codec2;
+#line 18
+# Find passthrough HAL implementations
+#line 18
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 18
+
+#line 18
+
+
+#line 19
+typeattribute surfaceflinger halclientdomain;
+#line 19
+typeattribute surfaceflinger hal_omx_client;
+#line 19
+
+#line 19
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 19
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 19
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 19
+
+#line 19
+typeattribute surfaceflinger hal_omx;
+#line 19
+# Find passthrough HAL implementations
+#line 19
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 19
+
+#line 19
+
+
+#line 20
+typeattribute surfaceflinger halclientdomain;
+#line 20
+typeattribute surfaceflinger hal_configstore_client;
+#line 20
+
+#line 20
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 20
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 20
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 20
+
+#line 20
+typeattribute surfaceflinger hal_configstore;
+#line 20
+# Find passthrough HAL implementations
+#line 20
+allow hal_configstore system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_configstore vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 20
+allow hal_configstore vendor_file:file { read open getattr execute map };
+#line 20
+
+#line 20
+
+
+#line 21
+typeattribute surfaceflinger halclientdomain;
+#line 21
+typeattribute surfaceflinger hal_power_client;
+#line 21
+
+#line 21
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 21
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 21
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 21
+
+#line 21
+typeattribute surfaceflinger hal_power;
+#line 21
+# Find passthrough HAL implementations
+#line 21
+allow hal_power system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_power vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 21
+allow hal_power vendor_file:file { read open getattr execute map };
+#line 21
+
+#line 21
+
+allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
+
+# Perform Binder IPC.
+
+#line 25
+# Call the servicemanager and transfer references to it.
+#line 25
+allow surfaceflinger servicemanager:binder { call transfer };
+#line 25
+# Allow servicemanager to send out callbacks
+#line 25
+allow servicemanager surfaceflinger:binder { call transfer };
+#line 25
+# servicemanager performs getpidcon on clients.
+#line 25
+allow servicemanager surfaceflinger:dir search;
+#line 25
+allow servicemanager surfaceflinger:file { read open };
+#line 25
+allow servicemanager surfaceflinger:process getattr;
+#line 25
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 25
+# all domains in domain.te.
+#line 25
+
+
+#line 26
+# Call the server domain and optionally transfer references to it.
+#line 26
+allow surfaceflinger binderservicedomain:binder { call transfer };
+#line 26
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 26
+allow binderservicedomain surfaceflinger:binder transfer;
+#line 26
+# Receive and use open files from the server.
+#line 26
+allow surfaceflinger binderservicedomain:fd use;
+#line 26
+
+
+#line 27
+# Call the server domain and optionally transfer references to it.
+#line 27
+allow surfaceflinger appdomain:binder { call transfer };
+#line 27
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 27
+allow appdomain surfaceflinger:binder transfer;
+#line 27
+# Receive and use open files from the server.
+#line 27
+allow surfaceflinger appdomain:fd use;
+#line 27
+
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow surfaceflinger bootanim:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow bootanim surfaceflinger:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow surfaceflinger bootanim:fd use;
+#line 28
+
+
+#line 29
+# Call the server domain and optionally transfer references to it.
+#line 29
+allow surfaceflinger system_server:binder { call transfer };
+#line 29
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 29
+allow system_server surfaceflinger:binder transfer;
+#line 29
+# Receive and use open files from the server.
+#line 29
+allow surfaceflinger system_server:fd use;
+#line 29
+;
+
+#line 30
+typeattribute surfaceflinger binderservicedomain;
+#line 30
+
+
+# Binder IPC to bu, presently runs in adbd domain.
+
+#line 33
+# Call the server domain and optionally transfer references to it.
+#line 33
+allow surfaceflinger adbd:binder { call transfer };
+#line 33
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 33
+allow adbd surfaceflinger:binder transfer;
+#line 33
+# Receive and use open files from the server.
+#line 33
+allow surfaceflinger adbd:fd use;
+#line 33
+
+
+# Read /proc/pid files for Binder clients.
+
+#line 36
+allow surfaceflinger binderservicedomain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow surfaceflinger binderservicedomain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+
+
+#line 37
+allow surfaceflinger appdomain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 37
+allow surfaceflinger appdomain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 37
+
+
+# Access the GPU.
+allow surfaceflinger gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow surfaceflinger gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow surfaceflinger sysfs_gpu:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access /dev/graphics/fb0.
+allow surfaceflinger graphics_device:dir search;
+allow surfaceflinger graphics_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access /dev/video1.
+allow surfaceflinger video_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow surfaceflinger video_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access the secure heap.
+allow surfaceflinger dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Create and use netlink kobject uevent sockets.
+allow surfaceflinger self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Set properties.
+
+#line 59
+
+#line 59
+allow surfaceflinger property_socket:sock_file write;
+#line 59
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 59
+
+#line 59
+allow surfaceflinger system_prop:property_service set;
+#line 59
+
+#line 59
+allow surfaceflinger system_prop:file { getattr open read map };
+#line 59
+
+#line 59
+
+
+#line 60
+
+#line 60
+allow surfaceflinger property_socket:sock_file write;
+#line 60
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 60
+
+#line 60
+allow surfaceflinger bootanim_system_prop:property_service set;
+#line 60
+
+#line 60
+allow surfaceflinger bootanim_system_prop:file { getattr open read map };
+#line 60
+
+#line 60
+
+
+#line 61
+
+#line 61
+allow surfaceflinger property_socket:sock_file write;
+#line 61
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 61
+
+#line 61
+allow surfaceflinger exported_system_prop:property_service set;
+#line 61
+
+#line 61
+allow surfaceflinger exported_system_prop:file { getattr open read map };
+#line 61
+
+#line 61
+
+
+#line 62
+
+#line 62
+allow surfaceflinger property_socket:sock_file write;
+#line 62
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 62
+
+#line 62
+allow surfaceflinger exported3_system_prop:property_service set;
+#line 62
+
+#line 62
+allow surfaceflinger exported3_system_prop:file { getattr open read map };
+#line 62
+
+#line 62
+
+
+#line 63
+
+#line 63
+allow surfaceflinger property_socket:sock_file write;
+#line 63
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 63
+
+#line 63
+allow surfaceflinger ctl_bootanim_prop:property_service set;
+#line 63
+
+#line 63
+allow surfaceflinger ctl_bootanim_prop:file { getattr open read map };
+#line 63
+
+#line 63
+
+
+#line 64
+
+#line 64
+allow surfaceflinger property_socket:sock_file write;
+#line 64
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 64
+
+#line 64
+allow surfaceflinger locale_prop:property_service set;
+#line 64
+
+#line 64
+allow surfaceflinger locale_prop:file { getattr open read map };
+#line 64
+
+#line 64
+
+
+#line 65
+
+#line 65
+allow surfaceflinger property_socket:sock_file write;
+#line 65
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 65
+
+#line 65
+allow surfaceflinger surfaceflinger_display_prop:property_service set;
+#line 65
+
+#line 65
+allow surfaceflinger surfaceflinger_display_prop:file { getattr open read map };
+#line 65
+
+#line 65
+
+
+#line 66
+
+#line 66
+allow surfaceflinger property_socket:sock_file write;
+#line 66
+allow surfaceflinger init:unix_stream_socket connectto;
+#line 66
+
+#line 66
+allow surfaceflinger timezone_prop:property_service set;
+#line 66
+
+#line 66
+allow surfaceflinger timezone_prop:file { getattr open read map };
+#line 66
+
+#line 66
+
+
+# Get properties.
+
+#line 69
+allow surfaceflinger qemu_sf_lcd_density_prop:file { getattr open read map };
+#line 69
+
+
+#line 70
+allow surfaceflinger device_config_surface_flinger_native_boot_prop:file { getattr open read map };
+#line 70
+
+
+# Use open files supplied by an app.
+allow surfaceflinger appdomain:fd use;
+allow surfaceflinger { app_data_file privapp_data_file }:file { read write };
+
+# Allow writing surface traces to /data/misc/wmtrace.
+#line 80
+
+
+# Needed to register as a Perfetto producer.
+
+#line 83
+ allow surfaceflinger traced:fd use;
+#line 83
+ allow surfaceflinger traced_tmpfs:file { read write getattr map };
+#line 83
+
+#line 83
+allow surfaceflinger traced_producer_socket:sock_file write;
+#line 83
+allow surfaceflinger traced:unix_stream_socket connectto;
+#line 83
+
+#line 83
+
+#line 83
+ # Also allow the service to use the producer file descriptors. This is
+#line 83
+ # necessary when the producer is creating the shared memory, as it will be
+#line 83
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 83
+ allow traced surfaceflinger:fd use;
+#line 83
+
+
+# Use socket supplied by adbd, for cmd gpu vkjson etc.
+allow surfaceflinger adbd:unix_stream_socket { read write getattr };
+
+# Allow reading and writing to sockets used for BLAST buffer releases.
+# SurfaceFlinger never reads from these sockets but needs read permissions in order to receive
+# the file descriptors over binder. There's no mechanism to mark a socket as write-only.
+# shutdown is used to close the read-end of the sockets that are sent to SurfaceFlinger. See
+# b/353597444
+allow surfaceflinger { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:unix_stream_socket { read write };
+allow surfaceflinger bootanim:unix_stream_socket { read write };
+allow surfaceflinger automotive_display_service:unix_stream_socket { read write };
+
+# Allow a dumpstate triggered screenshot
+
+#line 98
+# Call the server domain and optionally transfer references to it.
+#line 98
+allow surfaceflinger dumpstate:binder { call transfer };
+#line 98
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 98
+allow dumpstate surfaceflinger:binder transfer;
+#line 98
+# Receive and use open files from the server.
+#line 98
+allow surfaceflinger dumpstate:fd use;
+#line 98
+
+
+#line 99
+# Call the server domain and optionally transfer references to it.
+#line 99
+allow surfaceflinger shell:binder { call transfer };
+#line 99
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 99
+allow shell surfaceflinger:binder transfer;
+#line 99
+# Receive and use open files from the server.
+#line 99
+allow surfaceflinger shell:fd use;
+#line 99
+
+
+#line 100
+allow surfaceflinger dumpstate:dir { open getattr read search ioctl lock watch watch_reads };
+#line 100
+allow surfaceflinger dumpstate:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 100
+
+
+# media.player service
+
+# do not use add_service() as hal_graphics_composer_default may be the
+# provider as well
+#add_service(surfaceflinger, surfaceflinger_service)
+allow surfaceflinger surfaceflinger_service:service_manager { add find };
+
+allow surfaceflinger mediaserver_service:service_manager find;
+allow surfaceflinger permission_service:service_manager find;
+allow surfaceflinger power_service:service_manager find;
+allow surfaceflinger vr_manager_service:service_manager find;
+allow surfaceflinger window_service:service_manager find;
+allow surfaceflinger inputflinger_service:service_manager find;
+
+
+# allow self to set SCHED_FIFO
+allow surfaceflinger self:{ capability cap_userns } sys_nice;
+allow surfaceflinger proc_meminfo:file { getattr open read ioctl lock map watch watch_reads };
+
+#line 120
+allow surfaceflinger cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 120
+allow surfaceflinger cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 120
+
+
+#line 121
+allow surfaceflinger cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 121
+allow surfaceflinger cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 121
+
+
+#line 122
+allow surfaceflinger system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 122
+allow surfaceflinger system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 122
+
+allow surfaceflinger tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow surfaceflinger system_server:fd use;
+allow surfaceflinger system_server:unix_stream_socket { read write };
+allow surfaceflinger ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow surfaceflinger dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# pdx IPC
+
+#line 130
+# Mark the server domain as a PDX server.
+#line 130
+typeattribute surfaceflinger pdx_display_client_server_type;
+#line 130
+# Allow the init process to create the initial endpoint socket.
+#line 130
+allow init pdx_display_client_endpoint_socket_type:unix_stream_socket { create bind };
+#line 130
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 130
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 130
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 130
+allow surfaceflinger pdx_display_client_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 130
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 130
+allow surfaceflinger self:process setsockcreate;
+#line 130
+# Allow the server domain to create a client channel socket.
+#line 130
+allow surfaceflinger pdx_display_client_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 130
+# Prevent other processes from claiming to be a server for the same service.
+#line 130
+neverallow {domain -surfaceflinger} pdx_display_client_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 130
+
+
+#line 131
+# Mark the server domain as a PDX server.
+#line 131
+typeattribute surfaceflinger pdx_display_manager_server_type;
+#line 131
+# Allow the init process to create the initial endpoint socket.
+#line 131
+allow init pdx_display_manager_endpoint_socket_type:unix_stream_socket { create bind };
+#line 131
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 131
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 131
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 131
+allow surfaceflinger pdx_display_manager_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 131
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 131
+allow surfaceflinger self:process setsockcreate;
+#line 131
+# Allow the server domain to create a client channel socket.
+#line 131
+allow surfaceflinger pdx_display_manager_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 131
+# Prevent other processes from claiming to be a server for the same service.
+#line 131
+neverallow {domain -surfaceflinger} pdx_display_manager_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 131
+
+
+#line 132
+# Mark the server domain as a PDX server.
+#line 132
+typeattribute surfaceflinger pdx_display_screenshot_server_type;
+#line 132
+# Allow the init process to create the initial endpoint socket.
+#line 132
+allow init pdx_display_screenshot_endpoint_socket_type:unix_stream_socket { create bind };
+#line 132
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 132
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 132
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 132
+allow surfaceflinger pdx_display_screenshot_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 132
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 132
+allow surfaceflinger self:process setsockcreate;
+#line 132
+# Allow the server domain to create a client channel socket.
+#line 132
+allow surfaceflinger pdx_display_screenshot_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 132
+# Prevent other processes from claiming to be a server for the same service.
+#line 132
+neverallow {domain -surfaceflinger} pdx_display_screenshot_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 132
+
+
+#line 133
+# Mark the server domain as a PDX server.
+#line 133
+typeattribute surfaceflinger pdx_display_vsync_server_type;
+#line 133
+# Allow the init process to create the initial endpoint socket.
+#line 133
+allow init pdx_display_vsync_endpoint_socket_type:unix_stream_socket { create bind };
+#line 133
+# Allow the server domain to use the endpoint socket and accept connections on it.
+#line 133
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 133
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 133
+allow surfaceflinger pdx_display_vsync_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+#line 133
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+#line 133
+allow surfaceflinger self:process setsockcreate;
+#line 133
+# Allow the server domain to create a client channel socket.
+#line 133
+allow surfaceflinger pdx_display_vsync_channel_socket_type:unix_stream_socket { create { { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } listen accept } };
+#line 133
+# Prevent other processes from claiming to be a server for the same service.
+#line 133
+neverallow {domain -surfaceflinger} pdx_display_vsync_endpoint_socket_type:unix_stream_socket { listen accept };
+#line 133
+
+
+
+#line 135
+
+#line 135
+# Allow client to open the service endpoint file.
+#line 135
+allow surfaceflinger pdx_bufferhub_client_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 135
+allow surfaceflinger pdx_bufferhub_client_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 135
+# Allow the client to connect to endpoint socket.
+#line 135
+allow surfaceflinger pdx_bufferhub_client_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 135
+
+#line 135
+
+#line 135
+# Allow the client to use the PDX channel socket.
+#line 135
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 135
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 135
+allow surfaceflinger pdx_bufferhub_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 135
+# Client needs to use an channel event fd from the server.
+#line 135
+allow surfaceflinger pdx_bufferhub_client_server_type:fd use;
+#line 135
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 135
+# This could be tightened on a per-server basis, but keeping track of service
+#line 135
+# clients is error prone.
+#line 135
+allow pdx_bufferhub_client_server_type surfaceflinger:fd use;
+#line 135
+
+#line 135
+
+
+#line 136
+
+#line 136
+# Allow client to open the service endpoint file.
+#line 136
+allow surfaceflinger pdx_performance_client_endpoint_dir_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 136
+allow surfaceflinger pdx_performance_client_endpoint_socket_type:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 136
+# Allow the client to connect to endpoint socket.
+#line 136
+allow surfaceflinger pdx_performance_client_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+#line 136
+
+#line 136
+
+#line 136
+# Allow the client to use the PDX channel socket.
+#line 136
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+#line 136
+# than we need (e.g. we don"t need "bind" or "connect").
+#line 136
+allow surfaceflinger pdx_performance_client_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+#line 136
+# Client needs to use an channel event fd from the server.
+#line 136
+allow surfaceflinger pdx_performance_client_server_type:fd use;
+#line 136
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+#line 136
+# This could be tightened on a per-server basis, but keeping track of service
+#line 136
+# clients is error prone.
+#line 136
+allow pdx_performance_client_server_type surfaceflinger:fd use;
+#line 136
+
+#line 136
+
+
+# Allow supplying timestats statistics to statsd
+allow surfaceflinger stats_service:service_manager find;
+allow surfaceflinger statsmanager_service:service_manager find;
+# TODO(146461633): remove this once native pullers talk to StatsManagerService
+
+#line 142
+# Call the server domain and optionally transfer references to it.
+#line 142
+allow surfaceflinger statsd:binder { call transfer };
+#line 142
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 142
+allow statsd surfaceflinger:binder transfer;
+#line 142
+# Receive and use open files from the server.
+#line 142
+allow surfaceflinger statsd:fd use;
+#line 142
+;
+# Allow pushing atoms to the stats bootstrap atom service
+allow surfaceflinger statsbootstrap_service:service_manager find;
+
+# Allow to use files supplied by hal_evs
+allow surfaceflinger hal_evs:fd use;
+
+# Allow to use release fence fds supplied by hal_camera
+allow surfaceflinger hal_camera:fd use;
+
+
+# Surfaceflinger should not be reading default vendor-defined properties.
+dontaudit surfaceflinger vendor_default_prop:file read;
+
+###
+### Neverallow rules
+###
+### surfaceflinger should NEVER do any of this
+
+# Do not allow accessing SDcard files as unsafe ejection could
+# cause the kernel to kill the process.
+neverallow surfaceflinger { sdcard_type fuse }:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# b/68864350
+dontaudit surfaceflinger unlabeled:dir search;
+#line 1 "system/sepolicy/private/system_app.te"
+###
+### Apps that run with the system UID, e.g. com.android.system.ui,
+### com.android.settings. These are not as privileged as the system
+### server.
+###
+
+typeattribute system_app coredomain, mlstrustedsubject;
+
+
+#line 9
+typeattribute system_app appdomain;
+#line 9
+# Label tmpfs objects for all apps.
+#line 9
+type_transition system_app tmpfs:file appdomain_tmpfs;
+#line 9
+
+#line 9
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 9
+type system_app_userfaultfd;
+#line 9
+type_transition system_app system_app:anon_inode system_app_userfaultfd "[userfaultfd]";
+#line 9
+# Allow domain to create/use userfaultfd anon_inode.
+#line 9
+allow system_app system_app_userfaultfd:anon_inode { create ioctl read };
+#line 9
+# Suppress errors generate during bugreport
+#line 9
+dontaudit su system_app_userfaultfd:anon_inode *;
+#line 9
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 9
+neverallow { domain -system_app } system_app_userfaultfd:anon_inode *;
+#line 9
+
+#line 9
+allow system_app appdomain_tmpfs:file { execute getattr map read write };
+#line 9
+neverallow { system_app -runas_app -shell -simpleperf } { domain -system_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+neverallow { appdomain -runas_app -shell -simpleperf -system_app } system_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 9
+# The Android security model guarantees the confidentiality and integrity
+#line 9
+# of application data and execution state. Ptrace bypasses those
+#line 9
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 9
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 9
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 9
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 9
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 9
+# live lock conditions.
+#line 9
+neverallow { domain -system_app -crash_dump -runas_app -simpleperf } system_app:process ptrace;
+#line 9
+
+
+#line 10
+typeattribute system_app netdomain;
+#line 10
+
+
+#line 11
+typeattribute system_app binderservicedomain;
+#line 11
+
+
+# android.ui and system.ui
+allow system_app rootfs:dir getattr;
+
+# read/write certain subdirectories of /data/data for system UID apps.
+allow system_app system_app_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_app system_app_data_file:{ file lnk_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read and write to /data/misc/user.
+allow system_app misc_user_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_app misc_user_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access to apex files stored on /data (b/136063500)
+# Needed so that Settings can access NOTICE files inside apex
+# files located in the assets/ directory.
+allow system_app apex_data_file:dir search;
+allow system_app staging_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read wallpaper file.
+allow system_app wallpaper_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read icon file.
+allow system_app icon_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Write to properties
+
+#line 37
+
+#line 37
+allow system_app property_socket:sock_file write;
+#line 37
+allow system_app init:unix_stream_socket connectto;
+#line 37
+
+#line 37
+allow system_app adaptive_haptics_prop:property_service set;
+#line 37
+
+#line 37
+allow system_app adaptive_haptics_prop:file { getattr open read map };
+#line 37
+
+#line 37
+
+
+#line 38
+
+#line 38
+allow system_app property_socket:sock_file write;
+#line 38
+allow system_app init:unix_stream_socket connectto;
+#line 38
+
+#line 38
+allow system_app arm64_memtag_prop:property_service set;
+#line 38
+
+#line 38
+allow system_app arm64_memtag_prop:file { getattr open read map };
+#line 38
+
+#line 38
+
+
+#line 39
+
+#line 39
+allow system_app property_socket:sock_file write;
+#line 39
+allow system_app init:unix_stream_socket connectto;
+#line 39
+
+#line 39
+allow system_app bluetooth_a2dp_offload_prop:property_service set;
+#line 39
+
+#line 39
+allow system_app bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 39
+
+#line 39
+
+
+#line 40
+
+#line 40
+allow system_app property_socket:sock_file write;
+#line 40
+allow system_app init:unix_stream_socket connectto;
+#line 40
+
+#line 40
+allow system_app bluetooth_audio_hal_prop:property_service set;
+#line 40
+
+#line 40
+allow system_app bluetooth_audio_hal_prop:file { getattr open read map };
+#line 40
+
+#line 40
+
+
+#line 41
+
+#line 41
+allow system_app property_socket:sock_file write;
+#line 41
+allow system_app init:unix_stream_socket connectto;
+#line 41
+
+#line 41
+allow system_app bluetooth_prop:property_service set;
+#line 41
+
+#line 41
+allow system_app bluetooth_prop:file { getattr open read map };
+#line 41
+
+#line 41
+
+
+#line 42
+
+#line 42
+allow system_app property_socket:sock_file write;
+#line 42
+allow system_app init:unix_stream_socket connectto;
+#line 42
+
+#line 42
+allow system_app debug_prop:property_service set;
+#line 42
+
+#line 42
+allow system_app debug_prop:file { getattr open read map };
+#line 42
+
+#line 42
+
+
+#line 43
+
+#line 43
+allow system_app property_socket:sock_file write;
+#line 43
+allow system_app init:unix_stream_socket connectto;
+#line 43
+
+#line 43
+allow system_app system_prop:property_service set;
+#line 43
+
+#line 43
+allow system_app system_prop:file { getattr open read map };
+#line 43
+
+#line 43
+
+
+#line 44
+
+#line 44
+allow system_app property_socket:sock_file write;
+#line 44
+allow system_app init:unix_stream_socket connectto;
+#line 44
+
+#line 44
+allow system_app exported_bluetooth_prop:property_service set;
+#line 44
+
+#line 44
+allow system_app exported_bluetooth_prop:file { getattr open read map };
+#line 44
+
+#line 44
+
+
+#line 45
+
+#line 45
+allow system_app property_socket:sock_file write;
+#line 45
+allow system_app init:unix_stream_socket connectto;
+#line 45
+
+#line 45
+allow system_app exported_system_prop:property_service set;
+#line 45
+
+#line 45
+allow system_app exported_system_prop:file { getattr open read map };
+#line 45
+
+#line 45
+
+
+#line 46
+
+#line 46
+allow system_app property_socket:sock_file write;
+#line 46
+allow system_app init:unix_stream_socket connectto;
+#line 46
+
+#line 46
+allow system_app exported3_system_prop:property_service set;
+#line 46
+
+#line 46
+allow system_app exported3_system_prop:file { getattr open read map };
+#line 46
+
+#line 46
+
+
+#line 47
+
+#line 47
+allow system_app property_socket:sock_file write;
+#line 47
+allow system_app init:unix_stream_socket connectto;
+#line 47
+
+#line 47
+allow system_app gesture_prop:property_service set;
+#line 47
+
+#line 47
+allow system_app gesture_prop:file { getattr open read map };
+#line 47
+
+#line 47
+
+
+#line 48
+
+#line 48
+allow system_app property_socket:sock_file write;
+#line 48
+allow system_app init:unix_stream_socket connectto;
+#line 48
+
+#line 48
+allow system_app locale_prop:property_service set;
+#line 48
+
+#line 48
+allow system_app locale_prop:file { getattr open read map };
+#line 48
+
+#line 48
+
+
+#line 49
+
+#line 49
+allow system_app property_socket:sock_file write;
+#line 49
+allow system_app init:unix_stream_socket connectto;
+#line 49
+
+#line 49
+allow system_app logd_prop:property_service set;
+#line 49
+
+#line 49
+allow system_app logd_prop:file { getattr open read map };
+#line 49
+
+#line 49
+
+
+#line 50
+
+#line 50
+allow system_app property_socket:sock_file write;
+#line 50
+allow system_app init:unix_stream_socket connectto;
+#line 50
+
+#line 50
+allow system_app net_radio_prop:property_service set;
+#line 50
+
+#line 50
+allow system_app net_radio_prop:file { getattr open read map };
+#line 50
+
+#line 50
+
+
+#line 51
+
+#line 51
+allow system_app property_socket:sock_file write;
+#line 51
+allow system_app init:unix_stream_socket connectto;
+#line 51
+
+#line 51
+allow system_app timezone_prop:property_service set;
+#line 51
+
+#line 51
+allow system_app timezone_prop:file { getattr open read map };
+#line 51
+
+#line 51
+
+
+#line 52
+
+#line 52
+allow system_app property_socket:sock_file write;
+#line 52
+allow system_app init:unix_stream_socket connectto;
+#line 52
+
+#line 52
+allow system_app usb_control_prop:property_service set;
+#line 52
+
+#line 52
+allow system_app usb_control_prop:file { getattr open read map };
+#line 52
+
+#line 52
+
+
+#line 53
+
+#line 53
+allow system_app property_socket:sock_file write;
+#line 53
+allow system_app init:unix_stream_socket connectto;
+#line 53
+
+#line 53
+allow system_app usb_prop:property_service set;
+#line 53
+
+#line 53
+allow system_app usb_prop:file { getattr open read map };
+#line 53
+
+#line 53
+
+
+#line 54
+
+#line 54
+allow system_app property_socket:sock_file write;
+#line 54
+allow system_app init:unix_stream_socket connectto;
+#line 54
+
+#line 54
+allow system_app log_tag_prop:property_service set;
+#line 54
+
+#line 54
+allow system_app log_tag_prop:file { getattr open read map };
+#line 54
+
+#line 54
+
+
+#line 55
+
+#line 55
+allow system_app property_socket:sock_file write;
+#line 55
+allow system_app init:unix_stream_socket connectto;
+#line 55
+
+#line 55
+allow system_app drm_forcel3_prop:property_service set;
+#line 55
+
+#line 55
+allow system_app drm_forcel3_prop:file { getattr open read map };
+#line 55
+
+#line 55
+
+
+auditallow system_app net_radio_prop:property_service set;
+auditallow system_app usb_control_prop:property_service set;
+auditallow system_app usb_prop:property_service set;
+# Allow Settings to enable Dynamic System Update
+
+#line 61
+
+#line 61
+allow system_app property_socket:sock_file write;
+#line 61
+allow system_app init:unix_stream_socket connectto;
+#line 61
+
+#line 61
+allow system_app dynamic_system_prop:property_service set;
+#line 61
+
+#line 61
+allow system_app dynamic_system_prop:file { getattr open read map };
+#line 61
+
+#line 61
+
+
+# ctl interface
+
+#line 64
+
+#line 64
+allow system_app property_socket:sock_file write;
+#line 64
+allow system_app init:unix_stream_socket connectto;
+#line 64
+
+#line 64
+allow system_app ctl_default_prop:property_service set;
+#line 64
+
+#line 64
+allow system_app ctl_default_prop:file { getattr open read map };
+#line 64
+
+#line 64
+
+
+#line 65
+
+#line 65
+allow system_app property_socket:sock_file write;
+#line 65
+allow system_app init:unix_stream_socket connectto;
+#line 65
+
+#line 65
+allow system_app ctl_bugreport_prop:property_service set;
+#line 65
+
+#line 65
+allow system_app ctl_bugreport_prop:file { getattr open read map };
+#line 65
+
+#line 65
+
+
+# Allow developer settings to query gsid status
+
+#line 68
+allow system_app gsid_prop:file { getattr open read map };
+#line 68
+
+
+# Allow developer settings to check 16k pages boot option status
+
+#line 71
+allow system_app enable_16k_pages_prop:file { getattr open read map };
+#line 71
+
+
+# Allow developer settings to check virtualization capabilities
+
+#line 74
+allow system_app hypervisor_prop:file { getattr open read map };
+#line 74
+
+
+# Create /data/anr/traces.txt.
+allow system_app anr_data_file:dir { { open getattr read search ioctl lock watch watch_reads } add_name write };
+allow system_app anr_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Settings need to access app name and icon from asec
+allow system_app asec_apk_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow system apps (like Settings) to interact with statsd
+
+#line 84
+# Call the server domain and optionally transfer references to it.
+#line 84
+allow system_app statsd:binder { call transfer };
+#line 84
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 84
+allow statsd system_app:binder transfer;
+#line 84
+# Receive and use open files from the server.
+#line 84
+allow system_app statsd:fd use;
+#line 84
+
+
+# Allow system apps to interact with incidentd
+
+#line 87
+# Call the server domain and optionally transfer references to it.
+#line 87
+allow system_app incidentd:binder { call transfer };
+#line 87
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 87
+allow incidentd system_app:binder transfer;
+#line 87
+# Receive and use open files from the server.
+#line 87
+allow system_app incidentd:fd use;
+#line 87
+
+
+# Allow system apps (Settings) to call into update_engine
+# in order to apply update to switch from 4k kernel to 16K and vice-versa
+
+#line 91
+# Call the servicemanager and transfer references to it.
+#line 91
+allow system_app servicemanager:binder { call transfer };
+#line 91
+# Allow servicemanager to send out callbacks
+#line 91
+allow servicemanager system_app:binder { call transfer };
+#line 91
+# servicemanager performs getpidcon on clients.
+#line 91
+allow servicemanager system_app:dir search;
+#line 91
+allow servicemanager system_app:file { read open };
+#line 91
+allow servicemanager system_app:process getattr;
+#line 91
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 91
+# all domains in domain.te.
+#line 91
+
+allow system_app update_engine_stable_service:service_manager find;
+
+#line 93
+# Call the server domain and optionally transfer references to it.
+#line 93
+allow system_app update_engine:binder { call transfer };
+#line 93
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 93
+allow update_engine system_app:binder transfer;
+#line 93
+# Receive and use open files from the server.
+#line 93
+allow system_app update_engine:fd use;
+#line 93
+
+
+# Allow system app to interact with Dumpstate HAL
+
+#line 96
+typeattribute system_app halclientdomain;
+#line 96
+typeattribute system_app hal_dumpstate_client;
+#line 96
+
+#line 96
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 96
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 96
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 96
+
+#line 96
+typeattribute system_app hal_dumpstate;
+#line 96
+# Find passthrough HAL implementations
+#line 96
+allow hal_dumpstate system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 96
+allow hal_dumpstate vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 96
+allow hal_dumpstate vendor_file:file { read open getattr execute map };
+#line 96
+
+#line 96
+
+
+allow system_app servicemanager:service_manager list;
+# TODO: scope this down? Too broad?
+allow system_app {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -dumpstate_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -system_suspend_control_internal_service
+ -system_suspend_control_service
+ -tracingproxy_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+}:service_manager find;
+# suppress denials for services system_app should not be accessing.
+dontaudit system_app {
+ dnsresolver_service
+ dumpstate_service
+ installd_service
+ mdns_service
+ netd_service
+ virtual_touchpad_service
+ vold_service
+}:service_manager find;
+
+# suppress denials caused by debugfs_tracing
+dontaudit system_app debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Ignore access to memory properties for Settings.
+dontaudit system_app proc_pagetypeinfo:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit system_app sysfs_zram:dir search;
+
+allow system_app keystore:keystore2_key {
+ delete
+ get_info
+ grant
+ rebind
+ update
+ use
+};
+
+# Allow Settings to manage WI-FI keys.
+allow system_app wifi_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# settings app reads /proc/version
+allow system_app {
+ proc_version
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow system apps to modify cgroup attributes and migrate processes
+allow system_app cgroup:file { open append write lock map };
+allow system_app cgroup_v2:file { open append write lock map };
+allow system_app cgroup_v2:dir { open search write add_name remove_name lock };
+
+
+#line 162
+# Group AID_LOG checked by filesystem & logd
+#line 162
+# to permit control commands
+#line 162
+
+#line 162
+allow system_app logd_socket:sock_file write;
+#line 162
+allow system_app logd:unix_stream_socket connectto;
+#line 162
+
+#line 162
+
+
+#line 163
+allow system_app runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 163
+
+
+#line 164
+allow system_app device_logging_prop:file { getattr open read map };
+#line 164
+
+
+# allow system apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow system_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow system apps to read game manager related sysrops
+
+#line 172
+allow system_app game_manager_config_prop:file { getattr open read map };
+#line 172
+
+
+# Settings app reads ro.oem_unlock_supported
+
+#line 175
+allow system_app oem_unlock_prop:file { getattr open read map };
+#line 175
+
+
+# Settings app reads ro.usb.uvc.enabled
+
+#line 178
+allow system_app usb_uvc_enabled_prop:file { getattr open read map };
+#line 178
+
+
+# Settings app reads and writes the wifi blob database
+allow system_app connectivityblob_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_app connectivityblob_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+###
+### Neverallow rules
+###
+
+# app domains which access /dev/fuse should not run as system_app
+neverallow system_app fuse_device:chr_file *;
+
+# Apps which run as UID=system should not rely on any attacker controlled
+# filesystem locations, such as /data/local/tmp. For /data/local/tmp, we
+# allow writes to files passed by file descriptor to support dumpstate and
+# bug reports, but not reads.
+neverallow system_app shell_data_file:dir { { add_name create link relabelfrom remove_name rename reparent rmdir setattr write } open search read };
+neverallow system_app shell_data_file:file { open read ioctl lock };
+
+# system_app should be the only domain writing the adaptive haptics prop
+neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set;
+# system_app should be the only domain writing the force l3 prop
+neverallow { domain -init -system_app } drm_forcel3_prop:property_service set;
+
+allow system_app vendor_boot_ota_file:dir { { open getattr read search ioctl lock watch watch_reads } };
+allow system_app vendor_boot_ota_file:file { { getattr open read ioctl lock map watch watch_reads } };
+
+# allow system_app to read system_dlkm_file for /system_dlkm/etc/NOTICE.xml.gz
+allow system_app system_dlkm_file:dir search;
+allow system_app system_dlkm_file:file { getattr open read };
+#line 1 "system/sepolicy/private/system_server.te"
+#
+# System Server aka system_server spawned by zygote.
+# Most of the framework services run in this process.
+#
+
+typeattribute system_server coredomain;
+typeattribute system_server mlstrustedsubject;
+typeattribute system_server remote_provisioning_service_server;
+typeattribute system_server scheduler_service_server;
+typeattribute system_server sensor_service_server;
+typeattribute system_server stats_service_server;
+typeattribute system_server bpfdomain;
+
+# Define a type for tmpfs-backed ashmem regions.
+
+#line 15
+type_transition system_server tmpfs:file system_server_tmpfs;
+#line 15
+allow system_server system_server_tmpfs:file { read write getattr map };
+#line 15
+
+
+
+#line 17
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 17
+type system_server_userfaultfd;
+#line 17
+type_transition system_server system_server:anon_inode system_server_userfaultfd "[userfaultfd]";
+#line 17
+# Allow domain to create/use userfaultfd anon_inode.
+#line 17
+allow system_server system_server_userfaultfd:anon_inode { create ioctl read };
+#line 17
+# Suppress errors generate during bugreport
+#line 17
+dontaudit su system_server_userfaultfd:anon_inode *;
+#line 17
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 17
+neverallow { domain -system_server } system_server_userfaultfd:anon_inode *;
+#line 17
+
+
+# Create a socket for connections from crash_dump.
+type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
+
+# Create a socket for connections from zygotes.
+type_transition system_server system_data_file:sock_file system_unsolzygote_socket "unsolzygotesocket";
+
+allow system_server zygote_tmpfs:file { map read };
+allow system_server appdomain_tmpfs:file { getattr map read write };
+
+# For Incremental Service to check if incfs is available
+allow system_server proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+# To create files, get permission to fill blocks, and configure Incremental File System
+allow system_server incremental_control_file:file { ioctl { getattr open read ioctl lock map watch watch_reads } };
+allowxperm system_server incremental_control_file:file ioctl {
+ 0x0000671e
+ 0x00006723
+ 0x00006721
+ 0x00006725
+ 0x00006726
+ 0x00006727
+};
+
+# To get signature of an APK installed on Incremental File System, and fill in data
+# blocks and get the filesystem state
+allowxperm system_server apk_data_file:file ioctl {
+ 0x0000671f
+ 0x00006720
+ 0x00006722
+ 0x00006724
+ 0xf50c
+ 0xf511
+ 0xf518
+ 0xf517
+ 0xf512
+ 0xf513
+ 0x40086602
+ 0x80086601
+};
+
+allowxperm system_server apk_tmp_file:file ioctl {
+ 0xf512
+ 0x80086601
+};
+
+# For Incremental Service to check incfs metrics
+allow system_server sysfs_fs_incfs_metrics:file { getattr open read ioctl lock map watch watch_reads };
+
+# For f2fs-compression support
+allow system_server sysfs_fs_f2fs:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server sysfs_fs_f2fs:file { getattr open read ioctl lock map watch watch_reads };
+
+# For SdkSandboxManagerService
+allow system_server sdk_sandbox_system_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# For art.
+allow system_server { apex_art_data_file dalvikcache_data_file }:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server { apex_art_data_file dalvikcache_data_file }:file { getattr open read ioctl lock map watch watch_reads };
+
+# Ignore the denial on `system@framework@com.android.location.provider.jar@classes.odex`.
+# `com.android.location.provider.jar` happens to be both a jar on system server classpath and a
+# shared library used by a system server app. The odex file is loaded fine by Zygote when it forks
+# system_server. It fails to be loaded when the jar is used as a shared library, which is expected.
+dontaudit system_server apex_art_data_file:file execute;
+
+# For release odex/vdex compress blocks
+allowxperm system_server dalvikcache_data_file:file ioctl {
+ 0xf512
+ 0x80086601
+};
+
+# When running system server under --invoke-with, we'll try to load the boot image under the
+# system server domain, following links to the system partition.
+
+
+# /data/resource-cache
+allow system_server resourcecache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow system_server resourcecache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# ptrace to processes in the same domain for debugging crashes.
+allow system_server self:process ptrace;
+
+# Child of the zygote.
+allow system_server zygote:fd use;
+allow system_server zygote:process sigchld;
+
+# May kill zygote (or its child processes) on crashes.
+allow system_server {
+ app_zygote
+ crash_dump
+ crosvm
+ virtualizationmanager
+ webview_zygote
+ zygote
+}:process { getpgid sigkill signull };
+
+# Read /system/bin/app_process.
+allow system_server zygote_exec:file { getattr open read ioctl lock map watch watch_reads };
+
+# Needed to close the zygote socket, which involves getopt / getattr
+allow system_server zygote:unix_stream_socket { getopt getattr };
+
+# system server gets network and bluetooth permissions.
+
+#line 122
+typeattribute system_server netdomain;
+#line 122
+
+# in addition to ioctls allowlisted for all domains, also allow system_server
+# to use privileged ioctls commands. Needed to set up VPNs.
+allowxperm system_server self:udp_socket ioctl
+#line 125
+{
+#line 125
+# qualcomm rmnet ioctls
+#line 125
+0x00006900 0x00006902
+#line 125
+# socket ioctls
+#line 125
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 125
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 125
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 125
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 125
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 125
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 125
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 125
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 125
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 125
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 125
+# device and protocol specific ioctls
+#line 125
+0x000089f0-0x000089ff
+#line 125
+0x000089e0-0x000089ef
+#line 125
+# Wireless extension ioctls
+#line 125
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 125
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 125
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 125
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 125
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 125
+0x00008b34 0x00008b35 0x00008b36
+#line 125
+# Dev private ioctl i.e. hardware specific ioctls
+#line 125
+0x00008be0-0x00008bff
+#line 125
+};
+
+#line 126
+typeattribute system_server bluetoothdomain;
+#line 126
+
+
+# Allow setup of tcp keepalive offload. This gives system_server the permission to
+# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to
+# be granted individually, except for a small set of safe values allowlisted in
+# public/domain.te.
+allow system_server appdomain:tcp_socket ioctl;
+
+# These are the capabilities assigned by the zygote to the
+# system server.
+allow system_server self:{ capability cap_userns } {
+ ipc_lock
+ kill
+ net_admin
+ net_bind_service
+ net_broadcast
+ net_raw
+ sys_boot
+ sys_nice
+ sys_ptrace
+ sys_time
+ sys_tty_config
+};
+
+# Allow alarmtimers to be set
+allow system_server self:{ capability2 cap2_userns } wake_alarm;
+
+# Create and share netlink_netfilter_sockets for tetheroffload.
+allow system_server self:netlink_netfilter_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps.
+allow system_server self:netlink_tcpdiag_socket
+ { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_read nlmsg_write };
+
+# Use netlink uevent sockets.
+allow system_server self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+allow system_server self:netlink_nflog_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Use generic netlink sockets.
+allow system_server self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow system_server self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# libvintf reads the kernel config to verify vendor interface compatibility.
+allow system_server config_gz:file { read open };
+
+# Use generic "sockets" where the address family is not known
+# to the kernel. The ioctl permission is specifically omitted here, but may
+# be added to device specific policy along with the ioctl commands to be
+# allowlisted.
+allow system_server self:socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Set and get routes directly via netlink.
+allow system_server self:netlink_route_socket nlmsg_write;
+
+# Use XFRM (IPsec) netlink sockets
+allow system_server self:netlink_xfrm_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } nlmsg_write nlmsg_read };
+
+# Kill apps.
+allow system_server appdomain:process { getpgid sigkill signal };
+# signull allowed for kill(pid, 0) existence test.
+allow system_server appdomain:process { signull };
+
+# Set scheduling info for apps.
+allow system_server appdomain:process { getsched setsched };
+allow system_server audioserver:process { getsched setsched };
+allow system_server hal_audio:process { getsched setsched };
+allow system_server hal_bluetooth:process { getsched setsched };
+allow system_server hal_codec2_server:process { getsched setsched };
+allow system_server hal_omx_server:process { getsched setsched };
+allow system_server mediaswcodec:process { getsched setsched };
+allow system_server cameraserver:process { getsched setsched };
+allow system_server hal_camera:process { getsched setsched };
+allow system_server mediaserver:process { getsched setsched };
+allow system_server bootanim:process { getsched setsched };
+# Set scheduling info for VMs (b/375058190)
+allow system_server { virtualizationmanager crosvm }:process { getsched setsched };
+
+# Set scheduling info for psi monitor thread.
+# TODO: delete this line b/131761776
+allow system_server kernel:process { getsched setsched };
+
+# Allow system_server to write to /proc/<pid>/*
+allow system_server domain:file { open append write lock map };
+
+# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
+# within system_server to keep track of memory and CPU usage for
+# all processes on the device. In addition, /proc/pid files access is needed
+# for dumping stack traces of native processes.
+
+#line 215
+allow system_server domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 215
+allow system_server domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 215
+
+
+# Write /proc/uid_cputime/remove_uid_range.
+allow system_server proc_uid_cputime_removeuid:file { { open append write lock map } getattr };
+
+# Write /proc/uid_procstat/set.
+allow system_server proc_uid_procstat_set:file { { open append write lock map } getattr };
+
+# Write to /proc/sysrq-trigger.
+allow system_server proc_sysrq:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Delete /data/misc/stats-service/ directories.
+allow system_server stats_config_data_file:dir { open read remove_name search write };
+allow system_server stats_config_data_file:file unlink;
+
+# Read metric file & upload to statsd
+allow system_server odsign_data_file:dir search;
+allow system_server odsign_metrics_file:dir { { open getattr read search ioctl lock watch watch_reads } write remove_name };
+allow system_server odsign_metrics_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+
+# Read /sys/kernel/debug/wakeup_sources.
+
+#line 236
+ allow system_server debugfs_wakeup_sources:file { getattr open read ioctl lock map watch watch_reads };
+#line 238
+
+
+# Read /sys/kernel/ion/*.
+allow system_server sysfs_ion:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /sys/kernel/dma_heap/*.
+allow system_server sysfs_dma_heap:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /sys/kernel/mm/cma/*.
+
+#line 247
+allow system_server sysfs_cma:file { getattr open read ioctl lock map watch watch_reads };
+#line 249
+
+
+# Allow reading DMA-BUF sysfs stats from /sys/kernel/dmabuf.
+allow system_server sysfs_dmabuf_stats:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server sysfs_dmabuf_stats:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow ActivityManager to look at the list of DMA-BUF heaps from /dev/dma_heap
+# for dumpsys meminfo
+allow system_server dmabuf_heap_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow reading /proc/vmstat for the oom kill count
+allow system_server proc_vmstat:file { getattr open read ioctl lock map watch watch_reads };
+
+# The DhcpClient and WifiWatchdog use packet_sockets
+allow system_server self:packet_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# 3rd party VPN clients require a tun_socket to be created
+allow system_server self:tun_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+# Talk to init and various daemons via sockets.
+
+#line 269
+allow system_server lmkd_socket:sock_file write;
+#line 269
+allow system_server lmkd:unix_stream_socket connectto;
+#line 269
+
+
+#line 270
+allow system_server zygote_socket:sock_file write;
+#line 270
+allow system_server zygote:unix_stream_socket connectto;
+#line 270
+
+
+#line 271
+allow system_server uncrypt_socket:sock_file write;
+#line 271
+allow system_server uncrypt:unix_stream_socket connectto;
+#line 271
+
+
+# Allow system_server to write to statsd.
+
+#line 274
+allow system_server statsdw_socket:sock_file write;
+#line 274
+allow system_server statsd:unix_dgram_socket sendto;
+#line 274
+
+
+# Communicate over a socket created by surfaceflinger.
+allow system_server surfaceflinger:unix_stream_socket { read write setopt };
+
+allow system_server gpuservice:unix_stream_socket { read write setopt };
+
+# Communicate over a socket created by webview_zygote.
+allow system_server webview_zygote:unix_stream_socket { read write connectto setopt };
+
+# Communicate over a socket created by app_zygote.
+allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
+
+# Perform Binder IPC.
+
+#line 288
+# Call the servicemanager and transfer references to it.
+#line 288
+allow system_server servicemanager:binder { call transfer };
+#line 288
+# Allow servicemanager to send out callbacks
+#line 288
+allow servicemanager system_server:binder { call transfer };
+#line 288
+# servicemanager performs getpidcon on clients.
+#line 288
+allow servicemanager system_server:dir search;
+#line 288
+allow servicemanager system_server:file { read open };
+#line 288
+allow servicemanager system_server:process getattr;
+#line 288
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 288
+# all domains in domain.te.
+#line 288
+
+
+#line 289
+# Call the server domain and optionally transfer references to it.
+#line 289
+allow system_server appdomain:binder { call transfer };
+#line 289
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 289
+allow appdomain system_server:binder transfer;
+#line 289
+# Receive and use open files from the server.
+#line 289
+allow system_server appdomain:fd use;
+#line 289
+
+
+#line 290
+# Call the server domain and optionally transfer references to it.
+#line 290
+allow system_server artd:binder { call transfer };
+#line 290
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 290
+allow artd system_server:binder transfer;
+#line 290
+# Receive and use open files from the server.
+#line 290
+allow system_server artd:fd use;
+#line 290
+
+
+#line 291
+# Call the server domain and optionally transfer references to it.
+#line 291
+allow system_server binderservicedomain:binder { call transfer };
+#line 291
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 291
+allow binderservicedomain system_server:binder transfer;
+#line 291
+# Receive and use open files from the server.
+#line 291
+allow system_server binderservicedomain:fd use;
+#line 291
+
+
+#line 292
+# Call the server domain and optionally transfer references to it.
+#line 292
+allow system_server composd:binder { call transfer };
+#line 292
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 292
+allow composd system_server:binder transfer;
+#line 292
+# Receive and use open files from the server.
+#line 292
+allow system_server composd:fd use;
+#line 292
+
+
+#line 293
+# Call the server domain and optionally transfer references to it.
+#line 293
+allow system_server dexopt_chroot_setup:binder { call transfer };
+#line 293
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 293
+allow dexopt_chroot_setup system_server:binder transfer;
+#line 293
+# Receive and use open files from the server.
+#line 293
+allow system_server dexopt_chroot_setup:fd use;
+#line 293
+
+
+#line 294
+# Call the server domain and optionally transfer references to it.
+#line 294
+allow system_server dumpstate:binder { call transfer };
+#line 294
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 294
+allow dumpstate system_server:binder transfer;
+#line 294
+# Receive and use open files from the server.
+#line 294
+allow system_server dumpstate:fd use;
+#line 294
+
+
+#line 295
+# Call the server domain and optionally transfer references to it.
+#line 295
+allow system_server fingerprintd:binder { call transfer };
+#line 295
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 295
+allow fingerprintd system_server:binder transfer;
+#line 295
+# Receive and use open files from the server.
+#line 295
+allow system_server fingerprintd:fd use;
+#line 295
+
+
+#line 296
+# Call the server domain and optionally transfer references to it.
+#line 296
+allow system_server gatekeeperd:binder { call transfer };
+#line 296
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 296
+allow gatekeeperd system_server:binder transfer;
+#line 296
+# Receive and use open files from the server.
+#line 296
+allow system_server gatekeeperd:fd use;
+#line 296
+
+
+#line 297
+# Call the server domain and optionally transfer references to it.
+#line 297
+allow system_server gpuservice:binder { call transfer };
+#line 297
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 297
+allow gpuservice system_server:binder transfer;
+#line 297
+# Receive and use open files from the server.
+#line 297
+allow system_server gpuservice:fd use;
+#line 297
+
+
+#line 298
+# Call the server domain and optionally transfer references to it.
+#line 298
+allow system_server idmap:binder { call transfer };
+#line 298
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 298
+allow idmap system_server:binder transfer;
+#line 298
+# Receive and use open files from the server.
+#line 298
+allow system_server idmap:fd use;
+#line 298
+
+
+#line 299
+# Call the server domain and optionally transfer references to it.
+#line 299
+allow system_server installd:binder { call transfer };
+#line 299
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 299
+allow installd system_server:binder transfer;
+#line 299
+# Receive and use open files from the server.
+#line 299
+allow system_server installd:fd use;
+#line 299
+
+
+#line 300
+# Call the server domain and optionally transfer references to it.
+#line 300
+allow system_server incidentd:binder { call transfer };
+#line 300
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 300
+allow incidentd system_server:binder transfer;
+#line 300
+# Receive and use open files from the server.
+#line 300
+allow system_server incidentd:fd use;
+#line 300
+
+
+#line 301
+# Call the server domain and optionally transfer references to it.
+#line 301
+allow system_server mmd:binder { call transfer };
+#line 301
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 301
+allow mmd system_server:binder transfer;
+#line 301
+# Receive and use open files from the server.
+#line 301
+allow system_server mmd:fd use;
+#line 301
+
+
+#line 302
+# Call the server domain and optionally transfer references to it.
+#line 302
+allow system_server netd:binder { call transfer };
+#line 302
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 302
+allow netd system_server:binder transfer;
+#line 302
+# Receive and use open files from the server.
+#line 302
+allow system_server netd:fd use;
+#line 302
+
+
+#line 303
+# Call the server domain and optionally transfer references to it.
+#line 303
+allow system_server ot_daemon:binder { call transfer };
+#line 303
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 303
+allow ot_daemon system_server:binder transfer;
+#line 303
+# Receive and use open files from the server.
+#line 303
+allow system_server ot_daemon:fd use;
+#line 303
+
+
+
+#line 305
+# Call the server domain and optionally transfer references to it.
+#line 305
+allow system_server statsd:binder { call transfer };
+#line 305
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 305
+allow statsd system_server:binder transfer;
+#line 305
+# Receive and use open files from the server.
+#line 305
+allow system_server statsd:fd use;
+#line 305
+
+
+#line 306
+# Call the server domain and optionally transfer references to it.
+#line 306
+allow system_server storaged:binder { call transfer };
+#line 306
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 306
+allow storaged system_server:binder transfer;
+#line 306
+# Receive and use open files from the server.
+#line 306
+allow system_server storaged:fd use;
+#line 306
+
+
+#line 307
+# Call the server domain and optionally transfer references to it.
+#line 307
+allow system_server update_engine:binder { call transfer };
+#line 307
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 307
+allow update_engine system_server:binder transfer;
+#line 307
+# Receive and use open files from the server.
+#line 307
+allow system_server update_engine:fd use;
+#line 307
+
+
+#line 308
+# Call the server domain and optionally transfer references to it.
+#line 308
+allow system_server virtual_camera:binder { call transfer };
+#line 308
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 308
+allow virtual_camera system_server:binder transfer;
+#line 308
+# Receive and use open files from the server.
+#line 308
+allow system_server virtual_camera:fd use;
+#line 308
+
+
+#line 309
+# Call the server domain and optionally transfer references to it.
+#line 309
+allow system_server vold:binder { call transfer };
+#line 309
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 309
+allow vold system_server:binder transfer;
+#line 309
+# Receive and use open files from the server.
+#line 309
+allow system_server vold:fd use;
+#line 309
+
+
+#line 310
+# Call the server domain and optionally transfer references to it.
+#line 310
+allow system_server logd:binder { call transfer };
+#line 310
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 310
+allow logd system_server:binder transfer;
+#line 310
+# Receive and use open files from the server.
+#line 310
+allow system_server logd:fd use;
+#line 310
+
+
+#line 311
+# Call the server domain and optionally transfer references to it.
+#line 311
+allow system_server wificond:binder { call transfer };
+#line 311
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 311
+allow wificond system_server:binder transfer;
+#line 311
+# Receive and use open files from the server.
+#line 311
+allow system_server wificond:fd use;
+#line 311
+
+
+#line 312
+# Call the server domain and optionally transfer references to it.
+#line 312
+allow system_server uprobestats:binder { call transfer };
+#line 312
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 312
+allow uprobestats system_server:binder transfer;
+#line 312
+# Receive and use open files from the server.
+#line 312
+allow system_server uprobestats:fd use;
+#line 312
+
+
+#line 313
+# Call the server domain and optionally transfer references to it.
+#line 313
+allow system_server wifi_mainline_supplicant:binder { call transfer };
+#line 313
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 313
+allow wifi_mainline_supplicant system_server:binder transfer;
+#line 313
+# Receive and use open files from the server.
+#line 313
+allow system_server wifi_mainline_supplicant:fd use;
+#line 313
+
+
+#line 314
+typeattribute system_server binderservicedomain;
+#line 314
+
+
+# Use HALs
+
+#line 317
+typeattribute system_server halclientdomain;
+#line 317
+typeattribute system_server hal_allocator_client;
+#line 317
+
+#line 317
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 317
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 317
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 317
+
+#line 317
+typeattribute system_server hal_allocator;
+#line 317
+# Find passthrough HAL implementations
+#line 317
+allow hal_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 317
+allow hal_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 317
+allow hal_allocator vendor_file:file { read open getattr execute map };
+#line 317
+
+#line 317
+
+
+#line 318
+typeattribute system_server halclientdomain;
+#line 318
+typeattribute system_server hal_audio_client;
+#line 318
+
+#line 318
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 318
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 318
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 318
+
+#line 318
+typeattribute system_server hal_audio;
+#line 318
+# Find passthrough HAL implementations
+#line 318
+allow hal_audio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 318
+allow hal_audio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 318
+allow hal_audio vendor_file:file { read open getattr execute map };
+#line 318
+
+#line 318
+
+
+#line 319
+typeattribute system_server halclientdomain;
+#line 319
+typeattribute system_server hal_authgraph_client;
+#line 319
+
+#line 319
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 319
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 319
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 319
+
+#line 319
+typeattribute system_server hal_authgraph;
+#line 319
+# Find passthrough HAL implementations
+#line 319
+allow hal_authgraph system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 319
+allow hal_authgraph vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 319
+allow hal_authgraph vendor_file:file { read open getattr execute map };
+#line 319
+
+#line 319
+
+
+#line 320
+typeattribute system_server halclientdomain;
+#line 320
+typeattribute system_server hal_authsecret_client;
+#line 320
+
+#line 320
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 320
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 320
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 320
+
+#line 320
+typeattribute system_server hal_authsecret;
+#line 320
+# Find passthrough HAL implementations
+#line 320
+allow hal_authsecret system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 320
+allow hal_authsecret vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 320
+allow hal_authsecret vendor_file:file { read open getattr execute map };
+#line 320
+
+#line 320
+
+
+#line 321
+typeattribute system_server halclientdomain;
+#line 321
+typeattribute system_server hal_bluetooth_client;
+#line 321
+
+#line 321
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 321
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 321
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 321
+
+#line 321
+typeattribute system_server hal_bluetooth;
+#line 321
+# Find passthrough HAL implementations
+#line 321
+allow hal_bluetooth system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 321
+allow hal_bluetooth vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 321
+allow hal_bluetooth vendor_file:file { read open getattr execute map };
+#line 321
+
+#line 321
+
+
+#line 322
+typeattribute system_server halclientdomain;
+#line 322
+typeattribute system_server hal_broadcastradio_client;
+#line 322
+
+#line 322
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 322
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 322
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 322
+
+#line 322
+typeattribute system_server hal_broadcastradio;
+#line 322
+# Find passthrough HAL implementations
+#line 322
+allow hal_broadcastradio system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 322
+allow hal_broadcastradio vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 322
+allow hal_broadcastradio vendor_file:file { read open getattr execute map };
+#line 322
+
+#line 322
+
+
+#line 323
+typeattribute system_server halclientdomain;
+#line 323
+typeattribute system_server hal_codec2_client;
+#line 323
+
+#line 323
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 323
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 323
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 323
+
+#line 323
+typeattribute system_server hal_codec2;
+#line 323
+# Find passthrough HAL implementations
+#line 323
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 323
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 323
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 323
+
+#line 323
+
+
+#line 324
+typeattribute system_server halclientdomain;
+#line 324
+typeattribute system_server hal_configstore_client;
+#line 324
+
+#line 324
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 324
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 324
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 324
+
+#line 324
+typeattribute system_server hal_configstore;
+#line 324
+# Find passthrough HAL implementations
+#line 324
+allow hal_configstore system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 324
+allow hal_configstore vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 324
+allow hal_configstore vendor_file:file { read open getattr execute map };
+#line 324
+
+#line 324
+
+
+#line 325
+typeattribute system_server halclientdomain;
+#line 325
+typeattribute system_server hal_contexthub_client;
+#line 325
+
+#line 325
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 325
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 325
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 325
+
+#line 325
+typeattribute system_server hal_contexthub;
+#line 325
+# Find passthrough HAL implementations
+#line 325
+allow hal_contexthub system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 325
+allow hal_contexthub vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 325
+allow hal_contexthub vendor_file:file { read open getattr execute map };
+#line 325
+
+#line 325
+
+
+#line 326
+typeattribute system_server halclientdomain;
+#line 326
+typeattribute system_server hal_face_client;
+#line 326
+
+#line 326
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 326
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 326
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 326
+
+#line 326
+typeattribute system_server hal_face;
+#line 326
+# Find passthrough HAL implementations
+#line 326
+allow hal_face system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 326
+allow hal_face vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 326
+allow hal_face vendor_file:file { read open getattr execute map };
+#line 326
+
+#line 326
+
+
+#line 327
+typeattribute system_server halclientdomain;
+#line 327
+typeattribute system_server hal_fingerprint_client;
+#line 327
+
+#line 327
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 327
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 327
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 327
+
+#line 327
+typeattribute system_server hal_fingerprint;
+#line 327
+# Find passthrough HAL implementations
+#line 327
+allow hal_fingerprint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 327
+allow hal_fingerprint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 327
+allow hal_fingerprint vendor_file:file { read open getattr execute map };
+#line 327
+
+#line 327
+
+
+#line 328
+typeattribute system_server halclientdomain;
+#line 328
+typeattribute system_server hal_gnss_client;
+#line 328
+
+#line 328
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 328
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 328
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 328
+
+#line 328
+typeattribute system_server hal_gnss;
+#line 328
+# Find passthrough HAL implementations
+#line 328
+allow hal_gnss system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 328
+allow hal_gnss vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 328
+allow hal_gnss vendor_file:file { read open getattr execute map };
+#line 328
+
+#line 328
+
+
+#line 329
+typeattribute system_server halclientdomain;
+#line 329
+typeattribute system_server hal_graphics_allocator_client;
+#line 329
+
+#line 329
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 329
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 329
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 329
+
+#line 329
+typeattribute system_server hal_graphics_allocator;
+#line 329
+# Find passthrough HAL implementations
+#line 329
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 329
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 329
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 329
+
+#line 329
+
+
+#line 330
+typeattribute system_server halclientdomain;
+#line 330
+typeattribute system_server hal_health_client;
+#line 330
+
+#line 330
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 330
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 330
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 330
+
+#line 330
+typeattribute system_server hal_health;
+#line 330
+# Find passthrough HAL implementations
+#line 330
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 330
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 330
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 330
+
+#line 330
+
+
+#line 331
+typeattribute system_server halclientdomain;
+#line 331
+typeattribute system_server hal_input_classifier_client;
+#line 331
+
+#line 331
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 331
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 331
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 331
+
+#line 331
+typeattribute system_server hal_input_classifier;
+#line 331
+# Find passthrough HAL implementations
+#line 331
+allow hal_input_classifier system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 331
+allow hal_input_classifier vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 331
+allow hal_input_classifier vendor_file:file { read open getattr execute map };
+#line 331
+
+#line 331
+
+
+#line 332
+typeattribute system_server halclientdomain;
+#line 332
+typeattribute system_server hal_input_processor_client;
+#line 332
+
+#line 332
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 332
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 332
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 332
+
+#line 332
+typeattribute system_server hal_input_processor;
+#line 332
+# Find passthrough HAL implementations
+#line 332
+allow hal_input_processor system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 332
+allow hal_input_processor vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 332
+allow hal_input_processor vendor_file:file { read open getattr execute map };
+#line 332
+
+#line 332
+
+
+#line 333
+typeattribute system_server halclientdomain;
+#line 333
+typeattribute system_server hal_ir_client;
+#line 333
+
+#line 333
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 333
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 333
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 333
+
+#line 333
+typeattribute system_server hal_ir;
+#line 333
+# Find passthrough HAL implementations
+#line 333
+allow hal_ir system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 333
+allow hal_ir vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 333
+allow hal_ir vendor_file:file { read open getattr execute map };
+#line 333
+
+#line 333
+
+
+#line 334
+typeattribute system_server halclientdomain;
+#line 334
+typeattribute system_server hal_keymint_client;
+#line 334
+
+#line 334
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 334
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 334
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 334
+
+#line 334
+typeattribute system_server hal_keymint;
+#line 334
+# Find passthrough HAL implementations
+#line 334
+allow hal_keymint system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 334
+allow hal_keymint vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 334
+allow hal_keymint vendor_file:file { read open getattr execute map };
+#line 334
+
+#line 334
+
+
+#line 335
+typeattribute system_server halclientdomain;
+#line 335
+typeattribute system_server hal_light_client;
+#line 335
+
+#line 335
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 335
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 335
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 335
+
+#line 335
+typeattribute system_server hal_light;
+#line 335
+# Find passthrough HAL implementations
+#line 335
+allow hal_light system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 335
+allow hal_light vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 335
+allow hal_light vendor_file:file { read open getattr execute map };
+#line 335
+
+#line 335
+
+
+#line 336
+typeattribute system_server halclientdomain;
+#line 336
+typeattribute system_server hal_mediaquality_client;
+#line 336
+
+#line 336
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 336
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 336
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 336
+
+#line 336
+typeattribute system_server hal_mediaquality;
+#line 336
+# Find passthrough HAL implementations
+#line 336
+allow hal_mediaquality system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 336
+allow hal_mediaquality vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 336
+allow hal_mediaquality vendor_file:file { read open getattr execute map };
+#line 336
+
+#line 336
+
+
+#line 337
+typeattribute system_server halclientdomain;
+#line 337
+typeattribute system_server hal_memtrack_client;
+#line 337
+
+#line 337
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 337
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 337
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 337
+
+#line 337
+typeattribute system_server hal_memtrack;
+#line 337
+# Find passthrough HAL implementations
+#line 337
+allow hal_memtrack system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 337
+allow hal_memtrack vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 337
+allow hal_memtrack vendor_file:file { read open getattr execute map };
+#line 337
+
+#line 337
+
+
+#line 338
+typeattribute system_server halclientdomain;
+#line 338
+typeattribute system_server hal_neuralnetworks_client;
+#line 338
+
+#line 338
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 338
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 338
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 338
+
+#line 338
+typeattribute system_server hal_neuralnetworks;
+#line 338
+# Find passthrough HAL implementations
+#line 338
+allow hal_neuralnetworks system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 338
+allow hal_neuralnetworks vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 338
+allow hal_neuralnetworks vendor_file:file { read open getattr execute map };
+#line 338
+
+#line 338
+
+
+#line 339
+typeattribute system_server halclientdomain;
+#line 339
+typeattribute system_server hal_oemlock_client;
+#line 339
+
+#line 339
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 339
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 339
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 339
+
+#line 339
+typeattribute system_server hal_oemlock;
+#line 339
+# Find passthrough HAL implementations
+#line 339
+allow hal_oemlock system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 339
+allow hal_oemlock vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 339
+allow hal_oemlock vendor_file:file { read open getattr execute map };
+#line 339
+
+#line 339
+
+
+#line 340
+typeattribute system_server halclientdomain;
+#line 340
+typeattribute system_server hal_omx_client;
+#line 340
+
+#line 340
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 340
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 340
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 340
+
+#line 340
+typeattribute system_server hal_omx;
+#line 340
+# Find passthrough HAL implementations
+#line 340
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 340
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 340
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 340
+
+#line 340
+
+
+#line 341
+typeattribute system_server halclientdomain;
+#line 341
+typeattribute system_server hal_power_client;
+#line 341
+
+#line 341
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 341
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 341
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 341
+
+#line 341
+typeattribute system_server hal_power;
+#line 341
+# Find passthrough HAL implementations
+#line 341
+allow hal_power system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 341
+allow hal_power vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 341
+allow hal_power vendor_file:file { read open getattr execute map };
+#line 341
+
+#line 341
+
+
+#line 342
+typeattribute system_server halclientdomain;
+#line 342
+typeattribute system_server hal_power_stats_client;
+#line 342
+
+#line 342
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 342
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 342
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 342
+
+#line 342
+typeattribute system_server hal_power_stats;
+#line 342
+# Find passthrough HAL implementations
+#line 342
+allow hal_power_stats system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 342
+allow hal_power_stats vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 342
+allow hal_power_stats vendor_file:file { read open getattr execute map };
+#line 342
+
+#line 342
+
+
+#line 343
+typeattribute system_server halclientdomain;
+#line 343
+typeattribute system_server hal_rebootescrow_client;
+#line 343
+
+#line 343
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 343
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 343
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 343
+
+#line 343
+typeattribute system_server hal_rebootescrow;
+#line 343
+# Find passthrough HAL implementations
+#line 343
+allow hal_rebootescrow system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 343
+allow hal_rebootescrow vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 343
+allow hal_rebootescrow vendor_file:file { read open getattr execute map };
+#line 343
+
+#line 343
+
+
+#line 344
+typeattribute system_server halclientdomain;
+#line 344
+typeattribute system_server hal_remotelyprovisionedcomponent_avf_client;
+#line 344
+
+#line 344
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 344
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 344
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 344
+
+#line 344
+typeattribute system_server hal_remotelyprovisionedcomponent_avf;
+#line 344
+# Find passthrough HAL implementations
+#line 344
+allow hal_remotelyprovisionedcomponent_avf system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 344
+allow hal_remotelyprovisionedcomponent_avf vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 344
+allow hal_remotelyprovisionedcomponent_avf vendor_file:file { read open getattr execute map };
+#line 344
+
+#line 344
+
+
+#line 345
+typeattribute system_server halclientdomain;
+#line 345
+typeattribute system_server hal_sensors_client;
+#line 345
+
+#line 345
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 345
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 345
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 345
+
+#line 345
+typeattribute system_server hal_sensors;
+#line 345
+# Find passthrough HAL implementations
+#line 345
+allow hal_sensors system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 345
+allow hal_sensors vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 345
+allow hal_sensors vendor_file:file { read open getattr execute map };
+#line 345
+
+#line 345
+
+
+#line 346
+typeattribute system_server halclientdomain;
+#line 346
+typeattribute system_server hal_secretkeeper_client;
+#line 346
+
+#line 346
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 346
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 346
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 346
+
+#line 346
+typeattribute system_server hal_secretkeeper;
+#line 346
+# Find passthrough HAL implementations
+#line 346
+allow hal_secretkeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 346
+allow hal_secretkeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 346
+allow hal_secretkeeper vendor_file:file { read open getattr execute map };
+#line 346
+
+#line 346
+
+
+#line 347
+typeattribute system_server halclientdomain;
+#line 347
+typeattribute system_server hal_tetheroffload_client;
+#line 347
+
+#line 347
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 347
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 347
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 347
+
+#line 347
+typeattribute system_server hal_tetheroffload;
+#line 347
+# Find passthrough HAL implementations
+#line 347
+allow hal_tetheroffload system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 347
+allow hal_tetheroffload vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 347
+allow hal_tetheroffload vendor_file:file { read open getattr execute map };
+#line 347
+
+#line 347
+
+
+#line 348
+typeattribute system_server halclientdomain;
+#line 348
+typeattribute system_server hal_thermal_client;
+#line 348
+
+#line 348
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 348
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 348
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 348
+
+#line 348
+typeattribute system_server hal_thermal;
+#line 348
+# Find passthrough HAL implementations
+#line 348
+allow hal_thermal system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 348
+allow hal_thermal vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 348
+allow hal_thermal vendor_file:file { read open getattr execute map };
+#line 348
+
+#line 348
+
+
+#line 349
+typeattribute system_server halclientdomain;
+#line 349
+typeattribute system_server hal_threadnetwork_client;
+#line 349
+
+#line 349
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 349
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 349
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 349
+
+#line 349
+typeattribute system_server hal_threadnetwork;
+#line 349
+# Find passthrough HAL implementations
+#line 349
+allow hal_threadnetwork system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 349
+allow hal_threadnetwork vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 349
+allow hal_threadnetwork vendor_file:file { read open getattr execute map };
+#line 349
+
+#line 349
+
+
+#line 350
+typeattribute system_server halclientdomain;
+#line 350
+typeattribute system_server hal_tv_cec_client;
+#line 350
+
+#line 350
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 350
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 350
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 350
+
+#line 350
+typeattribute system_server hal_tv_cec;
+#line 350
+# Find passthrough HAL implementations
+#line 350
+allow hal_tv_cec system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 350
+allow hal_tv_cec vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 350
+allow hal_tv_cec vendor_file:file { read open getattr execute map };
+#line 350
+
+#line 350
+
+
+#line 351
+typeattribute system_server halclientdomain;
+#line 351
+typeattribute system_server hal_tv_hdmi_cec_client;
+#line 351
+
+#line 351
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 351
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 351
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 351
+
+#line 351
+typeattribute system_server hal_tv_hdmi_cec;
+#line 351
+# Find passthrough HAL implementations
+#line 351
+allow hal_tv_hdmi_cec system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 351
+allow hal_tv_hdmi_cec vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 351
+allow hal_tv_hdmi_cec vendor_file:file { read open getattr execute map };
+#line 351
+
+#line 351
+
+
+#line 352
+typeattribute system_server halclientdomain;
+#line 352
+typeattribute system_server hal_tv_hdmi_connection_client;
+#line 352
+
+#line 352
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 352
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 352
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 352
+
+#line 352
+typeattribute system_server hal_tv_hdmi_connection;
+#line 352
+# Find passthrough HAL implementations
+#line 352
+allow hal_tv_hdmi_connection system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 352
+allow hal_tv_hdmi_connection vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 352
+allow hal_tv_hdmi_connection vendor_file:file { read open getattr execute map };
+#line 352
+
+#line 352
+
+
+#line 353
+typeattribute system_server halclientdomain;
+#line 353
+typeattribute system_server hal_tv_hdmi_earc_client;
+#line 353
+
+#line 353
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 353
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 353
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 353
+
+#line 353
+typeattribute system_server hal_tv_hdmi_earc;
+#line 353
+# Find passthrough HAL implementations
+#line 353
+allow hal_tv_hdmi_earc system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 353
+allow hal_tv_hdmi_earc vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 353
+allow hal_tv_hdmi_earc vendor_file:file { read open getattr execute map };
+#line 353
+
+#line 353
+
+
+#line 354
+typeattribute system_server halclientdomain;
+#line 354
+typeattribute system_server hal_tv_input_client;
+#line 354
+
+#line 354
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 354
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 354
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 354
+
+#line 354
+typeattribute system_server hal_tv_input;
+#line 354
+# Find passthrough HAL implementations
+#line 354
+allow hal_tv_input system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 354
+allow hal_tv_input vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 354
+allow hal_tv_input vendor_file:file { read open getattr execute map };
+#line 354
+
+#line 354
+
+
+#line 355
+typeattribute system_server halclientdomain;
+#line 355
+typeattribute system_server hal_usb_client;
+#line 355
+
+#line 355
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 355
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 355
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 355
+
+#line 355
+typeattribute system_server hal_usb;
+#line 355
+# Find passthrough HAL implementations
+#line 355
+allow hal_usb system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 355
+allow hal_usb vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 355
+allow hal_usb vendor_file:file { read open getattr execute map };
+#line 355
+
+#line 355
+
+
+#line 356
+typeattribute system_server halclientdomain;
+#line 356
+typeattribute system_server hal_usb_gadget_client;
+#line 356
+
+#line 356
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 356
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 356
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 356
+
+#line 356
+typeattribute system_server hal_usb_gadget;
+#line 356
+# Find passthrough HAL implementations
+#line 356
+allow hal_usb_gadget system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 356
+allow hal_usb_gadget vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 356
+allow hal_usb_gadget vendor_file:file { read open getattr execute map };
+#line 356
+
+#line 356
+
+
+#line 357
+typeattribute system_server halclientdomain;
+#line 357
+typeattribute system_server hal_uwb_client;
+#line 357
+
+#line 357
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 357
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 357
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 357
+
+#line 357
+typeattribute system_server hal_uwb;
+#line 357
+# Find passthrough HAL implementations
+#line 357
+allow hal_uwb system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 357
+allow hal_uwb vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 357
+allow hal_uwb vendor_file:file { read open getattr execute map };
+#line 357
+
+#line 357
+
+
+#line 358
+typeattribute system_server halclientdomain;
+#line 358
+typeattribute system_server hal_vibrator_client;
+#line 358
+
+#line 358
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 358
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 358
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 358
+
+#line 358
+typeattribute system_server hal_vibrator;
+#line 358
+# Find passthrough HAL implementations
+#line 358
+allow hal_vibrator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 358
+allow hal_vibrator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 358
+allow hal_vibrator vendor_file:file { read open getattr execute map };
+#line 358
+
+#line 358
+
+
+#line 359
+typeattribute system_server halclientdomain;
+#line 359
+typeattribute system_server hal_vr_client;
+#line 359
+
+#line 359
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 359
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 359
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 359
+
+#line 359
+typeattribute system_server hal_vr;
+#line 359
+# Find passthrough HAL implementations
+#line 359
+allow hal_vr system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 359
+allow hal_vr vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 359
+allow hal_vr vendor_file:file { read open getattr execute map };
+#line 359
+
+#line 359
+
+
+#line 360
+typeattribute system_server halclientdomain;
+#line 360
+typeattribute system_server hal_weaver_client;
+#line 360
+
+#line 360
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 360
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 360
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 360
+
+#line 360
+typeattribute system_server hal_weaver;
+#line 360
+# Find passthrough HAL implementations
+#line 360
+allow hal_weaver system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 360
+allow hal_weaver vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 360
+allow hal_weaver vendor_file:file { read open getattr execute map };
+#line 360
+
+#line 360
+
+
+#line 361
+typeattribute system_server halclientdomain;
+#line 361
+typeattribute system_server hal_wifi_client;
+#line 361
+
+#line 361
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 361
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 361
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 361
+
+#line 361
+typeattribute system_server hal_wifi;
+#line 361
+# Find passthrough HAL implementations
+#line 361
+allow hal_wifi system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 361
+allow hal_wifi vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 361
+allow hal_wifi vendor_file:file { read open getattr execute map };
+#line 361
+
+#line 361
+
+
+#line 362
+typeattribute system_server halclientdomain;
+#line 362
+typeattribute system_server hal_wifi_hostapd_client;
+#line 362
+
+#line 362
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 362
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 362
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 362
+
+#line 362
+typeattribute system_server hal_wifi_hostapd;
+#line 362
+# Find passthrough HAL implementations
+#line 362
+allow hal_wifi_hostapd system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 362
+allow hal_wifi_hostapd vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 362
+allow hal_wifi_hostapd vendor_file:file { read open getattr execute map };
+#line 362
+
+#line 362
+
+
+#line 363
+typeattribute system_server halclientdomain;
+#line 363
+typeattribute system_server hal_wifi_supplicant_client;
+#line 363
+
+#line 363
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 363
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 363
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 363
+
+#line 363
+typeattribute system_server hal_wifi_supplicant;
+#line 363
+# Find passthrough HAL implementations
+#line 363
+allow hal_wifi_supplicant system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 363
+allow hal_wifi_supplicant vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 363
+allow hal_wifi_supplicant vendor_file:file { read open getattr execute map };
+#line 363
+
+#line 363
+
+# The bootctl is a pass through HAL mode under recovery mode. So we skip the
+# permission for recovery in order not to give system server the access to
+# the low level block devices.
+
+#line 367
+typeattribute system_server halclientdomain;
+#line 367
+typeattribute system_server hal_bootctl_client;
+#line 367
+
+#line 367
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 367
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 367
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 367
+
+#line 367
+typeattribute system_server hal_bootctl;
+#line 367
+# Find passthrough HAL implementations
+#line 367
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 367
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 367
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 367
+
+#line 367
+
+
+# Talk with graphics composer fences
+allow system_server hal_graphics_composer:fd use;
+
+# Use RenderScript always-passthrough HAL
+allow system_server hal_renderscript_hwservice:hwservice_manager find;
+allow system_server same_process_hal_file:file { execute read open getattr map };
+
+# Talk to tombstoned to get ANR traces.
+
+#line 377
+allow system_server tombstoned_intercept_socket:sock_file write;
+#line 377
+allow system_server tombstoned:unix_stream_socket connectto;
+#line 377
+
+
+# List HAL interfaces to get ANR traces.
+allow system_server hwservicemanager:hwservice_manager list;
+allow system_server servicemanager:service_manager list;
+
+# Send signals to trigger ANR traces.
+allow system_server {
+ # This is derived from the list that system server defines as interesting native processes
+ # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
+ # frameworks/base/services/core/java/com/android/server/Watchdog.java.
+ artd
+ audioserver
+ cameraserver
+ drmserver
+ gpuservice
+ inputflinger
+ keystore
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ mediaswcodec
+ mediatranscoding
+ mediatuner
+ mmd
+ netd
+ sdcardd
+ servicemanager
+ statsd
+ surfaceflinger
+ vold
+
+ # This list comes from HAL_INTERFACES_OF_INTEREST in
+ # frameworks/base/services/core/java/com/android/server/Watchdog.java.
+ hal_audio_server
+ hal_bluetooth_server
+ hal_camera_server
+ hal_codec2_server
+ hal_drm_server
+ hal_face_server
+ hal_fingerprint_server
+ hal_gnss_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_input_processor_server
+ hal_light_server
+ hal_neuralnetworks_server
+ hal_omx_server
+ hal_power_server
+ hal_power_stats_server
+ hal_sensors_server
+ hal_vibrator_server
+ hal_vr_server
+ system_suspend_server
+}:process { signal };
+
+# Use sockets received over binder from various services.
+allow system_server audioserver:tcp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+allow system_server audioserver:udp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+allow system_server mediaserver:tcp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+allow system_server mediaserver:udp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+
+# Use sockets received over binder from various services.
+allow system_server mediadrmserver:tcp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+allow system_server mediadrmserver:udp_socket { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map };
+
+# Write trace data to the Perfetto traced daemon. This requires connecting to
+# its producer socket and obtaining a (per-process) tmpfs fd.
+
+#line 447
+ allow system_server traced:fd use;
+#line 447
+ allow system_server traced_tmpfs:file { read write getattr map };
+#line 447
+
+#line 447
+allow system_server traced_producer_socket:sock_file write;
+#line 447
+allow system_server traced:unix_stream_socket connectto;
+#line 447
+
+#line 447
+
+#line 447
+ # Also allow the service to use the producer file descriptors. This is
+#line 447
+ # necessary when the producer is creating the shared memory, as it will be
+#line 447
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 447
+ allow traced system_server:fd use;
+#line 447
+
+
+# Get file context
+allow system_server file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# access for mac_permissions
+allow system_server mac_perms_file: file { getattr open read ioctl lock map watch watch_reads };
+# Check SELinux permissions.
+
+#line 454
+
+#line 454
+allow system_server selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 454
+allow system_server selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 454
+
+#line 454
+allow system_server selinuxfs:file { open append write lock map };
+#line 454
+allow system_server kernel:security compute_av;
+#line 454
+allow system_server self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 454
+
+
+allow system_server sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+
+
+#line 458
+allow system_server sysfs_android_usb:dir { open getattr read search ioctl lock watch watch_reads };
+#line 458
+allow system_server sysfs_android_usb:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 458
+
+allow system_server sysfs_android_usb:file { open append write lock map };
+
+
+#line 461
+allow system_server sysfs_extcon:dir { open getattr read search ioctl lock watch watch_reads };
+#line 461
+allow system_server sysfs_extcon:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 461
+
+
+
+#line 463
+allow system_server sysfs_ipv4:dir { open getattr read search ioctl lock watch watch_reads };
+#line 463
+allow system_server sysfs_ipv4:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 463
+
+allow system_server sysfs_ipv4:file { open append write lock map };
+
+
+#line 466
+allow system_server sysfs_rtc:dir { open getattr read search ioctl lock watch watch_reads };
+#line 466
+allow system_server sysfs_rtc:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 466
+
+
+#line 467
+allow system_server sysfs_switch:dir { open getattr read search ioctl lock watch watch_reads };
+#line 467
+allow system_server sysfs_switch:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 467
+
+
+allow system_server sysfs_nfc_power_writable:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server sysfs_power:dir search;
+allow system_server sysfs_power:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server sysfs_thermal:dir search;
+allow system_server sysfs_thermal:file { getattr open read ioctl lock map watch watch_reads };
+allow system_server sysfs_uhid:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server sysfs_uhid:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# TODO: Remove when HALs are forced into separate processes
+allow system_server sysfs_vibrator:file { write append };
+
+# TODO: added to match above sysfs rule. Remove me?
+allow system_server sysfs_usb:file { open append write lock map };
+
+# Access devices.
+allow system_server device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server mdns_socket:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server sysfs_gpu:file { getattr open read ioctl lock map watch watch_reads };
+allow system_server input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server input_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server usbaccessory_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server video_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server video_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server adbd_socket:sock_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server rtc_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server audio_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server uhid_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server hidraw_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server hidraw_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
+allow system_server audio_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# tun device used for 3rd party vpn apps and test network manager
+allow system_server tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm system_server tun_device:chr_file ioctl { 0x800454d2 0x400454ca 0x400454cd 0x400454e2 };
+
+# Manage data/ota_package
+allow system_server ota_package_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server ota_package_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage system data files.
+allow system_server system_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server system_data_file:{ file lnk_file sock_file fifo_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server packages_list_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server game_mode_intervention_list_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server keychain_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server keychain_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server keychain_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read the user parent directories like /data/user. Don't allow write access,
+# as vold is responsible for creating and deleting the subdirectories.
+allow system_server system_userdir_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Manage /data/app.
+allow system_server apk_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apk_data_file:{ file lnk_file } { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } link };
+allow system_server apk_tmp_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apk_tmp_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/app-metadata
+allow system_server apk_metadata_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apk_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access input configuration files in the /vendor directory
+
+#line 537
+allow system_server vendor_keylayout_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 537
+allow system_server vendor_keylayout_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 537
+
+
+#line 538
+allow system_server vendor_keychars_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 538
+allow system_server vendor_keychars_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 538
+
+
+#line 539
+allow system_server vendor_idc_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 539
+allow system_server vendor_idc_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 539
+
+
+#line 540
+allow system_server input_device_config_prop:file { getattr open read map };
+#line 540
+
+
+# Access /vendor/{app,framework,overlay}
+
+#line 543
+allow system_server vendor_app_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 543
+allow system_server vendor_app_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 543
+
+
+#line 544
+allow system_server vendor_framework_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 544
+allow system_server vendor_framework_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 544
+
+
+#line 545
+allow system_server vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 545
+allow system_server vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 545
+
+
+# Manage /data/app-private.
+allow system_server apk_private_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apk_private_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server apk_private_tmp_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apk_private_tmp_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage files within asec containers.
+allow system_server asec_apk_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server asec_apk_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server asec_public_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/anr.
+#
+# TODO: Some of these permissions can be withdrawn once we've switched to the
+# new stack dumping mechanism, see b/32064548 and the rules below. In particular,
+# the system_server should never need to create a new anr_data_file:file or write
+# to one, but it will still need to read and append to existing files.
+allow system_server anr_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server anr_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# New stack dumping scheme : request an output FD from tombstoned via a unix
+# domain socket.
+#
+# Allow system_server to connect and write to the tombstoned java trace socket in
+# order to dump its traces. Also allow the system server to write its traces to
+# dumpstate during bugreport capture and incidentd during incident collection.
+
+#line 573
+allow system_server tombstoned_java_trace_socket:sock_file write;
+#line 573
+allow system_server tombstoned:unix_stream_socket connectto;
+#line 573
+
+allow system_server tombstoned:fd use;
+allow system_server dumpstate:fifo_file append;
+allow system_server incidentd:fifo_file append;
+# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`)
+#line 580
+
+
+# Allow system_server to read pipes from incidentd (used to deliver incident reports
+# to dropbox)
+allow system_server incidentd:fifo_file read;
+
+# Read /data/misc/incidents - only read. The fd will be sent over binder,
+# with no DAC access to it, for dropbox to read.
+allow system_server incident_data_file:file read;
+
+# Manage /data/misc/prereboot.
+allow system_server prereboot_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server prereboot_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow tracing proxy service to read traces. Only the fd is sent over
+# binder.
+allow system_server perfetto_traces_data_file:file { read getattr };
+allow system_server perfetto:fd use;
+
+# Allow system_server to exec the perfetto cmdline client and pass it a trace config
+
+#line 600
+# Allow the necessary permissions.
+#line 600
+
+#line 600
+# Old domain may exec the file and transition to the new domain.
+#line 600
+allow system_server perfetto_exec:file { getattr open read execute map };
+#line 600
+allow system_server perfetto:process transition;
+#line 600
+# New domain is entered by executing the file.
+#line 600
+allow perfetto perfetto_exec:file { entrypoint open read execute getattr map };
+#line 600
+# New domain can send SIGCHLD to its caller.
+#line 600
+allow perfetto system_server:process sigchld;
+#line 600
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 600
+dontaudit system_server perfetto:process noatsecure;
+#line 600
+# XXX dontaudit candidate but requires further study.
+#line 600
+allow system_server perfetto:process { siginh rlimitinh };
+#line 600
+
+#line 600
+# Make the transition occur by default.
+#line 600
+type_transition system_server perfetto_exec:process perfetto;
+#line 600
+;
+allow system_server perfetto:fifo_file { read write };
+
+# Allow system server to manage perfetto traces for ProfilingService.
+allow system_server perfetto_traces_profiling_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server perfetto_traces_profiling_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server perfetto_traces_data_file:dir search;
+
+# Allow system server to exec the trace redactor cmdline client and kill the process for
+# ProfilingService.
+
+#line 610
+# Allow the necessary permissions.
+#line 610
+
+#line 610
+# Old domain may exec the file and transition to the new domain.
+#line 610
+allow system_server trace_redactor_exec:file { getattr open read execute map };
+#line 610
+allow system_server trace_redactor:process transition;
+#line 610
+# New domain is entered by executing the file.
+#line 610
+allow trace_redactor trace_redactor_exec:file { entrypoint open read execute getattr map };
+#line 610
+# New domain can send SIGCHLD to its caller.
+#line 610
+allow trace_redactor system_server:process sigchld;
+#line 610
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 610
+dontaudit system_server trace_redactor:process noatsecure;
+#line 610
+# XXX dontaudit candidate but requires further study.
+#line 610
+allow system_server trace_redactor:process { siginh rlimitinh };
+#line 610
+
+#line 610
+# Make the transition occur by default.
+#line 610
+type_transition system_server trace_redactor_exec:process trace_redactor;
+#line 610
+;
+allow system_server trace_redactor:process signal;
+
+# Allow system server to kill perfetto processes for ProfilingService.
+allow system_server perfetto:process signal;
+
+# Manage /data/backup.
+allow system_server backup_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server backup_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Write to /data/system/dropbox
+allow system_server dropbox_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server dropbox_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Write to /data/system/heapdump
+allow system_server heapdump_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server heapdump_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/adb.
+allow system_server adb_keys_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server adb_keys_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/appcompat.
+allow system_server appcompat_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server appcompat_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/connectivityblobdb.
+# Specifically, for vpn and wifi to create, read and write to an sqlite database.
+allow system_server connectivityblob_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server connectivityblob_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/emergencynumberdb
+allow system_server emergency_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server emergency_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/network_watchlist
+allow system_server network_watchlist_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server network_watchlist_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/sms.
+# TODO: Split into a separate type?
+allow system_server radio_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server radio_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/systemkeys.
+allow system_server systemkeys_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server systemkeys_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/textclassifier.
+allow system_server textclassifier_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server textclassifier_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/tombstones.
+allow system_server tombstone_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server tombstone_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/vpn.
+allow system_server vpn_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server vpn_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/misc/wifi.
+allow system_server wifi_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server wifi_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/app-staging.
+allow system_server staging_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server staging_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage /data/rollback.
+allow system_server staging_data_file:{ file lnk_file } { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } link };
+
+# Walk /data/data subdirectories.
+allow system_server app_data_file_type:dir { getattr read search };
+
+# Also permit for unlabeled /data/data subdirectories and
+# for unlabeled asec containers on upgrades from 4.2.
+allow system_server unlabeled:dir { open getattr read search ioctl lock watch watch_reads };
+# Read pkg.apk file before it has been relabeled by vold.
+allow system_server unlabeled:file { getattr open read ioctl lock map watch watch_reads };
+
+# Populate com.android.providers.settings/databases/settings.db.
+allow system_server system_app_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server system_app_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Receive and use open app data files passed over binder IPC.
+allow system_server app_data_file_type:file { getattr read write append map };
+
+# Access to /data/media for measuring disk usage.
+allow system_server media_rw_data_file:dir { search getattr open read };
+
+# Receive and use open /data/media files passed over binder IPC.
+# Also used for measuring disk usage.
+allow system_server media_rw_data_file:file { getattr read write append };
+
+# System server needs to setfscreate to packages_list_file when writing
+# /data/system/packages.list
+allow system_server system_server:process setfscreate;
+
+# Relabel apk files.
+allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
+allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
+# Allow PackageManager to:
+# 1. rename file from /data/app-staging folder to /data/app
+# 2. relabel files (linked to /data/rollback) under /data/app-staging
+# during staged apk/apex install.
+allow system_server { staging_data_file }:{ dir file } { relabelfrom relabelto };
+
+# Relabel wallpaper.
+allow system_server system_data_file:file relabelfrom;
+allow system_server wallpaper_file:file relabelto;
+allow system_server wallpaper_file:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } rename unlink };
+
+# Backup of wallpaper imagery uses temporary hard links to avoid data churn
+allow system_server { system_data_file wallpaper_file }:file link;
+
+# ShortcutManager icons
+allow system_server system_data_file:dir relabelfrom;
+allow system_server shortcut_manager_icons:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow system_server shortcut_manager_icons:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage ringtones.
+allow system_server ringtone_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow system_server ringtone_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Relabel icon file.
+allow system_server icon_file:file relabelto;
+allow system_server icon_file:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } unlink };
+
+# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
+allow system_server system_data_file:dir relabelfrom;
+
+# server_configurable_flags_data_file is used for storing server configurable flags which
+# have been reset during current booting. system_server needs to read the data to perform related
+# disaster recovery actions.
+allow system_server server_configurable_flags_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server server_configurable_flags_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Property Service write
+
+#line 748
+
+#line 748
+allow system_server property_socket:sock_file write;
+#line 748
+allow system_server init:unix_stream_socket connectto;
+#line 748
+
+#line 748
+allow system_server system_prop:property_service set;
+#line 748
+
+#line 748
+allow system_server system_prop:file { getattr open read map };
+#line 748
+
+#line 748
+
+
+#line 749
+
+#line 749
+allow system_server property_socket:sock_file write;
+#line 749
+allow system_server init:unix_stream_socket connectto;
+#line 749
+
+#line 749
+allow system_server bootanim_system_prop:property_service set;
+#line 749
+
+#line 749
+allow system_server bootanim_system_prop:file { getattr open read map };
+#line 749
+
+#line 749
+
+
+#line 750
+
+#line 750
+allow system_server property_socket:sock_file write;
+#line 750
+allow system_server init:unix_stream_socket connectto;
+#line 750
+
+#line 750
+allow system_server bluetooth_prop:property_service set;
+#line 750
+
+#line 750
+allow system_server bluetooth_prop:file { getattr open read map };
+#line 750
+
+#line 750
+
+
+#line 751
+
+#line 751
+allow system_server property_socket:sock_file write;
+#line 751
+allow system_server init:unix_stream_socket connectto;
+#line 751
+
+#line 751
+allow system_server exported_system_prop:property_service set;
+#line 751
+
+#line 751
+allow system_server exported_system_prop:file { getattr open read map };
+#line 751
+
+#line 751
+
+
+#line 752
+
+#line 752
+allow system_server property_socket:sock_file write;
+#line 752
+allow system_server init:unix_stream_socket connectto;
+#line 752
+
+#line 752
+allow system_server exported3_system_prop:property_service set;
+#line 752
+
+#line 752
+allow system_server exported3_system_prop:file { getattr open read map };
+#line 752
+
+#line 752
+
+
+#line 753
+
+#line 753
+allow system_server property_socket:sock_file write;
+#line 753
+allow system_server init:unix_stream_socket connectto;
+#line 753
+
+#line 753
+allow system_server safemode_prop:property_service set;
+#line 753
+
+#line 753
+allow system_server safemode_prop:file { getattr open read map };
+#line 753
+
+#line 753
+
+
+#line 754
+
+#line 754
+allow system_server property_socket:sock_file write;
+#line 754
+allow system_server init:unix_stream_socket connectto;
+#line 754
+
+#line 754
+allow system_server theme_prop:property_service set;
+#line 754
+
+#line 754
+allow system_server theme_prop:file { getattr open read map };
+#line 754
+
+#line 754
+
+
+#line 755
+
+#line 755
+allow system_server property_socket:sock_file write;
+#line 755
+allow system_server init:unix_stream_socket connectto;
+#line 755
+
+#line 755
+allow system_server dhcp_prop:property_service set;
+#line 755
+
+#line 755
+allow system_server dhcp_prop:file { getattr open read map };
+#line 755
+
+#line 755
+
+
+#line 756
+
+#line 756
+allow system_server property_socket:sock_file write;
+#line 756
+allow system_server init:unix_stream_socket connectto;
+#line 756
+
+#line 756
+allow system_server net_connectivity_prop:property_service set;
+#line 756
+
+#line 756
+allow system_server net_connectivity_prop:file { getattr open read map };
+#line 756
+
+#line 756
+
+
+#line 757
+
+#line 757
+allow system_server property_socket:sock_file write;
+#line 757
+allow system_server init:unix_stream_socket connectto;
+#line 757
+
+#line 757
+allow system_server net_radio_prop:property_service set;
+#line 757
+
+#line 757
+allow system_server net_radio_prop:file { getattr open read map };
+#line 757
+
+#line 757
+
+
+#line 758
+
+#line 758
+allow system_server property_socket:sock_file write;
+#line 758
+allow system_server init:unix_stream_socket connectto;
+#line 758
+
+#line 758
+allow system_server net_dns_prop:property_service set;
+#line 758
+
+#line 758
+allow system_server net_dns_prop:file { getattr open read map };
+#line 758
+
+#line 758
+
+
+#line 759
+
+#line 759
+allow system_server property_socket:sock_file write;
+#line 759
+allow system_server init:unix_stream_socket connectto;
+#line 759
+
+#line 759
+allow system_server usb_control_prop:property_service set;
+#line 759
+
+#line 759
+allow system_server usb_control_prop:file { getattr open read map };
+#line 759
+
+#line 759
+
+
+#line 760
+
+#line 760
+allow system_server property_socket:sock_file write;
+#line 760
+allow system_server init:unix_stream_socket connectto;
+#line 760
+
+#line 760
+allow system_server usb_prop:property_service set;
+#line 760
+
+#line 760
+allow system_server usb_prop:file { getattr open read map };
+#line 760
+
+#line 760
+
+
+#line 761
+
+#line 761
+allow system_server property_socket:sock_file write;
+#line 761
+allow system_server init:unix_stream_socket connectto;
+#line 761
+
+#line 761
+allow system_server debug_prop:property_service set;
+#line 761
+
+#line 761
+allow system_server debug_prop:file { getattr open read map };
+#line 761
+
+#line 761
+
+
+#line 762
+
+#line 762
+allow system_server property_socket:sock_file write;
+#line 762
+allow system_server init:unix_stream_socket connectto;
+#line 762
+
+#line 762
+allow system_server powerctl_prop:property_service set;
+#line 762
+
+#line 762
+allow system_server powerctl_prop:file { getattr open read map };
+#line 762
+
+#line 762
+
+
+#line 763
+
+#line 763
+allow system_server property_socket:sock_file write;
+#line 763
+allow system_server init:unix_stream_socket connectto;
+#line 763
+
+#line 763
+allow system_server fingerprint_prop:property_service set;
+#line 763
+
+#line 763
+allow system_server fingerprint_prop:file { getattr open read map };
+#line 763
+
+#line 763
+
+
+#line 764
+
+#line 764
+allow system_server property_socket:sock_file write;
+#line 764
+allow system_server init:unix_stream_socket connectto;
+#line 764
+
+#line 764
+allow system_server device_logging_prop:property_service set;
+#line 764
+
+#line 764
+allow system_server device_logging_prop:file { getattr open read map };
+#line 764
+
+#line 764
+
+
+#line 765
+
+#line 765
+allow system_server property_socket:sock_file write;
+#line 765
+allow system_server init:unix_stream_socket connectto;
+#line 765
+
+#line 765
+allow system_server dumpstate_options_prop:property_service set;
+#line 765
+
+#line 765
+allow system_server dumpstate_options_prop:file { getattr open read map };
+#line 765
+
+#line 765
+
+
+#line 766
+
+#line 766
+allow system_server property_socket:sock_file write;
+#line 766
+allow system_server init:unix_stream_socket connectto;
+#line 766
+
+#line 766
+allow system_server overlay_prop:property_service set;
+#line 766
+
+#line 766
+allow system_server overlay_prop:file { getattr open read map };
+#line 766
+
+#line 766
+
+
+#line 767
+
+#line 767
+allow system_server property_socket:sock_file write;
+#line 767
+allow system_server init:unix_stream_socket connectto;
+#line 767
+
+#line 767
+allow system_server exported_overlay_prop:property_service set;
+#line 767
+
+#line 767
+allow system_server exported_overlay_prop:file { getattr open read map };
+#line 767
+
+#line 767
+
+
+#line 768
+
+#line 768
+allow system_server property_socket:sock_file write;
+#line 768
+allow system_server init:unix_stream_socket connectto;
+#line 768
+
+#line 768
+allow system_server pm_prop:property_service set;
+#line 768
+
+#line 768
+allow system_server pm_prop:file { getattr open read map };
+#line 768
+
+#line 768
+
+
+#line 769
+
+#line 769
+allow system_server property_socket:sock_file write;
+#line 769
+allow system_server init:unix_stream_socket connectto;
+#line 769
+
+#line 769
+allow system_server exported_pm_prop:property_service set;
+#line 769
+
+#line 769
+allow system_server exported_pm_prop:file { getattr open read map };
+#line 769
+
+#line 769
+
+
+#line 770
+
+#line 770
+allow system_server property_socket:sock_file write;
+#line 770
+allow system_server init:unix_stream_socket connectto;
+#line 770
+
+#line 770
+allow system_server socket_hook_prop:property_service set;
+#line 770
+
+#line 770
+allow system_server socket_hook_prop:file { getattr open read map };
+#line 770
+
+#line 770
+
+
+#line 771
+
+#line 771
+allow system_server property_socket:sock_file write;
+#line 771
+allow system_server init:unix_stream_socket connectto;
+#line 771
+
+#line 771
+allow system_server audio_prop:property_service set;
+#line 771
+
+#line 771
+allow system_server audio_prop:file { getattr open read map };
+#line 771
+
+#line 771
+
+
+#line 772
+
+#line 772
+allow system_server property_socket:sock_file write;
+#line 772
+allow system_server init:unix_stream_socket connectto;
+#line 772
+
+#line 772
+allow system_server boot_status_prop:property_service set;
+#line 772
+
+#line 772
+allow system_server boot_status_prop:file { getattr open read map };
+#line 772
+
+#line 772
+
+
+#line 773
+
+#line 773
+allow system_server property_socket:sock_file write;
+#line 773
+allow system_server init:unix_stream_socket connectto;
+#line 773
+
+#line 773
+allow system_server surfaceflinger_color_prop:property_service set;
+#line 773
+
+#line 773
+allow system_server surfaceflinger_color_prop:file { getattr open read map };
+#line 773
+
+#line 773
+
+
+#line 774
+
+#line 774
+allow system_server property_socket:sock_file write;
+#line 774
+allow system_server init:unix_stream_socket connectto;
+#line 774
+
+#line 774
+allow system_server provisioned_prop:property_service set;
+#line 774
+
+#line 774
+allow system_server provisioned_prop:file { getattr open read map };
+#line 774
+
+#line 774
+
+
+#line 775
+
+#line 775
+allow system_server property_socket:sock_file write;
+#line 775
+allow system_server init:unix_stream_socket connectto;
+#line 775
+
+#line 775
+allow system_server retaildemo_prop:property_service set;
+#line 775
+
+#line 775
+allow system_server retaildemo_prop:file { getattr open read map };
+#line 775
+
+#line 775
+
+
+#line 776
+
+#line 776
+allow system_server property_socket:sock_file write;
+#line 776
+allow system_server init:unix_stream_socket connectto;
+#line 776
+
+#line 776
+allow system_server dmesgd_start_prop:property_service set;
+#line 776
+
+#line 776
+allow system_server dmesgd_start_prop:file { getattr open read map };
+#line 776
+
+#line 776
+
+
+#line 777
+
+#line 777
+allow system_server property_socket:sock_file write;
+#line 777
+allow system_server init:unix_stream_socket connectto;
+#line 777
+
+#line 777
+allow system_server locale_prop:property_service set;
+#line 777
+
+#line 777
+allow system_server locale_prop:file { getattr open read map };
+#line 777
+
+#line 777
+
+
+#line 778
+
+#line 778
+allow system_server property_socket:sock_file write;
+#line 778
+allow system_server init:unix_stream_socket connectto;
+#line 778
+
+#line 778
+allow system_server timezone_metadata_prop:property_service set;
+#line 778
+
+#line 778
+allow system_server timezone_metadata_prop:file { getattr open read map };
+#line 778
+
+#line 778
+
+
+#line 779
+
+#line 779
+allow system_server property_socket:sock_file write;
+#line 779
+allow system_server init:unix_stream_socket connectto;
+#line 779
+
+#line 779
+allow system_server timezone_prop:property_service set;
+#line 779
+
+#line 779
+allow system_server timezone_prop:file { getattr open read map };
+#line 779
+
+#line 779
+
+
+#line 780
+
+#line 780
+allow system_server property_socket:sock_file write;
+#line 780
+allow system_server init:unix_stream_socket connectto;
+#line 780
+
+#line 780
+allow system_server crashrecovery_prop:property_service set;
+#line 780
+
+#line 780
+allow system_server crashrecovery_prop:file { getattr open read map };
+#line 780
+
+#line 780
+
+
+
+
+# ctl interface
+
+#line 785
+
+#line 785
+allow system_server property_socket:sock_file write;
+#line 785
+allow system_server init:unix_stream_socket connectto;
+#line 785
+
+#line 785
+allow system_server ctl_default_prop:property_service set;
+#line 785
+
+#line 785
+allow system_server ctl_default_prop:file { getattr open read map };
+#line 785
+
+#line 785
+
+
+#line 786
+
+#line 786
+allow system_server property_socket:sock_file write;
+#line 786
+allow system_server init:unix_stream_socket connectto;
+#line 786
+
+#line 786
+allow system_server ctl_bugreport_prop:property_service set;
+#line 786
+
+#line 786
+allow system_server ctl_bugreport_prop:file { getattr open read map };
+#line 786
+
+#line 786
+
+
+#line 787
+
+#line 787
+allow system_server property_socket:sock_file write;
+#line 787
+allow system_server init:unix_stream_socket connectto;
+#line 787
+
+#line 787
+allow system_server ctl_gsid_prop:property_service set;
+#line 787
+
+#line 787
+allow system_server ctl_gsid_prop:file { getattr open read map };
+#line 787
+
+#line 787
+
+
+#line 788
+
+#line 788
+allow system_server property_socket:sock_file write;
+#line 788
+allow system_server init:unix_stream_socket connectto;
+#line 788
+
+#line 788
+allow system_server ctl_artd_pre_reboot_prop:property_service set;
+#line 788
+
+#line 788
+allow system_server ctl_artd_pre_reboot_prop:file { getattr open read map };
+#line 788
+
+#line 788
+
+
+# cppreopt property
+
+#line 791
+
+#line 791
+allow system_server property_socket:sock_file write;
+#line 791
+allow system_server init:unix_stream_socket connectto;
+#line 791
+
+#line 791
+allow system_server cppreopt_prop:property_service set;
+#line 791
+
+#line 791
+allow system_server cppreopt_prop:file { getattr open read map };
+#line 791
+
+#line 791
+
+
+# server configurable flags properties
+
+#line 794
+
+#line 794
+allow system_server property_socket:sock_file write;
+#line 794
+allow system_server init:unix_stream_socket connectto;
+#line 794
+
+#line 794
+allow system_server device_config_core_experiments_team_internal_prop:property_service set;
+#line 794
+
+#line 794
+allow system_server device_config_core_experiments_team_internal_prop:file { getattr open read map };
+#line 794
+
+#line 794
+
+
+#line 795
+
+#line 795
+allow system_server property_socket:sock_file write;
+#line 795
+allow system_server init:unix_stream_socket connectto;
+#line 795
+
+#line 795
+allow system_server device_config_edgetpu_native_prop:property_service set;
+#line 795
+
+#line 795
+allow system_server device_config_edgetpu_native_prop:file { getattr open read map };
+#line 795
+
+#line 795
+
+
+#line 796
+
+#line 796
+allow system_server property_socket:sock_file write;
+#line 796
+allow system_server init:unix_stream_socket connectto;
+#line 796
+
+#line 796
+allow system_server device_config_input_native_boot_prop:property_service set;
+#line 796
+
+#line 796
+allow system_server device_config_input_native_boot_prop:file { getattr open read map };
+#line 796
+
+#line 796
+
+
+#line 797
+
+#line 797
+allow system_server property_socket:sock_file write;
+#line 797
+allow system_server init:unix_stream_socket connectto;
+#line 797
+
+#line 797
+allow system_server device_config_netd_native_prop:property_service set;
+#line 797
+
+#line 797
+allow system_server device_config_netd_native_prop:file { getattr open read map };
+#line 797
+
+#line 797
+
+
+#line 798
+
+#line 798
+allow system_server property_socket:sock_file write;
+#line 798
+allow system_server init:unix_stream_socket connectto;
+#line 798
+
+#line 798
+allow system_server device_config_nnapi_native_prop:property_service set;
+#line 798
+
+#line 798
+allow system_server device_config_nnapi_native_prop:file { getattr open read map };
+#line 798
+
+#line 798
+
+
+#line 799
+
+#line 799
+allow system_server property_socket:sock_file write;
+#line 799
+allow system_server init:unix_stream_socket connectto;
+#line 799
+
+#line 799
+allow system_server device_config_activity_manager_native_boot_prop:property_service set;
+#line 799
+
+#line 799
+allow system_server device_config_activity_manager_native_boot_prop:file { getattr open read map };
+#line 799
+
+#line 799
+
+
+#line 800
+
+#line 800
+allow system_server property_socket:sock_file write;
+#line 800
+allow system_server init:unix_stream_socket connectto;
+#line 800
+
+#line 800
+allow system_server device_config_runtime_native_boot_prop:property_service set;
+#line 800
+
+#line 800
+allow system_server device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 800
+
+#line 800
+
+
+#line 801
+
+#line 801
+allow system_server property_socket:sock_file write;
+#line 801
+allow system_server init:unix_stream_socket connectto;
+#line 801
+
+#line 801
+allow system_server device_config_runtime_native_prop:property_service set;
+#line 801
+
+#line 801
+allow system_server device_config_runtime_native_prop:file { getattr open read map };
+#line 801
+
+#line 801
+
+
+#line 802
+
+#line 802
+allow system_server property_socket:sock_file write;
+#line 802
+allow system_server init:unix_stream_socket connectto;
+#line 802
+
+#line 802
+allow system_server device_config_lmkd_native_prop:property_service set;
+#line 802
+
+#line 802
+allow system_server device_config_lmkd_native_prop:file { getattr open read map };
+#line 802
+
+#line 802
+
+
+#line 803
+
+#line 803
+allow system_server property_socket:sock_file write;
+#line 803
+allow system_server init:unix_stream_socket connectto;
+#line 803
+
+#line 803
+allow system_server device_config_media_native_prop:property_service set;
+#line 803
+
+#line 803
+allow system_server device_config_media_native_prop:file { getattr open read map };
+#line 803
+
+#line 803
+
+
+#line 804
+
+#line 804
+allow system_server property_socket:sock_file write;
+#line 804
+allow system_server init:unix_stream_socket connectto;
+#line 804
+
+#line 804
+allow system_server device_config_camera_native_prop:property_service set;
+#line 804
+
+#line 804
+allow system_server device_config_camera_native_prop:file { getattr open read map };
+#line 804
+
+#line 804
+
+
+#line 805
+
+#line 805
+allow system_server property_socket:sock_file write;
+#line 805
+allow system_server init:unix_stream_socket connectto;
+#line 805
+
+#line 805
+allow system_server device_config_mglru_native_prop:property_service set;
+#line 805
+
+#line 805
+allow system_server device_config_mglru_native_prop:file { getattr open read map };
+#line 805
+
+#line 805
+
+
+#line 806
+
+#line 806
+allow system_server property_socket:sock_file write;
+#line 806
+allow system_server init:unix_stream_socket connectto;
+#line 806
+
+#line 806
+allow system_server device_config_profcollect_native_boot_prop:property_service set;
+#line 806
+
+#line 806
+allow system_server device_config_profcollect_native_boot_prop:file { getattr open read map };
+#line 806
+
+#line 806
+
+
+#line 807
+
+#line 807
+allow system_server property_socket:sock_file write;
+#line 807
+allow system_server init:unix_stream_socket connectto;
+#line 807
+
+#line 807
+allow system_server device_config_statsd_native_prop:property_service set;
+#line 807
+
+#line 807
+allow system_server device_config_statsd_native_prop:file { getattr open read map };
+#line 807
+
+#line 807
+
+
+#line 808
+
+#line 808
+allow system_server property_socket:sock_file write;
+#line 808
+allow system_server init:unix_stream_socket connectto;
+#line 808
+
+#line 808
+allow system_server device_config_statsd_native_boot_prop:property_service set;
+#line 808
+
+#line 808
+allow system_server device_config_statsd_native_boot_prop:file { getattr open read map };
+#line 808
+
+#line 808
+
+
+#line 809
+
+#line 809
+allow system_server property_socket:sock_file write;
+#line 809
+allow system_server init:unix_stream_socket connectto;
+#line 809
+
+#line 809
+allow system_server device_config_storage_native_boot_prop:property_service set;
+#line 809
+
+#line 809
+allow system_server device_config_storage_native_boot_prop:file { getattr open read map };
+#line 809
+
+#line 809
+
+
+#line 810
+
+#line 810
+allow system_server property_socket:sock_file write;
+#line 810
+allow system_server init:unix_stream_socket connectto;
+#line 810
+
+#line 810
+allow system_server device_config_swcodec_native_prop:property_service set;
+#line 810
+
+#line 810
+allow system_server device_config_swcodec_native_prop:file { getattr open read map };
+#line 810
+
+#line 810
+
+
+#line 811
+
+#line 811
+allow system_server property_socket:sock_file write;
+#line 811
+allow system_server init:unix_stream_socket connectto;
+#line 811
+
+#line 811
+allow system_server device_config_sys_traced_prop:property_service set;
+#line 811
+
+#line 811
+allow system_server device_config_sys_traced_prop:file { getattr open read map };
+#line 811
+
+#line 811
+
+
+#line 812
+
+#line 812
+allow system_server property_socket:sock_file write;
+#line 812
+allow system_server init:unix_stream_socket connectto;
+#line 812
+
+#line 812
+allow system_server device_config_window_manager_native_boot_prop:property_service set;
+#line 812
+
+#line 812
+allow system_server device_config_window_manager_native_boot_prop:file { getattr open read map };
+#line 812
+
+#line 812
+
+
+#line 813
+
+#line 813
+allow system_server property_socket:sock_file write;
+#line 813
+allow system_server init:unix_stream_socket connectto;
+#line 813
+
+#line 813
+allow system_server device_config_configuration_prop:property_service set;
+#line 813
+
+#line 813
+allow system_server device_config_configuration_prop:file { getattr open read map };
+#line 813
+
+#line 813
+
+
+#line 814
+
+#line 814
+allow system_server property_socket:sock_file write;
+#line 814
+allow system_server init:unix_stream_socket connectto;
+#line 814
+
+#line 814
+allow system_server device_config_connectivity_prop:property_service set;
+#line 814
+
+#line 814
+allow system_server device_config_connectivity_prop:file { getattr open read map };
+#line 814
+
+#line 814
+
+
+#line 815
+
+#line 815
+allow system_server property_socket:sock_file write;
+#line 815
+allow system_server init:unix_stream_socket connectto;
+#line 815
+
+#line 815
+allow system_server device_config_surface_flinger_native_boot_prop:property_service set;
+#line 815
+
+#line 815
+allow system_server device_config_surface_flinger_native_boot_prop:file { getattr open read map };
+#line 815
+
+#line 815
+
+
+#line 816
+
+#line 816
+allow system_server property_socket:sock_file write;
+#line 816
+allow system_server init:unix_stream_socket connectto;
+#line 816
+
+#line 816
+allow system_server device_config_aconfig_flags_prop:property_service set;
+#line 816
+
+#line 816
+allow system_server device_config_aconfig_flags_prop:file { getattr open read map };
+#line 816
+
+#line 816
+
+
+#line 817
+
+#line 817
+allow system_server property_socket:sock_file write;
+#line 817
+allow system_server init:unix_stream_socket connectto;
+#line 817
+
+#line 817
+allow system_server device_config_vendor_system_native_prop:property_service set;
+#line 817
+
+#line 817
+allow system_server device_config_vendor_system_native_prop:file { getattr open read map };
+#line 817
+
+#line 817
+
+
+#line 818
+
+#line 818
+allow system_server property_socket:sock_file write;
+#line 818
+allow system_server init:unix_stream_socket connectto;
+#line 818
+
+#line 818
+allow system_server device_config_vendor_system_native_boot_prop:property_service set;
+#line 818
+
+#line 818
+allow system_server device_config_vendor_system_native_boot_prop:file { getattr open read map };
+#line 818
+
+#line 818
+
+
+#line 819
+
+#line 819
+allow system_server property_socket:sock_file write;
+#line 819
+allow system_server init:unix_stream_socket connectto;
+#line 819
+
+#line 819
+allow system_server device_config_virtualization_framework_native_prop:property_service set;
+#line 819
+
+#line 819
+allow system_server device_config_virtualization_framework_native_prop:file { getattr open read map };
+#line 819
+
+#line 819
+
+
+#line 820
+
+#line 820
+allow system_server property_socket:sock_file write;
+#line 820
+allow system_server init:unix_stream_socket connectto;
+#line 820
+
+#line 820
+allow system_server device_config_memory_safety_native_boot_prop:property_service set;
+#line 820
+
+#line 820
+allow system_server device_config_memory_safety_native_boot_prop:file { getattr open read map };
+#line 820
+
+#line 820
+
+
+#line 821
+
+#line 821
+allow system_server property_socket:sock_file write;
+#line 821
+allow system_server init:unix_stream_socket connectto;
+#line 821
+
+#line 821
+allow system_server device_config_memory_safety_native_prop:property_service set;
+#line 821
+
+#line 821
+allow system_server device_config_memory_safety_native_prop:file { getattr open read map };
+#line 821
+
+#line 821
+
+
+#line 822
+
+#line 822
+allow system_server property_socket:sock_file write;
+#line 822
+allow system_server init:unix_stream_socket connectto;
+#line 822
+
+#line 822
+allow system_server device_config_remote_key_provisioning_native_prop:property_service set;
+#line 822
+
+#line 822
+allow system_server device_config_remote_key_provisioning_native_prop:file { getattr open read map };
+#line 822
+
+#line 822
+
+
+#line 823
+
+#line 823
+allow system_server property_socket:sock_file write;
+#line 823
+allow system_server init:unix_stream_socket connectto;
+#line 823
+
+#line 823
+allow system_server device_config_tethering_u_or_later_native_prop:property_service set;
+#line 823
+
+#line 823
+allow system_server device_config_tethering_u_or_later_native_prop:file { getattr open read map };
+#line 823
+
+#line 823
+
+
+#line 824
+
+#line 824
+allow system_server property_socket:sock_file write;
+#line 824
+allow system_server init:unix_stream_socket connectto;
+#line 824
+
+#line 824
+allow system_server device_config_mmd_native_prop:property_service set;
+#line 824
+
+#line 824
+allow system_server device_config_mmd_native_prop:file { getattr open read map };
+#line 824
+
+#line 824
+
+
+#line 825
+
+#line 825
+allow system_server property_socket:sock_file write;
+#line 825
+allow system_server init:unix_stream_socket connectto;
+#line 825
+
+#line 825
+allow system_server smart_idle_maint_enabled_prop:property_service set;
+#line 825
+
+#line 825
+allow system_server smart_idle_maint_enabled_prop:file { getattr open read map };
+#line 825
+
+#line 825
+
+
+#line 826
+
+#line 826
+allow system_server property_socket:sock_file write;
+#line 826
+allow system_server init:unix_stream_socket connectto;
+#line 826
+
+#line 826
+allow system_server arm64_memtag_prop:property_service set;
+#line 826
+
+#line 826
+allow system_server arm64_memtag_prop:file { getattr open read map };
+#line 826
+
+#line 826
+
+
+# staged flag properties
+
+#line 829
+
+#line 829
+allow system_server property_socket:sock_file write;
+#line 829
+allow system_server init:unix_stream_socket connectto;
+#line 829
+
+#line 829
+allow system_server next_boot_prop:property_service set;
+#line 829
+
+#line 829
+allow system_server next_boot_prop:file { getattr open read map };
+#line 829
+
+#line 829
+
+
+# Allow system server to read pm.16kb.app_compat.disabled
+
+#line 832
+allow system_server pm_16kb_app_compat_prop:file { getattr open read map };
+#line 832
+
+
+# Allow query ART device config properties
+
+#line 835
+allow system_server device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 835
+
+
+#line 836
+allow system_server device_config_runtime_native_prop:file { getattr open read map };
+#line 836
+
+
+# BootReceiver to read ro.boot.bootreason
+
+#line 839
+allow system_server bootloader_boot_reason_prop:file { getattr open read map };
+#line 839
+
+# PowerManager to read sys.boot.reason
+
+#line 841
+allow system_server system_boot_reason_prop:file { getattr open read map };
+#line 841
+
+
+# Collect metrics on boot time created by init
+
+#line 844
+allow system_server boottime_prop:file { getattr open read map };
+#line 844
+
+
+# Read device's serial number from system properties
+
+#line 847
+allow system_server serialno_prop:file { getattr open read map };
+#line 847
+
+
+# Read/write the property which keeps track of whether this is the first start of system_server
+
+#line 850
+
+#line 850
+allow system_server property_socket:sock_file write;
+#line 850
+allow system_server init:unix_stream_socket connectto;
+#line 850
+
+#line 850
+allow system_server firstboot_prop:property_service set;
+#line 850
+
+#line 850
+allow system_server firstboot_prop:file { getattr open read map };
+#line 850
+
+#line 850
+
+
+# Audio service in system server can read audio config properties,
+# such as camera shutter enforcement
+
+#line 854
+allow system_server audio_config_prop:file { getattr open read map };
+#line 854
+
+
+# StorageManager service reads media config while checking if transcoding is supported.
+
+#line 857
+allow system_server media_config_prop:file { getattr open read map };
+#line 857
+
+
+# system server reads this property to keep track of whether server configurable flags have been
+# reset during current boot.
+
+#line 861
+allow system_server device_config_reset_performed_prop:file { getattr open read map };
+#line 861
+
+
+# Read/write the property that enables Test Harness Mode
+
+#line 864
+
+#line 864
+allow system_server property_socket:sock_file write;
+#line 864
+allow system_server init:unix_stream_socket connectto;
+#line 864
+
+#line 864
+allow system_server test_harness_prop:property_service set;
+#line 864
+
+#line 864
+allow system_server test_harness_prop:file { getattr open read map };
+#line 864
+
+#line 864
+
+
+# Read gsid.image_running.
+
+#line 867
+allow system_server gsid_prop:file { getattr open read map };
+#line 867
+
+
+# Read the property that mocks an OTA
+
+#line 870
+allow system_server mock_ota_prop:file { getattr open read map };
+#line 870
+
+
+# Read the property as feature flag for protecting apks with fs-verity.
+
+#line 873
+allow system_server apk_verity_prop:file { getattr open read map };
+#line 873
+
+
+# Read wifi.interface
+
+#line 876
+allow system_server wifi_prop:file { getattr open read map };
+#line 876
+
+
+# Read the vendor property that indicates if Incremental features is enabled
+
+#line 879
+allow system_server incremental_prop:file { getattr open read map };
+#line 879
+
+
+# Read ro.zram. properties
+
+#line 882
+allow system_server zram_config_prop:file { getattr open read map };
+#line 882
+
+
+# Read/write persist.sys.zram_enabled
+
+#line 885
+
+#line 885
+allow system_server property_socket:sock_file write;
+#line 885
+allow system_server init:unix_stream_socket connectto;
+#line 885
+
+#line 885
+allow system_server zram_control_prop:property_service set;
+#line 885
+
+#line 885
+allow system_server zram_control_prop:file { getattr open read map };
+#line 885
+
+#line 885
+
+
+# Read/write persist.sys.dalvik.vm.lib.2
+
+#line 888
+
+#line 888
+allow system_server property_socket:sock_file write;
+#line 888
+allow system_server init:unix_stream_socket connectto;
+#line 888
+
+#line 888
+allow system_server dalvik_runtime_prop:property_service set;
+#line 888
+
+#line 888
+allow system_server dalvik_runtime_prop:file { getattr open read map };
+#line 888
+
+#line 888
+
+
+# Read ro.control_privapp_permissions and ro.cp_system_other_odex
+
+#line 891
+allow system_server packagemanager_config_prop:file { getattr open read map };
+#line 891
+
+
+# Read the net.464xlat.cellular.enabled property (written by init).
+
+#line 894
+allow system_server net_464xlat_fromvendor_prop:file { getattr open read map };
+#line 894
+
+
+# Read hypervisor capabilities ro.boot.hypervisor.*
+
+#line 897
+allow system_server hypervisor_prop:file { getattr open read map };
+#line 897
+
+
+# Read persist.wm.debug. properties
+
+#line 900
+allow system_server persist_wm_debug_prop:file { getattr open read map };
+#line 900
+
+
+# Read persist.sysui.notification.builder_extras_override property
+
+#line 903
+allow system_server persist_sysui_builder_extras_prop:file { getattr open read map };
+#line 903
+
+# Read persist.sysui.notification.ranking_update_ashmem property
+
+#line 905
+allow system_server persist_sysui_ranking_update_prop:file { getattr open read map };
+#line 905
+
+
+# Read ro.tuner.lazyhal
+
+#line 908
+allow system_server tuner_config_prop:file { getattr open read map };
+#line 908
+
+# Write tuner.server.enable
+
+#line 910
+
+#line 910
+allow system_server property_socket:sock_file write;
+#line 910
+allow system_server init:unix_stream_socket connectto;
+#line 910
+
+#line 910
+allow system_server tuner_server_ctl_prop:property_service set;
+#line 910
+
+#line 910
+allow system_server tuner_server_ctl_prop:file { getattr open read map };
+#line 910
+
+#line 910
+
+
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+
+#line 913
+allow system_server traced_oome_heap_session_count_prop:file { getattr open read map };
+#line 913
+
+
+# Allow the sensor service (running in the system service) to read sensor
+# configuration properties
+
+#line 917
+allow system_server sensors_config_prop:file { getattr open read map };
+#line 917
+
+
+# Allow system server to determine if system services are enabled
+
+#line 920
+allow system_server system_service_enable_prop:file { getattr open read map };
+#line 920
+
+
+# Create a socket for connections from debuggerd.
+allow system_server system_ndebug_socket:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Create a socket for connections from zygotes.
+allow system_server system_unsolzygote_socket:sock_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage cache files.
+allow system_server cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow system_server { cache_file cache_recovery_file }:dir { relabelfrom { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } };
+allow system_server { cache_file cache_recovery_file }:file { relabelfrom { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } };
+allow system_server { cache_file cache_recovery_file }:fifo_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow system_server system_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server system_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# ART locks profile files.
+allow system_server system_file:file lock;
+
+# LocationManager(e.g, GPS) needs to read and write
+# to uart driver and ctrl proc entry
+allow system_server gps_control:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow system_server to use app-created sockets and pipes.
+allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
+allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
+
+# BackupManagerService needs to manipulate backup data files
+allow system_server cache_backup_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server cache_backup_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# LocalTransport works inside /cache/backup
+allow system_server cache_private_backup_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server cache_private_backup_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow system to talk to usb device
+allow system_server usb_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_server usb_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Read and delete files under /dev/fscklogs.
+
+#line 960
+allow system_server fscklogs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 960
+allow system_server fscklogs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 960
+
+allow system_server fscklogs:dir { write remove_name add_name };
+allow system_server fscklogs:file rename;
+
+# logd access, system_server inherit logd write socket
+# (urge is to deprecate this long term)
+allow system_server zygote:unix_dgram_socket write;
+
+# Read from log daemon.
+
+#line 969
+allow system_server logcat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+#line 969
+
+#line 969
+allow system_server logdr_socket:sock_file write;
+#line 969
+allow system_server logd:unix_stream_socket connectto;
+#line 969
+
+#line 969
+
+
+#line 970
+allow system_server runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 970
+
+
+# Be consistent with DAC permissions. Allow system_server to write to
+# /sys/module/lowmemorykiller/parameters/adj
+# /sys/module/lowmemorykiller/parameters/minfree
+allow system_server sysfs_lowmemorykiller:file { getattr { open append write lock map } };
+
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow system_server pstorefs:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server pstorefs:file { getattr open read ioctl lock map watch watch_reads };
+
+# /sys access
+allow system_server sysfs_zram:dir search;
+allow system_server sysfs_zram:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Read /sys/fs/selinux/policy
+allow system_server kernel:security read_policy;
+
+
+#line 990
+ allow system_server system_server_service:service_manager { add find };
+#line 990
+ neverallow { domain -system_server } system_server_service:service_manager add;
+#line 990
+
+#line 990
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 990
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 990
+
+#line 990
+;
+allow system_server artd_service:service_manager find;
+allow system_server artd_pre_reboot_service:service_manager find;
+allow system_server audioserver_service:service_manager find;
+allow system_server authorization_service:service_manager find;
+allow system_server batteryproperties_service:service_manager find;
+allow system_server cameraserver_service:service_manager find;
+allow system_server compos_service:service_manager find;
+allow system_server dataloader_manager_service:service_manager find;
+allow system_server dexopt_chroot_setup_service:service_manager find;
+allow system_server dnsresolver_service:service_manager find;
+allow system_server drmserver_service:service_manager find;
+allow system_server dumpstate_service:service_manager find;
+allow system_server fingerprintd_service:service_manager find;
+allow system_server gatekeeper_service:service_manager find;
+allow system_server gpu_service:service_manager find;
+allow system_server gsi_service:service_manager find;
+allow system_server idmap_service:service_manager find;
+allow system_server incident_service:service_manager find;
+allow system_server incremental_service:service_manager find;
+allow system_server installd_service:service_manager find;
+allow system_server keystore_maintenance_service:service_manager find;
+allow system_server keystore_metrics_service:service_manager find;
+allow system_server keystore_service:service_manager find;
+allow system_server mdns_service:service_manager find;
+allow system_server mediaserver_service:service_manager find;
+allow system_server mediametrics_service:service_manager find;
+allow system_server mediaextractor_service:service_manager find;
+allow system_server mediadrmserver_service:service_manager find;
+allow system_server mediatuner_service:service_manager find;
+allow system_server mmd_service:service_manager find;
+allow system_server netd_service:service_manager find;
+allow system_server nfc_service:service_manager find;
+allow system_server ot_daemon_service:service_manager find;
+allow system_server radio_service:service_manager find;
+allow system_server stats_service:service_manager find;
+allow system_server storaged_service:service_manager find;
+allow system_server surfaceflinger_service:service_manager find;
+allow system_server update_engine_service:service_manager find;
+allow system_server virtual_camera_service:service_manager find;
+
+#line 1030
+ allow system_server virtualization_maintenance_service:service_manager find;
+#line 1032
+
+allow system_server vold_service:service_manager find;
+allow system_server wifinl80211_service:service_manager find;
+allow system_server logd_service:service_manager find;
+#line 1038
+
+allow system_server wifi_mainline_supplicant_service:service_manager find;
+
+
+#line 1041
+ allow system_server batteryproperties_service:service_manager { add find };
+#line 1041
+ neverallow { domain -system_server } batteryproperties_service:service_manager add;
+#line 1041
+
+#line 1041
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 1041
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 1041
+
+#line 1041
+
+
+allow system_server keystore:keystore2 {
+ add_auth
+ change_password
+ change_user
+ clear_ns
+ clear_uid
+ delete_all_keys
+ get_last_auth_time
+ lock
+ pull_metrics
+ reset
+ unlock
+};
+
+allow system_server keystore:keystore2_key {
+ delete
+ use_dev_id
+ grant
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow Wifi module to manage Wi-Fi keys.
+allow system_server wifi_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow lock_settings service to manage RoR keys.
+allow system_server resume_on_reboot_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow lock_settings service to manage locksettings keys (e.g. the synthetic password key).
+allow system_server locksettings_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+
+# Allow system server to search and write to the persistent factory reset
+# protection partition. This block device does not get wiped in a factory reset.
+allow system_server block_device:dir search;
+allow system_server frp_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm system_server frp_block_device:blk_file ioctl { 0x0000127d 0x00001277 };
+
+# Create new process groups and clean up old cgroups
+allow system_server cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server cgroup:file setattr;
+allow system_server cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server cgroup_v2:file { { getattr open read ioctl lock map watch watch_reads } setattr };
+
+# /oem access
+
+#line 1108
+allow system_server oemfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1108
+allow system_server oemfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1108
+
+
+# Allow resolving per-user storage symlinks
+allow system_server { mnt_user_file storage_file }:dir { getattr search };
+allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
+
+# Allow statfs() on storage devices, which happens fast enough that
+# we shouldn't be killed during unsafe removal
+allow system_server { sdcard_type fuse }:dir { getattr search };
+
+# Traverse into expanded storage
+allow system_server mnt_expand_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow system process to relabel the fingerprint directory after mkdir
+# and delete the directory and files when no longer needed
+allow system_server fingerprintd_data_file:dir { { open getattr read search ioctl lock watch watch_reads } remove_name rmdir relabelto write };
+allow system_server fingerprintd_data_file:file { getattr unlink };
+
+#line 1141
+
+
+# For AppFuse.
+allow system_server vold:fd use;
+allow system_server fuse_device:chr_file { read write ioctl getattr };
+allow system_server app_fuse_file:file { read write getattr };
+
+# For configuring sdcardfs
+allow system_server configfs:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } };
+allow system_server configfs:file { getattr open create unlink write };
+
+# Connect to adbd and use a socket transferred from it.
+# Used for e.g. jdwp.
+allow system_server adbd_common:unix_stream_socket connectto;
+allow system_server adbd_common:fd use;
+allow system_server adbd_common:unix_stream_socket { getattr getopt ioctl read write shutdown };
+
+# Read service.adb.tls.port, persist.adb.wifi. properties
+
+#line 1159
+allow system_server adbd_prop:file { getattr open read map };
+#line 1159
+
+
+# Set persist.adb.tls_server.enable property
+
+#line 1162
+
+#line 1162
+allow system_server property_socket:sock_file write;
+#line 1162
+allow system_server init:unix_stream_socket connectto;
+#line 1162
+
+#line 1162
+allow system_server system_adbd_prop:property_service set;
+#line 1162
+
+#line 1162
+allow system_server system_adbd_prop:file { getattr open read map };
+#line 1162
+
+#line 1162
+
+
+# Set service.adbd.tradeinmode from ITradeInService.
+
+#line 1165
+
+#line 1165
+allow system_server property_socket:sock_file write;
+#line 1165
+allow system_server init:unix_stream_socket connectto;
+#line 1165
+
+#line 1165
+allow system_server adbd_tradeinmode_prop:property_service set;
+#line 1165
+
+#line 1165
+allow system_server adbd_tradeinmode_prop:file { getattr open read map };
+#line 1165
+
+#line 1165
+
+
+# Allow invoking tools like "timeout"
+allow system_server toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow system process to setup fs-verity
+allowxperm system_server { apk_data_file apk_tmp_file system_data_file apex_system_server_data_file }:file ioctl 0x6685;
+
+# Allow system process to measure fs-verity for apps, including those being installed
+allowxperm system_server { apk_data_file apk_tmp_file }:file ioctl 0x6686;
+allowxperm system_server apk_tmp_file:file ioctl 0x40086602;
+
+# Postinstall
+#
+# For OTA dexopt, allow calls coming from postinstall.
+
+#line 1180
+# Call the server domain and optionally transfer references to it.
+#line 1180
+allow system_server postinstall:binder { call transfer };
+#line 1180
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1180
+allow postinstall system_server:binder transfer;
+#line 1180
+# Receive and use open files from the server.
+#line 1180
+allow system_server postinstall:fd use;
+#line 1180
+
+
+allow system_server postinstall:fifo_file write;
+allow system_server update_engine:fd use;
+allow system_server update_engine:fifo_file write;
+
+# Access to /data/preloads
+allow system_server preloads_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow system_server preloads_data_file:dir { { open getattr read search ioctl lock watch watch_reads } write remove_name rmdir };
+allow system_server preloads_media_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+allow system_server preloads_media_file:dir { { open getattr read search ioctl lock watch watch_reads } write remove_name rmdir };
+
+
+#line 1192
+allow system_server cgroup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1192
+allow system_server cgroup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1192
+
+
+#line 1193
+allow system_server cgroup_v2:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1193
+allow system_server cgroup_v2:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1193
+
+allow system_server ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Access to /dev/dma_heap/system
+allow system_server dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+# Access to /dev/dma_heap/system-secure
+allow system_server dmabuf_system_secure_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 1201
+allow system_server proc_asound:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1201
+allow system_server proc_asound:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1201
+
+
+#line 1202
+allow system_server proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1202
+allow system_server proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1202
+
+
+#line 1203
+allow system_server proc_qtaguid_stat:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1203
+allow system_server proc_qtaguid_stat:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1203
+
+allow system_server {
+ proc_cmdline
+ proc_loadavg
+ proc_locks
+ proc_meminfo
+ proc_pagetypeinfo
+ proc_pipe_conf
+ proc_stat
+ proc_uid_cputime_showstat
+ proc_uid_io_stats
+ proc_uid_time_in_state
+ proc_uid_concurrent_active_time
+ proc_uid_concurrent_policy_time
+ proc_version
+ proc_vmallocinfo
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+allow system_server proc_uid_time_in_state:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server proc_uid_cpupower:file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 1224
+allow system_server rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1224
+allow system_server rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1224
+
+
+# Allow WifiService to start, stop, and read wifi-specific trace events.
+allow system_server debugfs_tracing_instances:dir search;
+allow system_server debugfs_wifi_tracing:dir search;
+allow system_server debugfs_wifi_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow BootReceiver to watch trace error_report events.
+allow system_server debugfs_bootreceiver_tracing:dir search;
+allow system_server debugfs_bootreceiver_tracing:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow system_server to read tracepoint ids in order to attach BPF programs to them.
+allow system_server debugfs_tracing:file { getattr open read ioctl lock map watch watch_reads };
+
+# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
+# asanwrapper.
+#line 1244
+
+
+# allow system_server to read the eBPF maps that stores the traffic stats information and update
+# the map after snapshot is recorded, and to read, update and run the maps and programs used for
+# time in state accounting
+allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:dir search;
+allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:file { getattr read write };
+allow system_server bpfloader:bpf prog_run;
+allow system_server self:bpf map_create;
+allow system_server { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+allow system_server self:key_socket create;
+# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
+# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
+dontaudit system_server self:key_socket getopt;
+
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow system_server fs_bpf_memevents:dir search;
+allow system_server fs_bpf_memevents:file { read write };
+
+# Allow system_server to start clatd in its own domain and kill it.
+
+#line 1265
+# Allow the necessary permissions.
+#line 1265
+
+#line 1265
+# Old domain may exec the file and transition to the new domain.
+#line 1265
+allow system_server clatd_exec:file { getattr open read execute map };
+#line 1265
+allow system_server clatd:process transition;
+#line 1265
+# New domain is entered by executing the file.
+#line 1265
+allow clatd clatd_exec:file { entrypoint open read execute getattr map };
+#line 1265
+# New domain can send SIGCHLD to its caller.
+#line 1265
+allow clatd system_server:process sigchld;
+#line 1265
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1265
+dontaudit system_server clatd:process noatsecure;
+#line 1265
+# XXX dontaudit candidate but requires further study.
+#line 1265
+allow system_server clatd:process { siginh rlimitinh };
+#line 1265
+
+#line 1265
+# Make the transition occur by default.
+#line 1265
+type_transition system_server clatd_exec:process clatd;
+#line 1265
+
+allow system_server clatd:process { sigkill signal };
+
+# ART Profiles.
+# Allow system_server to open profile snapshots for read.
+# System server never reads the actual content. It passes the descriptor to
+# to privileged apps which acquire the permissions to inspect the profiles.
+allow system_server { user_profile_root_file user_profile_data_file}:dir { getattr search };
+allow system_server user_profile_data_file:file { getattr open read };
+
+# System server may dump profile data for debuggable apps in the /data/misc/profman.
+# As such it needs to be able create files but it should never read from them.
+# It also needs to stat the directory to check if it has the right permissions.
+allow system_server profman_dump_data_file:file { create getattr setattr { open append write lock map }};
+allow system_server profman_dump_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# On userdebug build we may profile system server. Allow it to write and create its own profile.
+#line 1285
+
+# Allow system server to load JVMTI agents under control of a property.
+
+#line 1287
+allow system_server system_jvmti_agent_prop:file { getattr open read map };
+#line 1287
+
+
+# UsbDeviceManager uses /dev/usb-ffs
+allow system_server functionfs:dir search;
+allow system_server functionfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# To resolve arbitrary sysfs paths from /sys/class/udc/* symlinks.
+
+#line 1293
+allow system_server sysfs_type:dir search;
+#line 1293
+
+#line 1293
+allow system_server sysfs_udc:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1293
+allow system_server sysfs_udc:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 1293
+
+#line 1296
+
+
+# system_server contains time / time zone detection logic so reads the associated properties.
+
+#line 1299
+allow system_server time_prop:file { getattr open read map };
+#line 1299
+
+
+# system_server reads this property to know it should expect the lmkd sends notification to it
+# on low memory kills.
+
+#line 1303
+allow system_server system_lmk_prop:file { getattr open read map };
+#line 1303
+
+
+
+#line 1305
+allow system_server wifi_config_prop:file { getattr open read map };
+#line 1305
+
+
+# Only system server can access BINDER_FREEZE and BINDER_GET_FROZEN_INFO
+allowxperm system_server binder_device:chr_file ioctl { 0x400c620e 0xc00c620f };
+
+# Watchdog prints debugging log to /dev/kmsg_debug.
+#line 1313
+
+# Watchdog reads sysprops framework_watchdog.fatal_* to handle watchdog timeout loop.
+
+#line 1315
+allow system_server framework_watchdog_config_prop:file { getattr open read map };
+#line 1315
+
+
+
+# Font files are written by system server
+allow system_server font_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server font_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+# Allow system process to setup and measure fs-verity for font files
+allowxperm system_server font_data_file:file ioctl { 0x6685 0x6686 };
+
+# Read qemu.hw.mainkeys property
+
+#line 1325
+allow system_server qemu_hw_prop:file { getattr open read map };
+#line 1325
+
+
+# Allow system server to read profcollectd reports for upload.
+
+
+# Power controls for debugging/diagnostics
+
+#line 1331
+allow system_server power_debug_prop:file { getattr open read map };
+#line 1331
+
+
+#line 1332
+
+#line 1332
+allow system_server property_socket:sock_file write;
+#line 1332
+allow system_server init:unix_stream_socket connectto;
+#line 1332
+
+#line 1332
+allow system_server power_debug_prop:property_service set;
+#line 1332
+
+#line 1332
+allow system_server power_debug_prop:file { getattr open read map };
+#line 1332
+
+#line 1332
+
+
+###
+### Neverallow rules
+###
+### system_server should NEVER do any of this
+
+# Do not allow opening files from external storage as unsafe ejection
+# could cause the kernel to kill the system_server.
+neverallow system_server { sdcard_type fuse }:dir { open read write };
+neverallow system_server { sdcard_type fuse }:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# system server should never be operating on zygote spawned app data
+# files directly. Rather, they should always be passed via a
+# file descriptor.
+# Exclude those types that system_server needs to open directly.
+neverallow system_server {
+ app_data_file_type
+ -system_app_data_file
+ -radio_data_file
+}:file { open create unlink link };
+
+# Forking and execing is inherently dangerous and racy. See, for
+# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
+# Prevent the addition of new file execs to stop the problem from
+# getting worse. b/28035297
+neverallow system_server {
+ file_type
+ -toolbox_exec
+ -logcat_exec
+
+}:file execute_no_trans;
+
+# Ensure that system_server doesn't perform any domain transitions other than
+# transitioning to the crash_dump domain when a crash occurs or fork clatd.
+# add perfetto and trace_redactor which are exec'd from system server for ProfilingService.
+neverallow system_server { domain -clatd -crash_dump -perfetto -trace_redactor }:process transition;
+neverallow system_server *:process dyntransition;
+
+# Ensure that system_server doesn't access anything but search in perfetto_traces_data_file:dir.
+neverallow system_server perfetto_traces_data_file:dir ~search;
+
+# Only allow crash_dump to connect to system_ndebug_socket.
+neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
+
+# Only allow zygotes to connect to system_unsolzygote_socket.
+neverallow {
+ domain
+ -init
+ -system_server
+ -zygote
+ -app_zygote
+ -webview_zygote
+} system_unsolzygote_socket:sock_file { open write };
+
+# Only allow init, system_server, flags_health_check to set properties for server configurable flags
+neverallow {
+ domain
+ -init
+ -system_server
+ -flags_health_check
+} {
+ device_config_core_experiments_team_internal_prop
+ device_config_activity_manager_native_boot_prop
+ device_config_connectivity_prop
+ device_config_input_native_boot_prop
+ device_config_lmkd_native_prop
+ device_config_netd_native_prop
+ device_config_nnapi_native_prop
+ device_config_edgetpu_native_prop
+ device_config_runtime_native_boot_prop
+ device_config_runtime_native_prop
+ device_config_media_native_prop
+ device_config_mglru_native_prop
+ device_config_remote_key_provisioning_native_prop
+ device_config_storage_native_boot_prop
+ device_config_surface_flinger_native_boot_prop
+ device_config_sys_traced_prop
+ device_config_swcodec_native_prop
+ device_config_aconfig_flags_prop
+ device_config_window_manager_native_boot_prop
+ device_config_tethering_u_or_later_native_prop
+ device_config_mmd_native_prop
+ next_boot_prop
+}:property_service set;
+
+# Only allow system_server and init to set tuner_server_ctl_prop
+neverallow {
+ domain
+ -system_server
+ -init
+} tuner_server_ctl_prop:property_service set;
+
+# system_server should never be executing dex2oat. This is either
+# a bug (for example, bug 16317188), or represents an attempt by
+# system server to dynamically load a dex file, something we do not
+# want to allow.
+neverallow system_server dex2oat_exec:file { execute execute_no_trans };
+
+# system_server should never execute or load executable shared libraries
+# in /data. Executable files in /data are a persistence vector.
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
+neverallow system_server data_file_type:file { execute execute_no_trans };
+
+# The only block device system_server should be writing to is
+# the frp_block_device. This helps avoid a system_server to root
+# escalation by writing to raw block devices.
+# The system_server may need to read from vd_device if it uses
+# block apexes.
+neverallow system_server { dev_type -frp_block_device }:blk_file { append create link unlink relabelfrom rename setattr write };
+neverallow system_server { dev_type -frp_block_device -vd_device }:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# system_server should never use JIT functionality
+# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
+# in the section titled "A Short ROP Chain" for why.
+# However, in emulator builds without OpenGL passthrough, we use software
+# rendering via SwiftShader, which requires JIT support. These builds are
+# never shipped to users.
+neverallow system_server self:process execmem;
+#line 1453
+neverallow system_server { ashmem_device ashmem_libcutils_device }:chr_file execute;
+
+# TODO: deal with tmpfs_domain pub/priv split properly
+neverallow system_server system_server_tmpfs:file execute;
+
+# Resources handed off by system_server_startup
+allow system_server system_server_startup:fd use;
+allow system_server system_server_startup_tmpfs:file { read write map };
+allow system_server system_server_startup:unix_dgram_socket write;
+
+# Allow system server to communicate to apexd
+allow system_server apex_service:service_manager find;
+allow system_server apexd:binder call;
+
+# Allow system server to scan /apex for flattened APEXes
+allow system_server apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow system server to read /apex/apex-info-list.xml
+allow system_server apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow system_server to communicate with tradeinmode.
+
+#line 1474
+# Call the server domain and optionally transfer references to it.
+#line 1474
+allow system_server tradeinmode:binder { call transfer };
+#line 1474
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1474
+allow tradeinmode system_server:binder transfer;
+#line 1474
+# Receive and use open files from the server.
+#line 1474
+allow system_server tradeinmode:fd use;
+#line 1474
+
+
+# Allow system server to communicate to system-suspend's control interface
+allow system_server system_suspend_control_internal_service:service_manager find;
+allow system_server system_suspend_control_service:service_manager find;
+
+#line 1479
+# Call the server domain and optionally transfer references to it.
+#line 1479
+allow system_server system_suspend:binder { call transfer };
+#line 1479
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1479
+allow system_suspend system_server:binder transfer;
+#line 1479
+# Receive and use open files from the server.
+#line 1479
+allow system_server system_suspend:fd use;
+#line 1479
+
+
+#line 1480
+# Call the server domain and optionally transfer references to it.
+#line 1480
+allow system_suspend system_server:binder { call transfer };
+#line 1480
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1480
+allow system_server system_suspend:binder transfer;
+#line 1480
+# Receive and use open files from the server.
+#line 1480
+allow system_suspend system_server:fd use;
+#line 1480
+
+
+# Allow system server to communicate to system-suspend's wakelock interface
+
+#line 1483
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 1483
+# deprecated.
+#line 1483
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 1483
+allow system_server sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1483
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 1483
+allow system_server self:{ capability2 cap2_userns } block_suspend;
+#line 1483
+# system_suspend permissions
+#line 1483
+
+#line 1483
+# Call the server domain and optionally transfer references to it.
+#line 1483
+allow system_server system_suspend_server:binder { call transfer };
+#line 1483
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 1483
+allow system_suspend_server system_server:binder transfer;
+#line 1483
+# Receive and use open files from the server.
+#line 1483
+allow system_server system_suspend_server:fd use;
+#line 1483
+
+#line 1483
+allow system_server system_suspend_hwservice:hwservice_manager find;
+#line 1483
+# halclientdomain permissions
+#line 1483
+
+#line 1483
+# Call the hwservicemanager and transfer references to it.
+#line 1483
+allow system_server hwservicemanager:binder { call transfer };
+#line 1483
+# Allow hwservicemanager to send out callbacks
+#line 1483
+allow hwservicemanager system_server:binder { call transfer };
+#line 1483
+# hwservicemanager performs getpidcon on clients.
+#line 1483
+allow hwservicemanager system_server:dir search;
+#line 1483
+allow hwservicemanager system_server:file { read open map };
+#line 1483
+allow hwservicemanager system_server:process getattr;
+#line 1483
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 1483
+# all domains in domain.te.
+#line 1483
+
+#line 1483
+
+#line 1483
+allow system_server hwservicemanager_prop:file { getattr open read map };
+#line 1483
+
+#line 1483
+allow system_server hidl_manager_hwservice:hwservice_manager find;
+#line 1483
+# AIDL suspend hal permissions
+#line 1483
+allow system_server hal_system_suspend_service:service_manager find;
+#line 1483
+
+#line 1483
+# Call the servicemanager and transfer references to it.
+#line 1483
+allow system_server servicemanager:binder { call transfer };
+#line 1483
+# Allow servicemanager to send out callbacks
+#line 1483
+allow servicemanager system_server:binder { call transfer };
+#line 1483
+# servicemanager performs getpidcon on clients.
+#line 1483
+allow servicemanager system_server:dir search;
+#line 1483
+allow servicemanager system_server:file { read open };
+#line 1483
+allow servicemanager system_server:process getattr;
+#line 1483
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 1483
+# all domains in domain.te.
+#line 1483
+
+#line 1483
+
+
+# Allow the system server to read files under /data/apex. The system_server
+# needs these privileges to compare file signatures while processing installs.
+#
+# Only apexd is allowed to create new entries or write to any file under /data/apex.
+allow system_server apex_data_file:dir { getattr search };
+allow system_server apex_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow the system server to read files under /vendor/apex. This is where
+# vendor APEX packages might be installed and system_server needs to parse
+# these packages to inspect the signatures and other metadata.
+allow system_server vendor_apex_file:dir { getattr search };
+allow system_server vendor_apex_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow the system server to manage relevant apex module data files.
+allow system_server apex_module_data_file:dir { getattr search };
+# These are modules where the code runs in system_server, so we need full access.
+allow system_server apex_system_server_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apex_system_server_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server apex_tethering_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apex_tethering_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow system_server apex_uwb_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server apex_uwb_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# Legacy labels that we still need to support (b/217581286)
+allow system_server {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_wifi_data_file
+}:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_wifi_data_file
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can
+# communicate which slots are available for use.
+allow system_server metadata_file:dir search;
+allow system_server password_slot_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server password_slot_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow TradeInMode service rw access to /metadata/tradeinmode.
+allow system_server tradeinmode_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server tradeinmode_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow system_server userspace_reboot_metadata_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server userspace_reboot_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow system server rw access to files in /metadata/staged-install folder
+allow system_server staged_install_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server staged_install_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow system_server watchdog_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server watchdog_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow system_server write to aconfigd socket
+
+#line 1542
+allow system_server aconfigd_socket:sock_file write;
+#line 1542
+allow system_server aconfigd:unix_stream_socket connectto;
+#line 1542
+;
+
+# allow system_server write to aconfigd_mainline socket
+
+#line 1545
+allow system_server aconfigd_mainline_socket:sock_file write;
+#line 1545
+allow system_server aconfigd_mainline:unix_stream_socket connectto;
+#line 1545
+;
+
+allow system_server repair_mode_metadata_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server repair_mode_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+allow system_server gsi_persistent_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server gsi_persistent_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow system server read and remove files under /data/misc/odrefresh
+allow system_server odrefresh_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow system_server odrefresh_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+
+# Allow system server r access to /system/bin/surfaceflinger for PinnerService.
+allow system_server surfaceflinger_exec:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow init to set sysprop used to compute stats about userspace reboot.
+
+#line 1561
+
+#line 1561
+allow system_server property_socket:sock_file write;
+#line 1561
+allow system_server init:unix_stream_socket connectto;
+#line 1561
+
+#line 1561
+allow system_server userspace_reboot_log_prop:property_service set;
+#line 1561
+
+#line 1561
+allow system_server userspace_reboot_log_prop:file { getattr open read map };
+#line 1561
+
+#line 1561
+
+
+# JVMTI agent settings are only readable from the system server.
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -init
+ -vendor_init
+} {
+ system_jvmti_agent_prop
+}:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Read/Write /proc/pressure/memory
+allow system_server proc_pressure_mem:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+# Read /proc/pressure/cpu and /proc/pressure/io
+allow system_server { proc_pressure_cpu proc_pressure_io }:file { getattr open read ioctl lock map watch watch_reads };
+
+# No ptracing others
+neverallow system_server { domain -system_server }:process ptrace;
+
+# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
+# file read access. However, that is now unnecessary (b/34951864)
+neverallow system_server system_server:{ capability cap_userns } sys_resource;
+
+# Only system_server/init should access /metadata/password_slots.
+neverallow { domain -init -system_server } password_slot_metadata_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_server
+} password_slot_metadata_file:{ file lnk_file sock_file fifo_file } ~{ relabelto getattr };
+neverallow { domain -init -system_server } password_slot_metadata_file:{ file lnk_file sock_file fifo_file } *;
+
+# Allow systemserver to read/write the invalidation property
+
+#line 1596
+
+#line 1596
+allow system_server property_socket:sock_file write;
+#line 1596
+allow system_server init:unix_stream_socket connectto;
+#line 1596
+
+#line 1596
+allow system_server binder_cache_system_server_prop:property_service set;
+#line 1596
+
+#line 1596
+allow system_server binder_cache_system_server_prop:file { getattr open read map };
+#line 1596
+
+#line 1596
+
+neverallow { domain -system_server -init }
+ binder_cache_system_server_prop:property_service set;
+
+# Allow system server to attach BPF programs to tracepoints. Deny read permission so that
+# system_server cannot use this access to read perf event data like process stacks.
+allow system_server self:perf_event { open write cpu kernel };
+neverallow system_server self:perf_event ~{ open write cpu kernel };
+
+# Allow writing files under /data/system/shutdown-checkpoints/
+allow system_server shutdown_checkpoints_system_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow system_server shutdown_checkpoints_system_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Do not allow any domain other than init or system server to set the property
+neverallow { domain -init -system_server } socket_hook_prop:property_service set;
+
+neverallow { domain -init -system_server } boot_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_server
+} wifi_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Only allow system server to write uhid sysfs files
+neverallow {
+ domain
+ -init
+ -system_server
+ -ueventd
+ -vendor_init
+} sysfs_uhid:file { append create link unlink relabelfrom rename setattr write };
+
+# BINDER_FREEZE is used to block ipc transactions to frozen processes, so it
+# can be accessed by system_server only (b/143717177)
+# BINDER_GET_FROZEN_INFO is used by system_server to determine the state of a frozen binder
+# interface
+neverallowxperm { domain -system_server } binder_device:chr_file ioctl { 0x400c620e 0xc00c620f };
+
+# Only system server can write the font files.
+neverallow { domain -init -system_server } font_data_file:file { append create link unlink relabelfrom rename setattr write };
+neverallow { domain -init -system_server } font_data_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+
+# Allow reading /system/etc/font_fallback.xml
+allow system_server system_font_fallback_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow system server to set dynamic ART properties.
+
+#line 1645
+
+#line 1645
+allow system_server property_socket:sock_file write;
+#line 1645
+allow system_server init:unix_stream_socket connectto;
+#line 1645
+
+#line 1645
+allow system_server dalvik_dynamic_config_prop:property_service set;
+#line 1645
+
+#line 1645
+allow system_server dalvik_dynamic_config_prop:file { getattr open read map };
+#line 1645
+
+#line 1645
+
+
+# Allow system server to read binderfs
+allow system_server binderfs_logs:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server binderfs_logs_stats:file { getattr open read ioctl lock map watch watch_reads };
+
+# For ANRs
+#line 1654
+
+
+# Allow GameManagerService to read and write persist.graphics.game_default_frame_rate.enabled
+
+#line 1657
+
+#line 1657
+allow system_server property_socket:sock_file write;
+#line 1657
+allow system_server init:unix_stream_socket connectto;
+#line 1657
+
+#line 1657
+allow system_server game_manager_config_prop:property_service set;
+#line 1657
+
+#line 1657
+allow system_server game_manager_config_prop:file { getattr open read map };
+#line 1657
+
+#line 1657
+
+
+# Allow system server to write HintManagerService properties
+
+#line 1660
+
+#line 1660
+allow system_server property_socket:sock_file write;
+#line 1660
+allow system_server init:unix_stream_socket connectto;
+#line 1660
+
+#line 1660
+allow system_server hint_manager_config_prop:property_service set;
+#line 1660
+
+#line 1660
+allow system_server hint_manager_config_prop:file { getattr open read map };
+#line 1660
+
+#line 1660
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -system_server
+
+} hint_manager_config_prop:property_service set;
+
+# ThreadNetworkService reads Thread Network properties
+
+#line 1670
+allow system_server threadnetwork_config_prop:file { getattr open read map };
+#line 1670
+
+
+# Do not allow any domain other than init and system server to set the property
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_server
+} threadnetwork_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow accessing /mnt/pre_reboot_dexopt/chroot, to load the new service-art.jar
+# in Pre-reboot Dexopt.
+allow system_server pre_reboot_dexopt_file:dir { getattr search };
+
+# Allow system_server to reopen its own memfd.
+# system_server needs to copy the new service-art.jar to a memfd and reopen it with the path
+# /proc/self/fd/<fd> with a classloader.
+allow system_server system_server_tmpfs:file open;
+
+# Allow system_server to read from postinstall scripts through STDIN, to check if the
+# otapreopt_script is still alive.
+allow system_server postinstall:fifo_file read;
+
+# Allow system_server to kill artd and its subprocesses, to make sure that no process is accessing
+# files in chroot when we teardown chroot.
+allow system_server {
+ artd
+ derive_classpath
+ dex2oat
+ odrefresh
+ profman
+}:process sigkill;
+
+# Do not allow any domain other than init or system server to get or set the property
+neverallow { domain -init -system_server } crashrecovery_prop:property_service set;
+neverallow { domain -init -dumpstate -system_server } crashrecovery_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Do not allow anything other than system_server and init to touch /metadata/tradeinmode.
+neverallow { domain -init -system_server } tradeinmode_metadata_file:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -system_server
+ -shell
+} power_debug_prop:property_service set;
+#line 1 "system/sepolicy/private/system_server_startup.te"
+type system_server_startup, domain, coredomain;
+type system_server_startup_tmpfs, file_type;
+
+
+#line 4
+type_transition system_server_startup tmpfs:file system_server_startup_tmpfs;
+#line 4
+allow system_server_startup system_server_startup_tmpfs:file { read write getattr map };
+#line 4
+
+
+# Create JIT memory
+allow system_server_startup self:process execmem;
+allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
+
+# Allow to pick up integrity-checked artifacts from the ART APEX dalvik cache.
+allow system_server_startup apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow system_server_startup apex_art_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# Allow system_server_startup to run setcon() and enter the
+# system_server domain
+allow system_server_startup self:process setcurrent;
+allow system_server_startup system_server:process dyntransition;
+
+# Child of the zygote.
+allow system_server_startup zygote:process sigchld;
+
+# Allow query ART device config properties
+
+#line 23
+allow system_server_startup device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 23
+
+
+#line 24
+allow system_server_startup device_config_runtime_native_prop:file { getattr open read map };
+#line 24
+
+#line 1 "system/sepolicy/private/system_suspend.te"
+type system_suspend, domain, coredomain, system_suspend_server, system_suspend_internal_server;
+
+type system_suspend_exec, system_file_type, exec_type, file_type;
+
+#line 4
+
+#line 4
+# Allow the necessary permissions.
+#line 4
+
+#line 4
+# Old domain may exec the file and transition to the new domain.
+#line 4
+allow init system_suspend_exec:file { getattr open read execute map };
+#line 4
+allow init system_suspend:process transition;
+#line 4
+# New domain is entered by executing the file.
+#line 4
+allow system_suspend system_suspend_exec:file { entrypoint open read execute getattr map };
+#line 4
+# New domain can send SIGCHLD to its caller.
+#line 4
+
+#line 4
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 4
+dontaudit init system_suspend:process noatsecure;
+#line 4
+# XXX dontaudit candidate but requires further study.
+#line 4
+allow init system_suspend:process { siginh rlimitinh };
+#line 4
+
+#line 4
+# Make the transition occur by default.
+#line 4
+type_transition init system_suspend_exec:process system_suspend;
+#line 4
+
+#line 4
+
+
+# To serve ISuspendControlService.
+
+#line 7
+# Call the servicemanager and transfer references to it.
+#line 7
+allow system_suspend servicemanager:binder { call transfer };
+#line 7
+# Allow servicemanager to send out callbacks
+#line 7
+allow servicemanager system_suspend:binder { call transfer };
+#line 7
+# servicemanager performs getpidcon on clients.
+#line 7
+allow servicemanager system_suspend:dir search;
+#line 7
+allow servicemanager system_suspend:file { read open };
+#line 7
+allow servicemanager system_suspend:process getattr;
+#line 7
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 7
+# all domains in domain.te.
+#line 7
+
+
+#line 8
+ allow system_suspend system_suspend_control_service:service_manager { add find };
+#line 8
+ neverallow { domain -system_suspend } system_suspend_control_service:service_manager add;
+#line 8
+
+#line 8
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 8
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 8
+
+#line 8
+
+
+
+#line 10
+ allow system_suspend hal_system_suspend_service:service_manager { add find };
+#line 10
+ neverallow { domain -system_suspend } hal_system_suspend_service:service_manager add;
+#line 10
+
+#line 10
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 10
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 10
+
+#line 10
+
+
+# Access to /sys/power/{ wakeup_count, state } suspend interface.
+allow system_suspend sysfs_power:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access to wakeup, suspend stats, and wakeup reasons.
+
+#line 16
+allow system_suspend sysfs_suspend_stats:dir { open getattr read search ioctl lock watch watch_reads };
+#line 16
+allow system_suspend sysfs_suspend_stats:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 16
+
+
+#line 17
+allow system_suspend sysfs_wakeup:dir { open getattr read search ioctl lock watch watch_reads };
+#line 17
+allow system_suspend sysfs_wakeup:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 17
+
+
+#line 18
+allow system_suspend sysfs_wakeup_reasons:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow system_suspend sysfs_wakeup_reasons:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 18
+
+# To resolve arbitrary sysfs paths from /sys/class/wakeup/* symlinks.
+allow system_suspend sysfs_type:dir search;
+
+# Access to suspend_hal system properties
+
+#line 23
+allow system_suspend suspend_prop:file { getattr open read map };
+#line 23
+
+
+# Access to system_suspend debug system properties
+#line 28
+
+
+# To call BTAA registered callbacks
+allow system_suspend bluetooth:binder call;
+
+# For adding `dumpsys syspend_control` output to bugreport
+allow system_suspend dumpstate:fd use;
+allow system_suspend dumpstate:fifo_file write;
+
+# Allow init to take kernel wakelock and system suspend to
+# remove kenel wakelocks and the capability to access these
+# files
+allow init sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow init self:{ capability2 cap2_userns } block_suspend;
+allow system_suspend sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow system_suspend self:{ capability2 cap2_userns } block_suspend;
+
+# Allow init to set /sys/power/sync_on_suspend.
+allow init sysfs_sync_on_suspend:file { open append write lock map };
+
+neverallow {
+ domain
+ -atrace # tracing
+ -bluetooth # support Bluetooth activity attribution (BTAA)
+ -dumpstate # bug reports
+ -system_suspend # implements system_suspend_control_service
+ -system_server # configures system_suspend via ISuspendControlService
+ -traceur_app # tracing
+} system_suspend_control_service:service_manager find;
+#line 1 "system/sepolicy/private/system_suspend_internal_server.te"
+# To serve ISuspendControlServiceInternal.
+
+#line 2
+ allow system_suspend_internal_server system_suspend_control_internal_service:service_manager { add find };
+#line 2
+ neverallow { domain -system_suspend_internal_server } system_suspend_control_internal_service:service_manager add;
+#line 2
+
+#line 2
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 2
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 2
+
+#line 2
+
+
+neverallow {
+ domain
+ -atrace # tracing
+ -dumpstate # bug reports
+ -system_suspend_internal_server # implements system_suspend_control_internal_service
+ -system_server # configures system_suspend via ISuspendControlServiceInternal
+ -traced_probes # tracing
+ -traceur_app # tracing
+} system_suspend_control_internal_service:service_manager find;
+#line 1 "system/sepolicy/private/system_suspend_server.te"
+# Required to export a HIDL interface.
+
+#line 2
+# Call the hwservicemanager and transfer references to it.
+#line 2
+allow system_suspend_server hwservicemanager:binder { call transfer };
+#line 2
+# Allow hwservicemanager to send out callbacks
+#line 2
+allow hwservicemanager system_suspend_server:binder { call transfer };
+#line 2
+# hwservicemanager performs getpidcon on clients.
+#line 2
+allow hwservicemanager system_suspend_server:dir search;
+#line 2
+allow hwservicemanager system_suspend_server:file { read open map };
+#line 2
+allow hwservicemanager system_suspend_server:process getattr;
+#line 2
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 2
+# all domains in domain.te.
+#line 2
+
+
+#line 3
+allow system_suspend_server hwservicemanager_prop:file { getattr open read map };
+#line 3
+
+
+# To serve ISystemSuspend.hal.
+
+#line 6
+ allow system_suspend_server system_suspend_hwservice:hwservice_manager { add find };
+#line 6
+ allow system_suspend_server hidl_base_hwservice:hwservice_manager add;
+#line 6
+ neverallow { domain -system_suspend_server } system_suspend_hwservice:hwservice_manager add;
+#line 6
+
+#line 1 "system/sepolicy/private/tee.te"
+allow tee fingerprint_vendor_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow tee fingerprint_vendor_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1 "system/sepolicy/private/tee_services.te"
+# Specify tee_services in this file.
+# Please keep the names in the alphabetical order and comment each new entry.
+
+# An example tee_service that can be used to test end-to-end integration of custom
+# smcs filtering feature on a device with pkvm hypervisor.
+type test_pkvm_tee_service, tee_service_type;
+#line 1 "system/sepolicy/private/tombstoned.te"
+typeattribute tombstoned coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init tombstoned_exec:file { getattr open read execute map };
+#line 3
+allow init tombstoned:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow tombstoned tombstoned_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init tombstoned:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init tombstoned:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init tombstoned_exec:process tombstoned;
+#line 3
+
+#line 3
+
+
+
+#line 5
+allow tombstoned tombstone_config_prop:file { getattr open read map };
+#line 5
+
+
+# Write to arbitrary pipes given to us.
+allow tombstoned domain:fd use;
+allow tombstoned domain:fifo_file write;
+
+allow tombstoned domain:dir { open getattr read search ioctl lock watch watch_reads };
+allow tombstoned domain:file { getattr open read ioctl lock map watch watch_reads };
+allow tombstoned tombstone_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow tombstoned tombstone_data_file:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } link };
+
+# Changes for the new stack dumping mechanism. Each trace goes into a
+# separate file, and these files are managed by tombstoned.
+allow tombstoned anr_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow tombstoned anr_data_file:file { append create getattr open link unlink };
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -tombstoned
+} tombstone_config_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 1 "system/sepolicy/private/toolbox.te"
+typeattribute toolbox coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init toolbox_exec:file { getattr open read execute map };
+#line 3
+allow init toolbox:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow toolbox toolbox_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init toolbox:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init toolbox:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init toolbox_exec:process toolbox;
+#line 3
+
+#line 3
+
+
+# rm -rf in /data/misc/virtualizationservice
+allow toolbox virtualizationservice_data_file:dir { rmdir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow toolbox virtualizationservice_data_file:file { getattr unlink };
+
+# If we can't remove these directories we try to chmod them. That
+# doesn't work, but it doesn't matter as virtualizationservice itself
+# will delete them when it starts. See b/235338094#comment39
+dontaudit toolbox virtualizationservice_data_file:dir setattr;
+
+# /dev/__null__ created by init prior to policy load,
+# open fd inherited by fsck.
+allow toolbox tmpfs:chr_file { read write ioctl };
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow toolbox devpts:chr_file { read write getattr ioctl };
+
+# mkswap-specific.
+# Read/write block devices used for swap partitions.
+# Assign swap_block_device type any such partition in your
+# device/<vendor>/<product>/sepolicy/file_contexts file.
+allow toolbox block_device:dir search;
+allow toolbox swap_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# rm -rf /data/per_boot
+allow toolbox system_data_root_file:dir { remove_name write };
+allow toolbox system_data_file:dir { rmdir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow toolbox system_data_file:file { getattr unlink };
+
+# chattr +F /data/media in init
+allow toolbox media_userdir_file:dir { { open getattr read search ioctl lock watch watch_reads } setattr };
+allowxperm toolbox media_userdir_file:dir ioctl { 0x40086602 0x80086601 };
+
+###
+### Neverallow rules
+###
+
+# Only allow entry from init via the toolbox binary.
+neverallow { domain -init } toolbox:process transition;
+neverallow * toolbox:process dyntransition;
+neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
+#line 1 "system/sepolicy/private/trace_redactor.te"
+# Trace Redactor command line
+type trace_redactor_exec, system_file_type, exec_type, file_type;
+type trace_redactor, domain, coredomain;
+
+# Use pipes provided by system_server
+allow trace_redactor system_server:fd use;
+allow trace_redactor system_server:fifo_file { read write getattr ioctl };
+
+# Allow trace_redactor to read output trace file and write to new redacted file.
+allow trace_redactor perfetto_traces_profiling_data_file:dir search;
+allow trace_redactor perfetto_traces_data_file:dir search;
+allow trace_redactor perfetto_traces_data_file:file { read getattr ioctl };
+allow trace_redactor perfetto_traces_profiling_data_file:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/traced.te"
+# Perfetto user-space tracing daemon (unprivileged)
+type traced_exec, system_file_type, exec_type, file_type;
+
+# Allow init to exec the daemon.
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init traced_exec:file { getattr open read execute map };
+#line 5
+allow init traced:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow traced traced_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init traced:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init traced:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init traced_exec:process traced;
+#line 5
+
+#line 5
+
+
+#line 6
+type_transition traced tmpfs:file traced_tmpfs;
+#line 6
+allow traced traced_tmpfs:file { read write getattr map };
+#line 6
+
+
+# Allow apps in other MLS contexts (for multi-user) to access
+# share memory buffers created by traced.
+typeattribute traced_tmpfs mlstrustedobject;
+
+# Allow traced to start with a lower scheduling class and change
+# class accordingly to what defined in the config provided by
+# the privileged process that controls it.
+allow traced self:{ capability cap_userns } { sys_nice };
+
+# Allow to pass a file descriptor for the output trace from "perfetto" (the
+# cmdline client) and other shell binaries to traced and let traced write
+# directly into that (rather than returning the trace contents over the socket).
+allow traced perfetto:fd use;
+allow traced shell:fd use;
+allow traced shell:fifo_file { read write };
+
+# Allow the service to create new files within /data/misc/perfetto-traces.
+allow traced perfetto_traces_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow traced perfetto_traces_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Allow traceur to pass open file descriptors to traced, so traced can directly
+# write into the output file without doing roundtrips over IPC.
+allow traced traceur_app:fd use;
+allow traced platform_app:fd use;
+allow traced trace_data_file:file { read write };
+
+# Allow perfetto to access the proxy service for notifying Traceur.
+allow traced tracingproxy_service:service_manager find;
+
+#line 36
+# Call the servicemanager and transfer references to it.
+#line 36
+allow traced servicemanager:binder { call transfer };
+#line 36
+# Allow servicemanager to send out callbacks
+#line 36
+allow servicemanager traced:binder { call transfer };
+#line 36
+# servicemanager performs getpidcon on clients.
+#line 36
+allow servicemanager traced:dir search;
+#line 36
+allow servicemanager traced:file { read open };
+#line 36
+allow servicemanager traced:process getattr;
+#line 36
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 36
+# all domains in domain.te.
+#line 36
+;
+
+#line 37
+# Call the server domain and optionally transfer references to it.
+#line 37
+allow traced system_server:binder { call transfer };
+#line 37
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 37
+allow system_server traced:binder transfer;
+#line 37
+# Receive and use open files from the server.
+#line 37
+allow traced system_server:fd use;
+#line 37
+;
+
+# Allow traced to use shared memory supplied by producers. Typically, traced
+# (i.e. the tracing service) creates the shared memory used for data transfer
+# from the producer. This rule allows an alternative scheme, where the producer
+# creates the shared memory, that is then adopted by traced (after validating
+# that it is appropriately sealed).
+# This list has to replicate the tmpfs domains of all applicable domains that
+# have perfetto_producer() macro applied to them.
+# perfetto_tmpfs excluded as it should never need to use the producer-supplied
+# shared memory scheme.
+allow traced {
+ appdomain_tmpfs
+ heapprofd_tmpfs
+ surfaceflinger_tmpfs
+ traced_probes_tmpfs
+
+}:file { getattr map read write };
+
+# Allow traced to detect if a process is frozen (b/381089063).
+allow traced cgroup_v2:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow setting debug properties which guard initialization of the Perfetto SDK
+# in SurfaceFlinger and HWUI's copy of Skia.
+# Required for the android.sdk_sysprop_guard data source.
+# TODO(b/281329340): remove this when no longer needed.
+
+#line 63
+
+#line 63
+allow traced property_socket:sock_file write;
+#line 63
+allow traced init:unix_stream_socket connectto;
+#line 63
+
+#line 63
+allow traced debug_prop:property_service set;
+#line 63
+
+#line 63
+allow traced debug_prop:file { getattr open read map };
+#line 63
+
+#line 63
+
+# Allow traced to notify Traceur when a trace ends by setting the
+# sys.trace.trace_end_signal property.
+
+#line 66
+
+#line 66
+allow traced property_socket:sock_file write;
+#line 66
+allow traced init:unix_stream_socket connectto;
+#line 66
+
+#line 66
+allow traced system_trace_prop:property_service set;
+#line 66
+
+#line 66
+allow traced system_trace_prop:file { getattr open read map };
+#line 66
+
+#line 66
+
+# Allow to lazily start producers.
+
+#line 68
+
+#line 68
+allow traced property_socket:sock_file write;
+#line 68
+allow traced init:unix_stream_socket connectto;
+#line 68
+
+#line 68
+allow traced traced_lazy_prop:property_service set;
+#line 68
+
+#line 68
+allow traced traced_lazy_prop:file { getattr open read map };
+#line 68
+
+#line 68
+
+# Allow tracking the count of sessions intercepting Java OutOfMemoryError
+# If there are such tracing sessions and an OutOfMemoryError is thrown by ART,
+# the hprof plugin intercepts the error, lazily registers a data source to
+# traced and collects a heap dump.
+
+#line 73
+
+#line 73
+allow traced property_socket:sock_file write;
+#line 73
+allow traced init:unix_stream_socket connectto;
+#line 73
+
+#line 73
+allow traced traced_oome_heap_session_count_prop:property_service set;
+#line 73
+
+#line 73
+allow traced traced_oome_heap_session_count_prop:file { getattr open read map };
+#line 73
+
+#line 73
+
+
+# Allow traced to talk to statsd for logging metrics.
+
+#line 76
+allow traced statsdw_socket:sock_file write;
+#line 76
+allow traced statsd:unix_dgram_socket sendto;
+#line 76
+
+
+###
+### Neverallow rules
+###
+### traced should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced self:process execmem;
+
+# Block device access.
+neverallow traced dev_type:blk_file { read write };
+
+# ptrace any other process
+neverallow traced domain:process ptrace;
+
+# Disallows access to /data files, still allowing to write to file descriptors
+# passed through the socket.
+neverallow traced {
+ data_file_type
+ -perfetto_traces_data_file
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
+ # subsequent neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+
+}:dir *;
+neverallow traced { system_data_file }:dir ~{ getattr search };
+neverallow traced {
+ data_file_type
+ -perfetto_traces_data_file
+ -trace_data_file
+
+}:file ~write;
+
+# Only init is allowed to enter the traced domain via exec()
+neverallow { domain -init } traced:process transition;
+neverallow * traced:process dyntransition;
+
+# Limit the processes that can access tracingproxy_service.
+neverallow {
+ domain
+ -traced
+ -dumpstate
+ -traceur_app
+ -platform_app
+ -shell
+ -system_server
+ -perfetto
+} tracingproxy_service:service_manager find;
+#line 1 "system/sepolicy/private/traced_perf.te"
+# Performance profiler, backed by perf_event_open(2).
+# See go/perfetto-perf-android.
+typeattribute traced_perf coredomain;
+typeattribute traced_perf mlstrustedsubject;
+
+type traced_perf_exec, system_file_type, exec_type, file_type;
+
+
+#line 8
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow init traced_perf_exec:file { getattr open read execute map };
+#line 8
+allow init traced_perf:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow traced_perf traced_perf_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit init traced_perf:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow init traced_perf:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition init traced_perf_exec:process traced_perf;
+#line 8
+
+#line 8
+
+
+#line 9
+ allow traced_perf traced:fd use;
+#line 9
+ allow traced_perf traced_tmpfs:file { read write getattr map };
+#line 9
+
+#line 9
+allow traced_perf traced_producer_socket:sock_file write;
+#line 9
+allow traced_perf traced:unix_stream_socket connectto;
+#line 9
+
+#line 9
+
+#line 9
+ # Also allow the service to use the producer file descriptors. This is
+#line 9
+ # necessary when the producer is creating the shared memory, as it will be
+#line 9
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 9
+ allow traced traced_perf:fd use;
+#line 9
+
+
+# Allow traced_perf full use of perf_event_open(2). It will perform cpu-wide
+# profiling, but retain samples only for profileable processes.
+# Thread-specific profiling is still disallowed due to a PTRACE_MODE_ATTACH
+# check (which would require a process:attach SELinux allow-rule).
+allow traced_perf self:perf_event { open cpu kernel read write tracepoint };
+
+# Allow CAP_KILL for delivery of dedicated signal to obtain proc-fds from a
+# process. Allow CAP_DAC_READ_SEARCH for stack unwinding and symbolization of
+# sampled stacks, which requires opening the backing libraries/executables (as
+# symbols are usually not mapped into the process space). Not all such files
+# are world-readable, e.g. odex files that included user profiles during
+# profile-guided optimization.
+allow traced_perf self:capability { kill dac_read_search };
+
+# Allow reading /system/data/packages.list.
+allow traced_perf packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow reading files for stack unwinding and symbolization.
+
+#line 29
+allow traced_perf nativetest_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 29
+allow traced_perf nativetest_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 29
+
+
+#line 30
+allow traced_perf system_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 30
+allow traced_perf system_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 30
+
+
+#line 31
+allow traced_perf apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 31
+allow traced_perf apk_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 31
+
+
+#line 32
+allow traced_perf dalvikcache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow traced_perf dalvikcache_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+
+#line 33
+allow traced_perf vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 33
+allow traced_perf vendor_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 33
+
+# ART apex files and directory access to the containing /data/misc/apexdata.
+
+#line 35
+allow traced_perf apex_art_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 35
+allow traced_perf apex_art_data_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 35
+
+allow traced_perf apex_module_data_file:dir { getattr search };
+
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
+
+allow traced_perf proc_kallsyms:file { open read lock };
+
+# Allow reading tracefs files to get the format and numeric ids of tracepoints.
+allow traced_perf debugfs_tracing:dir { open getattr read search ioctl lock watch watch_reads };
+allow traced_perf debugfs_tracing:file { getattr open read ioctl lock map watch watch_reads };
+#line 52
+
+
+# Do not audit the cases where traced_perf attempts to access /proc/[pid] for
+# domains that it cannot read.
+dontaudit traced_perf domain:dir { search getattr open };
+
+# Do not audit failures to signal a process, as there are cases when this is
+# expected (native processes on debug builds use the policy for enforcing which
+# processes are profileable).
+dontaudit traced_perf domain:process signal;
+
+# Never allow access to app data files
+neverallow traced_perf app_data_file_type:file *;
+
+# Never allow profiling privileged or otherwise incompatible domains.
+# Corresponding allow-rule is in private/domain.te.
+
+#line 68
+ neverallow traced_perf {
+#line 68
+ apexd
+#line 68
+ app_zygote
+#line 68
+ bpfloader
+#line 68
+ hal_configstore_server
+#line 68
+ init
+#line 68
+ kernel
+#line 68
+ keystore
+#line 68
+ llkd
+#line 68
+ logd
+#line 68
+ ueventd
+#line 68
+ vendor_init
+#line 68
+ vold
+#line 68
+ webview_zygote
+#line 68
+ zygote
+#line 68
+}:file read;
+#line 68
+ neverallow traced_perf {
+#line 68
+ apexd
+#line 68
+ app_zygote
+#line 68
+ bpfloader
+#line 68
+ hal_configstore_server
+#line 68
+ init
+#line 68
+ kernel
+#line 68
+ keystore
+#line 68
+ llkd
+#line 68
+ logd
+#line 68
+ ueventd
+#line 68
+ vendor_init
+#line 68
+ vold
+#line 68
+ webview_zygote
+#line 68
+ zygote
+#line 68
+}:process signal;
+#line 83
+
+#line 1 "system/sepolicy/private/traced_probes.te"
+# Perfetto tracing probes, has tracefs access.
+type traced_probes_exec, system_file_type, exec_type, file_type;
+type traced_probes_tmpfs, file_type;
+
+# Allow init to exec the daemon.
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init traced_probes_exec:file { getattr open read execute map };
+#line 6
+allow init traced_probes:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow traced_probes traced_probes_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init traced_probes:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init traced_probes:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init traced_probes_exec:process traced_probes;
+#line 6
+
+#line 6
+
+
+#line 7
+type_transition traced_probes tmpfs:file traced_probes_tmpfs;
+#line 7
+allow traced_probes traced_probes_tmpfs:file { read write getattr map };
+#line 7
+
+
+# Write trace data to the Perfetto traced damon. This requires connecting to its
+# producer socket and obtaining a (per-process) tmpfs fd.
+
+#line 11
+ allow traced_probes traced:fd use;
+#line 11
+ allow traced_probes traced_tmpfs:file { read write getattr map };
+#line 11
+
+#line 11
+allow traced_probes traced_producer_socket:sock_file write;
+#line 11
+allow traced_probes traced:unix_stream_socket connectto;
+#line 11
+
+#line 11
+
+#line 11
+ # Also allow the service to use the producer file descriptors. This is
+#line 11
+ # necessary when the producer is creating the shared memory, as it will be
+#line 11
+ # passed to the service as a file descriptor (obtained from memfd_create).
+#line 11
+ allow traced traced_probes:fd use;
+#line 11
+
+
+# Allow traced_probes to access tracefs.
+allow traced_probes debugfs_tracing:dir { open getattr read search ioctl lock watch watch_reads };
+allow traced_probes debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow traced_probes debugfs_trace_marker:file getattr;
+allow traced_probes debugfs_tracing_printk_formats:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow traced_probes to access mm_events trace instance
+allow traced_probes debugfs_tracing_instances:dir search;
+allow traced_probes debugfs_mm_events_tracing:dir search;
+allow traced_probes debugfs_mm_events_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# TODO(primiano): temporarily I/O tracing categories are still
+# userdebug only until we nail down the denylist/allowlist.
+#line 29
+
+
+# Allow traced_probes to start with a higher scheduling class and then downgrade
+# itself.
+allow traced_probes self:{ capability cap_userns } { sys_nice };
+
+# Allow procfs access
+
+#line 36
+allow traced_probes domain:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow traced_probes domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+
+
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
+
+allow traced_probes proc_kallsyms:file { open read lock };
+
+# Allow to read packages.list file.
+allow traced_probes packages_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow to read game_mode_intervention.list file.
+allow traced_probes game_mode_intervention_list_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow to log to kernel dmesg when starting / stopping ftrace.
+allow traced_probes kmsg_device:chr_file write;
+
+# Allow traced_probes to list the system partition.
+allow traced_probes system_file:dir { open read };
+
+# Allow traced_probes to list some of the data partition.
+allow traced_probes self:{ capability cap_userns } dac_read_search;
+
+allow traced_probes apk_data_file:dir { getattr open read search };
+allow traced_probes { apex_art_data_file apex_module_data_file }:dir { getattr open read search };
+allow traced_probes dalvikcache_data_file:dir { getattr open read search };
+#line 67
+
+allow traced_probes system_app_data_file:dir { getattr open read search };
+allow traced_probes backup_data_file:dir { getattr open read search };
+allow traced_probes bootstat_data_file:dir { getattr open read search };
+allow traced_probes update_engine_data_file:dir { getattr open read search };
+allow traced_probes update_engine_log_data_file:dir { getattr open read search };
+allow traced_probes { user_profile_root_file user_profile_data_file}:dir { getattr open read search };
+
+# Allow traced_probes to run atrace. atrace pokes at system services to enable
+# their userspace TRACE macros.
+
+#line 77
+# Allow the necessary permissions.
+#line 77
+
+#line 77
+# Old domain may exec the file and transition to the new domain.
+#line 77
+allow traced_probes atrace_exec:file { getattr open read execute map };
+#line 77
+allow traced_probes atrace:process transition;
+#line 77
+# New domain is entered by executing the file.
+#line 77
+allow atrace atrace_exec:file { entrypoint open read execute getattr map };
+#line 77
+# New domain can send SIGCHLD to its caller.
+#line 77
+allow atrace traced_probes:process sigchld;
+#line 77
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 77
+dontaudit traced_probes atrace:process noatsecure;
+#line 77
+# XXX dontaudit candidate but requires further study.
+#line 77
+allow traced_probes atrace:process { siginh rlimitinh };
+#line 77
+
+#line 77
+# Make the transition occur by default.
+#line 77
+type_transition traced_probes atrace_exec:process atrace;
+#line 77
+;
+
+# Allow traced_probes to kill atrace on timeout.
+allow traced_probes atrace:process sigkill;
+
+# Allow traced_probes to access /proc files for system stats.
+# Note: trace data is NOT exposed to anything other than shell and privileged
+# system apps that have access to the traced consumer socket.
+allow traced_probes {
+ proc_meminfo
+ proc_vmstat
+ proc_stat
+ proc_buddyinfo
+ proc_pressure_cpu
+ proc_pressure_io
+ proc_pressure_mem
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files
+allow traced_probes sysfs_devfreq_dir:dir { open getattr read search ioctl lock watch watch_reads };
+allow traced_probes sysfs_devfreq_cur:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow access to read /proc/diskstats for I/O profiling.
+allow traced_probes proc_diskstats:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow access to the IHealth and IPowerStats HAL service for tracing battery counters.
+
+#line 103
+typeattribute traced_probes halclientdomain;
+#line 103
+typeattribute traced_probes hal_health_client;
+#line 103
+
+#line 103
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 103
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 103
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 103
+
+#line 103
+typeattribute traced_probes hal_health;
+#line 103
+# Find passthrough HAL implementations
+#line 103
+allow hal_health system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 103
+allow hal_health vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 103
+allow hal_health vendor_file:file { read open getattr execute map };
+#line 103
+
+#line 103
+
+
+#line 104
+typeattribute traced_probes halclientdomain;
+#line 104
+typeattribute traced_probes hal_power_stats_client;
+#line 104
+
+#line 104
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 104
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 104
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 104
+
+#line 104
+typeattribute traced_probes hal_power_stats;
+#line 104
+# Find passthrough HAL implementations
+#line 104
+allow hal_power_stats system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 104
+allow hal_power_stats vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 104
+allow hal_power_stats vendor_file:file { read open getattr execute map };
+#line 104
+
+#line 104
+
+
+# Allow access to Atrace HAL for enabling vendor/device specific tracing categories.
+
+#line 107
+typeattribute traced_probes halclientdomain;
+#line 107
+typeattribute traced_probes hal_atrace_client;
+#line 107
+
+#line 107
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 107
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 107
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 107
+
+#line 107
+typeattribute traced_probes hal_atrace;
+#line 107
+# Find passthrough HAL implementations
+#line 107
+allow hal_atrace system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 107
+allow hal_atrace vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 107
+allow hal_atrace vendor_file:file { read open getattr execute map };
+#line 107
+
+#line 107
+
+
+# On debug builds allow to ingest system logs into the trace.
+
+
+# Allow traced_probes to talk to statsd for logging metrics and recording atoms.
+
+#line 113
+allow traced_probes statsdw_socket:sock_file write;
+#line 113
+allow traced_probes statsd:unix_dgram_socket sendto;
+#line 113
+
+
+#line 114
+# Call the server domain and optionally transfer references to it.
+#line 114
+allow traced_probes statsd:binder { call transfer };
+#line 114
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 114
+allow statsd traced_probes:binder transfer;
+#line 114
+# Receive and use open files from the server.
+#line 114
+allow traced_probes statsd:fd use;
+#line 114
+
+allow traced_probes stats_service:service_manager find;
+
+# Allow traced_probes to talk to suspend control service to read details of kernel wakelocks.
+allow traced_probes system_suspend_control_internal_service:service_manager find;
+allow traced_probes system_suspend:binder call;
+
+# Allow reading the system property representing number of desktop windows to
+# set the initial value for the counter in traces.
+
+#line 123
+allow traced_probes debug_tracing_desktop_mode_visible_tasks_prop:file { getattr open read map };
+#line 123
+
+
+###
+### Neverallow rules
+###
+### traced_probes should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced_probes self:process execmem;
+
+# Block device access.
+neverallow traced_probes dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow traced_probes domain:process ptrace;
+
+# Disallows access to /data files.
+neverallow traced_probes {
+ data_file_type
+ -apex_module_data_file
+ -apex_art_data_file
+ -apk_data_file
+ -dalvikcache_data_file
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ -system_app_data_file
+ -backup_data_file
+ -bootstat_data_file
+ -update_engine_data_file
+ -update_engine_log_data_file
+ -user_profile_root_file
+ -user_profile_data_file
+ # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
+ # subsequent neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+
+}:dir *;
+neverallow traced_probes system_data_file:dir ~{ getattr search };
+neverallow traced_probes {
+ data_file_type
+ -packages_list_file
+
+ -game_mode_intervention_list_file
+}:file *;
+
+# Only init is allowed to enter the traced_probes domain via exec()
+neverallow { domain -init } traced_probes:process transition;
+neverallow * traced_probes:process dyntransition;
+
+#line 1 "system/sepolicy/private/traceur_app.te"
+typeattribute traceur_app coredomain;
+
+
+#line 3
+typeattribute traceur_app appdomain;
+#line 3
+# Label tmpfs objects for all apps.
+#line 3
+type_transition traceur_app tmpfs:file appdomain_tmpfs;
+#line 3
+
+#line 3
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 3
+type traceur_app_userfaultfd;
+#line 3
+type_transition traceur_app traceur_app:anon_inode traceur_app_userfaultfd "[userfaultfd]";
+#line 3
+# Allow domain to create/use userfaultfd anon_inode.
+#line 3
+allow traceur_app traceur_app_userfaultfd:anon_inode { create ioctl read };
+#line 3
+# Suppress errors generate during bugreport
+#line 3
+dontaudit su traceur_app_userfaultfd:anon_inode *;
+#line 3
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 3
+neverallow { domain -traceur_app } traceur_app_userfaultfd:anon_inode *;
+#line 3
+
+#line 3
+allow traceur_app appdomain_tmpfs:file { execute getattr map read write };
+#line 3
+neverallow { traceur_app -runas_app -shell -simpleperf } { domain -traceur_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+neverallow { appdomain -runas_app -shell -simpleperf -traceur_app } traceur_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 3
+# The Android security model guarantees the confidentiality and integrity
+#line 3
+# of application data and execution state. Ptrace bypasses those
+#line 3
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 3
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 3
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 3
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 3
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 3
+# live lock conditions.
+#line 3
+neverallow { domain -traceur_app -crash_dump -runas_app -simpleperf } traceur_app:process ptrace;
+#line 3
+;
+allow traceur_app debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow traceur_app debugfs_tracing_debug:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 9
+
+
+allow traceur_app trace_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow traceur_app trace_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow traceur_app wm_trace_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow traceur_app wm_trace_data_file:file { getattr { getattr open read ioctl lock map watch watch_reads } unlink };
+allow traceur_app atrace_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# To exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe.
+allow traceur_app perfetto_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow to access traced's privileged consumer socket.
+
+#line 22
+allow traceur_app traced_consumer_socket:sock_file write;
+#line 22
+allow traceur_app traced:unix_stream_socket connectto;
+#line 22
+
+
+dontaudit traceur_app debugfs_tracing_debug:file audit_access;
+
+
+#line 26
+
+#line 26
+allow traceur_app property_socket:sock_file write;
+#line 26
+allow traceur_app init:unix_stream_socket connectto;
+#line 26
+
+#line 26
+allow traceur_app debug_prop:property_service set;
+#line 26
+
+#line 26
+allow traceur_app debug_prop:file { getattr open read map };
+#line 26
+
+#line 26
+
+
+allow traceur_app servicemanager:service_manager list;
+allow traceur_app hwservicemanager:hwservice_manager list;
+
+allow traceur_app {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -gatekeeper_service
+ -incident_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+}:service_manager find;
+
+# Allow traceur_app to use atrace HAL
+
+#line 47
+typeattribute traceur_app halclientdomain;
+#line 47
+typeattribute traceur_app hal_atrace_client;
+#line 47
+
+#line 47
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 47
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 47
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 47
+
+#line 47
+typeattribute traceur_app hal_atrace;
+#line 47
+# Find passthrough HAL implementations
+#line 47
+allow hal_atrace system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 47
+allow hal_atrace vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 47
+allow hal_atrace vendor_file:file { read open getattr execute map };
+#line 47
+
+#line 47
+
+
+dontaudit traceur_app service_manager_type:service_manager find;
+dontaudit traceur_app hwservice_manager_type:hwservice_manager find;
+dontaudit traceur_app domain:binder call;
+#line 1 "system/sepolicy/private/tradeinmode.te"
+### trade-in mode
+
+type tradeinmode, domain, coredomain;
+type tradeinmode_exec, exec_type, file_type, system_file_type;
+
+allow tradeinmode adbd_tradeinmode:fd use;
+allow tradeinmode adbd_tradeinmode:unix_stream_socket { read write ioctl };
+
+# Needed to enable trade-in mode for testing.
+
+#line 10
+
+#line 10
+allow tradeinmode property_socket:sock_file write;
+#line 10
+allow tradeinmode init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow tradeinmode adbd_tradeinmode_prop:property_service set;
+#line 10
+
+#line 10
+allow tradeinmode adbd_tradeinmode_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# Allow running from normal shell.
+allow tradeinmode { adbd shell }:fd use;
+allow tradeinmode adbd:unix_stream_socket { read write ioctl };
+
+allow tradeinmode devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Allow executing am/content without a domain transition.
+allow tradeinmode system_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow tradeinmode zygote_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow tradeinmode apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+allow tradeinmode activity_service:service_manager find;
+
+
+#line 25
+allow tradeinmode odsign_prop:file { getattr open read map };
+#line 25
+
+
+#line 26
+allow tradeinmode build_attestation_prop:file { getattr open read map };
+#line 26
+
+
+#line 27
+allow tradeinmode adbd_tradeinmode_prop:file { getattr open read map };
+#line 27
+
+
+#line 28
+
+#line 28
+allow tradeinmode property_socket:sock_file write;
+#line 28
+allow tradeinmode init:unix_stream_socket connectto;
+#line 28
+
+#line 28
+allow tradeinmode powerctl_prop:property_service set;
+#line 28
+
+#line 28
+allow tradeinmode powerctl_prop:file { getattr open read map };
+#line 28
+
+#line 28
+
+
+# Needed to start activities through "am".
+
+#line 31
+# Call the server domain and optionally transfer references to it.
+#line 31
+allow tradeinmode system_server:binder { call transfer };
+#line 31
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 31
+allow system_server tradeinmode:binder transfer;
+#line 31
+# Receive and use open files from the server.
+#line 31
+allow tradeinmode system_server:fd use;
+#line 31
+
+
+#line 32
+# Call the server domain and optionally transfer references to it.
+#line 32
+allow tradeinmode servicemanager:binder { call transfer };
+#line 32
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 32
+allow servicemanager tradeinmode:binder transfer;
+#line 32
+# Receive and use open files from the server.
+#line 32
+allow tradeinmode servicemanager:fd use;
+#line 32
+
+
+# Needed to run "content".
+
+#line 35
+# Call the server domain and optionally transfer references to it.
+#line 35
+allow tradeinmode platform_app:binder { call transfer };
+#line 35
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 35
+allow platform_app tradeinmode:binder transfer;
+#line 35
+# Receive and use open files from the server.
+#line 35
+allow tradeinmode platform_app:fd use;
+#line 35
+
+#line 1 "system/sepolicy/private/ueventd.te"
+typeattribute ueventd coredomain;
+
+
+#line 3
+type_transition ueventd tmpfs:file ueventd_tmpfs;
+#line 3
+allow ueventd ueventd_tmpfs:file { read write getattr map };
+#line 3
+
+
+# ueventd can set properties, particularly it sets ro.cold_boot_done to signal
+# to init that cold boot has completed.
+
+#line 7
+
+#line 7
+allow ueventd property_socket:sock_file write;
+#line 7
+allow ueventd init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow ueventd cold_boot_done_prop:property_service set;
+#line 7
+
+#line 7
+allow ueventd cold_boot_done_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+
+# Write to /dev/kmsg.
+allow ueventd kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+allow ueventd self:{ capability cap_userns } { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner setuid };
+allow ueventd device:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+
+#line 15
+allow ueventd rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow ueventd rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 15
+
+
+# ueventd needs write access to files in /sys to regenerate uevents
+allow ueventd sysfs_type:file { open append write lock map };
+
+#line 19
+allow ueventd sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 19
+allow ueventd sysfs_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 19
+
+allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr };
+allow ueventd sysfs_type:dir { relabelfrom relabelto setattr };
+allow ueventd tmpfs:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow ueventd dev_type:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow ueventd dev_type:lnk_file { create unlink };
+allow ueventd dev_type:chr_file { getattr create setattr unlink };
+allow ueventd dev_type:blk_file { getattr relabelfrom relabelto create setattr unlink };
+allow ueventd self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow ueventd efs_file:dir search;
+allow ueventd efs_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Get SELinux enforcing status.
+
+#line 32
+allow ueventd selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 32
+allow ueventd selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 32
+
+
+# Access for /vendor/ueventd.rc and /vendor/firmware
+
+#line 35
+allow ueventd { vendor_file_type -vendor_app_file -vendor_overlay_file }:dir { open getattr read search ioctl lock watch watch_reads };
+#line 35
+allow ueventd { vendor_file_type -vendor_app_file -vendor_overlay_file }:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 35
+
+
+# Access for /apex/*/firmware
+allow ueventd apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Get file contexts for new device nodes
+allow ueventd file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Use setfscreatecon() to label /dev directories and files.
+allow ueventd self:process setfscreate;
+
+# Allow ueventd to read androidboot.android_dt_dir from kernel cmdline or bootconfig.
+allow ueventd proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+allow ueventd proc_bootconfig:file { getattr open read ioctl lock map watch watch_reads };
+
+# Everything is labeled as rootfs in recovery mode. ueventd has to execute
+# the dynamic linker and shared libraries.
+#line 54
+
+
+# Suppress denials for ueventd to getattr /postinstall. This occurs when the
+# linker tries to resolve paths in ld.config.txt.
+dontaudit ueventd postinstall_mnt_dir:dir getattr;
+
+# ueventd loads modules in response to modalias events.
+allow ueventd self:{ capability cap_userns } sys_module;
+allow ueventd vendor_file:system module_load;
+allow ueventd kernel:key search;
+
+# ueventd is using bootstrap bionic
+
+#line 66
+ allow ueventd system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 66
+ allow ueventd system_bootstrap_lib_file:file { execute read open getattr map };
+#line 66
+
+
+# Allow ueventd to run shell scripts from vendor
+allow ueventd vendor_shell_exec:file execute;
+
+# Query device-mapper to extract name/uuid in response to uevents.
+allow ueventd dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow ueventd self:capability sys_admin;
+
+# Allow ueventd to read apexd property
+
+#line 76
+allow ueventd apexd_prop:file { getattr open read map };
+#line 76
+
+
+#####
+##### neverallow rules
+#####
+
+# Restrict ueventd access on block devices to maintenence operations.
+neverallow ueventd dev_type:blk_file ~{ getattr relabelfrom relabelto create setattr unlink };
+
+# Only relabelto as we would never want to relabelfrom port_device
+neverallow ueventd port_device:chr_file ~{ getattr create setattr unlink relabelto };
+
+# Nobody should be able to ptrace ueventd
+neverallow * ueventd:process ptrace;
+
+# ueventd should never execute a program without changing to another domain.
+neverallow ueventd { file_type fs_type }:file execute_no_trans;
+#line 1 "system/sepolicy/private/uncrypt.te"
+typeattribute uncrypt coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init uncrypt_exec:file { getattr open read execute map };
+#line 3
+allow init uncrypt:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow uncrypt uncrypt_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init uncrypt:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init uncrypt:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init uncrypt_exec:process uncrypt;
+#line 3
+
+#line 3
+
+
+# Set a property to reboot the device.
+
+#line 6
+
+#line 6
+allow uncrypt property_socket:sock_file write;
+#line 6
+allow uncrypt init:unix_stream_socket connectto;
+#line 6
+
+#line 6
+allow uncrypt powerctl_prop:property_service set;
+#line 6
+
+#line 6
+allow uncrypt powerctl_prop:file { getattr open read map };
+#line 6
+
+#line 6
+
+
+allow uncrypt self:{ capability cap_userns } { dac_override dac_read_search };
+
+#line 13
+
+
+# Read /cache/recovery/command
+# Read /cache/recovery/uncrypt_file
+allow uncrypt cache_file:dir search;
+allow uncrypt cache_recovery_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow uncrypt cache_recovery_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/.
+allow uncrypt ota_package_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow uncrypt ota_package_file:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Write to /dev/socket/uncrypt
+
+#line 26
+allow uncrypt uncrypt_socket:sock_file write;
+#line 26
+allow uncrypt uncrypt:unix_stream_socket connectto;
+#line 26
+
+
+# Raw writes to block device
+allow uncrypt self:{ capability cap_userns } sys_rawio;
+allow uncrypt misc_block_device:blk_file { open append write lock map };
+allow uncrypt block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Access userdata block device.
+allow uncrypt userdata_block_device:blk_file { open append write lock map };
+
+
+#line 36
+allow uncrypt rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 36
+allow uncrypt rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 36
+
+
+# Access to bootconfig is needed when calling ReadDefaultFstab.
+allow uncrypt {
+ proc_bootconfig
+ proc_cmdline
+
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read files in /sys
+
+#line 46
+allow uncrypt sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+#line 46
+allow uncrypt sysfs_dt_firmware_android:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 46
+
+
+# Allow ReadDefaultFstab().
+
+#line 49
+ allow uncrypt { metadata_file gsi_metadata_file_type }:dir search;
+#line 49
+ allow uncrypt gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 49
+ allow uncrypt { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 49
+
+#line 1 "system/sepolicy/private/untrusted_app.te"
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion >= 34.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app coredomain;
+
+
+#line 13
+typeattribute untrusted_app appdomain;
+#line 13
+# Label tmpfs objects for all apps.
+#line 13
+type_transition untrusted_app tmpfs:file appdomain_tmpfs;
+#line 13
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type untrusted_app_userfaultfd;
+#line 13
+type_transition untrusted_app untrusted_app:anon_inode untrusted_app_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow untrusted_app untrusted_app_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su untrusted_app_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -untrusted_app } untrusted_app_userfaultfd:anon_inode *;
+#line 13
+
+#line 13
+allow untrusted_app appdomain_tmpfs:file { execute getattr map read write };
+#line 13
+neverallow { untrusted_app -runas_app -shell -simpleperf } { domain -untrusted_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app } untrusted_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+# The Android security model guarantees the confidentiality and integrity
+#line 13
+# of application data and execution state. Ptrace bypasses those
+#line 13
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 13
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 13
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 13
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 13
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 13
+# live lock conditions.
+#line 13
+neverallow { domain -untrusted_app -crash_dump -runas_app -simpleperf } untrusted_app:process ptrace;
+#line 13
+
+
+#line 14
+typeattribute untrusted_app untrusted_app_all;
+#line 14
+
+
+#line 15
+typeattribute untrusted_app netdomain;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app bluetoothdomain;
+#line 16
+
+
+# Allow webview to access fd shared by sdksandbox for experiments data
+# TODO(b/229249719): Will not be supported in Android U
+allow untrusted_app sdk_sandbox_data_file:fd use;
+allow untrusted_app sdk_sandbox_data_file:file write;
+
+neverallow untrusted_app sdk_sandbox_data_file:file { open create };
+#line 1 "system/sepolicy/private/untrusted_app_25.te"
+###
+### Untrusted_app_25
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion <= 25.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_25 coredomain;
+
+
+#line 13
+typeattribute untrusted_app_25 appdomain;
+#line 13
+# Label tmpfs objects for all apps.
+#line 13
+type_transition untrusted_app_25 tmpfs:file appdomain_tmpfs;
+#line 13
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type untrusted_app_25_userfaultfd;
+#line 13
+type_transition untrusted_app_25 untrusted_app_25:anon_inode untrusted_app_25_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow untrusted_app_25 untrusted_app_25_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su untrusted_app_25_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -untrusted_app_25 } untrusted_app_25_userfaultfd:anon_inode *;
+#line 13
+
+#line 13
+allow untrusted_app_25 appdomain_tmpfs:file { execute getattr map read write };
+#line 13
+neverallow { untrusted_app_25 -runas_app -shell -simpleperf } { domain -untrusted_app_25 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app_25 } untrusted_app_25:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+# The Android security model guarantees the confidentiality and integrity
+#line 13
+# of application data and execution state. Ptrace bypasses those
+#line 13
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 13
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 13
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 13
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 13
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 13
+# live lock conditions.
+#line 13
+neverallow { domain -untrusted_app_25 -crash_dump -runas_app -simpleperf } untrusted_app_25:process ptrace;
+#line 13
+
+
+#line 14
+typeattribute untrusted_app_25 untrusted_app_all;
+#line 14
+
+
+#line 15
+typeattribute untrusted_app_25 netdomain;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app_25 bluetoothdomain;
+#line 16
+
+
+# b/35917228 - /proc/misc access
+# This will go away in a future Android release
+allow untrusted_app_25 proc_misc:file { getattr open read ioctl lock map watch watch_reads };
+
+# Access to /proc/tty/drivers, to allow apps to determine if they
+# are running in an emulated environment.
+# b/33214085 b/33814662 b/33791054 b/33211769
+# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
+# This will go away in a future Android release
+allow untrusted_app_25 proc_tty_drivers:file { getattr open read ioctl lock map watch watch_reads };
+
+# Text relocation support for API < 23. This is now disallowed for targetSdkVersion>=Q.
+# https://android.googlesource.com/platform/bionic/+/master/android-changes-for-ndk-developers.md#text-relocations-enforced-for-api-level-23
+allow untrusted_app_25 { apk_data_file app_data_file asec_public_file }:file execmod;
+
+# The ability to call exec() on files in the apps home directories
+# for targetApi<=25. This is also allowed for targetAPIs 26, 27,
+# and 28 in untrusted_app_27.te.
+allow untrusted_app_25 app_data_file:file execute_no_trans;
+auditallow untrusted_app_25 app_data_file:file { execute execute_no_trans };
+
+# The ability to invoke dex2oat. Historically required by ART, now only
+# allowed for targetApi<=28 for compat reasons.
+allow untrusted_app_25 dex2oat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_25 ashmem_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+auditallow untrusted_app_25 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_25 mnt_sdcard_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_25 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_25 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 57
+allow untrusted_app_25 mdnsd_socket:sock_file write;
+#line 57
+allow untrusted_app_25 mdnsd:unix_stream_socket connectto;
+#line 57
+
+#line 61
+
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_25 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_25 apk_data_file:file { watch watch_reads };
+#line 70
+
+#line 1 "system/sepolicy/private/untrusted_app_27.te"
+###
+### Untrusted_27.
+###
+### This file defines the rules for untrusted apps running with
+### 25 < targetSdkVersion <= 28.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_27 coredomain;
+
+
+#line 13
+typeattribute untrusted_app_27 appdomain;
+#line 13
+# Label tmpfs objects for all apps.
+#line 13
+type_transition untrusted_app_27 tmpfs:file appdomain_tmpfs;
+#line 13
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type untrusted_app_27_userfaultfd;
+#line 13
+type_transition untrusted_app_27 untrusted_app_27:anon_inode untrusted_app_27_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow untrusted_app_27 untrusted_app_27_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su untrusted_app_27_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -untrusted_app_27 } untrusted_app_27_userfaultfd:anon_inode *;
+#line 13
+
+#line 13
+allow untrusted_app_27 appdomain_tmpfs:file { execute getattr map read write };
+#line 13
+neverallow { untrusted_app_27 -runas_app -shell -simpleperf } { domain -untrusted_app_27 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app_27 } untrusted_app_27:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+# The Android security model guarantees the confidentiality and integrity
+#line 13
+# of application data and execution state. Ptrace bypasses those
+#line 13
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 13
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 13
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 13
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 13
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 13
+# live lock conditions.
+#line 13
+neverallow { domain -untrusted_app_27 -crash_dump -runas_app -simpleperf } untrusted_app_27:process ptrace;
+#line 13
+
+
+#line 14
+typeattribute untrusted_app_27 untrusted_app_all;
+#line 14
+
+
+#line 15
+typeattribute untrusted_app_27 netdomain;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app_27 bluetoothdomain;
+#line 16
+
+
+# Text relocation support for API < 23. This is now disallowed for targetSdkVersion>=Q.
+# https://android.googlesource.com/platform/bionic/+/master/android-changes-for-ndk-developers.md#text-relocations-enforced-for-api-level-23
+allow untrusted_app_27 { apk_data_file app_data_file asec_public_file }:file execmod;
+
+# The ability to call exec() on files in the apps home directories
+# for targetApi 26, 27, and 28.
+allow untrusted_app_27 app_data_file:file execute_no_trans;
+auditallow untrusted_app_27 app_data_file:file { execute execute_no_trans };
+
+# The ability to invoke dex2oat. Historically required by ART, now only
+# allowed for targetApi<=28 for compat reasons.
+allow untrusted_app_27 dex2oat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_27 ashmem_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+auditallow untrusted_app_27 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_27 mnt_sdcard_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_27 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_27 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 45
+allow untrusted_app_27 mdnsd_socket:sock_file write;
+#line 45
+allow untrusted_app_27 mdnsd:unix_stream_socket connectto;
+#line 45
+
+#line 49
+
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_27 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_27 apk_data_file:file { watch watch_reads };
+#line 58
+
+#line 1 "system/sepolicy/private/untrusted_app_29.te"
+###
+### Untrusted_29.
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion = 29.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_29 coredomain;
+
+
+#line 13
+typeattribute untrusted_app_29 appdomain;
+#line 13
+# Label tmpfs objects for all apps.
+#line 13
+type_transition untrusted_app_29 tmpfs:file appdomain_tmpfs;
+#line 13
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type untrusted_app_29_userfaultfd;
+#line 13
+type_transition untrusted_app_29 untrusted_app_29:anon_inode untrusted_app_29_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow untrusted_app_29 untrusted_app_29_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su untrusted_app_29_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -untrusted_app_29 } untrusted_app_29_userfaultfd:anon_inode *;
+#line 13
+
+#line 13
+allow untrusted_app_29 appdomain_tmpfs:file { execute getattr map read write };
+#line 13
+neverallow { untrusted_app_29 -runas_app -shell -simpleperf } { domain -untrusted_app_29 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app_29 } untrusted_app_29:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+# The Android security model guarantees the confidentiality and integrity
+#line 13
+# of application data and execution state. Ptrace bypasses those
+#line 13
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 13
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 13
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 13
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 13
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 13
+# live lock conditions.
+#line 13
+neverallow { domain -untrusted_app_29 -crash_dump -runas_app -simpleperf } untrusted_app_29:process ptrace;
+#line 13
+
+
+#line 14
+typeattribute untrusted_app_29 untrusted_app_all;
+#line 14
+
+
+#line 15
+typeattribute untrusted_app_29 netdomain;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app_29 bluetoothdomain;
+#line 16
+
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 23
+allow untrusted_app_29 mdnsd_socket:sock_file write;
+#line 23
+allow untrusted_app_29 mdnsd:unix_stream_socket connectto;
+#line 23
+
+#line 27
+
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_29 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_29 apk_data_file:file { watch watch_reads };
+#line 36
+
+#line 1 "system/sepolicy/private/untrusted_app_30.te"
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### 29 < targetSdkVersion <= 31.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+### TODO(b/192334803): Merge this policy into untrusted_app_29 when possible
+###
+
+typeattribute untrusted_app_30 coredomain;
+
+
+#line 15
+typeattribute untrusted_app_30 appdomain;
+#line 15
+# Label tmpfs objects for all apps.
+#line 15
+type_transition untrusted_app_30 tmpfs:file appdomain_tmpfs;
+#line 15
+
+#line 15
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 15
+type untrusted_app_30_userfaultfd;
+#line 15
+type_transition untrusted_app_30 untrusted_app_30:anon_inode untrusted_app_30_userfaultfd "[userfaultfd]";
+#line 15
+# Allow domain to create/use userfaultfd anon_inode.
+#line 15
+allow untrusted_app_30 untrusted_app_30_userfaultfd:anon_inode { create ioctl read };
+#line 15
+# Suppress errors generate during bugreport
+#line 15
+dontaudit su untrusted_app_30_userfaultfd:anon_inode *;
+#line 15
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 15
+neverallow { domain -untrusted_app_30 } untrusted_app_30_userfaultfd:anon_inode *;
+#line 15
+
+#line 15
+allow untrusted_app_30 appdomain_tmpfs:file { execute getattr map read write };
+#line 15
+neverallow { untrusted_app_30 -runas_app -shell -simpleperf } { domain -untrusted_app_30 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app_30 } untrusted_app_30:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 15
+# The Android security model guarantees the confidentiality and integrity
+#line 15
+# of application data and execution state. Ptrace bypasses those
+#line 15
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 15
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 15
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 15
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 15
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 15
+# live lock conditions.
+#line 15
+neverallow { domain -untrusted_app_30 -crash_dump -runas_app -simpleperf } untrusted_app_30:process ptrace;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app_30 untrusted_app_all;
+#line 16
+
+
+#line 17
+typeattribute untrusted_app_30 netdomain;
+#line 17
+
+
+#line 18
+typeattribute untrusted_app_30 bluetoothdomain;
+#line 18
+
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 25
+allow untrusted_app_30 mdnsd_socket:sock_file write;
+#line 25
+allow untrusted_app_30 mdnsd:unix_stream_socket connectto;
+#line 25
+
+#line 29
+
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_30 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_30 apk_data_file:file { watch watch_reads };
+#line 38
+
+#line 1 "system/sepolicy/private/untrusted_app_32.te"
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### 31 < targetSdkVersion <= 33.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_32 coredomain;
+
+
+#line 13
+typeattribute untrusted_app_32 appdomain;
+#line 13
+# Label tmpfs objects for all apps.
+#line 13
+type_transition untrusted_app_32 tmpfs:file appdomain_tmpfs;
+#line 13
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type untrusted_app_32_userfaultfd;
+#line 13
+type_transition untrusted_app_32 untrusted_app_32:anon_inode untrusted_app_32_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow untrusted_app_32 untrusted_app_32_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su untrusted_app_32_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -untrusted_app_32 } untrusted_app_32_userfaultfd:anon_inode *;
+#line 13
+
+#line 13
+allow untrusted_app_32 appdomain_tmpfs:file { execute getattr map read write };
+#line 13
+neverallow { untrusted_app_32 -runas_app -shell -simpleperf } { domain -untrusted_app_32 }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+neverallow { appdomain -runas_app -shell -simpleperf -untrusted_app_32 } untrusted_app_32:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 13
+# The Android security model guarantees the confidentiality and integrity
+#line 13
+# of application data and execution state. Ptrace bypasses those
+#line 13
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 13
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 13
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 13
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 13
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 13
+# live lock conditions.
+#line 13
+neverallow { domain -untrusted_app_32 -crash_dump -runas_app -simpleperf } untrusted_app_32:process ptrace;
+#line 13
+
+
+#line 14
+typeattribute untrusted_app_32 untrusted_app_all;
+#line 14
+
+
+#line 15
+typeattribute untrusted_app_32 netdomain;
+#line 15
+
+
+#line 16
+typeattribute untrusted_app_32 bluetoothdomain;
+#line 16
+
+
+# Allow webview to access fd shared by sdksandbox for experiments data
+# TODO(b/229249719): Will not be supported in Android U
+allow untrusted_app_32 sdk_sandbox_data_file:fd use;
+allow untrusted_app_32 sdk_sandbox_data_file:file write;
+
+neverallow untrusted_app_32 sdk_sandbox_data_file:file { open create };
+
+# Connect to mdnsd via mdnsd socket.
+
+#line 26
+allow untrusted_app_32 mdnsd_socket:sock_file write;
+#line 26
+allow untrusted_app_32 mdnsd:unix_stream_socket connectto;
+#line 26
+
+#line 30
+
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_32 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_32 apk_data_file:file { watch watch_reads };
+#line 39
+
+#line 1 "system/sepolicy/private/untrusted_app_all.te"
+###
+### Untrusted_app_all.
+###
+### This file defines the rules shared by all untrusted app domains except
+### ephemeral_app for instant apps and isolated_app (which has a reduced
+### permission set).
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The untrusted_app_all attribute is assigned to all default
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml. In current AOSP, this
+### attribute is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key. To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
+###
+### Note that rules that should apply to all untrusted apps must be in app.te or also
+### added to ephemeral_app.te.
+
+# Some apps ship with shared libraries and binaries that they write out
+# to their sandbox directory and then execute.
+allow untrusted_app_all privapp_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+allow untrusted_app_all app_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+auditallow untrusted_app_all app_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow untrusted_app_all system_linker_exec:file execute_no_trans;
+
+# Follow priv-app symlinks. This is used for dynamite functionality.
+allow untrusted_app_all privapp_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow handling of less common filesystem objects
+allow untrusted_app_all app_data_file:{ lnk_file sock_file fifo_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow loading and deleting executable shared libraries
+# within an application home directory. Such shared libraries would be
+# created by things like renderscript or via other mechanisms.
+allow untrusted_app_all app_exec_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute unlink };
+
+# ASEC
+allow untrusted_app_all asec_apk_file:file { getattr open read ioctl lock map watch watch_reads };
+allow untrusted_app_all asec_apk_file:dir { open getattr read search ioctl lock watch watch_reads };
+# Execute libs in asec containers.
+allow untrusted_app_all asec_public_file:file { execute };
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+# TODO: Long term, we don't want apps probing into shell data files.
+# Figure out a way to remove these rules.
+allow untrusted_app_all shell_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow untrusted_app_all shell_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow traceur to pass file descriptors through a content provider to untrusted apps
+# for the purpose of sharing files through e.g. gmail
+allow untrusted_app_all trace_data_file:file { getattr read };
+
+# untrusted apps should not be able to open trace data files, they should depend
+# upon traceur to pass a file descriptor
+neverallow untrusted_app_all trace_data_file:dir *;
+neverallow untrusted_app_all trace_data_file:file { { append create link unlink relabelfrom rename setattr write } open };
+
+# neverallow untrusted apps accessing debugfs_tracing
+neverallow untrusted_app_all debugfs_tracing:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow to read staged apks.
+allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr};
+
+# Read and write system app data files passed over Binder.
+# Motivating case was /data/data/com.android.settings/cache/*.jpg for
+# cropping or taking user photos.
+allow untrusted_app_all system_app_data_file:file { read write getattr };
+
+#
+# Rules migrated from old app domains coalesced into untrusted_app.
+# This includes what used to be media_app, shared_app, and release_app.
+#
+
+# Access to /data/media.
+allow untrusted_app_all media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow untrusted_app_all media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# allow cts to query all services
+allow untrusted_app_all servicemanager:service_manager list;
+
+allow untrusted_app_all audioserver_service:service_manager find;
+allow untrusted_app_all cameraserver_service:service_manager find;
+allow untrusted_app_all drmserver_service:service_manager find;
+allow untrusted_app_all mediaserver_service:service_manager find;
+allow untrusted_app_all mediaextractor_service:service_manager find;
+allow untrusted_app_all mediametrics_service:service_manager find;
+allow untrusted_app_all mediadrmserver_service:service_manager find;
+allow untrusted_app_all nfc_service:service_manager find;
+allow untrusted_app_all radio_service:service_manager find;
+allow untrusted_app_all app_api_service:service_manager find;
+allow untrusted_app_all vr_manager_service:service_manager find;
+
+# gdbserver for ndk-gdb ptrace attaches to app process.
+allow untrusted_app_all self:process ptrace;
+
+# Android Studio Instant Run has the application connect to a
+# runas_app socket listening in the abstract namespace.
+# https://developer.android.com/studio/run/
+# b/123297648
+allow untrusted_app_all runas_app:unix_stream_socket connectto;
+
+# Untrusted apps need to be able to send a SIGCHLD to runas_app
+# when running under a debugger (b/123612207)
+allow untrusted_app_all runas_app:process sigchld;
+
+# Cts: HwRngTest
+allow untrusted_app_all sysfs_hwrandom:dir search;
+allow untrusted_app_all sysfs_hwrandom:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow apps to view preloaded media content
+allow untrusted_app_all preloads_media_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow untrusted_app_all preloads_media_file:file { getattr open read ioctl lock map watch watch_reads };
+allow untrusted_app_all preloads_data_file:dir search;
+
+# Allow untrusted apps read / execute access to /vendor/app for there can
+# be pre-installed vendor apps that package a library within themselves.
+# TODO (b/37784178) Consider creating a special type for /vendor/app installed
+# apps.
+allow untrusted_app_all vendor_app_file:dir { open getattr read search };
+allow untrusted_app_all vendor_app_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
+
+# allow untrusted apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow untrusted_app_all system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# Allow the renderscript compiler to be run.
+
+#line 138
+# Allow the necessary permissions.
+#line 138
+
+#line 138
+# Old domain may exec the file and transition to the new domain.
+#line 138
+allow untrusted_app_all rs_exec:file { getattr open read execute map };
+#line 138
+allow untrusted_app_all rs:process transition;
+#line 138
+# New domain is entered by executing the file.
+#line 138
+allow rs rs_exec:file { entrypoint open read execute getattr map };
+#line 138
+# New domain can send SIGCHLD to its caller.
+#line 138
+allow rs untrusted_app_all:process sigchld;
+#line 138
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 138
+dontaudit untrusted_app_all rs:process noatsecure;
+#line 138
+# XXX dontaudit candidate but requires further study.
+#line 138
+allow untrusted_app_all rs:process { siginh rlimitinh };
+#line 138
+
+#line 138
+# Make the transition occur by default.
+#line 138
+type_transition untrusted_app_all rs_exec:process rs;
+#line 138
+
+
+# suppress denials caused by debugfs_tracing
+dontaudit untrusted_app_all debugfs_tracing:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# This is allowed for targetSdkVersion <= 25 but disallowed on newer versions.
+dontaudit untrusted_app_all net_dns_prop:file read;
+
+# These have been disallowed since Android O.
+# For P, we assume that apps are safely handling the denial.
+dontaudit untrusted_app_all {
+ proc_stat
+ proc_uptime
+ proc_vmstat
+ proc_zoneinfo
+}:file read;
+
+# Allow the allocation and use of ptys
+# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
+
+#line 157
+# Each domain gets a unique devpts type.
+#line 157
+type untrusted_app_all_devpts, fs_type;
+#line 157
+# Label the pty with the unique type when created.
+#line 157
+type_transition untrusted_app_all devpts:chr_file untrusted_app_all_devpts;
+#line 157
+# Allow use of the pty after creation.
+#line 157
+allow untrusted_app_all untrusted_app_all_devpts:chr_file { open getattr read write ioctl };
+#line 157
+allowxperm untrusted_app_all untrusted_app_all_devpts:chr_file ioctl {
+#line 157
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 157
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 157
+};
+#line 157
+# TIOCSTI is only ever used for exploits. Block it.
+#line 157
+# b/33073072, b/7530569
+#line 157
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+#line 157
+neverallowxperm * untrusted_app_all_devpts:chr_file ioctl 0x00005412;
+#line 157
+# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
+#line 157
+# allowed to everyone via domain.te.
+#line 157
+
+
+# Allow access to kcov via its ioctl interface for coverage
+# guided kernel fuzzing.
+#line 164
+
+
+# Allow running a VM for test/demo purposes. Note that access to the
+# service is still guarded with the
+# `android.permission.MANAGE_VIRTUAL_MACHINE` permission. The
+# protection level of the permission is
+# `signature|privileged|development` so that it can only be granted to
+# either platform-key signed apps, privileged apps, or test-only apps
+# having `android:testOnly="true"` in their manifest.
+
+#line 173
+# Transition to virtualizationmanager when the client executes it.
+#line 173
+
+#line 173
+# Allow the necessary permissions.
+#line 173
+
+#line 173
+# Old domain may exec the file and transition to the new domain.
+#line 173
+allow untrusted_app_all virtualizationmanager_exec:file { getattr open read execute map };
+#line 173
+allow untrusted_app_all virtualizationmanager:process transition;
+#line 173
+# New domain is entered by executing the file.
+#line 173
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 173
+# New domain can send SIGCHLD to its caller.
+#line 173
+allow virtualizationmanager untrusted_app_all:process sigchld;
+#line 173
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 173
+dontaudit untrusted_app_all virtualizationmanager:process noatsecure;
+#line 173
+# XXX dontaudit candidate but requires further study.
+#line 173
+allow untrusted_app_all virtualizationmanager:process { siginh rlimitinh };
+#line 173
+
+#line 173
+# Make the transition occur by default.
+#line 173
+type_transition untrusted_app_all virtualizationmanager_exec:process virtualizationmanager;
+#line 173
+
+#line 173
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 173
+allow { virtualizationmanager crosvm } untrusted_app_all:unix_stream_socket { ioctl getattr read write };
+#line 173
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 173
+allow { virtualizationmanager crosvm } untrusted_app_all:fd use;
+#line 173
+# Let the client use file descriptors created by virtualizationmanager.
+#line 173
+allow untrusted_app_all virtualizationmanager:fd use;
+#line 173
+# Allow piping console log to the client
+#line 173
+allow { virtualizationmanager crosvm } untrusted_app_all:fifo_file { ioctl getattr read write };
+#line 173
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 173
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 173
+# the client can only connect to VMs that it owns.
+#line 173
+allow untrusted_app_all virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 173
+# Allow client to inspect hypervisor capabilities
+#line 173
+
+#line 173
+allow untrusted_app_all hypervisor_prop:file { getattr open read map };
+#line 173
+
+#line 173
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 173
+allow untrusted_app_all virtualizationservice_data_file:file { getattr read };
+#line 173
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 173
+allow virtualizationmanager untrusted_app_all:dir search;
+#line 173
+allow virtualizationmanager untrusted_app_all:file read;
+#line 173
+allow virtualizationmanager untrusted_app_all:lnk_file read;
+#line 173
+
+
+#line 179
+
+#line 1 "system/sepolicy/private/update_engine.te"
+typeattribute update_engine coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init update_engine_exec:file { getattr open read execute map };
+#line 3
+allow init update_engine:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow update_engine update_engine_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init update_engine:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init update_engine:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init update_engine_exec:process update_engine;
+#line 3
+
+#line 3
+;
+
+# Allow to talk to gsid.
+allow update_engine gsi_service:service_manager find;
+
+#line 7
+# Call the server domain and optionally transfer references to it.
+#line 7
+allow update_engine gsid:binder { call transfer };
+#line 7
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 7
+allow gsid update_engine:binder transfer;
+#line 7
+# Receive and use open files from the server.
+#line 7
+allow update_engine gsid:fd use;
+#line 7
+
+
+# Allow to start gsid service.
+
+#line 10
+
+#line 10
+allow update_engine property_socket:sock_file write;
+#line 10
+allow update_engine init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow update_engine ctl_gsid_prop:property_service set;
+#line 10
+
+#line 10
+allow update_engine ctl_gsid_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# Allow to start snapuserd for dm-user communication.
+
+#line 13
+
+#line 13
+allow update_engine property_socket:sock_file write;
+#line 13
+allow update_engine init:unix_stream_socket connectto;
+#line 13
+
+#line 13
+allow update_engine ctl_snapuserd_prop:property_service set;
+#line 13
+
+#line 13
+allow update_engine ctl_snapuserd_prop:file { getattr open read map };
+#line 13
+
+#line 13
+
+
+# Allow to set the OTA related properties, e.g. ota.warm_reset.
+
+#line 16
+
+#line 16
+allow update_engine property_socket:sock_file write;
+#line 16
+allow update_engine init:unix_stream_socket connectto;
+#line 16
+
+#line 16
+allow update_engine ota_prop:property_service set;
+#line 16
+
+#line 16
+allow update_engine ota_prop:file { getattr open read map };
+#line 16
+
+#line 16
+
+
+#line 17
+allow update_engine ota_build_prop:file { getattr open read map };
+#line 17
+
+
+# Allow to get the DSU status
+
+#line 20
+allow update_engine gsid_prop:file { getattr open read map };
+#line 20
+
+
+# Allow update_engine to call the callback function provided by GKI update hook.
+
+#line 23
+# Call the server domain and optionally transfer references to it.
+#line 23
+allow update_engine gki_apex_prepostinstall:binder { call transfer };
+#line 23
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 23
+allow gki_apex_prepostinstall update_engine:binder transfer;
+#line 23
+# Receive and use open files from the server.
+#line 23
+allow update_engine gki_apex_prepostinstall:fd use;
+#line 23
+
+
+# Allow update_engine to call the callback function by settings app
+# for the kernel update triggered using 16k developer option
+
+#line 27
+# Call the server domain and optionally transfer references to it.
+#line 27
+allow update_engine system_app:binder { call transfer };
+#line 27
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 27
+allow system_app update_engine:binder transfer;
+#line 27
+# Receive and use open files from the server.
+#line 27
+allow update_engine system_app:fd use;
+#line 27
+
+
+# Allow to communicate with the snapuserd service, for dm-user snapshots.
+allow update_engine snapuserd:unix_stream_socket connectto;
+allow update_engine snapuserd_socket:sock_file write;
+
+#line 32
+allow update_engine snapuserd_prop:file { getattr open read map };
+#line 32
+
+
+# Allow to communicate with apexd for calculating and reserving space for
+# capex decompression
+allow update_engine apex_service:service_manager find;
+
+#line 37
+# Call the server domain and optionally transfer references to it.
+#line 37
+allow update_engine apexd:binder { call transfer };
+#line 37
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 37
+allow apexd update_engine:binder transfer;
+#line 37
+# Receive and use open files from the server.
+#line 37
+allow update_engine apexd:fd use;
+#line 37
+
+
+# let this domain use the hal service
+
+#line 40
+# Call the servicemanager and transfer references to it.
+#line 40
+allow update_engine servicemanager:binder { call transfer };
+#line 40
+# Allow servicemanager to send out callbacks
+#line 40
+allow servicemanager update_engine:binder { call transfer };
+#line 40
+# servicemanager performs getpidcon on clients.
+#line 40
+allow servicemanager update_engine:dir search;
+#line 40
+allow servicemanager update_engine:file { read open };
+#line 40
+allow servicemanager update_engine:process getattr;
+#line 40
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 40
+# all domains in domain.te.
+#line 40
+
+
+#line 41
+typeattribute update_engine halclientdomain;
+#line 41
+typeattribute update_engine hal_bootctl_client;
+#line 41
+
+#line 41
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 41
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 41
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 41
+
+#line 41
+typeattribute update_engine hal_bootctl;
+#line 41
+# Find passthrough HAL implementations
+#line 41
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 41
+
+#line 41
+
+
+
+#line 43
+typeattribute update_engine netdomain;
+#line 43
+;
+
+# Following permissions are needed for update_engine.
+allow update_engine self:process { setsched };
+allow update_engine self:{ capability cap_userns } { fowner sys_admin };
+# Note: fsetid checks are triggered when creating a file in a directory with
+# the setgid bit set to determine if the file should inherit setgid. In this
+# case, setgid on the file is undesirable so we should just suppress the
+# denial.
+dontaudit update_engine self:{ capability cap_userns } fsetid;
+
+allow update_engine kmsg_device:chr_file { getattr { open append write lock map } };
+allow update_engine update_engine_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+#line 56
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 56
+# deprecated.
+#line 56
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 56
+allow update_engine sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 56
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 56
+allow update_engine self:{ capability2 cap2_userns } block_suspend;
+#line 56
+# system_suspend permissions
+#line 56
+
+#line 56
+# Call the server domain and optionally transfer references to it.
+#line 56
+allow update_engine system_suspend_server:binder { call transfer };
+#line 56
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 56
+allow system_suspend_server update_engine:binder transfer;
+#line 56
+# Receive and use open files from the server.
+#line 56
+allow update_engine system_suspend_server:fd use;
+#line 56
+
+#line 56
+allow update_engine system_suspend_hwservice:hwservice_manager find;
+#line 56
+# halclientdomain permissions
+#line 56
+
+#line 56
+# Call the hwservicemanager and transfer references to it.
+#line 56
+allow update_engine hwservicemanager:binder { call transfer };
+#line 56
+# Allow hwservicemanager to send out callbacks
+#line 56
+allow hwservicemanager update_engine:binder { call transfer };
+#line 56
+# hwservicemanager performs getpidcon on clients.
+#line 56
+allow hwservicemanager update_engine:dir search;
+#line 56
+allow hwservicemanager update_engine:file { read open map };
+#line 56
+allow hwservicemanager update_engine:process getattr;
+#line 56
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 56
+# all domains in domain.te.
+#line 56
+
+#line 56
+
+#line 56
+allow update_engine hwservicemanager_prop:file { getattr open read map };
+#line 56
+
+#line 56
+allow update_engine hidl_manager_hwservice:hwservice_manager find;
+#line 56
+# AIDL suspend hal permissions
+#line 56
+allow update_engine hal_system_suspend_service:service_manager find;
+#line 56
+
+#line 56
+# Call the servicemanager and transfer references to it.
+#line 56
+allow update_engine servicemanager:binder { call transfer };
+#line 56
+# Allow servicemanager to send out callbacks
+#line 56
+allow servicemanager update_engine:binder { call transfer };
+#line 56
+# servicemanager performs getpidcon on clients.
+#line 56
+allow servicemanager update_engine:dir search;
+#line 56
+allow servicemanager update_engine:file { read open };
+#line 56
+allow servicemanager update_engine:process getattr;
+#line 56
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 56
+# all domains in domain.te.
+#line 56
+
+#line 56
+;
+
+# Ignore these denials.
+dontaudit update_engine kernel:process setsched;
+dontaudit update_engine self:{ capability cap_userns } sys_rawio;
+
+# Allow using persistent storage in /data/misc/update_engine.
+allow update_engine update_engine_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow update_engine update_engine_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow using persistent storage in /data/misc/update_engine_log.
+allow update_engine update_engine_log_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow update_engine update_engine_log_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Register the service to perform Binder IPC.
+
+#line 71
+# Call the servicemanager and transfer references to it.
+#line 71
+allow update_engine servicemanager:binder { call transfer };
+#line 71
+# Allow servicemanager to send out callbacks
+#line 71
+allow servicemanager update_engine:binder { call transfer };
+#line 71
+# servicemanager performs getpidcon on clients.
+#line 71
+allow servicemanager update_engine:dir search;
+#line 71
+allow servicemanager update_engine:file { read open };
+#line 71
+allow servicemanager update_engine:process getattr;
+#line 71
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 71
+# all domains in domain.te.
+#line 71
+
+
+#line 72
+ allow update_engine update_engine_service:service_manager { add find };
+#line 72
+ neverallow { domain -update_engine } update_engine_service:service_manager add;
+#line 72
+
+#line 72
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 72
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 72
+
+#line 72
+
+
+#line 73
+ allow update_engine update_engine_stable_service:service_manager { add find };
+#line 73
+ neverallow { domain -update_engine } update_engine_stable_service:service_manager add;
+#line 73
+
+#line 73
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 73
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 73
+
+#line 73
+
+
+# Allow update_engine to call the callback function provided by priv_app/GMS core.
+
+#line 76
+# Call the server domain and optionally transfer references to it.
+#line 76
+allow update_engine priv_app:binder { call transfer };
+#line 76
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 76
+allow priv_app update_engine:binder transfer;
+#line 76
+# Receive and use open files from the server.
+#line 76
+allow update_engine priv_app:fd use;
+#line 76
+
+# b/142672293: No other priv-app should need this rule now that GMS core runs in its own domain.
+#line 82
+
+
+
+#line 84
+# Call the server domain and optionally transfer references to it.
+#line 84
+allow update_engine gmscore_app:binder { call transfer };
+#line 84
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 84
+allow gmscore_app update_engine:binder transfer;
+#line 84
+# Receive and use open files from the server.
+#line 84
+allow update_engine gmscore_app:fd use;
+#line 84
+
+
+# Allow update_engine to call the callback function provided by system_server.
+
+#line 87
+# Call the server domain and optionally transfer references to it.
+#line 87
+allow update_engine system_server:binder { call transfer };
+#line 87
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 87
+allow system_server update_engine:binder transfer;
+#line 87
+# Receive and use open files from the server.
+#line 87
+allow update_engine system_server:fd use;
+#line 87
+
+
+# Read OTA zip file at /data/ota_package/.
+allow update_engine ota_package_file:file { getattr open read ioctl lock map watch watch_reads };
+allow update_engine ota_package_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Use Boot Control HAL
+
+#line 94
+typeattribute update_engine halclientdomain;
+#line 94
+typeattribute update_engine hal_bootctl_client;
+#line 94
+
+#line 94
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 94
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 94
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 94
+
+#line 94
+typeattribute update_engine hal_bootctl;
+#line 94
+# Find passthrough HAL implementations
+#line 94
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 94
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 94
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 94
+
+#line 94
+
+
+# access /proc/misc
+allow update_engine proc_misc:file { getattr open read ioctl lock map watch watch_reads };
+
+# read directories on /system and /vendor
+allow update_engine system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow ReadDefaultFstab().
+# update_engine tries to determine the parent path for all devices (e.g.
+# /dev/block/by-name) by reading the default fstab and looking for the misc
+# device.
+
+#line 106
+ allow update_engine { metadata_file gsi_metadata_file_type }:dir search;
+#line 106
+ allow update_engine gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 106
+ allow update_engine { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 106
+
+
+# Allow to write to snapshotctl_log logs.
+# TODO(b/148818798) revert when parent bug is fixed.
+#line 113
+
+
+# Allow determining filesystems available on system.
+# Needed for checking if overlayfs is enabled
+allow update_engine proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+allow update_engine vendor_boot_ota_file:dir { { open getattr read search ioctl lock watch watch_reads } };
+allow update_engine vendor_boot_ota_file:file { { getattr open read ioctl lock map watch watch_reads } };
+#line 1 "system/sepolicy/private/update_engine_common.te"
+# update_engine payload application permissions. These are shared between the
+# background daemon and the recovery tool to sideload an update.
+
+# type_transition must be private policy the domain_trans rules could stay
+# public, but conceptually should go with this
+# The postinstall program is run by update_engine_common and must be tagged
+# with postinstall_exec in the new filesystem.
+# TODO Have build system attempt to verify this
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow update_engine_common postinstall_exec:file { getattr open read execute map };
+#line 9
+allow update_engine_common postinstall:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow postinstall postinstall_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+allow postinstall update_engine_common:process sigchld;
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit update_engine_common postinstall:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow update_engine_common postinstall:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition update_engine_common postinstall_exec:process postinstall;
+#line 9
+
+
+# Vendor directories can have the transition as well during OTA. This is caused
+# by update_engine execing scripts in vendor to perform any update tasks needed
+# there.
+
+#line 14
+# Allow the necessary permissions.
+#line 14
+
+#line 14
+# Old domain may exec the file and transition to the new domain.
+#line 14
+allow update_engine_common postinstall_file:file { getattr open read execute map };
+#line 14
+allow update_engine_common postinstall:process transition;
+#line 14
+# New domain is entered by executing the file.
+#line 14
+allow postinstall postinstall_file:file { entrypoint open read execute getattr map };
+#line 14
+# New domain can send SIGCHLD to its caller.
+#line 14
+allow postinstall update_engine_common:process sigchld;
+#line 14
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 14
+dontaudit update_engine_common postinstall:process noatsecure;
+#line 14
+# XXX dontaudit candidate but requires further study.
+#line 14
+allow update_engine_common postinstall:process { siginh rlimitinh };
+#line 14
+
+#line 14
+# Make the transition occur by default.
+#line 14
+type_transition update_engine_common postinstall_file:process postinstall;
+#line 14
+
+
+# Allow update_engine to reach block devices in /dev/block.
+allow update_engine_common block_device:dir search;
+
+# Allow read/write on system and boot partitions.
+allow update_engine_common boot_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow update_engine_common system_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Where ioctls are granted via standard allow rules to block devices,
+# automatically allow common ioctls that are generally needed by
+# update_engine.
+allowxperm update_engine_common dev_type:blk_file ioctl {
+ 0x00001277
+ 0x0000127c
+ 0x0000125e
+ 0x0000125d
+ 0x0000127d
+ 0x0000127f
+};
+
+# Allow to set recovery options in the BCB. Used to trigger factory reset when
+# the update to an older version (channel change) or incompatible version
+# requires it.
+allow update_engine_common misc_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# read fstab
+allow update_engine_common rootfs:dir getattr;
+allow update_engine_common rootfs:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow update_engine_common to mount on the /postinstall directory and reset the
+# labels on the mounted filesystem to postinstall_file.
+allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search };
+allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto };
+allow update_engine_common labeledfs:filesystem { mount unmount relabelfrom };
+
+# Allow update_engine_common to read and execute postinstall_file.
+allow update_engine_common postinstall_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow update_engine_common postinstall_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow update_engine_common postinstall_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# install update.zip from cache
+
+#line 56
+allow update_engine_common cache_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 56
+allow update_engine_common cache_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 56
+
+
+# A postinstall program is typically a shell script (with a #!), so we allow
+# to execute those.
+allow update_engine_common shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow update_engine_common to suspend, resume and kill the postinstall program.
+allow update_engine_common postinstall:process { signal sigstop sigkill };
+
+# access /proc/cmdline
+allow update_engine_common proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read files in /sys/firmware/devicetree/base/firmware/android/
+
+#line 69
+allow update_engine_common sysfs_dt_firmware_android:dir { open getattr read search ioctl lock watch watch_reads };
+#line 69
+allow update_engine_common sysfs_dt_firmware_android:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 69
+
+
+# Needed because libdm reads sysfs to validate when a dm path is ready.
+
+#line 72
+allow update_engine_common sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+#line 72
+allow update_engine_common sysfs_dm:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 72
+
+
+# Scan files in /sys/fs/ext4 and /sys/fs/f2fs for device-mapper diagnostics.
+allow update_engine_common sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+allow update_engine_common sysfs_fs_f2fs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# read / write on /dev/device-mapper to map / unmap devices
+allow update_engine_common dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# apply / verify updates on devices mapped via device mapper
+allow update_engine_common dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# read /dev/dm-user, so that we can inotify wait for control devices to be
+# asynchronously created by ueventd.
+allow update_engine dm_user_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow update_engine dm_user_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# read / write metadata on super device to resize partitions
+allow update_engine_common super_block_device_type:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# ioctl on super device to get block device alignment and alignment offset
+allowxperm update_engine_common super_block_device_type:blk_file ioctl { 0x00001278 0x0000127a };
+
+# get physical block device to map logical partitions on device mapper
+allow update_engine_common block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow update_engine_common to write to statsd socket.
+
+#line 99
+allow update_engine_common statsdw_socket:sock_file write;
+#line 99
+allow update_engine_common statsd:unix_dgram_socket sendto;
+#line 99
+
+
+# Allow to read Virtual A/B feature flags.
+
+#line 102
+allow update_engine_common virtual_ab_prop:file { getattr open read map };
+#line 102
+
+
+# Allow to read GKI related flags.
+
+#line 105
+allow update_engine_common ab_update_gki_prop:file { getattr open read map };
+#line 105
+
+
+#line 106
+allow update_engine_common build_bootimage_prop:file { getattr open read map };
+#line 106
+
+
+# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
+allow update_engine_common metadata_file:dir search;
+allow update_engine_common ota_metadata_file:dir { { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } rmdir };
+allow update_engine_common ota_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1 "system/sepolicy/private/update_verifier.te"
+typeattribute update_verifier coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init update_verifier_exec:file { getattr open read execute map };
+#line 3
+allow init update_verifier:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow update_verifier update_verifier_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init update_verifier:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init update_verifier:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init update_verifier_exec:process update_verifier;
+#line 3
+
+#line 3
+
+
+# Allow update_verifier to reboot the device.
+
+#line 6
+
+#line 6
+allow update_verifier property_socket:sock_file write;
+#line 6
+allow update_verifier init:unix_stream_socket connectto;
+#line 6
+
+#line 6
+allow update_verifier powerctl_prop:property_service set;
+#line 6
+
+#line 6
+allow update_verifier powerctl_prop:file { getattr open read map };
+#line 6
+
+#line 6
+
+
+# Allow to set the OTA related properties e.g. ota.warm_reset.
+
+#line 9
+
+#line 9
+allow update_verifier property_socket:sock_file write;
+#line 9
+allow update_verifier init:unix_stream_socket connectto;
+#line 9
+
+#line 9
+allow update_verifier ota_prop:property_service set;
+#line 9
+
+#line 9
+allow update_verifier ota_prop:file { getattr open read map };
+#line 9
+
+#line 9
+
+
+# allow update_verifier to connect to snapuserd daemon
+allow update_verifier snapuserd_socket:sock_file write;
+allow update_verifier snapuserd:unix_stream_socket connectto;
+
+# virtual a/b properties
+
+#line 16
+allow update_verifier virtual_ab_prop:file { getattr open read map };
+#line 16
+
+
+# Allow update_verifier to reach block devices in /dev/block.
+allow update_verifier block_device:dir search;
+
+# Read care map in /data/ota_package/.
+allow update_verifier ota_package_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow update_verifier ota_package_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read /sys/block to find all the DM directories like (/sys/block/dm-X).
+allow update_verifier sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Read /sys/block/dm-X/dm/name (which is a symlink to
+# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between
+# dm-X and system/vendor partitions.
+allow update_verifier sysfs_dm:dir { open getattr read search ioctl lock watch watch_reads };
+allow update_verifier sysfs_dm:file { getattr open read ioctl lock map watch watch_reads };
+
+# Read all blocks in DM wrapped system partition.
+allow update_verifier dm_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Write to kernel message.
+allow update_verifier kmsg_device:chr_file { getattr { open append write lock map } };
+
+# Use Boot Control HAL
+
+#line 41
+typeattribute update_verifier halclientdomain;
+#line 41
+typeattribute update_verifier hal_bootctl_client;
+#line 41
+
+#line 41
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 41
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 41
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 41
+
+#line 41
+typeattribute update_verifier hal_bootctl;
+#line 41
+# Find passthrough HAL implementations
+#line 41
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 41
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 41
+
+#line 41
+
+
+# Access Checkpoint commands over binder
+allow update_verifier vold_service:service_manager find;
+
+#line 45
+# Call the server domain and optionally transfer references to it.
+#line 45
+allow update_verifier servicemanager:binder { call transfer };
+#line 45
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 45
+allow servicemanager update_verifier:binder transfer;
+#line 45
+# Receive and use open files from the server.
+#line 45
+allow update_verifier servicemanager:fd use;
+#line 45
+
+
+#line 46
+# Call the server domain and optionally transfer references to it.
+#line 46
+allow update_verifier vold:binder { call transfer };
+#line 46
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 46
+allow vold update_verifier:binder transfer;
+#line 46
+# Receive and use open files from the server.
+#line 46
+allow update_verifier vold:fd use;
+#line 46
+
+#line 1 "system/sepolicy/private/uprobestats.te"
+type uprobestats, domain, coredomain;
+
+typeattribute uprobestats bpfdomain;
+
+type uprobestats_exec, system_file_type, exec_type, file_type;
+
+# Allow init to start uprobestats.
+
+#line 8
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow init uprobestats_exec:file { getattr open read execute map };
+#line 8
+allow init uprobestats:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow uprobestats uprobestats_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit init uprobestats:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow init uprobestats:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition init uprobestats_exec:process uprobestats;
+#line 8
+
+#line 8
+
+
+allow uprobestats fs_bpf_uprobestats:file { read write };
+allow uprobestats fs_bpf_uprobestats:dir search;
+allow uprobestats bpfloader:bpf { map_read map_write prog_run };
+allow uprobestats self:capability2 perfmon;
+allow uprobestats self:perf_event { cpu open write };
+allow uprobestats sysfs_uprobe:file { open read };
+allow uprobestats sysfs_uprobe:dir { search };
+
+# Allow uprobestats to popen oatdump.
+allow uprobestats system_file:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow uprobestats to write atoms to statsd
+
+#line 22
+allow uprobestats statsdw_socket:sock_file write;
+#line 22
+allow uprobestats statsd:unix_dgram_socket sendto;
+#line 22
+
+
+# For registration with system server as a process observer.
+
+#line 25
+# Call the servicemanager and transfer references to it.
+#line 25
+allow uprobestats servicemanager:binder { call transfer };
+#line 25
+# Allow servicemanager to send out callbacks
+#line 25
+allow servicemanager uprobestats:binder { call transfer };
+#line 25
+# servicemanager performs getpidcon on clients.
+#line 25
+allow servicemanager uprobestats:dir search;
+#line 25
+allow servicemanager uprobestats:file { read open };
+#line 25
+allow servicemanager uprobestats:process getattr;
+#line 25
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 25
+# all domains in domain.te.
+#line 25
+
+allow uprobestats activity_service:service_manager find;
+allow uprobestats dynamic_instrumentation_service:service_manager find;
+
+#line 28
+# Call the server domain and optionally transfer references to it.
+#line 28
+allow uprobestats system_server:binder { call transfer };
+#line 28
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 28
+allow system_server uprobestats:binder transfer;
+#line 28
+# Receive and use open files from the server.
+#line 28
+allow uprobestats system_server:fd use;
+#line 28
+;
+
+# Allow uprobestats to talk to native package manager
+allow uprobestats package_native_service:service_manager find;
+
+# Allow uprobestats to scan /proc/<pid>/cmdline.
+
+#line 34
+allow uprobestats { domain -appdomain }:dir { open getattr read search ioctl lock watch watch_reads };
+#line 34
+allow uprobestats { domain -appdomain }:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 34
+
+
+# Allow uprobestats to manage its own config files.
+allow uprobestats uprobestats_configs_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow uprobestats uprobestats_configs_data_file:file { { getattr open read ioctl lock map watch watch_reads } unlink };
+#line 1 "system/sepolicy/private/usbd.te"
+typeattribute usbd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init usbd_exec:file { getattr open read execute map };
+#line 3
+allow init usbd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow usbd usbd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init usbd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init usbd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init usbd_exec:process usbd;
+#line 3
+
+#line 3
+
+
+# Access usb gadget hal
+
+#line 6
+typeattribute usbd halclientdomain;
+#line 6
+typeattribute usbd hal_usb_gadget_client;
+#line 6
+
+#line 6
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 6
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 6
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 6
+
+#line 6
+typeattribute usbd hal_usb_gadget;
+#line 6
+# Find passthrough HAL implementations
+#line 6
+allow hal_usb_gadget system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_usb_gadget vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 6
+allow hal_usb_gadget vendor_file:file { read open getattr execute map };
+#line 6
+
+#line 6
+
+
+# Access persist.sys.usb.config
+
+#line 9
+allow usbd system_prop:file { getattr open read map };
+#line 9
+
+
+# start adbd during boot if adb is enabled
+
+#line 12
+
+#line 12
+allow usbd property_socket:sock_file write;
+#line 12
+allow usbd init:unix_stream_socket connectto;
+#line 12
+
+#line 12
+allow usbd ctl_default_prop:property_service set;
+#line 12
+
+#line 12
+allow usbd ctl_default_prop:file { getattr open read map };
+#line 12
+
+#line 12
+
+
+# Start/stop adbd via ctl.start adbd
+
+#line 15
+
+#line 15
+allow usbd property_socket:sock_file write;
+#line 15
+allow usbd init:unix_stream_socket connectto;
+#line 15
+
+#line 15
+allow usbd ctl_adbd_prop:property_service set;
+#line 15
+
+#line 15
+allow usbd ctl_adbd_prop:file { getattr open read map };
+#line 15
+
+#line 15
+
+
+
+#line 17
+# Call the server domain and optionally transfer references to it.
+#line 17
+allow usbd servicemanager:binder { call transfer };
+#line 17
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 17
+allow servicemanager usbd:binder transfer;
+#line 17
+# Receive and use open files from the server.
+#line 17
+allow usbd servicemanager:fd use;
+#line 17
+
+#line 1 "system/sepolicy/private/userdata_sysdev.te"
+allow userdata_sysdev sysfs:filesystem associate;
+#line 1 "system/sepolicy/private/vdc.te"
+typeattribute vdc coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init vdc_exec:file { getattr open read execute map };
+#line 3
+allow init vdc:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow vdc vdc_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init vdc:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init vdc:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init vdc_exec:process vdc;
+#line 3
+
+#line 3
+
+
+# Allow stdin/out back to vehicle_binding_util
+allow vdc vehicle_binding_util:fd use;
+
+# vdc can be invoked with logwrapper, so let it write to pty
+allow vdc devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# vdc writes directly to kmsg during the boot process
+allow vdc kmsg_device:chr_file { getattr { open append write lock map } };
+
+# vdc talks to vold over Binder
+
+#line 15
+# Call the servicemanager and transfer references to it.
+#line 15
+allow vdc servicemanager:binder { call transfer };
+#line 15
+# Allow servicemanager to send out callbacks
+#line 15
+allow servicemanager vdc:binder { call transfer };
+#line 15
+# servicemanager performs getpidcon on clients.
+#line 15
+allow servicemanager vdc:dir search;
+#line 15
+allow servicemanager vdc:file { read open };
+#line 15
+allow servicemanager vdc:process getattr;
+#line 15
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 15
+# all domains in domain.te.
+#line 15
+
+
+#line 16
+# Call the server domain and optionally transfer references to it.
+#line 16
+allow vdc vold:binder { call transfer };
+#line 16
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 16
+allow vold vdc:binder transfer;
+#line 16
+# Receive and use open files from the server.
+#line 16
+allow vdc vold:fd use;
+#line 16
+
+allow vdc vold_service:service_manager find;
+#line 1 "system/sepolicy/private/vehicle_binding_util.te"
+# vehicle binding util startup application
+type vehicle_binding_util, domain, coredomain;
+
+# allow init to start vehicle_binding_util
+type vehicle_binding_util_exec, exec_type, file_type, system_file_type;
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init vehicle_binding_util_exec:file { getattr open read execute map };
+#line 6
+allow init vehicle_binding_util:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow vehicle_binding_util vehicle_binding_util_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init vehicle_binding_util:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init vehicle_binding_util:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init vehicle_binding_util_exec:process vehicle_binding_util;
+#line 6
+
+#line 6
+
+
+# allow writing to kmsg during boot
+allow vehicle_binding_util kmsg_device:chr_file { getattr { open append write lock map } };
+
+# allow reading the binding property from HIDL VHAL.
+
+#line 12
+# Call the hwservicemanager and transfer references to it.
+#line 12
+allow vehicle_binding_util hwservicemanager:binder { call transfer };
+#line 12
+# Allow hwservicemanager to send out callbacks
+#line 12
+allow hwservicemanager vehicle_binding_util:binder { call transfer };
+#line 12
+# hwservicemanager performs getpidcon on clients.
+#line 12
+allow hwservicemanager vehicle_binding_util:dir search;
+#line 12
+allow hwservicemanager vehicle_binding_util:file { read open map };
+#line 12
+allow hwservicemanager vehicle_binding_util:process getattr;
+#line 12
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 12
+# all domains in domain.te.
+#line 12
+
+# allow reading the binding property from AIDL VHAL.
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow vehicle_binding_util servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager vehicle_binding_util:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager vehicle_binding_util:dir search;
+#line 14
+allow servicemanager vehicle_binding_util:file { read open };
+#line 14
+allow servicemanager vehicle_binding_util:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+#line 15
+typeattribute vehicle_binding_util halclientdomain;
+#line 15
+typeattribute vehicle_binding_util hal_vehicle_client;
+#line 15
+
+#line 15
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 15
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 15
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 15
+
+#line 15
+typeattribute vehicle_binding_util hal_vehicle;
+#line 15
+# Find passthrough HAL implementations
+#line 15
+allow hal_vehicle system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_vehicle vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 15
+allow hal_vehicle vendor_file:file { read open getattr execute map };
+#line 15
+
+#line 15
+
+
+# allow executing vdc
+
+#line 18
+# Allow the necessary permissions.
+#line 18
+
+#line 18
+# Old domain may exec the file and transition to the new domain.
+#line 18
+allow vehicle_binding_util vdc_exec:file { getattr open read execute map };
+#line 18
+allow vehicle_binding_util vdc:process transition;
+#line 18
+# New domain is entered by executing the file.
+#line 18
+allow vdc vdc_exec:file { entrypoint open read execute getattr map };
+#line 18
+# New domain can send SIGCHLD to its caller.
+#line 18
+allow vdc vehicle_binding_util:process sigchld;
+#line 18
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 18
+dontaudit vehicle_binding_util vdc:process noatsecure;
+#line 18
+# XXX dontaudit candidate but requires further study.
+#line 18
+allow vehicle_binding_util vdc:process { siginh rlimitinh };
+#line 18
+
+#line 18
+# Make the transition occur by default.
+#line 18
+type_transition vehicle_binding_util vdc_exec:process vdc;
+#line 18
+
+
+# devpts is needed to redirect output from vdc
+allow vehicle_binding_util devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+#line 1 "system/sepolicy/private/vendor_init.te"
+# Creating files on sysfs is impossible so this isn't a threat
+# Sometimes we have to write to non-existent files to avoid conditional
+# init behavior. See b/35303861 for an example.
+dontaudit vendor_init sysfs:dir write;
+
+# TODO(b/140259336) We want to remove vendor_init in the long term but allow for now
+allow vendor_init system_data_root_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Let vendor_init set service.adb.tcp.port.
+
+#line 10
+
+#line 10
+allow vendor_init property_socket:sock_file write;
+#line 10
+allow vendor_init init:unix_stream_socket connectto;
+#line 10
+
+#line 10
+allow vendor_init adbd_config_prop:property_service set;
+#line 10
+
+#line 10
+allow vendor_init adbd_config_prop:file { getattr open read map };
+#line 10
+
+#line 10
+
+
+# Let vendor_init react to AVF device config changes
+
+#line 13
+allow vendor_init device_config_virtualization_framework_native_prop:file { getattr open read map };
+#line 13
+
+
+# Let vendor_init use apex.<name>.ready to start services from vendor APEX
+
+#line 16
+allow vendor_init apex_ready_prop:file { getattr open read map };
+#line 16
+
+
+# Let vendor_init read ro.fstype.data to process init.rc triggers
+# for this property
+
+#line 20
+allow vendor_init fstype_prop:file { getattr open read map };
+#line 20
+
+
+# chown/chmod on devices, e.g. /dev/ttyHS0
+allow vendor_init {
+ dev_type
+ -keychord_device
+ -vm_manager_device_type
+ -port_device
+ -lowpan_device
+ -hw_random_device
+}:chr_file setattr;
+
+# Communication to the main init process
+allow vendor_init init:unix_stream_socket { read write };
+
+# Logging to kmsg
+allow vendor_init kmsg_device:chr_file { open getattr write };
+
+# Mount on /dev/usb-ffs/adb.
+allow vendor_init device:dir mounton;
+
+# Create and remove symlinks in /.
+allow vendor_init rootfs:lnk_file { create unlink };
+
+# Create cgroups mount points in tmpfs and mount cgroups on them.
+allow vendor_init cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vendor_init cgroup:file { open append write lock map };
+allow vendor_init cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vendor_init cgroup_v2:file { open append write lock map };
+
+# /config
+allow vendor_init configfs:dir mounton;
+allow vendor_init configfs:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vendor_init configfs:{ file lnk_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Create directories under /dev/cpuctl after chowning it to system.
+allow vendor_init self:{ capability cap_userns } { dac_override dac_read_search };
+
+# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
+# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
+# system/core/init.rc requires at least cache_file and data_file_type.
+# init.<board>.rc files often include device-specific types, so
+# we just allow all file types except /system files here.
+allow vendor_init self:{ capability cap_userns } { chown fowner fsetid };
+
+# mkdir with FBE requires reading /data/unencrypted/{ref,mode}.
+allow vendor_init unencrypted_data_file:dir search;
+allow vendor_init unencrypted_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Set encryption policy on dirs in /data
+allowxperm vendor_init data_file_type:dir ioctl {
+ 0x400c6615
+ 0x800c6613
+};
+
+allow vendor_init system_data_file:dir getattr;
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -system_dlkm_file_type
+ -system_file_type
+ -mnt_product_file
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
+
+allow vendor_init unlabeled:{ dir { file lnk_file sock_file fifo_file } } { getattr relabelfrom };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -runtime_event_log_tags_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -apex_info_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+ -tradeinmode_metadata_file
+ -proc_kallsyms
+ # BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 120
+-debugfs_type
+#line 120
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 120
+
+}:file { create getattr open read write setattr relabelfrom unlink map };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
+
+allow vendor_init {
+ file_type
+ -apex_mnt_dir
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:lnk_file { create getattr setattr relabelfrom unlink };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -mnt_product_file
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } relabelto;
+
+allow vendor_init dev_type:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vendor_init dev_type:lnk_file create;
+
+# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
+allow vendor_init debugfs_tracing:file { open append write lock map };
+
+# chown/chmod on pseudo files.
+allow vendor_init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -keychord_device
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+ -proc_uid_time_in_state
+ -proc_uid_concurrent_active_time
+ -proc_uid_concurrent_policy_time
+ -proc_kallsyms
+ # BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 200
+-debugfs_type
+#line 200
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+#line 200
+
+}:file { open read setattr map };
+
+allow vendor_init tracefs_type:file { open read setattr map };
+
+allow vendor_init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+ -proc_uid_time_in_state
+ -proc_uid_concurrent_active_time
+ -proc_uid_concurrent_policy_time
+}:dir { open read setattr search };
+
+allow vendor_init dev_type:blk_file getattr;
+
+# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
+
+#line 220
+allow vendor_init proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 220
+allow vendor_init proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 220
+
+allow vendor_init proc_net_type:file { open append write lock map };
+allow vendor_init self:{ capability cap_userns } net_admin;
+
+# Write to /proc/sys/vm/page-cluster
+allow vendor_init proc_page_cluster:file { open append write lock map };
+
+# Write to sysfs nodes.
+allow vendor_init sysfs_type:dir { open getattr read search ioctl lock watch watch_reads };
+allow vendor_init sysfs_type:lnk_file read;
+allow vendor_init { sysfs_type -sysfs_usermodehelper }:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# setfscreatecon() for labeling directories and socket files.
+allow vendor_init self:process { setfscreate };
+
+
+#line 235
+allow vendor_init vendor_file_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 235
+allow vendor_init vendor_file_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 235
+
+
+# Vendor init can read properties
+allow vendor_init serialno_prop:file { getattr open read map };
+
+# Vendor init can perform operations on trusted and security Extended Attributes
+allow vendor_init self:{ capability cap_userns } sys_admin;
+
+# Raw writes to misc block device
+allow vendor_init misc_block_device:blk_file { open append write lock map };
+
+# vendor_init is using bootstrap bionic
+
+#line 247
+ allow vendor_init system_bootstrap_lib_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 247
+ allow vendor_init system_bootstrap_lib_file:file { execute read open getattr map };
+#line 247
+
+
+# allow filesystem tuning
+allow vendor_init userdata_sysdev:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Everything is labeled as rootfs in recovery mode. Vendor init has to execute
+# the dynamic linker and shared libraries.
+#line 256
+
+
+
+#line 258
+
+#line 258
+
+#line 258
+allow vendor_init property_socket:sock_file write;
+#line 258
+allow vendor_init init:unix_stream_socket connectto;
+#line 258
+
+#line 258
+allow vendor_init {
+#line 258
+ property_type
+#line 258
+ -system_internal_property_type
+#line 258
+ -system_restricted_property_type
+#line 258
+ }:property_service set;
+#line 258
+
+#line 258
+allow vendor_init {
+#line 258
+ property_type
+#line 258
+ -system_internal_property_type
+#line 258
+ -system_restricted_property_type
+#line 258
+ }:file { getattr open read map };
+#line 258
+
+#line 258
+
+#line 264
+
+
+# Get file context
+allow vendor_init file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow vendor_init to (re)set nice
+allow vendor_init self:capability sys_nice;
+
+
+#line 272
+
+#line 272
+allow vendor_init property_socket:sock_file write;
+#line 272
+allow vendor_init init:unix_stream_socket connectto;
+#line 272
+
+#line 272
+allow vendor_init apk_verity_prop:property_service set;
+#line 272
+
+#line 272
+allow vendor_init apk_verity_prop:file { getattr open read map };
+#line 272
+
+#line 272
+
+
+#line 273
+
+#line 273
+allow vendor_init property_socket:sock_file write;
+#line 273
+allow vendor_init init:unix_stream_socket connectto;
+#line 273
+
+#line 273
+allow vendor_init bluetooth_a2dp_offload_prop:property_service set;
+#line 273
+
+#line 273
+allow vendor_init bluetooth_a2dp_offload_prop:file { getattr open read map };
+#line 273
+
+#line 273
+
+
+#line 274
+
+#line 274
+allow vendor_init property_socket:sock_file write;
+#line 274
+allow vendor_init init:unix_stream_socket connectto;
+#line 274
+
+#line 274
+allow vendor_init bluetooth_audio_hal_prop:property_service set;
+#line 274
+
+#line 274
+allow vendor_init bluetooth_audio_hal_prop:file { getattr open read map };
+#line 274
+
+#line 274
+
+
+#line 275
+
+#line 275
+allow vendor_init property_socket:sock_file write;
+#line 275
+allow vendor_init init:unix_stream_socket connectto;
+#line 275
+
+#line 275
+allow vendor_init bluetooth_config_prop:property_service set;
+#line 275
+
+#line 275
+allow vendor_init bluetooth_config_prop:file { getattr open read map };
+#line 275
+
+#line 275
+
+
+#line 276
+
+#line 276
+allow vendor_init property_socket:sock_file write;
+#line 276
+allow vendor_init init:unix_stream_socket connectto;
+#line 276
+
+#line 276
+allow vendor_init camera2_extensions_prop:property_service set;
+#line 276
+
+#line 276
+allow vendor_init camera2_extensions_prop:file { getattr open read map };
+#line 276
+
+#line 276
+
+
+#line 277
+
+#line 277
+allow vendor_init property_socket:sock_file write;
+#line 277
+allow vendor_init init:unix_stream_socket connectto;
+#line 277
+
+#line 277
+allow vendor_init camerax_extensions_prop:property_service set;
+#line 277
+
+#line 277
+allow vendor_init camerax_extensions_prop:file { getattr open read map };
+#line 277
+
+#line 277
+
+
+#line 278
+
+#line 278
+allow vendor_init property_socket:sock_file write;
+#line 278
+allow vendor_init init:unix_stream_socket connectto;
+#line 278
+
+#line 278
+allow vendor_init cpu_variant_prop:property_service set;
+#line 278
+
+#line 278
+allow vendor_init cpu_variant_prop:file { getattr open read map };
+#line 278
+
+#line 278
+
+
+#line 279
+
+#line 279
+allow vendor_init property_socket:sock_file write;
+#line 279
+allow vendor_init init:unix_stream_socket connectto;
+#line 279
+
+#line 279
+allow vendor_init dalvik_config_prop:property_service set;
+#line 279
+
+#line 279
+allow vendor_init dalvik_config_prop:file { getattr open read map };
+#line 279
+
+#line 279
+
+
+#line 280
+
+#line 280
+allow vendor_init property_socket:sock_file write;
+#line 280
+allow vendor_init init:unix_stream_socket connectto;
+#line 280
+
+#line 280
+allow vendor_init dalvik_dynamic_config_prop:property_service set;
+#line 280
+
+#line 280
+allow vendor_init dalvik_dynamic_config_prop:file { getattr open read map };
+#line 280
+
+#line 280
+
+
+#line 281
+
+#line 281
+allow vendor_init property_socket:sock_file write;
+#line 281
+allow vendor_init init:unix_stream_socket connectto;
+#line 281
+
+#line 281
+allow vendor_init dalvik_runtime_prop:property_service set;
+#line 281
+
+#line 281
+allow vendor_init dalvik_runtime_prop:file { getattr open read map };
+#line 281
+
+#line 281
+
+
+#line 282
+
+#line 282
+allow vendor_init property_socket:sock_file write;
+#line 282
+allow vendor_init init:unix_stream_socket connectto;
+#line 282
+
+#line 282
+allow vendor_init debug_prop:property_service set;
+#line 282
+
+#line 282
+allow vendor_init debug_prop:file { getattr open read map };
+#line 282
+
+#line 282
+
+
+#line 283
+
+#line 283
+allow vendor_init property_socket:sock_file write;
+#line 283
+allow vendor_init init:unix_stream_socket connectto;
+#line 283
+
+#line 283
+allow vendor_init exported_bluetooth_prop:property_service set;
+#line 283
+
+#line 283
+allow vendor_init exported_bluetooth_prop:file { getattr open read map };
+#line 283
+
+#line 283
+
+
+#line 284
+
+#line 284
+allow vendor_init property_socket:sock_file write;
+#line 284
+allow vendor_init init:unix_stream_socket connectto;
+#line 284
+
+#line 284
+allow vendor_init exported_camera_prop:property_service set;
+#line 284
+
+#line 284
+allow vendor_init exported_camera_prop:file { getattr open read map };
+#line 284
+
+#line 284
+
+
+#line 285
+
+#line 285
+allow vendor_init property_socket:sock_file write;
+#line 285
+allow vendor_init init:unix_stream_socket connectto;
+#line 285
+
+#line 285
+allow vendor_init exported_config_prop:property_service set;
+#line 285
+
+#line 285
+allow vendor_init exported_config_prop:file { getattr open read map };
+#line 285
+
+#line 285
+
+
+#line 286
+
+#line 286
+allow vendor_init property_socket:sock_file write;
+#line 286
+allow vendor_init init:unix_stream_socket connectto;
+#line 286
+
+#line 286
+allow vendor_init exported_default_prop:property_service set;
+#line 286
+
+#line 286
+allow vendor_init exported_default_prop:file { getattr open read map };
+#line 286
+
+#line 286
+
+
+#line 287
+
+#line 287
+allow vendor_init property_socket:sock_file write;
+#line 287
+allow vendor_init init:unix_stream_socket connectto;
+#line 287
+
+#line 287
+allow vendor_init exported_overlay_prop:property_service set;
+#line 287
+
+#line 287
+allow vendor_init exported_overlay_prop:file { getattr open read map };
+#line 287
+
+#line 287
+
+
+#line 288
+
+#line 288
+allow vendor_init property_socket:sock_file write;
+#line 288
+allow vendor_init init:unix_stream_socket connectto;
+#line 288
+
+#line 288
+allow vendor_init exported_pm_prop:property_service set;
+#line 288
+
+#line 288
+allow vendor_init exported_pm_prop:file { getattr open read map };
+#line 288
+
+#line 288
+
+
+#line 289
+
+#line 289
+allow vendor_init property_socket:sock_file write;
+#line 289
+allow vendor_init init:unix_stream_socket connectto;
+#line 289
+
+#line 289
+allow vendor_init ffs_control_prop:property_service set;
+#line 289
+
+#line 289
+allow vendor_init ffs_control_prop:file { getattr open read map };
+#line 289
+
+#line 289
+
+
+#line 290
+
+#line 290
+allow vendor_init property_socket:sock_file write;
+#line 290
+allow vendor_init init:unix_stream_socket connectto;
+#line 290
+
+#line 290
+allow vendor_init hw_timeout_multiplier_prop:property_service set;
+#line 290
+
+#line 290
+allow vendor_init hw_timeout_multiplier_prop:file { getattr open read map };
+#line 290
+
+#line 290
+
+
+#line 291
+
+#line 291
+allow vendor_init property_socket:sock_file write;
+#line 291
+allow vendor_init init:unix_stream_socket connectto;
+#line 291
+
+#line 291
+allow vendor_init incremental_prop:property_service set;
+#line 291
+
+#line 291
+allow vendor_init incremental_prop:file { getattr open read map };
+#line 291
+
+#line 291
+
+
+#line 292
+
+#line 292
+allow vendor_init property_socket:sock_file write;
+#line 292
+allow vendor_init init:unix_stream_socket connectto;
+#line 292
+
+#line 292
+allow vendor_init lmkd_prop:property_service set;
+#line 292
+
+#line 292
+allow vendor_init lmkd_prop:file { getattr open read map };
+#line 292
+
+#line 292
+
+
+#line 293
+
+#line 293
+allow vendor_init property_socket:sock_file write;
+#line 293
+allow vendor_init init:unix_stream_socket connectto;
+#line 293
+
+#line 293
+allow vendor_init logd_prop:property_service set;
+#line 293
+
+#line 293
+allow vendor_init logd_prop:file { getattr open read map };
+#line 293
+
+#line 293
+
+
+#line 294
+
+#line 294
+allow vendor_init property_socket:sock_file write;
+#line 294
+allow vendor_init init:unix_stream_socket connectto;
+#line 294
+
+#line 294
+allow vendor_init log_tag_prop:property_service set;
+#line 294
+
+#line 294
+allow vendor_init log_tag_prop:file { getattr open read map };
+#line 294
+
+#line 294
+
+
+#line 295
+
+#line 295
+allow vendor_init property_socket:sock_file write;
+#line 295
+allow vendor_init init:unix_stream_socket connectto;
+#line 295
+
+#line 295
+allow vendor_init log_prop:property_service set;
+#line 295
+
+#line 295
+allow vendor_init log_prop:file { getattr open read map };
+#line 295
+
+#line 295
+
+
+#line 296
+
+#line 296
+allow vendor_init property_socket:sock_file write;
+#line 296
+allow vendor_init init:unix_stream_socket connectto;
+#line 296
+
+#line 296
+allow vendor_init graphics_config_writable_prop:property_service set;
+#line 296
+
+#line 296
+allow vendor_init graphics_config_writable_prop:file { getattr open read map };
+#line 296
+
+#line 296
+
+
+#line 297
+
+#line 297
+allow vendor_init property_socket:sock_file write;
+#line 297
+allow vendor_init init:unix_stream_socket connectto;
+#line 297
+
+#line 297
+allow vendor_init prefetch_boot_prop:property_service set;
+#line 297
+
+#line 297
+allow vendor_init prefetch_boot_prop:file { getattr open read map };
+#line 297
+
+#line 297
+;
+
+#line 298
+
+#line 298
+allow vendor_init property_socket:sock_file write;
+#line 298
+allow vendor_init init:unix_stream_socket connectto;
+#line 298
+
+#line 298
+allow vendor_init qemu_hw_prop:property_service set;
+#line 298
+
+#line 298
+allow vendor_init qemu_hw_prop:file { getattr open read map };
+#line 298
+
+#line 298
+
+
+#line 299
+
+#line 299
+allow vendor_init property_socket:sock_file write;
+#line 299
+allow vendor_init init:unix_stream_socket connectto;
+#line 299
+
+#line 299
+allow vendor_init radio_control_prop:property_service set;
+#line 299
+
+#line 299
+allow vendor_init radio_control_prop:file { getattr open read map };
+#line 299
+
+#line 299
+
+
+#line 300
+
+#line 300
+allow vendor_init property_socket:sock_file write;
+#line 300
+allow vendor_init init:unix_stream_socket connectto;
+#line 300
+
+#line 300
+allow vendor_init rebootescrow_hal_prop:property_service set;
+#line 300
+
+#line 300
+allow vendor_init rebootescrow_hal_prop:file { getattr open read map };
+#line 300
+
+#line 300
+
+
+#line 301
+
+#line 301
+allow vendor_init property_socket:sock_file write;
+#line 301
+allow vendor_init init:unix_stream_socket connectto;
+#line 301
+
+#line 301
+allow vendor_init serialno_prop:property_service set;
+#line 301
+
+#line 301
+allow vendor_init serialno_prop:file { getattr open read map };
+#line 301
+
+#line 301
+
+
+#line 302
+
+#line 302
+allow vendor_init property_socket:sock_file write;
+#line 302
+allow vendor_init init:unix_stream_socket connectto;
+#line 302
+
+#line 302
+allow vendor_init soc_prop:property_service set;
+#line 302
+
+#line 302
+allow vendor_init soc_prop:file { getattr open read map };
+#line 302
+
+#line 302
+
+
+#line 303
+
+#line 303
+allow vendor_init property_socket:sock_file write;
+#line 303
+allow vendor_init init:unix_stream_socket connectto;
+#line 303
+
+#line 303
+allow vendor_init surfaceflinger_color_prop:property_service set;
+#line 303
+
+#line 303
+allow vendor_init surfaceflinger_color_prop:file { getattr open read map };
+#line 303
+
+#line 303
+
+
+#line 304
+
+#line 304
+allow vendor_init property_socket:sock_file write;
+#line 304
+allow vendor_init init:unix_stream_socket connectto;
+#line 304
+
+#line 304
+allow vendor_init usb_control_prop:property_service set;
+#line 304
+
+#line 304
+allow vendor_init usb_control_prop:file { getattr open read map };
+#line 304
+
+#line 304
+
+
+#line 305
+
+#line 305
+allow vendor_init property_socket:sock_file write;
+#line 305
+allow vendor_init init:unix_stream_socket connectto;
+#line 305
+
+#line 305
+allow vendor_init userspace_reboot_config_prop:property_service set;
+#line 305
+
+#line 305
+allow vendor_init userspace_reboot_config_prop:file { getattr open read map };
+#line 305
+
+#line 305
+
+
+#line 306
+
+#line 306
+allow vendor_init property_socket:sock_file write;
+#line 306
+allow vendor_init init:unix_stream_socket connectto;
+#line 306
+
+#line 306
+allow vendor_init vehicle_hal_prop:property_service set;
+#line 306
+
+#line 306
+allow vendor_init vehicle_hal_prop:file { getattr open read map };
+#line 306
+
+#line 306
+
+
+#line 307
+
+#line 307
+allow vendor_init property_socket:sock_file write;
+#line 307
+allow vendor_init init:unix_stream_socket connectto;
+#line 307
+
+#line 307
+allow vendor_init vendor_default_prop:property_service set;
+#line 307
+
+#line 307
+allow vendor_init vendor_default_prop:file { getattr open read map };
+#line 307
+
+#line 307
+
+
+#line 308
+
+#line 308
+allow vendor_init property_socket:sock_file write;
+#line 308
+allow vendor_init init:unix_stream_socket connectto;
+#line 308
+
+#line 308
+allow vendor_init keystore_config_prop:property_service set;
+#line 308
+
+#line 308
+allow vendor_init keystore_config_prop:file { getattr open read map };
+#line 308
+
+#line 308
+
+
+#line 309
+
+#line 309
+allow vendor_init property_socket:sock_file write;
+#line 309
+allow vendor_init init:unix_stream_socket connectto;
+#line 309
+
+#line 309
+allow vendor_init vendor_security_patch_level_prop:property_service set;
+#line 309
+
+#line 309
+allow vendor_init vendor_security_patch_level_prop:file { getattr open read map };
+#line 309
+
+#line 309
+
+
+#line 310
+
+#line 310
+allow vendor_init property_socket:sock_file write;
+#line 310
+allow vendor_init init:unix_stream_socket connectto;
+#line 310
+
+#line 310
+allow vendor_init vndk_prop:property_service set;
+#line 310
+
+#line 310
+allow vendor_init vndk_prop:file { getattr open read map };
+#line 310
+
+#line 310
+
+
+#line 311
+
+#line 311
+allow vendor_init property_socket:sock_file write;
+#line 311
+allow vendor_init init:unix_stream_socket connectto;
+#line 311
+
+#line 311
+allow vendor_init virtual_ab_prop:property_service set;
+#line 311
+
+#line 311
+allow vendor_init virtual_ab_prop:file { getattr open read map };
+#line 311
+
+#line 311
+
+
+#line 312
+
+#line 312
+allow vendor_init property_socket:sock_file write;
+#line 312
+allow vendor_init init:unix_stream_socket connectto;
+#line 312
+
+#line 312
+allow vendor_init vold_post_fs_data_prop:property_service set;
+#line 312
+
+#line 312
+allow vendor_init vold_post_fs_data_prop:file { getattr open read map };
+#line 312
+
+#line 312
+
+
+#line 313
+
+#line 313
+allow vendor_init property_socket:sock_file write;
+#line 313
+allow vendor_init init:unix_stream_socket connectto;
+#line 313
+
+#line 313
+allow vendor_init wifi_hal_prop:property_service set;
+#line 313
+
+#line 313
+allow vendor_init wifi_hal_prop:file { getattr open read map };
+#line 313
+
+#line 313
+
+
+#line 314
+
+#line 314
+allow vendor_init property_socket:sock_file write;
+#line 314
+allow vendor_init init:unix_stream_socket connectto;
+#line 314
+
+#line 314
+allow vendor_init wifi_log_prop:property_service set;
+#line 314
+
+#line 314
+allow vendor_init wifi_log_prop:file { getattr open read map };
+#line 314
+
+#line 314
+
+
+#line 315
+
+#line 315
+allow vendor_init property_socket:sock_file write;
+#line 315
+allow vendor_init init:unix_stream_socket connectto;
+#line 315
+
+#line 315
+allow vendor_init zram_control_prop:property_service set;
+#line 315
+
+#line 315
+allow vendor_init zram_control_prop:file { getattr open read map };
+#line 315
+
+#line 315
+
+
+
+#line 317
+allow vendor_init boot_status_prop:file { getattr open read map };
+#line 317
+
+
+#line 318
+allow vendor_init exported3_system_prop:file { getattr open read map };
+#line 318
+
+
+#line 319
+allow vendor_init ota_prop:file { getattr open read map };
+#line 319
+
+
+#line 320
+allow vendor_init power_debug_prop:file { getattr open read map };
+#line 320
+
+
+#line 321
+allow vendor_init provisioned_prop:file { getattr open read map };
+#line 321
+
+
+#line 322
+allow vendor_init retaildemo_prop:file { getattr open read map };
+#line 322
+
+
+#line 323
+allow vendor_init surfaceflinger_display_prop:file { getattr open read map };
+#line 323
+
+
+#line 324
+allow vendor_init test_harness_prop:file { getattr open read map };
+#line 324
+
+
+#line 325
+allow vendor_init theme_prop:file { getattr open read map };
+#line 325
+
+
+#line 326
+
+#line 326
+allow vendor_init property_socket:sock_file write;
+#line 326
+allow vendor_init init:unix_stream_socket connectto;
+#line 326
+
+#line 326
+allow vendor_init dck_prop:property_service set;
+#line 326
+
+#line 326
+allow vendor_init dck_prop:file { getattr open read map };
+#line 326
+
+#line 326
+
+
+# Allow vendor_init to read vendor_system_native device config changes
+
+#line 329
+allow vendor_init device_config_vendor_system_native_prop:file { getattr open read map };
+#line 329
+
+
+#line 330
+allow vendor_init device_config_vendor_system_native_boot_prop:file { getattr open read map };
+#line 330
+
+
+#line 334
+
+
+###
+### neverallow rules
+###
+
+# Vendor init shouldn't communicate with any vendor process, nor most system processes.
+
+#line 341
+ neverallow vendor_init {
+#line 341
+ domain -init -logd -prng_seeder -su -vendor_init }:{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket } { connect sendto };
+#line 341
+ neverallow vendor_init {
+#line 341
+ domain -init -logd -prng_seeder -su -vendor_init }:unix_stream_socket connectto;
+;
+
+# The vendor_init domain is only entered via an exec based transition from the
+# init domain, never via setcon().
+neverallow domain vendor_init:process dyntransition;
+neverallow { domain -init } vendor_init:process transition;
+neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint;
+
+# Never read/follow symlinks created by shell or untrusted apps.
+neverallow vendor_init app_data_file_type:lnk_file read;
+neverallow vendor_init shell_data_file:lnk_file read;
+# Init should not be creating subdirectories in /data/local/tmp
+neverallow vendor_init shell_data_file:dir { write add_name remove_name };
+
+# init should never execute a program without changing to another domain.
+neverallow vendor_init { file_type fs_type }:file execute_no_trans;
+
+# Init never adds or uses services via service_manager.
+neverallow vendor_init service_manager_type:service_manager { add find };
+neverallow vendor_init servicemanager:service_manager list;
+
+# vendor_init should never be ptraced
+neverallow * vendor_init:process ptrace;
+#line 1 "system/sepolicy/private/vendor_misc_writer.te"
+# Raw writes to misc_block_device
+allow vendor_misc_writer misc_block_device:blk_file { open append write lock map };
+allow vendor_misc_writer block_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Silence the denial when calling libfstab's ReadDefaultFstab, which tries to
+# load DT fstab.
+dontaudit vendor_misc_writer proc_cmdline:file { getattr open read ioctl lock map watch watch_reads };
+dontaudit vendor_misc_writer sysfs_dt_firmware_android:dir search;
+dontaudit vendor_misc_writer proc_bootconfig:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow ReadDefaultFstab().
+
+#line 12
+ allow vendor_misc_writer { metadata_file gsi_metadata_file_type }:dir search;
+#line 12
+ allow vendor_misc_writer gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 12
+ allow vendor_misc_writer { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 12
+
+#line 1 "system/sepolicy/private/vendor_shell.te"
+allow vendor_shell vendor_shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow vendor_shell vendor_toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Use fd from shell when vendor_shell is started from shell
+allow vendor_shell shell:fd use;
+
+# adbd: allow `adb shell /vendor/bin/sh` and `adb shell` then `/vendor/bin/sh`
+allow vendor_shell adbd:fd use;
+allow vendor_shell adbd:process sigchld;
+allow vendor_shell adbd:unix_stream_socket { getattr ioctl read write };
+
+allow vendor_shell devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vendor_shell tty_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vendor_shell console_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vendor_shell input_device:dir { open getattr read search ioctl lock watch watch_reads };
+allow vendor_shell input_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+
+#line 1 "system/sepolicy/private/vendor_toolbox.te"
+# Do not allow domains to transition to vendor toolbox
+# or read, execute the vendor_toolbox file.
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 3
+
+#line 3
+ # Do not allow non-vendor domains to transition
+#line 3
+ # to vendor toolbox except for the allowlisted domains.
+#line 3
+ neverallow {
+#line 3
+ coredomain
+#line 3
+ -init
+#line 3
+ -modprobe
+#line 3
+ } vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
+#line 3
+
+#line 3
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 11
+
+#line 1 "system/sepolicy/private/vfio_handler.te"
+
+#line 1
+ # vfio_handler is a helper service for VFIO tasks, like binding platform devices to VFIO driver.
+#line 1
+ # vfio_handler is separate from virtualizationservice as VFIO tasks require root.
+#line 1
+ type vfio_handler, domain, coredomain;
+#line 1
+ type vfio_handler_exec, system_file_type, exec_type, file_type;
+#line 1
+
+#line 1
+ # When init runs a file labelled with vfio_handler_exec, run it in the vfio_handler domain.
+#line 1
+
+#line 1
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow init vfio_handler_exec:file { getattr open read execute map };
+#line 1
+allow init vfio_handler:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow vfio_handler vfio_handler_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit init vfio_handler:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow init vfio_handler:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition init vfio_handler_exec:process vfio_handler;
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ # Let the vfio_handler domain register the vfio_handler_service with ServiceManager.
+#line 1
+
+#line 1
+ allow vfio_handler vfio_handler_service:service_manager { add find };
+#line 1
+ neverallow { domain -vfio_handler } vfio_handler_service:service_manager add;
+#line 1
+
+#line 1
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 1
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ # Let the vfio_handler domain use Binder.
+#line 1
+
+#line 1
+# Call the servicemanager and transfer references to it.
+#line 1
+allow vfio_handler servicemanager:binder { call transfer };
+#line 1
+# Allow servicemanager to send out callbacks
+#line 1
+allow servicemanager vfio_handler:binder { call transfer };
+#line 1
+# servicemanager performs getpidcon on clients.
+#line 1
+allow servicemanager vfio_handler:dir search;
+#line 1
+allow servicemanager vfio_handler:file { read open };
+#line 1
+allow servicemanager vfio_handler:process getattr;
+#line 1
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 1
+# all domains in domain.te.
+#line 1
+
+#line 1
+
+#line 1
+ # Allow vfio_handler to check if VFIO is supported
+#line 1
+ allow vfio_handler vfio_device:chr_file getattr;
+#line 1
+ allow vfio_handler vfio_device:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+
+#line 1
+ # Allow vfio_handler to bind/unbind platform devices
+#line 1
+ allow vfio_handler sysfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 1
+ allow vfio_handler sysfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1
+
+#line 1
+ # Allow vfio_handler to write to VM DTBO via a file created by virtualizationservice.
+#line 1
+ allow vfio_handler virtualizationservice:fd use;
+#line 1
+ allow vfio_handler virtualizationservice_data_file:file write;
+#line 1
+
+#line 1
+ # vfio_handler can only use fd from virtualizationservice, and cannot open files itself
+#line 1
+ neverallow vfio_handler virtualizationservice_data_file:file { open create };
+#line 1
+
+#line 1
+ # Allow vfio_handler to search /dev/block for accessing dtbo.img
+#line 1
+ allow vfio_handler block_device:dir search;
+#line 1
+ allow vfio_handler dtbo_block_device:blk_file { getattr open read ioctl lock map watch watch_reads };
+#line 34
+ # is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT)
+#line 1 "system/sepolicy/private/virtual_camera.te"
+# virtual_camera - virtual camera daemon
+
+# The types are moved to public starting at 202502
+#line 7
+
+
+
+#line 9
+
+#line 9
+# Allow the necessary permissions.
+#line 9
+
+#line 9
+# Old domain may exec the file and transition to the new domain.
+#line 9
+allow init virtual_camera_exec:file { getattr open read execute map };
+#line 9
+allow init virtual_camera:process transition;
+#line 9
+# New domain is entered by executing the file.
+#line 9
+allow virtual_camera virtual_camera_exec:file { entrypoint open read execute getattr map };
+#line 9
+# New domain can send SIGCHLD to its caller.
+#line 9
+
+#line 9
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 9
+dontaudit init virtual_camera:process noatsecure;
+#line 9
+# XXX dontaudit candidate but requires further study.
+#line 9
+allow init virtual_camera:process { siginh rlimitinh };
+#line 9
+
+#line 9
+# Make the transition occur by default.
+#line 9
+type_transition init virtual_camera_exec:process virtual_camera;
+#line 9
+
+#line 9
+
+
+# Since virtual_camera is not a real HAL we don't set the
+# hal_server_domain(virtual_camera, hal_camera) macro but only the rules that
+# we actually need from halserverdomain and hal_camera_server:
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow virtual_camera servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager virtual_camera:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager virtual_camera:dir search;
+#line 14
+allow servicemanager virtual_camera:file { read open };
+#line 14
+allow servicemanager virtual_camera:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+#line 15
+# Call the server domain and optionally transfer references to it.
+#line 15
+allow virtual_camera cameraserver:binder { call transfer };
+#line 15
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 15
+allow cameraserver virtual_camera:binder transfer;
+#line 15
+# Receive and use open files from the server.
+#line 15
+allow virtual_camera cameraserver:fd use;
+#line 15
+
+
+#line 16
+# Call the server domain and optionally transfer references to it.
+#line 16
+allow virtual_camera system_server:binder { call transfer };
+#line 16
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 16
+allow system_server virtual_camera:binder transfer;
+#line 16
+# Receive and use open files from the server.
+#line 16
+allow virtual_camera system_server:fd use;
+#line 16
+
+
+# Allow virtual_camera to communicate with
+# mediaserver (required for using Surface originating
+# from virtual camera in mediaserver).
+
+#line 21
+# Call the server domain and optionally transfer references to it.
+#line 21
+allow virtual_camera mediaserver:binder { call transfer };
+#line 21
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 21
+allow mediaserver virtual_camera:binder transfer;
+#line 21
+# Receive and use open files from the server.
+#line 21
+allow virtual_camera mediaserver:fd use;
+#line 21
+
+
+# Required for the codecs to be able to decode
+# video into surface provided by virtual camera.
+
+#line 25
+typeattribute virtual_camera halclientdomain;
+#line 25
+typeattribute virtual_camera hal_codec2_client;
+#line 25
+
+#line 25
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 25
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 25
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 25
+
+#line 25
+typeattribute virtual_camera hal_codec2;
+#line 25
+# Find passthrough HAL implementations
+#line 25
+allow hal_codec2 system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_codec2 vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 25
+allow hal_codec2 vendor_file:file { read open getattr execute map };
+#line 25
+
+#line 25
+
+
+#line 26
+typeattribute virtual_camera halclientdomain;
+#line 26
+typeattribute virtual_camera hal_omx_client;
+#line 26
+
+#line 26
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 26
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 26
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 26
+
+#line 26
+typeattribute virtual_camera hal_omx;
+#line 26
+# Find passthrough HAL implementations
+#line 26
+allow hal_omx system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_omx vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 26
+allow hal_omx vendor_file:file { read open getattr execute map };
+#line 26
+
+#line 26
+
+
+# Allow virtualCamera to call apps via binder.
+
+#line 29
+# Call the server domain and optionally transfer references to it.
+#line 29
+allow virtual_camera appdomain:binder { call transfer };
+#line 29
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 29
+allow appdomain virtual_camera:binder transfer;
+#line 29
+# Receive and use open files from the server.
+#line 29
+allow virtual_camera appdomain:fd use;
+#line 29
+
+
+# Allow virtual_camera to use fd from apps
+allow virtual_camera { appdomain -isolated_app }:fd use;
+
+
+#line 34
+# Call the server domain and optionally transfer references to it.
+#line 34
+allow virtual_camera surfaceflinger:binder { call transfer };
+#line 34
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 34
+allow surfaceflinger virtual_camera:binder transfer;
+#line 34
+# Receive and use open files from the server.
+#line 34
+allow virtual_camera surfaceflinger:fd use;
+#line 34
+;
+
+# Only allow virtual_camera to add a virtual_camera_service and no one else.
+
+#line 37
+ allow virtual_camera virtual_camera_service:service_manager { add find };
+#line 37
+ neverallow { domain -virtual_camera } virtual_camera_service:service_manager add;
+#line 37
+
+#line 37
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 37
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 37
+
+#line 37
+;
+
+# Allow virtual_camera to map graphic buffers
+
+#line 40
+typeattribute virtual_camera halclientdomain;
+#line 40
+typeattribute virtual_camera hal_graphics_allocator_client;
+#line 40
+
+#line 40
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 40
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 40
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 40
+
+#line 40
+typeattribute virtual_camera hal_graphics_allocator;
+#line 40
+# Find passthrough HAL implementations
+#line 40
+allow hal_graphics_allocator system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 40
+allow hal_graphics_allocator vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 40
+allow hal_graphics_allocator vendor_file:file { read open getattr execute map };
+#line 40
+
+#line 40
+
+
+# Allow virtual_camera to use GPU
+allow virtual_camera gpu_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow virtual_camera gpu_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+#line 45
+allow virtual_camera sysfs_gpu:dir { open getattr read search ioctl lock watch watch_reads };
+#line 45
+allow virtual_camera sysfs_gpu:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 45
+
+
+# ION And DMABUF are used by vendor to allocate graphic buffers needed by virtual_camera
+allow cameraserver ion_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow cameraserver dmabuf_system_heap_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow virtual camera to use graphics composer fd-s (fences).
+allow virtual_camera hal_graphics_composer:fd use;
+
+# For collecting bugreports.
+allow virtual_camera dumpstate:fd use;
+allow virtual_camera dumpstate:fifo_file write;
+
+# Needed for permission checks.
+allow virtual_camera permission_service:service_manager find;
+
+# Allow 'adb shell cmd' to configure test instances of camera.
+allow virtual_camera adbd:fd use;
+allow virtual_camera adbd:unix_stream_socket { getattr read write };
+allow virtual_camera shell:fifo_file { getattr read write };
+
+# Allow virtual_camera to access dmabuf_system_heap_device
+allow virtual_camera dmabuf_system_heap_device:chr_file { read open };
+#line 1 "system/sepolicy/private/virtual_face.te"
+# biometric virtual face sensor
+type virtual_face, domain;
+type virtual_face_exec, system_file_type, exec_type, file_type;
+
+#line 4
+typeattribute virtual_face halserverdomain;
+#line 4
+typeattribute virtual_face hal_face_server;
+#line 4
+typeattribute virtual_face hal_face;
+#line 4
+
+typeattribute virtual_face coredomain;
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init virtual_face_exec:file { getattr open read execute map };
+#line 6
+allow init virtual_face:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow virtual_face virtual_face_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init virtual_face:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init virtual_face:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init virtual_face_exec:process virtual_face;
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+allow virtual_face property_socket:sock_file write;
+#line 7
+allow virtual_face init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow virtual_face virtual_face_prop:property_service set;
+#line 7
+
+#line 7
+allow virtual_face virtual_face_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/virtual_fingerprint.te"
+# biometric virtual fingerprint sensor
+type virtual_fingerprint, domain;
+type virtual_fingerprint_exec, system_file_type, exec_type, file_type;
+
+#line 4
+typeattribute virtual_fingerprint halserverdomain;
+#line 4
+typeattribute virtual_fingerprint hal_fingerprint_server;
+#line 4
+typeattribute virtual_fingerprint hal_fingerprint;
+#line 4
+
+typeattribute virtual_fingerprint coredomain;
+
+#line 6
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow init virtual_fingerprint_exec:file { getattr open read execute map };
+#line 6
+allow init virtual_fingerprint:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow virtual_fingerprint virtual_fingerprint_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit init virtual_fingerprint:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow init virtual_fingerprint:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition init virtual_fingerprint_exec:process virtual_fingerprint;
+#line 6
+
+#line 6
+
+
+#line 7
+
+#line 7
+allow virtual_fingerprint property_socket:sock_file write;
+#line 7
+allow virtual_fingerprint init:unix_stream_socket connectto;
+#line 7
+
+#line 7
+allow virtual_fingerprint virtual_fingerprint_prop:property_service set;
+#line 7
+
+#line 7
+allow virtual_fingerprint virtual_fingerprint_prop:file { getattr open read map };
+#line 7
+
+#line 7
+
+#line 1 "system/sepolicy/private/virtual_touchpad.te"
+typeattribute virtual_touchpad coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init virtual_touchpad_exec:file { getattr open read execute map };
+#line 3
+allow init virtual_touchpad:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow virtual_touchpad virtual_touchpad_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init virtual_touchpad:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init virtual_touchpad:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init virtual_touchpad_exec:process virtual_touchpad;
+#line 3
+
+#line 3
+
+
+
+#line 5
+# Call the servicemanager and transfer references to it.
+#line 5
+allow virtual_touchpad servicemanager:binder { call transfer };
+#line 5
+# Allow servicemanager to send out callbacks
+#line 5
+allow servicemanager virtual_touchpad:binder { call transfer };
+#line 5
+# servicemanager performs getpidcon on clients.
+#line 5
+allow servicemanager virtual_touchpad:dir search;
+#line 5
+allow servicemanager virtual_touchpad:file { read open };
+#line 5
+allow servicemanager virtual_touchpad:process getattr;
+#line 5
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 5
+# all domains in domain.te.
+#line 5
+
+
+#line 6
+typeattribute virtual_touchpad binderservicedomain;
+#line 6
+
+
+#line 7
+ allow virtual_touchpad virtual_touchpad_service:service_manager { add find };
+#line 7
+ neverallow { domain -virtual_touchpad } virtual_touchpad_service:service_manager add;
+#line 7
+
+#line 7
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 7
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 7
+
+#line 7
+
+
+# Needed to check app permissions.
+
+#line 10
+# Call the server domain and optionally transfer references to it.
+#line 10
+allow virtual_touchpad system_server:binder { call transfer };
+#line 10
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 10
+allow system_server virtual_touchpad:binder transfer;
+#line 10
+# Receive and use open files from the server.
+#line 10
+allow virtual_touchpad system_server:fd use;
+#line 10
+
+
+# Requires access to /dev/uinput to create and feed the virtual device.
+allow virtual_touchpad uhid_device:chr_file { { open append write lock map } ioctl };
+
+# Requires access to the permission service to validate that clients have the
+# appropriate VR permissions.
+allow virtual_touchpad permission_service:service_manager find;
+#line 4 "system/sepolicy/private/virtualizationmanager.te"
+
+
+# Allow virtualizationmanager to communicate use, read and write over the adb connection.
+allow virtualizationmanager adbd:fd use;
+allow virtualizationmanager adbd:unix_stream_socket { getattr read write };
+
+# Allow writing VM logs to the shell console
+allow virtualizationmanager devpts:chr_file { read write getattr ioctl };
+
+# Let the virtualizationmanager domain use Binder.
+
+#line 14
+# Call the servicemanager and transfer references to it.
+#line 14
+allow virtualizationmanager servicemanager:binder { call transfer };
+#line 14
+# Allow servicemanager to send out callbacks
+#line 14
+allow servicemanager virtualizationmanager:binder { call transfer };
+#line 14
+# servicemanager performs getpidcon on clients.
+#line 14
+allow servicemanager virtualizationmanager:dir search;
+#line 14
+allow servicemanager virtualizationmanager:file { read open };
+#line 14
+allow servicemanager virtualizationmanager:process getattr;
+#line 14
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 14
+# all domains in domain.te.
+#line 14
+
+
+# Let virtualizationmanager find and communicate with virtualizationservice.
+allow virtualizationmanager virtualization_service:service_manager find;
+
+#line 18
+# Call the server domain and optionally transfer references to it.
+#line 18
+allow virtualizationmanager virtualizationservice:binder { call transfer };
+#line 18
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 18
+allow virtualizationservice virtualizationmanager:binder transfer;
+#line 18
+# Receive and use open files from the server.
+#line 18
+allow virtualizationmanager virtualizationservice:fd use;
+#line 18
+
+
+# Allow calling into the system server to find native services. "permission_service" to check
+# permissions, and "package_native" for staged apex info.
+
+#line 22
+# Call the server domain and optionally transfer references to it.
+#line 22
+allow virtualizationmanager system_server:binder { call transfer };
+#line 22
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 22
+allow system_server virtualizationmanager:binder transfer;
+#line 22
+# Receive and use open files from the server.
+#line 22
+allow virtualizationmanager system_server:fd use;
+#line 22
+
+allow virtualizationmanager { package_native_service permission_service }:service_manager find;
+
+# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain.
+
+#line 26
+# Allow the necessary permissions.
+#line 26
+
+#line 26
+# Old domain may exec the file and transition to the new domain.
+#line 26
+allow virtualizationmanager crosvm_exec:file { getattr open read execute map };
+#line 26
+allow virtualizationmanager crosvm:process transition;
+#line 26
+# New domain is entered by executing the file.
+#line 26
+allow crosvm crosvm_exec:file { entrypoint open read execute getattr map };
+#line 26
+# New domain can send SIGCHLD to its caller.
+#line 26
+allow crosvm virtualizationmanager:process sigchld;
+#line 26
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 26
+dontaudit virtualizationmanager crosvm:process noatsecure;
+#line 26
+# XXX dontaudit candidate but requires further study.
+#line 26
+allow virtualizationmanager crosvm:process { siginh rlimitinh };
+#line 26
+
+#line 26
+# Make the transition occur by default.
+#line 26
+type_transition virtualizationmanager crosvm_exec:process crosvm;
+#line 26
+
+
+# Let virtualizationmanager kill crosvm.
+allow virtualizationmanager crosvm:process sigkill;
+
+# Let virtualizationmanager create files inside virtualizationservice's temporary directories.
+allow virtualizationmanager virtualizationservice_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Let virtualizationmanager read and write files from its various clients, but not open them
+# directly as they must be passed over Binder by the client.
+allow virtualizationmanager apk_data_file:file { getattr read };
+
+# Write access is needed for mutable partitions like instance.img
+allow virtualizationmanager {
+ app_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ privapp_data_file
+}:file { getattr read write };
+
+# shell_data_file is used for automated tests and manual debugging.
+allow virtualizationmanager shell_data_file:file { getattr read write };
+
+# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there.
+allow virtualizationmanager apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+allow virtualizationmanager apex_data_file:dir search;
+allow virtualizationmanager staging_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow virtualizationmanager staging_data_file:dir search;
+
+# Run derive_classpath in our domain
+allow virtualizationmanager derive_classpath_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow virtualizationmanager apex_mnt_dir:dir { open getattr read search ioctl lock watch watch_reads };
+# Ignore harmless denials on /proc/self/fd
+dontaudit virtualizationmanager self:dir write;
+
+# Let virtualizationmanager to accept vsock connection from the guest VMs
+allow virtualizationmanager self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } listen accept };
+neverallow { domain -virtualizationmanager } virtualizationmanager:vsock_socket { accept bind create connect listen };
+
+# Allow virtualizationmanager to inspect all hypervisor capabilities.
+
+#line 67
+allow virtualizationmanager hypervisor_prop:file { getattr open read map };
+#line 67
+
+
+#line 68
+allow virtualizationmanager hypervisor_restricted_prop:file { getattr open read map };
+#line 68
+
+
+# Allow virtualizationmanager to be read custom pvmfw.img configuration
+
+dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
+neverallow {
+ domain
+ -init
+ -dumpstate
+
+ -early_virtmgr
+} hypervisor_pvmfw_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow virtualizationmanager to be read custom virtualizationmanager configuration
+
+dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
+neverallow {
+ domain
+ -init
+ -dumpstate
+
+ -early_virtmgr
+} hypervisor_virtualizationmanager_prop:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+
+# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
+
+#line 93
+allow virtualizationmanager tombstoned_crash_socket:sock_file write;
+#line 93
+allow virtualizationmanager tombstoned:unix_stream_socket connectto;
+#line 93
+
+
+# Append ramdumps to tombstone files passed as fds from tombstoned
+allow virtualizationmanager tombstone_data_file:file { append getattr };
+allow virtualizationmanager tombstoned:fd use;
+
+# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy
+
+#line 100
+allow virtualizationmanager proc_dt_avf:dir { open getattr read search ioctl lock watch watch_reads };
+#line 100
+allow virtualizationmanager proc_dt_avf:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 100
+
+
+#line 101
+allow virtualizationmanager sysfs_dt_avf:dir { open getattr read search ioctl lock watch watch_reads };
+#line 101
+allow virtualizationmanager sysfs_dt_avf:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 101
+
+
+# virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages
+# from pVM to HAL.
+
+#line 105
+typeattribute virtualizationmanager halclientdomain;
+#line 105
+typeattribute virtualizationmanager hal_secretkeeper_client;
+#line 105
+
+#line 105
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 105
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 105
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 105
+
+#line 105
+typeattribute virtualizationmanager hal_secretkeeper;
+#line 105
+# Find passthrough HAL implementations
+#line 105
+allow hal_secretkeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 105
+allow hal_secretkeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 105
+allow hal_secretkeeper vendor_file:file { read open getattr execute map };
+#line 105
+
+#line 105
+;
+
+# Let virtualizationmanager open test artifacts under /data/local/tmp with file path.
+# (e.g. custom debug policy)
+#line 112
+
+
+# Allow virtualizationmanager to read microdroid related files in vendor partition
+
+#line 115
+allow virtualizationmanager vendor_microdroid_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 115
+allow virtualizationmanager vendor_microdroid_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 115
+
+
+# Do not allow writing vendor_microdroid_file from any process.
+neverallow { domain } vendor_microdroid_file:dir { add_name create link relabelfrom remove_name rename reparent rmdir setattr write };
+neverallow { domain } vendor_microdroid_file:file { append create link unlink relabelfrom rename setattr write };
+
+# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
+
+#line 122
+allow virtualizationmanager crosvm:dir { open getattr read search ioctl lock watch watch_reads };
+#line 122
+allow virtualizationmanager crosvm:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 122
+;
+
+# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
+# a harmless denial for CompOS log files, so ignore that.
+dontaudit virtualizationmanager apex_module_data_file:dir search;
+
+
+#line 128
+ # virtualizationmanager holds references to bound devices, returned from vfio_handler
+#line 128
+
+#line 128
+# Call the server domain and optionally transfer references to it.
+#line 128
+allow virtualizationmanager vfio_handler:binder { call transfer };
+#line 128
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 128
+allow vfio_handler virtualizationmanager:binder transfer;
+#line 128
+# Receive and use open files from the server.
+#line 128
+allow virtualizationmanager vfio_handler:fd use;
+#line 128
+
+#line 131
+
+
+
+#line 133
+ # Allow virtualizationmanager to deal with file descriptors of TAP interfaces.
+#line 133
+ allow virtualizationmanager tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 133
+ allow virtualizationmanager vmnic:fd use;
+#line 137
+
+
+# virtualizationmanager reads tee_service_contexts_file to determine if VM is allowed
+# to access requested tee services
+allow virtualizationmanager tee_service_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# virtualizationmanager uses libselinux to check if VM is allowed to access requested
+# tee services.
+
+#line 144
+
+#line 144
+allow virtualizationmanager selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 144
+allow virtualizationmanager selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 144
+
+#line 144
+allow virtualizationmanager selinuxfs:file { open append write lock map };
+#line 144
+allow virtualizationmanager kernel:security compute_av;
+#line 144
+allow virtualizationmanager self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 144
+
+#line 1 "system/sepolicy/private/virtualizationservice.te"
+type virtualizationservice, domain, coredomain;
+type virtualizationservice_exec, system_file_type, exec_type, file_type;
+
+# The domain needs to be a 'mlstrustedsubject' to change the memlock rlimit of
+# the virtualizationmanager domain running at a more constrained MLS level.
+typeattribute virtualizationservice mlstrustedsubject;
+
+# When init runs a file labelled with virtualizationservice_exec, run it in the
+# virtualizationservice domain.
+
+#line 10
+
+#line 10
+# Allow the necessary permissions.
+#line 10
+
+#line 10
+# Old domain may exec the file and transition to the new domain.
+#line 10
+allow init virtualizationservice_exec:file { getattr open read execute map };
+#line 10
+allow init virtualizationservice:process transition;
+#line 10
+# New domain is entered by executing the file.
+#line 10
+allow virtualizationservice virtualizationservice_exec:file { entrypoint open read execute getattr map };
+#line 10
+# New domain can send SIGCHLD to its caller.
+#line 10
+
+#line 10
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 10
+dontaudit init virtualizationservice:process noatsecure;
+#line 10
+# XXX dontaudit candidate but requires further study.
+#line 10
+allow init virtualizationservice:process { siginh rlimitinh };
+#line 10
+
+#line 10
+# Make the transition occur by default.
+#line 10
+type_transition init virtualizationservice_exec:process virtualizationservice;
+#line 10
+
+#line 10
+
+
+# Let the virtualizationservice domain use Binder.
+
+#line 13
+# Call the servicemanager and transfer references to it.
+#line 13
+allow virtualizationservice servicemanager:binder { call transfer };
+#line 13
+# Allow servicemanager to send out callbacks
+#line 13
+allow servicemanager virtualizationservice:binder { call transfer };
+#line 13
+# servicemanager performs getpidcon on clients.
+#line 13
+allow servicemanager virtualizationservice:dir search;
+#line 13
+allow servicemanager virtualizationservice:file { read open };
+#line 13
+allow servicemanager virtualizationservice:process getattr;
+#line 13
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 13
+# all domains in domain.te.
+#line 13
+
+
+# Register our services with ServiceManager.
+
+#line 16
+ allow virtualizationservice virtualization_service:service_manager { add find };
+#line 16
+ neverallow { domain -virtualizationservice } virtualization_service:service_manager add;
+#line 16
+
+#line 16
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 16
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 16
+
+#line 16
+
+
+#line 17
+
+#line 17
+ allow virtualizationservice virtualization_maintenance_service:service_manager { add find };
+#line 17
+ neverallow { domain -virtualizationservice } virtualization_maintenance_service:service_manager add;
+#line 17
+
+#line 17
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 17
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 17
+
+#line 17
+
+#line 19
+
+
+
+#line 21
+ # Let virtualizationservice find and communicate with vfio_handler.
+#line 21
+ allow virtualizationservice vfio_handler_service:service_manager find;
+#line 21
+
+#line 21
+# Call the server domain and optionally transfer references to it.
+#line 21
+allow virtualizationservice vfio_handler:binder { call transfer };
+#line 21
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 21
+allow vfio_handler virtualizationservice:binder transfer;
+#line 21
+# Receive and use open files from the server.
+#line 21
+allow virtualizationservice vfio_handler:fd use;
+#line 21
+
+#line 25
+
+
+
+#line 27
+ # Let virtualizationservice find and communicate with vmnic.
+#line 27
+ allow virtualizationservice vmnic_service:service_manager find;
+#line 27
+
+#line 27
+# Call the server domain and optionally transfer references to it.
+#line 27
+allow virtualizationservice vmnic:binder { call transfer };
+#line 27
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 27
+allow vmnic virtualizationservice:binder transfer;
+#line 27
+# Receive and use open files from the server.
+#line 27
+allow virtualizationservice vmnic:fd use;
+#line 27
+
+#line 27
+ allow virtualizationservice vm_tethering_service:service_manager find;
+#line 32
+
+
+# Allow the virtualizationservice domain to serve a remotely provisioned component for
+# pVM remote attestation.
+
+#line 36
+typeattribute virtualizationservice halserverdomain;
+#line 36
+typeattribute virtualizationservice hal_remotelyprovisionedcomponent_avf_server;
+#line 36
+typeattribute virtualizationservice hal_remotelyprovisionedcomponent_avf;
+#line 36
+
+
+# Allow the virtualizationservice to inspect whether remote attestation is supported
+# through the system property.
+
+#line 40
+allow virtualizationservice avf_virtualizationservice_prop:file { getattr open read map };
+#line 40
+
+
+# Allow calling into the system server to find "permission_service".
+
+#line 43
+# Call the server domain and optionally transfer references to it.
+#line 43
+allow virtualizationservice system_server:binder { call transfer };
+#line 43
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 43
+allow system_server virtualizationservice:binder transfer;
+#line 43
+# Receive and use open files from the server.
+#line 43
+allow virtualizationservice system_server:fd use;
+#line 43
+
+allow virtualizationservice permission_service:service_manager find;
+
+# Allow virtualizationservice to retrieve the remotely provisioned keys from rkpd.
+
+#line 47
+# Call the server domain and optionally transfer references to it.
+#line 47
+allow virtualizationservice remote_provisioning_service_server:binder { call transfer };
+#line 47
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 47
+allow remote_provisioning_service_server virtualizationservice:binder transfer;
+#line 47
+# Receive and use open files from the server.
+#line 47
+allow virtualizationservice remote_provisioning_service_server:fd use;
+#line 47
+
+allow virtualizationservice remote_provisioning_service:service_manager find;
+
+# Allow virtualizationservice to manage VM secrets via Secretkeeper.
+
+#line 51
+typeattribute virtualizationservice halclientdomain;
+#line 51
+typeattribute virtualizationservice hal_secretkeeper_client;
+#line 51
+
+#line 51
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 51
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 51
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 51
+
+#line 51
+typeattribute virtualizationservice hal_secretkeeper;
+#line 51
+# Find passthrough HAL implementations
+#line 51
+allow hal_secretkeeper system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 51
+allow hal_secretkeeper vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 51
+allow hal_secretkeeper vendor_file:file { read open getattr execute map };
+#line 51
+
+#line 51
+
+
+# Let virtualizationservice remove memlock rlimit of virtualizationmanager. This is necessary
+# to mlock VM memory and page tables.
+allow virtualizationservice self:capability sys_resource;
+allow virtualizationservice virtualizationmanager:process setrlimit;
+
+
+#line 58
+ # To provide display service to an app to get surface.
+#line 58
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+#line 58
+ allow virtualizationservice vmlauncher_app:binder transfer;
+#line 62
+
+
+# Let virtualizationservice set the owner of a VM's temporary directory.
+allow virtualizationservice self:capability chown;
+
+# Let virtualizationservice create and delete temporary directories of VMs. To remove old
+# directories, it needs the permission to unlink the files created by virtualizationmanager.
+allow virtualizationservice virtualizationservice_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow virtualizationservice virtualizationservice_data_file:sock_file unlink;
+allow virtualizationservice virtualizationservice_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from
+# crosvm to the console
+allow virtualizationservice adbd:fd use;
+allow virtualizationservice adbd:unix_stream_socket { read write };
+
+# Allow to connnect to and run VirtMgr to start the service VM for remote attestation.
+
+#line 79
+# Transition to virtualizationmanager when the client executes it.
+#line 79
+
+#line 79
+# Allow the necessary permissions.
+#line 79
+
+#line 79
+# Old domain may exec the file and transition to the new domain.
+#line 79
+allow virtualizationservice virtualizationmanager_exec:file { getattr open read execute map };
+#line 79
+allow virtualizationservice virtualizationmanager:process transition;
+#line 79
+# New domain is entered by executing the file.
+#line 79
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 79
+# New domain can send SIGCHLD to its caller.
+#line 79
+allow virtualizationmanager virtualizationservice:process sigchld;
+#line 79
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 79
+dontaudit virtualizationservice virtualizationmanager:process noatsecure;
+#line 79
+# XXX dontaudit candidate but requires further study.
+#line 79
+allow virtualizationservice virtualizationmanager:process { siginh rlimitinh };
+#line 79
+
+#line 79
+# Make the transition occur by default.
+#line 79
+type_transition virtualizationservice virtualizationmanager_exec:process virtualizationmanager;
+#line 79
+
+#line 79
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 79
+allow { virtualizationmanager crosvm } virtualizationservice:unix_stream_socket { ioctl getattr read write };
+#line 79
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 79
+allow { virtualizationmanager crosvm } virtualizationservice:fd use;
+#line 79
+# Let the client use file descriptors created by virtualizationmanager.
+#line 79
+allow virtualizationservice virtualizationmanager:fd use;
+#line 79
+# Allow piping console log to the client
+#line 79
+allow { virtualizationmanager crosvm } virtualizationservice:fifo_file { ioctl getattr read write };
+#line 79
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 79
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 79
+# the client can only connect to VMs that it owns.
+#line 79
+allow virtualizationservice virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 79
+# Allow client to inspect hypervisor capabilities
+#line 79
+
+#line 79
+allow virtualizationservice hypervisor_prop:file { getattr open read map };
+#line 79
+
+#line 79
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 79
+allow virtualizationservice virtualizationservice_data_file:file { getattr read };
+#line 79
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 79
+allow virtualizationmanager virtualizationservice:dir search;
+#line 79
+allow virtualizationmanager virtualizationservice:file read;
+#line 79
+allow virtualizationmanager virtualizationservice:lnk_file read;
+#line 79
+
+
+# Allow virtualizationservice to read and write in the apex data directory
+# /data/misc/apexdata/com.android.virt. Also allow checking of the parent directory
+# (needed for SQLite database creation).
+allow virtualizationservice apex_module_data_file:dir { search getattr };
+allow virtualizationservice apex_virt_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow virtualizationservice apex_virt_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Accept vsock connection from the guest VMs to singleton services
+# such as the guest tombstone server.
+allow virtualizationservice self:vsock_socket { create read getattr write setattr lock append bind getopt setopt shutdown map listen accept };
+neverallow { domain -virtualizationservice -dumpstate } virtualizationservice:vsock_socket *;
+
+# Allow virtualizationservice to read/write its own sysprop. Only the process can do so.
+
+#line 94
+
+#line 94
+allow virtualizationservice property_socket:sock_file write;
+#line 94
+allow virtualizationservice init:unix_stream_socket connectto;
+#line 94
+
+#line 94
+allow virtualizationservice virtualizationservice_prop:property_service set;
+#line 94
+
+#line 94
+allow virtualizationservice virtualizationservice_prop:file { getattr open read map };
+#line 94
+
+#line 94
+
+
+# Allow writing stats to statsd
+
+#line 97
+allow virtualizationservice statsdw_socket:sock_file write;
+#line 97
+allow virtualizationservice statsd:unix_dgram_socket sendto;
+#line 97
+
+
+# Allow virtualization service to talk to tombstoned to push guest tombstones
+
+#line 100
+allow virtualizationservice tombstoned_crash_socket:sock_file write;
+#line 100
+allow virtualizationservice tombstoned:unix_stream_socket connectto;
+#line 100
+
+
+# Append to tombstone files passed as fds from tombstoned
+allow virtualizationservice tombstone_data_file:file { append getattr };
+allow virtualizationservice tombstoned:fd use;
+
+# Allow virtualizationservice to check if VFIO is supported
+allow virtualizationservice vfio_device:chr_file getattr;
+allow virtualizationservice vfio_device:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Allow virtualizationservice to access VM DTBO via a file created by virtualizationmanager.
+allow virtualizationservice virtualizationmanager:fd use;
+
+# Allow virtualizationservice to access vendor_configs_file to get the list of assignable devices.
+
+#line 114
+allow virtualizationservice vendor_configs_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 114
+allow virtualizationservice vendor_configs_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 114
+
+
+neverallow {
+ domain
+ -init
+ -virtualizationservice
+} virtualizationservice_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -virtualizationmanager
+ -virtualizationservice
+} virtualizationservice_data_file:file { open create };
+
+neverallow virtualizationservice {
+ domain
+ -virtualizationmanager
+ -virtualizationservice
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+ -crosvm
+}:process setrlimit;
+
+
+#line 137
+ # Allow virtualizationservice to deal with file descriptors of TAP interfaces.
+#line 137
+ allow virtualizationservice tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 137
+ allow virtualizationservice vmnic:fd use;
+#line 141
+
+
+
+#line 143
+ # Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
+#line 143
+ neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;
+#line 146
+
+#line 1 "system/sepolicy/private/vmlauncher_app.te"
+type vmlauncher_app, domain;
+typeattribute vmlauncher_app coredomain;
+
+
+#line 4
+typeattribute vmlauncher_app appdomain;
+#line 4
+# Label tmpfs objects for all apps.
+#line 4
+type_transition vmlauncher_app tmpfs:file appdomain_tmpfs;
+#line 4
+
+#line 4
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 4
+type vmlauncher_app_userfaultfd;
+#line 4
+type_transition vmlauncher_app vmlauncher_app:anon_inode vmlauncher_app_userfaultfd "[userfaultfd]";
+#line 4
+# Allow domain to create/use userfaultfd anon_inode.
+#line 4
+allow vmlauncher_app vmlauncher_app_userfaultfd:anon_inode { create ioctl read };
+#line 4
+# Suppress errors generate during bugreport
+#line 4
+dontaudit su vmlauncher_app_userfaultfd:anon_inode *;
+#line 4
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 4
+neverallow { domain -vmlauncher_app } vmlauncher_app_userfaultfd:anon_inode *;
+#line 4
+
+#line 4
+allow vmlauncher_app appdomain_tmpfs:file { execute getattr map read write };
+#line 4
+neverallow { vmlauncher_app -runas_app -shell -simpleperf } { domain -vmlauncher_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 4
+neverallow { appdomain -runas_app -shell -simpleperf -vmlauncher_app } vmlauncher_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 4
+# The Android security model guarantees the confidentiality and integrity
+#line 4
+# of application data and execution state. Ptrace bypasses those
+#line 4
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 4
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 4
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 4
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 4
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 4
+# live lock conditions.
+#line 4
+neverallow { domain -vmlauncher_app -crash_dump -runas_app -simpleperf } vmlauncher_app:process ptrace;
+#line 4
+
+
+#line 5
+typeattribute vmlauncher_app netdomain;
+#line 5
+
+
+allow vmlauncher_app app_api_service:service_manager find;
+allow vmlauncher_app system_api_service:service_manager find;
+
+allow vmlauncher_app shell_data_file:dir search;
+allow vmlauncher_app shell_data_file:file { read open write };
+
+#line 12
+# Transition to virtualizationmanager when the client executes it.
+#line 12
+
+#line 12
+# Allow the necessary permissions.
+#line 12
+
+#line 12
+# Old domain may exec the file and transition to the new domain.
+#line 12
+allow vmlauncher_app virtualizationmanager_exec:file { getattr open read execute map };
+#line 12
+allow vmlauncher_app virtualizationmanager:process transition;
+#line 12
+# New domain is entered by executing the file.
+#line 12
+allow virtualizationmanager virtualizationmanager_exec:file { entrypoint open read execute getattr map };
+#line 12
+# New domain can send SIGCHLD to its caller.
+#line 12
+allow virtualizationmanager vmlauncher_app:process sigchld;
+#line 12
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 12
+dontaudit vmlauncher_app virtualizationmanager:process noatsecure;
+#line 12
+# XXX dontaudit candidate but requires further study.
+#line 12
+allow vmlauncher_app virtualizationmanager:process { siginh rlimitinh };
+#line 12
+
+#line 12
+# Make the transition occur by default.
+#line 12
+type_transition vmlauncher_app virtualizationmanager_exec:process virtualizationmanager;
+#line 12
+
+#line 12
+# Allow virtualizationmanager to communicate over UDS with the client.
+#line 12
+allow { virtualizationmanager crosvm } vmlauncher_app:unix_stream_socket { ioctl getattr read write };
+#line 12
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+#line 12
+allow { virtualizationmanager crosvm } vmlauncher_app:fd use;
+#line 12
+# Let the client use file descriptors created by virtualizationmanager.
+#line 12
+allow vmlauncher_app virtualizationmanager:fd use;
+#line 12
+# Allow piping console log to the client
+#line 12
+allow { virtualizationmanager crosvm } vmlauncher_app:fifo_file { ioctl getattr read write };
+#line 12
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+#line 12
+# that it created. Notice that we do not grant permission to create a vsock;
+#line 12
+# the client can only connect to VMs that it owns.
+#line 12
+allow vmlauncher_app virtualizationmanager:vsock_socket { getattr getopt read write };
+#line 12
+# Allow client to inspect hypervisor capabilities
+#line 12
+
+#line 12
+allow vmlauncher_app hypervisor_prop:file { getattr open read map };
+#line 12
+
+#line 12
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+#line 12
+allow vmlauncher_app virtualizationservice_data_file:file { getattr read };
+#line 12
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+#line 12
+allow virtualizationmanager vmlauncher_app:dir search;
+#line 12
+allow virtualizationmanager vmlauncher_app:file read;
+#line 12
+allow virtualizationmanager vmlauncher_app:lnk_file read;
+#line 12
+
+
+allow vmlauncher_app fsck_exec:file { { getattr open read ioctl lock map watch watch_reads } execute execute_no_trans };
+allow vmlauncher_app crosvm:fd use;
+allow vmlauncher_app crosvm_tmpfs:file { map read write };
+allow vmlauncher_app crosvm_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+allow vmlauncher_app privapp_data_file:sock_file { create unlink write getattr };
+
+
+#line 21
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+#line 21
+ allow vmlauncher_app virtualization_service:service_manager find;
+#line 21
+ allow vmlauncher_app virtualizationservice:binder call;
+#line 21
+ allow vmlauncher_app crosvm:binder { call transfer };
+#line 26
+
+
+
+#line 28
+ allow vmlauncher_app self:vsock_socket { { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } } listen accept };
+#line 30
+
+
+#line 37
+
+
+# TODO(b/372664601): Remove this when we don't need linux_vm_setup
+
+#line 40
+
+#line 40
+allow vmlauncher_app property_socket:sock_file write;
+#line 40
+allow vmlauncher_app init:unix_stream_socket connectto;
+#line 40
+
+#line 40
+allow vmlauncher_app debug_prop:property_service set;
+#line 40
+
+#line 40
+allow vmlauncher_app debug_prop:file { getattr open read map };
+#line 40
+
+#line 40
+;
+#line 1 "system/sepolicy/private/vmnic.te"
+
+#line 1
+ # vmnic is a helper service for network tasks, like creating TAP network interface.
+#line 1
+ # vmnic is separated from virtualizationservice as vmnic requires more permission to do network related tasks.
+#line 1
+ type vmnic, domain, coredomain;
+#line 1
+ type vmnic_exec, system_file_type, exec_type, file_type;
+#line 1
+
+#line 1
+ # When init runs a file labelled with vmnic_exec, run it in the vmnic domain.
+#line 1
+
+#line 1
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow init vmnic_exec:file { getattr open read execute map };
+#line 1
+allow init vmnic:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow vmnic vmnic_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit init vmnic:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow init vmnic:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition init vmnic_exec:process vmnic;
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ # Let the vmnic domain register the vmnic_service with ServiceManager.
+#line 1
+
+#line 1
+ allow vmnic vmnic_service:service_manager { add find };
+#line 1
+ neverallow { domain -vmnic } vmnic_service:service_manager add;
+#line 1
+
+#line 1
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 1
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 1
+
+#line 1
+
+#line 1
+
+#line 1
+ # Let the vmnic domain use Binder.
+#line 1
+
+#line 1
+# Call the servicemanager and transfer references to it.
+#line 1
+allow vmnic servicemanager:binder { call transfer };
+#line 1
+# Allow servicemanager to send out callbacks
+#line 1
+allow servicemanager vmnic:binder { call transfer };
+#line 1
+# servicemanager performs getpidcon on clients.
+#line 1
+allow servicemanager vmnic:dir search;
+#line 1
+allow servicemanager vmnic:file { read open };
+#line 1
+allow servicemanager vmnic:process getattr;
+#line 1
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 1
+# all domains in domain.te.
+#line 1
+
+#line 1
+
+#line 1
+ # Allow for creating and deleting TAP network interfaces.
+#line 1
+ allow vmnic self:{ capability cap_userns } net_admin;
+#line 1
+ allow vmnic self:tun_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+#line 1
+ allow vmnic tun_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1
+ allowxperm vmnic tun_device:chr_file ioctl { 0x800454d2 0x400454ca };
+#line 1
+ allow vmnic self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+#line 1
+ allowxperm vmnic self:udp_socket ioctl 0x00008914;
+#line 1
+
+#line 1
+ # Only virtualizationservice can communicate to vmnic
+#line 1
+ neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;
+#line 26
+ # is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK)
+#line 1 "system/sepolicy/private/vold.te"
+typeattribute vold coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init vold_exec:file { getattr open read execute map };
+#line 3
+allow init vold:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow vold vold_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init vold:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init vold:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init vold_exec:process vold;
+#line 3
+
+#line 3
+
+
+# Switch to more restrictive domains when executing common tools
+
+#line 6
+# Allow the necessary permissions.
+#line 6
+
+#line 6
+# Old domain may exec the file and transition to the new domain.
+#line 6
+allow vold sgdisk_exec:file { getattr open read execute map };
+#line 6
+allow vold sgdisk:process transition;
+#line 6
+# New domain is entered by executing the file.
+#line 6
+allow sgdisk sgdisk_exec:file { entrypoint open read execute getattr map };
+#line 6
+# New domain can send SIGCHLD to its caller.
+#line 6
+allow sgdisk vold:process sigchld;
+#line 6
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 6
+dontaudit vold sgdisk:process noatsecure;
+#line 6
+# XXX dontaudit candidate but requires further study.
+#line 6
+allow vold sgdisk:process { siginh rlimitinh };
+#line 6
+
+#line 6
+# Make the transition occur by default.
+#line 6
+type_transition vold sgdisk_exec:process sgdisk;
+#line 6
+;
+
+#line 7
+# Allow the necessary permissions.
+#line 7
+
+#line 7
+# Old domain may exec the file and transition to the new domain.
+#line 7
+allow vold sdcardd_exec:file { getattr open read execute map };
+#line 7
+allow vold sdcardd:process transition;
+#line 7
+# New domain is entered by executing the file.
+#line 7
+allow sdcardd sdcardd_exec:file { entrypoint open read execute getattr map };
+#line 7
+# New domain can send SIGCHLD to its caller.
+#line 7
+allow sdcardd vold:process sigchld;
+#line 7
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 7
+dontaudit vold sdcardd:process noatsecure;
+#line 7
+# XXX dontaudit candidate but requires further study.
+#line 7
+allow vold sdcardd:process { siginh rlimitinh };
+#line 7
+
+#line 7
+# Make the transition occur by default.
+#line 7
+type_transition vold sdcardd_exec:process sdcardd;
+#line 7
+;
+
+#line 8
+# Allow the necessary permissions.
+#line 8
+
+#line 8
+# Old domain may exec the file and transition to the new domain.
+#line 8
+allow vold fuseblkd_untrusted_exec:file { getattr open read execute map };
+#line 8
+allow vold fuseblkd_untrusted:process transition;
+#line 8
+# New domain is entered by executing the file.
+#line 8
+allow fuseblkd_untrusted fuseblkd_untrusted_exec:file { entrypoint open read execute getattr map };
+#line 8
+# New domain can send SIGCHLD to its caller.
+#line 8
+allow fuseblkd_untrusted vold:process sigchld;
+#line 8
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 8
+dontaudit vold fuseblkd_untrusted:process noatsecure;
+#line 8
+# XXX dontaudit candidate but requires further study.
+#line 8
+allow vold fuseblkd_untrusted:process { siginh rlimitinh };
+#line 8
+
+#line 8
+# Make the transition occur by default.
+#line 8
+type_transition vold fuseblkd_untrusted_exec:process fuseblkd_untrusted;
+#line 8
+;
+
+# Switch to e2fs domain when running mkfs.ext4 to format a partition
+
+#line 11
+# Allow the necessary permissions.
+#line 11
+
+#line 11
+# Old domain may exec the file and transition to the new domain.
+#line 11
+allow vold e2fs_exec:file { getattr open read execute map };
+#line 11
+allow vold e2fs:process transition;
+#line 11
+# New domain is entered by executing the file.
+#line 11
+allow e2fs e2fs_exec:file { entrypoint open read execute getattr map };
+#line 11
+# New domain can send SIGCHLD to its caller.
+#line 11
+allow e2fs vold:process sigchld;
+#line 11
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 11
+dontaudit vold e2fs:process noatsecure;
+#line 11
+# XXX dontaudit candidate but requires further study.
+#line 11
+allow vold e2fs:process { siginh rlimitinh };
+#line 11
+
+#line 11
+# Make the transition occur by default.
+#line 11
+type_transition vold e2fs_exec:process e2fs;
+#line 11
+;
+
+
+# For a handful of probing tools, we choose an even more restrictive
+# domain when working with untrusted block devices
+
+#line 16
+# Old domain may exec the file and transition to the new domain.
+#line 16
+allow vold blkid_exec:file { getattr open read execute map };
+#line 16
+allow vold blkid:process transition;
+#line 16
+# New domain is entered by executing the file.
+#line 16
+allow blkid blkid_exec:file { entrypoint open read execute getattr map };
+#line 16
+# New domain can send SIGCHLD to its caller.
+#line 16
+allow blkid vold:process sigchld;
+#line 16
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 16
+dontaudit vold blkid:process noatsecure;
+#line 16
+# XXX dontaudit candidate but requires further study.
+#line 16
+allow vold blkid:process { siginh rlimitinh };
+#line 16
+;
+
+#line 17
+# Old domain may exec the file and transition to the new domain.
+#line 17
+allow vold blkid_exec:file { getattr open read execute map };
+#line 17
+allow vold blkid_untrusted:process transition;
+#line 17
+# New domain is entered by executing the file.
+#line 17
+allow blkid_untrusted blkid_exec:file { entrypoint open read execute getattr map };
+#line 17
+# New domain can send SIGCHLD to its caller.
+#line 17
+allow blkid_untrusted vold:process sigchld;
+#line 17
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 17
+dontaudit vold blkid_untrusted:process noatsecure;
+#line 17
+# XXX dontaudit candidate but requires further study.
+#line 17
+allow vold blkid_untrusted:process { siginh rlimitinh };
+#line 17
+;
+
+#line 18
+# Old domain may exec the file and transition to the new domain.
+#line 18
+allow vold fsck_exec:file { getattr open read execute map };
+#line 18
+allow vold fsck:process transition;
+#line 18
+# New domain is entered by executing the file.
+#line 18
+allow fsck fsck_exec:file { entrypoint open read execute getattr map };
+#line 18
+# New domain can send SIGCHLD to its caller.
+#line 18
+allow fsck vold:process sigchld;
+#line 18
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 18
+dontaudit vold fsck:process noatsecure;
+#line 18
+# XXX dontaudit candidate but requires further study.
+#line 18
+allow vold fsck:process { siginh rlimitinh };
+#line 18
+;
+
+#line 19
+# Old domain may exec the file and transition to the new domain.
+#line 19
+allow vold fsck_exec:file { getattr open read execute map };
+#line 19
+allow vold fsck_untrusted:process transition;
+#line 19
+# New domain is entered by executing the file.
+#line 19
+allow fsck_untrusted fsck_exec:file { entrypoint open read execute getattr map };
+#line 19
+# New domain can send SIGCHLD to its caller.
+#line 19
+allow fsck_untrusted vold:process sigchld;
+#line 19
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 19
+dontaudit vold fsck_untrusted:process noatsecure;
+#line 19
+# XXX dontaudit candidate but requires further study.
+#line 19
+allow vold fsck_untrusted:process { siginh rlimitinh };
+#line 19
+;
+
+# Newly created storage dirs are always treated as mount stubs to prevent us
+# from accidentally writing when the mount point isn't present.
+type_transition vold storage_file:dir storage_stub_file;
+type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
+
+# Property Service
+
+#line 27
+allow vold vold_config_prop:file { getattr open read map };
+#line 27
+
+
+#line 28
+allow vold storage_config_prop:file { getattr open read map };
+#line 28
+;
+
+#line 29
+allow vold incremental_prop:file { getattr open read map };
+#line 29
+;
+
+#line 30
+allow vold gsid_prop:file { getattr open read map };
+#line 30
+;
+
+
+#line 32
+
+#line 32
+allow vold property_socket:sock_file write;
+#line 32
+allow vold init:unix_stream_socket connectto;
+#line 32
+
+#line 32
+allow vold vold_prop:property_service set;
+#line 32
+
+#line 32
+allow vold vold_prop:file { getattr open read map };
+#line 32
+
+#line 32
+
+
+#line 33
+
+#line 33
+allow vold property_socket:sock_file write;
+#line 33
+allow vold init:unix_stream_socket connectto;
+#line 33
+
+#line 33
+allow vold vold_status_prop:property_service set;
+#line 33
+
+#line 33
+allow vold vold_status_prop:file { getattr open read map };
+#line 33
+
+#line 33
+
+
+#line 34
+
+#line 34
+allow vold property_socket:sock_file write;
+#line 34
+allow vold init:unix_stream_socket connectto;
+#line 34
+
+#line 34
+allow vold powerctl_prop:property_service set;
+#line 34
+
+#line 34
+allow vold powerctl_prop:file { getattr open read map };
+#line 34
+
+#line 34
+
+
+#line 35
+
+#line 35
+allow vold property_socket:sock_file write;
+#line 35
+allow vold init:unix_stream_socket connectto;
+#line 35
+
+#line 35
+allow vold ctl_fuse_prop:property_service set;
+#line 35
+
+#line 35
+allow vold ctl_fuse_prop:file { getattr open read map };
+#line 35
+
+#line 35
+
+
+#line 36
+
+#line 36
+allow vold property_socket:sock_file write;
+#line 36
+allow vold init:unix_stream_socket connectto;
+#line 36
+
+#line 36
+allow vold restorecon_prop:property_service set;
+#line 36
+
+#line 36
+allow vold restorecon_prop:file { getattr open read map };
+#line 36
+
+#line 36
+
+
+#line 37
+
+#line 37
+allow vold property_socket:sock_file write;
+#line 37
+allow vold init:unix_stream_socket connectto;
+#line 37
+
+#line 37
+allow vold ota_prop:property_service set;
+#line 37
+
+#line 37
+allow vold ota_prop:file { getattr open read map };
+#line 37
+
+#line 37
+
+
+#line 38
+
+#line 38
+allow vold property_socket:sock_file write;
+#line 38
+allow vold init:unix_stream_socket connectto;
+#line 38
+
+#line 38
+allow vold boottime_prop:property_service set;
+#line 38
+
+#line 38
+allow vold boottime_prop:file { getattr open read map };
+#line 38
+
+#line 38
+
+
+#line 39
+
+#line 39
+allow vold property_socket:sock_file write;
+#line 39
+allow vold init:unix_stream_socket connectto;
+#line 39
+
+#line 39
+allow vold boottime_public_prop:property_service set;
+#line 39
+
+#line 39
+allow vold boottime_public_prop:file { getattr open read map };
+#line 39
+
+#line 39
+
+
+# Vold will use Keystore instead of using Keymint directly. But it still needs
+# to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
+allow vold vold_key:keystore2_key {
+ convert_storage_key_to_ephemeral
+ delete
+ get_info
+ manage_blob
+ rebind
+ req_forced_op
+ update
+ use
+};
+
+# vold needs to call keystore methods
+allow vold keystore:binder call;
+
+# vold needs to find keystore2 services
+allow vold keystore_service:service_manager find;
+allow vold keystore_maintenance_service:service_manager find;
+
+# vold needs to be able to call earlyBootEnded() and deleteAllKeys()
+allow vold keystore:keystore2 early_boot_ended;
+allow vold keystore:keystore2 delete_all_keys;
+
+
+#line 65
+ allow vold storage_area_app_dir:dir search;
+#line 65
+ # Allow vold to get the encryption policy and
+#line 65
+ # verify the ownership of storage areas
+#line 65
+ allow vold storage_area_dir:dir {
+#line 65
+ read
+#line 65
+ open
+#line 65
+ getattr
+#line 65
+ ioctl
+#line 65
+ };
+#line 75
+
+
+# when a storage area is created (with `openStorageArea`), vold creates the key
+# and when a storage area is deleted (with `deleteStorageArea`), vold deletes the key
+
+#line 79
+ allow vold storage_area_key_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 79
+ allow vold storage_area_key_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+#line 82
+
+
+# Allow vold to create and delete per-user directories like /data/user/$userId.
+allow vold {
+ media_userdir_file
+ system_userdir_file
+ vendor_userdir_file
+}:dir {
+ add_name
+ remove_name
+ write
+};
+
+# Read already opened /cache files.
+allow vold cache_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow vold cache_file:file { getattr read };
+allow vold cache_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+
+#line 100
+allow vold { sysfs_type -sysfs_batteryinfo }:dir { open getattr read search ioctl lock watch watch_reads };
+#line 100
+allow vold { sysfs_type -sysfs_batteryinfo }:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 100
+
+# XXX Label sysfs files with a specific type?
+allow vold {
+ sysfs # writing to /sys/*/uevent during coldboot.
+ sysfs_devices_block
+ sysfs_dm
+ sysfs_loop # writing to /sys/block/loop*/uevent during coldboot.
+ sysfs_usb
+ sysfs_zram_uevent
+ sysfs_fs_f2fs
+}:file { open append write lock map };
+
+
+#line 112
+allow vold rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 112
+allow vold rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 112
+
+
+#line 113
+allow vold metadata_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 113
+allow vold metadata_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 113
+
+allow vold {
+ proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
+ proc_bootconfig
+ proc_cmdline
+ proc_drop_caches
+ proc_filesystems
+ proc_meminfo
+ proc_mounts
+}:file { getattr open read ioctl lock map watch watch_reads };
+
+#Get file contexts
+allow vold file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow us to jump into execution domains of above tools
+allow vold self:process setexec;
+
+# For formatting adoptable storage devices
+allow vold e2fs_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Run fstrim on mounted partitions
+# allowxperm still requires the ioctl permission for the individual type
+allowxperm vold { fs_type file_type }:dir ioctl 0xc0185879;
+
+# Get/set file-based encryption policies on dirs in /data and adoptable storage,
+# and add/remove file-based encryption keys.
+allowxperm vold data_file_type:dir ioctl {
+ 0x400c6615
+ 0xc0096616
+ 0x800c6613
+ 0xc0506617
+ 0xc0406618
+ 0xc080661a
+};
+
+# Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is
+# tried first. Otherwise, FS_IOC_FIEMAP is needed to get the
+# location of the file's blocks on the raw block device to erase.
+allowxperm vold {
+ vold_data_file
+ vold_metadata_file
+ storage_area_key_file
+}:file ioctl {
+ 0xf514
+ 0xc020660b
+};
+
+typeattribute vold mlstrustedsubject;
+allow vold self:process setfscreate;
+allow vold system_file:file { getattr execute execute_no_trans map };
+allow vold vendor_file:file { getattr execute execute_no_trans map };
+allow vold block_device:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold device:dir write;
+allow vold devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold rootfs:dir mounton;
+allow vold { sdcard_type fuse }:dir mounton; # TODO: deprecated in M
+allow vold { sdcard_type fuse }:filesystem { mount remount unmount }; # TODO: deprecated in M
+
+# Manage locations where storage is mounted
+allow vold { mnt_media_rw_file storage_file sdcard_type fuse }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold { mnt_media_rw_file storage_file sdcard_type fuse }:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Access to storage that backs emulated FUSE daemons for migration optimization
+allow vold media_rw_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold media_rw_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+# Allow mounting (lower filesystem) on parts of media for performance
+allow vold media_rw_data_file:dir mounton;
+
+# Allow setting project quota IDs and enabling project ID inheritance on
+# /data/media/$userId/* and /mnt/expand/$volume/media/$userId/*
+allowxperm vold media_rw_data_file:{ dir file } ioctl {
+ 0x801c581f
+ 0x401c5820
+ 0x80086601
+ 0x40086602
+};
+
+# Allow mounting of storage devices
+allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
+
+# Manage per-user primary symlinks
+allow vold mnt_user_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow vold mnt_user_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow vold mnt_user_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Manage per-user pass_through primary symlinks
+allow vold mnt_pass_through_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow vold mnt_pass_through_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow to create and mount expanded storage
+allow vold mnt_expand_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow vold apk_data_file:dir { create getattr setattr };
+allow vold shell_data_file:dir { create getattr setattr };
+allow vold system_userdir_file:dir { create getattr setattr };
+allow vold media_userdir_file:dir { create getattr setattr open read ioctl };
+# Needed to set the casefold flag on /mnt/expand/$volume/media
+allowxperm vold media_userdir_file:dir ioctl { 0x80086601 0x40086602 };
+
+# Allow to mount incremental file system on /data/incremental and create files
+allow vold apk_data_file:dir { mounton { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+# Allow to create and write files in /data/incremental
+allow vold apk_data_file:file { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } unlink };
+# Allow to bind-mount incremental file system on /data/app/vmdl*.tmp and read files
+allow vold apk_tmp_file:dir { mounton { open getattr read search ioctl lock watch watch_reads } };
+# Allow to read incremental control file and call selinux restorecon on it
+allow vold incremental_control_file:file { { getattr open read ioctl lock map watch watch_reads } relabelto };
+
+allow vold tmpfs:filesystem { mount unmount };
+allow vold tmpfs:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold tmpfs:dir mounton;
+allow vold self:{ capability cap_userns } { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid };
+allow vold self:netlink_kobject_uevent_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow vold loop_control_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold loop_device:blk_file { create setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allowxperm vold loop_device:blk_file ioctl {
+ 0x00004c01
+ 0x00004c82
+ 0x00004c05
+ 0x00004c00
+ 0x00004c04
+};
+allow vold vold_device:blk_file { create setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allowxperm vold vold_device:blk_file ioctl { 0x00001277 0x00001260 };
+allow vold dm_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold dm_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm vold dm_device:blk_file ioctl { 0x00001277 0x0000127d 0xc0101282 0x40101283 0x0000125d 0x0000125e };
+# For vold Process::killProcessesWithOpenFiles function.
+allow vold domain:dir { open getattr read search ioctl lock watch watch_reads };
+allow vold domain:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+allow vold domain:process { signal sigkill };
+allow vold self:{ capability cap_userns } { sys_ptrace kill };
+
+allow vold kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Run fsck in the fsck domain.
+allow vold fsck_exec:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# Log fsck results
+allow vold fscklogs:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow vold fscklogs:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Mount and unmount filesystems.
+allow vold labeledfs:filesystem { mount unmount remount };
+
+# Create and mount on /data/tmp_mnt and management of expansion mounts
+#
+# Also rename per-user encrypted directories such as /data/user/10 from their
+# temporary name ("10.new") to their final name ("10").
+allow vold {
+ system_data_file
+ system_data_root_file
+}:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow vold system_data_file:lnk_file getattr;
+
+# Vold create users in /data/vendor_{ce,de}/[0-9]+
+allow vold vendor_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# for secdiscard
+allow vold system_data_file:file read;
+
+# Set scheduling policy of kernel processes
+allow vold kernel:process setsched;
+
+# ASEC
+allow vold asec_image_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow vold asec_image_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow vold asec_apk_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton relabelfrom relabelto };
+allow vold asec_public_file:dir { relabelto setattr };
+allow vold asec_apk_file:file { { getattr open read ioctl lock map watch watch_reads } setattr relabelfrom relabelto };
+allow vold asec_public_file:file { relabelto setattr };
+# restorecon files in asec containers created on 4.2 or earlier.
+allow vold unlabeled:dir { { open getattr read search ioctl lock watch watch_reads } setattr relabelfrom };
+allow vold unlabeled:file { { getattr open read ioctl lock map watch watch_reads } setattr relabelfrom };
+
+# Access to FUSE control filesystem to hard-abort FUSE mounts
+allow vold fusectlfs:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold fusectlfs:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+
+# Allow vold to use wake locks. Needed for idle maintenance and moving storage.
+
+#line 292
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+#line 292
+# deprecated.
+#line 292
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+#line 292
+allow vold sysfs_wake_lock:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 292
+# Accessing these files requires CAP_BLOCK_SUSPEND
+#line 292
+allow vold self:{ capability2 cap2_userns } block_suspend;
+#line 292
+# system_suspend permissions
+#line 292
+
+#line 292
+# Call the server domain and optionally transfer references to it.
+#line 292
+allow vold system_suspend_server:binder { call transfer };
+#line 292
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 292
+allow system_suspend_server vold:binder transfer;
+#line 292
+# Receive and use open files from the server.
+#line 292
+allow vold system_suspend_server:fd use;
+#line 292
+
+#line 292
+allow vold system_suspend_hwservice:hwservice_manager find;
+#line 292
+# halclientdomain permissions
+#line 292
+
+#line 292
+# Call the hwservicemanager and transfer references to it.
+#line 292
+allow vold hwservicemanager:binder { call transfer };
+#line 292
+# Allow hwservicemanager to send out callbacks
+#line 292
+allow hwservicemanager vold:binder { call transfer };
+#line 292
+# hwservicemanager performs getpidcon on clients.
+#line 292
+allow hwservicemanager vold:dir search;
+#line 292
+allow hwservicemanager vold:file { read open map };
+#line 292
+allow hwservicemanager vold:process getattr;
+#line 292
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 292
+# all domains in domain.te.
+#line 292
+
+#line 292
+
+#line 292
+allow vold hwservicemanager_prop:file { getattr open read map };
+#line 292
+
+#line 292
+allow vold hidl_manager_hwservice:hwservice_manager find;
+#line 292
+# AIDL suspend hal permissions
+#line 292
+allow vold hal_system_suspend_service:service_manager find;
+#line 292
+
+#line 292
+# Call the servicemanager and transfer references to it.
+#line 292
+allow vold servicemanager:binder { call transfer };
+#line 292
+# Allow servicemanager to send out callbacks
+#line 292
+allow servicemanager vold:binder { call transfer };
+#line 292
+# servicemanager performs getpidcon on clients.
+#line 292
+allow servicemanager vold:dir search;
+#line 292
+allow servicemanager vold:file { read open };
+#line 292
+allow servicemanager vold:process getattr;
+#line 292
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 292
+# all domains in domain.te.
+#line 292
+
+#line 292
+
+
+# Allow vold to make binder calls and publish binder services.
+
+#line 295
+# Call the servicemanager and transfer references to it.
+#line 295
+allow vold servicemanager:binder { call transfer };
+#line 295
+# Allow servicemanager to send out callbacks
+#line 295
+allow servicemanager vold:binder { call transfer };
+#line 295
+# servicemanager performs getpidcon on clients.
+#line 295
+allow servicemanager vold:dir search;
+#line 295
+allow servicemanager vold:file { read open };
+#line 295
+allow servicemanager vold:process getattr;
+#line 295
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 295
+# all domains in domain.te.
+#line 295
+
+
+#line 296
+ allow vold vold_service:service_manager { add find };
+#line 296
+ neverallow { domain -vold } vold_service:service_manager add;
+#line 296
+
+#line 296
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 296
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 296
+
+#line 296
+
+
+#line 297
+ allow vold fwk_vold_service:service_manager { add find };
+#line 297
+ neverallow { domain -vold } fwk_vold_service:service_manager add;
+#line 297
+
+#line 297
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 297
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 297
+
+#line 297
+
+
+# Allow vold to call into the system server so it can check permissions.
+
+#line 300
+# Call the server domain and optionally transfer references to it.
+#line 300
+allow vold system_server:binder { call transfer };
+#line 300
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 300
+allow system_server vold:binder transfer;
+#line 300
+# Receive and use open files from the server.
+#line 300
+allow vold system_server:fd use;
+#line 300
+
+allow vold permission_service:service_manager find;
+
+# talk to health storage HAL
+
+#line 304
+typeattribute vold halclientdomain;
+#line 304
+typeattribute vold hal_health_storage_client;
+#line 304
+
+#line 304
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 304
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 304
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 304
+
+#line 304
+typeattribute vold hal_health_storage;
+#line 304
+# Find passthrough HAL implementations
+#line 304
+allow hal_health_storage system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 304
+allow hal_health_storage vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 304
+allow hal_health_storage vendor_file:file { read open getattr execute map };
+#line 304
+
+#line 304
+
+
+# talk to bootloader HAL
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 307
+
+#line 307
+typeattribute vold halclientdomain;
+#line 307
+typeattribute vold hal_bootctl_client;
+#line 307
+
+#line 307
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 307
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 307
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 307
+
+#line 307
+typeattribute vold hal_bootctl;
+#line 307
+# Find passthrough HAL implementations
+#line 307
+allow hal_bootctl system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 307
+allow hal_bootctl vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 307
+allow hal_bootctl vendor_file:file { read open getattr execute map };
+#line 307
+
+#line 307
+
+#line 307
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+#line 307
+
+
+# Access userdata block device.
+allow vold userdata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm vold userdata_block_device:blk_file ioctl 0x0000127d;
+
+# Access zoned block device.
+allow vold zoned_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+
+# Access metadata block device used for encryption meta-data.
+allow vold metadata_block_device:blk_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allowxperm vold metadata_block_device:blk_file ioctl 0x0000127d;
+
+# Allow vold to manipulate /data/unencrypted
+allow vold unencrypted_data_file:{ file } { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow vold unencrypted_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# Write to /proc/sys/vm/drop_caches
+allow vold proc_drop_caches:file { open append write lock map };
+
+# Give vold a place where only vold can store files; everyone else is off limits
+allow vold vold_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold vold_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# And a similar place in the metadata partition
+allow vold vold_metadata_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow vold vold_metadata_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# linux keyring configuration
+allow vold init:key { write search setattr };
+allow vold vold:key { write search setattr };
+
+# vold temporarily changes its priority when running benchmarks
+allow vold self:{ capability cap_userns } sys_nice;
+
+# vold needs to chroot into app namespaces to remount when runtime permissions change
+allow vold self:{ capability cap_userns } sys_chroot;
+allow vold storage_file:dir mounton;
+
+# For AppFuse.
+allow vold fuse_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold fuse:filesystem { relabelfrom };
+allow vold app_fusefs:filesystem { relabelfrom relabelto };
+allow vold app_fusefs:filesystem { mount unmount };
+allow vold app_fuse_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow vold app_fuse_file:file { read write open getattr append };
+
+# MoveStorage.cpp executes cp and rm
+allow vold toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Prepare profile dir for users.
+allow vold { user_profile_data_file user_profile_root_file }:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+
+# Raw writes to misc block device
+allow vold misc_block_device:blk_file { open append write lock map };
+
+# vold might need to search or mount /mnt/vendor/*
+allow vold mnt_vendor_file:dir search;
+
+dontaudit vold self:{ capability cap_userns } sys_resource;
+
+dontaudit vold self:capability sys_rawio;
+
+# Allow ReadDefaultFstab().
+
+#line 371
+ allow vold { metadata_file gsi_metadata_file_type }:dir search;
+#line 371
+ allow vold gsi_public_metadata_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 371
+ allow vold { proc_bootconfig proc_cmdline }:file { getattr open read ioctl lock map watch watch_reads };
+#line 371
+
+
+# vold might need to search loopback apex files
+allow vold vendor_apex_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -system_server
+ -vdc
+ -vold
+ -update_verifier
+ -apexd
+ -gsid
+} vold_service:service_manager find;
+
+# Only vold should create (and delete) per-user directories like
+# /data/user/$userId. This is very important, as these directories need to be
+# encrypted with per-user keys, which only vold can do. Encryption can only be
+# set up on empty directories, so creation and encryption must happen together.
+neverallow {
+ domain
+ -vold
+} {
+ media_userdir_file
+ system_userdir_file
+ vendor_userdir_file
+}:dir {
+ add_name
+ remove_name
+ write
+};
+
+# Only vold and init should ever set file-based encryption policies.
+neverallowxperm {
+ domain
+ -vold
+ -init
+ -vendor_init
+ -vold_prepare_subdirs
+} data_file_type:dir ioctl { 0x800c6613 };
+
+# Only vold should ever add/remove file-based encryption keys.
+neverallowxperm {
+ domain
+ -vold
+} data_file_type:dir ioctl { 0xc0506617 0xc0406618 0xc080661a };
+
+neverallow {
+ domain
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:dir ~{ open create read getattr setattr search relabelfrom relabelto ioctl };
+
+neverallow {
+ domain
+ -init
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:dir *;
+
+neverallow {
+ domain
+ -init
+ -vold
+} vold_metadata_file:dir *;
+
+neverallow {
+ domain
+ -kernel
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:{ file lnk_file sock_file fifo_file } ~{ relabelto getattr };
+
+neverallow {
+ domain
+ -init
+ -vold
+ -vold_prepare_subdirs
+} vold_metadata_file:{ file lnk_file sock_file fifo_file } ~{ relabelto getattr };
+
+neverallow {
+ domain
+ -init
+ -kernel
+ -vold
+ -vold_prepare_subdirs
+} { vold_data_file vold_metadata_file }:{ file lnk_file sock_file fifo_file } *;
+
+neverallow { domain -vold -init } restorecon_prop:property_service set;
+
+neverallow vold {
+ domain
+ -hal_health_storage_server
+ -hal_keymaster_server
+ -system_suspend_server
+ -hal_bootctl_server
+ -hwservicemanager
+ -keystore
+ -servicemanager
+ -system_server
+
+}:binder call;
+
+neverallow vold fsck_exec:file execute_no_trans;
+neverallow { domain -init } vold:process { transition dyntransition };
+neverallow vold *:process ptrace;
+neverallow vold *:rawip_socket *;
+#line 1 "system/sepolicy/private/vold_prepare_subdirs.te"
+
+#line 1
+# Allow the necessary permissions.
+#line 1
+
+#line 1
+# Old domain may exec the file and transition to the new domain.
+#line 1
+allow vold vold_prepare_subdirs_exec:file { getattr open read execute map };
+#line 1
+allow vold vold_prepare_subdirs:process transition;
+#line 1
+# New domain is entered by executing the file.
+#line 1
+allow vold_prepare_subdirs vold_prepare_subdirs_exec:file { entrypoint open read execute getattr map };
+#line 1
+# New domain can send SIGCHLD to its caller.
+#line 1
+allow vold_prepare_subdirs vold:process sigchld;
+#line 1
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 1
+dontaudit vold vold_prepare_subdirs:process noatsecure;
+#line 1
+# XXX dontaudit candidate but requires further study.
+#line 1
+allow vold vold_prepare_subdirs:process { siginh rlimitinh };
+#line 1
+
+#line 1
+# Make the transition occur by default.
+#line 1
+type_transition vold vold_prepare_subdirs_exec:process vold_prepare_subdirs;
+#line 1
+
+
+typeattribute vold_prepare_subdirs coredomain;
+typeattribute vold_prepare_subdirs mlstrustedsubject;
+
+allow vold_prepare_subdirs system_file:file execute_no_trans;
+allow vold_prepare_subdirs shell_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow vold_prepare_subdirs toolbox_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow vold_prepare_subdirs devpts:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow vold_prepare_subdirs vold:fd use;
+allow vold_prepare_subdirs vold:fifo_file { read write };
+allow vold_prepare_subdirs file_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow vold_prepare_subdirs seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+allow vold_prepare_subdirs self:{ capability cap_userns } { chown dac_override dac_read_search fowner };
+allow vold_prepare_subdirs self:process setfscreate;
+allow vold_prepare_subdirs {
+ sdk_sandbox_system_data_file
+ system_data_file
+ vendor_data_file
+}:dir { open read write add_name remove_name rmdir relabelfrom };
+allow vold_prepare_subdirs {
+ apex_data_file_type
+ apex_module_data_file
+ apex_rollback_data_file
+ backup_data_file
+ checkin_data_file
+ face_vendor_data_file
+ fingerprint_vendor_data_file
+ iris_vendor_data_file
+ rollback_data_file
+ storage_area_key_file
+ storaged_data_file
+ sdk_sandbox_data_file
+ sdk_sandbox_system_data_file
+ system_data_file
+ vold_data_file
+}:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } relabelto };
+allow vold_prepare_subdirs {
+ apex_data_file_type
+ apex_art_staging_data_file
+ apex_module_data_file
+ apex_rollback_data_file
+ backup_data_file
+ checkin_data_file
+ face_vendor_data_file
+ fingerprint_vendor_data_file
+ iris_vendor_data_file
+ rollback_data_file
+ storaged_data_file
+ sdk_sandbox_data_file
+ system_data_file
+ vold_data_file
+}:file { getattr unlink };
+allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
+allow vold_prepare_subdirs mnt_expand_file:dir search;
+allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
+allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
+
+# Allow vold_prepare_subdirs to create storage area directories on behalf of apps.
+
+#line 60
+ allow vold_prepare_subdirs {
+#line 60
+ storage_area_dir
+#line 60
+ storage_area_app_dir
+#line 60
+ }:dir {
+#line 60
+ { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } }
+#line 60
+ create
+#line 60
+ setattr # for chown() and chmod()
+#line 60
+ rmdir
+#line 60
+ unlink
+#line 60
+ relabelfrom # setfilecon
+#line 60
+ relabelto # setfilecon
+#line 60
+ };
+#line 60
+
+#line 60
+ # The storage area directories should have type storage_area_dir
+#line 60
+ type_transition vold_prepare_subdirs storage_area_app_dir:dir storage_area_dir;
+#line 60
+
+#line 60
+
+#line 60
+
+#line 60
+allow vold_prepare_subdirs selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 60
+allow vold_prepare_subdirs selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 60
+
+#line 60
+allow vold_prepare_subdirs selinuxfs:file { open append write lock map };
+#line 60
+allow vold_prepare_subdirs kernel:security check_context;
+#line 60
+
+#line 60
+
+#line 60
+ allowxperm vold_prepare_subdirs storage_area_dir:dir ioctl 0x800c6613;
+#line 80
+
+
+
+#line 82
+ neverallowxperm vold_prepare_subdirs {
+#line 82
+ data_file_type
+#line 82
+ -storage_area_dir
+#line 82
+ }:dir ioctl 0x800c6613;
+#line 87
+
+
+# Migrate legacy labels to apex_system_server_data_file (b/217581286)
+allow vold_prepare_subdirs {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_tethering_data_file
+ apex_wifi_data_file
+}:dir relabelfrom;
+
+# /data/misc is unlabeled during early boot.
+allow vold_prepare_subdirs unlabeled:dir search;
+
+dontaudit vold_prepare_subdirs { proc unlabeled }:file { getattr open read ioctl lock map watch watch_reads };
+#line 1 "system/sepolicy/private/vzwomatrigger_app.te"
+###
+### A domain for further sandboxing the VzwOmaTrigger app.
+###
+type vzwomatrigger_app, domain;
+
+
+#line 6
+typeattribute vzwomatrigger_app appdomain;
+#line 6
+# Label tmpfs objects for all apps.
+#line 6
+type_transition vzwomatrigger_app tmpfs:file appdomain_tmpfs;
+#line 6
+
+#line 6
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 6
+type vzwomatrigger_app_userfaultfd;
+#line 6
+type_transition vzwomatrigger_app vzwomatrigger_app:anon_inode vzwomatrigger_app_userfaultfd "[userfaultfd]";
+#line 6
+# Allow domain to create/use userfaultfd anon_inode.
+#line 6
+allow vzwomatrigger_app vzwomatrigger_app_userfaultfd:anon_inode { create ioctl read };
+#line 6
+# Suppress errors generate during bugreport
+#line 6
+dontaudit su vzwomatrigger_app_userfaultfd:anon_inode *;
+#line 6
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 6
+neverallow { domain -vzwomatrigger_app } vzwomatrigger_app_userfaultfd:anon_inode *;
+#line 6
+
+#line 6
+allow vzwomatrigger_app appdomain_tmpfs:file { execute getattr map read write };
+#line 6
+neverallow { vzwomatrigger_app -runas_app -shell -simpleperf } { domain -vzwomatrigger_app }:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+neverallow { appdomain -runas_app -shell -simpleperf -vzwomatrigger_app } vzwomatrigger_app:file { { append create link unlink relabelfrom rename setattr write } open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads };
+#line 6
+# The Android security model guarantees the confidentiality and integrity
+#line 6
+# of application data and execution state. Ptrace bypasses those
+#line 6
+# confidentiality guarantees. Disallow ptrace access from system components to
+#line 6
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+#line 6
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+#line 6
+# simpleperf is excluded, as it operates only on debuggable or profileable
+#line 6
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+#line 6
+# live lock conditions.
+#line 6
+neverallow { domain -vzwomatrigger_app -crash_dump -runas_app -simpleperf } vzwomatrigger_app:process ptrace;
+#line 6
+
+#line 1 "system/sepolicy/private/wait_for_keymaster.te"
+# wait_for_keymaster service. No longer used;
+# here only so that downstream code compiles.
+type wait_for_keymaster, domain, coredomain;
+type wait_for_keymaster_exec, system_file_type, exec_type, file_type;
+
+#line 1 "system/sepolicy/private/watchdogd.te"
+typeattribute watchdogd coredomain;
+
+
+#line 3
+
+#line 3
+# Allow the necessary permissions.
+#line 3
+
+#line 3
+# Old domain may exec the file and transition to the new domain.
+#line 3
+allow init watchdogd_exec:file { getattr open read execute map };
+#line 3
+allow init watchdogd:process transition;
+#line 3
+# New domain is entered by executing the file.
+#line 3
+allow watchdogd watchdogd_exec:file { entrypoint open read execute getattr map };
+#line 3
+# New domain can send SIGCHLD to its caller.
+#line 3
+
+#line 3
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 3
+dontaudit init watchdogd:process noatsecure;
+#line 3
+# XXX dontaudit candidate but requires further study.
+#line 3
+allow init watchdogd:process { siginh rlimitinh };
+#line 3
+
+#line 3
+# Make the transition occur by default.
+#line 3
+type_transition init watchdogd_exec:process watchdogd;
+#line 3
+
+#line 3
+
+
+allow watchdogd watchdog_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow watchdogd kmsg_device:chr_file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+#line 1 "system/sepolicy/private/webview_zygote.te"
+# webview_zygote is an auxiliary zygote process that is used to spawn
+# isolated_app processes for rendering untrusted web content.
+
+typeattribute webview_zygote coredomain;
+
+# The webview_zygote needs to be able to transition domains.
+typeattribute webview_zygote mlstrustedsubject;
+
+# Allow access to temporary files, which is normally permitted through
+# a domain macro.
+
+#line 11
+type_transition webview_zygote tmpfs:file webview_zygote_tmpfs;
+#line 11
+allow webview_zygote webview_zygote_tmpfs:file { read write getattr map };
+#line 11
+;
+
+
+#line 13
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 13
+type webview_zygote_userfaultfd;
+#line 13
+type_transition webview_zygote webview_zygote:anon_inode webview_zygote_userfaultfd "[userfaultfd]";
+#line 13
+# Allow domain to create/use userfaultfd anon_inode.
+#line 13
+allow webview_zygote webview_zygote_userfaultfd:anon_inode { create ioctl read };
+#line 13
+# Suppress errors generate during bugreport
+#line 13
+dontaudit su webview_zygote_userfaultfd:anon_inode *;
+#line 13
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 13
+neverallow { domain -webview_zygote } webview_zygote_userfaultfd:anon_inode *;
+#line 13
+
+
+# Allow reading/executing installed binaries to enable preloading the
+# installed WebView implementation.
+allow webview_zygote apk_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow webview_zygote apk_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# Access to the WebView relro file.
+allow webview_zygote shared_relro_file:dir search;
+allow webview_zygote shared_relro_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Set the UID/GID of the process.
+allow webview_zygote self:{ capability cap_userns } { setgid setuid };
+# Drop capabilities from bounding set.
+allow webview_zygote self:{ capability cap_userns } setpcap;
+# Switch SELinux context to app domains.
+allow webview_zygote self:process setcurrent;
+allow webview_zygote isolated_app:process dyntransition;
+
+# For art.
+allow webview_zygote { apex_art_data_file dalvikcache_data_file }:dir { open getattr read search ioctl lock watch watch_reads };
+allow webview_zygote dalvikcache_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+allow webview_zygote { apex_art_data_file dalvikcache_data_file }:file { { getattr open read ioctl lock map watch watch_reads } execute };
+allow webview_zygote apex_module_data_file:dir search;
+
+# To load overlay from /apex (vendor APEXes)
+allow webview_zygote vendor_apex_metadata_file:dir search;
+
+# Allow webview_zygote to create JIT memory.
+allow webview_zygote self:process execmem;
+
+# Allow webview_zygote to stat the files that it opens. It must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow webview_zygote debugfs_trace_marker:file getattr;
+
+# Allow webview_zygote to manage the pgroup of its children.
+allow webview_zygote system_server:process getpgid;
+
+# Interaction between the webview_zygote and its children.
+allow webview_zygote isolated_app:process setpgid;
+
+# TODO (b/63631799) fix this access
+# Suppress denials to storage. Webview zygote should not be accessing.
+dontaudit webview_zygote mnt_expand_file:dir getattr;
+
+# TODO (b/72957399) remove this when webview_zygote is reparented to
+# app_process zygote
+dontaudit webview_zygote dex2oat_exec:file execute;
+
+# Get seapp_contexts
+allow webview_zygote seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# Check validity of SELinux context before use.
+
+#line 66
+
+#line 66
+allow webview_zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 66
+allow webview_zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 66
+
+#line 66
+allow webview_zygote selinuxfs:file { open append write lock map };
+#line 66
+allow webview_zygote kernel:security check_context;
+#line 66
+
+# Check SELinux permissions.
+
+#line 68
+
+#line 68
+allow webview_zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 68
+allow webview_zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 68
+
+#line 68
+allow webview_zygote selinuxfs:file { open append write lock map };
+#line 68
+allow webview_zygote kernel:security compute_av;
+#line 68
+allow webview_zygote self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 68
+
+
+# Directory listing in /system.
+allow webview_zygote system_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+# Read and inspect temporary files (like system properties) managed by zygote.
+allow webview_zygote zygote_tmpfs:file { read getattr };
+# Child of zygote.
+allow webview_zygote zygote:fd use;
+allow webview_zygote zygote:process sigchld;
+
+# Allow apps access to /vendor/overlay
+
+#line 80
+allow webview_zygote vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 80
+allow webview_zygote vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 80
+
+
+allow webview_zygote same_process_hal_file:file { execute read open getattr map };
+
+allow webview_zygote system_data_file:lnk_file { getattr open read ioctl lock map watch watch_reads };
+
+# Send unsolicited message to system_server
+
+#line 87
+allow webview_zygote system_unsolzygote_socket:sock_file write;
+#line 87
+allow webview_zygote system_server:unix_dgram_socket sendto;
+#line 87
+
+
+# Allow the webview_zygote to access the runtime feature flag properties.
+
+#line 90
+allow webview_zygote device_config_runtime_native_prop:file { getattr open read map };
+#line 90
+
+
+#line 91
+allow webview_zygote device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 91
+
+
+# Allow webview_zygote to access odsign verification status
+
+#line 94
+allow zygote odsign_prop:file { getattr open read map };
+#line 94
+
+
+# /data/resource-cache
+allow webview_zygote resourcecache_data_file:file { getattr open read ioctl lock map watch watch_reads };
+allow webview_zygote resourcecache_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+
+#####
+##### Neverallow
+#####
+
+# Only permit transition to isolated_app.
+neverallow webview_zygote { domain -isolated_app }:process dyntransition;
+
+# Only setcon() transitions, no exec() based transitions, except for crash_dump.
+neverallow webview_zygote { domain -crash_dump }:process transition;
+
+# Must not exec() a program without changing domains.
+# Having said that, exec() above is not allowed.
+neverallow webview_zygote *:file execute_no_trans;
+
+# The only way to enter this domain is for the zygote to fork a new
+# webview_zygote child.
+neverallow { domain -zygote } webview_zygote:process dyntransition;
+
+# Disallow write access to properties.
+neverallow webview_zygote property_socket:sock_file write;
+neverallow webview_zygote property_type:property_service set;
+
+# Should not have any access to app data files.
+neverallow webview_zygote app_data_file_type:file { { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } { getattr execute execute_no_trans map } } };
+
+neverallow webview_zygote {
+ service_manager_type
+ -activity_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps shouldn't be able to access the driver directly.
+neverallow webview_zygote gpu_device:chr_file { { { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } { getattr execute execute_no_trans map } } };
+
+# Do not allow webview_zygote access to /cache.
+neverallow webview_zygote cache_file:dir ~{ { open getattr read search ioctl lock watch watch_reads } };
+neverallow webview_zygote cache_file:file ~{ read getattr };
+
+# Do not allow most socket access. This is socket_class_set, excluding unix_dgram_socket,
+# unix_stream_socket, and netlink_selinux_socket.
+neverallow webview_zygote domain:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket
+ appletalk_socket netlink_route_socket netlink_tcpdiag_socket
+ netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
+ sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket
+ x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket
+ pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket
+ rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
+ xdp_socket
+} *;
+
+# Do not allow access to Bluetooth-related system properties.
+# neverallow rules for Bluetooth-related data files are listed above.
+neverallow webview_zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+#line 1 "system/sepolicy/private/wifi_mainline_supplicant.te"
+type wifi_mainline_supplicant, domain, coredomain;
+type wifi_mainline_supplicant_exec, system_file_type, exec_type, file_type;
+
+
+#line 4
+# Call the servicemanager and transfer references to it.
+#line 4
+allow wifi_mainline_supplicant servicemanager:binder { call transfer };
+#line 4
+# Allow servicemanager to send out callbacks
+#line 4
+allow servicemanager wifi_mainline_supplicant:binder { call transfer };
+#line 4
+# servicemanager performs getpidcon on clients.
+#line 4
+allow servicemanager wifi_mainline_supplicant:dir search;
+#line 4
+allow servicemanager wifi_mainline_supplicant:file { read open };
+#line 4
+allow servicemanager wifi_mainline_supplicant:process getattr;
+#line 4
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 4
+# all domains in domain.te.
+#line 4
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init wifi_mainline_supplicant_exec:file { getattr open read execute map };
+#line 5
+allow init wifi_mainline_supplicant:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow wifi_mainline_supplicant wifi_mainline_supplicant_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init wifi_mainline_supplicant:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init wifi_mainline_supplicant:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init wifi_mainline_supplicant_exec:process wifi_mainline_supplicant;
+#line 5
+
+#line 5
+
+
+#line 6
+ allow wifi_mainline_supplicant wifi_mainline_supplicant_service:service_manager { add find };
+#line 6
+ neverallow { domain -wifi_mainline_supplicant } wifi_mainline_supplicant_service:service_manager add;
+#line 6
+
+#line 6
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 6
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 6
+
+#line 6
+
+
+allow wifi_mainline_supplicant self:{ capability cap_userns } { setuid setgid net_admin net_raw };
+allow wifi_mainline_supplicant proc_net:file { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } };
+allow wifi_mainline_supplicant sysfs_net:dir search;
+
+# Allow limited access to the parent directory /data/misc/wifi/
+allow wifi_mainline_supplicant wifi_data_file:dir { getattr search };
+
+# Create temporary socket files in /data/misc/wifi/mainline_supplicant/sockets
+allow wifi_mainline_supplicant mainline_supplicant_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow wifi_mainline_supplicant mainline_supplicant_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow wifi_mainline_supplicant mainline_supplicant_data_file:sock_file { create write setattr unlink };
+
+# UDP sockets
+allow wifi_mainline_supplicant self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allowxperm wifi_mainline_supplicant self:udp_socket ioctl {
+#line 22
+{
+#line 22
+# qualcomm rmnet ioctls
+#line 22
+0x00006900 0x00006902
+#line 22
+# socket ioctls
+#line 22
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 22
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 22
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 22
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 22
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 22
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 22
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 22
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 22
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 22
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 22
+# device and protocol specific ioctls
+#line 22
+0x000089f0-0x000089ff
+#line 22
+0x000089e0-0x000089ef
+#line 22
+# Wireless extension ioctls
+#line 22
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 22
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 22
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 22
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 22
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 22
+0x00008b34 0x00008b35 0x00008b36
+#line 22
+# Dev private ioctl i.e. hardware specific ioctls
+#line 22
+0x00008be0-0x00008bff
+#line 22
+} 0x00008914 0x00008924 };
+
+# Packet sockets
+allow wifi_mainline_supplicant self:packet_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allowxperm wifi_mainline_supplicant self:packet_socket ioctl {
+#line 26
+{
+#line 26
+# Socket ioctls for gathering information about the interface
+#line 26
+0x00008906 0x00008907
+#line 26
+0x00008910 0x00008912 0x00008913 0x00008915 0x00008917 0x00008919
+#line 26
+0x0000891b 0x00008921 0x00008933 0x00008938 0x00008942
+#line 26
+# Wireless extension ioctls. Primarily get functions.
+#line 26
+0x00008b01 0x00008b05 0x00008b07 0x00008b09 0x00008b0b 0x00008b0d
+#line 26
+0x00008b0f 0x00008b11 0x00008b12 0x00008b13 0x00008b21 0x00008b23
+#line 26
+0x00008b25 0x00008b27 0x00008b29 0x00008b2d
+#line 26
+}
+#line 26
+{
+#line 26
+# qualcomm rmnet ioctls
+#line 26
+0x00006900 0x00006902
+#line 26
+# socket ioctls
+#line 26
+0x0000890b 0x0000890c 0x0000890d 0x00008911 0x00008914 0x00008916
+#line 26
+0x00008918 0x0000891a 0x0000891c 0x0000891d 0x0000891e 0x0000891f
+#line 26
+0x00008920 0x00008922 0x00008923 0x00008924 0x00008925 0x00008926
+#line 26
+0x00008927 0x00008929 0x00008930 0x00008931 0x00008932
+#line 26
+0x00008934 0x00008935 0x00008936 0x00008937 0x00008939 0x00008940 0x00008941
+#line 26
+0x00008943 0x00008946 0x00008947 0x00008948 0x00008949 0x0000894a
+#line 26
+0x0000894b 0x00008953 0x00008954 0x00008955 0x00008960 0x00008961 0x00008962 0x00008970
+#line 26
+0x00008971 0x00008980 0x00008981 0x00008982 0x00008983 0x00008990
+#line 26
+0x00008991 0x00008992 0x00008993 0x00008994
+#line 26
+0x00008995 0x000089a0 0x000089a1 0x000089a2 0x000089a3 0x000089b0
+#line 26
+# device and protocol specific ioctls
+#line 26
+0x000089f0-0x000089ff
+#line 26
+0x000089e0-0x000089ef
+#line 26
+# Wireless extension ioctls
+#line 26
+0x00008b00 0x00008b02 0x00008b04 0x00008b06 0x00008b08 0x00008b0a
+#line 26
+0x00008b0c 0x00008b0e 0x00008b10 0x00008b14 0x00008b15 0x00008b16 0x00008b17
+#line 26
+0x00008b18 0x00008b19 0x00008b1a 0x00008b1b 0x00008b1c 0x00008b1d
+#line 26
+0x00008b20 0x00008b22 0x00008b24 0x00008b26 0x00008b28 0x00008b2a
+#line 26
+0x00008b2b 0x00008b2c 0x00008b30 0x00008b31 0x00008b32 0x00008b33
+#line 26
+0x00008b34 0x00008b35 0x00008b36
+#line 26
+# Dev private ioctl i.e. hardware specific ioctls
+#line 26
+0x00008be0-0x00008bff
+#line 26
+} {
+#line 26
+ 0x00005411 0x00005451 0x00005450 0x00005401 0x00005402 0x00005403 0x00005404 0x00005413 0x00005414
+#line 26
+ 0x0000540e 0x0000540b 0x00005410 0x0000540f
+#line 26
+} };
+
+# Netlink sockets
+allow wifi_mainline_supplicant self:netlink_route_socket { bind create read write nlmsg_readpriv nlmsg_write };
+allow wifi_mainline_supplicant self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+allow wifi_mainline_supplicant self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+#line 1 "system/sepolicy/private/wificond.te"
+typeattribute wificond coredomain;
+
+
+#line 3
+
+#line 3
+allow wificond property_socket:sock_file write;
+#line 3
+allow wificond init:unix_stream_socket connectto;
+#line 3
+
+#line 3
+allow wificond wifi_hal_prop:property_service set;
+#line 3
+
+#line 3
+allow wificond wifi_hal_prop:file { getattr open read map };
+#line 3
+
+#line 3
+
+
+#line 4
+
+#line 4
+allow wificond property_socket:sock_file write;
+#line 4
+allow wificond init:unix_stream_socket connectto;
+#line 4
+
+#line 4
+allow wificond wifi_prop:property_service set;
+#line 4
+
+#line 4
+allow wificond wifi_prop:file { getattr open read map };
+#line 4
+
+#line 4
+
+
+#line 5
+
+#line 5
+allow wificond property_socket:sock_file write;
+#line 5
+allow wificond init:unix_stream_socket connectto;
+#line 5
+
+#line 5
+allow wificond ctl_default_prop:property_service set;
+#line 5
+
+#line 5
+allow wificond ctl_default_prop:file { getattr open read map };
+#line 5
+
+#line 5
+
+
+
+#line 7
+allow wificond hwservicemanager_prop:file { getattr open read map };
+#line 7
+
+
+allow wificond legacykeystore_service:service_manager find;
+
+
+#line 11
+
+#line 11
+# Allow the necessary permissions.
+#line 11
+
+#line 11
+# Old domain may exec the file and transition to the new domain.
+#line 11
+allow init wificond_exec:file { getattr open read execute map };
+#line 11
+allow init wificond:process transition;
+#line 11
+# New domain is entered by executing the file.
+#line 11
+allow wificond wificond_exec:file { entrypoint open read execute getattr map };
+#line 11
+# New domain can send SIGCHLD to its caller.
+#line 11
+
+#line 11
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 11
+dontaudit init wificond:process noatsecure;
+#line 11
+# XXX dontaudit candidate but requires further study.
+#line 11
+allow init wificond:process { siginh rlimitinh };
+#line 11
+
+#line 11
+# Make the transition occur by default.
+#line 11
+type_transition init wificond_exec:process wificond;
+#line 11
+
+#line 11
+
+
+
+#line 13
+# Call the servicemanager and transfer references to it.
+#line 13
+allow wificond servicemanager:binder { call transfer };
+#line 13
+# Allow servicemanager to send out callbacks
+#line 13
+allow servicemanager wificond:binder { call transfer };
+#line 13
+# servicemanager performs getpidcon on clients.
+#line 13
+allow servicemanager wificond:dir search;
+#line 13
+allow servicemanager wificond:file { read open };
+#line 13
+allow servicemanager wificond:process getattr;
+#line 13
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+#line 13
+# all domains in domain.te.
+#line 13
+
+
+#line 14
+# Call the server domain and optionally transfer references to it.
+#line 14
+allow wificond system_server:binder { call transfer };
+#line 14
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 14
+allow system_server wificond:binder transfer;
+#line 14
+# Receive and use open files from the server.
+#line 14
+allow wificond system_server:fd use;
+#line 14
+
+
+#line 15
+# Call the server domain and optionally transfer references to it.
+#line 15
+allow wificond keystore:binder { call transfer };
+#line 15
+# Allow the serverdomain to transfer references to the client on the reply.
+#line 15
+allow keystore wificond:binder transfer;
+#line 15
+# Receive and use open files from the server.
+#line 15
+allow wificond keystore:fd use;
+#line 15
+
+
+
+#line 17
+ allow wificond wifinl80211_service:service_manager { add find };
+#line 17
+ neverallow { domain -wificond } wifinl80211_service:service_manager add;
+#line 17
+
+#line 17
+ # On debug builds with root, allow binder services to use binder over TCP.
+#line 17
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+#line 17
+
+#line 17
+
+
+#line 18
+typeattribute wificond halclientdomain;
+#line 18
+typeattribute wificond hal_nlinterceptor_client;
+#line 18
+
+#line 18
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+#line 18
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+#line 18
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+#line 18
+
+#line 18
+typeattribute wificond hal_nlinterceptor;
+#line 18
+# Find passthrough HAL implementations
+#line 18
+allow hal_nlinterceptor system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_nlinterceptor vendor_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 18
+allow hal_nlinterceptor vendor_file:file { read open getattr execute map };
+#line 18
+
+#line 18
+
+
+# create sockets to set interfaces up and down
+allow wificond self:udp_socket { create { ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+# setting interface state up/down is a privileged ioctl
+allowxperm wificond self:udp_socket ioctl { 0x00008914 0x00008924 };
+allow wificond self:{ capability cap_userns } { net_admin net_raw };
+# allow wificond to speak to nl80211 in the kernel
+allow wificond self:netlink_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
+allow wificond self:netlink_generic_socket { create { read getattr write setattr lock append bind connect getopt setopt shutdown map } };
+
+
+#line 30
+allow wificond proc_net_type:dir { open getattr read search ioctl lock watch watch_reads };
+#line 30
+allow wificond proc_net_type:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 30
+
+
+# allow wificond to check permission for dumping logs
+allow wificond permission_service:service_manager find;
+
+# dumpstate support
+allow wificond dumpstate:fd use;
+allow wificond dumpstate:fifo_file write;
+
+#### Offer the Wifi Keystore HwBinder service ###
+
+#line 40
+# Call the hwservicemanager and transfer references to it.
+#line 40
+allow wificond hwservicemanager:binder { call transfer };
+#line 40
+# Allow hwservicemanager to send out callbacks
+#line 40
+allow hwservicemanager wificond:binder { call transfer };
+#line 40
+# hwservicemanager performs getpidcon on clients.
+#line 40
+allow hwservicemanager wificond:dir search;
+#line 40
+allow hwservicemanager wificond:file { read open map };
+#line 40
+allow hwservicemanager wificond:process getattr;
+#line 40
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+#line 40
+# all domains in domain.te.
+#line 40
+
+typeattribute wificond wifi_keystore_service_server;
+
+#line 42
+ allow wificond system_wifi_keystore_hwservice:hwservice_manager { add find };
+#line 42
+ allow wificond hidl_base_hwservice:hwservice_manager add;
+#line 42
+ neverallow { domain -wificond } system_wifi_keystore_hwservice:hwservice_manager add;
+#line 42
+
+
+# Allow keystore2 binder access to serve the HwBinder service.
+allow wificond keystore_service:service_manager find;
+allow wificond wifi_key:keystore2_key {
+ get_info
+ use
+};
+#line 1 "system/sepolicy/private/zygote.te"
+# zygote
+typeattribute zygote coredomain;
+typeattribute zygote mlstrustedsubject;
+
+
+#line 5
+
+#line 5
+# Allow the necessary permissions.
+#line 5
+
+#line 5
+# Old domain may exec the file and transition to the new domain.
+#line 5
+allow init zygote_exec:file { getattr open read execute map };
+#line 5
+allow init zygote:process transition;
+#line 5
+# New domain is entered by executing the file.
+#line 5
+allow zygote zygote_exec:file { entrypoint open read execute getattr map };
+#line 5
+# New domain can send SIGCHLD to its caller.
+#line 5
+
+#line 5
+# Enable AT_SECURE, i.e. libc secure mode.
+#line 5
+dontaudit init zygote:process noatsecure;
+#line 5
+# XXX dontaudit candidate but requires further study.
+#line 5
+allow init zygote:process { siginh rlimitinh };
+#line 5
+
+#line 5
+# Make the transition occur by default.
+#line 5
+type_transition init zygote_exec:process zygote;
+#line 5
+
+#line 5
+
+
+#line 6
+type_transition zygote tmpfs:file zygote_tmpfs;
+#line 6
+allow zygote zygote_tmpfs:file { read write getattr map };
+#line 6
+
+
+
+#line 8
+allow zygote runtime_event_log_tags_file:file { getattr open read ioctl lock map watch watch_reads };
+#line 8
+
+
+# Override DAC on files and switch uid/gid.
+allow zygote self:{ capability cap_userns } { dac_override dac_read_search setgid setuid fowner chown };
+
+# Drop capabilities from bounding set.
+allow zygote self:{ capability cap_userns } setpcap;
+
+# Switch SELinux context to app domains.
+allow zygote self:process setcurrent;
+allow zygote system_server_startup:process dyntransition;
+allow zygote appdomain:process dyntransition;
+allow zygote webview_zygote:process dyntransition;
+allow zygote app_zygote:process dyntransition;
+
+# Allow zygote to read app /proc/pid dirs (b/10455872).
+allow zygote appdomain:dir { getattr search };
+allow zygote appdomain:file { { getattr open read ioctl lock map watch watch_reads } };
+
+
+#line 27
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+#line 27
+type zygote_userfaultfd;
+#line 27
+type_transition zygote zygote:anon_inode zygote_userfaultfd "[userfaultfd]";
+#line 27
+# Allow domain to create/use userfaultfd anon_inode.
+#line 27
+allow zygote zygote_userfaultfd:anon_inode { create ioctl read };
+#line 27
+# Suppress errors generate during bugreport
+#line 27
+dontaudit su zygote_userfaultfd:anon_inode *;
+#line 27
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+#line 27
+neverallow { domain -zygote } zygote_userfaultfd:anon_inode *;
+#line 27
+
+
+# Move children into the peer process group.
+allow zygote system_server:process { getpgid setpgid };
+allow zygote appdomain:process { getpgid setpgid };
+allow zygote webview_zygote:process { getpgid setpgid };
+allow zygote app_zygote:process { getpgid setpgid };
+
+# Read system data.
+allow zygote system_data_file:dir { open getattr read search ioctl lock watch watch_reads };
+allow zygote system_data_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Get attributes of /mnt/expand, needed by cacheNonBootClasspathClassLoaders.
+allow zygote mnt_expand_file:dir getattr;
+
+# Write to /data/dalvik-cache.
+allow zygote dalvikcache_data_file:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow zygote dalvikcache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Create symlinks in /data/dalvik-cache.
+allow zygote dalvikcache_data_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Write to /data/resource-cache.
+allow zygote resourcecache_data_file:dir { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } };
+allow zygote resourcecache_data_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# For updateability, the zygote may fetch the current boot
+# classpath from the dalvik cache. Integrity of the files
+# is ensured by fsverity protection (checked in art_apex_boot_integrity).
+allow zygote dalvikcache_data_file:file execute;
+
+# Allow zygote to find files in APEX data directories.
+allow zygote apex_module_data_file:dir search;
+
+# Allow zygote to find and map files created by on device signing.
+allow zygote apex_art_data_file:dir { getattr search };
+allow zygote apex_art_data_file:file { { getattr open read ioctl lock map watch watch_reads } execute };
+
+# Mount tmpfs over various directories containing per-app directories, to hide
+# them for app data isolation. Also traverse these directories (via
+# /data_mirror) to find the allowlisted per-app directories to bind-mount in.
+allow zygote {
+ # /data/user{,_de}, /mnt/expand/$volume/user{,_de}
+ system_userdir_file
+ # /data/data
+ system_data_file
+ # /data/misc/profiles/cur
+ user_profile_root_file
+ # /data/misc/profiles/ref
+ user_profile_data_file
+ # /storage/emulated/$userId/Android/{data,obb}
+ media_rw_data_file
+ # /dev/__properties__
+ properties_device
+}:dir { mounton search };
+
+# Traverse /data_mirror to get to the above directories while their normal paths
+# are hidden, in order to bind-mount allowlisted per-app directories.
+allow zygote mirror_data_file:dir search;
+
+# List /mnt/expand to find all /mnt/expand/$volume/user{,_de} directories that
+# need to be hidden by app data isolation, and traverse /mnt/expand to get to
+# any allowlisted per-app directories within these directories.
+allow zygote mnt_expand_file:dir { open read search };
+
+# Get the inode number of app CE data directories to find them by inode number
+# when CE storage is locked. Needed for app data isolation.
+allow zygote app_data_file_type:dir getattr;
+
+# Create dirs in the app data isolation tmpfs mounts and bind mount on them.
+allow zygote tmpfs:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+
+# Create the '/data/user/0 => /data/data' symlink in the /data/user tmpfs mount
+# when setting up app data isolation.
+allow zygote tmpfs:lnk_file create;
+
+# Relabel dirs and symlinks in the app and sdk sandbox data isolation tmpfs mounts to their
+# standard labels. Note: it seems that not all dirs are actually relabeled yet,
+# but it works anyway since all domains can search tmpfs:dir.
+allow zygote tmpfs:{ dir lnk_file } relabelfrom;
+allow zygote system_userdir_file:dir relabelto;
+allow zygote system_data_file:{ dir lnk_file } relabelto;
+allow zygote sdk_sandbox_system_data_file:dir { getattr relabelto search };
+
+# Read if sdcardfs is supported
+allow zygote proc_filesystems:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow zygote to create JIT memory.
+allow zygote self:process execmem;
+allow zygote zygote_tmpfs:file execute;
+allow zygote ashmem_libcutils_device:chr_file execute;
+
+# Execute idmap and dex2oat within zygote's own domain.
+# TODO: Should either of these be transitioned to the same domain
+# used by installd or stay in-domain for zygote?
+allow zygote idmap_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+allow zygote dex2oat_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow apps access to /vendor/overlay
+
+#line 126
+allow zygote vendor_overlay_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 126
+allow zygote vendor_overlay_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 126
+
+
+# Control cgroups.
+allow zygote cgroup:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow zygote cgroup:{ file lnk_file } { { getattr open read ioctl lock map watch watch_reads } setattr };
+allow zygote cgroup_v2:dir { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } };
+allow zygote cgroup_v2:{ file lnk_file } { { getattr open read ioctl lock map watch watch_reads } setattr };
+allow zygote self:{ capability cap_userns } sys_admin;
+
+# Allow zygote to stat the files that it opens. The zygote must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow zygote pmsg_device:chr_file getattr;
+allow zygote debugfs_trace_marker:file getattr;
+
+# Get seapp_contexts
+allow zygote seapp_contexts_file:file { getattr open read ioctl lock map watch watch_reads };
+# Check validity of SELinux context before use.
+
+#line 144
+
+#line 144
+allow zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 144
+allow zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 144
+
+#line 144
+allow zygote selinuxfs:file { open append write lock map };
+#line 144
+allow zygote kernel:security check_context;
+#line 144
+
+# Check SELinux permissions.
+
+#line 146
+
+#line 146
+allow zygote selinuxfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 146
+allow zygote selinuxfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 146
+
+#line 146
+allow zygote selinuxfs:file { open append write lock map };
+#line 146
+allow zygote kernel:security compute_av;
+#line 146
+allow zygote self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+#line 146
+
+
+# Native bridge functionality requires that zygote replaces
+# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
+allow zygote proc_cpuinfo:file mounton;
+
+# Allow remounting rootfs as MS_SLAVE.
+allow zygote rootfs:dir mounton;
+allow zygote tmpfs:filesystem { mount unmount };
+allow zygote fuse:filesystem { unmount };
+allow zygote sdcardfs:filesystem { unmount };
+allow zygote labeledfs:filesystem { unmount };
+
+# Allow creating user-specific storage source if started before vold.
+allow zygote mnt_user_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow zygote mnt_user_file:lnk_file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+allow zygote mnt_user_file:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Allow mounting user-specific storage source if started before vold.
+allow zygote mnt_pass_through_file:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+
+# Allowed to mount user-specific storage into place
+allow zygote storage_file:dir { search mounton };
+
+# Allow mounting and creating files, dirs on sdcardfs.
+allow zygote { sdcard_type fuse }:dir { { create reparent rename rmdir setattr { { open getattr read search ioctl lock watch watch_reads } { open search write add_name remove_name lock } } } mounton };
+allow zygote { sdcard_type fuse }:file { { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } } };
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { { getattr open read ioctl lock map watch watch_reads } { getattr execute execute_no_trans map } };
+
+# Allow zygote to write to statsd.
+
+#line 178
+allow zygote statsdw_socket:sock_file write;
+#line 178
+allow zygote statsd:unix_dgram_socket sendto;
+#line 178
+
+
+# Root fs.
+
+#line 181
+allow zygote rootfs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 181
+allow zygote rootfs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 181
+
+
+# System file accesses.
+
+#line 184
+allow zygote system_file:dir { open getattr read search ioctl lock watch watch_reads };
+#line 184
+allow zygote system_file:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 184
+
+
+# /oem accesses.
+allow zygote oemfs:dir search;
+
+#line 193
+
+
+allow zygote ion_device:chr_file { getattr open read ioctl lock map watch watch_reads };
+allow zygote tmpfs:dir { open getattr read search ioctl lock watch watch_reads };
+
+allow zygote same_process_hal_file:file { execute read open getattr map };
+
+# Allow zygote to read build properties for attestation feature
+
+#line 201
+allow zygote build_attestation_prop:file { getattr open read map };
+#line 201
+
+
+# Allow the zygote to access storage properties to check if sdcardfs is enabled.
+
+#line 204
+allow zygote storage_config_prop:file { getattr open read map };
+#line 204
+;
+
+# Let the zygote access overlays so it can initialize the AssetManager.
+
+#line 207
+allow zygote overlay_prop:file { getattr open read map };
+#line 207
+
+
+#line 208
+allow zygote exported_overlay_prop:file { getattr open read map };
+#line 208
+
+
+# Allow the zygote to access the runtime feature flag properties.
+
+#line 211
+allow zygote device_config_runtime_native_prop:file { getattr open read map };
+#line 211
+
+
+#line 212
+allow zygote device_config_runtime_native_boot_prop:file { getattr open read map };
+#line 212
+
+
+# Allow the zygote to access window manager native boot feature flags
+# to initialize WindowManager static properties.
+
+#line 216
+allow zygote device_config_window_manager_native_boot_prop:file { getattr open read map };
+#line 216
+
+
+# ingore spurious denials
+# fsetid can be checked as a consequence of chmod when using cgroup v2 uid/pid hierarchy. This is
+# done to determine if the file should inherit setgid. In this case, setgid on the file is
+# undesirable, so suppress the denial.
+dontaudit zygote self:{ capability cap_userns } { sys_resource fsetid };
+
+# Ignore spurious denials calling access() on fuse.
+# Also ignore read and open as sdcardfs may read and open dir when app tries to access a dir that
+# doesn't exist.
+# TODO(b/151316657): avoid the denials
+dontaudit zygote media_rw_data_file:dir { read open setattr };
+
+# Allow zygote to use ashmem fds from system_server.
+allow zygote system_server:fd use;
+
+# Send unsolicited message to system_server
+
+#line 234
+allow zygote system_unsolzygote_socket:sock_file write;
+#line 234
+allow zygote system_server:unix_dgram_socket sendto;
+#line 234
+
+
+# Allow zygote to access media_variant_prop for static initialization
+
+#line 237
+allow zygote media_variant_prop:file { getattr open read map };
+#line 237
+
+
+# Allow zygote to access odsign verification status
+
+#line 240
+allow zygote odsign_prop:file { getattr open read map };
+#line 240
+
+
+# Allow zygote to read ro.control_privapp_permissions and ro.cp_system_other_odex
+
+#line 243
+allow zygote packagemanager_config_prop:file { getattr open read map };
+#line 243
+
+
+# Allow zygote to read qemu.sf.lcd_density
+
+#line 246
+allow zygote qemu_sf_lcd_density_prop:file { getattr open read map };
+#line 246
+
+
+# Allow zygote to read persist.wm.debug.* to toggle experimental window manager features in
+# preloaded classes
+
+#line 250
+allow zygote persist_wm_debug_prop:file { getattr open read map };
+#line 250
+
+
+# Allow zygote to read persist_sysui_builder_extras_prop
+# and persist_sysui_ranking_update_prop
+# to toggle experimental features in core preloaded classes
+
+#line 255
+allow zygote persist_sysui_builder_extras_prop:file { getattr open read map };
+#line 255
+
+
+#line 256
+allow zygote persist_sysui_ranking_update_prop:file { getattr open read map };
+#line 256
+
+
+# Allow zygote to read /apex/apex-info-list.xml
+allow zygote apex_info_file:file { getattr open read ioctl lock map watch watch_reads };
+
+# Allow zygote to canonicalize vendor APEX paths. This is used when zygote is checking the
+# preinstalled path of APEXes that contain runtime resource overlays for the 'android' package.
+allow zygote vendor_apex_file:dir { getattr search };
+allow zygote vendor_apex_file:file { getattr };
+allow zygote vendor_apex_metadata_file:dir { search };
+
+# Allow zygote to query for compression/features.
+
+#line 268
+allow zygote sysfs_fs_f2fs:dir { open getattr read search ioctl lock watch watch_reads };
+#line 268
+allow zygote sysfs_fs_f2fs:{ file lnk_file } { getattr open read ioctl lock map watch watch_reads };
+#line 268
+
+
+# Allow zygote to read fonts_customization.xml for preloading font files that matches device locale.
+allow zygote system_font_fallback_file:file { getattr open read ioctl lock map watch watch_reads };
+
+###
+### neverallow rules
+###
+
+# Ensure that all types assigned to app processes are included
+# in the appdomain attribute, so that all allow and neverallow rules
+# written on appdomain are applied to all app processes.
+# This is achieved by ensuring that it is impossible for zygote to
+# setcon (dyntransition) to any types other than those associated
+# with appdomain plus system_server_startup, webview_zygote and
+# app_zygote.
+neverallow zygote ~{
+ appdomain
+ system_server_startup
+ webview_zygote
+ app_zygote
+}:process dyntransition;
+
+# Zygote should never execute anything from /data except for
+# /data/dalvik-cache files or files generated during on-device
+# signing under /data/misc/apexdata/com.android.art/.
+neverallow zygote {
+ data_file_type
+ -apex_art_data_file # map PROT_EXEC
+ -dalvikcache_data_file # map PROT_EXEC
+}:file { execute execute_no_trans };
+
+# Do not allow access to Bluetooth-related system properties and files
+neverallow zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file { create rename setattr unlink { { getattr open read ioctl lock map watch watch_reads } { open append write lock map } } };
+
+# Zygote should not be able to access app private data.
+neverallow zygote app_data_file_type:dir ~getattr;
+#line 1 "system/sepolicy/private/roles_decl"
+role r;
+#line 1 "system/sepolicy/public/roles"
+role r types domain;
+#line 1 "system/sepolicy/private/users"
+user u roles { r } level s0 range s0 - s0:c0.c1023;
+#line 1 "system/sepolicy/private/initial_sid_contexts"
+sid kernel u:r:kernel:s0
+sid security u:object_r:kernel:s0
+sid unlabeled u:object_r:unlabeled:s0
+sid fs u:object_r:labeledfs:s0
+sid file u:object_r:unlabeled:s0
+sid file_labels u:object_r:unlabeled:s0
+sid init u:object_r:unlabeled:s0
+sid any_socket u:object_r:unlabeled:s0
+sid port u:object_r:port:s0
+sid netif u:object_r:netif:s0
+sid netmsg u:object_r:unlabeled:s0
+sid node u:object_r:node:s0
+sid igmp_packet u:object_r:unlabeled:s0
+sid icmp_socket u:object_r:unlabeled:s0
+sid tcp_socket u:object_r:unlabeled:s0
+sid sysctl_modprobe u:object_r:unlabeled:s0
+sid sysctl u:object_r:proc:s0
+sid sysctl_fs u:object_r:unlabeled:s0
+sid sysctl_kernel u:object_r:unlabeled:s0
+sid sysctl_net u:object_r:unlabeled:s0
+sid sysctl_net_unix u:object_r:unlabeled:s0
+sid sysctl_vm u:object_r:unlabeled:s0
+sid sysctl_dev u:object_r:unlabeled:s0
+sid kmod u:object_r:unlabeled:s0
+sid policy u:object_r:unlabeled:s0
+sid scmp_packet u:object_r:unlabeled:s0
+sid devnull u:object_r:null_device:s0
+#line 1 "system/sepolicy/private/fs_use"
+# Label inodes via getxattr.
+fs_use_xattr yaffs2 u:object_r:labeledfs:s0;
+fs_use_xattr jffs2 u:object_r:labeledfs:s0;
+fs_use_xattr ext2 u:object_r:labeledfs:s0;
+fs_use_xattr ext3 u:object_r:labeledfs:s0;
+fs_use_xattr ext4 u:object_r:labeledfs:s0;
+fs_use_xattr xfs u:object_r:labeledfs:s0;
+fs_use_xattr btrfs u:object_r:labeledfs:s0;
+fs_use_xattr f2fs u:object_r:labeledfs:s0;
+fs_use_xattr squashfs u:object_r:labeledfs:s0;
+fs_use_xattr overlay u:object_r:labeledfs:s0;
+fs_use_xattr erofs u:object_r:labeledfs:s0;
+fs_use_xattr incremental-fs u:object_r:labeledfs:s0;
+fs_use_xattr virtiofs u:object_r:labeledfs:s0;
+
+# Label inodes from task label.
+fs_use_task pipefs u:object_r:pipefs:s0;
+fs_use_task sockfs u:object_r:sockfs:s0;
+
+# Label inodes from combination of task label and fs label.
+# Define type_transition rules if you want per-domain types.
+fs_use_trans devpts u:object_r:devpts:s0;
+fs_use_trans tmpfs u:object_r:tmpfs:s0;
+fs_use_trans devtmpfs u:object_r:device:s0;
+fs_use_trans shm u:object_r:shm:s0;
+fs_use_trans mqueue u:object_r:mqueue:s0;
+
+#line 1 "system/sepolicy/private/genfs_contexts"
+# Label inodes with the fs label.
+genfscon rootfs / u:object_r:rootfs:s0
+# proc labeling can be further refined (longest matching prefix).
+genfscon proc / u:object_r:proc:s0
+genfscon proc /allocinfo u:object_r:proc_allocinfo:s0
+genfscon proc /asound u:object_r:proc_asound:s0
+genfscon proc /bootconfig u:object_r:proc_bootconfig:s0
+genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
+genfscon proc /cgroups u:object_r:proc_cgroups:s0
+genfscon proc /cmdline u:object_r:proc_cmdline:s0
+genfscon proc /config.gz u:object_r:config_gz:s0
+genfscon proc /cpu/alignment u:object_r:proc_cpu_alignment:s0
+genfscon proc /device-tree/avf u:object_r:proc_dt_avf:s0
+genfscon proc /diskstats u:object_r:proc_diskstats:s0
+genfscon proc /filesystems u:object_r:proc_filesystems:s0
+genfscon proc /interrupts u:object_r:proc_interrupts:s0
+genfscon proc /iomem u:object_r:proc_iomem:s0
+genfscon proc /kallsyms u:object_r:proc_kallsyms:s0
+genfscon proc /keys u:object_r:proc_keys:s0
+genfscon proc /kmsg u:object_r:proc_kmsg:s0
+genfscon proc /loadavg u:object_r:proc_loadavg:s0
+genfscon proc /locks u:object_r:proc_locks:s0
+genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
+genfscon proc /meminfo u:object_r:proc_meminfo:s0
+genfscon proc /misc u:object_r:proc_misc:s0
+genfscon proc /modules u:object_r:proc_modules:s0
+genfscon proc /mounts u:object_r:proc_mounts:s0
+genfscon proc /net u:object_r:proc_net:s0
+genfscon proc /net/tcp u:object_r:proc_net_tcp_udp:s0
+genfscon proc /net/udp u:object_r:proc_net_tcp_udp:s0
+genfscon proc /net/xt_qtaguid/ctrl u:object_r:proc_qtaguid_ctrl:s0
+genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
+genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
+genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
+genfscon proc /pressure/cpu u:object_r:proc_pressure_cpu:s0
+genfscon proc /pressure/io u:object_r:proc_pressure_io:s0
+genfscon proc /pressure/memory u:object_r:proc_pressure_mem:s0
+genfscon proc /slabinfo u:object_r:proc_slabinfo:s0
+genfscon proc /softirqs u:object_r:proc_timer:s0
+genfscon proc /stat u:object_r:proc_stat:s0
+genfscon proc /swaps u:object_r:proc_swaps:s0
+genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
+genfscon proc /kpageflags u:object_r:proc_kpageflags:s0
+genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
+genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
+genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
+genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
+genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
+genfscon proc /sys/kernel/bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
+genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
+genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
+genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/hung_task_ u:object_r:proc_hung_task:s0
+genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
+genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
+genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
+genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_cpu_time_max_percent u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_event_mlock_kb u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
+genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/random u:object_r:proc_random:s0
+genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
+genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_max u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_min u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_min_rt_default u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
+genfscon proc /sys/kernel/unprivileged_bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
+genfscon proc /sys/net u:object_r:proc_net:s0
+genfscon proc /sys/net/core/bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
+genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
+genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
+genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
+genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
+genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
+genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
+genfscon proc /sys/vm/watermark_boost_factor u:object_r:proc_watermark_boost_factor:s0
+genfscon proc /sys/vm/watermark_scale_factor u:object_r:proc_watermark_scale_factor:s0
+genfscon proc /sys/vm/percpu_pagelist_high_fraction u:object_r:proc_percpu_pagelist_high_fraction:s0
+genfscon proc /timer_list u:object_r:proc_timer:s0
+genfscon proc /timer_stats u:object_r:proc_timer:s0
+genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
+genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
+genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
+genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
+genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
+genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
+genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
+genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
+genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
+genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
+genfscon proc /uptime u:object_r:proc_uptime:s0
+genfscon proc /version u:object_r:proc_version:s0
+genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
+genfscon proc /vmstat u:object_r:proc_vmstat:s0
+genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
+genfscon proc /vendor_sched u:object_r:proc_vendor_sched:s0
+
+genfscon fusectl / u:object_r:fusectlfs:s0
+
+# selinuxfs booleans can be individually labeled.
+genfscon selinuxfs / u:object_r:selinuxfs:s0
+genfscon cgroup / u:object_r:cgroup:s0
+genfscon cgroup2 / u:object_r:cgroup_v2:s0
+# sysfs labels can be set by userspace.
+genfscon sysfs / u:object_r:sysfs:s0
+genfscon sysfs /devices/cs_etm u:object_r:sysfs_devices_cs_etm:s0
+genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
+genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0
+genfscon sysfs /class/extcon u:object_r:sysfs_extcon:s0
+genfscon sysfs /class/gpu u:object_r:sysfs_gpu:s0
+genfscon sysfs /class/leds u:object_r:sysfs_leds:s0
+genfscon sysfs /class/net u:object_r:sysfs_net:s0
+genfscon sysfs /class/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill1/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill3/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
+genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
+genfscon sysfs /class/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
+genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
+genfscon sysfs /devices/virtual/block/ u:object_r:sysfs_devices_block:s0
+genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0
+genfscon sysfs /devices/virtual/block/loop u:object_r:sysfs_loop:s0
+genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0
+genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0
+genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0
+genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0
+genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
+genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0
+genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
+genfscon sysfs /devices/virtual/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /firmware/acpi/tables u:object_r:sysfs_firmware_acpi_tables:s0
+genfscon sysfs /firmware/devicetree/base/avf u:object_r:sysfs_dt_avf:s0
+genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
+genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
+genfscon sysfs /fs/f2fs u:object_r:sysfs_fs_f2fs:s0
+genfscon sysfs /fs/fuse/bpf_prog_type_fuse u:object_r:sysfs_fs_fuse_bpf:s0
+genfscon sysfs /fs/fuse/features u:object_r:sysfs_fs_fuse_features:s0
+genfscon sysfs /fs/incremental-fs/features u:object_r:sysfs_fs_incfs_features:s0
+genfscon sysfs /fs/incremental-fs/instances u:object_r:sysfs_fs_incfs_metrics:s0
+genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
+genfscon sysfs /power/state u:object_r:sysfs_power:s0
+genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0
+genfscon sysfs /power/sync_on_suspend u:object_r:sysfs_sync_on_suspend:s0
+genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
+genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
+genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
+genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
+genfscon sysfs /kernel/dma_heap u:object_r:sysfs_dma_heap:s0
+genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0
+genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
+
+#line 172
+genfscon sysfs /kernel/mm/cma u:object_r:sysfs_cma:s0
+#line 174
+
+genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0
+genfscon sysfs /kernel/mm/lru_gen/enabled u:object_r:sysfs_lru_gen_enabled:s0
+genfscon sysfs /kernel/mm/pgsize_migration/enabled u:object_r:sysfs_pgsize_migration:s0
+genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
+genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
+genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
+genfscon sysfs /kernel/dmabuf/buffers u:object_r:sysfs_dmabuf_stats:s0
+genfscon sysfs /module/dm_bufio/parameters/max_age_seconds u:object_r:sysfs_dm_verity:s0
+genfscon sysfs /module/dm_verity/parameters/prefetch_cluster u:object_r:sysfs_dm_verity:s0
+genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
+genfscon sysfs /module/tcp_cubic/parameters u:object_r:sysfs_net:s0
+genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
+genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/virtual/misc/uhid u:object_r:sysfs_uhid:s0
+genfscon sysfs /kernel/vendor_sched u:object_r:sysfs_vendor_sched:s0
+genfscon sysfs /devices/uprobe u:object_r:sysfs_uprobe:s0
+
+genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0
+genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
+genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
+genfscon tracefs / u:object_r:debugfs_tracing_debug:s0
+genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0
+genfscon tracefs /trace u:object_r:debugfs_tracing:s0
+genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /hyp u:object_r:debugfs_tracing:s0
+
+genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0
+genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0
+genfscon debugfs /tracing/instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
+genfscon tracefs /instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
+genfscon debugfs /tracing/instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
+genfscon tracefs /instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
+genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0
+genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0
+genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0
+genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0
+genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0
+genfscon debugfs /tracing/printk_formats u:object_r:debugfs_tracing_printk_formats:s0
+genfscon tracefs /printk_formats u:object_r:debugfs_tracing_printk_formats:s0
+
+genfscon tracefs /events/header_page u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /synthetic_events u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /events/synthetic/rss_stat_throttled u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/synthetic/suspend_resume_minimal u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0
+genfscon tracefs /buffer_percent u:object_r:debugfs_tracing:s0
+genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/record-tgid u:object_r:debugfs_tracing:s0
+genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_wakeup_new/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_waking/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_process_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_process_free/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_pi_setprio/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_enable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_disable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/gpu_work_period/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_command/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_return/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/dma_fence/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/filemap/mm_filemap_add_to_page_cache/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/filemap/mm_filemap_delete_from_page_cache/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/rss_stat/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_grow/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_shrink/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ion/ion_stat/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/mm_event/mm_event_record/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/oom/oom_score_adj_update/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/oom/mark_victim/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_rename/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_newtask/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ftrace/print/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/gpu_mem/gpu_mem_total u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/thermal/thermal_temperature/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/thermal/cdev_update/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_pause/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/irq/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_enable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_disable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_set_rate/ u:object_r:debugfs_tracing:s0
+
+genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
+
+genfscon securityfs / u:object_r:securityfs:s0
+
+genfscon binder /binder u:object_r:binder_device:s0
+genfscon binder /hwbinder u:object_r:hwbinder_device:s0
+genfscon binder /vndbinder u:object_r:vndbinder_device:s0
+genfscon binder /binder_logs u:object_r:binderfs_logs:s0
+genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
+genfscon binder /binder_logs/stats u:object_r:binderfs_logs_stats:s0
+genfscon binder /binder_logs/transactions u:object_r:binderfs_logs_transactions:s0
+genfscon binder /binder_logs/transaction_log u:object_r:binderfs_logs_transaction_history:s0
+genfscon binder /binder_logs/failed_transaction_log u:object_r:binderfs_logs_transaction_history:s0
+genfscon binder /features u:object_r:binderfs_features:s0
+
+genfscon inotifyfs / u:object_r:inotify:s0
+genfscon vfat / u:object_r:vfat:s0
+genfscon binder / u:object_r:binderfs:s0
+genfscon exfat / u:object_r:exfat:s0
+genfscon debugfs / u:object_r:debugfs:s0
+genfscon fuse / u:object_r:fuse:s0
+genfscon fuseblk / u:object_r:fuseblk:s0
+genfscon configfs / u:object_r:configfs:s0
+genfscon sdcardfs / u:object_r:sdcardfs:s0
+genfscon esdfs / u:object_r:sdcardfs:s0
+genfscon pstore / u:object_r:pstorefs:s0
+genfscon functionfs / u:object_r:functionfs:s0
+genfscon usbfs / u:object_r:usbfs:s0
+genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
+
+genfscon bpf / u:object_r:fs_bpf:s0
+genfscon bpf /loader u:object_r:fs_bpf_loader:s0
+genfscon bpf /memevents u:object_r:fs_bpf_memevents:s0
+genfscon bpf /net_private u:object_r:fs_bpf_net_private:s0
+genfscon bpf /net_shared u:object_r:fs_bpf_net_shared:s0
+genfscon bpf /netd_readonly u:object_r:fs_bpf_netd_readonly:s0
+genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
+genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
+genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
+genfscon bpf /uprobestats u:object_r:fs_bpf_uprobestats:s0
+#line 1 "system/sepolicy/private/port_contexts"
+# portcon statements go here, e.g.
+# portcon tcp 80 u:object_r:http_port:s0
+
diff --git a/prebuilts/api/202504/202504_mapping.cil b/prebuilts/api/202504/202504_mapping.cil
new file mode 100644
index 0000000..19efdc7
--- /dev/null
+++ b/prebuilts/api/202504/202504_mapping.cil
@@ -0,0 +1,4248 @@
+(typeattributeset mediadrmserver_service_202504 (mediadrmserver_service))
+(expandtypeattribute (mediadrmserver_service_202504) true)
+(typeattribute mediadrmserver_service_202504)
+(typeattributeset sysfs_gpu_202504 (sysfs_gpu))
+(expandtypeattribute (sysfs_gpu_202504) true)
+(typeattribute sysfs_gpu_202504)
+(typeattributeset recovery_refresh_202504 (recovery_refresh))
+(expandtypeattribute (recovery_refresh_202504) true)
+(typeattribute recovery_refresh_202504)
+(typeattributeset slice_service_202504 (slice_service))
+(expandtypeattribute (slice_service_202504) true)
+(typeattribute slice_service_202504)
+(typeattributeset pdx_display_dir_202504 (pdx_display_dir))
+(expandtypeattribute (pdx_display_dir_202504) true)
+(typeattribute pdx_display_dir_202504)
+(typeattributeset vendor_service_contexts_file_202504 (vendor_service_contexts_file))
+(expandtypeattribute (vendor_service_contexts_file_202504) true)
+(typeattribute vendor_service_contexts_file_202504)
+(typeattributeset shell_test_data_file_202504 (shell_test_data_file))
+(expandtypeattribute (shell_test_data_file_202504) true)
+(typeattribute shell_test_data_file_202504)
+(typeattributeset processinfo_service_202504 (processinfo_service))
+(expandtypeattribute (processinfo_service_202504) true)
+(typeattribute processinfo_service_202504)
+(typeattributeset domain_verification_service_202504 (domain_verification_service))
+(expandtypeattribute (domain_verification_service_202504) true)
+(typeattribute domain_verification_service_202504)
+(typeattributeset sysfs_ipv4_202504 (sysfs_ipv4))
+(expandtypeattribute (sysfs_ipv4_202504) true)
+(typeattribute sysfs_ipv4_202504)
+(typeattributeset system_asan_options_file_202504 (system_asan_options_file))
+(expandtypeattribute (system_asan_options_file_202504) true)
+(typeattribute system_asan_options_file_202504)
+(typeattributeset vdc_202504 (vdc))
+(expandtypeattribute (vdc_202504) true)
+(typeattribute vdc_202504)
+(typeattributeset mediadrmserver_exec_202504 (mediadrmserver_exec))
+(expandtypeattribute (mediadrmserver_exec_202504) true)
+(typeattribute mediadrmserver_exec_202504)
+(typeattributeset proc_pressure_cpu_202504 (proc_pressure_cpu))
+(expandtypeattribute (proc_pressure_cpu_202504) true)
+(typeattribute proc_pressure_cpu_202504)
+(typeattributeset devicelock_service_202504 (devicelock_service))
+(expandtypeattribute (devicelock_service_202504) true)
+(typeattribute devicelock_service_202504)
+(typeattributeset serial_service_202504 (serial_service))
+(expandtypeattribute (serial_service_202504) true)
+(typeattribute serial_service_202504)
+(typeattributeset vendor_shell_202504 (vendor_shell))
+(expandtypeattribute (vendor_shell_202504) true)
+(typeattribute vendor_shell_202504)
+(typeattributeset system_ndebug_socket_202504 (system_ndebug_socket))
+(expandtypeattribute (system_ndebug_socket_202504) true)
+(typeattribute system_ndebug_socket_202504)
+(typeattributeset fingerprint_service_202504 (fingerprint_service))
+(expandtypeattribute (fingerprint_service_202504) true)
+(typeattribute fingerprint_service_202504)
+(typeattributeset hal_fingerprint_service_202504 (hal_fingerprint_service))
+(expandtypeattribute (hal_fingerprint_service_202504) true)
+(typeattribute hal_fingerprint_service_202504)
+(typeattributeset recovery_block_device_202504 (recovery_block_device))
+(expandtypeattribute (recovery_block_device_202504) true)
+(typeattribute recovery_block_device_202504)
+(typeattributeset drmserver_202504 (drmserver))
+(expandtypeattribute (drmserver_202504) true)
+(typeattribute drmserver_202504)
+(typeattributeset sysfs_fs_fuse_features_202504 (sysfs_fs_fuse_features))
+(expandtypeattribute (sysfs_fs_fuse_features_202504) true)
+(typeattribute sysfs_fs_fuse_features_202504)
+(typeattributeset vr_hwc_service_202504 (vr_hwc_service))
+(expandtypeattribute (vr_hwc_service_202504) true)
+(typeattribute vr_hwc_service_202504)
+(typeattributeset userdata_sysdev_202504 (userdata_sysdev))
+(expandtypeattribute (userdata_sysdev_202504) true)
+(typeattribute userdata_sysdev_202504)
+(typeattributeset bootanim_oem_file_202504 (bootanim_oem_file))
+(expandtypeattribute (bootanim_oem_file_202504) true)
+(typeattribute bootanim_oem_file_202504)
+(typeattributeset debugfs_mm_events_tracing_202504 (debugfs_mm_events_tracing))
+(expandtypeattribute (debugfs_mm_events_tracing_202504) true)
+(typeattribute debugfs_mm_events_tracing_202504)
+(typeattributeset secure_element_device_202504 (secure_element_device))
+(expandtypeattribute (secure_element_device_202504) true)
+(typeattribute secure_element_device_202504)
+(typeattributeset hal_sensors_hwservice_202504 (hal_sensors_hwservice))
+(expandtypeattribute (hal_sensors_hwservice_202504) true)
+(typeattribute hal_sensors_hwservice_202504)
+(typeattributeset evsmanagerd_202504 (evsmanagerd))
+(expandtypeattribute (evsmanagerd_202504) true)
+(typeattribute evsmanagerd_202504)
+(typeattributeset audiohal_data_file_202504 (audiohal_data_file))
+(expandtypeattribute (audiohal_data_file_202504) true)
+(typeattribute audiohal_data_file_202504)
+(typeattributeset charger_exec_202504 (charger_exec))
+(expandtypeattribute (charger_exec_202504) true)
+(typeattribute charger_exec_202504)
+(typeattributeset wifi_service_202504 (wifi_service))
+(expandtypeattribute (wifi_service_202504) true)
+(typeattribute wifi_service_202504)
+(typeattributeset legacykeystore_service_202504 (legacykeystore_service))
+(expandtypeattribute (legacykeystore_service_202504) true)
+(typeattribute legacykeystore_service_202504)
+(typeattributeset hal_can_bus_hwservice_202504 (hal_can_bus_hwservice))
+(expandtypeattribute (hal_can_bus_hwservice_202504) true)
+(typeattribute hal_can_bus_hwservice_202504)
+(typeattributeset hal_wifi_service_202504 (hal_wifi_service))
+(expandtypeattribute (hal_wifi_service_202504) true)
+(typeattribute hal_wifi_service_202504)
+(typeattributeset media_communication_service_202504 (media_communication_service))
+(expandtypeattribute (media_communication_service_202504) true)
+(typeattribute media_communication_service_202504)
+(typeattributeset proc_qtaguid_stat_202504 (proc_qtaguid_stat))
+(expandtypeattribute (proc_qtaguid_stat_202504) true)
+(typeattribute proc_qtaguid_stat_202504)
+(typeattributeset exfat_202504 (exfat))
+(expandtypeattribute (exfat_202504) true)
+(typeattribute exfat_202504)
+(typeattributeset hal_gatekeeper_service_202504 (hal_gatekeeper_service))
+(expandtypeattribute (hal_gatekeeper_service_202504) true)
+(typeattribute hal_gatekeeper_service_202504)
+(typeattributeset system_prop_202504 (system_prop))
+(expandtypeattribute (system_prop_202504) true)
+(typeattribute system_prop_202504)
+(typeattributeset vfat_202504 (vfat))
+(expandtypeattribute (vfat_202504) true)
+(typeattribute vfat_202504)
+(typeattributeset pdx_bufferhub_client_endpoint_socket_202504 (pdx_bufferhub_client_endpoint_socket))
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_202504) true)
+(typeattribute pdx_bufferhub_client_endpoint_socket_202504)
+(typeattributeset hal_confirmationui_service_202504 (hal_confirmationui_service))
+(expandtypeattribute (hal_confirmationui_service_202504) true)
+(typeattribute hal_confirmationui_service_202504)
+(typeattributeset remote_provisioning_service_202504 (remote_provisioning_service))
+(expandtypeattribute (remote_provisioning_service_202504) true)
+(typeattribute remote_provisioning_service_202504)
+(typeattributeset property_info_202504 (property_info))
+(expandtypeattribute (property_info_202504) true)
+(typeattribute property_info_202504)
+(typeattributeset keystore_exec_202504 (keystore_exec))
+(expandtypeattribute (keystore_exec_202504) true)
+(typeattribute keystore_exec_202504)
+(typeattributeset netpolicy_service_202504 (netpolicy_service))
+(expandtypeattribute (netpolicy_service_202504) true)
+(typeattribute netpolicy_service_202504)
+(typeattributeset video_device_202504 (video_device))
+(expandtypeattribute (video_device_202504) true)
+(typeattribute video_device_202504)
+(typeattributeset serialno_prop_202504 (serialno_prop))
+(expandtypeattribute (serialno_prop_202504) true)
+(typeattribute serialno_prop_202504)
+(typeattributeset midi_service_202504 (midi_service))
+(expandtypeattribute (midi_service_202504) true)
+(typeattribute midi_service_202504)
+(typeattributeset virtualizationmanager_exec_202504 (virtualizationmanager_exec))
+(expandtypeattribute (virtualizationmanager_exec_202504) true)
+(typeattribute virtualizationmanager_exec_202504)
+(typeattributeset persistent_properties_ready_prop_202504 (persistent_properties_ready_prop))
+(expandtypeattribute (persistent_properties_ready_prop_202504) true)
+(typeattribute persistent_properties_ready_prop_202504)
+(typeattributeset cold_boot_done_prop_202504 (cold_boot_done_prop))
+(expandtypeattribute (cold_boot_done_prop_202504) true)
+(typeattribute cold_boot_done_prop_202504)
+(typeattributeset file_contexts_file_202504 (file_contexts_file))
+(expandtypeattribute (file_contexts_file_202504) true)
+(typeattribute file_contexts_file_202504)
+(typeattributeset aidl_lazy_test_server_202504 (aidl_lazy_test_server))
+(expandtypeattribute (aidl_lazy_test_server_202504) true)
+(typeattribute aidl_lazy_test_server_202504)
+(typeattributeset boot_status_prop_202504 (boot_status_prop))
+(expandtypeattribute (boot_status_prop_202504) true)
+(typeattribute boot_status_prop_202504)
+(typeattributeset profiling_service_202504 (profiling_service))
+(expandtypeattribute (profiling_service_202504) true)
+(typeattribute profiling_service_202504)
+(typeattributeset aidl_lazy_test_server_exec_202504 (aidl_lazy_test_server_exec))
+(expandtypeattribute (aidl_lazy_test_server_exec_202504) true)
+(typeattribute aidl_lazy_test_server_exec_202504)
+(typeattributeset proc_diskstats_202504 (proc_diskstats))
+(expandtypeattribute (proc_diskstats_202504) true)
+(typeattribute proc_diskstats_202504)
+(typeattributeset vold_status_prop_202504 (vold_status_prop))
+(expandtypeattribute (vold_status_prop_202504) true)
+(typeattribute vold_status_prop_202504)
+(typeattributeset property_contexts_file_202504 (property_contexts_file))
+(expandtypeattribute (property_contexts_file_202504) true)
+(typeattribute property_contexts_file_202504)
+(typeattributeset firstboot_prop_202504 (firstboot_prop))
+(expandtypeattribute (firstboot_prop_202504) true)
+(typeattribute firstboot_prop_202504)
+(typeattributeset pan_result_prop_202504 (pan_result_prop))
+(expandtypeattribute (pan_result_prop_202504) true)
+(typeattribute pan_result_prop_202504)
+(typeattributeset tethering_service_202504 (tethering_service))
+(expandtypeattribute (tethering_service_202504) true)
+(typeattribute tethering_service_202504)
+(typeattributeset vts_status_prop_202504 (vts_status_prop))
+(expandtypeattribute (vts_status_prop_202504) true)
+(typeattribute vts_status_prop_202504)
+(typeattributeset system_server_tmpfs_202504 (system_server_tmpfs))
+(expandtypeattribute (system_server_tmpfs_202504) true)
+(typeattribute system_server_tmpfs_202504)
+(typeattributeset hal_authgraph_service_202504 (hal_authgraph_service))
+(expandtypeattribute (hal_authgraph_service_202504) true)
+(typeattribute hal_authgraph_service_202504)
+(typeattributeset ctl_rildaemon_prop_202504 (ctl_rildaemon_prop))
+(expandtypeattribute (ctl_rildaemon_prop_202504) true)
+(typeattribute ctl_rildaemon_prop_202504)
+(typeattributeset bluetooth_logs_data_file_202504 (bluetooth_logs_data_file))
+(expandtypeattribute (bluetooth_logs_data_file_202504) true)
+(typeattribute bluetooth_logs_data_file_202504)
+(typeattributeset hal_light_hwservice_202504 (hal_light_hwservice))
+(expandtypeattribute (hal_light_hwservice_202504) true)
+(typeattribute hal_light_hwservice_202504)
+(typeattributeset sysfs_devfreq_dir_202504 (sysfs_devfreq_dir))
+(expandtypeattribute (sysfs_devfreq_dir_202504) true)
+(typeattribute sysfs_devfreq_dir_202504)
+(typeattributeset metadata_bootstat_file_202504 (metadata_bootstat_file))
+(expandtypeattribute (metadata_bootstat_file_202504) true)
+(typeattribute metadata_bootstat_file_202504)
+(typeattributeset system_bootstrap_lib_file_202504 (system_bootstrap_lib_file))
+(expandtypeattribute (system_bootstrap_lib_file_202504) true)
+(typeattribute system_bootstrap_lib_file_202504)
+(typeattributeset rootdisk_sysdev_202504 (rootdisk_sysdev))
+(expandtypeattribute (rootdisk_sysdev_202504) true)
+(typeattribute rootdisk_sysdev_202504)
+(typeattributeset hint_service_202504 (hint_service))
+(expandtypeattribute (hint_service_202504) true)
+(typeattribute hint_service_202504)
+(typeattributeset print_service_202504 (print_service))
+(expandtypeattribute (print_service_202504) true)
+(typeattribute print_service_202504)
+(typeattributeset proc_hung_task_202504 (proc_hung_task))
+(expandtypeattribute (proc_hung_task_202504) true)
+(typeattribute proc_hung_task_202504)
+(typeattributeset same_process_hal_file_202504 (same_process_hal_file))
+(expandtypeattribute (same_process_hal_file_202504) true)
+(typeattribute same_process_hal_file_202504)
+(typeattributeset hal_vibrator_hwservice_202504 (hal_vibrator_hwservice))
+(expandtypeattribute (hal_vibrator_hwservice_202504) true)
+(typeattribute hal_vibrator_hwservice_202504)
+(typeattributeset location_service_202504 (location_service))
+(expandtypeattribute (location_service_202504) true)
+(typeattribute location_service_202504)
+(typeattributeset mediaprovider_202504 (mediaprovider))
+(expandtypeattribute (mediaprovider_202504) true)
+(typeattribute mediaprovider_202504)
+(typeattributeset device_config_runtime_native_prop_202504 (device_config_runtime_native_prop))
+(expandtypeattribute (device_config_runtime_native_prop_202504) true)
+(typeattribute device_config_runtime_native_prop_202504)
+(typeattributeset attestation_verification_service_202504 (attestation_verification_service))
+(expandtypeattribute (attestation_verification_service_202504) true)
+(typeattribute attestation_verification_service_202504)
+(typeattributeset hal_confirmationui_hwservice_202504 (hal_confirmationui_hwservice))
+(expandtypeattribute (hal_confirmationui_hwservice_202504) true)
+(typeattribute hal_confirmationui_hwservice_202504)
+(typeattributeset looper_stats_service_202504 (looper_stats_service))
+(expandtypeattribute (looper_stats_service_202504) true)
+(typeattribute looper_stats_service_202504)
+(typeattributeset runtime_service_202504 (runtime_service))
+(expandtypeattribute (runtime_service_202504) true)
+(typeattribute runtime_service_202504)
+(typeattributeset sdcard_block_device_202504 (sdcard_block_device))
+(expandtypeattribute (sdcard_block_device_202504) true)
+(typeattribute sdcard_block_device_202504)
+(typeattributeset hal_dumpstate_service_202504 (hal_dumpstate_service))
+(expandtypeattribute (hal_dumpstate_service_202504) true)
+(typeattribute hal_dumpstate_service_202504)
+(typeattributeset hal_tv_tuner_service_202504 (hal_tv_tuner_service))
+(expandtypeattribute (hal_tv_tuner_service_202504) true)
+(typeattribute hal_tv_tuner_service_202504)
+(typeattributeset init_tmpfs_202504 (init_tmpfs))
+(expandtypeattribute (init_tmpfs_202504) true)
+(typeattribute init_tmpfs_202504)
+(typeattributeset device_policy_service_202504 (device_policy_service))
+(expandtypeattribute (device_policy_service_202504) true)
+(typeattribute device_policy_service_202504)
+(typeattributeset permissionmgr_service_202504 (permissionmgr_service))
+(expandtypeattribute (permissionmgr_service_202504) true)
+(typeattribute permissionmgr_service_202504)
+(typeattributeset hal_tv_tuner_hwservice_202504 (hal_tv_tuner_hwservice))
+(expandtypeattribute (hal_tv_tuner_hwservice_202504) true)
+(typeattribute hal_tv_tuner_hwservice_202504)
+(typeattributeset autofill_service_202504 (autofill_service))
+(expandtypeattribute (autofill_service_202504) true)
+(typeattribute autofill_service_202504)
+(typeattributeset ab_update_gki_prop_202504 (ab_update_gki_prop))
+(expandtypeattribute (ab_update_gki_prop_202504) true)
+(typeattribute ab_update_gki_prop_202504)
+(typeattributeset traced_perf_202504 (traced_perf))
+(expandtypeattribute (traced_perf_202504) true)
+(typeattribute traced_perf_202504)
+(typeattributeset exported_default_prop_202504 (exported_default_prop))
+(expandtypeattribute (exported_default_prop_202504) true)
+(typeattribute exported_default_prop_202504)
+(typeattributeset sysfs_fs_f2fs_202504 (sysfs_fs_f2fs))
+(expandtypeattribute (sysfs_fs_f2fs_202504) true)
+(typeattribute sysfs_fs_f2fs_202504)
+(typeattributeset proc_swaps_202504 (proc_swaps))
+(expandtypeattribute (proc_swaps_202504) true)
+(typeattribute proc_swaps_202504)
+(typeattributeset debugfs_202504 (debugfs))
+(expandtypeattribute (debugfs_202504) true)
+(typeattribute debugfs_202504)
+(typeattributeset configfs_202504 (configfs))
+(expandtypeattribute (configfs_202504) true)
+(typeattribute configfs_202504)
+(typeattributeset gwp_asan_prop_202504 (gwp_asan_prop))
+(expandtypeattribute (gwp_asan_prop_202504) true)
+(typeattribute gwp_asan_prop_202504)
+(typeattributeset dexopt_chroot_setup_service_202504 (dexopt_chroot_setup_service))
+(expandtypeattribute (dexopt_chroot_setup_service_202504) true)
+(typeattribute dexopt_chroot_setup_service_202504)
+(typeattributeset bq_config_prop_202504 (bq_config_prop))
+(expandtypeattribute (bq_config_prop_202504) true)
+(typeattribute bq_config_prop_202504)
+(typeattributeset config_prop_202504 (config_prop))
+(expandtypeattribute (config_prop_202504) true)
+(typeattribute config_prop_202504)
+(typeattributeset ffs_config_prop_202504 (ffs_config_prop))
+(expandtypeattribute (ffs_config_prop_202504) true)
+(typeattribute ffs_config_prop_202504)
+(typeattributeset usb_config_prop_202504 (usb_config_prop))
+(expandtypeattribute (usb_config_prop_202504) true)
+(typeattribute usb_config_prop_202504)
+(typeattributeset vts_config_prop_202504 (vts_config_prop))
+(expandtypeattribute (vts_config_prop_202504) true)
+(typeattribute vts_config_prop_202504)
+(typeattributeset mediaswcodec_202504 (mediaswcodec))
+(expandtypeattribute (mediaswcodec_202504) true)
+(typeattribute mediaswcodec_202504)
+(typeattributeset adbd_config_prop_202504 (adbd_config_prop))
+(expandtypeattribute (adbd_config_prop_202504) true)
+(typeattribute adbd_config_prop_202504)
+(typeattributeset hdmi_config_prop_202504 (hdmi_config_prop))
+(expandtypeattribute (hdmi_config_prop_202504) true)
+(typeattribute hdmi_config_prop_202504)
+(typeattributeset lmkd_config_prop_202504 (lmkd_config_prop))
+(expandtypeattribute (lmkd_config_prop_202504) true)
+(typeattribute lmkd_config_prop_202504)
+(typeattributeset vold_config_prop_202504 (vold_config_prop))
+(expandtypeattribute (vold_config_prop_202504) true)
+(typeattribute vold_config_prop_202504)
+(typeattributeset wifi_config_prop_202504 (wifi_config_prop))
+(expandtypeattribute (wifi_config_prop_202504) true)
+(typeattribute wifi_config_prop_202504)
+(typeattributeset zram_config_prop_202504 (zram_config_prop))
+(expandtypeattribute (zram_config_prop_202504) true)
+(typeattribute zram_config_prop_202504)
+(typeattributeset binderfs_logs_202504 (binderfs_logs))
+(expandtypeattribute (binderfs_logs_202504) true)
+(typeattribute binderfs_logs_202504)
+(typeattributeset charger_202504 (charger))
+(expandtypeattribute (charger_202504) true)
+(typeattribute charger_202504)
+(typeattributeset service_manager_service_202504 (service_manager_service))
+(expandtypeattribute (service_manager_service_202504) true)
+(typeattribute service_manager_service_202504)
+(typeattributeset system_block_device_202504 (system_block_device))
+(expandtypeattribute (system_block_device_202504) true)
+(typeattribute system_block_device_202504)
+(typeattributeset postinstall_202504 (postinstall))
+(expandtypeattribute (postinstall_202504) true)
+(typeattribute postinstall_202504)
+(typeattributeset updatelock_service_202504 (updatelock_service))
+(expandtypeattribute (updatelock_service_202504) true)
+(typeattribute updatelock_service_202504)
+(typeattributeset server_configurable_flags_data_file_202504 (server_configurable_flags_data_file))
+(expandtypeattribute (server_configurable_flags_data_file_202504) true)
+(typeattribute server_configurable_flags_data_file_202504)
+(typeattributeset apk_data_file_202504 (apk_data_file))
+(expandtypeattribute (apk_data_file_202504) true)
+(typeattribute apk_data_file_202504)
+(typeattributeset hidl_base_hwservice_202504 (hidl_base_hwservice))
+(expandtypeattribute (hidl_base_hwservice_202504) true)
+(typeattribute hidl_base_hwservice_202504)
+(typeattributeset vendor_modprobe_202504 (vendor_modprobe))
+(expandtypeattribute (vendor_modprobe_202504) true)
+(typeattribute vendor_modprobe_202504)
+(typeattributeset system_app_202504 (system_app))
+(expandtypeattribute (system_app_202504) true)
+(typeattribute system_app_202504)
+(typeattributeset uri_grants_service_202504 (uri_grants_service))
+(expandtypeattribute (uri_grants_service_202504) true)
+(typeattribute uri_grants_service_202504)
+(typeattributeset proc_qtaguid_ctrl_202504 (proc_qtaguid_ctrl))
+(expandtypeattribute (proc_qtaguid_ctrl_202504) true)
+(typeattribute proc_qtaguid_ctrl_202504)
+(typeattributeset hal_fastboot_service_202504 (hal_fastboot_service))
+(expandtypeattribute (hal_fastboot_service_202504) true)
+(typeattribute hal_fastboot_service_202504)
+(typeattributeset hidl_manager_hwservice_202504 (hidl_manager_hwservice))
+(expandtypeattribute (hidl_manager_hwservice_202504) true)
+(typeattribute hidl_manager_hwservice_202504)
+(typeattributeset hidl_memory_hwservice_202504 (hidl_memory_hwservice))
+(expandtypeattribute (hidl_memory_hwservice_202504) true)
+(typeattribute hidl_memory_hwservice_202504)
+(typeattributeset archive_service_202504 (archive_service))
+(expandtypeattribute (archive_service_202504) true)
+(typeattribute archive_service_202504)
+(typeattributeset preloads_media_file_202504 (preloads_media_file))
+(expandtypeattribute (preloads_media_file_202504) true)
+(typeattribute preloads_media_file_202504)
+(typeattributeset surfaceflinger_202504 (surfaceflinger))
+(expandtypeattribute (surfaceflinger_202504) true)
+(typeattribute surfaceflinger_202504)
+(typeattributeset pdx_display_screenshot_channel_socket_202504 (pdx_display_screenshot_channel_socket))
+(expandtypeattribute (pdx_display_screenshot_channel_socket_202504) true)
+(typeattribute pdx_display_screenshot_channel_socket_202504)
+(typeattributeset debugfs_tracing_instances_202504 (debugfs_tracing_instances))
+(expandtypeattribute (debugfs_tracing_instances_202504) true)
+(typeattribute debugfs_tracing_instances_202504)
+(typeattributeset hal_contexthub_hwservice_202504 (hal_contexthub_hwservice))
+(expandtypeattribute (hal_contexthub_hwservice_202504) true)
+(typeattribute hal_contexthub_hwservice_202504)
+(typeattributeset hal_ivn_service_202504 (hal_ivn_service))
+(expandtypeattribute (hal_ivn_service_202504) true)
+(typeattribute hal_ivn_service_202504)
+(typeattributeset blob_store_service_202504 (blob_store_service))
+(expandtypeattribute (blob_store_service_202504) true)
+(typeattribute blob_store_service_202504)
+(typeattributeset persist_vendor_debug_wifi_prop_202504 (persist_vendor_debug_wifi_prop))
+(expandtypeattribute (persist_vendor_debug_wifi_prop_202504) true)
+(typeattribute persist_vendor_debug_wifi_prop_202504)
+(typeattributeset proc_slabinfo_202504 (proc_slabinfo))
+(expandtypeattribute (proc_slabinfo_202504) true)
+(typeattribute proc_slabinfo_202504)
+(typeattributeset proc_zoneinfo_202504 (proc_zoneinfo))
+(expandtypeattribute (proc_zoneinfo_202504) true)
+(typeattribute proc_zoneinfo_202504)
+(typeattributeset proc_tty_drivers_202504 (proc_tty_drivers))
+(expandtypeattribute (proc_tty_drivers_202504) true)
+(typeattribute proc_tty_drivers_202504)
+(typeattributeset mock_ota_prop_202504 (mock_ota_prop))
+(expandtypeattribute (mock_ota_prop_202504) true)
+(typeattribute mock_ota_prop_202504)
+(typeattributeset mnt_pass_through_file_202504 (mnt_pass_through_file))
+(expandtypeattribute (mnt_pass_through_file_202504) true)
+(typeattribute mnt_pass_through_file_202504)
+(typeattributeset tuner_config_prop_202504 (tuner_config_prop))
+(expandtypeattribute (tuner_config_prop_202504) true)
+(typeattribute tuner_config_prop_202504)
+(typeattributeset sec_key_att_app_id_provider_service_202504 (sec_key_att_app_id_provider_service))
+(expandtypeattribute (sec_key_att_app_id_provider_service_202504) true)
+(typeattribute sec_key_att_app_id_provider_service_202504)
+(typeattributeset activity_service_202504 (activity_service))
+(expandtypeattribute (activity_service_202504) true)
+(typeattribute activity_service_202504)
+(typeattributeset media_config_prop_202504 (media_config_prop))
+(expandtypeattribute (media_config_prop_202504) true)
+(typeattribute media_config_prop_202504)
+(typeattributeset mediaextractor_exec_202504 (mediaextractor_exec))
+(expandtypeattribute (mediaextractor_exec_202504) true)
+(typeattribute mediaextractor_exec_202504)
+(typeattributeset virtual_camera_202504 (virtual_camera))
+(expandtypeattribute (virtual_camera_202504) true)
+(typeattribute virtual_camera_202504)
+(typeattributeset fwk_automotive_display_hwservice_202504 (fwk_automotive_display_hwservice))
+(expandtypeattribute (fwk_automotive_display_hwservice_202504) true)
+(typeattribute fwk_automotive_display_hwservice_202504)
+(typeattributeset tombstoned_java_trace_socket_202504 (tombstoned_java_trace_socket))
+(expandtypeattribute (tombstoned_java_trace_socket_202504) true)
+(typeattribute tombstoned_java_trace_socket_202504)
+(typeattributeset watchdog_device_202504 (watchdog_device))
+(expandtypeattribute (watchdog_device_202504) true)
+(typeattribute watchdog_device_202504)
+(typeattributeset build_config_prop_202504 (build_config_prop))
+(expandtypeattribute (build_config_prop_202504) true)
+(typeattribute build_config_prop_202504)
+(typeattributeset apexd_config_prop_202504 (apexd_config_prop))
+(expandtypeattribute (apexd_config_prop_202504) true)
+(typeattribute apexd_config_prop_202504)
+(typeattributeset audio_config_prop_202504 (audio_config_prop))
+(expandtypeattribute (audio_config_prop_202504) true)
+(typeattribute audio_config_prop_202504)
+(typeattributeset provisioned_prop_202504 (provisioned_prop))
+(expandtypeattribute (provisioned_prop_202504) true)
+(typeattribute provisioned_prop_202504)
+(typeattributeset task_profiles_file_202504 (task_profiles_file))
+(expandtypeattribute (task_profiles_file_202504) true)
+(typeattribute task_profiles_file_202504)
+(typeattributeset hypervisor_prop_202504 (hypervisor_prop))
+(expandtypeattribute (hypervisor_prop_202504) true)
+(typeattribute hypervisor_prop_202504)
+(typeattributeset composd_vm_art_prop_202504 (composd_vm_art_prop))
+(expandtypeattribute (composd_vm_art_prop_202504) true)
+(typeattribute composd_vm_art_prop_202504)
+(typeattributeset graphics_device_202504 (graphics_device))
+(expandtypeattribute (graphics_device_202504) true)
+(typeattribute graphics_device_202504)
+(typeattributeset hal_tv_hdmi_connection_service_202504 (hal_tv_hdmi_connection_service))
+(expandtypeattribute (hal_tv_hdmi_connection_service_202504) true)
+(typeattribute hal_tv_hdmi_connection_service_202504)
+(typeattributeset method_trace_data_file_202504 (method_trace_data_file))
+(expandtypeattribute (method_trace_data_file_202504) true)
+(typeattribute method_trace_data_file_202504)
+(typeattributeset vndservicemanager_202504 (vndservicemanager))
+(expandtypeattribute (vndservicemanager_202504) true)
+(typeattribute vndservicemanager_202504)
+(typeattributeset tombstone_wifi_data_file_202504 (tombstone_wifi_data_file))
+(expandtypeattribute (tombstone_wifi_data_file_202504) true)
+(typeattribute tombstone_wifi_data_file_202504)
+(typeattributeset apk_private_data_file_202504 (apk_private_data_file))
+(expandtypeattribute (apk_private_data_file_202504) true)
+(typeattribute apk_private_data_file_202504)
+(typeattributeset vold_prepare_subdirs_202504 (vold_prepare_subdirs))
+(expandtypeattribute (vold_prepare_subdirs_202504) true)
+(typeattribute vold_prepare_subdirs_202504)
+(typeattributeset binder_cache_bluetooth_server_prop_202504 (binder_cache_bluetooth_server_prop))
+(expandtypeattribute (binder_cache_bluetooth_server_prop_202504) true)
+(typeattribute binder_cache_bluetooth_server_prop_202504)
+(typeattributeset hwservicemanager_202504 (hwservicemanager))
+(expandtypeattribute (hwservicemanager_202504) true)
+(typeattribute hwservicemanager_202504)
+(typeattributeset keychord_device_202504 (keychord_device))
+(expandtypeattribute (keychord_device_202504) true)
+(typeattribute keychord_device_202504)
+(typeattributeset secure_element_202504 (secure_element))
+(expandtypeattribute (secure_element_202504) true)
+(typeattribute secure_element_202504)
+(typeattributeset hal_graphics_composer_hwservice_202504 (hal_graphics_composer_hwservice))
+(expandtypeattribute (hal_graphics_composer_hwservice_202504) true)
+(typeattribute hal_graphics_composer_hwservice_202504)
+(typeattributeset servicemanager_202504 (servicemanager))
+(expandtypeattribute (servicemanager_202504) true)
+(typeattribute servicemanager_202504)
+(typeattributeset apexd_select_prop_202504 (apexd_select_prop))
+(expandtypeattribute (apexd_select_prop_202504) true)
+(typeattribute apexd_select_prop_202504)
+(typeattributeset ashmem_device_202504 (ashmem_device))
+(expandtypeattribute (ashmem_device_202504) true)
+(typeattribute ashmem_device_202504)
+(typeattributeset virtual_touchpad_202504 (virtual_touchpad))
+(expandtypeattribute (virtual_touchpad_202504) true)
+(typeattribute virtual_touchpad_202504)
+(typeattributeset hal_telephony_hwservice_202504 (hal_telephony_hwservice))
+(expandtypeattribute (hal_telephony_hwservice_202504) true)
+(typeattribute hal_telephony_hwservice_202504)
+(typeattributeset fingerprint_prop_202504 (fingerprint_prop))
+(expandtypeattribute (fingerprint_prop_202504) true)
+(typeattribute fingerprint_prop_202504)
+(typeattributeset flags_health_check_exec_202504 (flags_health_check_exec))
+(expandtypeattribute (flags_health_check_exec_202504) true)
+(typeattribute flags_health_check_exec_202504)
+(typeattributeset file_integrity_service_202504 (file_integrity_service))
+(expandtypeattribute (file_integrity_service_202504) true)
+(typeattribute file_integrity_service_202504)
+(typeattributeset sysfs_dma_heap_202504 (sysfs_dma_heap))
+(expandtypeattribute (sysfs_dma_heap_202504) true)
+(typeattribute sysfs_dma_heap_202504)
+(typeattributeset zoned_block_device_202504 (zoned_block_device))
+(expandtypeattribute (zoned_block_device_202504) true)
+(typeattribute zoned_block_device_202504)
+(typeattributeset proc_stat_202504 (proc_stat))
+(expandtypeattribute (proc_stat_202504) true)
+(typeattribute proc_stat_202504)
+(typeattributeset rootfs_202504 (rootfs))
+(expandtypeattribute (rootfs_202504) true)
+(typeattribute rootfs_202504)
+(typeattributeset cameraserver_tmpfs_202504 (cameraserver_tmpfs))
+(expandtypeattribute (cameraserver_tmpfs_202504) true)
+(typeattribute cameraserver_tmpfs_202504)
+(typeattributeset sdcardfs_202504 (sdcardfs))
+(expandtypeattribute (sdcardfs_202504) true)
+(typeattribute sdcardfs_202504)
+(typeattributeset hal_authsecret_service_202504 (hal_authsecret_service))
+(expandtypeattribute (hal_authsecret_service_202504) true)
+(typeattribute hal_authsecret_service_202504)
+(typeattributeset exported_overlay_prop_202504 (exported_overlay_prop))
+(expandtypeattribute (exported_overlay_prop_202504) true)
+(typeattribute exported_overlay_prop_202504)
+(typeattributeset netd_202504 (netd))
+(expandtypeattribute (netd_202504) true)
+(typeattribute netd_202504)
+(typeattributeset authorization_service_202504 (authorization_service))
+(expandtypeattribute (authorization_service_202504) true)
+(typeattribute authorization_service_202504)
+(typeattributeset sysfs_usb_202504 (sysfs_usb))
+(expandtypeattribute (sysfs_usb_202504) true)
+(typeattribute sysfs_usb_202504)
+(typeattributeset qemu_sf_lcd_density_prop_202504 (qemu_sf_lcd_density_prop))
+(expandtypeattribute (qemu_sf_lcd_density_prop_202504) true)
+(typeattribute qemu_sf_lcd_density_prop_202504)
+(typeattributeset hal_nlinterceptor_service_202504 (hal_nlinterceptor_service))
+(expandtypeattribute (hal_nlinterceptor_service_202504) true)
+(typeattribute hal_nlinterceptor_service_202504)
+(typeattributeset proc_perf_202504 (proc_perf))
+(expandtypeattribute (proc_perf_202504) true)
+(typeattribute proc_perf_202504)
+(typeattributeset system_server_dumper_service_202504 (system_server_dumper_service))
+(expandtypeattribute (system_server_dumper_service_202504) true)
+(typeattribute system_server_dumper_service_202504)
+(typeattributeset mqueue_202504 (mqueue))
+(expandtypeattribute (mqueue_202504) true)
+(typeattribute mqueue_202504)
+(typeattributeset tee_202504 (tee))
+(expandtypeattribute (tee_202504) true)
+(typeattribute tee_202504)
+(typeattributeset apex_data_file_202504 (apex_data_file))
+(expandtypeattribute (apex_data_file_202504) true)
+(typeattribute apex_data_file_202504)
+(typeattributeset mediadrm_config_prop_202504 (mediadrm_config_prop))
+(expandtypeattribute (mediadrm_config_prop_202504) true)
+(typeattribute mediadrm_config_prop_202504)
+(typeattributeset apex_info_file_202504 (apex_info_file))
+(expandtypeattribute (apex_info_file_202504) true)
+(typeattribute apex_info_file_202504)
+(typeattributeset bluetooth_config_prop_202504 (bluetooth_config_prop))
+(expandtypeattribute (bluetooth_config_prop_202504) true)
+(typeattribute bluetooth_config_prop_202504)
+(typeattributeset device_config_activity_manager_native_boot_prop_202504 (device_config_activity_manager_native_boot_prop))
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_202504) true)
+(typeattribute device_config_activity_manager_native_boot_prop_202504)
+(typeattributeset media_session_service_202504 (media_session_service))
+(expandtypeattribute (media_session_service_202504) true)
+(typeattribute media_session_service_202504)
+(typeattributeset composd_vm_vendor_prop_202504 (composd_vm_vendor_prop))
+(expandtypeattribute (composd_vm_vendor_prop_202504) true)
+(typeattribute composd_vm_vendor_prop_202504)
+(typeattributeset hal_mediaquality_service_202504 (hal_mediaquality_service))
+(expandtypeattribute (hal_mediaquality_service_202504) true)
+(typeattribute hal_mediaquality_service_202504)
+(typeattributeset recovery_config_prop_202504 (recovery_config_prop))
+(expandtypeattribute (recovery_config_prop_202504) true)
+(typeattribute recovery_config_prop_202504)
+(typeattributeset hal_graphics_allocator_service_202504 (hal_graphics_allocator_service))
+(expandtypeattribute (hal_graphics_allocator_service_202504) true)
+(typeattribute hal_graphics_allocator_service_202504)
+(typeattributeset adbd_202504 (adbd))
+(expandtypeattribute (adbd_202504) true)
+(typeattribute adbd_202504)
+(typeattributeset bpfloader_202504 (bpfloader))
+(expandtypeattribute (bpfloader_202504) true)
+(typeattribute bpfloader_202504)
+(typeattributeset vendor_public_lib_file_202504 (vendor_public_lib_file))
+(expandtypeattribute (vendor_public_lib_file_202504) true)
+(typeattribute vendor_public_lib_file_202504)
+(typeattributeset proc_dirty_202504 (proc_dirty))
+(expandtypeattribute (proc_dirty_202504) true)
+(typeattribute proc_dirty_202504)
+(typeattributeset vendor_cgroup_desc_file_202504 (vendor_cgroup_desc_file))
+(expandtypeattribute (vendor_cgroup_desc_file_202504) true)
+(typeattribute vendor_cgroup_desc_file_202504)
+(typeattributeset sysfs_fs_ext4_features_202504 (sysfs_fs_ext4_features))
+(expandtypeattribute (sysfs_fs_ext4_features_202504) true)
+(typeattribute sysfs_fs_ext4_features_202504)
+(typeattributeset dropbox_data_file_202504 (dropbox_data_file))
+(expandtypeattribute (dropbox_data_file_202504) true)
+(typeattribute dropbox_data_file_202504)
+(typeattributeset textclassifier_data_file_202504 (textclassifier_data_file))
+(expandtypeattribute (textclassifier_data_file_202504) true)
+(typeattribute textclassifier_data_file_202504)
+(typeattributeset fuse_202504 (fuse))
+(expandtypeattribute (fuse_202504) true)
+(typeattribute fuse_202504)
+(typeattributeset fwk_automotive_display_service_202504 (fwk_automotive_display_service))
+(expandtypeattribute (fwk_automotive_display_service_202504) true)
+(typeattribute fwk_automotive_display_service_202504)
+(typeattributeset recovery_202504 (recovery))
+(expandtypeattribute (recovery_202504) true)
+(typeattribute recovery_202504)
+(typeattributeset timedetector_service_202504 (timedetector_service))
+(expandtypeattribute (timedetector_service_202504) true)
+(typeattribute timedetector_service_202504)
+(typeattributeset bootstat_202504 (bootstat))
+(expandtypeattribute (bootstat_202504) true)
+(typeattribute bootstat_202504)
+(typeattributeset pm_archiving_enabled_prop_202504 (pm_archiving_enabled_prop))
+(expandtypeattribute (pm_archiving_enabled_prop_202504) true)
+(typeattribute pm_archiving_enabled_prop_202504)
+(typeattributeset traced_tmpfs_202504 (traced_tmpfs))
+(expandtypeattribute (traced_tmpfs_202504) true)
+(typeattribute traced_tmpfs_202504)
+(typeattributeset sensitive_content_protection_service_202504 (sensitive_content_protection_service))
+(expandtypeattribute (sensitive_content_protection_service_202504) true)
+(typeattribute sensitive_content_protection_service_202504)
+(typeattributeset labeledfs_202504 (labeledfs))
+(expandtypeattribute (labeledfs_202504) true)
+(typeattribute labeledfs_202504)
+(typeattributeset mediaextractor_tmpfs_202504 (mediaextractor_tmpfs))
+(expandtypeattribute (mediaextractor_tmpfs_202504) true)
+(typeattribute mediaextractor_tmpfs_202504)
+(typeattributeset grammatical_inflection_service_202504 (grammatical_inflection_service))
+(expandtypeattribute (grammatical_inflection_service_202504) true)
+(typeattribute grammatical_inflection_service_202504)
+(typeattributeset super_block_device_202504 (super_block_device))
+(expandtypeattribute (super_block_device_202504) true)
+(typeattribute super_block_device_202504)
+(typeattributeset proc_loadavg_202504 (proc_loadavg))
+(expandtypeattribute (proc_loadavg_202504) true)
+(typeattribute proc_loadavg_202504)
+(typeattributeset system_security_cacerts_file_202504 (system_security_cacerts_file))
+(expandtypeattribute (system_security_cacerts_file_202504) true)
+(typeattribute system_security_cacerts_file_202504)
+(typeattributeset proc_keys_202504 (proc_keys))
+(expandtypeattribute (proc_keys_202504) true)
+(typeattribute proc_keys_202504)
+(typeattributeset pdx_bufferhub_dir_202504 (pdx_bufferhub_dir))
+(expandtypeattribute (pdx_bufferhub_dir_202504) true)
+(typeattribute pdx_bufferhub_dir_202504)
+(typeattributeset usermodehelper_202504 (usermodehelper))
+(expandtypeattribute (usermodehelper_202504) true)
+(typeattribute usermodehelper_202504)
+(typeattributeset hal_health_service_202504 (hal_health_service))
+(expandtypeattribute (hal_health_service_202504) true)
+(typeattribute hal_health_service_202504)
+(typeattributeset mediaextractor_service_202504 (mediaextractor_service))
+(expandtypeattribute (mediaextractor_service_202504) true)
+(typeattribute mediaextractor_service_202504)
+(typeattributeset debug_prop_202504 (debug_prop))
+(expandtypeattribute (debug_prop_202504) true)
+(typeattribute debug_prop_202504)
+(typeattributeset hal_omx_hwservice_202504 (hal_omx_hwservice))
+(expandtypeattribute (hal_omx_hwservice_202504) true)
+(typeattribute hal_omx_hwservice_202504)
+(typeattributeset incremental_service_202504 (incremental_service))
+(expandtypeattribute (incremental_service_202504) true)
+(typeattribute incremental_service_202504)
+(typeattributeset bluetooth_audio_hal_prop_202504 (bluetooth_audio_hal_prop))
+(expandtypeattribute (bluetooth_audio_hal_prop_202504) true)
+(typeattribute bluetooth_audio_hal_prop_202504)
+(typeattributeset permissive_mte_prop_202504 (permissive_mte_prop))
+(expandtypeattribute (permissive_mte_prop_202504) true)
+(typeattribute permissive_mte_prop_202504)
+(typeattributeset lpdumpd_prop_202504 (lpdumpd_prop))
+(expandtypeattribute (lpdumpd_prop_202504) true)
+(typeattribute lpdumpd_prop_202504)
+(typeattributeset proc_locks_202504 (proc_locks))
+(expandtypeattribute (proc_locks_202504) true)
+(typeattribute proc_locks_202504)
+(typeattributeset update_engine_service_202504 (update_engine_service))
+(expandtypeattribute (update_engine_service_202504) true)
+(typeattribute update_engine_service_202504)
+(typeattributeset test_harness_prop_202504 (test_harness_prop))
+(expandtypeattribute (test_harness_prop_202504) true)
+(typeattribute test_harness_prop_202504)
+(typeattributeset lock_settings_service_202504 (lock_settings_service))
+(expandtypeattribute (lock_settings_service_202504) true)
+(typeattribute lock_settings_service_202504)
+(typeattributeset systemsound_config_prop_202504 (systemsound_config_prop))
+(expandtypeattribute (systemsound_config_prop_202504) true)
+(typeattribute systemsound_config_prop_202504)
+(typeattributeset ctl_interface_restart_prop_202504 (ctl_interface_restart_prop))
+(expandtypeattribute (ctl_interface_restart_prop_202504) true)
+(typeattribute ctl_interface_restart_prop_202504)
+(typeattributeset staged_install_file_202504 (staged_install_file))
+(expandtypeattribute (staged_install_file_202504) true)
+(typeattribute staged_install_file_202504)
+(typeattributeset cpu_variant_prop_202504 (cpu_variant_prop))
+(expandtypeattribute (cpu_variant_prop_202504) true)
+(typeattribute cpu_variant_prop_202504)
+(typeattributeset cameraproxy_service_202504 (cameraproxy_service))
+(expandtypeattribute (cameraproxy_service_202504) true)
+(typeattribute cameraproxy_service_202504)
+(typeattributeset build_prop_202504 (build_prop))
+(expandtypeattribute (build_prop_202504) true)
+(typeattribute build_prop_202504)
+(typeattributeset hal_remotelyprovisionedcomponent_avf_service_202504 (hal_remotelyprovisionedcomponent_avf_service))
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf_service_202504) true)
+(typeattribute hal_remotelyprovisionedcomponent_avf_service_202504)
+(typeattributeset audio_prop_202504 (audio_prop))
+(expandtypeattribute (audio_prop_202504) true)
+(typeattribute audio_prop_202504)
+(typeattributeset apexd_202504 (apexd))
+(expandtypeattribute (apexd_202504) true)
+(typeattribute apexd_202504)
+(typeattributeset healthd_202504 (healthd))
+(expandtypeattribute (healthd_202504) true)
+(typeattribute healthd_202504)
+(typeattributeset keychain_data_file_202504 (keychain_data_file))
+(expandtypeattribute (keychain_data_file_202504) true)
+(typeattribute keychain_data_file_202504)
+(typeattributeset apexd_prop_202504 (apexd_prop))
+(expandtypeattribute (apexd_prop_202504) true)
+(typeattribute apexd_prop_202504)
+(typeattributeset media_metrics_service_202504 (media_metrics_service))
+(expandtypeattribute (media_metrics_service_202504) true)
+(typeattribute media_metrics_service_202504)
+(typeattributeset kmsg_device_202504 (kmsg_device))
+(expandtypeattribute (kmsg_device_202504) true)
+(typeattribute kmsg_device_202504)
+(typeattributeset netif_202504 (netif))
+(expandtypeattribute (netif_202504) true)
+(typeattribute netif_202504)
+(typeattributeset webview_zygote_exec_202504 (webview_zygote_exec))
+(expandtypeattribute (webview_zygote_exec_202504) true)
+(typeattribute webview_zygote_exec_202504)
+(typeattributeset hal_tetheroffload_hwservice_202504 (hal_tetheroffload_hwservice))
+(expandtypeattribute (hal_tetheroffload_hwservice_202504) true)
+(typeattribute hal_tetheroffload_hwservice_202504)
+(typeattributeset proc_watermark_scale_factor_202504 (proc_watermark_scale_factor))
+(expandtypeattribute (proc_watermark_scale_factor_202504) true)
+(typeattribute proc_watermark_scale_factor_202504)
+(typeattributeset radio_202504 (radio))
+(expandtypeattribute (radio_202504) true)
+(typeattribute radio_202504)
+(typeattributeset extra_free_kbytes_202504 (extra_free_kbytes))
+(expandtypeattribute (extra_free_kbytes_202504) true)
+(typeattribute extra_free_kbytes_202504)
+(typeattributeset hypervisor_restricted_prop_202504 (hypervisor_restricted_prop))
+(expandtypeattribute (hypervisor_restricted_prop_202504) true)
+(typeattribute hypervisor_restricted_prop_202504)
+(typeattributeset smart_idle_maint_enabled_prop_202504 (smart_idle_maint_enabled_prop))
+(expandtypeattribute (smart_idle_maint_enabled_prop_202504) true)
+(typeattribute smart_idle_maint_enabled_prop_202504)
+(typeattributeset pipefs_202504 (pipefs))
+(expandtypeattribute (pipefs_202504) true)
+(typeattribute pipefs_202504)
+(typeattributeset pstorefs_202504 (pstorefs))
+(expandtypeattribute (pstorefs_202504) true)
+(typeattribute pstorefs_202504)
+(typeattributeset device_config_surface_flinger_native_boot_prop_202504 (device_config_surface_flinger_native_boot_prop))
+(expandtypeattribute (device_config_surface_flinger_native_boot_prop_202504) true)
+(typeattribute device_config_surface_flinger_native_boot_prop_202504)
+(typeattributeset device_config_vendor_system_native_prop_202504 (device_config_vendor_system_native_prop))
+(expandtypeattribute (device_config_vendor_system_native_prop_202504) true)
+(typeattribute device_config_vendor_system_native_prop_202504)
+(typeattributeset proc_sysrq_202504 (proc_sysrq))
+(expandtypeattribute (proc_sysrq_202504) true)
+(typeattribute proc_sysrq_202504)
+(typeattributeset gatekeeperd_202504 (gatekeeperd))
+(expandtypeattribute (gatekeeperd_202504) true)
+(typeattribute gatekeeperd_202504)
+(typeattributeset device_config_memory_safety_native_prop_202504 (device_config_memory_safety_native_prop))
+(expandtypeattribute (device_config_memory_safety_native_prop_202504) true)
+(typeattribute device_config_memory_safety_native_prop_202504)
+(typeattributeset perfetto_202504 (perfetto))
+(expandtypeattribute (perfetto_202504) true)
+(typeattribute perfetto_202504)
+(typeattributeset consumer_ir_service_202504 (consumer_ir_service))
+(expandtypeattribute (consumer_ir_service_202504) true)
+(typeattribute consumer_ir_service_202504)
+(typeattributeset threadnetwork_service_202504 (threadnetwork_service))
+(expandtypeattribute (threadnetwork_service_202504) true)
+(typeattribute threadnetwork_service_202504)
+(typeattributeset sysfs_devices_cs_etm_202504 (sysfs_devices_cs_etm))
+(expandtypeattribute (sysfs_devices_cs_etm_202504) true)
+(typeattribute sysfs_devices_cs_etm_202504)
+(typeattributeset virtual_device_service_202504 (virtual_device_service))
+(expandtypeattribute (virtual_device_service_202504) true)
+(typeattribute virtual_device_service_202504)
+(typeattributeset sysfs_zram_202504 (sysfs_zram))
+(expandtypeattribute (sysfs_zram_202504) true)
+(typeattribute sysfs_zram_202504)
+(typeattributeset gsi_data_file_202504 (gsi_data_file))
+(expandtypeattribute (gsi_data_file_202504) true)
+(typeattribute gsi_data_file_202504)
+(typeattributeset wifi_data_file_202504 (wifi_data_file))
+(expandtypeattribute (wifi_data_file_202504) true)
+(typeattribute wifi_data_file_202504)
+(typeattributeset mediametrics_service_202504 (mediametrics_service))
+(expandtypeattribute (mediametrics_service_202504) true)
+(typeattribute mediametrics_service_202504)
+(typeattributeset hal_secureclock_service_202504 (hal_secureclock_service))
+(expandtypeattribute (hal_secureclock_service_202504) true)
+(typeattribute hal_secureclock_service_202504)
+(typeattributeset system_boot_reason_prop_202504 (system_boot_reason_prop))
+(expandtypeattribute (system_boot_reason_prop_202504) true)
+(typeattribute system_boot_reason_prop_202504)
+(typeattributeset hal_threadnetwork_service_202504 (hal_threadnetwork_service))
+(expandtypeattribute (hal_threadnetwork_service_202504) true)
+(typeattribute hal_threadnetwork_service_202504)
+(typeattributeset recovery_usb_config_prop_202504 (recovery_usb_config_prop))
+(expandtypeattribute (recovery_usb_config_prop_202504) true)
+(typeattribute recovery_usb_config_prop_202504)
+(typeattributeset hal_lowpan_hwservice_202504 (hal_lowpan_hwservice))
+(expandtypeattribute (hal_lowpan_hwservice_202504) true)
+(typeattribute hal_lowpan_hwservice_202504)
+(typeattributeset statsd_202504 (statsd))
+(expandtypeattribute (statsd_202504) true)
+(typeattribute statsd_202504)
+(typeattributeset assetatlas_service_202504 (assetatlas_service))
+(expandtypeattribute (assetatlas_service_202504) true)
+(typeattribute assetatlas_service_202504)
+(typeattributeset sysfs_udc_202504 (sysfs_udc))
+(expandtypeattribute (sysfs_udc_202504) true)
+(typeattribute sysfs_udc_202504)
+(typeattributeset proc_filesystems_202504 (proc_filesystems))
+(expandtypeattribute (proc_filesystems_202504) true)
+(typeattribute proc_filesystems_202504)
+(typeattributeset backup_service_202504 (backup_service))
+(expandtypeattribute (backup_service_202504) true)
+(typeattribute backup_service_202504)
+(typeattributeset pdx_display_manager_channel_socket_202504 (pdx_display_manager_channel_socket))
+(expandtypeattribute (pdx_display_manager_channel_socket_202504) true)
+(typeattribute pdx_display_manager_channel_socket_202504)
+(typeattributeset traced_probes_202504 (traced_probes))
+(expandtypeattribute (traced_probes_202504) true)
+(typeattribute traced_probes_202504)
+(typeattributeset zero_device_202504 (zero_device))
+(expandtypeattribute (zero_device_202504) true)
+(typeattribute zero_device_202504)
+(typeattributeset vendor_keychars_file_202504 (vendor_keychars_file))
+(expandtypeattribute (vendor_keychars_file_202504) true)
+(typeattribute vendor_keychars_file_202504)
+(typeattributeset system_linker_exec_202504 (system_linker_exec))
+(expandtypeattribute (system_linker_exec_202504) true)
+(typeattribute system_linker_exec_202504)
+(typeattributeset hwservice_contexts_file_202504 (hwservice_contexts_file))
+(expandtypeattribute (hwservice_contexts_file_202504) true)
+(typeattribute hwservice_contexts_file_202504)
+(typeattributeset service_contexts_file_202504 (service_contexts_file))
+(expandtypeattribute (service_contexts_file_202504) true)
+(typeattribute service_contexts_file_202504)
+(typeattributeset translation_service_202504 (translation_service))
+(expandtypeattribute (translation_service_202504) true)
+(typeattribute translation_service_202504)
+(typeattributeset exported_bluetooth_prop_202504 (exported_bluetooth_prop))
+(expandtypeattribute (exported_bluetooth_prop_202504) true)
+(typeattribute exported_bluetooth_prop_202504)
+(typeattributeset sysfs_uio_202504 (sysfs_uio))
+(expandtypeattribute (sysfs_uio_202504) true)
+(typeattribute sysfs_uio_202504)
+(typeattributeset vndservice_contexts_file_202504 (vndservice_contexts_file))
+(expandtypeattribute (vndservice_contexts_file_202504) true)
+(typeattribute vndservice_contexts_file_202504)
+(typeattributeset incident_202504 (incident))
+(expandtypeattribute (incident_202504) true)
+(typeattribute incident_202504)
+(typeattributeset vold_post_fs_data_prop_202504 (vold_post_fs_data_prop))
+(expandtypeattribute (vold_post_fs_data_prop_202504) true)
+(typeattribute vold_post_fs_data_prop_202504)
+(typeattributeset mediatranscoding_service_202504 (mediatranscoding_service))
+(expandtypeattribute (mediatranscoding_service_202504) true)
+(typeattribute mediatranscoding_service_202504)
+(typeattributeset cache_block_device_202504 (cache_block_device))
+(expandtypeattribute (cache_block_device_202504) true)
+(typeattribute cache_block_device_202504)
+(typeattributeset dynamic_system_prop_202504 (dynamic_system_prop))
+(expandtypeattribute (dynamic_system_prop_202504) true)
+(typeattribute dynamic_system_prop_202504)
+(typeattributeset media_quality_service_202504 (media_quality_service))
+(expandtypeattribute (media_quality_service_202504) true)
+(typeattribute media_quality_service_202504)
+(typeattributeset soundtrigger_middleware_service_202504 (soundtrigger_middleware_service))
+(expandtypeattribute (soundtrigger_middleware_service_202504) true)
+(typeattribute soundtrigger_middleware_service_202504)
+(typeattributeset crash_dump_exec_202504 (crash_dump_exec))
+(expandtypeattribute (crash_dump_exec_202504) true)
+(typeattribute crash_dump_exec_202504)
+(typeattributeset vendor_public_framework_file_202504 (vendor_public_framework_file))
+(expandtypeattribute (vendor_public_framework_file_202504) true)
+(typeattribute vendor_public_framework_file_202504)
+(typeattributeset shell_202504 (shell))
+(expandtypeattribute (shell_202504) true)
+(typeattribute shell_202504)
+(typeattributeset network_time_update_service_202504 (network_time_update_service))
+(expandtypeattribute (network_time_update_service_202504) true)
+(typeattribute network_time_update_service_202504)
+(typeattributeset theme_prop_202504 (theme_prop))
+(expandtypeattribute (theme_prop_202504) true)
+(typeattribute theme_prop_202504)
+(typeattributeset seapp_contexts_file_202504 (seapp_contexts_file))
+(expandtypeattribute (seapp_contexts_file_202504) true)
+(typeattribute seapp_contexts_file_202504)
+(typeattributeset textclassification_service_202504 (textclassification_service))
+(expandtypeattribute (textclassification_service_202504) true)
+(typeattribute textclassification_service_202504)
+(typeattributeset blkid_untrusted_202504 (blkid_untrusted))
+(expandtypeattribute (blkid_untrusted_202504) true)
+(typeattribute blkid_untrusted_202504)
+(typeattributeset rss_hwm_reset_202504 (rss_hwm_reset))
+(expandtypeattribute (rss_hwm_reset_202504) true)
+(typeattribute rss_hwm_reset_202504)
+(typeattributeset speech_recognition_service_202504 (speech_recognition_service))
+(expandtypeattribute (speech_recognition_service_202504) true)
+(typeattribute speech_recognition_service_202504)
+(typeattributeset dumpstate_prop_202504 (dumpstate_prop))
+(expandtypeattribute (dumpstate_prop_202504) true)
+(typeattribute dumpstate_prop_202504)
+(typeattributeset zygote_exec_202504 (zygote_exec))
+(expandtypeattribute (zygote_exec_202504) true)
+(typeattribute zygote_exec_202504)
+(typeattributeset cppreopt_prop_202504 (cppreopt_prop))
+(expandtypeattribute (cppreopt_prop_202504) true)
+(typeattribute cppreopt_prop_202504)
+(typeattributeset radio_prop_202504 (radio_prop))
+(expandtypeattribute (radio_prop_202504) true)
+(typeattribute radio_prop_202504)
+(typeattributeset postinstall_mnt_dir_202504 (postinstall_mnt_dir))
+(expandtypeattribute (postinstall_mnt_dir_202504) true)
+(typeattribute postinstall_mnt_dir_202504)
+(typeattributeset misc_user_data_file_202504 (misc_user_data_file))
+(expandtypeattribute (misc_user_data_file_202504) true)
+(typeattribute misc_user_data_file_202504)
+(typeattributeset debugfs_wifi_tracing_202504 (debugfs_wifi_tracing))
+(expandtypeattribute (debugfs_wifi_tracing_202504) true)
+(typeattribute debugfs_wifi_tracing_202504)
+(typeattributeset sysfs_fs_incfs_features_202504 (sysfs_fs_incfs_features))
+(expandtypeattribute (sysfs_fs_incfs_features_202504) true)
+(typeattribute sysfs_fs_incfs_features_202504)
+(typeattributeset shell_prop_202504 (shell_prop))
+(expandtypeattribute (shell_prop_202504) true)
+(typeattribute shell_prop_202504)
+(typeattributeset dev_cpu_variant_202504 (dev_cpu_variant))
+(expandtypeattribute (dev_cpu_variant_202504) true)
+(typeattribute dev_cpu_variant_202504)
+(typeattributeset system_linker_config_file_202504 (system_linker_config_file))
+(expandtypeattribute (system_linker_config_file_202504) true)
+(typeattribute system_linker_config_file_202504)
+(typeattributeset keyguard_config_prop_202504 (keyguard_config_prop))
+(expandtypeattribute (keyguard_config_prop_202504) true)
+(typeattribute keyguard_config_prop_202504)
+(typeattributeset aac_drc_prop_202504 (aac_drc_prop))
+(expandtypeattribute (aac_drc_prop_202504) true)
+(typeattribute aac_drc_prop_202504)
+(typeattributeset password_slot_metadata_file_202504 (password_slot_metadata_file))
+(expandtypeattribute (password_slot_metadata_file_202504) true)
+(typeattribute password_slot_metadata_file_202504)
+(typeattributeset isolated_app_202504 (isolated_app))
+(expandtypeattribute (isolated_app_202504) true)
+(typeattribute isolated_app_202504)
+(typeattributeset sysfs_vibrator_202504 (sysfs_vibrator))
+(expandtypeattribute (sysfs_vibrator_202504) true)
+(typeattribute sysfs_vibrator_202504)
+(typeattributeset network_management_service_202504 (network_management_service))
+(expandtypeattribute (network_management_service_202504) true)
+(typeattribute network_management_service_202504)
+(typeattributeset heapprofd_prop_202504 (heapprofd_prop))
+(expandtypeattribute (heapprofd_prop_202504) true)
+(typeattribute heapprofd_prop_202504)
+(typeattributeset sysfs_hwrandom_202504 (sysfs_hwrandom))
+(expandtypeattribute (sysfs_hwrandom_202504) true)
+(typeattribute sysfs_hwrandom_202504)
+(typeattributeset virtualization_service_202504 (virtualization_service))
+(expandtypeattribute (virtualization_service_202504) true)
+(typeattribute virtualization_service_202504)
+(typeattributeset tee_service_contexts_file_202504 (tee_service_contexts_file))
+(expandtypeattribute (tee_service_contexts_file_202504) true)
+(typeattribute tee_service_contexts_file_202504)
+(typeattributeset keystore_config_prop_202504 (keystore_config_prop))
+(expandtypeattribute (keystore_config_prop_202504) true)
+(typeattribute keystore_config_prop_202504)
+(typeattributeset system_server_202504 (system_server))
+(expandtypeattribute (system_server_202504) true)
+(typeattribute system_server_202504)
+(typeattributeset device_identifiers_service_202504 (device_identifiers_service))
+(expandtypeattribute (device_identifiers_service_202504) true)
+(typeattribute device_identifiers_service_202504)
+(typeattributeset userspace_reboot_exported_prop_202504 (userspace_reboot_exported_prop))
+(expandtypeattribute (userspace_reboot_exported_prop_202504) true)
+(typeattribute userspace_reboot_exported_prop_202504)
+(typeattributeset crosvm_202504 (crosvm))
+(expandtypeattribute (crosvm_202504) true)
+(typeattribute crosvm_202504)
+(typeattributeset network_score_service_202504 (network_score_service))
+(expandtypeattribute (network_score_service_202504) true)
+(typeattribute network_score_service_202504)
+(typeattributeset e2fs_202504 (e2fs))
+(expandtypeattribute (e2fs_202504) true)
+(typeattribute e2fs_202504)
+(typeattributeset usbfs_202504 (usbfs))
+(expandtypeattribute (usbfs_202504) true)
+(typeattribute usbfs_202504)
+(typeattributeset binderfs_202504 (binderfs))
+(expandtypeattribute (binderfs_202504) true)
+(typeattribute binderfs_202504)
+(typeattributeset vendor_microdroid_file_202504 (vendor_microdroid_file))
+(expandtypeattribute (vendor_microdroid_file_202504) true)
+(typeattribute vendor_microdroid_file_202504)
+(typeattributeset debugfs_wakeup_sources_202504 (debugfs_wakeup_sources))
+(expandtypeattribute (debugfs_wakeup_sources_202504) true)
+(typeattribute debugfs_wakeup_sources_202504)
+(typeattributeset repair_mode_metadata_file_202504 (repair_mode_metadata_file))
+(expandtypeattribute (repair_mode_metadata_file_202504) true)
+(typeattribute repair_mode_metadata_file_202504)
+(typeattributeset surfaceflinger_display_prop_202504 (surfaceflinger_display_prop))
+(expandtypeattribute (surfaceflinger_display_prop_202504) true)
+(typeattribute surfaceflinger_display_prop_202504)
+(typeattributeset incident_helper_202504 (incident_helper))
+(expandtypeattribute (incident_helper_202504) true)
+(typeattribute incident_helper_202504)
+(typeattributeset sendbug_config_prop_202504 (sendbug_config_prop))
+(expandtypeattribute (sendbug_config_prop_202504) true)
+(typeattribute sendbug_config_prop_202504)
+(typeattributeset system_wifi_keystore_hwservice_202504 (system_wifi_keystore_hwservice))
+(expandtypeattribute (system_wifi_keystore_hwservice_202504) true)
+(typeattribute system_wifi_keystore_hwservice_202504)
+(typeattributeset sdcardd_202504 (sdcardd))
+(expandtypeattribute (sdcardd_202504) true)
+(typeattribute sdcardd_202504)
+(typeattributeset audioserver_tmpfs_202504 (audioserver_tmpfs))
+(expandtypeattribute (audioserver_tmpfs_202504) true)
+(typeattribute audioserver_tmpfs_202504)
+(typeattributeset mediaserver_tmpfs_202504 (mediaserver_tmpfs))
+(expandtypeattribute (mediaserver_tmpfs_202504) true)
+(typeattribute mediaserver_tmpfs_202504)
+(typeattributeset thermal_service_202504 (thermal_service))
+(expandtypeattribute (thermal_service_202504) true)
+(typeattribute thermal_service_202504)
+(typeattributeset connectivity_native_service_202504 (connectivity_native_service))
+(expandtypeattribute (connectivity_native_service_202504) true)
+(typeattribute connectivity_native_service_202504)
+(typeattributeset idmap_service_202504 (idmap_service))
+(expandtypeattribute (idmap_service_202504) true)
+(typeattribute idmap_service_202504)
+(typeattributeset logdr_socket_202504 (logdr_socket))
+(expandtypeattribute (logdr_socket_202504) true)
+(typeattribute logdr_socket_202504)
+(typeattributeset logdw_socket_202504 (logdw_socket))
+(expandtypeattribute (logdw_socket_202504) true)
+(typeattribute logdw_socket_202504)
+(typeattributeset vpn_data_file_202504 (vpn_data_file))
+(expandtypeattribute (vpn_data_file_202504) true)
+(typeattribute vpn_data_file_202504)
+(typeattributeset dalvikcache_data_file_202504 (dalvikcache_data_file))
+(expandtypeattribute (dalvikcache_data_file_202504) true)
+(typeattribute dalvikcache_data_file_202504)
+(typeattributeset hw_timeout_multiplier_prop_202504 (hw_timeout_multiplier_prop))
+(expandtypeattribute (hw_timeout_multiplier_prop_202504) true)
+(typeattribute hw_timeout_multiplier_prop_202504)
+(typeattributeset drm_service_config_prop_202504 (drm_service_config_prop))
+(expandtypeattribute (drm_service_config_prop_202504) true)
+(typeattribute drm_service_config_prop_202504)
+(typeattributeset vendor_boot_ota_file_202504 (vendor_boot_ota_file))
+(expandtypeattribute (vendor_boot_ota_file_202504) true)
+(typeattribute vendor_boot_ota_file_202504)
+(typeattributeset mediaserver_service_202504 (mediaserver_service))
+(expandtypeattribute (mediaserver_service_202504) true)
+(typeattribute mediaserver_service_202504)
+(typeattributeset network_stack_202504 (network_stack))
+(expandtypeattribute (network_stack_202504) true)
+(typeattribute network_stack_202504)
+(typeattributeset property_data_file_202504 (property_data_file))
+(expandtypeattribute (property_data_file_202504) true)
+(typeattribute property_data_file_202504)
+(typeattributeset binderfs_logs_proc_202504 (binderfs_logs_proc))
+(expandtypeattribute (binderfs_logs_proc_202504) true)
+(typeattribute binderfs_logs_proc_202504)
+(typeattributeset wifi_hal_prop_202504 (wifi_hal_prop))
+(expandtypeattribute (wifi_hal_prop_202504) true)
+(typeattribute wifi_hal_prop_202504)
+(typeattributeset wifi_log_prop_202504 (wifi_log_prop))
+(expandtypeattribute (wifi_log_prop_202504) true)
+(typeattribute wifi_log_prop_202504)
+(typeattributeset accessibility_service_202504 (accessibility_service))
+(expandtypeattribute (accessibility_service_202504) true)
+(typeattribute accessibility_service_202504)
+(typeattributeset timezonedetector_service_202504 (timezonedetector_service))
+(expandtypeattribute (timezonedetector_service_202504) true)
+(typeattribute timezonedetector_service_202504)
+(typeattributeset device_config_aconfig_flags_prop_202504 (device_config_aconfig_flags_prop))
+(expandtypeattribute (device_config_aconfig_flags_prop_202504) true)
+(typeattribute device_config_aconfig_flags_prop_202504)
+(typeattributeset camera_device_202504 (camera_device))
+(expandtypeattribute (camera_device_202504) true)
+(typeattribute camera_device_202504)
+(typeattributeset recovery_data_file_202504 (recovery_data_file))
+(expandtypeattribute (recovery_data_file_202504) true)
+(typeattribute recovery_data_file_202504)
+(typeattributeset system_app_data_file_202504 (system_app_data_file))
+(expandtypeattribute (system_app_data_file_202504) true)
+(typeattribute system_app_data_file_202504)
+(typeattributeset proc_cpu_alignment_202504 (proc_cpu_alignment))
+(expandtypeattribute (proc_cpu_alignment_202504) true)
+(typeattribute proc_cpu_alignment_202504)
+(typeattributeset sysfs_fs_fuse_bpf_202504 (sysfs_fs_fuse_bpf))
+(expandtypeattribute (sysfs_fs_fuse_bpf_202504) true)
+(typeattribute sysfs_fs_fuse_bpf_202504)
+(typeattributeset media_variant_prop_202504 (media_variant_prop))
+(expandtypeattribute (media_variant_prop_202504) true)
+(typeattribute media_variant_prop_202504)
+(typeattributeset sysfs_leds_202504 (sysfs_leds))
+(expandtypeattribute (sysfs_leds_202504) true)
+(typeattribute sysfs_leds_202504)
+(typeattributeset adaptive_haptics_prop_202504 (adaptive_haptics_prop))
+(expandtypeattribute (adaptive_haptics_prop_202504) true)
+(typeattribute adaptive_haptics_prop_202504)
+(typeattributeset restrictions_service_202504 (restrictions_service))
+(expandtypeattribute (restrictions_service_202504) true)
+(typeattribute restrictions_service_202504)
+(typeattributeset dck_prop_202504 (dck_prop))
+(expandtypeattribute (dck_prop_202504) true)
+(typeattribute dck_prop_202504)
+(typeattributeset log_prop_202504 (log_prop))
+(expandtypeattribute (log_prop_202504) true)
+(typeattribute log_prop_202504)
+(typeattributeset mmc_prop_202504 (mmc_prop))
+(expandtypeattribute (mmc_prop_202504) true)
+(typeattribute mmc_prop_202504)
+(typeattributeset nfc_prop_202504 (nfc_prop))
+(expandtypeattribute (nfc_prop_202504) true)
+(typeattribute nfc_prop_202504)
+(typeattributeset ota_prop_202504 (ota_prop))
+(expandtypeattribute (ota_prop_202504) true)
+(typeattribute ota_prop_202504)
+(typeattributeset soc_prop_202504 (soc_prop))
+(expandtypeattribute (soc_prop_202504) true)
+(typeattribute soc_prop_202504)
+(typeattributeset usb_prop_202504 (usb_prop))
+(expandtypeattribute (usb_prop_202504) true)
+(typeattribute usb_prop_202504)
+(typeattributeset toolbox_202504 (toolbox))
+(expandtypeattribute (toolbox_202504) true)
+(typeattribute toolbox_202504)
+(typeattributeset IProxyService_service_202504 (IProxyService_service))
+(expandtypeattribute (IProxyService_service_202504) true)
+(typeattribute IProxyService_service_202504)
+(typeattributeset hal_vehicle_service_202504 (hal_vehicle_service))
+(expandtypeattribute (hal_vehicle_service_202504) true)
+(typeattribute hal_vehicle_service_202504)
+(typeattributeset aidl_lazy_test_service_202504 (aidl_lazy_test_service))
+(expandtypeattribute (aidl_lazy_test_service_202504) true)
+(typeattribute aidl_lazy_test_service_202504)
+(typeattributeset music_recognition_service_202504 (music_recognition_service))
+(expandtypeattribute (music_recognition_service_202504) true)
+(typeattribute music_recognition_service_202504)
+(typeattributeset mnt_media_rw_stub_file_202504 (mnt_media_rw_stub_file))
+(expandtypeattribute (mnt_media_rw_stub_file_202504) true)
+(typeattribute mnt_media_rw_stub_file_202504)
+(typeattributeset proc_202504 (proc))
+(expandtypeattribute (proc_202504) true)
+(typeattribute proc_202504)
+(typeattributeset virtual_device_native_service_202504 (virtual_device_native_service))
+(expandtypeattribute (virtual_device_native_service_202504) true)
+(typeattribute virtual_device_native_service_202504)
+(typeattributeset bluetooth_socket_202504 (bluetooth_socket))
+(expandtypeattribute (bluetooth_socket_202504) true)
+(typeattribute bluetooth_socket_202504)
+(typeattributeset logcat_exec_202504 (logcat_exec))
+(expandtypeattribute (logcat_exec_202504) true)
+(typeattribute logcat_exec_202504)
+(typeattributeset apk_verity_prop_202504 (apk_verity_prop))
+(expandtypeattribute (apk_verity_prop_202504) true)
+(typeattribute apk_verity_prop_202504)
+(typeattributeset inputflinger_exec_202504 (inputflinger_exec))
+(expandtypeattribute (inputflinger_exec_202504) true)
+(typeattribute inputflinger_exec_202504)
+(typeattributeset overlay_prop_202504 (overlay_prop))
+(expandtypeattribute (overlay_prop_202504) true)
+(typeattribute overlay_prop_202504)
+(typeattributeset ot_daemon_service_202504 (ot_daemon_service))
+(expandtypeattribute (ot_daemon_service_202504) true)
+(typeattribute ot_daemon_service_202504)
+(typeattributeset hal_tetheroffload_service_202504 (hal_tetheroffload_service))
+(expandtypeattribute (hal_tetheroffload_service_202504) true)
+(typeattribute hal_tetheroffload_service_202504)
+(typeattributeset camera_calibration_prop_202504 (camera_calibration_prop))
+(expandtypeattribute (camera_calibration_prop_202504) true)
+(typeattribute camera_calibration_prop_202504)
+(typeattributeset fuseblk_202504 (fuseblk))
+(expandtypeattribute (fuseblk_202504) true)
+(typeattribute fuseblk_202504)
+(typeattributeset test_boot_reason_prop_202504 (test_boot_reason_prop))
+(expandtypeattribute (test_boot_reason_prop_202504) true)
+(typeattribute test_boot_reason_prop_202504)
+(typeattributeset hal_wifi_hostapd_hwservice_202504 (hal_wifi_hostapd_hwservice))
+(expandtypeattribute (hal_wifi_hostapd_hwservice_202504) true)
+(typeattribute hal_wifi_hostapd_hwservice_202504)
+(typeattributeset virtual_face_hal_prop_202504 (virtual_face_hal_prop))
+(expandtypeattribute (virtual_face_hal_prop_202504) true)
+(typeattribute virtual_face_hal_prop_202504)
+(typeattributeset safemode_prop_202504 (safemode_prop))
+(expandtypeattribute (safemode_prop_202504) true)
+(typeattribute safemode_prop_202504)
+(typeattributeset vendor_apex_metadata_file_202504 (vendor_apex_metadata_file))
+(expandtypeattribute (vendor_apex_metadata_file_202504) true)
+(typeattribute vendor_apex_metadata_file_202504)
+(typeattributeset wallpaper_file_202504 (wallpaper_file))
+(expandtypeattribute (wallpaper_file_202504) true)
+(typeattribute wallpaper_file_202504)
+(typeattributeset shortcut_manager_icons_202504 (shortcut_manager_icons))
+(expandtypeattribute (shortcut_manager_icons_202504) true)
+(typeattribute shortcut_manager_icons_202504)
+(typeattributeset dalvik_dynamic_config_prop_202504 (dalvik_dynamic_config_prop))
+(expandtypeattribute (dalvik_dynamic_config_prop_202504) true)
+(typeattribute dalvik_dynamic_config_prop_202504)
+(typeattributeset proc_asound_202504 (proc_asound))
+(expandtypeattribute (proc_asound_202504) true)
+(typeattribute proc_asound_202504)
+(typeattributeset apex_mnt_dir_202504 (apex_mnt_dir))
+(expandtypeattribute (apex_mnt_dir_202504) true)
+(typeattribute apex_mnt_dir_202504)
+(typeattributeset intrusion_detection_service_202504 (intrusion_detection_service))
+(expandtypeattribute (intrusion_detection_service_202504) true)
+(typeattribute intrusion_detection_service_202504)
+(typeattributeset hal_neuralnetworks_hwservice_202504 (hal_neuralnetworks_hwservice))
+(expandtypeattribute (hal_neuralnetworks_hwservice_202504) true)
+(typeattribute hal_neuralnetworks_hwservice_202504)
+(typeattributeset selection_toolbar_service_202504 (selection_toolbar_service))
+(expandtypeattribute (selection_toolbar_service_202504) true)
+(typeattribute selection_toolbar_service_202504)
+(typeattributeset build_vendor_prop_202504 (build_vendor_prop))
+(expandtypeattribute (build_vendor_prop_202504) true)
+(typeattribute build_vendor_prop_202504)
+(typeattributeset dhcp_prop_202504 (dhcp_prop))
+(expandtypeattribute (dhcp_prop_202504) true)
+(typeattribute dhcp_prop_202504)
+(typeattributeset gps_control_202504 (gps_control))
+(expandtypeattribute (gps_control_202504) true)
+(typeattribute gps_control_202504)
+(typeattributeset llkd_prop_202504 (llkd_prop))
+(expandtypeattribute (llkd_prop_202504) true)
+(typeattribute llkd_prop_202504)
+(typeattributeset lmkd_prop_202504 (lmkd_prop))
+(expandtypeattribute (lmkd_prop_202504) true)
+(typeattribute lmkd_prop_202504)
+(typeattributeset logd_prop_202504 (logd_prop))
+(expandtypeattribute (logd_prop_202504) true)
+(typeattribute logd_prop_202504)
+(typeattributeset system_unsolzygote_socket_202504 (system_unsolzygote_socket))
+(expandtypeattribute (system_unsolzygote_socket_202504) true)
+(typeattribute system_unsolzygote_socket_202504)
+(typeattributeset dumpstate_options_prop_202504 (dumpstate_options_prop))
+(expandtypeattribute (dumpstate_options_prop_202504) true)
+(typeattribute dumpstate_options_prop_202504)
+(typeattributeset proc_uid_concurrent_active_time_202504 (proc_uid_concurrent_active_time))
+(expandtypeattribute (proc_uid_concurrent_active_time_202504) true)
+(typeattribute proc_uid_concurrent_active_time_202504)
+(typeattributeset vndk_prop_202504 (vndk_prop))
+(expandtypeattribute (vndk_prop_202504) true)
+(typeattribute vndk_prop_202504)
+(typeattributeset vold_prop_202504 (vold_prop))
+(expandtypeattribute (vold_prop_202504) true)
+(typeattribute vold_prop_202504)
+(typeattributeset wifi_prop_202504 (wifi_prop))
+(expandtypeattribute (wifi_prop_202504) true)
+(typeattribute wifi_prop_202504)
+(typeattributeset time_prop_202504 (time_prop))
+(expandtypeattribute (time_prop_202504) true)
+(typeattribute time_prop_202504)
+(typeattributeset imms_service_202504 (imms_service))
+(expandtypeattribute (imms_service_202504) true)
+(typeattribute imms_service_202504)
+(typeattributeset sota_prop_202504 (sota_prop))
+(expandtypeattribute (sota_prop_202504) true)
+(typeattribute sota_prop_202504)
+(typeattributeset app_integrity_service_202504 (app_integrity_service))
+(expandtypeattribute (app_integrity_service_202504) true)
+(typeattribute app_integrity_service_202504)
+(typeattributeset charger_config_prop_202504 (charger_config_prop))
+(expandtypeattribute (charger_config_prop_202504) true)
+(typeattribute charger_config_prop_202504)
+(typeattributeset hal_bootctl_service_202504 (hal_bootctl_service))
+(expandtypeattribute (hal_bootctl_service_202504) true)
+(typeattribute hal_bootctl_service_202504)
+(typeattributeset sysfs_202504 (sysfs))
+(expandtypeattribute (sysfs_202504) true)
+(typeattribute sysfs_202504)
+(typeattributeset default_android_service_202504 (default_android_service))
+(expandtypeattribute (default_android_service_202504) true)
+(typeattribute default_android_service_202504)
+(typeattributeset hal_sharedsecret_service_202504 (hal_sharedsecret_service))
+(expandtypeattribute (hal_sharedsecret_service_202504) true)
+(typeattribute hal_sharedsecret_service_202504)
+(typeattributeset bufferhubd_202504 (bufferhubd))
+(expandtypeattribute (bufferhubd_202504) true)
+(typeattribute bufferhubd_202504)
+(typeattributeset simpleperf_202504 (simpleperf))
+(expandtypeattribute (simpleperf_202504) true)
+(typeattribute simpleperf_202504)
+(typeattributeset socket_hook_prop_202504 (socket_hook_prop))
+(expandtypeattribute (socket_hook_prop_202504) true)
+(typeattribute socket_hook_prop_202504)
+(typeattributeset traced_lazy_prop_202504 (traced_lazy_prop))
+(expandtypeattribute (traced_lazy_prop_202504) true)
+(typeattribute traced_lazy_prop_202504)
+(typeattributeset sysfs_devices_system_cpu_202504 (sysfs_devices_system_cpu))
+(expandtypeattribute (sysfs_devices_system_cpu_202504) true)
+(typeattribute sysfs_devices_system_cpu_202504)
+(typeattributeset untrusted_app_202504 (untrusted_app))
+(expandtypeattribute (untrusted_app_202504) true)
+(typeattribute untrusted_app_202504)
+(typeattributeset artd_202504 (artd))
+(expandtypeattribute (artd_202504) true)
+(typeattribute artd_202504)
+(typeattributeset system_suspend_control_internal_service_202504 (system_suspend_control_internal_service))
+(expandtypeattribute (system_suspend_control_internal_service_202504) true)
+(typeattribute system_suspend_control_internal_service_202504)
+(typeattributeset device_config_camera_native_prop_202504 (device_config_camera_native_prop))
+(expandtypeattribute (device_config_camera_native_prop_202504) true)
+(typeattribute device_config_camera_native_prop_202504)
+(typeattributeset shared_relro_202504 (shared_relro))
+(expandtypeattribute (shared_relro_202504) true)
+(typeattribute shared_relro_202504)
+(typeattributeset hal_input_processor_service_202504 (hal_input_processor_service))
+(expandtypeattribute (hal_input_processor_service_202504) true)
+(typeattribute hal_input_processor_service_202504)
+(typeattributeset hal_wifi_hwservice_202504 (hal_wifi_hwservice))
+(expandtypeattribute (hal_wifi_hwservice_202504) true)
+(typeattribute hal_wifi_hwservice_202504)
+(typeattributeset proc_vmstat_202504 (proc_vmstat))
+(expandtypeattribute (proc_vmstat_202504) true)
+(typeattribute proc_vmstat_202504)
+(typeattributeset binderfs_features_202504 (binderfs_features))
+(expandtypeattribute (binderfs_features_202504) true)
+(typeattribute binderfs_features_202504)
+(typeattributeset storage_config_prop_202504 (storage_config_prop))
+(expandtypeattribute (storage_config_prop_202504) true)
+(typeattribute storage_config_prop_202504)
+(typeattributeset hal_graphics_mapper_hwservice_202504 (hal_graphics_mapper_hwservice))
+(expandtypeattribute (hal_graphics_mapper_hwservice_202504) true)
+(typeattribute hal_graphics_mapper_hwservice_202504)
+(typeattributeset traced_202504 (traced))
+(expandtypeattribute (traced_202504) true)
+(typeattribute traced_202504)
+(typeattributeset debugfs_kprobes_202504 (debugfs_kprobes))
+(expandtypeattribute (debugfs_kprobes_202504) true)
+(typeattribute debugfs_kprobes_202504)
+(typeattributeset proc_uid_concurrent_policy_time_202504 (proc_uid_concurrent_policy_time))
+(expandtypeattribute (proc_uid_concurrent_policy_time_202504) true)
+(typeattribute proc_uid_concurrent_policy_time_202504)
+(typeattributeset audio_data_file_202504 (audio_data_file))
+(expandtypeattribute (audio_data_file_202504) true)
+(typeattribute audio_data_file_202504)
+(typeattributeset radio_data_file_202504 (radio_data_file))
+(expandtypeattribute (radio_data_file_202504) true)
+(typeattribute radio_data_file_202504)
+(typeattributeset traceur_app_202504 (traceur_app))
+(expandtypeattribute (traceur_app_202504) true)
+(typeattribute traceur_app_202504)
+(typeattributeset display_service_202504 (display_service))
+(expandtypeattribute (display_service_202504) true)
+(typeattribute display_service_202504)
+(typeattributeset overlay_service_202504 (overlay_service))
+(expandtypeattribute (overlay_service_202504) true)
+(typeattribute overlay_service_202504)
+(typeattributeset hal_wifi_supplicant_hwservice_202504 (hal_wifi_supplicant_hwservice))
+(expandtypeattribute (hal_wifi_supplicant_hwservice_202504) true)
+(typeattribute hal_wifi_supplicant_hwservice_202504)
+(typeattributeset performanced_exec_202504 (performanced_exec))
+(expandtypeattribute (performanced_exec_202504) true)
+(typeattribute performanced_exec_202504)
+(typeattributeset charger_status_prop_202504 (charger_status_prop))
+(expandtypeattribute (charger_status_prop_202504) true)
+(typeattribute charger_status_prop_202504)
+(typeattributeset usbd_202504 (usbd))
+(expandtypeattribute (usbd_202504) true)
+(typeattribute usbd_202504)
+(typeattributeset proc_page_cluster_202504 (proc_page_cluster))
+(expandtypeattribute (proc_page_cluster_202504) true)
+(typeattribute proc_page_cluster_202504)
+(typeattributeset graphics_config_writable_prop_202504 (graphics_config_writable_prop))
+(expandtypeattribute (graphics_config_writable_prop_202504) true)
+(typeattribute graphics_config_writable_prop_202504)
+(typeattributeset emergency_affordance_service_202504 (emergency_affordance_service))
+(expandtypeattribute (emergency_affordance_service_202504) true)
+(typeattribute emergency_affordance_service_202504)
+(typeattributeset hal_health_hwservice_202504 (hal_health_hwservice))
+(expandtypeattribute (hal_health_hwservice_202504) true)
+(typeattribute hal_health_hwservice_202504)
+(typeattributeset system_wpa_socket_202504 (system_wpa_socket))
+(expandtypeattribute (system_wpa_socket_202504) true)
+(typeattribute system_wpa_socket_202504)
+(typeattributeset sysfs_rtc_202504 (sysfs_rtc))
+(expandtypeattribute (sysfs_rtc_202504) true)
+(typeattribute sysfs_rtc_202504)
+(typeattributeset fsck_202504 (fsck))
+(expandtypeattribute (fsck_202504) true)
+(typeattribute fsck_202504)
+(typeattributeset keystore_compat_hal_service_202504 (keystore_compat_hal_service))
+(expandtypeattribute (keystore_compat_hal_service_202504) true)
+(typeattribute keystore_compat_hal_service_202504)
+(typeattributeset proc_bpf_202504 (proc_bpf))
+(expandtypeattribute (proc_bpf_202504) true)
+(typeattribute proc_bpf_202504)
+(typeattributeset fs_bpf_202504 (fs_bpf))
+(expandtypeattribute (fs_bpf_202504) true)
+(typeattribute fs_bpf_202504)
+(typeattributeset snapshotctl_log_data_file_202504 (snapshotctl_log_data_file))
+(expandtypeattribute (snapshotctl_log_data_file_202504) true)
+(typeattribute snapshotctl_log_data_file_202504)
+(typeattributeset dalvik_runtime_prop_202504 (dalvik_runtime_prop))
+(expandtypeattribute (dalvik_runtime_prop_202504) true)
+(typeattribute dalvik_runtime_prop_202504)
+(typeattributeset prng_seeder_202504 (prng_seeder))
+(expandtypeattribute (prng_seeder_202504) true)
+(typeattribute prng_seeder_202504)
+(typeattributeset netd_listener_service_202504 (netd_listener_service))
+(expandtypeattribute (netd_listener_service_202504) true)
+(typeattribute netd_listener_service_202504)
+(typeattributeset debugfs_bootreceiver_tracing_202504 (debugfs_bootreceiver_tracing))
+(expandtypeattribute (debugfs_bootreceiver_tracing_202504) true)
+(typeattribute debugfs_bootreceiver_tracing_202504)
+(typeattributeset vcn_management_service_202504 (vcn_management_service))
+(expandtypeattribute (vcn_management_service_202504) true)
+(typeattribute vcn_management_service_202504)
+(typeattributeset vpn_management_service_202504 (vpn_management_service))
+(expandtypeattribute (vpn_management_service_202504) true)
+(typeattribute vpn_management_service_202504)
+(typeattributeset app_fusefs_202504 (app_fusefs))
+(expandtypeattribute (app_fusefs_202504) true)
+(typeattribute app_fusefs_202504)
+(typeattributeset graphics_config_prop_202504 (graphics_config_prop))
+(expandtypeattribute (graphics_config_prop_202504) true)
+(typeattribute graphics_config_prop_202504)
+(typeattributeset proc_overcommit_memory_202504 (proc_overcommit_memory))
+(expandtypeattribute (proc_overcommit_memory_202504) true)
+(typeattribute proc_overcommit_memory_202504)
+(typeattributeset ctl_dumpstate_prop_202504 (ctl_dumpstate_prop))
+(expandtypeattribute (ctl_dumpstate_prop_202504) true)
+(typeattribute ctl_dumpstate_prop_202504)
+(typeattributeset build_bootimage_prop_202504 (build_bootimage_prop))
+(expandtypeattribute (build_bootimage_prop_202504) true)
+(typeattribute build_bootimage_prop_202504)
+(typeattributeset device_config_memory_safety_native_boot_prop_202504 (device_config_memory_safety_native_boot_prop))
+(expandtypeattribute (device_config_memory_safety_native_boot_prop_202504) true)
+(typeattribute device_config_memory_safety_native_boot_prop_202504)
+(typeattributeset init_service_status_prop_202504 (init_service_status_prop))
+(expandtypeattribute (init_service_status_prop_202504) true)
+(typeattribute init_service_status_prop_202504)
+(typeattributeset binderfs_logs_transaction_history_202504 (binderfs_logs_transaction_history))
+(expandtypeattribute (binderfs_logs_transaction_history_202504) true)
+(typeattribute binderfs_logs_transaction_history_202504)
+(typeattributeset connmetrics_service_202504 (connmetrics_service))
+(expandtypeattribute (connmetrics_service_202504) true)
+(typeattribute connmetrics_service_202504)
+(typeattributeset hal_health_storage_service_202504 (hal_health_storage_service))
+(expandtypeattribute (hal_health_storage_service_202504) true)
+(typeattribute hal_health_storage_service_202504)
+(typeattributeset proc_uid_cputime_removeuid_202504 (proc_uid_cputime_removeuid))
+(expandtypeattribute (proc_uid_cputime_removeuid_202504) true)
+(typeattribute proc_uid_cputime_removeuid_202504)
+(typeattributeset dtbo_block_device_202504 (dtbo_block_device))
+(expandtypeattribute (dtbo_block_device_202504) true)
+(typeattribute dtbo_block_device_202504)
+(typeattributeset boot_block_device_202504 (boot_block_device))
+(expandtypeattribute (boot_block_device_202504) true)
+(typeattribute boot_block_device_202504)
+(typeattributeset powerctl_prop_202504 (powerctl_prop))
+(expandtypeattribute (powerctl_prop_202504) true)
+(typeattribute powerctl_prop_202504)
+(typeattributeset sysfs_android_usb_202504 (sysfs_android_usb))
+(expandtypeattribute (sysfs_android_usb_202504) true)
+(typeattribute sysfs_android_usb_202504)
+(typeattributeset misc_block_device_202504 (misc_block_device))
+(expandtypeattribute (misc_block_device_202504) true)
+(typeattribute misc_block_device_202504)
+(typeattributeset ublk_block_device_202504 (ublk_block_device))
+(expandtypeattribute (ublk_block_device_202504) true)
+(typeattribute ublk_block_device_202504)
+(typeattributeset root_block_device_202504 (root_block_device))
+(expandtypeattribute (root_block_device_202504) true)
+(typeattribute root_block_device_202504)
+(typeattributeset swap_block_device_202504 (swap_block_device))
+(expandtypeattribute (swap_block_device_202504) true)
+(typeattribute swap_block_device_202504)
+(typeattributeset sysfs_mem_sleep_202504 (sysfs_mem_sleep))
+(expandtypeattribute (sysfs_mem_sleep_202504) true)
+(typeattribute sysfs_mem_sleep_202504)
+(typeattributeset block_device_202504 (block_device))
+(expandtypeattribute (block_device_202504) true)
+(typeattribute block_device_202504)
+(typeattributeset sysfs_cma_202504 (sysfs_cma))
+(expandtypeattribute (sysfs_cma_202504) true)
+(typeattribute sysfs_cma_202504)
+(typeattributeset frp_block_device_202504 (frp_block_device))
+(expandtypeattribute (frp_block_device_202504) true)
+(typeattribute frp_block_device_202504)
+(typeattributeset sysfs_power_202504 (sysfs_power))
+(expandtypeattribute (sysfs_power_202504) true)
+(typeattribute sysfs_power_202504)
+(typeattributeset loop_device_202504 (loop_device))
+(expandtypeattribute (loop_device_202504) true)
+(typeattribute loop_device_202504)
+(typeattributeset proc_random_202504 (proc_random))
+(expandtypeattribute (proc_random_202504) true)
+(typeattribute proc_random_202504)
+(typeattributeset hal_health_storage_hwservice_202504 (hal_health_storage_hwservice))
+(expandtypeattribute (hal_health_storage_hwservice_202504) true)
+(typeattribute hal_health_storage_hwservice_202504)
+(typeattributeset dnsproxyd_socket_202504 (dnsproxyd_socket))
+(expandtypeattribute (dnsproxyd_socket_202504) true)
+(typeattribute dnsproxyd_socket_202504)
+(typeattributeset crash_dump_202504 (crash_dump))
+(expandtypeattribute (crash_dump_202504) true)
+(typeattribute crash_dump_202504)
+(typeattributeset hal_keymaster_hwservice_202504 (hal_keymaster_hwservice))
+(expandtypeattribute (hal_keymaster_hwservice_202504) true)
+(typeattribute hal_keymaster_hwservice_202504)
+(typeattributeset ctl_interface_start_prop_202504 (ctl_interface_start_prop))
+(expandtypeattribute (ctl_interface_start_prop_202504) true)
+(typeattribute ctl_interface_start_prop_202504)
+(typeattributeset module_sdkextensions_prop_202504 (module_sdkextensions_prop))
+(expandtypeattribute (module_sdkextensions_prop_202504) true)
+(typeattribute module_sdkextensions_prop_202504)
+(typeattributeset sysfs_wakeup_reasons_202504 (sysfs_wakeup_reasons))
+(expandtypeattribute (sysfs_wakeup_reasons_202504) true)
+(typeattribute sysfs_wakeup_reasons_202504)
+(typeattributeset device_config_reset_performed_prop_202504 (device_config_reset_performed_prop))
+(expandtypeattribute (device_config_reset_performed_prop_202504) true)
+(typeattribute device_config_reset_performed_prop_202504)
+(typeattributeset shm_202504 (shm))
+(expandtypeattribute (shm_202504) true)
+(typeattribute shm_202504)
+(typeattributeset installd_service_202504 (installd_service))
+(expandtypeattribute (installd_service_202504) true)
+(typeattribute installd_service_202504)
+(typeattributeset proc_extra_free_kbytes_202504 (proc_extra_free_kbytes))
+(expandtypeattribute (proc_extra_free_kbytes_202504) true)
+(typeattribute proc_extra_free_kbytes_202504)
+(typeattributeset proc_uid_cputime_showstat_202504 (proc_uid_cputime_showstat))
+(expandtypeattribute (proc_uid_cputime_showstat_202504) true)
+(typeattribute proc_uid_cputime_showstat_202504)
+(typeattributeset vendor_misc_writer_exec_202504 (vendor_misc_writer_exec))
+(expandtypeattribute (vendor_misc_writer_exec_202504) true)
+(typeattribute vendor_misc_writer_exec_202504)
+(typeattributeset runas_app_202504 (runas_app))
+(expandtypeattribute (runas_app_202504) true)
+(typeattribute runas_app_202504)
+(typeattributeset bootstat_exec_202504 (bootstat_exec))
+(expandtypeattribute (bootstat_exec_202504) true)
+(typeattribute bootstat_exec_202504)
+(typeattributeset mdns_socket_202504 (mdns_socket))
+(expandtypeattribute (mdns_socket_202504) true)
+(typeattribute mdns_socket_202504)
+(typeattributeset oem_lock_service_202504 (oem_lock_service))
+(expandtypeattribute (oem_lock_service_202504) true)
+(typeattribute oem_lock_service_202504)
+(typeattributeset audioserver_202504 (audioserver))
+(expandtypeattribute (audioserver_202504) true)
+(typeattribute audioserver_202504)
+(typeattributeset tmpfs_202504 (tmpfs))
+(expandtypeattribute (tmpfs_202504) true)
+(typeattribute tmpfs_202504)
+(typeattributeset bootanim_exec_202504 (bootanim_exec))
+(expandtypeattribute (bootanim_exec_202504) true)
+(typeattribute bootanim_exec_202504)
+(typeattributeset hal_gnss_service_202504 (hal_gnss_service))
+(expandtypeattribute (hal_gnss_service_202504) true)
+(typeattribute hal_gnss_service_202504)
+(typeattributeset vendor_configs_file_202504 (vendor_configs_file))
+(expandtypeattribute (vendor_configs_file_202504) true)
+(typeattribute vendor_configs_file_202504)
+(typeattributeset vendor_shell_exec_202504 (vendor_shell_exec))
+(expandtypeattribute (vendor_shell_exec_202504) true)
+(typeattribute vendor_shell_exec_202504)
+(typeattributeset hwservicemanager_prop_202504 (hwservicemanager_prop))
+(expandtypeattribute (hwservicemanager_prop_202504) true)
+(typeattribute hwservicemanager_prop_202504)
+(typeattributeset servicemanager_prop_202504 (servicemanager_prop))
+(expandtypeattribute (servicemanager_prop_202504) true)
+(typeattribute servicemanager_prop_202504)
+(typeattributeset tv_ad_service_202504 (tv_ad_service))
+(expandtypeattribute (tv_ad_service_202504) true)
+(typeattribute tv_ad_service_202504)
+(typeattributeset input_device_202504 (input_device))
+(expandtypeattribute (input_device_202504) true)
+(typeattribute input_device_202504)
+(typeattributeset flags_health_check_202504 (flags_health_check))
+(expandtypeattribute (flags_health_check_202504) true)
+(typeattribute flags_health_check_202504)
+(typeattributeset ueventd_tmpfs_202504 (ueventd_tmpfs))
+(expandtypeattribute (ueventd_tmpfs_202504) true)
+(typeattribute ueventd_tmpfs_202504)
+(typeattributeset DockObserver_service_202504 (DockObserver_service))
+(expandtypeattribute (DockObserver_service_202504) true)
+(typeattribute DockObserver_service_202504)
+(typeattributeset shell_data_file_202504 (shell_data_file))
+(expandtypeattribute (shell_data_file_202504) true)
+(typeattribute shell_data_file_202504)
+(typeattributeset bluetooth_manager_service_202504 (bluetooth_manager_service))
+(expandtypeattribute (bluetooth_manager_service_202504) true)
+(typeattribute bluetooth_manager_service_202504)
+(typeattributeset contexthub_service_202504 (contexthub_service))
+(expandtypeattribute (contexthub_service_202504) true)
+(typeattribute contexthub_service_202504)
+(typeattributeset setupwizard_mode_prop_202504 (setupwizard_mode_prop))
+(expandtypeattribute (setupwizard_mode_prop_202504) true)
+(typeattribute setupwizard_mode_prop_202504)
+(typeattributeset hal_wifi_hostapd_service_202504 (hal_wifi_hostapd_service))
+(expandtypeattribute (hal_wifi_hostapd_service_202504) true)
+(typeattribute hal_wifi_hostapd_service_202504)
+(typeattributeset dnsmasq_202504 (dnsmasq))
+(expandtypeattribute (dnsmasq_202504) true)
+(typeattribute dnsmasq_202504)
+(typeattributeset dumpstate_202504 (dumpstate))
+(expandtypeattribute (dumpstate_202504) true)
+(typeattribute dumpstate_202504)
+(typeattributeset system_suspend_hwservice_202504 (system_suspend_hwservice))
+(expandtypeattribute (system_suspend_hwservice_202504) true)
+(typeattribute system_suspend_hwservice_202504)
+(typeattributeset hal_vehicle_hwservice_202504 (hal_vehicle_hwservice))
+(expandtypeattribute (hal_vehicle_hwservice_202504) true)
+(typeattribute hal_vehicle_hwservice_202504)
+(typeattributeset hal_usb_gadget_service_202504 (hal_usb_gadget_service))
+(expandtypeattribute (hal_usb_gadget_service_202504) true)
+(typeattribute hal_usb_gadget_service_202504)
+(typeattributeset bootloader_boot_reason_prop_202504 (bootloader_boot_reason_prop))
+(expandtypeattribute (bootloader_boot_reason_prop_202504) true)
+(typeattribute bootloader_boot_reason_prop_202504)
+(typeattributeset early_virtmgr_exec_202504 (early_virtmgr_exec))
+(expandtypeattribute (early_virtmgr_exec_202504) true)
+(typeattribute early_virtmgr_exec_202504)
+(typeattributeset install_data_file_202504 (install_data_file))
+(expandtypeattribute (install_data_file_202504) true)
+(typeattribute install_data_file_202504)
+(typeattributeset asec_image_file_202504 (asec_image_file))
+(expandtypeattribute (asec_image_file_202504) true)
+(typeattribute asec_image_file_202504)
+(typeattributeset iris_vendor_data_file_202504 (iris_vendor_data_file))
+(expandtypeattribute (iris_vendor_data_file_202504) true)
+(typeattribute iris_vendor_data_file_202504)
+(typeattributeset hardware_properties_service_202504 (hardware_properties_service))
+(expandtypeattribute (hardware_properties_service_202504) true)
+(typeattribute hardware_properties_service_202504)
+(typeattributeset owntty_device_202504 (owntty_device))
+(expandtypeattribute (owntty_device_202504) true)
+(typeattribute owntty_device_202504)
+(typeattributeset credential_service_202504 (credential_service))
+(expandtypeattribute (credential_service_202504) true)
+(typeattribute credential_service_202504)
+(typeattributeset virtual_fingerprint_prop_202504 (virtual_fingerprint_prop))
+(expandtypeattribute (virtual_fingerprint_prop_202504) true)
+(typeattribute virtual_fingerprint_prop_202504)
+(typeattributeset null_device_202504 (null_device))
+(expandtypeattribute (null_device_202504) true)
+(typeattribute null_device_202504)
+(typeattributeset isolated_compute_app_202504 (isolated_compute_app))
+(expandtypeattribute (isolated_compute_app_202504) true)
+(typeattribute isolated_compute_app_202504)
+(typeattributeset rkpdapp_202504 (rkpdapp))
+(expandtypeattribute (rkpdapp_202504) true)
+(typeattribute rkpdapp_202504)
+(typeattributeset uimode_service_202504 (uimode_service))
+(expandtypeattribute (uimode_service_202504) true)
+(typeattribute uimode_service_202504)
+(typeattributeset sysfs_devfreq_cur_202504 (sysfs_devfreq_cur))
+(expandtypeattribute (sysfs_devfreq_cur_202504) true)
+(typeattribute sysfs_devfreq_cur_202504)
+(typeattributeset uncrypt_exec_202504 (uncrypt_exec))
+(expandtypeattribute (uncrypt_exec_202504) true)
+(typeattribute uncrypt_exec_202504)
+(typeattributeset priv_app_202504 (priv_app))
+(expandtypeattribute (priv_app_202504) true)
+(typeattribute priv_app_202504)
+(typeattributeset hal_bluetooth_hwservice_202504 (hal_bluetooth_hwservice))
+(expandtypeattribute (hal_bluetooth_hwservice_202504) true)
+(typeattribute hal_bluetooth_hwservice_202504)
+(typeattributeset wifiscanner_service_202504 (wifiscanner_service))
+(expandtypeattribute (wifiscanner_service_202504) true)
+(typeattribute wifiscanner_service_202504)
+(typeattributeset bluetooth_data_file_202504 (bluetooth_data_file))
+(expandtypeattribute (bluetooth_data_file_202504) true)
+(typeattribute bluetooth_data_file_202504)
+(typeattributeset loop_control_device_202504 (loop_control_device))
+(expandtypeattribute (loop_control_device_202504) true)
+(typeattribute loop_control_device_202504)
+(typeattributeset pdx_display_client_endpoint_socket_202504 (pdx_display_client_endpoint_socket))
+(expandtypeattribute (pdx_display_client_endpoint_socket_202504) true)
+(typeattribute pdx_display_client_endpoint_socket_202504)
+(typeattributeset sqlite_log_prop_202504 (sqlite_log_prop))
+(expandtypeattribute (sqlite_log_prop_202504) true)
+(typeattribute sqlite_log_prop_202504)
+(typeattributeset charger_vendor_202504 (charger_vendor))
+(expandtypeattribute (charger_vendor_202504) true)
+(typeattribute charger_vendor_202504)
+(typeattributeset net_dns_prop_202504 (net_dns_prop))
+(expandtypeattribute (net_dns_prop_202504) true)
+(typeattribute net_dns_prop_202504)
+(typeattributeset app_binding_service_202504 (app_binding_service))
+(expandtypeattribute (app_binding_service_202504) true)
+(typeattribute app_binding_service_202504)
+(typeattributeset fingerprintd_202504 (fingerprintd))
+(expandtypeattribute (fingerprintd_202504) true)
+(typeattribute fingerprintd_202504)
+(typeattributeset bluetooth_prop_202504 (bluetooth_prop))
+(expandtypeattribute (bluetooth_prop_202504) true)
+(typeattribute bluetooth_prop_202504)
+(typeattributeset hal_ir_service_202504 (hal_ir_service))
+(expandtypeattribute (hal_ir_service_202504) true)
+(typeattribute hal_ir_service_202504)
+(typeattributeset hal_power_hwservice_202504 (hal_power_hwservice))
+(expandtypeattribute (hal_power_hwservice_202504) true)
+(typeattribute hal_power_hwservice_202504)
+(typeattributeset sysfs_suspend_stats_202504 (sysfs_suspend_stats))
+(expandtypeattribute (sysfs_suspend_stats_202504) true)
+(typeattribute sysfs_suspend_stats_202504)
+(typeattributeset hal_fingerprint_hwservice_202504 (hal_fingerprint_hwservice))
+(expandtypeattribute (hal_fingerprint_hwservice_202504) true)
+(typeattribute hal_fingerprint_hwservice_202504)
+(typeattributeset exported_pm_prop_202504 (exported_pm_prop))
+(expandtypeattribute (exported_pm_prop_202504) true)
+(typeattribute exported_pm_prop_202504)
+(typeattributeset future_pm_prop_202504 (future_pm_prop))
+(expandtypeattribute (future_pm_prop_202504) true)
+(typeattribute future_pm_prop_202504)
+(typeattributeset hal_can_controller_hwservice_202504 (hal_can_controller_hwservice))
+(expandtypeattribute (hal_can_controller_hwservice_202504) true)
+(typeattribute hal_can_controller_hwservice_202504)
+(typeattributeset gesture_prop_202504 (gesture_prop))
+(expandtypeattribute (gesture_prop_202504) true)
+(typeattribute gesture_prop_202504)
+(typeattributeset ctl_restart_prop_202504 (ctl_restart_prop))
+(expandtypeattribute (ctl_restart_prop_202504) true)
+(typeattribute ctl_restart_prop_202504)
+(typeattributeset font_service_202504 (font_service))
+(expandtypeattribute (font_service_202504) true)
+(typeattribute font_service_202504)
+(typeattributeset suspend_prop_202504 (suspend_prop))
+(expandtypeattribute (suspend_prop_202504) true)
+(typeattribute suspend_prop_202504)
+(typeattributeset zygote_config_prop_202504 (zygote_config_prop))
+(expandtypeattribute (zygote_config_prop_202504) true)
+(typeattribute zygote_config_prop_202504)
+(typeattributeset proc_kallsyms_202504 (proc_kallsyms))
+(expandtypeattribute (proc_kallsyms_202504) true)
+(typeattribute proc_kallsyms_202504)
+(typeattributeset system_group_file_202504 (system_group_file))
+(expandtypeattribute (system_group_file_202504) true)
+(typeattribute system_group_file_202504)
+(typeattributeset postinstall_file_202504 (postinstall_file))
+(expandtypeattribute (postinstall_file_202504) true)
+(typeattribute postinstall_file_202504)
+(typeattributeset exported3_system_prop_202504 (exported3_system_prop))
+(expandtypeattribute (exported3_system_prop_202504) true)
+(typeattribute exported3_system_prop_202504)
+(typeattributeset exported_dumpstate_prop_202504 (exported_dumpstate_prop))
+(expandtypeattribute (exported_dumpstate_prop_202504) true)
+(typeattribute exported_dumpstate_prop_202504)
+(typeattributeset ctl_bugreport_prop_202504 (ctl_bugreport_prop))
+(expandtypeattribute (ctl_bugreport_prop_202504) true)
+(typeattribute ctl_bugreport_prop_202504)
+(typeattributeset proc_cgroups_202504 (proc_cgroups))
+(expandtypeattribute (proc_cgroups_202504) true)
+(typeattribute proc_cgroups_202504)
+(typeattributeset virtualizationmanager_202504 (virtualizationmanager))
+(expandtypeattribute (virtualizationmanager_202504) true)
+(typeattribute virtualizationmanager_202504)
+(typeattributeset hal_identity_service_202504 (hal_identity_service))
+(expandtypeattribute (hal_identity_service_202504) true)
+(typeattribute hal_identity_service_202504)
+(typeattributeset vold_service_202504 (vold_service))
+(expandtypeattribute (vold_service_202504) true)
+(typeattribute vold_service_202504)
+(typeattributeset role_service_202504 (role_service))
+(expandtypeattribute (role_service_202504) true)
+(typeattribute role_service_202504)
+(typeattributeset device_config_edgetpu_native_prop_202504 (device_config_edgetpu_native_prop))
+(expandtypeattribute (device_config_edgetpu_native_prop_202504) true)
+(typeattribute device_config_edgetpu_native_prop_202504)
+(typeattributeset system_user_mode_emulation_prop_202504 (system_user_mode_emulation_prop))
+(expandtypeattribute (system_user_mode_emulation_prop_202504) true)
+(typeattribute system_user_mode_emulation_prop_202504)
+(typeattributeset hal_tv_input_hwservice_202504 (hal_tv_input_hwservice))
+(expandtypeattribute (hal_tv_input_hwservice_202504) true)
+(typeattribute hal_tv_input_hwservice_202504)
+(typeattributeset dalvik_prop_202504 (dalvik_prop))
+(expandtypeattribute (dalvik_prop_202504) true)
+(typeattribute dalvik_prop_202504)
+(typeattributeset inputflinger_service_202504 (inputflinger_service))
+(expandtypeattribute (inputflinger_service_202504) true)
+(typeattribute inputflinger_service_202504)
+(typeattributeset system_lmk_prop_202504 (system_lmk_prop))
+(expandtypeattribute (system_lmk_prop_202504) true)
+(typeattribute system_lmk_prop_202504)
+(typeattributeset oem_unlock_prop_202504 (oem_unlock_prop))
+(expandtypeattribute (oem_unlock_prop_202504) true)
+(typeattribute oem_unlock_prop_202504)
+(typeattributeset vendor_vm_data_file_202504 (vendor_vm_data_file))
+(expandtypeattribute (vendor_vm_data_file_202504) true)
+(typeattribute vendor_vm_data_file_202504)
+(typeattributeset mtpd_socket_202504 (mtpd_socket))
+(expandtypeattribute (mtpd_socket_202504) true)
+(typeattribute mtpd_socket_202504)
+(typeattributeset keystore_service_202504 (keystore_service))
+(expandtypeattribute (keystore_service_202504) true)
+(typeattribute keystore_service_202504)
+(typeattributeset framework_status_prop_202504 (framework_status_prop))
+(expandtypeattribute (framework_status_prop_202504) true)
+(typeattribute framework_status_prop_202504)
+(typeattributeset apex_ota_reserved_file_202504 (apex_ota_reserved_file))
+(expandtypeattribute (apex_ota_reserved_file_202504) true)
+(typeattribute apex_ota_reserved_file_202504)
+(typeattributeset bluetooth_service_202504 (bluetooth_service))
+(expandtypeattribute (bluetooth_service_202504) true)
+(typeattribute bluetooth_service_202504)
+(typeattributeset search_ui_service_202504 (search_ui_service))
+(expandtypeattribute (search_ui_service_202504) true)
+(typeattribute search_ui_service_202504)
+(typeattributeset qemu_hw_prop_202504 (qemu_hw_prop))
+(expandtypeattribute (qemu_hw_prop_202504) true)
+(typeattribute qemu_hw_prop_202504)
+(typeattributeset appops_service_202504 (appops_service))
+(expandtypeattribute (appops_service_202504) true)
+(typeattribute appops_service_202504)
+(typeattributeset extra_free_kbytes_exec_202504 (extra_free_kbytes_exec))
+(expandtypeattribute (extra_free_kbytes_exec_202504) true)
+(typeattribute extra_free_kbytes_exec_202504)
+(typeattributeset sysfs_kernel_notes_202504 (sysfs_kernel_notes))
+(expandtypeattribute (sysfs_kernel_notes_202504) true)
+(typeattribute sysfs_kernel_notes_202504)
+(typeattributeset system_data_file_202504 (system_data_file))
+(expandtypeattribute (system_data_file_202504) true)
+(typeattribute system_data_file_202504)
+(typeattributeset system_dlkm_file_202504 (system_dlkm_file))
+(expandtypeattribute (system_dlkm_file_202504) true)
+(typeattribute system_dlkm_file_202504)
+(typeattributeset devpts_202504 (devpts))
+(expandtypeattribute (devpts_202504) true)
+(typeattribute devpts_202504)
+(typeattributeset drm_data_file_202504 (drm_data_file))
+(expandtypeattribute (drm_data_file_202504) true)
+(typeattribute drm_data_file_202504)
+(typeattributeset hal_broadcastradio_hwservice_202504 (hal_broadcastradio_hwservice))
+(expandtypeattribute (hal_broadcastradio_hwservice_202504) true)
+(typeattribute hal_broadcastradio_hwservice_202504)
+(typeattributeset cacheinfo_service_202504 (cacheinfo_service))
+(expandtypeattribute (cacheinfo_service_202504) true)
+(typeattribute cacheinfo_service_202504)
+(typeattributeset system_net_netd_hwservice_202504 (system_net_netd_hwservice))
+(expandtypeattribute (system_net_netd_hwservice_202504) true)
+(typeattribute system_net_netd_hwservice_202504)
+(typeattributeset dalvik_config_prop_202504 (dalvik_config_prop))
+(expandtypeattribute (dalvik_config_prop_202504) true)
+(typeattribute dalvik_config_prop_202504)
+(typeattributeset codec2_config_prop_202504 (codec2_config_prop))
+(expandtypeattribute (codec2_config_prop_202504) true)
+(typeattribute codec2_config_prop_202504)
+(typeattributeset su_202504 (su))
+(expandtypeattribute (su_202504) true)
+(typeattribute su_202504)
+(typeattributeset wallpaper_effects_generation_service_202504 (wallpaper_effects_generation_service))
+(expandtypeattribute (wallpaper_effects_generation_service_202504) true)
+(typeattribute wallpaper_effects_generation_service_202504)
+(typeattributeset dmabuf_heap_device_202504 (dmabuf_heap_device))
+(expandtypeattribute (dmabuf_heap_device_202504) true)
+(typeattribute dmabuf_heap_device_202504)
+(typeattributeset update_engine_log_data_file_202504 (update_engine_log_data_file))
+(expandtypeattribute (update_engine_log_data_file_202504) true)
+(typeattribute update_engine_log_data_file_202504)
+(typeattributeset otadexopt_service_202504 (otadexopt_service))
+(expandtypeattribute (otadexopt_service_202504) true)
+(typeattribute otadexopt_service_202504)
+(typeattributeset proc_abi_202504 (proc_abi))
+(expandtypeattribute (proc_abi_202504) true)
+(typeattribute proc_abi_202504)
+(typeattributeset camera_config_prop_202504 (camera_config_prop))
+(expandtypeattribute (camera_config_prop_202504) true)
+(typeattribute camera_config_prop_202504)
+(typeattributeset proc_security_202504 (proc_security))
+(expandtypeattribute (proc_security_202504) true)
+(typeattribute proc_security_202504)
+(typeattributeset hal_nfc_service_202504 (hal_nfc_service))
+(expandtypeattribute (hal_nfc_service_202504) true)
+(typeattribute hal_nfc_service_202504)
+(typeattributeset nfc_service_202504 (nfc_service))
+(expandtypeattribute (nfc_service_202504) true)
+(typeattribute nfc_service_202504)
+(typeattributeset rs_202504 (rs))
+(expandtypeattribute (rs_202504) true)
+(typeattribute rs_202504)
+(typeattributeset settings_service_202504 (settings_service))
+(expandtypeattribute (settings_service_202504) true)
+(typeattribute settings_service_202504)
+(typeattributeset atrace_202504 (atrace))
+(expandtypeattribute (atrace_202504) true)
+(typeattribute atrace_202504)
+(typeattributeset ecm_enhanced_confirmation_service_202504 (ecm_enhanced_confirmation_service))
+(expandtypeattribute (ecm_enhanced_confirmation_service_202504) true)
+(typeattribute ecm_enhanced_confirmation_service_202504)
+(typeattributeset debugfs_tracing_debug_202504 (debugfs_tracing_debug))
+(expandtypeattribute (debugfs_tracing_debug_202504) true)
+(typeattribute debugfs_tracing_debug_202504)
+(typeattributeset bluetooth_finder_prop_202504 (bluetooth_finder_prop))
+(expandtypeattribute (bluetooth_finder_prop_202504) true)
+(typeattribute bluetooth_finder_prop_202504)
+(typeattributeset cpuinfo_service_202504 (cpuinfo_service))
+(expandtypeattribute (cpuinfo_service_202504) true)
+(typeattribute cpuinfo_service_202504)
+(typeattributeset dbinfo_service_202504 (dbinfo_service))
+(expandtypeattribute (dbinfo_service_202504) true)
+(typeattribute dbinfo_service_202504)
+(typeattributeset gfxinfo_service_202504 (gfxinfo_service))
+(expandtypeattribute (gfxinfo_service_202504) true)
+(typeattribute gfxinfo_service_202504)
+(typeattributeset meminfo_service_202504 (meminfo_service))
+(expandtypeattribute (meminfo_service_202504) true)
+(typeattribute meminfo_service_202504)
+(typeattributeset bugreport_service_202504 (bugreport_service))
+(expandtypeattribute (bugreport_service_202504) true)
+(typeattribute bugreport_service_202504)
+(typeattributeset dnsmasq_exec_202504 (dnsmasq_exec))
+(expandtypeattribute (dnsmasq_exec_202504) true)
+(typeattribute dnsmasq_exec_202504)
+(typeattributeset content_suggestions_service_202504 (content_suggestions_service))
+(expandtypeattribute (content_suggestions_service_202504) true)
+(typeattribute content_suggestions_service_202504)
+(typeattributeset aaudio_config_prop_202504 (aaudio_config_prop))
+(expandtypeattribute (aaudio_config_prop_202504) true)
+(typeattribute aaudio_config_prop_202504)
+(typeattributeset ppp_202504 (ppp))
+(expandtypeattribute (ppp_202504) true)
+(typeattribute ppp_202504)
+(typeattributeset vndbinder_device_202504 (vndbinder_device))
+(expandtypeattribute (vndbinder_device_202504) true)
+(typeattribute vndbinder_device_202504)
+(typeattributeset credstore_service_202504 (credstore_service))
+(expandtypeattribute (credstore_service_202504) true)
+(typeattribute credstore_service_202504)
+(typeattributeset ethernet_service_202504 (ethernet_service))
+(expandtypeattribute (ethernet_service_202504) true)
+(typeattribute ethernet_service_202504)
+(typeattributeset pinner_service_202504 (pinner_service))
+(expandtypeattribute (pinner_service_202504) true)
+(typeattribute pinner_service_202504)
+(typeattributeset performanced_202504 (performanced))
+(expandtypeattribute (performanced_202504) true)
+(typeattribute performanced_202504)
+(typeattributeset systemkeys_data_file_202504 (systemkeys_data_file))
+(expandtypeattribute (systemkeys_data_file_202504) true)
+(typeattribute systemkeys_data_file_202504)
+(typeattributeset network_watchlist_data_file_202504 (network_watchlist_data_file))
+(expandtypeattribute (network_watchlist_data_file_202504) true)
+(typeattribute network_watchlist_data_file_202504)
+(typeattributeset binder_device_202504 (binder_device))
+(expandtypeattribute (binder_device_202504) true)
+(typeattribute binder_device_202504)
+(typeattributeset hwbinder_device_202504 (hwbinder_device))
+(expandtypeattribute (hwbinder_device_202504) true)
+(typeattribute hwbinder_device_202504)
+(typeattributeset hw_random_device_202504 (hw_random_device))
+(expandtypeattribute (hw_random_device_202504) true)
+(typeattribute hw_random_device_202504)
+(typeattributeset random_device_202504 (random_device))
+(expandtypeattribute (random_device_202504) true)
+(typeattribute random_device_202504)
+(typeattributeset cgroup_rc_file_202504 (cgroup_rc_file))
+(expandtypeattribute (cgroup_rc_file_202504) true)
+(typeattribute cgroup_rc_file_202504)
+(typeattributeset ctl_default_prop_202504 (ctl_default_prop))
+(expandtypeattribute (ctl_default_prop_202504) true)
+(typeattribute ctl_default_prop_202504)
+(typeattributeset userdata_block_device_202504 (userdata_block_device))
+(expandtypeattribute (userdata_block_device_202504) true)
+(typeattribute userdata_block_device_202504)
+(typeattributeset default_prop_202504 (default_prop))
+(expandtypeattribute (default_prop_202504) true)
+(typeattribute default_prop_202504)
+(typeattributeset hal_graphics_composer_service_202504 (hal_graphics_composer_service))
+(expandtypeattribute (hal_graphics_composer_service_202504) true)
+(typeattribute hal_graphics_composer_service_202504)
+(typeattributeset vndk_sp_file_202504 (vndk_sp_file))
+(expandtypeattribute (vndk_sp_file_202504) true)
+(typeattribute vndk_sp_file_202504)
+(typeattributeset cameraserver_202504 (cameraserver))
+(expandtypeattribute (cameraserver_202504) true)
+(typeattribute cameraserver_202504)
+(typeattributeset debuggerd_prop_202504 (debuggerd_prop))
+(expandtypeattribute (debuggerd_prop_202504) true)
+(typeattribute debuggerd_prop_202504)
+(typeattributeset vendor_toolbox_exec_202504 (vendor_toolbox_exec))
+(expandtypeattribute (vendor_toolbox_exec_202504) true)
+(typeattribute vendor_toolbox_exec_202504)
+(typeattributeset shared_relro_file_202504 (shared_relro_file))
+(expandtypeattribute (shared_relro_file_202504) true)
+(typeattribute shared_relro_file_202504)
+(typeattributeset app_function_service_202504 (app_function_service))
+(expandtypeattribute (app_function_service_202504) true)
+(typeattribute app_function_service_202504)
+(typeattributeset lmkd_socket_202504 (lmkd_socket))
+(expandtypeattribute (lmkd_socket_202504) true)
+(typeattribute lmkd_socket_202504)
+(typeattributeset hal_drm_hwservice_202504 (hal_drm_hwservice))
+(expandtypeattribute (hal_drm_hwservice_202504) true)
+(typeattribute hal_drm_hwservice_202504)
+(typeattributeset ringtone_file_202504 (ringtone_file))
+(expandtypeattribute (ringtone_file_202504) true)
+(typeattribute ringtone_file_202504)
+(typeattributeset toolbox_exec_202504 (toolbox_exec))
+(expandtypeattribute (toolbox_exec_202504) true)
+(typeattribute toolbox_exec_202504)
+(typeattributeset permission_service_202504 (permission_service))
+(expandtypeattribute (permission_service_202504) true)
+(typeattribute permission_service_202504)
+(typeattributeset metadata_block_device_202504 (metadata_block_device))
+(expandtypeattribute (metadata_block_device_202504) true)
+(typeattribute metadata_block_device_202504)
+(typeattributeset logd_socket_202504 (logd_socket))
+(expandtypeattribute (logd_socket_202504) true)
+(typeattribute logd_socket_202504)
+(typeattributeset vendor_default_prop_202504 (vendor_default_prop))
+(expandtypeattribute (vendor_default_prop_202504) true)
+(typeattribute vendor_default_prop_202504)
+(typeattributeset mac_perms_file_202504 (mac_perms_file))
+(expandtypeattribute (mac_perms_file_202504) true)
+(typeattribute mac_perms_file_202504)
+(typeattributeset gmscore_app_202504 (gmscore_app))
+(expandtypeattribute (gmscore_app_202504) true)
+(typeattribute gmscore_app_202504)
+(typeattributeset vendor_app_file_202504 (vendor_app_file))
+(expandtypeattribute (vendor_app_file_202504) true)
+(typeattribute vendor_app_file_202504)
+(typeattributeset vendor_hal_file_202504 (vendor_hal_file))
+(expandtypeattribute (vendor_hal_file_202504) true)
+(typeattribute vendor_hal_file_202504)
+(typeattributeset vendor_idc_file_202504 (vendor_idc_file))
+(expandtypeattribute (vendor_idc_file_202504) true)
+(typeattribute vendor_idc_file_202504)
+(typeattributeset pac_proxy_service_202504 (pac_proxy_service))
+(expandtypeattribute (pac_proxy_service_202504) true)
+(typeattribute pac_proxy_service_202504)
+(typeattributeset virtual_ab_prop_202504 (virtual_ab_prop))
+(expandtypeattribute (virtual_ab_prop_202504) true)
+(typeattribute virtual_ab_prop_202504)
+(typeattributeset art_apex_dir_202504 (art_apex_dir))
+(expandtypeattribute (art_apex_dir_202504) true)
+(typeattribute art_apex_dir_202504)
+(typeattributeset sysfs_wlan_fwpath_202504 (sysfs_wlan_fwpath))
+(expandtypeattribute (sysfs_wlan_fwpath_202504) true)
+(typeattribute sysfs_wlan_fwpath_202504)
+(typeattributeset hal_face_service_202504 (hal_face_service))
+(expandtypeattribute (hal_face_service_202504) true)
+(typeattribute hal_face_service_202504)
+(typeattributeset nfc_202504 (nfc))
+(expandtypeattribute (nfc_202504) true)
+(typeattribute nfc_202504)
+(typeattributeset ondevicepersonalization_system_service_202504 (ondevicepersonalization_system_service))
+(expandtypeattribute (ondevicepersonalization_system_service_202504) true)
+(typeattribute ondevicepersonalization_system_service_202504)
+(typeattributeset face_service_202504 (face_service))
+(expandtypeattribute (face_service_202504) true)
+(typeattribute face_service_202504)
+(typeattributeset default_android_vndservice_202504 (default_android_vndservice))
+(expandtypeattribute (default_android_vndservice_202504) true)
+(typeattribute default_android_vndservice_202504)
+(typeattributeset rtc_device_202504 (rtc_device))
+(expandtypeattribute (rtc_device_202504) true)
+(typeattribute rtc_device_202504)
+(typeattributeset snapuserd_socket_202504 (snapuserd_socket))
+(expandtypeattribute (snapuserd_socket_202504) true)
+(typeattribute snapuserd_socket_202504)
+(typeattributeset hal_system_suspend_service_202504 (hal_system_suspend_service))
+(expandtypeattribute (hal_system_suspend_service_202504) true)
+(typeattribute hal_system_suspend_service_202504)
+(typeattributeset rollback_service_202504 (rollback_service))
+(expandtypeattribute (rollback_service_202504) true)
+(typeattribute rollback_service_202504)
+(typeattributeset ram_device_202504 (ram_device))
+(expandtypeattribute (ram_device_202504) true)
+(typeattribute ram_device_202504)
+(typeattributeset radio_core_data_file_202504 (radio_core_data_file))
+(expandtypeattribute (radio_core_data_file_202504) true)
+(typeattribute radio_core_data_file_202504)
+(typeattributeset nativetest_data_file_202504 (nativetest_data_file))
+(expandtypeattribute (nativetest_data_file_202504) true)
+(typeattribute nativetest_data_file_202504)
+(typeattributeset country_detector_service_202504 (country_detector_service))
+(expandtypeattribute (country_detector_service_202504) true)
+(typeattribute country_detector_service_202504)
+(typeattributeset cgroup_202504 (cgroup))
+(expandtypeattribute (cgroup_202504) true)
+(typeattribute cgroup_202504)
+(typeattributeset drmserver_socket_202504 (drmserver_socket))
+(expandtypeattribute (drmserver_socket_202504) true)
+(typeattribute drmserver_socket_202504)
+(typeattributeset credstore_202504 (credstore))
+(expandtypeattribute (credstore_202504) true)
+(typeattribute credstore_202504)
+(typeattributeset proc_net_202504 (proc_net))
+(expandtypeattribute (proc_net_202504) true)
+(typeattribute proc_net_202504)
+(typeattributeset untrusted_app_30_202504 (untrusted_app_30))
+(expandtypeattribute (untrusted_app_30_202504) true)
+(typeattribute untrusted_app_30_202504)
+(typeattributeset zygote_202504 (zygote))
+(expandtypeattribute (zygote_202504) true)
+(typeattribute zygote_202504)
+(typeattributeset untrusted_app_32_202504 (untrusted_app_32))
+(expandtypeattribute (untrusted_app_32_202504) true)
+(typeattribute untrusted_app_32_202504)
+(typeattributeset vendor_data_file_202504 (vendor_data_file))
+(expandtypeattribute (vendor_data_file_202504) true)
+(typeattribute vendor_data_file_202504)
+(typeattributeset mirror_data_file_202504 (mirror_data_file))
+(expandtypeattribute (mirror_data_file_202504) true)
+(typeattribute mirror_data_file_202504)
+(typeattributeset rebootescrow_hal_prop_202504 (rebootescrow_hal_prop))
+(expandtypeattribute (rebootescrow_hal_prop_202504) true)
+(typeattribute rebootescrow_hal_prop_202504)
+(typeattributeset untrusted_app_25_202504 (untrusted_app_25))
+(expandtypeattribute (untrusted_app_25_202504) true)
+(typeattribute untrusted_app_25_202504)
+(typeattributeset untrusted_app_27_202504 (untrusted_app_27))
+(expandtypeattribute (untrusted_app_27_202504) true)
+(typeattribute untrusted_app_27_202504)
+(typeattributeset vendor_apex_file_202504 (vendor_apex_file))
+(expandtypeattribute (vendor_apex_file_202504) true)
+(typeattribute vendor_apex_file_202504)
+(typeattributeset watchdog_metadata_file_202504 (watchdog_metadata_file))
+(expandtypeattribute (watchdog_metadata_file_202504) true)
+(typeattribute watchdog_metadata_file_202504)
+(typeattributeset adb_data_file_202504 (adb_data_file))
+(expandtypeattribute (adb_data_file_202504) true)
+(typeattribute adb_data_file_202504)
+(typeattributeset anr_data_file_202504 (anr_data_file))
+(expandtypeattribute (anr_data_file_202504) true)
+(typeattribute anr_data_file_202504)
+(typeattributeset cgroup_v2_202504 (cgroup_v2))
+(expandtypeattribute (cgroup_v2_202504) true)
+(typeattribute cgroup_v2_202504)
+(typeattributeset adb_keys_file_202504 (adb_keys_file))
+(expandtypeattribute (adb_keys_file_202504) true)
+(typeattribute adb_keys_file_202504)
+(typeattributeset mm_events_config_prop_202504 (mm_events_config_prop))
+(expandtypeattribute (mm_events_config_prop_202504) true)
+(typeattribute mm_events_config_prop_202504)
+(typeattributeset input_device_config_prop_202504 (input_device_config_prop))
+(expandtypeattribute (input_device_config_prop_202504) true)
+(typeattribute input_device_config_prop_202504)
+(typeattributeset kernel_202504 (kernel))
+(expandtypeattribute (kernel_202504) true)
+(typeattribute kernel_202504)
+(typeattributeset servicediscovery_service_202504 (servicediscovery_service))
+(expandtypeattribute (servicediscovery_service_202504) true)
+(typeattribute servicediscovery_service_202504)
+(typeattributeset untrusted_app_29_202504 (untrusted_app_29))
+(expandtypeattribute (untrusted_app_29_202504) true)
+(typeattribute untrusted_app_29_202504)
+(typeattributeset securityfs_202504 (securityfs))
+(expandtypeattribute (securityfs_202504) true)
+(typeattribute securityfs_202504)
+(typeattributeset appcompat_data_file_202504 (appcompat_data_file))
+(expandtypeattribute (appcompat_data_file_202504) true)
+(typeattribute appcompat_data_file_202504)
+(typeattributeset coverage_service_202504 (coverage_service))
+(expandtypeattribute (coverage_service_202504) true)
+(typeattribute coverage_service_202504)
+(typeattributeset keystore_202504 (keystore))
+(expandtypeattribute (keystore_202504) true)
+(typeattribute keystore_202504)
+(typeattributeset fastbootd_202504 (fastbootd))
+(expandtypeattribute (fastbootd_202504) true)
+(typeattribute fastbootd_202504)
+(typeattributeset package_service_202504 (package_service))
+(expandtypeattribute (package_service_202504) true)
+(typeattribute package_service_202504)
+(typeattributeset shutdown_checkpoints_system_data_file_202504 (shutdown_checkpoints_system_data_file))
+(expandtypeattribute (shutdown_checkpoints_system_data_file_202504) true)
+(typeattribute shutdown_checkpoints_system_data_file_202504)
+(typeattributeset ephemeral_app_202504 (ephemeral_app))
+(expandtypeattribute (ephemeral_app_202504) true)
+(typeattribute ephemeral_app_202504)
+(typeattributeset bluetooth_202504 (bluetooth))
+(expandtypeattribute (bluetooth_202504) true)
+(typeattribute bluetooth_202504)
+(typeattributeset inputflinger_202504 (inputflinger))
+(expandtypeattribute (inputflinger_202504) true)
+(typeattribute inputflinger_202504)
+(typeattributeset sysfs_net_202504 (sysfs_net))
+(expandtypeattribute (sysfs_net_202504) true)
+(typeattribute sysfs_net_202504)
+(typeattributeset hal_atrace_hwservice_202504 (hal_atrace_hwservice))
+(expandtypeattribute (hal_atrace_hwservice_202504) true)
+(typeattribute hal_atrace_hwservice_202504)
+(typeattributeset hal_oemlock_hwservice_202504 (hal_oemlock_hwservice))
+(expandtypeattribute (hal_oemlock_hwservice_202504) true)
+(typeattribute hal_oemlock_hwservice_202504)
+(typeattributeset port_202504 (port))
+(expandtypeattribute (port_202504) true)
+(typeattribute port_202504)
+(typeattributeset apexd_exec_202504 (apexd_exec))
+(expandtypeattribute (apexd_exec_202504) true)
+(typeattribute apexd_exec_202504)
+(typeattributeset keystore_metrics_service_202504 (keystore_metrics_service))
+(expandtypeattribute (keystore_metrics_service_202504) true)
+(typeattribute keystore_metrics_service_202504)
+(typeattributeset contextual_search_service_202504 (contextual_search_service))
+(expandtypeattribute (contextual_search_service_202504) true)
+(typeattribute contextual_search_service_202504)
+(typeattributeset virtual_touchpad_exec_202504 (virtual_touchpad_exec))
+(expandtypeattribute (virtual_touchpad_exec_202504) true)
+(typeattribute virtual_touchpad_exec_202504)
+(typeattributeset hal_secure_element_service_202504 (hal_secure_element_service))
+(expandtypeattribute (hal_secure_element_service_202504) true)
+(typeattribute hal_secure_element_service_202504)
+(typeattributeset runas_202504 (runas))
+(expandtypeattribute (runas_202504) true)
+(typeattribute runas_202504)
+(typeattributeset tty_device_202504 (tty_device))
+(expandtypeattribute (tty_device_202504) true)
+(typeattribute tty_device_202504)
+(typeattributeset tun_device_202504 (tun_device))
+(expandtypeattribute (tun_device_202504) true)
+(typeattribute tun_device_202504)
+(typeattributeset system_event_log_tags_file_202504 (system_event_log_tags_file))
+(expandtypeattribute (system_event_log_tags_file_202504) true)
+(typeattribute system_event_log_tags_file_202504)
+(typeattributeset uio_device_202504 (uio_device))
+(expandtypeattribute (uio_device_202504) true)
+(typeattribute uio_device_202504)
+(typeattributeset hal_vm_capabilities_service_202504 (hal_vm_capabilities_service))
+(expandtypeattribute (hal_vm_capabilities_service_202504) true)
+(typeattribute hal_vm_capabilities_service_202504)
+(typeattributeset usb_device_202504 (usb_device))
+(expandtypeattribute (usb_device_202504) true)
+(typeattribute usb_device_202504)
+(typeattributeset adb_service_202504 (adb_service))
+(expandtypeattribute (adb_service_202504) true)
+(typeattribute adb_service_202504)
+(typeattributeset hal_oemlock_service_202504 (hal_oemlock_service))
+(expandtypeattribute (hal_oemlock_service_202504) true)
+(typeattribute hal_oemlock_service_202504)
+(typeattributeset tv_input_service_202504 (tv_input_service))
+(expandtypeattribute (tv_input_service_202504) true)
+(typeattribute tv_input_service_202504)
+(typeattributeset input_service_202504 (input_service))
+(expandtypeattribute (input_service_202504) true)
+(typeattribute input_service_202504)
+(typeattributeset tee_device_202504 (tee_device))
+(expandtypeattribute (tee_device_202504) true)
+(typeattribute tee_device_202504)
+(typeattributeset hal_memtrack_hwservice_202504 (hal_memtrack_hwservice))
+(expandtypeattribute (hal_memtrack_hwservice_202504) true)
+(typeattribute hal_memtrack_hwservice_202504)
+(typeattributeset radio_device_202504 (radio_device))
+(expandtypeattribute (radio_device_202504) true)
+(typeattribute radio_device_202504)
+(typeattributeset bootstat_data_file_202504 (bootstat_data_file))
+(expandtypeattribute (bootstat_data_file_202504) true)
+(typeattribute bootstat_data_file_202504)
+(typeattributeset ptmx_device_202504 (ptmx_device))
+(expandtypeattribute (ptmx_device_202504) true)
+(typeattribute ptmx_device_202504)
+(typeattributeset textservices_service_202504 (textservices_service))
+(expandtypeattribute (textservices_service_202504) true)
+(typeattribute textservices_service_202504)
+(typeattributeset hal_power_stats_hwservice_202504 (hal_power_stats_hwservice))
+(expandtypeattribute (hal_power_stats_hwservice_202504) true)
+(typeattribute hal_power_stats_hwservice_202504)
+(typeattributeset usbaccessory_device_202504 (usbaccessory_device))
+(expandtypeattribute (usbaccessory_device_202504) true)
+(typeattribute usbaccessory_device_202504)
+(typeattributeset asec_public_file_202504 (asec_public_file))
+(expandtypeattribute (asec_public_file_202504) true)
+(typeattribute asec_public_file_202504)
+(typeattributeset hal_rebootescrow_service_202504 (hal_rebootescrow_service))
+(expandtypeattribute (hal_rebootescrow_service_202504) true)
+(typeattribute hal_rebootescrow_service_202504)
+(typeattributeset proc_min_free_order_shift_202504 (proc_min_free_order_shift))
+(expandtypeattribute (proc_min_free_order_shift_202504) true)
+(typeattribute proc_min_free_order_shift_202504)
+(typeattributeset bootanim_config_prop_202504 (bootanim_config_prop))
+(expandtypeattribute (bootanim_config_prop_202504) true)
+(typeattribute bootanim_config_prop_202504)
+(typeattributeset fwk_vibrator_control_service_202504 (fwk_vibrator_control_service))
+(expandtypeattribute (fwk_vibrator_control_service_202504) true)
+(typeattribute fwk_vibrator_control_service_202504)
+(typeattributeset hal_usb_hwservice_202504 (hal_usb_hwservice))
+(expandtypeattribute (hal_usb_hwservice_202504) true)
+(typeattribute hal_usb_hwservice_202504)
+(typeattributeset user_profile_root_file_202504 (user_profile_root_file))
+(expandtypeattribute (user_profile_root_file_202504) true)
+(typeattribute user_profile_root_file_202504)
+(typeattributeset recovery_refresh_exec_202504 (recovery_refresh_exec))
+(expandtypeattribute (recovery_refresh_exec_202504) true)
+(typeattribute recovery_refresh_exec_202504)
+(typeattributeset proc_fs_verity_202504 (proc_fs_verity))
+(expandtypeattribute (proc_fs_verity_202504) true)
+(typeattribute proc_fs_verity_202504)
+(typeattributeset pdx_performance_client_endpoint_socket_202504 (pdx_performance_client_endpoint_socket))
+(expandtypeattribute (pdx_performance_client_endpoint_socket_202504) true)
+(typeattribute pdx_performance_client_endpoint_socket_202504)
+(typeattributeset sysfs_dm_verity_202504 (sysfs_dm_verity))
+(expandtypeattribute (sysfs_dm_verity_202504) true)
+(typeattribute sysfs_dm_verity_202504)
+(typeattributeset user_profile_data_file_202504 (user_profile_data_file))
+(expandtypeattribute (user_profile_data_file_202504) true)
+(typeattribute user_profile_data_file_202504)
+(typeattributeset input_method_service_202504 (input_method_service))
+(expandtypeattribute (input_method_service_202504) true)
+(typeattribute input_method_service_202504)
+(typeattributeset binder_cache_telephony_server_prop_202504 (binder_cache_telephony_server_prop))
+(expandtypeattribute (binder_cache_telephony_server_prop_202504) true)
+(typeattribute binder_cache_telephony_server_prop_202504)
+(typeattributeset app_prediction_service_202504 (app_prediction_service))
+(expandtypeattribute (app_prediction_service_202504) true)
+(typeattribute app_prediction_service_202504)
+(typeattributeset media_projection_service_202504 (media_projection_service))
+(expandtypeattribute (media_projection_service_202504) true)
+(typeattribute media_projection_service_202504)
+(typeattributeset racoon_socket_202504 (racoon_socket))
+(expandtypeattribute (racoon_socket_202504) true)
+(typeattribute racoon_socket_202504)
+(typeattributeset proc_vmallocinfo_202504 (proc_vmallocinfo))
+(expandtypeattribute (proc_vmallocinfo_202504) true)
+(typeattribute proc_vmallocinfo_202504)
+(typeattributeset cameraserver_service_202504 (cameraserver_service))
+(expandtypeattribute (cameraserver_service_202504) true)
+(typeattribute cameraserver_service_202504)
+(typeattributeset idmap_exec_202504 (idmap_exec))
+(expandtypeattribute (idmap_exec_202504) true)
+(typeattribute idmap_exec_202504)
+(typeattributeset uncrypt_socket_202504 (uncrypt_socket))
+(expandtypeattribute (uncrypt_socket_202504) true)
+(typeattribute uncrypt_socket_202504)
+(typeattributeset legacy_permission_service_202504 (legacy_permission_service))
+(expandtypeattribute (legacy_permission_service_202504) true)
+(typeattribute legacy_permission_service_202504)
+(typeattributeset logpersistd_logging_prop_202504 (logpersistd_logging_prop))
+(expandtypeattribute (logpersistd_logging_prop_202504) true)
+(typeattribute logpersistd_logging_prop_202504)
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_202504 (hal_configstore_ISurfaceFlingerConfigs))
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_202504) true)
+(typeattribute hal_configstore_ISurfaceFlingerConfigs_202504)
+(typeattributeset hal_ir_hwservice_202504 (hal_ir_hwservice))
+(expandtypeattribute (hal_ir_hwservice_202504) true)
+(typeattribute hal_ir_hwservice_202504)
+(typeattributeset hal_vr_hwservice_202504 (hal_vr_hwservice))
+(expandtypeattribute (hal_vr_hwservice_202504) true)
+(typeattribute hal_vr_hwservice_202504)
+(typeattributeset incident_data_file_202504 (incident_data_file))
+(expandtypeattribute (incident_data_file_202504) true)
+(typeattribute incident_data_file_202504)
+(typeattributeset fwk_stats_hwservice_202504 (fwk_stats_hwservice))
+(expandtypeattribute (fwk_stats_hwservice_202504) true)
+(typeattribute fwk_stats_hwservice_202504)
+(typeattributeset webview_zygote_202504 (webview_zygote))
+(expandtypeattribute (webview_zygote_202504) true)
+(typeattribute webview_zygote_202504)
+(typeattributeset proc_uid_procstat_set_202504 (proc_uid_procstat_set))
+(expandtypeattribute (proc_uid_procstat_set_202504) true)
+(typeattribute proc_uid_procstat_set_202504)
+(typeattributeset vendor_init_202504 (vendor_init))
+(expandtypeattribute (vendor_init_202504) true)
+(typeattribute vendor_init_202504)
+(typeattributeset hal_remotelyprovisionedcomponent_service_202504 (hal_remotelyprovisionedcomponent_service))
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_202504) true)
+(typeattribute hal_remotelyprovisionedcomponent_service_202504)
+(typeattributeset connectivity_service_202504 (connectivity_service))
+(expandtypeattribute (connectivity_service_202504) true)
+(typeattribute connectivity_service_202504)
+(typeattributeset notification_service_202504 (notification_service))
+(expandtypeattribute (notification_service_202504) true)
+(typeattribute notification_service_202504)
+(typeattributeset init_202504 (init))
+(expandtypeattribute (init_202504) true)
+(typeattribute init_202504)
+(typeattributeset game_service_202504 (game_service))
+(expandtypeattribute (game_service_202504) true)
+(typeattribute game_service_202504)
+(typeattributeset hal_audiocontrol_service_202504 (hal_audiocontrol_service))
+(expandtypeattribute (hal_audiocontrol_service_202504) true)
+(typeattribute hal_audiocontrol_service_202504)
+(typeattributeset logpersist_202504 (logpersist))
+(expandtypeattribute (logpersist_202504) true)
+(typeattribute logpersist_202504)
+(typeattributeset dreams_service_202504 (dreams_service))
+(expandtypeattribute (dreams_service_202504) true)
+(typeattribute dreams_service_202504)
+(typeattributeset locale_service_202504 (locale_service))
+(expandtypeattribute (locale_service_202504) true)
+(typeattribute locale_service_202504)
+(typeattributeset companion_device_service_202504 (companion_device_service))
+(expandtypeattribute (companion_device_service_202504) true)
+(typeattribute companion_device_service_202504)
+(typeattributeset bootanim_202504 (bootanim))
+(expandtypeattribute (bootanim_202504) true)
+(typeattribute bootanim_202504)
+(typeattributeset proc_uptime_202504 (proc_uptime))
+(expandtypeattribute (proc_uptime_202504) true)
+(typeattribute proc_uptime_202504)
+(typeattributeset persist_wm_debug_prop_202504 (persist_wm_debug_prop))
+(expandtypeattribute (persist_wm_debug_prop_202504) true)
+(typeattribute persist_wm_debug_prop_202504)
+(typeattributeset ota_package_file_202504 (ota_package_file))
+(expandtypeattribute (ota_package_file_202504) true)
+(typeattribute ota_package_file_202504)
+(typeattributeset diskstats_service_202504 (diskstats_service))
+(expandtypeattribute (diskstats_service_202504) true)
+(typeattribute diskstats_service_202504)
+(typeattributeset fwk_stats_service_202504 (fwk_stats_service))
+(expandtypeattribute (fwk_stats_service_202504) true)
+(typeattribute fwk_stats_service_202504)
+(typeattributeset wallpaper_service_202504 (wallpaper_service))
+(expandtypeattribute (wallpaper_service_202504) true)
+(typeattribute wallpaper_service_202504)
+(typeattributeset fscklogs_202504 (fscklogs))
+(expandtypeattribute (fscklogs_202504) true)
+(typeattribute fscklogs_202504)
+(typeattributeset nnapi_ext_deny_product_prop_202504 (nnapi_ext_deny_product_prop))
+(expandtypeattribute (nnapi_ext_deny_product_prop_202504) true)
+(typeattribute nnapi_ext_deny_product_prop_202504)
+(typeattributeset task_service_202504 (task_service))
+(expandtypeattribute (task_service_202504) true)
+(typeattribute task_service_202504)
+(typeattributeset zygote_tmpfs_202504 (zygote_tmpfs))
+(expandtypeattribute (zygote_tmpfs_202504) true)
+(typeattribute zygote_tmpfs_202504)
+(typeattributeset app_zygote_tmpfs_202504 (app_zygote_tmpfs))
+(expandtypeattribute (app_zygote_tmpfs_202504) true)
+(typeattribute app_zygote_tmpfs_202504)
+(typeattributeset hal_neuralnetworks_service_202504 (hal_neuralnetworks_service))
+(expandtypeattribute (hal_neuralnetworks_service_202504) true)
+(typeattribute hal_neuralnetworks_service_202504)
+(typeattributeset hardware_service_202504 (hardware_service))
+(expandtypeattribute (hardware_service_202504) true)
+(typeattribute hardware_service_202504)
+(typeattributeset logd_202504 (logd))
+(expandtypeattribute (logd_202504) true)
+(typeattribute logd_202504)
+(typeattributeset procstats_service_202504 (procstats_service))
+(expandtypeattribute (procstats_service_202504) true)
+(typeattribute procstats_service_202504)
+(typeattributeset tare_service_202504 (tare_service))
+(expandtypeattribute (tare_service_202504) true)
+(typeattribute tare_service_202504)
+(typeattributeset dumpstate_service_202504 (dumpstate_service))
+(expandtypeattribute (dumpstate_service_202504) true)
+(typeattribute dumpstate_service_202504)
+(typeattributeset fingerprintd_exec_202504 (fingerprintd_exec))
+(expandtypeattribute (fingerprintd_exec_202504) true)
+(typeattribute fingerprintd_exec_202504)
+(typeattributeset alarm_service_202504 (alarm_service))
+(expandtypeattribute (alarm_service_202504) true)
+(typeattribute alarm_service_202504)
+(typeattributeset tv_iapp_service_202504 (tv_iapp_service))
+(expandtypeattribute (tv_iapp_service_202504) true)
+(typeattribute tv_iapp_service_202504)
+(typeattributeset rttmanager_service_202504 (rttmanager_service))
+(expandtypeattribute (rttmanager_service_202504) true)
+(typeattribute rttmanager_service_202504)
+(typeattributeset fwk_sensor_hwservice_202504 (fwk_sensor_hwservice))
+(expandtypeattribute (fwk_sensor_hwservice_202504) true)
+(typeattribute fwk_sensor_hwservice_202504)
+(typeattributeset vendor_uuid_mapping_config_file_202504 (vendor_uuid_mapping_config_file))
+(expandtypeattribute (vendor_uuid_mapping_config_file_202504) true)
+(typeattribute vendor_uuid_mapping_config_file_202504)
+(typeattributeset ueventd_202504 (ueventd))
+(expandtypeattribute (ueventd_202504) true)
+(typeattribute ueventd_202504)
+(typeattributeset node_202504 (node))
+(expandtypeattribute (node_202504) true)
+(typeattribute node_202504)
+(typeattributeset vold_prepare_subdirs_exec_202504 (vold_prepare_subdirs_exec))
+(expandtypeattribute (vold_prepare_subdirs_exec_202504) true)
+(typeattribute vold_prepare_subdirs_exec_202504)
+(typeattributeset sysfs_dm_202504 (sysfs_dm))
+(expandtypeattribute (sysfs_dm_202504) true)
+(typeattribute sysfs_dm_202504)
+(typeattributeset hal_face_hwservice_202504 (hal_face_hwservice))
+(expandtypeattribute (hal_face_hwservice_202504) true)
+(typeattribute hal_face_hwservice_202504)
+(typeattributeset apc_service_202504 (apc_service))
+(expandtypeattribute (apc_service_202504) true)
+(typeattribute apc_service_202504)
+(typeattributeset nfc_data_file_202504 (nfc_data_file))
+(expandtypeattribute (nfc_data_file_202504) true)
+(typeattribute nfc_data_file_202504)
+(typeattributeset stats_data_file_202504 (stats_data_file))
+(expandtypeattribute (stats_data_file_202504) true)
+(typeattribute stats_data_file_202504)
+(typeattributeset hal_contexthub_service_202504 (hal_contexthub_service))
+(expandtypeattribute (hal_contexthub_service_202504) true)
+(typeattribute hal_contexthub_service_202504)
+(typeattributeset misc_logd_file_202504 (misc_logd_file))
+(expandtypeattribute (misc_logd_file_202504) true)
+(typeattribute misc_logd_file_202504)
+(typeattributeset sepolicy_file_202504 (sepolicy_file))
+(expandtypeattribute (sepolicy_file_202504) true)
+(typeattribute sepolicy_file_202504)
+(typeattributeset audioserver_service_202504 (audioserver_service))
+(expandtypeattribute (audioserver_service_202504) true)
+(typeattribute audioserver_service_202504)
+(typeattributeset proc_sched_202504 (proc_sched))
+(expandtypeattribute (proc_sched_202504) true)
+(typeattribute proc_sched_202504)
+(typeattributeset modprobe_202504 (modprobe))
+(expandtypeattribute (modprobe_202504) true)
+(typeattribute modprobe_202504)
+(typeattributeset remote_auth_service_202504 (remote_auth_service))
+(expandtypeattribute (remote_auth_service_202504) true)
+(typeattribute remote_auth_service_202504)
+(typeattributeset threadnetwork_config_prop_202504 (threadnetwork_config_prop))
+(expandtypeattribute (threadnetwork_config_prop_202504) true)
+(typeattribute threadnetwork_config_prop_202504)
+(typeattributeset incidentd_202504 (incidentd))
+(expandtypeattribute (incidentd_202504) true)
+(typeattribute incidentd_202504)
+(typeattributeset apk_tmp_file_202504 (apk_tmp_file))
+(expandtypeattribute (apk_tmp_file_202504) true)
+(typeattribute apk_tmp_file_202504)
+(typeattributeset dmabuf_system_heap_device_202504 (dmabuf_system_heap_device))
+(expandtypeattribute (dmabuf_system_heap_device_202504) true)
+(typeattribute dmabuf_system_heap_device_202504)
+(typeattributeset gpu_device_202504 (gpu_device))
+(expandtypeattribute (gpu_device_202504) true)
+(typeattribute gpu_device_202504)
+(typeattributeset gpuservice_202504 (gpuservice))
+(expandtypeattribute (gpuservice_202504) true)
+(typeattribute gpuservice_202504)
+(typeattributeset mdnsd_202504 (mdnsd))
+(expandtypeattribute (mdnsd_202504) true)
+(typeattribute mdnsd_202504)
+(typeattributeset hal_tv_hdmi_cec_service_202504 (hal_tv_hdmi_cec_service))
+(expandtypeattribute (hal_tv_hdmi_cec_service_202504) true)
+(typeattribute hal_tv_hdmi_cec_service_202504)
+(typeattributeset proc_uid_io_stats_202504 (proc_uid_io_stats))
+(expandtypeattribute (proc_uid_io_stats_202504) true)
+(typeattribute proc_uid_io_stats_202504)
+(typeattributeset sensorservice_service_202504 (sensorservice_service))
+(expandtypeattribute (sensorservice_service_202504) true)
+(typeattribute sensorservice_service_202504)
+(typeattributeset runas_exec_202504 (runas_exec))
+(expandtypeattribute (runas_exec_202504) true)
+(typeattribute runas_exec_202504)
+(typeattributeset wifiaware_service_202504 (wifiaware_service))
+(expandtypeattribute (wifiaware_service_202504) true)
+(typeattribute wifiaware_service_202504)
+(typeattributeset netstats_service_202504 (netstats_service))
+(expandtypeattribute (netstats_service_202504) true)
+(typeattribute netstats_service_202504)
+(typeattributeset vr_manager_service_202504 (vr_manager_service))
+(expandtypeattribute (vr_manager_service_202504) true)
+(typeattribute vr_manager_service_202504)
+(typeattributeset watchdogd_202504 (watchdogd))
+(expandtypeattribute (watchdogd_202504) true)
+(typeattribute watchdogd_202504)
+(typeattributeset vendor_security_patch_level_prop_202504 (vendor_security_patch_level_prop))
+(expandtypeattribute (vendor_security_patch_level_prop_202504) true)
+(typeattribute vendor_security_patch_level_prop_202504)
+(typeattributeset heapprofd_202504 (heapprofd))
+(expandtypeattribute (heapprofd_202504) true)
+(typeattribute heapprofd_202504)
+(typeattributeset shell_exec_202504 (shell_exec))
+(expandtypeattribute (shell_exec_202504) true)
+(typeattribute shell_exec_202504)
+(typeattributeset hdmi_control_service_202504 (hdmi_control_service))
+(expandtypeattribute (hdmi_control_service_202504) true)
+(typeattribute hdmi_control_service_202504)
+(typeattributeset clipboard_service_202504 (clipboard_service))
+(expandtypeattribute (clipboard_service_202504) true)
+(typeattribute clipboard_service_202504)
+(typeattributeset dumpstate_exec_202504 (dumpstate_exec))
+(expandtypeattribute (dumpstate_exec_202504) true)
+(typeattribute dumpstate_exec_202504)
+(typeattributeset prereboot_data_file_202504 (prereboot_data_file))
+(expandtypeattribute (prereboot_data_file_202504) true)
+(typeattribute prereboot_data_file_202504)
+(typeattributeset netutils_wrapper_exec_202504 (netutils_wrapper_exec))
+(expandtypeattribute (netutils_wrapper_exec_202504) true)
+(typeattribute netutils_wrapper_exec_202504)
+(typeattributeset apex_service_202504 (apex_service))
+(expandtypeattribute (apex_service_202504) true)
+(typeattribute apex_service_202504)
+(typeattributeset hal_sensors_service_202504 (hal_sensors_service))
+(expandtypeattribute (hal_sensors_service_202504) true)
+(typeattribute hal_sensors_service_202504)
+(typeattributeset proc_max_map_count_202504 (proc_max_map_count))
+(expandtypeattribute (proc_max_map_count_202504) true)
+(typeattribute proc_max_map_count_202504)
+(typeattributeset apex_rollback_data_file_202504 (apex_rollback_data_file))
+(expandtypeattribute (apex_rollback_data_file_202504) true)
+(typeattribute apex_rollback_data_file_202504)
+(typeattributeset tombstoned_intercept_socket_202504 (tombstoned_intercept_socket))
+(expandtypeattribute (tombstoned_intercept_socket_202504) true)
+(typeattribute tombstoned_intercept_socket_202504)
+(typeattributeset wificond_202504 (wificond))
+(expandtypeattribute (wificond_202504) true)
+(typeattribute wificond_202504)
+(typeattributeset debugfs_mmc_202504 (debugfs_mmc))
+(expandtypeattribute (debugfs_mmc_202504) true)
+(typeattribute debugfs_mmc_202504)
+(typeattributeset usb_uvc_enabled_prop_202504 (usb_uvc_enabled_prop))
+(expandtypeattribute (usb_uvc_enabled_prop_202504) true)
+(typeattribute usb_uvc_enabled_prop_202504)
+(typeattributeset netutils_wrapper_202504 (netutils_wrapper))
+(expandtypeattribute (netutils_wrapper_202504) true)
+(typeattribute netutils_wrapper_202504)
+(typeattributeset hal_weaver_service_202504 (hal_weaver_service))
+(expandtypeattribute (hal_weaver_service_202504) true)
+(typeattribute hal_weaver_service_202504)
+(typeattributeset cpu_monitor_service_202504 (cpu_monitor_service))
+(expandtypeattribute (cpu_monitor_service_202504) true)
+(typeattribute cpu_monitor_service_202504)
+(typeattributeset hal_cas_hwservice_202504 (hal_cas_hwservice))
+(expandtypeattribute (hal_cas_hwservice_202504) true)
+(typeattribute hal_cas_hwservice_202504)
+(typeattributeset hal_evs_hwservice_202504 (hal_evs_hwservice))
+(expandtypeattribute (hal_evs_hwservice_202504) true)
+(typeattribute hal_evs_hwservice_202504)
+(typeattributeset hal_nfc_hwservice_202504 (hal_nfc_hwservice))
+(expandtypeattribute (hal_nfc_hwservice_202504) true)
+(typeattribute hal_nfc_hwservice_202504)
+(typeattributeset vold_202504 (vold))
+(expandtypeattribute (vold_202504) true)
+(typeattribute vold_202504)
+(typeattributeset iio_device_202504 (iio_device))
+(expandtypeattribute (iio_device_202504) true)
+(typeattribute iio_device_202504)
+(typeattributeset pdx_display_manager_endpoint_socket_202504 (pdx_display_manager_endpoint_socket))
+(expandtypeattribute (pdx_display_manager_endpoint_socket_202504) true)
+(typeattribute pdx_display_manager_endpoint_socket_202504)
+(typeattributeset ion_device_202504 (ion_device))
+(expandtypeattribute (ion_device_202504) true)
+(typeattribute ion_device_202504)
+(typeattributeset platform_compat_service_202504 (platform_compat_service))
+(expandtypeattribute (platform_compat_service_202504) true)
+(typeattribute platform_compat_service_202504)
+(typeattributeset camerax_extensions_prop_202504 (camerax_extensions_prop))
+(expandtypeattribute (camerax_extensions_prop_202504) true)
+(typeattribute camerax_extensions_prop_202504)
+(typeattributeset heapprofd_socket_202504 (heapprofd_socket))
+(expandtypeattribute (heapprofd_socket_202504) true)
+(typeattribute heapprofd_socket_202504)
+(typeattributeset service_manager_vndservice_202504 (service_manager_vndservice))
+(expandtypeattribute (service_manager_vndservice_202504) true)
+(typeattribute service_manager_vndservice_202504)
+(typeattributeset sysfs_uhid_202504 (sysfs_uhid))
+(expandtypeattribute (sysfs_uhid_202504) true)
+(typeattribute sysfs_uhid_202504)
+(typeattributeset proc_bootconfig_202504 (proc_bootconfig))
+(expandtypeattribute (proc_bootconfig_202504) true)
+(typeattribute proc_bootconfig_202504)
+(typeattributeset hal_secure_element_hwservice_202504 (hal_secure_element_hwservice))
+(expandtypeattribute (hal_secure_element_hwservice_202504) true)
+(typeattribute hal_secure_element_hwservice_202504)
+(typeattributeset port_device_202504 (port_device))
+(expandtypeattribute (port_device_202504) true)
+(typeattribute port_device_202504)
+(typeattributeset nfc_device_202504 (nfc_device))
+(expandtypeattribute (nfc_device_202504) true)
+(typeattribute nfc_device_202504)
+(typeattributeset system_zoneinfo_file_202504 (system_zoneinfo_file))
+(expandtypeattribute (system_zoneinfo_file_202504) true)
+(typeattribute system_zoneinfo_file_202504)
+(typeattributeset rild_socket_202504 (rild_socket))
+(expandtypeattribute (rild_socket_202504) true)
+(typeattribute rild_socket_202504)
+(typeattributeset keystore_data_file_202504 (keystore_data_file))
+(expandtypeattribute (keystore_data_file_202504) true)
+(typeattribute keystore_data_file_202504)
+(typeattributeset bootanim_system_prop_202504 (bootanim_system_prop))
+(expandtypeattribute (bootanim_system_prop_202504) true)
+(typeattribute bootanim_system_prop_202504)
+(typeattributeset recovery_persist_exec_202504 (recovery_persist_exec))
+(expandtypeattribute (recovery_persist_exec_202504) true)
+(typeattribute recovery_persist_exec_202504)
+(typeattributeset pmsg_device_202504 (pmsg_device))
+(expandtypeattribute (pmsg_device_202504) true)
+(typeattribute pmsg_device_202504)
+(typeattributeset rpmsg_device_202504 (rpmsg_device))
+(expandtypeattribute (rpmsg_device_202504) true)
+(typeattribute rpmsg_device_202504)
+(typeattributeset cache_file_202504 (cache_file))
+(expandtypeattribute (cache_file_202504) true)
+(typeattribute cache_file_202504)
+(typeattributeset debugfs_tracing_printk_formats_202504 (debugfs_tracing_printk_formats))
+(expandtypeattribute (debugfs_tracing_printk_formats_202504) true)
+(typeattribute debugfs_tracing_printk_formats_202504)
+(typeattributeset fingerprintd_service_202504 (fingerprintd_service))
+(expandtypeattribute (fingerprintd_service_202504) true)
+(typeattribute fingerprintd_service_202504)
+(typeattributeset people_service_202504 (people_service))
+(expandtypeattribute (people_service_202504) true)
+(typeattribute people_service_202504)
+(typeattributeset mtp_device_202504 (mtp_device))
+(expandtypeattribute (mtp_device_202504) true)
+(typeattribute mtp_device_202504)
+(typeattributeset camera2_extensions_prop_202504 (camera2_extensions_prop))
+(expandtypeattribute (camera2_extensions_prop_202504) true)
+(typeattribute camera2_extensions_prop_202504)
+(typeattributeset hal_graphics_mapper_service_202504 (hal_graphics_mapper_service))
+(expandtypeattribute (hal_graphics_mapper_service_202504) true)
+(typeattribute hal_graphics_mapper_service_202504)
+(typeattributeset adbd_socket_202504 (adbd_socket))
+(expandtypeattribute (adbd_socket_202504) true)
+(typeattribute adbd_socket_202504)
+(typeattributeset debugfs_trace_marker_202504 (debugfs_trace_marker))
+(expandtypeattribute (debugfs_trace_marker_202504) true)
+(typeattribute debugfs_trace_marker_202504)
+(typeattributeset hal_renderscript_hwservice_202504 (hal_renderscript_hwservice))
+(expandtypeattribute (hal_renderscript_hwservice_202504) true)
+(typeattribute hal_renderscript_hwservice_202504)
+(typeattributeset sysfs_dmabuf_stats_202504 (sysfs_dmabuf_stats))
+(expandtypeattribute (sysfs_dmabuf_stats_202504) true)
+(typeattribute sysfs_dmabuf_stats_202504)
+(typeattributeset installd_exec_202504 (installd_exec))
+(expandtypeattribute (installd_exec_202504) true)
+(typeattribute installd_exec_202504)
+(typeattributeset statsd_exec_202504 (statsd_exec))
+(expandtypeattribute (statsd_exec_202504) true)
+(typeattribute statsd_exec_202504)
+(typeattributeset tombstoned_exec_202504 (tombstoned_exec))
+(expandtypeattribute (tombstoned_exec_202504) true)
+(typeattribute tombstoned_exec_202504)
+(typeattributeset runtime_event_log_tags_file_202504 (runtime_event_log_tags_file))
+(expandtypeattribute (runtime_event_log_tags_file_202504) true)
+(typeattribute runtime_event_log_tags_file_202504)
+(typeattributeset proc_kmsg_202504 (proc_kmsg))
+(expandtypeattribute (proc_kmsg_202504) true)
+(typeattribute proc_kmsg_202504)
+(typeattributeset wpa_socket_202504 (wpa_socket))
+(expandtypeattribute (wpa_socket_202504) true)
+(typeattribute wpa_socket_202504)
+(typeattributeset fwk_camera_hwservice_202504 (fwk_camera_hwservice))
+(expandtypeattribute (fwk_camera_hwservice_202504) true)
+(typeattribute fwk_camera_hwservice_202504)
+(typeattributeset external_vibrator_service_202504 (external_vibrator_service))
+(expandtypeattribute (external_vibrator_service_202504) true)
+(typeattribute external_vibrator_service_202504)
+(typeattributeset hal_secretkeeper_service_202504 (hal_secretkeeper_service))
+(expandtypeattribute (hal_secretkeeper_service_202504) true)
+(typeattribute hal_secretkeeper_service_202504)
+(typeattributeset mtp_202504 (mtp))
+(expandtypeattribute (mtp_202504) true)
+(typeattribute mtp_202504)
+(typeattributeset backup_data_file_202504 (backup_data_file))
+(expandtypeattribute (backup_data_file_202504) true)
+(typeattribute backup_data_file_202504)
+(typeattributeset cgroup_desc_file_202504 (cgroup_desc_file))
+(expandtypeattribute (cgroup_desc_file_202504) true)
+(typeattribute cgroup_desc_file_202504)
+(typeattributeset vendor_kernel_modules_202504 (vendor_kernel_modules))
+(expandtypeattribute (vendor_kernel_modules_202504) true)
+(typeattribute vendor_kernel_modules_202504)
+(typeattributeset hal_cas_service_202504 (hal_cas_service))
+(expandtypeattribute (hal_cas_service_202504) true)
+(typeattribute hal_cas_service_202504)
+(typeattributeset app_fuse_file_202504 (app_fuse_file))
+(expandtypeattribute (app_fuse_file_202504) true)
+(typeattribute app_fuse_file_202504)
+(typeattributeset app_data_file_202504 (app_data_file))
+(expandtypeattribute (app_data_file_202504) true)
+(typeattribute app_data_file_202504)
+(typeattributeset boottime_public_prop_202504 (boottime_public_prop))
+(expandtypeattribute (boottime_public_prop_202504) true)
+(typeattribute boottime_public_prop_202504)
+(typeattributeset dhcp_data_file_202504 (dhcp_data_file))
+(expandtypeattribute (dhcp_data_file_202504) true)
+(typeattribute dhcp_data_file_202504)
+(typeattributeset privapp_data_file_202504 (privapp_data_file))
+(expandtypeattribute (privapp_data_file_202504) true)
+(typeattribute privapp_data_file_202504)
+(typeattributeset unlabeled_202504 (unlabeled))
+(expandtypeattribute (unlabeled_202504) true)
+(typeattribute unlabeled_202504)
+(typeattributeset hal_vibrator_service_202504 (hal_vibrator_service))
+(expandtypeattribute (hal_vibrator_service_202504) true)
+(typeattribute hal_vibrator_service_202504)
+(typeattributeset tombstone_config_prop_202504 (tombstone_config_prop))
+(expandtypeattribute (tombstone_config_prop_202504) true)
+(typeattribute tombstone_config_prop_202504)
+(typeattributeset tcpdump_exec_202504 (tcpdump_exec))
+(expandtypeattribute (tcpdump_exec_202504) true)
+(typeattribute tcpdump_exec_202504)
+(typeattributeset radio_control_prop_202504 (radio_control_prop))
+(expandtypeattribute (radio_control_prop_202504) true)
+(typeattribute radio_control_prop_202504)
+(typeattributeset hal_thermal_service_202504 (hal_thermal_service))
+(expandtypeattribute (hal_thermal_service_202504) true)
+(typeattribute hal_thermal_service_202504)
+(typeattributeset binder_calls_stats_service_202504 (binder_calls_stats_service))
+(expandtypeattribute (binder_calls_stats_service_202504) true)
+(typeattribute binder_calls_stats_service_202504)
+(typeattributeset linkerconfig_file_202504 (linkerconfig_file))
+(expandtypeattribute (linkerconfig_file_202504) true)
+(typeattribute linkerconfig_file_202504)
+(typeattributeset webview_zygote_tmpfs_202504 (webview_zygote_tmpfs))
+(expandtypeattribute (webview_zygote_tmpfs_202504) true)
+(typeattribute webview_zygote_tmpfs_202504)
+(typeattributeset surfaceflinger_prop_202504 (surfaceflinger_prop))
+(expandtypeattribute (surfaceflinger_prop_202504) true)
+(typeattribute surfaceflinger_prop_202504)
+(typeattributeset ipsec_service_202504 (ipsec_service))
+(expandtypeattribute (ipsec_service_202504) true)
+(typeattribute ipsec_service_202504)
+(typeattributeset fusectlfs_202504 (fusectlfs))
+(expandtypeattribute (fusectlfs_202504) true)
+(typeattribute fusectlfs_202504)
+(typeattributeset user_service_202504 (user_service))
+(expandtypeattribute (user_service_202504) true)
+(typeattribute user_service_202504)
+(typeattributeset dataloader_manager_service_202504 (dataloader_manager_service))
+(expandtypeattribute (dataloader_manager_service_202504) true)
+(typeattribute dataloader_manager_service_202504)
+(typeattributeset persistent_data_block_service_202504 (persistent_data_block_service))
+(expandtypeattribute (persistent_data_block_service_202504) true)
+(typeattribute persistent_data_block_service_202504)
+(typeattributeset artd_service_202504 (artd_service))
+(expandtypeattribute (artd_service_202504) true)
+(typeattribute artd_service_202504)
+(typeattributeset system_suspend_control_service_202504 (system_suspend_control_service))
+(expandtypeattribute (system_suspend_control_service_202504) true)
+(typeattribute system_suspend_control_service_202504)
+(typeattributeset mnt_sdcard_file_202504 (mnt_sdcard_file))
+(expandtypeattribute (mnt_sdcard_file_202504) true)
+(typeattribute mnt_sdcard_file_202504)
+(typeattributeset profman_dump_data_file_202504 (profman_dump_data_file))
+(expandtypeattribute (profman_dump_data_file_202504) true)
+(typeattribute profman_dump_data_file_202504)
+(typeattributeset telephony_status_prop_202504 (telephony_status_prop))
+(expandtypeattribute (telephony_status_prop_202504) true)
+(typeattribute telephony_status_prop_202504)
+(typeattributeset socket_device_202504 (socket_device))
+(expandtypeattribute (socket_device_202504) true)
+(typeattribute socket_device_202504)
+(typeattributeset broadcastradio_service_202504 (broadcastradio_service))
+(expandtypeattribute (broadcastradio_service_202504) true)
+(typeattribute broadcastradio_service_202504)
+(typeattributeset hal_tv_hdmi_earc_service_202504 (hal_tv_hdmi_earc_service))
+(expandtypeattribute (hal_tv_hdmi_earc_service_202504) true)
+(typeattribute hal_tv_hdmi_earc_service_202504)
+(typeattributeset permission_checker_service_202504 (permission_checker_service))
+(expandtypeattribute (permission_checker_service_202504) true)
+(typeattribute permission_checker_service_202504)
+(typeattributeset scheduling_policy_service_202504 (scheduling_policy_service))
+(expandtypeattribute (scheduling_policy_service_202504) true)
+(typeattribute scheduling_policy_service_202504)
+(typeattributeset update_engine_exec_202504 (update_engine_exec))
+(expandtypeattribute (update_engine_exec_202504) true)
+(typeattribute update_engine_exec_202504)
+(typeattributeset installd_202504 (installd))
+(expandtypeattribute (installd_202504) true)
+(typeattribute installd_202504)
+(typeattributeset profman_exec_202504 (profman_exec))
+(expandtypeattribute (profman_exec_202504) true)
+(typeattribute profman_exec_202504)
+(typeattributeset debugfs_restriction_prop_202504 (debugfs_restriction_prop))
+(expandtypeattribute (debugfs_restriction_prop_202504) true)
+(typeattribute debugfs_restriction_prop_202504)
+(typeattributeset bootchart_data_file_202504 (bootchart_data_file))
+(expandtypeattribute (bootchart_data_file_202504) true)
+(typeattribute bootchart_data_file_202504)
+(typeattributeset dmabuf_system_secure_heap_device_202504 (dmabuf_system_secure_heap_device))
+(expandtypeattribute (dmabuf_system_secure_heap_device_202504) true)
+(typeattribute dmabuf_system_secure_heap_device_202504)
+(typeattributeset hal_codec2_service_202504 (hal_codec2_service))
+(expandtypeattribute (hal_codec2_service_202504) true)
+(typeattribute hal_codec2_service_202504)
+(typeattributeset vendor_userdir_file_202504 (vendor_userdir_file))
+(expandtypeattribute (vendor_userdir_file_202504) true)
+(typeattribute vendor_userdir_file_202504)
+(typeattributeset persist_debug_prop_202504 (persist_debug_prop))
+(expandtypeattribute (persist_debug_prop_202504) true)
+(typeattribute persist_debug_prop_202504)
+(typeattributeset hal_can_controller_service_202504 (hal_can_controller_service))
+(expandtypeattribute (hal_can_controller_service_202504) true)
+(typeattribute hal_can_controller_service_202504)
+(typeattributeset telecom_service_202504 (telecom_service))
+(expandtypeattribute (telecom_service_202504) true)
+(typeattribute telecom_service_202504)
+(typeattributeset audioserver_data_file_202504 (audioserver_data_file))
+(expandtypeattribute (audioserver_data_file_202504) true)
+(typeattribute audioserver_data_file_202504)
+(typeattributeset console_device_202504 (console_device))
+(expandtypeattribute (console_device_202504) true)
+(typeattribute console_device_202504)
+(typeattributeset sensors_device_202504 (sensors_device))
+(expandtypeattribute (sensors_device_202504) true)
+(typeattribute sensors_device_202504)
+(typeattributeset llkd_202504 (llkd))
+(expandtypeattribute (llkd_202504) true)
+(typeattribute llkd_202504)
+(typeattributeset location_time_zone_manager_service_202504 (location_time_zone_manager_service))
+(expandtypeattribute (location_time_zone_manager_service_202504) true)
+(typeattribute location_time_zone_manager_service_202504)
+(typeattributeset vold_metadata_file_202504 (vold_metadata_file))
+(expandtypeattribute (vold_metadata_file_202504) true)
+(typeattribute vold_metadata_file_202504)
+(typeattributeset charger_prop_202504 (charger_prop))
+(expandtypeattribute (charger_prop_202504) true)
+(typeattribute charger_prop_202504)
+(typeattributeset samplingprofiler_service_202504 (samplingprofiler_service))
+(expandtypeattribute (samplingprofiler_service_202504) true)
+(typeattribute samplingprofiler_service_202504)
+(typeattributeset sysfs_vendor_sched_202504 (sysfs_vendor_sched))
+(expandtypeattribute (sysfs_vendor_sched_202504) true)
+(typeattribute sysfs_vendor_sched_202504)
+(typeattributeset fwk_camera_service_202504 (fwk_camera_service))
+(expandtypeattribute (fwk_camera_service_202504) true)
+(typeattribute fwk_camera_service_202504)
+(typeattributeset hal_graphics_allocator_hwservice_202504 (hal_graphics_allocator_hwservice))
+(expandtypeattribute (hal_graphics_allocator_hwservice_202504) true)
+(typeattribute hal_graphics_allocator_hwservice_202504)
+(typeattributeset hal_dumpstate_config_prop_202504 (hal_dumpstate_config_prop))
+(expandtypeattribute (hal_dumpstate_config_prop_202504) true)
+(typeattribute hal_dumpstate_config_prop_202504)
+(typeattributeset overlayfs_file_202504 (overlayfs_file))
+(expandtypeattribute (overlayfs_file_202504) true)
+(typeattribute overlayfs_file_202504)
+(typeattributeset proc_version_202504 (proc_version))
+(expandtypeattribute (proc_version_202504) true)
+(typeattribute proc_version_202504)
+(typeattributeset search_service_202504 (search_service))
+(expandtypeattribute (search_service_202504) true)
+(typeattribute search_service_202504)
+(typeattributeset nearby_service_202504 (nearby_service))
+(expandtypeattribute (nearby_service_202504) true)
+(typeattribute nearby_service_202504)
+(typeattributeset mediaserver_202504 (mediaserver))
+(expandtypeattribute (mediaserver_202504) true)
+(typeattribute mediaserver_202504)
+(typeattributeset mediaserver_exec_202504 (mediaserver_exec))
+(expandtypeattribute (mediaserver_exec_202504) true)
+(typeattribute mediaserver_exec_202504)
+(typeattributeset network_stack_service_202504 (network_stack_service))
+(expandtypeattribute (network_stack_service_202504) true)
+(typeattribute network_stack_service_202504)
+(typeattributeset oemfs_202504 (oemfs))
+(expandtypeattribute (oemfs_202504) true)
+(typeattribute oemfs_202504)
+(typeattributeset proc_cmdline_202504 (proc_cmdline))
+(expandtypeattribute (proc_cmdline_202504) true)
+(typeattribute proc_cmdline_202504)
+(typeattributeset drmserver_exec_202504 (drmserver_exec))
+(expandtypeattribute (drmserver_exec_202504) true)
+(typeattribute drmserver_exec_202504)
+(typeattributeset proc_net_tcp_udp_202504 (proc_net_tcp_udp))
+(expandtypeattribute (proc_net_tcp_udp_202504) true)
+(typeattribute proc_net_tcp_udp_202504)
+(typeattributeset resources_manager_service_202504 (resources_manager_service))
+(expandtypeattribute (resources_manager_service_202504) true)
+(typeattribute resources_manager_service_202504)
+(typeattributeset sgdisk_exec_202504 (sgdisk_exec))
+(expandtypeattribute (sgdisk_exec_202504) true)
+(typeattribute sgdisk_exec_202504)
+(typeattributeset retaildemo_prop_202504 (retaildemo_prop))
+(expandtypeattribute (retaildemo_prop_202504) true)
+(typeattribute retaildemo_prop_202504)
+(typeattributeset pdx_display_screenshot_endpoint_socket_202504 (pdx_display_screenshot_endpoint_socket))
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_202504) true)
+(typeattribute pdx_display_screenshot_endpoint_socket_202504)
+(typeattributeset simpleperf_app_runner_202504 (simpleperf_app_runner))
+(expandtypeattribute (simpleperf_app_runner_202504) true)
+(typeattribute simpleperf_app_runner_202504)
+(typeattributeset mnt_product_file_202504 (mnt_product_file))
+(expandtypeattribute (mnt_product_file_202504) true)
+(typeattribute mnt_product_file_202504)
+(typeattributeset camera_data_file_202504 (camera_data_file))
+(expandtypeattribute (camera_data_file_202504) true)
+(typeattribute camera_data_file_202504)
+(typeattributeset bluetooth_efs_file_202504 (bluetooth_efs_file))
+(expandtypeattribute (bluetooth_efs_file_202504) true)
+(typeattribute bluetooth_efs_file_202504)
+(typeattributeset media_data_file_202504 (media_data_file))
+(expandtypeattribute (media_data_file_202504) true)
+(typeattribute media_data_file_202504)
+(typeattributeset ota_data_file_202504 (ota_data_file))
+(expandtypeattribute (ota_data_file_202504) true)
+(typeattribute ota_data_file_202504)
+(typeattributeset security_state_service_202504 (security_state_service))
+(expandtypeattribute (security_state_service_202504) true)
+(typeattribute security_state_service_202504)
+(typeattributeset sysfs_fs_incfs_metrics_202504 (sysfs_fs_incfs_metrics))
+(expandtypeattribute (sysfs_fs_incfs_metrics_202504) true)
+(typeattribute sysfs_fs_incfs_metrics_202504)
+(typeattributeset telephony_config_prop_202504 (telephony_config_prop))
+(expandtypeattribute (telephony_config_prop_202504) true)
+(typeattribute telephony_config_prop_202504)
+(typeattributeset system_file_202504 (system_file))
+(expandtypeattribute (system_file_202504) true)
+(typeattribute system_file_202504)
+(typeattributeset system_seccomp_policy_file_202504 (system_seccomp_policy_file))
+(expandtypeattribute (system_seccomp_policy_file_202504) true)
+(typeattribute system_seccomp_policy_file_202504)
+(typeattributeset apk_private_tmp_file_202504 (apk_private_tmp_file))
+(expandtypeattribute (apk_private_tmp_file_202504) true)
+(typeattribute apk_private_tmp_file_202504)
+(typeattributeset hci_attach_dev_202504 (hci_attach_dev))
+(expandtypeattribute (hci_attach_dev_202504) true)
+(typeattribute hci_attach_dev_202504)
+(typeattributeset statusbar_service_202504 (statusbar_service))
+(expandtypeattribute (statusbar_service_202504) true)
+(typeattribute statusbar_service_202504)
+(typeattributeset traced_producer_socket_202504 (traced_producer_socket))
+(expandtypeattribute (traced_producer_socket_202504) true)
+(typeattribute traced_producer_socket_202504)
+(typeattributeset hal_input_classifier_hwservice_202504 (hal_input_classifier_hwservice))
+(expandtypeattribute (hal_input_classifier_hwservice_202504) true)
+(typeattribute hal_input_classifier_hwservice_202504)
+(typeattributeset idmap_202504 (idmap))
+(expandtypeattribute (idmap_202504) true)
+(typeattribute idmap_202504)
+(typeattributeset binderfs_logs_stats_202504 (binderfs_logs_stats))
+(expandtypeattribute (binderfs_logs_stats_202504) true)
+(typeattribute binderfs_logs_stats_202504)
+(typeattributeset fwmarkd_socket_202504 (fwmarkd_socket))
+(expandtypeattribute (fwmarkd_socket_202504) true)
+(typeattribute fwmarkd_socket_202504)
+(typeattributeset device_config_media_native_prop_202504 (device_config_media_native_prop))
+(expandtypeattribute (device_config_media_native_prop_202504) true)
+(typeattribute device_config_media_native_prop_202504)
+(typeattributeset cameraserver_exec_202504 (cameraserver_exec))
+(expandtypeattribute (cameraserver_exec_202504) true)
+(typeattribute cameraserver_exec_202504)
+(typeattributeset device_config_nnapi_native_prop_202504 (device_config_nnapi_native_prop))
+(expandtypeattribute (device_config_nnapi_native_prop_202504) true)
+(typeattribute device_config_nnapi_native_prop_202504)
+(typeattributeset shortcut_service_202504 (shortcut_service))
+(expandtypeattribute (shortcut_service_202504) true)
+(typeattribute shortcut_service_202504)
+(typeattributeset credstore_data_file_202504 (credstore_data_file))
+(expandtypeattribute (credstore_data_file_202504) true)
+(typeattribute credstore_data_file_202504)
+(typeattributeset device_state_service_202504 (device_state_service))
+(expandtypeattribute (device_state_service_202504) true)
+(typeattribute device_state_service_202504)
+(typeattributeset profman_202504 (profman))
+(expandtypeattribute (profman_202504) true)
+(typeattribute profman_202504)
+(typeattributeset heapprofd_enabled_prop_202504 (heapprofd_enabled_prop))
+(expandtypeattribute (heapprofd_enabled_prop_202504) true)
+(typeattribute heapprofd_enabled_prop_202504)
+(typeattributeset ctl_sigstop_prop_202504 (ctl_sigstop_prop))
+(expandtypeattribute (ctl_sigstop_prop_202504) true)
+(typeattribute ctl_sigstop_prop_202504)
+(typeattributeset media_rw_data_file_202504 (media_rw_data_file))
+(expandtypeattribute (media_rw_data_file_202504) true)
+(typeattribute media_rw_data_file_202504)
+(typeattributeset system_config_service_202504 (system_config_service))
+(expandtypeattribute (system_config_service_202504) true)
+(typeattribute system_config_service_202504)
+(typeattributeset gnss_time_update_service_202504 (gnss_time_update_service))
+(expandtypeattribute (gnss_time_update_service_202504) true)
+(typeattribute gnss_time_update_service_202504)
+(typeattributeset binder_cache_system_server_prop_202504 (binder_cache_system_server_prop))
+(expandtypeattribute (binder_cache_system_server_prop_202504) true)
+(typeattribute binder_cache_system_server_prop_202504)
+(typeattributeset coredump_file_202504 (coredump_file))
+(expandtypeattribute (coredump_file_202504) true)
+(typeattribute coredump_file_202504)
+(typeattributeset ctl_interface_stop_prop_202504 (ctl_interface_stop_prop))
+(expandtypeattribute (ctl_interface_stop_prop_202504) true)
+(typeattribute ctl_interface_stop_prop_202504)
+(typeattributeset serial_device_202504 (serial_device))
+(expandtypeattribute (serial_device_202504) true)
+(typeattribute serial_device_202504)
+(typeattributeset healthconnect_service_202504 (healthconnect_service))
+(expandtypeattribute (healthconnect_service_202504) true)
+(typeattribute healthconnect_service_202504)
+(typeattributeset traced_consumer_socket_202504 (traced_consumer_socket))
+(expandtypeattribute (traced_consumer_socket_202504) true)
+(typeattribute traced_consumer_socket_202504)
+(typeattributeset devicestoragemonitor_service_202504 (devicestoragemonitor_service))
+(expandtypeattribute (devicestoragemonitor_service_202504) true)
+(typeattribute devicestoragemonitor_service_202504)
+(typeattributeset enable_16k_pages_prop_202504 (enable_16k_pages_prop))
+(expandtypeattribute (enable_16k_pages_prop_202504) true)
+(typeattribute enable_16k_pages_prop_202504)
+(typeattributeset virtual_camera_exec_202504 (virtual_camera_exec))
+(expandtypeattribute (virtual_camera_exec_202504) true)
+(typeattribute virtual_camera_exec_202504)
+(typeattributeset boottrace_data_file_202504 (boottrace_data_file))
+(expandtypeattribute (boottrace_data_file_202504) true)
+(typeattribute boottrace_data_file_202504)
+(typeattributeset proc_uid_time_in_state_202504 (proc_uid_time_in_state))
+(expandtypeattribute (proc_uid_time_in_state_202504) true)
+(typeattribute proc_uid_time_in_state_202504)
+(typeattributeset apex_metadata_file_202504 (apex_metadata_file))
+(expandtypeattribute (apex_metadata_file_202504) true)
+(typeattribute apex_metadata_file_202504)
+(typeattributeset hal_audio_hwservice_202504 (hal_audio_hwservice))
+(expandtypeattribute (hal_audio_hwservice_202504) true)
+(typeattribute hal_audio_hwservice_202504)
+(typeattributeset iris_service_202504 (iris_service))
+(expandtypeattribute (iris_service_202504) true)
+(typeattribute iris_service_202504)
+(typeattributeset cache_backup_file_202504 (cache_backup_file))
+(expandtypeattribute (cache_backup_file_202504) true)
+(typeattribute cache_backup_file_202504)
+(typeattributeset hal_usb_gadget_hwservice_202504 (hal_usb_gadget_hwservice))
+(expandtypeattribute (hal_usb_gadget_hwservice_202504) true)
+(typeattribute hal_usb_gadget_hwservice_202504)
+(typeattributeset biometric_service_202504 (biometric_service))
+(expandtypeattribute (biometric_service_202504) true)
+(typeattribute biometric_service_202504)
+(typeattributeset sysfs_extcon_202504 (sysfs_extcon))
+(expandtypeattribute (sysfs_extcon_202504) true)
+(typeattribute sysfs_extcon_202504)
+(typeattributeset usb_serial_device_202504 (usb_serial_device))
+(expandtypeattribute (usb_serial_device_202504) true)
+(typeattribute usb_serial_device_202504)
+(typeattributeset watchdogd_exec_202504 (watchdogd_exec))
+(expandtypeattribute (watchdogd_exec_202504) true)
+(typeattribute watchdogd_exec_202504)
+(typeattributeset surfaceflinger_tmpfs_202504 (surfaceflinger_tmpfs))
+(expandtypeattribute (surfaceflinger_tmpfs_202504) true)
+(typeattribute surfaceflinger_tmpfs_202504)
+(typeattributeset fs_bpf_vendor_202504 (fs_bpf_vendor))
+(expandtypeattribute (fs_bpf_vendor_202504) true)
+(typeattribute fs_bpf_vendor_202504)
+(typeattributeset lmkd_202504 (lmkd))
+(expandtypeattribute (lmkd_202504) true)
+(typeattribute lmkd_202504)
+(typeattributeset deviceidle_service_202504 (deviceidle_service))
+(expandtypeattribute (deviceidle_service_202504) true)
+(typeattribute deviceidle_service_202504)
+(typeattributeset dropbox_service_202504 (dropbox_service))
+(expandtypeattribute (dropbox_service_202504) true)
+(typeattribute dropbox_service_202504)
+(typeattributeset userspace_reboot_metadata_file_202504 (userspace_reboot_metadata_file))
+(expandtypeattribute (userspace_reboot_metadata_file_202504) true)
+(typeattribute userspace_reboot_metadata_file_202504)
+(typeattributeset hidl_token_hwservice_202504 (hidl_token_hwservice))
+(expandtypeattribute (hidl_token_hwservice_202504) true)
+(typeattribute hidl_token_hwservice_202504)
+(typeattributeset storagestats_service_202504 (storagestats_service))
+(expandtypeattribute (storagestats_service_202504) true)
+(typeattribute storagestats_service_202504)
+(typeattributeset activity_task_service_202504 (activity_task_service))
+(expandtypeattribute (activity_task_service_202504) true)
+(typeattribute activity_task_service_202504)
+(typeattributeset hal_camera_service_202504 (hal_camera_service))
+(expandtypeattribute (hal_camera_service_202504) true)
+(typeattribute hal_camera_service_202504)
+(typeattributeset wifip2p_service_202504 (wifip2p_service))
+(expandtypeattribute (wifip2p_service_202504) true)
+(typeattribute wifip2p_service_202504)
+(typeattributeset fs_bpf_tethering_202504 (fs_bpf_tethering))
+(expandtypeattribute (fs_bpf_tethering_202504) true)
+(typeattribute fs_bpf_tethering_202504)
+(typeattributeset sysfs_switch_202504 (sysfs_switch))
+(expandtypeattribute (sysfs_switch_202504) true)
+(typeattribute sysfs_switch_202504)
+(typeattributeset device_config_input_native_boot_prop_202504 (device_config_input_native_boot_prop))
+(expandtypeattribute (device_config_input_native_boot_prop_202504) true)
+(typeattribute device_config_input_native_boot_prop_202504)
+(typeattributeset registry_service_202504 (registry_service))
+(expandtypeattribute (registry_service_202504) true)
+(typeattribute registry_service_202504)
+(typeattributeset aconfig_storage_metadata_file_202504 (aconfig_storage_metadata_file))
+(expandtypeattribute (aconfig_storage_metadata_file_202504) true)
+(typeattribute aconfig_storage_metadata_file_202504)
+(typeattributeset platform_app_202504 (platform_app))
+(expandtypeattribute (platform_app_202504) true)
+(typeattribute platform_app_202504)
+(typeattributeset hidraw_device_202504 (hidraw_device))
+(expandtypeattribute (hidraw_device_202504) true)
+(typeattribute hidraw_device_202504)
+(typeattributeset sysfs_batteryinfo_202504 (sysfs_batteryinfo))
+(expandtypeattribute (sysfs_batteryinfo_202504) true)
+(typeattribute sysfs_batteryinfo_202504)
+(typeattributeset framework_watchdog_config_prop_202504 (framework_watchdog_config_prop))
+(expandtypeattribute (framework_watchdog_config_prop_202504) true)
+(typeattribute framework_watchdog_config_prop_202504)
+(typeattributeset hal_drm_service_202504 (hal_drm_service))
+(expandtypeattribute (hal_drm_service_202504) true)
+(typeattribute hal_drm_service_202504)
+(typeattributeset recovery_persist_202504 (recovery_persist))
+(expandtypeattribute (recovery_persist_202504) true)
+(typeattribute recovery_persist_202504)
+(typeattributeset package_native_service_202504 (package_native_service))
+(expandtypeattribute (package_native_service_202504) true)
+(typeattribute package_native_service_202504)
+(typeattributeset jobscheduler_service_202504 (jobscheduler_service))
+(expandtypeattribute (jobscheduler_service_202504) true)
+(typeattribute jobscheduler_service_202504)
+(typeattributeset update_engine_stable_service_202504 (update_engine_stable_service))
+(expandtypeattribute (update_engine_stable_service_202504) true)
+(typeattribute update_engine_stable_service_202504)
+(typeattributeset system_lib_file_202504 (system_lib_file))
+(expandtypeattribute (system_lib_file_202504) true)
+(typeattribute system_lib_file_202504)
+(typeattributeset media_userdir_file_202504 (media_userdir_file))
+(expandtypeattribute (media_userdir_file_202504) true)
+(typeattribute media_userdir_file_202504)
+(typeattributeset keystore2_key_contexts_file_202504 (keystore2_key_contexts_file))
+(expandtypeattribute (keystore2_key_contexts_file_202504) true)
+(typeattribute keystore2_key_contexts_file_202504)
+(typeattributeset traced_perf_socket_202504 (traced_perf_socket))
+(expandtypeattribute (traced_perf_socket_202504) true)
+(typeattribute traced_perf_socket_202504)
+(typeattributeset proc_iomem_202504 (proc_iomem))
+(expandtypeattribute (proc_iomem_202504) true)
+(typeattribute proc_iomem_202504)
+(typeattributeset virtual_fingerprint_hal_prop_202504 (virtual_fingerprint_hal_prop))
+(expandtypeattribute (virtual_fingerprint_hal_prop_202504) true)
+(typeattribute virtual_fingerprint_hal_prop_202504)
+(typeattributeset hal_camera_hwservice_202504 (hal_camera_hwservice))
+(expandtypeattribute (hal_camera_hwservice_202504) true)
+(typeattribute hal_camera_hwservice_202504)
+(typeattributeset proc_timer_202504 (proc_timer))
+(expandtypeattribute (proc_timer_202504) true)
+(typeattribute proc_timer_202504)
+(typeattributeset pdx_performance_client_channel_socket_202504 (pdx_performance_client_channel_socket))
+(expandtypeattribute (pdx_performance_client_channel_socket_202504) true)
+(typeattribute pdx_performance_client_channel_socket_202504)
+(typeattributeset sdcardd_exec_202504 (sdcardd_exec))
+(expandtypeattribute (sdcardd_exec_202504) true)
+(typeattribute sdcardd_exec_202504)
+(typeattributeset kmsg_debug_device_202504 (kmsg_debug_device))
+(expandtypeattribute (kmsg_debug_device_202504) true)
+(typeattribute kmsg_debug_device_202504)
+(typeattributeset mediametrics_202504 (mediametrics))
+(expandtypeattribute (mediametrics_202504) true)
+(typeattribute mediametrics_202504)
+(typeattributeset mediametrics_exec_202504 (mediametrics_exec))
+(expandtypeattribute (mediametrics_exec_202504) true)
+(typeattribute mediametrics_exec_202504)
+(typeattributeset hal_broadcastradio_service_202504 (hal_broadcastradio_service))
+(expandtypeattribute (hal_broadcastradio_service_202504) true)
+(typeattribute hal_broadcastradio_service_202504)
+(typeattributeset sysfs_wakeup_202504 (sysfs_wakeup))
+(expandtypeattribute (sysfs_wakeup_202504) true)
+(typeattribute sysfs_wakeup_202504)
+(typeattributeset audio_device_202504 (audio_device))
+(expandtypeattribute (audio_device_202504) true)
+(typeattribute audio_device_202504)
+(typeattributeset webviewupdate_service_202504 (webviewupdate_service))
+(expandtypeattribute (webviewupdate_service_202504) true)
+(typeattribute webviewupdate_service_202504)
+(typeattributeset bufferhubd_exec_202504 (bufferhubd_exec))
+(expandtypeattribute (bufferhubd_exec_202504) true)
+(typeattribute bufferhubd_exec_202504)
+(typeattributeset device_config_updatable_service_202504 (device_config_updatable_service))
+(expandtypeattribute (device_config_updatable_service_202504) true)
+(typeattribute device_config_updatable_service_202504)
+(typeattributeset userspace_reboot_config_prop_202504 (userspace_reboot_config_prop))
+(expandtypeattribute (userspace_reboot_config_prop_202504) true)
+(typeattribute userspace_reboot_config_prop_202504)
+(typeattributeset hal_macsec_service_202504 (hal_macsec_service))
+(expandtypeattribute (hal_macsec_service_202504) true)
+(typeattribute hal_macsec_service_202504)
+(typeattributeset sysfs_lowmemorykiller_202504 (sysfs_lowmemorykiller))
+(expandtypeattribute (sysfs_lowmemorykiller_202504) true)
+(typeattribute sysfs_lowmemorykiller_202504)
+(typeattributeset reboot_readiness_service_202504 (reboot_readiness_service))
+(expandtypeattribute (reboot_readiness_service_202504) true)
+(typeattribute reboot_readiness_service_202504)
+(typeattributeset hwservicemanager_exec_202504 (hwservicemanager_exec))
+(expandtypeattribute (hwservicemanager_exec_202504) true)
+(typeattribute hwservicemanager_exec_202504)
+(typeattributeset servicemanager_exec_202504 (servicemanager_exec))
+(expandtypeattribute (servicemanager_exec_202504) true)
+(typeattribute servicemanager_exec_202504)
+(typeattributeset pdx_performance_dir_202504 (pdx_performance_dir))
+(expandtypeattribute (pdx_performance_dir_202504) true)
+(typeattribute pdx_performance_dir_202504)
+(typeattributeset proc_cpuinfo_202504 (proc_cpuinfo))
+(expandtypeattribute (proc_cpuinfo_202504) true)
+(typeattribute proc_cpuinfo_202504)
+(typeattributeset proc_meminfo_202504 (proc_meminfo))
+(expandtypeattribute (proc_meminfo_202504) true)
+(typeattribute proc_meminfo_202504)
+(typeattributeset device_config_netd_native_prop_202504 (device_config_netd_native_prop))
+(expandtypeattribute (device_config_netd_native_prop_202504) true)
+(typeattribute device_config_netd_native_prop_202504)
+(typeattributeset zygote_socket_202504 (zygote_socket))
+(expandtypeattribute (zygote_socket_202504) true)
+(typeattribute zygote_socket_202504)
+(typeattributeset vendor_framework_file_202504 (vendor_framework_file))
+(expandtypeattribute (vendor_framework_file_202504) true)
+(typeattribute vendor_framework_file_202504)
+(typeattributeset boottime_prop_202504 (boottime_prop))
+(expandtypeattribute (boottime_prop_202504) true)
+(typeattribute boottime_prop_202504)
+(typeattributeset fsck_untrusted_202504 (fsck_untrusted))
+(expandtypeattribute (fsck_untrusted_202504) true)
+(typeattribute fsck_untrusted_202504)
+(typeattributeset uhid_device_202504 (uhid_device))
+(expandtypeattribute (uhid_device_202504) true)
+(typeattribute uhid_device_202504)
+(typeattributeset system_trace_prop_202504 (system_trace_prop))
+(expandtypeattribute (system_trace_prop_202504) true)
+(typeattribute system_trace_prop_202504)
+(typeattributeset ctl_start_prop_202504 (ctl_start_prop))
+(expandtypeattribute (ctl_start_prop_202504) true)
+(typeattribute ctl_start_prop_202504)
+(typeattributeset incident_service_202504 (incident_service))
+(expandtypeattribute (incident_service_202504) true)
+(typeattribute incident_service_202504)
+(typeattributeset apex_ready_prop_202504 (apex_ready_prop))
+(expandtypeattribute (apex_ready_prop_202504) true)
+(typeattribute apex_ready_prop_202504)
+(typeattributeset ctl_bootanim_prop_202504 (ctl_bootanim_prop))
+(expandtypeattribute (ctl_bootanim_prop_202504) true)
+(typeattribute ctl_bootanim_prop_202504)
+(typeattributeset drm_forcel3_prop_202504 (drm_forcel3_prop))
+(expandtypeattribute (drm_forcel3_prop_202504) true)
+(typeattribute drm_forcel3_prop_202504)
+(typeattributeset fwk_sensor_service_202504 (fwk_sensor_service))
+(expandtypeattribute (fwk_sensor_service_202504) true)
+(typeattribute fwk_sensor_service_202504)
+(typeattributeset restorecon_prop_202504 (restorecon_prop))
+(expandtypeattribute (restorecon_prop_202504) true)
+(typeattribute restorecon_prop_202504)
+(typeattributeset account_service_202504 (account_service))
+(expandtypeattribute (account_service_202504) true)
+(typeattribute account_service_202504)
+(typeattributeset content_service_202504 (content_service))
+(expandtypeattribute (content_service_202504) true)
+(typeattribute content_service_202504)
+(typeattributeset mount_service_202504 (mount_service))
+(expandtypeattribute (mount_service_202504) true)
+(typeattribute mount_service_202504)
+(typeattributeset quick_start_prop_202504 (quick_start_prop))
+(expandtypeattribute (quick_start_prop_202504) true)
+(typeattribute quick_start_prop_202504)
+(typeattributeset mediatranscoding_202504 (mediatranscoding))
+(expandtypeattribute (mediatranscoding_202504) true)
+(typeattribute mediatranscoding_202504)
+(typeattributeset net_radio_prop_202504 (net_radio_prop))
+(expandtypeattribute (net_radio_prop_202504) true)
+(typeattribute net_radio_prop_202504)
+(typeattributeset sysfs_usermodehelper_202504 (sysfs_usermodehelper))
+(expandtypeattribute (sysfs_usermodehelper_202504) true)
+(typeattribute sysfs_usermodehelper_202504)
+(typeattributeset asec_apk_file_202504 (asec_apk_file))
+(expandtypeattribute (asec_apk_file_202504) true)
+(typeattribute asec_apk_file_202504)
+(typeattributeset heapdump_data_file_202504 (heapdump_data_file))
+(expandtypeattribute (heapdump_data_file_202504) true)
+(typeattribute heapdump_data_file_202504)
+(typeattributeset sysfs_dt_firmware_android_202504 (sysfs_dt_firmware_android))
+(expandtypeattribute (sysfs_dt_firmware_android_202504) true)
+(typeattribute sysfs_dt_firmware_android_202504)
+(typeattributeset hal_authsecret_hwservice_202504 (hal_authsecret_hwservice))
+(expandtypeattribute (hal_authsecret_hwservice_202504) true)
+(typeattribute hal_authsecret_hwservice_202504)
+(typeattributeset update_verifier_exec_202504 (update_verifier_exec))
+(expandtypeattribute (update_verifier_exec_202504) true)
+(typeattribute update_verifier_exec_202504)
+(typeattributeset property_service_version_prop_202504 (property_service_version_prop))
+(expandtypeattribute (property_service_version_prop_202504) true)
+(typeattribute property_service_version_prop_202504)
+(typeattributeset hal_dumpstate_hwservice_202504 (hal_dumpstate_hwservice))
+(expandtypeattribute (hal_dumpstate_hwservice_202504) true)
+(typeattribute hal_dumpstate_hwservice_202504)
+(typeattributeset lpdump_service_202504 (lpdump_service))
+(expandtypeattribute (lpdump_service_202504) true)
+(typeattribute lpdump_service_202504)
+(typeattributeset vibrator_manager_service_202504 (vibrator_manager_service))
+(expandtypeattribute (vibrator_manager_service_202504) true)
+(typeattribute vibrator_manager_service_202504)
+(typeattributeset build_attestation_prop_202504 (build_attestation_prop))
+(expandtypeattribute (build_attestation_prop_202504) true)
+(typeattribute build_attestation_prop_202504)
+(typeattributeset cache_private_backup_file_202504 (cache_private_backup_file))
+(expandtypeattribute (cache_private_backup_file_202504) true)
+(typeattribute cache_private_backup_file_202504)
+(typeattributeset recovery_socket_202504 (recovery_socket))
+(expandtypeattribute (recovery_socket_202504) true)
+(typeattribute recovery_socket_202504)
+(typeattributeset hal_usb_service_202504 (hal_usb_service))
+(expandtypeattribute (hal_usb_service_202504) true)
+(typeattribute hal_usb_service_202504)
+(typeattributeset usb_service_202504 (usb_service))
+(expandtypeattribute (usb_service_202504) true)
+(typeattribute usb_service_202504)
+(typeattributeset wifi_usd_service_202504 (wifi_usd_service))
+(expandtypeattribute (wifi_usd_service_202504) true)
+(typeattribute wifi_usd_service_202504)
+(typeattributeset ctl_stop_prop_202504 (ctl_stop_prop))
+(expandtypeattribute (ctl_stop_prop_202504) true)
+(typeattribute ctl_stop_prop_202504)
+(typeattributeset dm_user_device_202504 (dm_user_device))
+(expandtypeattribute (dm_user_device_202504) true)
+(typeattribute dm_user_device_202504)
+(typeattributeset packagemanager_config_prop_202504 (packagemanager_config_prop))
+(expandtypeattribute (packagemanager_config_prop_202504) true)
+(typeattribute packagemanager_config_prop_202504)
+(typeattributeset battery_service_202504 (battery_service))
+(expandtypeattribute (battery_service_202504) true)
+(typeattribute battery_service_202504)
+(typeattributeset incremental_control_file_202504 (incremental_control_file))
+(expandtypeattribute (incremental_control_file_202504) true)
+(typeattribute incremental_control_file_202504)
+(typeattributeset proc_lowmemorykiller_202504 (proc_lowmemorykiller))
+(expandtypeattribute (proc_lowmemorykiller_202504) true)
+(typeattribute proc_lowmemorykiller_202504)
+(typeattributeset recovery_service_202504 (recovery_service))
+(expandtypeattribute (recovery_service_202504) true)
+(typeattribute recovery_service_202504)
+(typeattributeset ctl_gsid_prop_202504 (ctl_gsid_prop))
+(expandtypeattribute (ctl_gsid_prop_202504) true)
+(typeattribute ctl_gsid_prop_202504)
+(typeattributeset ctl_fuse_prop_202504 (ctl_fuse_prop))
+(expandtypeattribute (ctl_fuse_prop_202504) true)
+(typeattribute ctl_fuse_prop_202504)
+(typeattributeset ctl_console_prop_202504 (ctl_console_prop))
+(expandtypeattribute (ctl_console_prop_202504) true)
+(typeattribute ctl_console_prop_202504)
+(typeattributeset gatekeeperd_exec_202504 (gatekeeperd_exec))
+(expandtypeattribute (gatekeeperd_exec_202504) true)
+(typeattribute gatekeeperd_exec_202504)
+(typeattributeset sockfs_202504 (sockfs))
+(expandtypeattribute (sockfs_202504) true)
+(typeattribute sockfs_202504)
+(typeattributeset trust_service_202504 (trust_service))
+(expandtypeattribute (trust_service_202504) true)
+(typeattribute trust_service_202504)
+(typeattributeset usb_control_prop_202504 (usb_control_prop))
+(expandtypeattribute (usb_control_prop_202504) true)
+(typeattribute usb_control_prop_202504)
+(typeattributeset ffs_control_prop_202504 (ffs_control_prop))
+(expandtypeattribute (ffs_control_prop_202504) true)
+(typeattribute ffs_control_prop_202504)
+(typeattributeset ctl_adbd_prop_202504 (ctl_adbd_prop))
+(expandtypeattribute (ctl_adbd_prop_202504) true)
+(typeattribute ctl_adbd_prop_202504)
+(typeattributeset binfmt_miscfs_202504 (binfmt_miscfs))
+(expandtypeattribute (binfmt_miscfs_202504) true)
+(typeattribute binfmt_miscfs_202504)
+(typeattributeset storage_file_202504 (storage_file))
+(expandtypeattribute (storage_file_202504) true)
+(typeattribute storage_file_202504)
+(typeattributeset storagemanager_config_prop_202504 (storagemanager_config_prop))
+(expandtypeattribute (storagemanager_config_prop_202504) true)
+(typeattribute storagemanager_config_prop_202504)
+(typeattributeset vendor_vm_file_202504 (vendor_vm_file))
+(expandtypeattribute (vendor_vm_file_202504) true)
+(typeattribute vendor_vm_file_202504)
+(typeattributeset adservices_manager_service_202504 (adservices_manager_service))
+(expandtypeattribute (adservices_manager_service_202504) true)
+(typeattribute adservices_manager_service_202504)
+(typeattributeset update_verifier_202504 (update_verifier))
+(expandtypeattribute (update_verifier_202504) true)
+(typeattribute update_verifier_202504)
+(typeattributeset wifi_key_202504 (wifi_key))
+(expandtypeattribute (wifi_key_202504) true)
+(typeattribute wifi_key_202504)
+(typeattributeset ctl_mdnsd_prop_202504 (ctl_mdnsd_prop))
+(expandtypeattribute (ctl_mdnsd_prop_202504) true)
+(typeattribute ctl_mdnsd_prop_202504)
+(typeattributeset use_memfd_prop_202504 (use_memfd_prop))
+(expandtypeattribute (use_memfd_prop_202504) true)
+(typeattribute use_memfd_prop_202504)
+(typeattributeset mnt_media_rw_file_202504 (mnt_media_rw_file))
+(expandtypeattribute (mnt_media_rw_file_202504) true)
+(typeattribute mnt_media_rw_file_202504)
+(typeattributeset sysfs_transparent_hugepage_202504 (sysfs_transparent_hugepage))
+(expandtypeattribute (sysfs_transparent_hugepage_202504) true)
+(typeattribute sysfs_transparent_hugepage_202504)
+(typeattributeset update_engine_data_file_202504 (update_engine_data_file))
+(expandtypeattribute (update_engine_data_file_202504) true)
+(typeattribute update_engine_data_file_202504)
+(typeattributeset binderfs_logs_transactions_202504 (binderfs_logs_transactions))
+(expandtypeattribute (binderfs_logs_transactions_202504) true)
+(typeattribute binderfs_logs_transactions_202504)
+(typeattributeset face_vendor_data_file_202504 (face_vendor_data_file))
+(expandtypeattribute (face_vendor_data_file_202504) true)
+(typeattribute face_vendor_data_file_202504)
+(typeattributeset hal_uwb_service_202504 (hal_uwb_service))
+(expandtypeattribute (hal_uwb_service_202504) true)
+(typeattribute hal_uwb_service_202504)
+(typeattributeset uwb_service_202504 (uwb_service))
+(expandtypeattribute (uwb_service_202504) true)
+(typeattribute uwb_service_202504)
+(typeattributeset hal_evs_service_202504 (hal_evs_service))
+(expandtypeattribute (hal_evs_service_202504) true)
+(typeattribute hal_evs_service_202504)
+(typeattributeset staging_data_file_202504 (staging_data_file))
+(expandtypeattribute (staging_data_file_202504) true)
+(typeattribute staging_data_file_202504)
+(typeattributeset sysfs_devices_block_202504 (sysfs_devices_block))
+(expandtypeattribute (sysfs_devices_block_202504) true)
+(typeattribute sysfs_devices_block_202504)
+(typeattributeset mnt_expand_file_202504 (mnt_expand_file))
+(expandtypeattribute (mnt_expand_file_202504) true)
+(typeattribute mnt_expand_file_202504)
+(typeattributeset system_update_service_202504 (system_update_service))
+(expandtypeattribute (system_update_service_202504) true)
+(typeattribute system_update_service_202504)
+(typeattributeset fwk_display_hwservice_202504 (fwk_display_hwservice))
+(expandtypeattribute (fwk_display_hwservice_202504) true)
+(typeattribute fwk_display_hwservice_202504)
+(typeattributeset virtual_face_prop_202504 (virtual_face_prop))
+(expandtypeattribute (virtual_face_prop_202504) true)
+(typeattribute virtual_face_prop_202504)
+(typeattributeset vendor_socket_hook_prop_202504 (vendor_socket_hook_prop))
+(expandtypeattribute (vendor_socket_hook_prop_202504) true)
+(typeattribute vendor_socket_hook_prop_202504)
+(typeattributeset tombstoned_crash_socket_202504 (tombstoned_crash_socket))
+(expandtypeattribute (tombstoned_crash_socket_202504) true)
+(typeattribute tombstoned_crash_socket_202504)
+(typeattributeset proc_drop_caches_202504 (proc_drop_caches))
+(expandtypeattribute (proc_drop_caches_202504) true)
+(typeattribute proc_drop_caches_202504)
+(typeattributeset zram_control_prop_202504 (zram_control_prop))
+(expandtypeattribute (zram_control_prop_202504) true)
+(typeattribute zram_control_prop_202504)
+(typeattributeset app_search_service_202504 (app_search_service))
+(expandtypeattribute (app_search_service_202504) true)
+(typeattribute app_search_service_202504)
+(typeattributeset credstore_exec_202504 (credstore_exec))
+(expandtypeattribute (credstore_exec_202504) true)
+(typeattribute credstore_exec_202504)
+(typeattributeset resourcecache_data_file_202504 (resourcecache_data_file))
+(expandtypeattribute (resourcecache_data_file_202504) true)
+(typeattribute resourcecache_data_file_202504)
+(typeattributeset netd_service_202504 (netd_service))
+(expandtypeattribute (netd_service_202504) true)
+(typeattribute netd_service_202504)
+(typeattributeset auth_service_202504 (auth_service))
+(expandtypeattribute (auth_service_202504) true)
+(typeattribute auth_service_202504)
+(typeattributeset postinstall_apex_mnt_dir_202504 (postinstall_apex_mnt_dir))
+(expandtypeattribute (postinstall_apex_mnt_dir_202504) true)
+(typeattribute postinstall_apex_mnt_dir_202504)
+(typeattributeset bpf_progs_loaded_prop_202504 (bpf_progs_loaded_prop))
+(expandtypeattribute (bpf_progs_loaded_prop_202504) true)
+(typeattribute bpf_progs_loaded_prop_202504)
+(typeattributeset apex_system_server_data_file_202504 (apex_system_server_data_file))
+(expandtypeattribute (apex_system_server_data_file_202504) true)
+(typeattribute apex_system_server_data_file_202504)
+(typeattributeset fwk_scheduler_hwservice_202504 (fwk_scheduler_hwservice))
+(expandtypeattribute (fwk_scheduler_hwservice_202504) true)
+(typeattribute fwk_scheduler_hwservice_202504)
+(typeattributeset fwk_altitude_service_202504 (fwk_altitude_service))
+(expandtypeattribute (fwk_altitude_service_202504) true)
+(typeattribute fwk_altitude_service_202504)
+(typeattributeset memtrackproxy_service_202504 (memtrackproxy_service))
+(expandtypeattribute (memtrackproxy_service_202504) true)
+(typeattribute memtrackproxy_service_202504)
+(typeattributeset sensor_privacy_service_202504 (sensor_privacy_service))
+(expandtypeattribute (sensor_privacy_service_202504) true)
+(typeattribute sensor_privacy_service_202504)
+(typeattributeset libc_debug_prop_202504 (libc_debug_prop))
+(expandtypeattribute (libc_debug_prop_202504) true)
+(typeattribute libc_debug_prop_202504)
+(typeattributeset power_debug_prop_202504 (power_debug_prop))
+(expandtypeattribute (power_debug_prop_202504) true)
+(typeattribute power_debug_prop_202504)
+(typeattributeset log_tag_prop_202504 (log_tag_prop))
+(expandtypeattribute (log_tag_prop_202504) true)
+(typeattribute log_tag_prop_202504)
+(typeattributeset bluetooth_a2dp_offload_prop_202504 (bluetooth_a2dp_offload_prop))
+(expandtypeattribute (bluetooth_a2dp_offload_prop_202504) true)
+(typeattribute bluetooth_a2dp_offload_prop_202504)
+(typeattributeset tombstone_data_file_202504 (tombstone_data_file))
+(expandtypeattribute (tombstone_data_file_202504) true)
+(typeattribute tombstone_data_file_202504)
+(typeattributeset audio_service_202504 (audio_service))
+(expandtypeattribute (audio_service_202504) true)
+(typeattribute audio_service_202504)
+(typeattributeset radio_service_202504 (radio_service))
+(expandtypeattribute (radio_service_202504) true)
+(typeattribute radio_service_202504)
+(typeattributeset unencrypted_data_file_202504 (unencrypted_data_file))
+(expandtypeattribute (unencrypted_data_file_202504) true)
+(typeattribute unencrypted_data_file_202504)
+(typeattributeset gsi_metadata_file_202504 (gsi_metadata_file))
+(expandtypeattribute (gsi_metadata_file_202504) true)
+(typeattribute gsi_metadata_file_202504)
+(typeattributeset ota_metadata_file_202504 (ota_metadata_file))
+(expandtypeattribute (ota_metadata_file_202504) true)
+(typeattribute ota_metadata_file_202504)
+(typeattributeset hal_audio_service_202504 (hal_audio_service))
+(expandtypeattribute (hal_audio_service_202504) true)
+(typeattribute hal_audio_service_202504)
+(typeattributeset hal_radio_service_202504 (hal_radio_service))
+(expandtypeattribute (hal_radio_service_202504) true)
+(typeattribute hal_radio_service_202504)
+(typeattributeset proc_vendor_sched_202504 (proc_vendor_sched))
+(expandtypeattribute (proc_vendor_sched_202504) true)
+(typeattribute proc_vendor_sched_202504)
+(typeattributeset mdns_service_202504 (mdns_service))
+(expandtypeattribute (mdns_service_202504) true)
+(typeattribute mdns_service_202504)
+(typeattributeset properties_device_202504 (properties_device))
+(expandtypeattribute (properties_device_202504) true)
+(typeattribute properties_device_202504)
+(typeattributeset ota_build_prop_202504 (ota_build_prop))
+(expandtypeattribute (ota_build_prop_202504) true)
+(typeattribute ota_build_prop_202504)
+(typeattributeset vibrator_service_202504 (vibrator_service))
+(expandtypeattribute (vibrator_service_202504) true)
+(typeattribute vibrator_service_202504)
+(typeattributeset metadata_file_202504 (metadata_file))
+(expandtypeattribute (metadata_file_202504) true)
+(typeattribute metadata_file_202504)
+(typeattributeset window_service_202504 (window_service))
+(expandtypeattribute (window_service_202504) true)
+(typeattribute window_service_202504)
+(typeattributeset device_config_boot_count_prop_202504 (device_config_boot_count_prop))
+(expandtypeattribute (device_config_boot_count_prop_202504) true)
+(typeattribute device_config_boot_count_prop_202504)
+(typeattributeset vendor_keylayout_file_202504 (vendor_keylayout_file))
+(expandtypeattribute (vendor_keylayout_file_202504) true)
+(typeattribute vendor_keylayout_file_202504)
+(typeattributeset ctl_apexd_prop_202504 (ctl_apexd_prop))
+(expandtypeattribute (ctl_apexd_prop_202504) true)
+(typeattribute ctl_apexd_prop_202504)
+(typeattributeset dnsresolver_service_202504 (dnsresolver_service))
+(expandtypeattribute (dnsresolver_service_202504) true)
+(typeattribute dnsresolver_service_202504)
+(typeattributeset update_engine_202504 (update_engine))
+(expandtypeattribute (update_engine_202504) true)
+(typeattribute update_engine_202504)
+(typeattributeset apex_module_data_file_202504 (apex_module_data_file))
+(expandtypeattribute (apex_module_data_file_202504) true)
+(typeattribute apex_module_data_file_202504)
+(typeattributeset mediaextractor_202504 (mediaextractor))
+(expandtypeattribute (mediaextractor_202504) true)
+(typeattribute mediaextractor_202504)
+(typeattributeset blkid_202504 (blkid))
+(expandtypeattribute (blkid_202504) true)
+(typeattribute blkid_202504)
+(typeattributeset properties_serial_202504 (properties_serial))
+(expandtypeattribute (properties_serial_202504) true)
+(typeattribute properties_serial_202504)
+(typeattributeset fwk_bufferhub_hwservice_202504 (fwk_bufferhub_hwservice))
+(expandtypeattribute (fwk_bufferhub_hwservice_202504) true)
+(typeattribute fwk_bufferhub_hwservice_202504)
+(typeattributeset game_mode_intervention_list_file_202504 (game_mode_intervention_list_file))
+(expandtypeattribute (game_mode_intervention_list_file_202504) true)
+(typeattribute game_mode_intervention_list_file_202504)
+(typeattributeset functionfs_202504 (functionfs))
+(expandtypeattribute (functionfs_202504) true)
+(typeattribute functionfs_202504)
+(typeattributeset lowpan_prop_202504 (lowpan_prop))
+(expandtypeattribute (lowpan_prop_202504) true)
+(typeattribute lowpan_prop_202504)
+(typeattributeset aconfig_storage_flags_metadata_file_202504 (aconfig_storage_flags_metadata_file))
+(expandtypeattribute (aconfig_storage_flags_metadata_file_202504) true)
+(typeattribute aconfig_storage_flags_metadata_file_202504)
+(typeattributeset rild_debug_socket_202504 (rild_debug_socket))
+(expandtypeattribute (rild_debug_socket_202504) true)
+(typeattribute rild_debug_socket_202504)
+(typeattributeset proc_watermark_boost_factor_202504 (proc_watermark_boost_factor))
+(expandtypeattribute (proc_watermark_boost_factor_202504) true)
+(typeattribute proc_watermark_boost_factor_202504)
+(typeattributeset surfaceflinger_service_202504 (surfaceflinger_service))
+(expandtypeattribute (surfaceflinger_service_202504) true)
+(typeattribute surfaceflinger_service_202504)
+(typeattributeset powerstats_service_202504 (powerstats_service))
+(expandtypeattribute (powerstats_service_202504) true)
+(typeattribute powerstats_service_202504)
+(typeattributeset appwidget_service_202504 (appwidget_service))
+(expandtypeattribute (appwidget_service_202504) true)
+(typeattribute appwidget_service_202504)
+(typeattributeset gatekeeper_data_file_202504 (gatekeeper_data_file))
+(expandtypeattribute (gatekeeper_data_file_202504) true)
+(typeattribute gatekeeper_data_file_202504)
+(typeattributeset locale_prop_202504 (locale_prop))
+(expandtypeattribute (locale_prop_202504) true)
+(typeattribute locale_prop_202504)
+(typeattributeset bootloader_prop_202504 (bootloader_prop))
+(expandtypeattribute (bootloader_prop_202504) true)
+(typeattribute bootloader_prop_202504)
+(typeattributeset simpleperf_app_runner_exec_202504 (simpleperf_app_runner_exec))
+(expandtypeattribute (simpleperf_app_runner_exec_202504) true)
+(typeattribute simpleperf_app_runner_exec_202504)
+(typeattributeset sysfs_lru_gen_enabled_202504 (sysfs_lru_gen_enabled))
+(expandtypeattribute (sysfs_lru_gen_enabled_202504) true)
+(typeattribute sysfs_lru_gen_enabled_202504)
+(typeattributeset launcherapps_service_202504 (launcherapps_service))
+(expandtypeattribute (launcherapps_service_202504) true)
+(typeattribute launcherapps_service_202504)
+(typeattributeset hal_power_service_202504 (hal_power_service))
+(expandtypeattribute (hal_power_service_202504) true)
+(typeattribute hal_power_service_202504)
+(typeattributeset hal_graphics_composer_server_tmpfs_202504 (hal_graphics_composer_server_tmpfs))
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_202504) true)
+(typeattribute hal_graphics_composer_server_tmpfs_202504)
+(typeattributeset proc_misc_202504 (proc_misc))
+(expandtypeattribute (proc_misc_202504) true)
+(typeattribute proc_misc_202504)
+(typeattributeset virtual_camera_service_202504 (virtual_camera_service))
+(expandtypeattribute (virtual_camera_service_202504) true)
+(typeattribute virtual_camera_service_202504)
+(typeattributeset ashmem_libcutils_device_202504 (ashmem_libcutils_device))
+(expandtypeattribute (ashmem_libcutils_device_202504) true)
+(typeattribute ashmem_libcutils_device_202504)
+(typeattributeset mnt_user_file_202504 (mnt_user_file))
+(expandtypeattribute (mnt_user_file_202504) true)
+(typeattribute mnt_user_file_202504)
+(typeattributeset rs_exec_202504 (rs_exec))
+(expandtypeattribute (rs_exec_202504) true)
+(typeattribute rs_exec_202504)
+(typeattributeset su_exec_202504 (su_exec))
+(expandtypeattribute (su_exec_202504) true)
+(typeattribute su_exec_202504)
+(typeattributeset vdc_exec_202504 (vdc_exec))
+(expandtypeattribute (vdc_exec_202504) true)
+(typeattribute vdc_exec_202504)
+(typeattributeset net_data_file_202504 (net_data_file))
+(expandtypeattribute (net_data_file_202504) true)
+(typeattribute net_data_file_202504)
+(typeattributeset vold_data_file_202504 (vold_data_file))
+(expandtypeattribute (vold_data_file_202504) true)
+(typeattribute vold_data_file_202504)
+(typeattributeset tv_tuner_resource_mgr_service_202504 (tv_tuner_resource_mgr_service))
+(expandtypeattribute (tv_tuner_resource_mgr_service_202504) true)
+(typeattribute tv_tuner_resource_mgr_service_202504)
+(typeattributeset app_hibernation_service_202504 (app_hibernation_service))
+(expandtypeattribute (app_hibernation_service_202504) true)
+(typeattribute app_hibernation_service_202504)
+(typeattributeset dhcp_202504 (dhcp))
+(expandtypeattribute (dhcp_202504) true)
+(typeattribute dhcp_202504)
+(typeattributeset usbd_exec_202504 (usbd_exec))
+(expandtypeattribute (usbd_exec_202504) true)
+(typeattribute usbd_exec_202504)
+(typeattributeset app_zygote_202504 (app_zygote))
+(expandtypeattribute (app_zygote_202504) true)
+(typeattribute app_zygote_202504)
+(typeattributeset preloads_data_file_202504 (preloads_data_file))
+(expandtypeattribute (preloads_data_file_202504) true)
+(typeattribute preloads_data_file_202504)
+(typeattributeset vold_exec_202504 (vold_exec))
+(expandtypeattribute (vold_exec_202504) true)
+(typeattribute vold_exec_202504)
+(typeattributeset usagestats_service_202504 (usagestats_service))
+(expandtypeattribute (usagestats_service_202504) true)
+(typeattribute usagestats_service_202504)
+(typeattributeset proc_uid_cpupower_202504 (proc_uid_cpupower))
+(expandtypeattribute (proc_uid_cpupower_202504) true)
+(typeattribute proc_uid_cpupower_202504)
+(typeattributeset dhcp_exec_202504 (dhcp_exec))
+(expandtypeattribute (dhcp_exec_202504) true)
+(typeattribute dhcp_exec_202504)
+(typeattributeset fsck_exec_202504 (fsck_exec))
+(expandtypeattribute (fsck_exec_202504) true)
+(typeattribute fsck_exec_202504)
+(typeattributeset hal_tv_cec_hwservice_202504 (hal_tv_cec_hwservice))
+(expandtypeattribute (hal_tv_cec_hwservice_202504) true)
+(typeattribute hal_tv_cec_hwservice_202504)
+(typeattributeset adbd_exec_202504 (adbd_exec))
+(expandtypeattribute (adbd_exec_202504) true)
+(typeattribute adbd_exec_202504)
+(typeattributeset e2fs_exec_202504 (e2fs_exec))
+(expandtypeattribute (e2fs_exec_202504) true)
+(typeattribute e2fs_exec_202504)
+(typeattributeset packages_list_file_202504 (packages_list_file))
+(expandtypeattribute (packages_list_file_202504) true)
+(typeattribute packages_list_file_202504)
+(typeattributeset llkd_exec_202504 (llkd_exec))
+(expandtypeattribute (llkd_exec_202504) true)
+(typeattribute llkd_exec_202504)
+(typeattributeset lmkd_exec_202504 (lmkd_exec))
+(expandtypeattribute (lmkd_exec_202504) true)
+(typeattribute lmkd_exec_202504)
+(typeattributeset logd_exec_202504 (logd_exec))
+(expandtypeattribute (logd_exec_202504) true)
+(typeattribute logd_exec_202504)
+(typeattributeset netd_exec_202504 (netd_exec))
+(expandtypeattribute (netd_exec_202504) true)
+(typeattribute netd_exec_202504)
+(typeattributeset sgdisk_202504 (sgdisk))
+(expandtypeattribute (sgdisk_202504) true)
+(typeattribute sgdisk_202504)
+(typeattributeset init_exec_202504 (init_exec))
+(expandtypeattribute (init_exec_202504) true)
+(typeattribute init_exec_202504)
+(typeattributeset media_router_service_202504 (media_router_service))
+(expandtypeattribute (media_router_service_202504) true)
+(typeattribute media_router_service_202504)
+(typeattributeset stats_config_data_file_202504 (stats_config_data_file))
+(expandtypeattribute (stats_config_data_file_202504) true)
+(typeattribute stats_config_data_file_202504)
+(typeattributeset batteryproperties_service_202504 (batteryproperties_service))
+(expandtypeattribute (batteryproperties_service_202504) true)
+(typeattribute batteryproperties_service_202504)
+(typeattributeset storaged_service_202504 (storaged_service))
+(expandtypeattribute (storaged_service_202504) true)
+(typeattribute storaged_service_202504)
+(typeattributeset system_userdir_file_202504 (system_userdir_file))
+(expandtypeattribute (system_userdir_file_202504) true)
+(typeattribute system_userdir_file_202504)
+(typeattributeset selinuxfs_202504 (selinuxfs))
+(expandtypeattribute (selinuxfs_202504) true)
+(typeattribute selinuxfs_202504)
+(typeattributeset sysfs_thermal_202504 (sysfs_thermal))
+(expandtypeattribute (sysfs_thermal_202504) true)
+(typeattribute sysfs_thermal_202504)
+(typeattributeset system_app_service_202504 (system_app_service))
+(expandtypeattribute (system_app_service_202504) true)
+(typeattribute system_app_service_202504)
+(typeattributeset exported_config_prop_202504 (exported_config_prop))
+(expandtypeattribute (exported_config_prop_202504) true)
+(typeattribute exported_config_prop_202504)
+(typeattributeset fuse_device_202504 (fuse_device))
+(expandtypeattribute (fuse_device_202504) true)
+(typeattribute fuse_device_202504)
+(typeattributeset power_service_202504 (power_service))
+(expandtypeattribute (power_service_202504) true)
+(typeattribute power_service_202504)
+(typeattributeset uncrypt_202504 (uncrypt))
+(expandtypeattribute (uncrypt_202504) true)
+(typeattribute uncrypt_202504)
+(typeattributeset statsdw_socket_202504 (statsdw_socket))
+(expandtypeattribute (statsdw_socket_202504) true)
+(typeattribute statsdw_socket_202504)
+(typeattributeset system_jvmti_agent_prop_202504 (system_jvmti_agent_prop))
+(expandtypeattribute (system_jvmti_agent_prop_202504) true)
+(typeattribute system_jvmti_agent_prop_202504)
+(typeattributeset proc_mounts_202504 (proc_mounts))
+(expandtypeattribute (proc_mounts_202504) true)
+(typeattribute proc_mounts_202504)
+(typeattributeset pdx_display_client_channel_socket_202504 (pdx_display_client_channel_socket))
+(expandtypeattribute (pdx_display_client_channel_socket_202504) true)
+(typeattribute pdx_display_client_channel_socket_202504)
+(typeattributeset content_capture_service_202504 (content_capture_service))
+(expandtypeattribute (content_capture_service_202504) true)
+(typeattribute content_capture_service_202504)
+(typeattributeset secure_element_service_202504 (secure_element_service))
+(expandtypeattribute (secure_element_service_202504) true)
+(typeattribute secure_element_service_202504)
+(typeattributeset snapuserd_proxy_socket_202504 (snapuserd_proxy_socket))
+(expandtypeattribute (snapuserd_proxy_socket_202504) true)
+(typeattribute snapuserd_proxy_socket_202504)
+(typeattributeset vehicle_hal_prop_202504 (vehicle_hal_prop))
+(expandtypeattribute (vehicle_hal_prop_202504) true)
+(typeattribute vehicle_hal_prop_202504)
+(typeattributeset system_passwd_file_202504 (system_passwd_file))
+(expandtypeattribute (system_passwd_file_202504) true)
+(typeattribute system_passwd_file_202504)
+(typeattributeset debugfs_tracing_202504 (debugfs_tracing))
+(expandtypeattribute (debugfs_tracing_202504) true)
+(typeattribute debugfs_tracing_202504)
+(typeattributeset exported_camera_prop_202504 (exported_camera_prop))
+(expandtypeattribute (exported_camera_prop_202504) true)
+(typeattribute exported_camera_prop_202504)
+(typeattributeset build_odm_prop_202504 (build_odm_prop))
+(expandtypeattribute (build_odm_prop_202504) true)
+(typeattribute build_odm_prop_202504)
+(typeattributeset proc_buddyinfo_202504 (proc_buddyinfo))
+(expandtypeattribute (proc_buddyinfo_202504) true)
+(typeattribute proc_buddyinfo_202504)
+(typeattributeset gsi_public_metadata_file_202504 (gsi_public_metadata_file))
+(expandtypeattribute (gsi_public_metadata_file_202504) true)
+(typeattribute gsi_public_metadata_file_202504)
+(typeattributeset ot_daemon_socket_202504 (ot_daemon_socket))
+(expandtypeattribute (ot_daemon_socket_202504) true)
+(typeattribute ot_daemon_socket_202504)
+(typeattributeset keystore_maintenance_service_202504 (keystore_maintenance_service))
+(expandtypeattribute (keystore_maintenance_service_202504) true)
+(typeattribute keystore_maintenance_service_202504)
+(typeattributeset artd_pre_reboot_service_202504 (artd_pre_reboot_service))
+(expandtypeattribute (artd_pre_reboot_service_202504) true)
+(typeattribute artd_pre_reboot_service_202504)
+(typeattributeset cloudsearch_service_202504 (cloudsearch_service))
+(expandtypeattribute (cloudsearch_service_202504) true)
+(typeattribute cloudsearch_service_202504)
+(typeattributeset light_service_202504 (light_service))
+(expandtypeattribute (light_service_202504) true)
+(typeattribute light_service_202504)
+(typeattributeset surfaceflinger_color_prop_202504 (surfaceflinger_color_prop))
+(expandtypeattribute (surfaceflinger_color_prop_202504) true)
+(typeattribute surfaceflinger_color_prop_202504)
+(typeattributeset sysfs_zram_uevent_202504 (sysfs_zram_uevent))
+(expandtypeattribute (sysfs_zram_uevent_202504) true)
+(typeattribute sysfs_zram_uevent_202504)
+(typeattributeset hal_remoteaccess_service_202504 (hal_remoteaccess_service))
+(expandtypeattribute (hal_remoteaccess_service_202504) true)
+(typeattribute hal_remoteaccess_service_202504)
+(typeattributeset fingerprint_vendor_data_file_202504 (fingerprint_vendor_data_file))
+(expandtypeattribute (fingerprint_vendor_data_file_202504) true)
+(typeattribute fingerprint_vendor_data_file_202504)
+(typeattributeset trusty_security_vm_sys_vendor_prop_202504 (trusty_security_vm_sys_vendor_prop))
+(expandtypeattribute (trusty_security_vm_sys_vendor_prop_202504) true)
+(typeattribute trusty_security_vm_sys_vendor_prop_202504)
+(typeattributeset proc_modules_202504 (proc_modules))
+(expandtypeattribute (proc_modules_202504) true)
+(typeattribute proc_modules_202504)
+(typeattributeset proc_pressure_io_202504 (proc_pressure_io))
+(expandtypeattribute (proc_pressure_io_202504) true)
+(typeattribute proc_pressure_io_202504)
+(typeattributeset userdebug_or_eng_prop_202504 (userdebug_or_eng_prop))
+(expandtypeattribute (userdebug_or_eng_prop_202504) true)
+(typeattribute userdebug_or_eng_prop_202504)
+(typeattributeset virtual_touchpad_service_202504 (virtual_touchpad_service))
+(expandtypeattribute (virtual_touchpad_service_202504) true)
+(typeattribute virtual_touchpad_service_202504)
+(typeattributeset hal_keymint_service_202504 (hal_keymint_service))
+(expandtypeattribute (hal_keymint_service_202504) true)
+(typeattribute hal_keymint_service_202504)
+(typeattributeset gnss_device_202504 (gnss_device))
+(expandtypeattribute (gnss_device_202504) true)
+(typeattribute gnss_device_202504)
+(typeattributeset vendor_misc_writer_202504 (vendor_misc_writer))
+(expandtypeattribute (vendor_misc_writer_202504) true)
+(typeattribute vendor_misc_writer_202504)
+(typeattributeset proc_kpageflags_202504 (proc_kpageflags))
+(expandtypeattribute (proc_kpageflags_202504) true)
+(typeattribute proc_kpageflags_202504)
+(typeattributeset wificond_exec_202504 (wificond_exec))
+(expandtypeattribute (wificond_exec_202504) true)
+(typeattribute wificond_exec_202504)
+(typeattributeset hal_light_service_202504 (hal_light_service))
+(expandtypeattribute (hal_light_service_202504) true)
+(typeattribute hal_light_service_202504)
+(typeattributeset proc_interrupts_202504 (proc_interrupts))
+(expandtypeattribute (proc_interrupts_202504) true)
+(typeattribute proc_interrupts_202504)
+(typeattributeset sysfs_loop_202504 (sysfs_loop))
+(expandtypeattribute (sysfs_loop_202504) true)
+(typeattribute sysfs_loop_202504)
+(typeattributeset proc_percpu_pagelist_high_fraction_202504 (proc_percpu_pagelist_high_fraction))
+(expandtypeattribute (proc_percpu_pagelist_high_fraction_202504) true)
+(typeattribute proc_percpu_pagelist_high_fraction_202504)
+(typeattributeset exported_secure_prop_202504 (exported_secure_prop))
+(expandtypeattribute (exported_secure_prop_202504) true)
+(typeattribute exported_secure_prop_202504)
+(typeattributeset proc_hostname_202504 (proc_hostname))
+(expandtypeattribute (proc_hostname_202504) true)
+(typeattribute proc_hostname_202504)
+(typeattributeset hal_bluetooth_service_202504 (hal_bluetooth_service))
+(expandtypeattribute (hal_bluetooth_service_202504) true)
+(typeattribute hal_bluetooth_service_202504)
+(typeattributeset pdx_bufferhub_client_channel_socket_202504 (pdx_bufferhub_client_channel_socket))
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_202504) true)
+(typeattribute pdx_bufferhub_client_channel_socket_202504)
+(typeattributeset hal_gatekeeper_hwservice_202504 (hal_gatekeeper_hwservice))
+(expandtypeattribute (hal_gatekeeper_hwservice_202504) true)
+(typeattribute hal_gatekeeper_hwservice_202504)
+(typeattributeset slideshow_202504 (slideshow))
+(expandtypeattribute (slideshow_202504) true)
+(typeattribute slideshow_202504)
+(typeattributeset sdk_sandbox_service_202504 (sdk_sandbox_service))
+(expandtypeattribute (sdk_sandbox_service_202504) true)
+(typeattribute sdk_sandbox_service_202504)
+(typeattributeset texttospeech_service_202504 (texttospeech_service))
+(expandtypeattribute (texttospeech_service_202504) true)
+(typeattribute texttospeech_service_202504)
+(typeattributeset vendor_task_profiles_file_202504 (vendor_task_profiles_file))
+(expandtypeattribute (vendor_task_profiles_file_202504) true)
+(typeattribute vendor_task_profiles_file_202504)
+(typeattributeset system_net_netd_service_202504 (system_net_netd_service))
+(expandtypeattribute (system_net_netd_service_202504) true)
+(typeattribute system_net_netd_service_202504)
+(typeattributeset hal_wifi_supplicant_service_202504 (hal_wifi_supplicant_service))
+(expandtypeattribute (hal_wifi_supplicant_service_202504) true)
+(typeattribute hal_wifi_supplicant_service_202504)
+(typeattributeset proc_pipe_conf_202504 (proc_pipe_conf))
+(expandtypeattribute (proc_pipe_conf_202504) true)
+(typeattribute proc_pipe_conf_202504)
+(typeattributeset evsmanagerd_service_202504 (evsmanagerd_service))
+(expandtypeattribute (evsmanagerd_service_202504) true)
+(typeattribute evsmanagerd_service_202504)
+(typeattributeset mediaswcodec_exec_202504 (mediaswcodec_exec))
+(expandtypeattribute (mediaswcodec_exec_202504) true)
+(typeattribute mediaswcodec_exec_202504)
+(typeattributeset system_data_root_file_202504 (system_data_root_file))
+(expandtypeattribute (system_data_root_file_202504) true)
+(typeattribute system_data_root_file_202504)
+(typeattributeset sysfs_sync_on_suspend_202504 (sysfs_sync_on_suspend))
+(expandtypeattribute (sysfs_sync_on_suspend_202504) true)
+(typeattribute sysfs_sync_on_suspend_202504)
+(typeattributeset exported_system_prop_202504 (exported_system_prop))
+(expandtypeattribute (exported_system_prop_202504) true)
+(typeattribute exported_system_prop_202504)
+(typeattributeset graphicsstats_service_202504 (graphicsstats_service))
+(expandtypeattribute (graphicsstats_service_202504) true)
+(typeattribute graphicsstats_service_202504)
+(typeattributeset drmserver_service_202504 (drmserver_service))
+(expandtypeattribute (drmserver_service_202504) true)
+(typeattribute drmserver_service_202504)
+(typeattributeset fingerprintd_data_file_202504 (fingerprintd_data_file))
+(expandtypeattribute (fingerprintd_data_file_202504) true)
+(typeattribute fingerprintd_data_file_202504)
+(typeattributeset inotify_202504 (inotify))
+(expandtypeattribute (inotify_202504) true)
+(typeattribute inotify_202504)
+(typeattributeset device_config_vendor_system_native_boot_prop_202504 (device_config_vendor_system_native_boot_prop))
+(expandtypeattribute (device_config_vendor_system_native_boot_prop_202504) true)
+(typeattribute device_config_vendor_system_native_boot_prop_202504)
+(typeattributeset tombstoned_202504 (tombstoned))
+(expandtypeattribute (tombstoned_202504) true)
+(typeattribute tombstoned_202504)
+(typeattributeset pdx_display_vsync_channel_socket_202504 (pdx_display_vsync_channel_socket))
+(expandtypeattribute (pdx_display_vsync_channel_socket_202504) true)
+(typeattribute pdx_display_vsync_channel_socket_202504)
+(typeattributeset gpu_service_202504 (gpu_service))
+(expandtypeattribute (gpu_service_202504) true)
+(typeattribute gpu_service_202504)
+(typeattributeset vd_device_202504 (vd_device))
+(expandtypeattribute (vd_device_202504) true)
+(typeattribute vd_device_202504)
+(typeattributeset hal_gnss_hwservice_202504 (hal_gnss_hwservice))
+(expandtypeattribute (hal_gnss_hwservice_202504) true)
+(typeattribute hal_gnss_hwservice_202504)
+(typeattributeset bt_device_202504 (bt_device))
+(expandtypeattribute (bt_device_202504) true)
+(typeattribute bt_device_202504)
+(typeattributeset sysfs_bluetooth_writable_202504 (sysfs_bluetooth_writable))
+(expandtypeattribute (sysfs_bluetooth_writable_202504) true)
+(typeattribute sysfs_bluetooth_writable_202504)
+(typeattributeset lowpan_device_202504 (lowpan_device))
+(expandtypeattribute (lowpan_device_202504) true)
+(typeattribute lowpan_device_202504)
+(typeattributeset proc_bluetooth_writable_202504 (proc_bluetooth_writable))
+(expandtypeattribute (proc_bluetooth_writable_202504) true)
+(typeattribute proc_bluetooth_writable_202504)
+(typeattributeset dm_device_202504 (dm_device))
+(expandtypeattribute (dm_device_202504) true)
+(typeattribute dm_device_202504)
+(typeattributeset tee_data_file_202504 (tee_data_file))
+(expandtypeattribute (tee_data_file_202504) true)
+(typeattribute tee_data_file_202504)
+(typeattributeset testharness_service_202504 (testharness_service))
+(expandtypeattribute (testharness_service_202504) true)
+(typeattribute testharness_service_202504)
+(typeattributeset trace_data_file_202504 (trace_data_file))
+(expandtypeattribute (trace_data_file_202504) true)
+(typeattribute trace_data_file_202504)
+(typeattributeset default_android_hwservice_202504 (default_android_hwservice))
+(expandtypeattribute (default_android_hwservice_202504) true)
+(typeattribute default_android_hwservice_202504)
+(typeattributeset dumpstate_socket_202504 (dumpstate_socket))
+(expandtypeattribute (dumpstate_socket_202504) true)
+(typeattribute dumpstate_socket_202504)
+(typeattributeset pdx_display_vsync_endpoint_socket_202504 (pdx_display_vsync_endpoint_socket))
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_202504) true)
+(typeattribute pdx_display_vsync_endpoint_socket_202504)
+(typeattributeset hal_thermal_hwservice_202504 (hal_thermal_hwservice))
+(expandtypeattribute (hal_thermal_hwservice_202504) true)
+(typeattribute hal_thermal_hwservice_202504)
+(typeattributeset cache_recovery_file_202504 (cache_recovery_file))
+(expandtypeattribute (cache_recovery_file_202504) true)
+(typeattribute cache_recovery_file_202504)
+(typeattributeset batterystats_service_202504 (batterystats_service))
+(expandtypeattribute (batterystats_service_202504) true)
+(typeattribute batterystats_service_202504)
+(typeattributeset mediadrmserver_202504 (mediadrmserver))
+(expandtypeattribute (mediadrmserver_202504) true)
+(typeattribute mediadrmserver_202504)
+(typeattributeset device_config_service_202504 (device_config_service))
+(expandtypeattribute (device_config_service_202504) true)
+(typeattribute device_config_service_202504)
+(typeattributeset hal_weaver_hwservice_202504 (hal_weaver_hwservice))
+(expandtypeattribute (hal_weaver_hwservice_202504) true)
+(typeattribute hal_weaver_hwservice_202504)
+(typeattributeset vrflinger_vsync_service_202504 (vrflinger_vsync_service))
+(expandtypeattribute (vrflinger_vsync_service_202504) true)
+(typeattribute vrflinger_vsync_service_202504)
+(typeattributeset hal_codec2_hwservice_202504 (hal_codec2_hwservice))
+(expandtypeattribute (hal_codec2_hwservice_202504) true)
+(typeattribute hal_codec2_hwservice_202504)
+(typeattributeset device_202504 (device))
+(expandtypeattribute (device_202504) true)
+(typeattribute device_202504)
+(typeattributeset storage_stub_file_202504 (storage_stub_file))
+(expandtypeattribute (storage_stub_file_202504) true)
+(typeattribute storage_stub_file_202504)
+(typeattributeset ublk_control_device_202504 (ublk_control_device))
+(expandtypeattribute (ublk_control_device_202504) true)
+(typeattribute ublk_control_device_202504)
+(typeattributeset sysfs_nfc_power_writable_202504 (sysfs_nfc_power_writable))
+(expandtypeattribute (sysfs_nfc_power_writable_202504) true)
+(typeattribute sysfs_nfc_power_writable_202504)
+(typeattributeset vfio_device_202504 (vfio_device))
+(expandtypeattribute (vfio_device_202504) true)
+(typeattribute vfio_device_202504)
+(typeattributeset voiceinteraction_service_202504 (voiceinteraction_service))
+(expandtypeattribute (voiceinteraction_service_202504) true)
+(typeattribute voiceinteraction_service_202504)
+(typeattributeset hal_bootctl_hwservice_202504 (hal_bootctl_hwservice))
+(expandtypeattribute (hal_bootctl_hwservice_202504) true)
+(typeattribute hal_bootctl_hwservice_202504)
+(typeattributeset smartspace_service_202504 (smartspace_service))
+(expandtypeattribute (smartspace_service_202504) true)
+(typeattribute smartspace_service_202504)
+(typeattributeset gatekeeper_service_202504 (gatekeeper_service))
+(expandtypeattribute (gatekeeper_service_202504) true)
+(typeattribute gatekeeper_service_202504)
+(typeattributeset device_config_runtime_native_boot_prop_202504 (device_config_runtime_native_boot_prop))
+(expandtypeattribute (device_config_runtime_native_boot_prop_202504) true)
+(typeattribute device_config_runtime_native_boot_prop_202504)
+(typeattributeset snapuserd_log_data_file_202504 (snapuserd_log_data_file))
+(expandtypeattribute (snapuserd_log_data_file_202504) true)
+(typeattribute snapuserd_log_data_file_202504)
+(typeattributeset hidl_allocator_hwservice_202504 (hidl_allocator_hwservice))
+(expandtypeattribute (hidl_allocator_hwservice_202504) true)
+(typeattribute hidl_allocator_hwservice_202504)
+(typeattributeset proc_pagetypeinfo_202504 (proc_pagetypeinfo))
+(expandtypeattribute (proc_pagetypeinfo_202504) true)
+(typeattribute proc_pagetypeinfo_202504)
+(typeattributeset qtaguid_device_202504 (qtaguid_device))
+(expandtypeattribute (qtaguid_device_202504) true)
+(typeattribute qtaguid_device_202504)
+(typeattributeset crossprofileapps_service_202504 (crossprofileapps_service))
+(expandtypeattribute (crossprofileapps_service_202504) true)
+(typeattribute crossprofileapps_service_202504)
+(typeattributeset proc_pressure_mem_202504 (proc_pressure_mem))
+(expandtypeattribute (proc_pressure_mem_202504) true)
+(typeattribute proc_pressure_mem_202504)
+(typeattributeset property_socket_202504 (property_socket))
+(expandtypeattribute (property_socket_202504) true)
+(typeattribute property_socket_202504)
+(typeattributeset traced_oome_heap_session_count_prop_202504 (traced_oome_heap_session_count_prop))
+(expandtypeattribute (traced_oome_heap_session_count_prop_202504) true)
+(typeattribute traced_oome_heap_session_count_prop_202504)
+(typeattributeset wifinl80211_service_202504 (wifinl80211_service))
+(expandtypeattribute (wifinl80211_service_202504) true)
+(typeattribute wifinl80211_service_202504)
+(typeattributeset proc_panic_202504 (proc_panic))
+(expandtypeattribute (proc_panic_202504) true)
+(typeattribute proc_panic_202504)
+(typeattributeset hal_memtrack_service_202504 (hal_memtrack_service))
+(expandtypeattribute (hal_memtrack_service_202504) true)
+(typeattribute hal_memtrack_service_202504)
+(typeattributeset profcollectd_etr_prop_202504 (profcollectd_etr_prop))
+(expandtypeattribute (profcollectd_etr_prop_202504) true)
+(typeattribute profcollectd_etr_prop_202504)
+(typeattributeset mnt_vendor_file_202504 (mnt_vendor_file))
+(expandtypeattribute (mnt_vendor_file_202504) true)
+(typeattribute mnt_vendor_file_202504)
+(typeattributeset vendor_file_202504 (vendor_file))
+(expandtypeattribute (vendor_file_202504) true)
+(typeattribute vendor_file_202504)
+(typeattributeset efs_file_202504 (efs_file))
+(expandtypeattribute (efs_file_202504) true)
+(typeattribute efs_file_202504)
+(typeattributeset appdomain_tmpfs_202504 (appdomain_tmpfs))
+(expandtypeattribute (appdomain_tmpfs_202504) true)
+(typeattribute appdomain_tmpfs_202504)
+(typeattributeset hal_instrumentation_prop_202504 (hal_instrumentation_prop))
+(expandtypeattribute (hal_instrumentation_prop_202504) true)
+(typeattribute hal_instrumentation_prop_202504)
+(typeattributeset timezone_prop_202504 (timezone_prop))
+(expandtypeattribute (timezone_prop_202504) true)
+(typeattribute timezone_prop_202504)
+(typeattributeset device_logging_prop_202504 (device_logging_prop))
+(expandtypeattribute (device_logging_prop_202504) true)
+(typeattribute device_logging_prop_202504)
+(typeattributeset mdnsd_socket_202504 (mdnsd_socket))
+(expandtypeattribute (mdnsd_socket_202504) true)
+(typeattribute mdnsd_socket_202504)
+(typeattributeset traced_enabled_prop_202504 (traced_enabled_prop))
+(expandtypeattribute (traced_enabled_prop_202504) true)
+(typeattribute traced_enabled_prop_202504)
+(typeattributeset nfc_logs_data_file_202504 (nfc_logs_data_file))
+(expandtypeattribute (nfc_logs_data_file_202504) true)
+(typeattribute nfc_logs_data_file_202504)
+(typeattributeset hal_audiocontrol_hwservice_202504 (hal_audiocontrol_hwservice))
+(expandtypeattribute (hal_audiocontrol_hwservice_202504) true)
+(typeattribute hal_audiocontrol_hwservice_202504)
+(typeattributeset vendor_overlay_file_202504 (vendor_overlay_file))
+(expandtypeattribute (vendor_overlay_file_202504) true)
+(typeattribute vendor_overlay_file_202504)
+(typeattributeset color_display_service_202504 (color_display_service))
+(expandtypeattribute (color_display_service_202504) true)
+(typeattribute color_display_service_202504)
+(typeattributeset early_virtmgr_202504 (early_virtmgr))
+(expandtypeattribute (early_virtmgr_202504) true)
+(typeattribute early_virtmgr_202504)
+(typeattributeset incremental_prop_202504 (incremental_prop))
+(expandtypeattribute (incremental_prop_202504) true)
+(typeattribute incremental_prop_202504)
+(typeattributeset icon_file_202504 (icon_file))
+(expandtypeattribute (icon_file_202504) true)
+(typeattribute icon_file_202504)
+(typeattributeset vold_device_202504 (vold_device))
+(expandtypeattribute (vold_device_202504) true)
+(typeattribute vold_device_202504)
+(typeattributeset sysfs_wake_lock_202504 (sysfs_wake_lock))
+(expandtypeattribute (sysfs_wake_lock_202504) true)
+(typeattribute sysfs_wake_lock_202504)
+(typeattributeset arm64_memtag_prop_202504 (arm64_memtag_prop))
+(expandtypeattribute (arm64_memtag_prop_202504) true)
+(typeattribute arm64_memtag_prop_202504)
+(typeattributeset hal_power_stats_service_202504 (hal_power_stats_service))
+(expandtypeattribute (hal_power_stats_service_202504) true)
+(typeattribute hal_power_stats_service_202504)
+(typeattributeset sysfs_ion_202504 (sysfs_ion))
+(expandtypeattribute (sysfs_ion_202504) true)
+(typeattribute sysfs_ion_202504)
+(typeattributeset hal_tv_input_service_202504 (hal_tv_input_service))
+(expandtypeattribute (hal_tv_input_service_202504) true)
+(typeattribute hal_tv_input_service_202504)
+(typeattributeset network_watchlist_service_202504 (network_watchlist_service))
+(expandtypeattribute (network_watchlist_service_202504) true)
+(typeattribute network_watchlist_service_202504)
+(typeattributeset proc_pid_max_202504 (proc_pid_max))
+(expandtypeattribute (proc_pid_max_202504) true)
+(typeattribute proc_pid_max_202504)
diff --git a/prebuilts/api/202504/202504_plat_sepolicy.cil b/prebuilts/api/202504/202504_plat_sepolicy.cil
new file mode 100644
index 0000000..7aec371
--- /dev/null
+++ b/prebuilts/api/202504/202504_plat_sepolicy.cil
@@ -0,0 +1,35256 @@
+(role object_r)
+(role auditadm_r)
+(role secadm_r)
+(typeattribute cil_gen_require)
+(roleattribute cil_gen_require)
+(handleunknown deny)
+(mls true)
+(policycap network_peer_controls)
+(policycap open_perms)
+(policycap extended_socket_class)
+(policycap nnp_nosuid_transition)
+(sid devnull)
+(sidcontext devnull (u object_r null_device ((s0) (s0))))
+(sid UNKNOWN26)
+(sidcontext UNKNOWN26 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN25)
+(sidcontext UNKNOWN25 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN24)
+(sidcontext UNKNOWN24 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN23)
+(sidcontext UNKNOWN23 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN22)
+(sidcontext UNKNOWN22 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN21)
+(sidcontext UNKNOWN21 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN20)
+(sidcontext UNKNOWN20 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN19)
+(sidcontext UNKNOWN19 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN18)
+(sidcontext UNKNOWN18 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN17)
+(sidcontext UNKNOWN17 (u object_r proc ((s0) (s0))))
+(sid UNKNOWN16)
+(sidcontext UNKNOWN16 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN15)
+(sidcontext UNKNOWN15 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN14)
+(sidcontext UNKNOWN14 (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN13)
+(sidcontext UNKNOWN13 (u object_r unlabeled ((s0) (s0))))
+(sid node)
+(sidcontext node (u object_r node ((s0) (s0))))
+(sid netmsg)
+(sidcontext netmsg (u object_r unlabeled ((s0) (s0))))
+(sid netif)
+(sidcontext netif (u object_r netif ((s0) (s0))))
+(sid port)
+(sidcontext port (u object_r port ((s0) (s0))))
+(sid any_socket)
+(sidcontext any_socket (u object_r unlabeled ((s0) (s0))))
+(sid init)
+(sidcontext init (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN6)
+(sidcontext UNKNOWN6 (u object_r unlabeled ((s0) (s0))))
+(sid file)
+(sidcontext file (u object_r unlabeled ((s0) (s0))))
+(sid UNKNOWN4)
+(sidcontext UNKNOWN4 (u object_r labeledfs ((s0) (s0))))
+(sid unlabeled)
+(sidcontext unlabeled (u object_r unlabeled ((s0) (s0))))
+(sid security)
+(sidcontext security (u object_r kernel ((s0) (s0))))
+(sid kernel)
+(sidcontext kernel (u r kernel ((s0) (s0))))
+(sidorder (kernel security unlabeled UNKNOWN4 file UNKNOWN6 init any_socket port netif netmsg node UNKNOWN13 UNKNOWN14 UNKNOWN15 UNKNOWN16 UNKNOWN17 UNKNOWN18 UNKNOWN19 UNKNOWN20 UNKNOWN21 UNKNOWN22 UNKNOWN23 UNKNOWN24 UNKNOWN25 UNKNOWN26 devnull ))
+(fsuse trans mqueue (u object_r mqueue ((s0) (s0))))
+(fsuse trans shm (u object_r shm ((s0) (s0))))
+(fsuse trans devtmpfs (u object_r device ((s0) (s0))))
+(fsuse trans tmpfs (u object_r tmpfs ((s0) (s0))))
+(fsuse trans devpts (u object_r devpts ((s0) (s0))))
+(fsuse task sockfs (u object_r sockfs ((s0) (s0))))
+(fsuse task pipefs (u object_r pipefs ((s0) (s0))))
+(fsuse xattr virtiofs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr incremental-fs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr erofs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr overlay (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr squashfs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr f2fs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr btrfs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr xfs (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr ext4 (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr ext3 (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr ext2 (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr jffs2 (u object_r labeledfs ((s0) (s0))))
+(fsuse xattr yaffs2 (u object_r labeledfs ((s0) (s0))))
+(genfscon binder "/binder_logs/failed_transaction_log" (u object_r binderfs_logs_transaction_history ((s0) (s0))))
+(genfscon binder "/binder_logs/transaction_log" (u object_r binderfs_logs_transaction_history ((s0) (s0))))
+(genfscon binder "/binder_logs/transactions" (u object_r binderfs_logs_transactions ((s0) (s0))))
+(genfscon binder "/binder_logs/stats" (u object_r binderfs_logs_stats ((s0) (s0))))
+(genfscon binder "/binder_logs/proc" (u object_r binderfs_logs_proc ((s0) (s0))))
+(genfscon binder "/binder_logs" (u object_r binderfs_logs ((s0) (s0))))
+(genfscon binder "/vndbinder" (u object_r vndbinder_device ((s0) (s0))))
+(genfscon binder "/hwbinder" (u object_r hwbinder_device ((s0) (s0))))
+(genfscon binder "/features" (u object_r binderfs_features ((s0) (s0))))
+(genfscon binder "/binder" (u object_r binder_device ((s0) (s0))))
+(genfscon binder "/" (u object_r binderfs ((s0) (s0))))
+(genfscon binfmt_misc "/" (u object_r binfmt_miscfs ((s0) (s0))))
+(genfscon bpf "/netd_readonly" (u object_r fs_bpf_netd_readonly ((s0) (s0))))
+(genfscon bpf "/net_private" (u object_r fs_bpf_net_private ((s0) (s0))))
+(genfscon bpf "/netd_shared" (u object_r fs_bpf_netd_shared ((s0) (s0))))
+(genfscon bpf "/uprobestats" (u object_r fs_bpf_uprobestats ((s0) (s0))))
+(genfscon bpf "/net_shared" (u object_r fs_bpf_net_shared ((s0) (s0))))
+(genfscon bpf "/memevents" (u object_r fs_bpf_memevents ((s0) (s0))))
+(genfscon bpf "/tethering" (u object_r fs_bpf_tethering ((s0) (s0))))
+(genfscon bpf "/loader" (u object_r fs_bpf_loader ((s0) (s0))))
+(genfscon bpf "/vendor" (u object_r fs_bpf_vendor ((s0) (s0))))
+(genfscon bpf "/" (u object_r fs_bpf ((s0) (s0))))
+(genfscon cgroup "/" (u object_r cgroup ((s0) (s0))))
+(genfscon cgroup2 "/" (u object_r cgroup_v2 ((s0) (s0))))
+(genfscon configfs "/" (u object_r configfs ((s0) (s0))))
+(genfscon debugfs "/tracing/instances/bootreceiver" (u object_r debugfs_bootreceiver_tracing ((s0) (s0))))
+(genfscon debugfs "/tracing/instances/mm_events" (u object_r debugfs_mm_events_tracing ((s0) (s0))))
+(genfscon debugfs "/tracing/instances/wifi" (u object_r debugfs_wifi_tracing ((s0) (s0))))
+(genfscon debugfs "/tracing/printk_formats" (u object_r debugfs_tracing_printk_formats ((s0) (s0))))
+(genfscon debugfs "/tracing/trace_marker" (u object_r debugfs_trace_marker ((s0) (s0))))
+(genfscon debugfs "/tracing/instances" (u object_r debugfs_tracing_instances ((s0) (s0))))
+(genfscon debugfs "/wakeup_sources" (u object_r debugfs_wakeup_sources ((s0) (s0))))
+(genfscon debugfs "/kprobes" (u object_r debugfs_kprobes ((s0) (s0))))
+(genfscon debugfs "/tracing" (u object_r debugfs_tracing_debug ((s0) (s0))))
+(genfscon debugfs "/mmc0" (u object_r debugfs_mmc ((s0) (s0))))
+(genfscon debugfs "/kcov" (u object_r debugfs_kcov ((s0) (s0))))
+(genfscon debugfs "/" (u object_r debugfs ((s0) (s0))))
+(genfscon esdfs "/" (u object_r sdcardfs ((s0) (s0))))
+(genfscon exfat "/" (u object_r exfat ((s0) (s0))))
+(genfscon functionfs "/" (u object_r functionfs ((s0) (s0))))
+(genfscon fuse "/" (u object_r fuse ((s0) (s0))))
+(genfscon fuseblk "/" (u object_r fuseblk ((s0) (s0))))
+(genfscon fusectl "/" (u object_r fusectlfs ((s0) (s0))))
+(genfscon inotifyfs "/" (u object_r inotify ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_util_clamp_min_rt_default" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_wakeup_granularity_ns" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/perf_event_max_sample_rate" (u object_r proc_perf ((s0) (s0))))
+(genfscon proc "/sys/kernel/perf_cpu_time_max_percent" (u object_r proc_perf ((s0) (s0))))
+(genfscon proc "/sys/vm/percpu_pagelist_high_fraction" (u object_r proc_percpu_pagelist_high_fraction ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_child_runs_first" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_tunable_scaling" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_util_clamp_max" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_util_clamp_min" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/perf_event_paranoid" (u object_r proc_perf ((s0) (s0))))
+(genfscon proc "/sys/kernel/perf_event_mlock_kb" (u object_r proc_perf ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_rt_runtime_us" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/randomize_va_space" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_rt_period_us" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/vm/dirty_background_ratio" (u object_r proc_dirty ((s0) (s0))))
+(genfscon proc "/sys/vm/dirty_expire_centisecs" (u object_r proc_dirty ((s0) (s0))))
+(genfscon proc "/sys/vm/watermark_boost_factor" (u object_r proc_watermark_boost_factor ((s0) (s0))))
+(genfscon proc "/sys/vm/watermark_scale_factor" (u object_r proc_watermark_scale_factor ((s0) (s0))))
+(genfscon proc "/sys/kernel/unprivileged_bpf_" (u object_r proc_bpf ((s0) (s0))))
+(genfscon proc "/uid_cputime/remove_uid_range" (u object_r proc_uid_cputime_removeuid ((s0) (s0))))
+(genfscon proc "/sys/kernel/modules_disabled" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_latency_ns" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/kernel/sched_schedstats" (u object_r proc_sched ((s0) (s0))))
+(genfscon proc "/sys/vm/mmap_rnd_compat_bits" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/vm/min_free_order_shift" (u object_r proc_min_free_order_shift ((s0) (s0))))
+(genfscon proc "/sys/fs/protected_hardlinks" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/core_pipe_limit" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/uid_concurrent_active_time" (u object_r proc_uid_concurrent_active_time ((s0) (s0))))
+(genfscon proc "/uid_concurrent_policy_time" (u object_r proc_uid_concurrent_policy_time ((s0) (s0))))
+(genfscon proc "/sys/fs/protected_symlinks" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/dmesg_restrict" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/usermodehelper" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/uid_cputime/show_uid_stat" (u object_r proc_uid_cputime_showstat ((s0) (s0))))
+(genfscon proc "/sys/kernel/kptr_restrict" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/kernel/panic_on_oops" (u object_r proc_panic ((s0) (s0))))
+(genfscon proc "/sys/vm/extra_free_kbytes" (u object_r proc_extra_free_kbytes ((s0) (s0))))
+(genfscon proc "/sys/vm/overcommit_memory" (u object_r proc_overcommit_memory ((s0) (s0))))
+(genfscon proc "/sys/kernel/core_pattern" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/sys/kernel/poweroff_cmd" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/sys/kernel/domainname" (u object_r proc_hostname ((s0) (s0))))
+(genfscon proc "/sys/kernel/hung_task_" (u object_r proc_hung_task ((s0) (s0))))
+(genfscon proc "/sys/fs/pipe-max-size" (u object_r proc_pipe_conf ((s0) (s0))))
+(genfscon proc "/sys/fs/suid_dumpable" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/vm/max_map_count" (u object_r proc_max_map_count ((s0) (s0))))
+(genfscon proc "/sys/vm/mmap_min_addr" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/sys/vm/mmap_rnd_bits" (u object_r proc_security ((s0) (s0))))
+(genfscon proc "/net/xt_qtaguid/ctrl" (u object_r proc_qtaguid_ctrl ((s0) (s0))))
+(genfscon proc "/sys/kernel/hostname" (u object_r proc_hostname ((s0) (s0))))
+(genfscon proc "/sys/kernel/modprobe" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/sys/vm/page-cluster" (u object_r proc_page_cluster ((s0) (s0))))
+(genfscon proc "/sys/kernel/hotplug" (u object_r usermodehelper ((s0) (s0))))
+(genfscon proc "/sys/kernel/pid_max" (u object_r proc_pid_max ((s0) (s0))))
+(genfscon proc "/sys/vm/drop_caches" (u object_r proc_drop_caches ((s0) (s0))))
+(genfscon proc "/sys/kernel/random" (u object_r proc_random ((s0) (s0))))
+(genfscon proc "/sys/net/core/bpf_" (u object_r proc_bpf ((s0) (s0))))
+(genfscon proc "/uid_time_in_state" (u object_r proc_uid_time_in_state ((s0) (s0))))
+(genfscon proc "/sys/kernel/sysrq" (u object_r proc_sysrq ((s0) (s0))))
+(genfscon proc "/uid_procstat/set" (u object_r proc_uid_procstat_set ((s0) (s0))))
+(genfscon proc "/device-tree/avf" (u object_r proc_dt_avf ((s0) (s0))))
+(genfscon proc "/lowmemorykiller" (u object_r proc_lowmemorykiller ((s0) (s0))))
+(genfscon proc "/net/xt_qtaguid/" (u object_r proc_qtaguid_stat ((s0) (s0))))
+(genfscon proc "/pressure/memory" (u object_r proc_pressure_mem ((s0) (s0))))
+(genfscon proc "/sys/kernel/bpf_" (u object_r proc_bpf ((s0) (s0))))
+(genfscon proc "/cpu/alignment" (u object_r proc_cpu_alignment ((s0) (s0))))
+(genfscon proc "/sysrq-trigger" (u object_r proc_sysrq ((s0) (s0))))
+(genfscon proc "/uid_cpupower/" (u object_r proc_uid_cpupower ((s0) (s0))))
+(genfscon proc "/pagetypeinfo" (u object_r proc_pagetypeinfo ((s0) (s0))))
+(genfscon proc "/pressure/cpu" (u object_r proc_pressure_cpu ((s0) (s0))))
+(genfscon proc "/uid_io/stats" (u object_r proc_uid_io_stats ((s0) (s0))))
+(genfscon proc "/vendor_sched" (u object_r proc_vendor_sched ((s0) (s0))))
+(genfscon proc "/filesystems" (u object_r proc_filesystems ((s0) (s0))))
+(genfscon proc "/pressure/io" (u object_r proc_pressure_io ((s0) (s0))))
+(genfscon proc "/sys/abi/swp" (u object_r proc_abi ((s0) (s0))))
+(genfscon proc "/timer_stats" (u object_r proc_timer ((s0) (s0))))
+(genfscon proc "/tty/drivers" (u object_r proc_tty_drivers ((s0) (s0))))
+(genfscon proc "/vmallocinfo" (u object_r proc_vmallocinfo ((s0) (s0))))
+(genfscon proc "/bootconfig" (u object_r proc_bootconfig ((s0) (s0))))
+(genfscon proc "/interrupts" (u object_r proc_interrupts ((s0) (s0))))
+(genfscon proc "/kpageflags" (u object_r proc_kpageflags ((s0) (s0))))
+(genfscon proc "/timer_list" (u object_r proc_timer ((s0) (s0))))
+(genfscon proc "/allocinfo" (u object_r proc_allocinfo ((s0) (s0))))
+(genfscon proc "/buddyinfo" (u object_r proc_buddyinfo ((s0) (s0))))
+(genfscon proc "/config.gz" (u object_r config_gz ((s0) (s0))))
+(genfscon proc "/diskstats" (u object_r proc_diskstats ((s0) (s0))))
+(genfscon proc "/kallsyms" (u object_r proc_kallsyms ((s0) (s0))))
+(genfscon proc "/slabinfo" (u object_r proc_slabinfo ((s0) (s0))))
+(genfscon proc "/softirqs" (u object_r proc_timer ((s0) (s0))))
+(genfscon proc "/zoneinfo" (u object_r proc_zoneinfo ((s0) (s0))))
+(genfscon proc "/cgroups" (u object_r proc_cgroups ((s0) (s0))))
+(genfscon proc "/cmdline" (u object_r proc_cmdline ((s0) (s0))))
+(genfscon proc "/loadavg" (u object_r proc_loadavg ((s0) (s0))))
+(genfscon proc "/meminfo" (u object_r proc_meminfo ((s0) (s0))))
+(genfscon proc "/modules" (u object_r proc_modules ((s0) (s0))))
+(genfscon proc "/net/tcp" (u object_r proc_net_tcp_udp ((s0) (s0))))
+(genfscon proc "/net/udp" (u object_r proc_net_tcp_udp ((s0) (s0))))
+(genfscon proc "/cpuinfo" (u object_r proc_cpuinfo ((s0) (s0))))
+(genfscon proc "/sys/net" (u object_r proc_net ((s0) (s0))))
+(genfscon proc "/version" (u object_r proc_version ((s0) (s0))))
+(genfscon proc "/asound" (u object_r proc_asound ((s0) (s0))))
+(genfscon proc "/mounts" (u object_r proc_mounts ((s0) (s0))))
+(genfscon proc "/uptime" (u object_r proc_uptime ((s0) (s0))))
+(genfscon proc "/vmstat" (u object_r proc_vmstat ((s0) (s0))))
+(genfscon proc "/iomem" (u object_r proc_iomem ((s0) (s0))))
+(genfscon proc "/locks" (u object_r proc_locks ((s0) (s0))))
+(genfscon proc "/swaps" (u object_r proc_swaps ((s0) (s0))))
+(genfscon proc "/keys" (u object_r proc_keys ((s0) (s0))))
+(genfscon proc "/kmsg" (u object_r proc_kmsg ((s0) (s0))))
+(genfscon proc "/misc" (u object_r proc_misc ((s0) (s0))))
+(genfscon proc "/stat" (u object_r proc_stat ((s0) (s0))))
+(genfscon proc "/uid/" (u object_r proc_uid_time_in_state ((s0) (s0))))
+(genfscon proc "/net" (u object_r proc_net ((s0) (s0))))
+(genfscon proc "/" (u object_r proc ((s0) (s0))))
+(genfscon pstore "/" (u object_r pstorefs ((s0) (s0))))
+(genfscon rootfs "/" (u object_r rootfs ((s0) (s0))))
+(genfscon sdcardfs "/" (u object_r sdcardfs ((s0) (s0))))
+(genfscon securityfs "/" (u object_r securityfs ((s0) (s0))))
+(genfscon selinuxfs "/" (u object_r selinuxfs ((s0) (s0))))
+(genfscon sysfs "/module/dm_verity/parameters/prefetch_cluster" (u object_r sysfs_dm_verity ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/timed_output/vibrator/enable" (u object_r sysfs_vibrator ((s0) (s0))))
+(genfscon sysfs "/module/dm_bufio/parameters/max_age_seconds" (u object_r sysfs_dm_verity ((s0) (s0))))
+(genfscon sysfs "/firmware/devicetree/base/firmware/android" (u object_r sysfs_dt_firmware_android ((s0) (s0))))
+(genfscon sysfs "/devices/platform/nfc-power/nfc_power" (u object_r sysfs_nfc_power_writable ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/zram0/uevent" (u object_r sysfs_zram_uevent ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/zram1/uevent" (u object_r sysfs_zram_uevent ((s0) (s0))))
+(genfscon sysfs "/kernel/mm/pgsize_migration/enabled" (u object_r sysfs_pgsize_migration ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/misc/hw_random" (u object_r sysfs_hwrandom ((s0) (s0))))
+(genfscon sysfs "/kernel/mm/transparent_hugepage" (u object_r sysfs_transparent_hugepage ((s0) (s0))))
+(genfscon sysfs "/module/wlan/parameters/fwpath" (u object_r sysfs_wlan_fwpath ((s0) (s0))))
+(genfscon sysfs "/firmware/devicetree/base/avf" (u object_r sysfs_dt_avf ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/android_usb" (u object_r sysfs_android_usb ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/zram0" (u object_r sysfs_zram ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/zram1" (u object_r sysfs_zram ((s0) (s0))))
+(genfscon sysfs "/fs/incremental-fs/instances" (u object_r sysfs_fs_incfs_metrics ((s0) (s0))))
+(genfscon sysfs "/module/tcp_cubic/parameters" (u object_r sysfs_net ((s0) (s0))))
+(genfscon sysfs "/class/rfkill/rfkill0/state" (u object_r sysfs_bluetooth_writable ((s0) (s0))))
+(genfscon sysfs "/class/rfkill/rfkill1/state" (u object_r sysfs_bluetooth_writable ((s0) (s0))))
+(genfscon sysfs "/class/rfkill/rfkill2/state" (u object_r sysfs_bluetooth_writable ((s0) (s0))))
+(genfscon sysfs "/class/rfkill/rfkill3/state" (u object_r sysfs_bluetooth_writable ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/loop" (u object_r sysfs_loop ((s0) (s0))))
+(genfscon sysfs "/fs/fuse/bpf_prog_type_fuse" (u object_r sysfs_fs_fuse_bpf ((s0) (s0))))
+(genfscon sysfs "/fs/incremental-fs/features" (u object_r sysfs_fs_incfs_features ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/dm-" (u object_r sysfs_dm ((s0) (s0))))
+(genfscon sysfs "/kernel/mm/lru_gen/enabled" (u object_r sysfs_lru_gen_enabled ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/misc/uhid" (u object_r sysfs_uhid ((s0) (s0))))
+(genfscon sysfs "/kernel/memory_state_time" (u object_r sysfs_power ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/block/" (u object_r sysfs_devices_block ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/switch" (u object_r sysfs_switch ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/wakeup" (u object_r sysfs_wakeup ((s0) (s0))))
+(genfscon sysfs "/module/lowmemorykiller" (u object_r sysfs_lowmemorykiller ((s0) (s0))))
+(genfscon sysfs "/power/sync_on_suspend" (u object_r sysfs_sync_on_suspend ((s0) (s0))))
+(genfscon sysfs "/kernel/wakeup_reasons" (u object_r sysfs_wakeup_reasons ((s0) (s0))))
+(genfscon sysfs "/kernel/dmabuf/buffers" (u object_r sysfs_dmabuf_stats ((s0) (s0))))
+(genfscon sysfs "/firmware/acpi/tables" (u object_r sysfs_firmware_acpi_tables ((s0) (s0))))
+(genfscon sysfs "/kernel/uevent_helper" (u object_r sysfs_usermodehelper ((s0) (s0))))
+(genfscon sysfs "/devices/virtual/net" (u object_r sysfs_net ((s0) (s0))))
+(genfscon sysfs "/power/suspend_stats" (u object_r sysfs_suspend_stats ((s0) (s0))))
+(genfscon sysfs "/kernel/vendor_sched" (u object_r sysfs_vendor_sched ((s0) (s0))))
+(genfscon sysfs "/devices/system/cpu" (u object_r sysfs_devices_system_cpu ((s0) (s0))))
+(genfscon sysfs "/power/wakeup_count" (u object_r sysfs_power ((s0) (s0))))
+(genfscon sysfs "/class/android_usb" (u object_r sysfs_android_usb ((s0) (s0))))
+(genfscon sysfs "/power/wake_unlock" (u object_r sysfs_wake_lock ((s0) (s0))))
+(genfscon sysfs "/fs/ext4/features" (u object_r sysfs_fs_ext4_features ((s0) (s0))))
+(genfscon sysfs "/fs/fuse/features" (u object_r sysfs_fs_fuse_features ((s0) (s0))))
+(genfscon sysfs "/power/autosleep" (u object_r sysfs_power ((s0) (s0))))
+(genfscon sysfs "/power/wake_lock" (u object_r sysfs_wake_lock ((s0) (s0))))
+(genfscon sysfs "/kernel/dma_heap" (u object_r sysfs_dma_heap ((s0) (s0))))
+(genfscon sysfs "/devices/cs_etm" (u object_r sysfs_devices_cs_etm ((s0) (s0))))
+(genfscon sysfs "/devices/uprobe" (u object_r sysfs_uprobe ((s0) (s0))))
+(genfscon sysfs "/kernel/mm/cma" (u object_r sysfs_cma ((s0) (s0))))
+(genfscon sysfs "/class/extcon" (u object_r sysfs_extcon ((s0) (s0))))
+(genfscon sysfs "/class/switch" (u object_r sysfs_switch ((s0) (s0))))
+(genfscon sysfs "/class/wakeup" (u object_r sysfs_wakeup ((s0) (s0))))
+(genfscon sysfs "/kernel/notes" (u object_r sysfs_kernel_notes ((s0) (s0))))
+(genfscon sysfs "/power/state" (u object_r sysfs_power ((s0) (s0))))
+(genfscon sysfs "/kernel/ipv4" (u object_r sysfs_ipv4 ((s0) (s0))))
+(genfscon sysfs "/class/leds" (u object_r sysfs_leds ((s0) (s0))))
+(genfscon sysfs "/kernel/ion" (u object_r sysfs_ion ((s0) (s0))))
+(genfscon sysfs "/class/gpu" (u object_r sysfs_gpu ((s0) (s0))))
+(genfscon sysfs "/class/net" (u object_r sysfs_net ((s0) (s0))))
+(genfscon sysfs "/class/rtc" (u object_r sysfs_rtc ((s0) (s0))))
+(genfscon sysfs "/fs/f2fs" (u object_r sysfs_fs_f2fs ((s0) (s0))))
+(genfscon sysfs "/" (u object_r sysfs ((s0) (s0))))
+(genfscon tracefs "/events/filemap/mm_filemap_delete_from_page_cache/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/vmscan/mm_vmscan_direct_reclaim_begin/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/filemap/mm_filemap_add_to_page_cache/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/vmscan/mm_vmscan_direct_reclaim_end/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_transaction_alloc_buf/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_transaction_received/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_es_lookup_extent_enter/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_es_lookup_extent_exit/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/synthetic/suspend_resume_minimal" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/vmscan/mm_vmscan_kswapd_sleep/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/vmscan/mm_vmscan_kswapd_wake/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/synthetic/rss_stat_throttled" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/thermal/thermal_temperature/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_blocked_reason/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/cpu_frequency_limits/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_set_priority/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_sync_file_enter/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_sync_file_enter/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_transaction/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_get_data_block/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_sync_file_exit/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_da_write_begin/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_sync_file_exit/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_process_exit/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_process_free/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/mm_event/mm_event_record/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/oom/oom_score_adj_update/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/block/block_rq_complete/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_cpu_hotplug/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_da_write_end/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_wakeup_new/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_pi_setprio/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_write_begin/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/gpu_work_period/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_command/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ext4/ext4_load_inode/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/block/block_rq_issue/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/clock_set_rate/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/suspend_resume/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_locked/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_unlock/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_return/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/kmem/ion_heap_shrink/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/gpu_mem/gpu_mem_total" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_write_end/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/cpu_frequency/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/clock_disable/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/gpu_frequency/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/cpufreq_interactive/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/thermal/cdev_update/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_switch/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_wakeup/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/sched/sched_waking/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/clock_enable/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/binder/binder_lock/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/kmem/ion_heap_grow/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/task/task_newtask/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/cpuhp/cpuhp_enter/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/cpuhp/cpuhp_pause/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/task/task_rename/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/cpuhp/cpuhp_exit/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/clk/clk_set_rate/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/lowmemorykiller/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/oom/mark_victim/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/clk/clk_disable/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/instances/bootreceiver" (u object_r debugfs_bootreceiver_tracing ((s0) (s0))))
+(genfscon tracefs "/events/f2fs/f2fs_iget/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/power/cpu_idle/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/clk/clk_enable/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/kmem/rss_stat/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ion/ion_stat/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ftrace/print/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/instances/mm_events" (u object_r debugfs_mm_events_tracing ((s0) (s0))))
+(genfscon tracefs "/options/record-tgid" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/saved_cmdlines_size" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/header_page" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/options/print-tgid" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/options/overwrite" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/dma_fence/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/synthetic_events" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/instances/wifi" (u object_r debugfs_wifi_tracing ((s0) (s0))))
+(genfscon tracefs "/printk_formats" (u object_r debugfs_tracing_printk_formats ((s0) (s0))))
+(genfscon tracefs "/buffer_percent" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/buffer_size_kb" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/cgroup/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/fence/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/trace_marker" (u object_r debugfs_trace_marker ((s0) (s0))))
+(genfscon tracefs "/events/sync/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/per_cpu/cpu" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/trace_clock" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/ipi/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/events/irq/" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/tracing_on" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/instances" (u object_r debugfs_tracing_instances ((s0) (s0))))
+(genfscon tracefs "/trace" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/hyp" (u object_r debugfs_tracing ((s0) (s0))))
+(genfscon tracefs "/" (u object_r debugfs_tracing_debug ((s0) (s0))))
+(genfscon usbfs "/" (u object_r usbfs ((s0) (s0))))
+(genfscon vfat "/" (u object_r vfat ((s0) (s0))))
+(common socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind ))
+(common file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads ))
+(common cap2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf ))
+(common cap (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap ))
+(common ipc (create destroy getattr setattr read write associate unix_read unix_write ))
+(typealias rs_data_file)
+(typealiasactual rs_data_file app_exec_data_file)
+(class security (compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot read_policy validate_trans ))
+(class process (fork transition sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate getrlimit ))
+(mlsconstrain (process (sigkill sigstop signal ptrace setsched setpgid setcap share setrlimit)) (or (eq l1 l2) (eq t1 mlstrustedsubject)))
+(mlsconstrain (process (ptrace getsched getsession getpgid getcap share getattr)) (or (dom l1 l2) (eq t1 mlstrustedsubject)))
+(mlsconstrain (process (transition dyntransition)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class system (ipc_info syslog_read syslog_mod syslog_console module_request module_load ))
+(class capability ())
+(classcommon capability cap)
+(class filesystem (mount remount unmount getattr relabelfrom relabelto associate quotamod quotaget watch ))
+(class file (execute_no_trans entrypoint ))
+(classcommon file file)
+(mlsconstrain (file (write setattr append unlink link rename)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (file (read getattr execute)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (file (setattr unlink link rename open)) (or (or (and (neq t2 app_data_file_type) (neq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)))
+(mlsconstrain (file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class anon_inode ())
+(classcommon anon_inode file)
+(mlsconstrain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute open execmod)) (eq l1 l2))
+(class dir (add_name remove_name reparent search rmdir ))
+(classcommon dir file)
+(mlsconstrain (dir (write setattr rename add_name remove_name reparent rmdir)) (or (or (or (eq t2 app_data_file_type) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (dir (read getattr search)) (or (or (or (or (eq t2 app_data_file_type) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)) (and (eq t1 mlsvendorcompat) (or (eq t2 system_data_file) (eq t2 user_profile_root_file)))))
+(mlsconstrain (dir (getattr setattr rename open add_name remove_name reparent search rmdir)) (or (or (neq t2 app_data_file_type) (dom l1 l2)) (eq t1 mlstrustedsubject)))
+(mlsconstrain (dir (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class fd (use ))
+(class lnk_file ())
+(classcommon lnk_file file)
+(mlsconstrain (lnk_file (write setattr append unlink link rename)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (lnk_file (read getattr execute)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (lnk_file (read setattr unlink link rename open)) (or (or (and (neq t2 privapp_data_file) (neq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)))
+(mlsconstrain (lnk_file (read setattr unlink link rename open)) (or (or (or (neq t2 app_data_file_type) (eq t2 privapp_data_file)) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(mlsconstrain (lnk_file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class chr_file (execute_no_trans entrypoint ))
+(classcommon chr_file file)
+(mlsconstrain (chr_file (write setattr append unlink link rename)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (chr_file (read getattr execute)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (chr_file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class blk_file ())
+(classcommon blk_file file)
+(mlsconstrain (blk_file (write setattr append unlink link rename)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (blk_file (read getattr execute)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (blk_file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class sock_file ())
+(classcommon sock_file file)
+(mlsconstrain (sock_file (write setattr append unlink link rename)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (eq l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (sock_file (read getattr execute)) (or (or (or (or (eq t2 app_data_file_type) (eq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)))
+(mlsconstrain (sock_file (setattr unlink link rename open)) (or (or (and (neq t2 app_data_file_type) (neq t2 appdomain_tmpfs)) (dom l1 l2)) (eq t1 mlstrustedsubject)))
+(mlsconstrain (sock_file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class fifo_file ())
+(classcommon fifo_file file)
+(mlsconstrain (fifo_file (write setattr append unlink link rename)) (or (or (or (eq l1 l2) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)) (eq t2 domain)))
+(mlsconstrain (fifo_file (read getattr)) (or (or (or (dom l1 l2) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedobject)) (eq t2 domain)))
+(mlsconstrain (fifo_file (create relabelfrom relabelto)) (and (eq l2 h2) (or (eq l1 l2) (eq t1 mlstrustedsubject))))
+(class socket ())
+(classcommon socket socket)
+(mlsconstrain (socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class tcp_socket (node_bind name_connect ))
+(classcommon tcp_socket socket)
+(mlsconstrain (tcp_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class udp_socket (node_bind ))
+(classcommon udp_socket socket)
+(mlsconstrain (udp_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class rawip_socket (node_bind ))
+(classcommon rawip_socket socket)
+(mlsconstrain (rawip_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class node (recvfrom sendto ))
+(class netif (ingress egress ))
+(class netlink_socket ())
+(classcommon netlink_socket socket)
+(mlsconstrain (netlink_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class packet_socket ())
+(classcommon packet_socket socket)
+(mlsconstrain (packet_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class key_socket ())
+(classcommon key_socket socket)
+(mlsconstrain (key_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class unix_stream_socket (connectto ))
+(classcommon unix_stream_socket socket)
+(mlsconstrain (unix_stream_socket (connectto)) (or (or (eq l1 l2) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedsubject)))
+(mlsconstrain (unix_stream_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class unix_dgram_socket ())
+(classcommon unix_dgram_socket socket)
+(mlsconstrain (unix_dgram_socket (sendto)) (or (or (eq l1 l2) (eq t1 mlstrustedsubject)) (eq t2 mlstrustedsubject)))
+(mlsconstrain (unix_dgram_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class sem ())
+(classcommon sem ipc)
+(class msg (send receive ))
+(class msgq (enqueue ))
+(classcommon msgq ipc)
+(class shm (lock ))
+(classcommon shm ipc)
+(class ipc ())
+(classcommon ipc ipc)
+(class netlink_route_socket (nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh ))
+(classcommon netlink_route_socket socket)
+(mlsconstrain (netlink_route_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_tcpdiag_socket (nlmsg_read nlmsg_write ))
+(classcommon netlink_tcpdiag_socket socket)
+(mlsconstrain (netlink_tcpdiag_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_nflog_socket ())
+(classcommon netlink_nflog_socket socket)
+(mlsconstrain (netlink_nflog_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_xfrm_socket (nlmsg_read nlmsg_write ))
+(classcommon netlink_xfrm_socket socket)
+(mlsconstrain (netlink_xfrm_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_selinux_socket ())
+(classcommon netlink_selinux_socket socket)
+(mlsconstrain (netlink_selinux_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_audit_socket (nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit ))
+(classcommon netlink_audit_socket socket)
+(mlsconstrain (netlink_audit_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_dnrt_socket ())
+(classcommon netlink_dnrt_socket socket)
+(mlsconstrain (netlink_dnrt_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class association (sendto recvfrom setcontext polmatch ))
+(class netlink_kobject_uevent_socket ())
+(classcommon netlink_kobject_uevent_socket socket)
+(mlsconstrain (netlink_kobject_uevent_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class appletalk_socket ())
+(classcommon appletalk_socket socket)
+(mlsconstrain (appletalk_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class packet (send recv relabelto forward_in forward_out ))
+(class key (view read write search link setattr create ))
+(class dccp_socket (node_bind name_connect ))
+(classcommon dccp_socket socket)
+(class memprotect (mmap_zero ))
+(class peer (recv ))
+(class capability2 ())
+(classcommon capability2 cap2)
+(class kernel_service (use_as_override create_files_as ))
+(class tun_socket (attach_queue ))
+(classcommon tun_socket socket)
+(mlsconstrain (tun_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class binder (impersonate call set_context_mgr transfer ))
+(class netlink_iscsi_socket ())
+(classcommon netlink_iscsi_socket socket)
+(mlsconstrain (netlink_iscsi_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_fib_lookup_socket ())
+(classcommon netlink_fib_lookup_socket socket)
+(mlsconstrain (netlink_fib_lookup_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_connector_socket ())
+(classcommon netlink_connector_socket socket)
+(mlsconstrain (netlink_connector_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_netfilter_socket ())
+(classcommon netlink_netfilter_socket socket)
+(mlsconstrain (netlink_netfilter_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_generic_socket ())
+(classcommon netlink_generic_socket socket)
+(mlsconstrain (netlink_generic_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_scsitransport_socket ())
+(classcommon netlink_scsitransport_socket socket)
+(mlsconstrain (netlink_scsitransport_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_rdma_socket ())
+(classcommon netlink_rdma_socket socket)
+(mlsconstrain (netlink_rdma_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netlink_crypto_socket ())
+(classcommon netlink_crypto_socket socket)
+(mlsconstrain (netlink_crypto_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class infiniband_pkey (access ))
+(class infiniband_endport (manage_subnet ))
+(class cap_userns ())
+(classcommon cap_userns cap)
+(class cap2_userns ())
+(classcommon cap2_userns cap2)
+(class sctp_socket (node_bind name_connect association ))
+(classcommon sctp_socket socket)
+(mlsconstrain (sctp_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class icmp_socket (node_bind ))
+(classcommon icmp_socket socket)
+(mlsconstrain (icmp_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class ax25_socket ())
+(classcommon ax25_socket socket)
+(mlsconstrain (ax25_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class ipx_socket ())
+(classcommon ipx_socket socket)
+(mlsconstrain (ipx_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class netrom_socket ())
+(classcommon netrom_socket socket)
+(mlsconstrain (netrom_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class atmpvc_socket ())
+(classcommon atmpvc_socket socket)
+(mlsconstrain (atmpvc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class x25_socket ())
+(classcommon x25_socket socket)
+(mlsconstrain (x25_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class rose_socket ())
+(classcommon rose_socket socket)
+(mlsconstrain (rose_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class decnet_socket ())
+(classcommon decnet_socket socket)
+(mlsconstrain (decnet_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class atmsvc_socket ())
+(classcommon atmsvc_socket socket)
+(mlsconstrain (atmsvc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class rds_socket ())
+(classcommon rds_socket socket)
+(mlsconstrain (rds_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class irda_socket ())
+(classcommon irda_socket socket)
+(mlsconstrain (irda_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class pppox_socket ())
+(classcommon pppox_socket socket)
+(mlsconstrain (pppox_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class llc_socket ())
+(classcommon llc_socket socket)
+(mlsconstrain (llc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class can_socket ())
+(classcommon can_socket socket)
+(mlsconstrain (can_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class tipc_socket ())
+(classcommon tipc_socket socket)
+(mlsconstrain (tipc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class bluetooth_socket ())
+(classcommon bluetooth_socket socket)
+(mlsconstrain (bluetooth_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class iucv_socket ())
+(classcommon iucv_socket socket)
+(mlsconstrain (iucv_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class rxrpc_socket ())
+(classcommon rxrpc_socket socket)
+(mlsconstrain (rxrpc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class isdn_socket ())
+(classcommon isdn_socket socket)
+(mlsconstrain (isdn_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class phonet_socket ())
+(classcommon phonet_socket socket)
+(mlsconstrain (phonet_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class ieee802154_socket ())
+(classcommon ieee802154_socket socket)
+(mlsconstrain (ieee802154_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class caif_socket ())
+(classcommon caif_socket socket)
+(mlsconstrain (caif_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class alg_socket ())
+(classcommon alg_socket socket)
+(mlsconstrain (alg_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class nfc_socket ())
+(classcommon nfc_socket socket)
+(mlsconstrain (nfc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class vsock_socket ())
+(classcommon vsock_socket socket)
+(mlsconstrain (vsock_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class kcm_socket ())
+(classcommon kcm_socket socket)
+(mlsconstrain (kcm_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class qipcrtr_socket ())
+(classcommon qipcrtr_socket socket)
+(mlsconstrain (qipcrtr_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class smc_socket ())
+(classcommon smc_socket socket)
+(mlsconstrain (smc_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class xdp_socket ())
+(classcommon xdp_socket socket)
+(mlsconstrain (xdp_socket (create relabelfrom relabelto)) (or (and (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
+(class mctp_socket ())
+(classcommon mctp_socket socket)
+(class process2 (nnp_transition nosuid_transition ))
+(class bpf (map_create map_read map_write prog_load prog_run ))
+(class perf_event (open cpu kernel tracepoint read write ))
+(class io_uring (override_creds sqpoll cmd ))
+(class lockdown (integrity confidentiality ))
+(class user_namespace (create ))
+(class property_service (set ))
+(class service_manager (add find list ))
+(class hwservice_manager (add find list ))
+(class keystore_key (get_state get insert delete exist list reset password lock unlock is_empty sign verify grant duplicate clear_uid add_auth user_changed gen_unique_id ))
+(class keystore2 (add_auth change_password change_user clear_ns clear_uid delete_all_keys early_boot_ended get_attestation_key get_auth_token get_last_auth_time get_state list lock pull_metrics report_off_body reset unlock ))
+(class keystore2_key (convert_storage_key_to_ephemeral delete gen_unique_id get_info grant manage_blob rebind req_forced_op update use use_dev_id ))
+(class diced (demote demote_self derive get_attestation_chain use_seal use_sign ))
+(class drmservice (consumeRights setPlaybackStatus openDecryptSession closeDecryptSession initializeDecryptUnit decrypt finalizeDecryptUnit pread ))
+(class tee_service (use ))
+(classorder (security process system capability filesystem file anon_inode dir fd lnk_file chr_file blk_file sock_file fifo_file socket tcp_socket udp_socket rawip_socket node netif netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket sem msg msgq shm ipc netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket association netlink_kobject_uevent_socket appletalk_socket packet key dccp_socket memprotect peer capability2 kernel_service tun_socket binder netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket infiniband_pkey infiniband_endport cap_userns cap2_userns sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket mctp_socket process2 bpf perf_event io_uring lockdown user_namespace property_service service_manager hwservice_manager keystore_key keystore2 keystore2_key diced drmservice tee_service ))
+(role r)
+(roletype r domain)
+(typeattribute dev_type)
+(typeattributeset dev_type (device ashmem_device ashmem_libcutils_device audio_device binder_device hwbinder_device vndbinder_device block_device bt_device camera_device dm_device ublk_block_device dm_user_device ublk_control_device keychord_device loop_control_device loop_device pmsg_device radio_device ram_device rtc_device vd_device vold_device console_device fscklogs gpu_device graphics_device hw_random_device input_device port_device lowpan_device mtp_device nfc_device ptmx_device kmsg_device kmsg_debug_device null_device random_device secure_element_device sensors_device serial_device socket_device owntty_device tty_device video_device zero_device fuse_device iio_device ion_device dmabuf_heap_device dmabuf_system_heap_device dmabuf_system_secure_heap_device qtaguid_device watchdog_device uhid_device uio_device tun_device usbaccessory_device usb_device usb_serial_device gnss_device properties_device properties_serial property_info hidraw_device hci_attach_dev rpmsg_device root_block_device frp_block_device system_block_device recovery_block_device boot_block_device dtbo_block_device userdata_block_device zoned_block_device cache_block_device swap_block_device metadata_block_device misc_block_device super_block_device sdcard_block_device userdata_sysdev rootdisk_sysdev vfio_device tee_device kvm_device ))
+(typeattribute bpffs_type)
+(typeattributeset bpffs_type (fs_bpf fs_bpf_tethering fs_bpf_vendor fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_loader fs_bpf_uprobestats fs_bpf_memevents ))
+(typeattribute domain)
+(typeattributeset domain (adbd aidl_lazy_test_server apexd app_zygote artd atrace audioserver blkid blkid_untrusted bluetooth bootanim bootstat bpfloader bufferhubd cameraserver charger charger_vendor crash_dump credstore crosvm dhcp dnsmasq drmserver dumpstate e2fs early_virtmgr ephemeral_app evsmanagerd extra_free_kbytes fastbootd fingerprintd flags_health_check fsck fsck_untrusted gatekeeperd gmscore_app gpuservice healthd heapprofd hwservicemanager idmap incident incident_helper incidentd init inputflinger installd isolated_app isolated_compute_app kernel keystore llkd lmkd logd logpersist mdnsd mediadrmserver mediaextractor mediametrics mediaprovider mediaserver mediaswcodec mediatranscoding modprobe mtp netd netutils_wrapper network_stack nfc perfetto performanced platform_app postinstall ppp priv_app prng_seeder profman radio recovery recovery_persist recovery_refresh rkpdapp rs rss_hwm_reset runas runas_app sdcardd secure_element servicemanager sgdisk shared_relro shell simpleperf simpleperf_app_runner slideshow statsd su surfaceflinger system_app system_server tee tombstoned toolbox traced traced_perf traced_probes traceur_app ueventd uncrypt untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine update_verifier usbd vdc vendor_init vendor_misc_writer vendor_modprobe vendor_shell virtual_camera virtual_touchpad virtualizationmanager vndservicemanager vold vold_prepare_subdirs watchdogd webview_zygote wificond zygote aconfigd aconfigd_mainline adbd_tradeinmode apex_test_prepostinstall apexd_derive_classpath art_boot art_exec auditctl automotive_display_service bert_collector blank_screen boringssl_self_test vendor_boringssl_self_test canhalconfigurator clatd compos_fd_server compos_verify composd cppreopts derive_classpath derive_sdk device_as_webcam dex2oat dexopt_chroot_setup dmesgd fuseblkd fuseblkd_untrusted fwk_bufferhub gki_apex_prepostinstall gsid hal_allocator_default hal_keymint_system hidl_lazy_test_server iw kcmdlinectrl linkerconfig linux_vm_setup lpdumpd mediaprovider_app mediatuner memcgv2_activation_depth microfuchsiad migrate_legacy_obb_data misctrl mm_events mmd mtectrl odrefresh odsign ot_ctl ot_daemon otapreopt_chroot otapreopt_slot permissioncontroller_app postinstall_dexopt prefetch preloads_copy preopt2cachename profcollectd remount rkp_cert_processor rkpd sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next simpleperf_boot snapshotctl snapuserd stats storaged system_server_startup system_suspend trace_redactor tradeinmode uprobestats vehicle_binding_util vfio_handler virtual_face virtual_fingerprint virtualizationservice vmlauncher_app vmnic vzwomatrigger_app wait_for_keymaster wifi_mainline_supplicant ))
+(typeattribute fs_type)
+(typeattributeset fs_type (device labeledfs pipefs sockfs rootfs proc binderfs binderfs_logs binderfs_logs_proc binderfs_logs_stats binderfs_logs_transactions binderfs_logs_transaction_history binderfs_features proc_security proc_drop_caches proc_overcommit_memory proc_min_free_order_shift proc_kpageflags proc_watermark_boost_factor proc_percpu_pagelist_high_fraction usermodehelper sysfs_usermodehelper proc_qtaguid_ctrl proc_qtaguid_stat proc_bluetooth_writable proc_abi proc_asound proc_bootconfig proc_bpf proc_buddyinfo proc_cgroups proc_cmdline proc_cpu_alignment proc_cpuinfo proc_dirty proc_diskstats proc_extra_free_kbytes proc_filesystems proc_fs_verity proc_hostname proc_hung_task proc_interrupts proc_iomem proc_kallsyms proc_keys proc_kmsg proc_loadavg proc_locks proc_lowmemorykiller proc_max_map_count proc_meminfo proc_misc proc_modules proc_mounts proc_net proc_net_tcp_udp proc_page_cluster proc_pagetypeinfo proc_panic proc_perf proc_pid_max proc_pipe_conf proc_pressure_cpu proc_pressure_io proc_pressure_mem proc_random proc_sched proc_slabinfo proc_stat proc_swaps proc_sysrq proc_timer proc_tty_drivers proc_uid_cputime_showstat proc_uid_cputime_removeuid proc_uid_io_stats proc_uid_procstat_set proc_uid_time_in_state proc_uid_concurrent_active_time proc_uid_concurrent_policy_time proc_uid_cpupower proc_uptime proc_version proc_vmallocinfo proc_vmstat proc_watermark_scale_factor proc_zoneinfo proc_vendor_sched selinuxfs fusectlfs cgroup cgroup_v2 sysfs sysfs_android_usb sysfs_uio sysfs_batteryinfo sysfs_bluetooth_writable sysfs_cma sysfs_devfreq_cur sysfs_devfreq_dir sysfs_devices_block sysfs_dm sysfs_dm_verity sysfs_dma_heap sysfs_dmabuf_stats sysfs_dt_firmware_android sysfs_extcon sysfs_ion sysfs_ipv4 sysfs_kernel_notes sysfs_leds sysfs_loop sysfs_gpu sysfs_hwrandom sysfs_nfc_power_writable sysfs_wake_lock sysfs_net sysfs_power sysfs_rtc sysfs_mem_sleep sysfs_suspend_stats sysfs_switch sysfs_sync_on_suspend sysfs_transparent_hugepage sysfs_lru_gen_enabled sysfs_usb sysfs_wakeup sysfs_wakeup_reasons sysfs_fs_ext4_features sysfs_fs_f2fs sysfs_fs_fuse_bpf sysfs_fs_fuse_features sysfs_fs_incfs_features sysfs_fs_incfs_metrics sysfs_vendor_sched fs_bpf fs_bpf_tethering fs_bpf_vendor configfs sysfs_devices_cs_etm sysfs_devices_system_cpu sysfs_lowmemorykiller sysfs_wlan_fwpath sysfs_vibrator sysfs_uhid sysfs_thermal sysfs_zram sysfs_zram_uevent inotify devpts tmpfs shm mqueue fuse fuseblk sdcardfs vfat exfat debugfs debugfs_kprobes debugfs_mmc debugfs_mm_events_tracing debugfs_trace_marker debugfs_tracing debugfs_tracing_debug debugfs_tracing_instances debugfs_tracing_printk_formats debugfs_wakeup_sources debugfs_wifi_tracing securityfs pstorefs functionfs oemfs usbfs binfmt_miscfs app_fusefs debugfs_bootreceiver_tracing sysfs_udc apexd_devpts proc_allocinfo config_gz fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_loader fs_bpf_uprobestats fs_bpf_memevents debugfs_kcov sysfs_dt_avf proc_dt_avf sysfs_uprobe sysfs_pgsize_migration sysfs_firmware_acpi_tables odsign_devpts priv_app_devpts untrusted_app_all_devpts ))
+(typeattribute contextmount_type)
+(typeattributeset contextmount_type (oemfs app_fusefs ))
+(typeattribute fusefs_type)
+(typeattributeset fusefs_type (fuse fuseblk app_fusefs ))
+(typeattribute file_type)
+(typeattributeset file_type (adbd_exec aidl_lazy_test_server_exec apexd_exec appdomain_tmpfs app_zygote_tmpfs audioserver_tmpfs bootanim_exec bootstat_exec bufferhubd_exec cameraserver_exec cameraserver_tmpfs charger_exec crash_dump_exec credstore_exec dhcp_exec dnsmasq_exec drmserver_exec drmserver_socket dumpstate_exec e2fs_exec early_virtmgr_exec extra_free_kbytes_exec unlabeled system_file system_asan_options_file system_event_log_tags_file system_lib_file system_bootstrap_lib_file system_group_file system_linker_exec system_linker_config_file system_passwd_file system_seccomp_policy_file system_security_cacerts_file tcpdump_exec system_zoneinfo_file cgroup_desc_file vendor_cgroup_desc_file task_profiles_file vendor_task_profiles_file art_apex_dir linkerconfig_file incremental_control_file bootanim_oem_file vendor_hal_file vendor_file vendor_app_file vendor_configs_file same_process_hal_file vndk_sp_file vendor_framework_file vendor_overlay_file vendor_public_lib_file vendor_public_framework_file vendor_microdroid_file vendor_boot_ota_file vendor_keylayout_file vendor_keychars_file vendor_idc_file vendor_uuid_mapping_config_file vendor_vm_file vendor_vm_data_file metadata_file vold_metadata_file gsi_metadata_file gsi_public_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file metadata_bootstat_file userspace_reboot_metadata_file staged_install_file watchdog_metadata_file repair_mode_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file dev_cpu_variant runtime_event_log_tags_file logcat_exec cgroup_rc_file coredump_file system_data_root_file system_data_file system_userdir_file packages_list_file game_mode_intervention_list_file vendor_data_file vendor_userdir_file unencrypted_data_file install_data_file drm_data_file adb_data_file anr_data_file tombstone_data_file tombstone_wifi_data_file apex_data_file apk_data_file apk_tmp_file apk_private_data_file apk_private_tmp_file dalvikcache_data_file ota_data_file ota_package_file user_profile_root_file user_profile_data_file profman_dump_data_file prereboot_data_file resourcecache_data_file shell_data_file property_data_file bootchart_data_file dropbox_data_file heapdump_data_file nativetest_data_file shell_test_data_file ringtone_file preloads_data_file preloads_media_file dhcp_data_file server_configurable_flags_data_file staging_data_file vendor_apex_file vendor_apex_metadata_file shutdown_checkpoints_system_data_file mnt_media_rw_file mnt_user_file mnt_pass_through_file mnt_expand_file mnt_sdcard_file storage_file mnt_media_rw_stub_file storage_stub_file mnt_vendor_file mnt_product_file apex_mnt_dir apex_info_file postinstall_mnt_dir postinstall_file postinstall_apex_mnt_dir mirror_data_file adb_keys_file apex_system_server_data_file apex_module_data_file apex_ota_reserved_file apex_rollback_data_file appcompat_data_file audio_data_file audioserver_data_file bluetooth_data_file bluetooth_logs_data_file bootstat_data_file boottrace_data_file camera_data_file credstore_data_file gatekeeper_data_file incident_data_file keychain_data_file keystore_data_file media_data_file media_rw_data_file media_userdir_file misc_user_data_file net_data_file network_watchlist_data_file nfc_data_file nfc_logs_data_file radio_data_file recovery_data_file shared_relro_file snapshotctl_log_data_file stats_config_data_file stats_data_file systemkeys_data_file textclassifier_data_file trace_data_file vpn_data_file wifi_data_file vold_data_file tee_data_file update_engine_data_file update_engine_log_data_file snapuserd_log_data_file method_trace_data_file gsi_data_file radio_core_data_file app_data_file privapp_data_file system_app_data_file cache_file overlayfs_file cache_backup_file cache_private_backup_file cache_recovery_file efs_file wallpaper_file shortcut_manager_icons icon_file asec_apk_file asec_public_file asec_image_file backup_data_file bluetooth_efs_file fingerprintd_data_file fingerprint_vendor_data_file app_fuse_file face_vendor_data_file iris_vendor_data_file adbd_socket bluetooth_socket dnsproxyd_socket dumpstate_socket fwmarkd_socket lmkd_socket logd_socket logdr_socket logdw_socket mdns_socket mdnsd_socket misc_logd_file mtpd_socket ot_daemon_socket property_socket racoon_socket recovery_socket rild_socket rild_debug_socket snapuserd_socket snapuserd_proxy_socket statsdw_socket system_wpa_socket system_ndebug_socket system_unsolzygote_socket tombstoned_crash_socket tombstoned_java_trace_socket tombstoned_intercept_socket traced_consumer_socket traced_perf_socket traced_producer_socket uncrypt_socket wpa_socket zygote_socket heapprofd_socket gps_control pdx_display_dir pdx_performance_dir pdx_bufferhub_dir pdx_display_client_endpoint_socket pdx_display_manager_endpoint_socket pdx_display_screenshot_endpoint_socket pdx_display_vsync_endpoint_socket pdx_performance_client_endpoint_socket pdx_bufferhub_client_endpoint_socket file_contexts_file mac_perms_file property_contexts_file seapp_contexts_file sepolicy_file service_contexts_file keystore2_key_contexts_file vendor_service_contexts_file hwservice_contexts_file vndservice_contexts_file vendor_kernel_modules system_dlkm_file audiohal_data_file tee_service_contexts_file fingerprintd_exec flags_health_check_exec fsck_exec gatekeeperd_exec hal_graphics_composer_server_tmpfs hwservicemanager_exec idmap_exec init_exec init_tmpfs inputflinger_exec installd_exec keystore_exec llkd_exec lmkd_exec logd_exec mediadrmserver_exec mediaextractor_exec mediaextractor_tmpfs mediametrics_exec mediaserver_exec mediaserver_tmpfs mediaswcodec_exec netd_exec netutils_wrapper_exec performanced_exec profman_exec recovery_persist_exec recovery_refresh_exec rs_exec runas_exec sdcardd_exec servicemanager_exec sgdisk_exec shell_exec simpleperf_app_runner_exec statsd_exec su_exec surfaceflinger_tmpfs system_server_tmpfs tombstoned_exec toolbox_exec traced_tmpfs ueventd_tmpfs uncrypt_exec update_engine_exec update_verifier_exec usbd_exec vdc_exec vendor_misc_writer_exec vendor_shell_exec vendor_toolbox_exec virtual_camera_exec virtual_touchpad_exec virtualizationmanager_exec vold_exec vold_prepare_subdirs_exec watchdogd_exec webview_zygote_exec webview_zygote_tmpfs wificond_exec zygote_tmpfs zygote_exec aconfigd_exec aconfigd_mainline_exec apex_test_prepostinstall_exec art_boot_exec art_exec_exec artd_exec artd_tmpfs atrace_exec audioserver_exec auditctl_exec automotive_display_service_exec bert_collector_exec blank_screen_exec blkid_exec boringssl_self_test_exec vendor_boringssl_self_test_exec boringssl_self_test_marker bpfloader_exec canhalconfigurator_exec clatd_exec compos_verify_exec composd_exec cppreopts_exec crosvm_exec crosvm_tmpfs derive_classpath_exec derive_sdk_exec dex2oat_exec dexopt_chroot_setup_exec dexopt_chroot_setup_tmpfs dexoptanalyzer_exec dmesgd_exec dumpstate_tmpfs evsmanagerd_exec storaged_data_file wm_trace_data_file accessibility_trace_data_file perfetto_traces_data_file perfetto_traces_bugreport_data_file perfetto_traces_profiling_data_file perfetto_configs_data_file system_perfetto_config_file uprobestats_configs_data_file oatdump_exec sdk_sandbox_system_data_file sdk_sandbox_data_file app_exec_data_file rollback_data_file checkin_data_file ota_image_data_file gsi_persistent_data_file emergency_data_file profcollectd_data_file apex_art_data_file apex_art_staging_data_file apex_compos_data_file apex_virt_data_file apex_tethering_data_file apex_uwb_data_file apex_appsearch_data_file apex_permission_data_file apex_scheduling_data_file apex_wifi_data_file font_data_file dmesgd_data_file odrefresh_data_file odsign_data_file odsign_metrics_file virtualizationservice_data_file vm_data_file environ_system_data_file bootanim_data_file fd_server_exec compos_exec compos_key_helper_exec prng_seeder_socket system_font_fallback_file aconfigd_socket aconfigd_mainline_socket system_aconfig_storage_file vendor_aconfig_storage_file connectivityblob_data_file mainline_supplicant_data_file pre_reboot_dexopt_file pre_reboot_dexopt_artd_file apk_metadata_file storage_area_app_dir storage_area_dir storage_area_content_file storage_area_key_file tradeinmode_metadata_file prefetch_metadata_file libprocessgroup_metadata_file fuseblkd_exec fuseblkd_untrusted_exec fwk_bufferhub_exec gki_apex_prepostinstall_exec gpuservice_exec gsid_exec hal_allocator_default_exec hal_keymint_system_exec heapprofd_exec heapprofd_tmpfs hidl_lazy_test_server_exec incident_exec incident_helper_exec incidentd_exec iw_exec kcmdlinectrl_exec linkerconfig_exec linux_vm_setup_exec lpdumpd_exec mdnsd_exec mediatranscoding_exec mediatranscoding_tmpfs mediatuner_exec memcgv2_activation_depth_exec microfuchsiad_exec migrate_legacy_obb_data_exec misctrl_exec mm_events_exec mmd_exec mtectrl_exec odrefresh_exec odsign_exec ot_ctl_exec ot_daemon_exec otapreopt_chroot_exec otapreopt_slot_exec perfetto_exec perfetto_tmpfs postinstall_exec postinstall_dexopt_exec postinstall_dexopt_tmpfs prefetch_exec preloads_copy_exec preopt2cachename_exec prng_seeder_exec profcollectd_exec remount_exec rkp_cert_processor_exec rkpd_exec rss_hwm_reset_exec simpleperf_exec simpleperf_boot_data_file snapshotctl_exec snapuserd_exec stats_exec storaged_exec surfaceflinger_exec system_server_startup_tmpfs system_suspend_exec trace_redactor_exec traced_exec traced_perf_exec traced_probes_exec traced_probes_tmpfs tradeinmode_exec uprobestats_exec vehicle_binding_util_exec vfio_handler_exec virtual_face_exec virtual_fingerprint_exec virtualizationservice_exec vmnic_exec wait_for_keymaster_exec wifi_mainline_supplicant_exec ))
+(typeattribute exec_type)
+(typeattributeset exec_type (adbd_exec aidl_lazy_test_server_exec apexd_exec bootanim_exec bootstat_exec bufferhubd_exec cameraserver_exec charger_exec crash_dump_exec credstore_exec dhcp_exec dnsmasq_exec drmserver_exec dumpstate_exec e2fs_exec early_virtmgr_exec extra_free_kbytes_exec tcpdump_exec logcat_exec fingerprintd_exec flags_health_check_exec fsck_exec gatekeeperd_exec hwservicemanager_exec idmap_exec init_exec inputflinger_exec installd_exec keystore_exec llkd_exec lmkd_exec logd_exec mediadrmserver_exec mediaextractor_exec mediametrics_exec mediaserver_exec mediaswcodec_exec netd_exec netutils_wrapper_exec performanced_exec profman_exec recovery_persist_exec recovery_refresh_exec rs_exec runas_exec sdcardd_exec servicemanager_exec sgdisk_exec shell_exec simpleperf_app_runner_exec statsd_exec su_exec tombstoned_exec toolbox_exec uncrypt_exec update_engine_exec update_verifier_exec usbd_exec vdc_exec vendor_misc_writer_exec vendor_shell_exec vendor_toolbox_exec virtual_camera_exec virtual_touchpad_exec virtualizationmanager_exec vold_exec vold_prepare_subdirs_exec watchdogd_exec webview_zygote_exec wificond_exec zygote_exec aconfigd_exec aconfigd_mainline_exec apex_test_prepostinstall_exec art_boot_exec art_exec_exec artd_exec atrace_exec audioserver_exec auditctl_exec automotive_display_service_exec bert_collector_exec blank_screen_exec blkid_exec boringssl_self_test_exec vendor_boringssl_self_test_exec bpfloader_exec canhalconfigurator_exec clatd_exec compos_verify_exec composd_exec cppreopts_exec crosvm_exec derive_classpath_exec derive_sdk_exec dex2oat_exec dexopt_chroot_setup_exec dexoptanalyzer_exec dmesgd_exec evsmanagerd_exec oatdump_exec fd_server_exec compos_exec compos_key_helper_exec fuseblkd_exec fuseblkd_untrusted_exec fwk_bufferhub_exec gki_apex_prepostinstall_exec gpuservice_exec gsid_exec hal_allocator_default_exec hal_keymint_system_exec heapprofd_exec hidl_lazy_test_server_exec incident_exec incident_helper_exec incidentd_exec iw_exec kcmdlinectrl_exec linkerconfig_exec linux_vm_setup_exec lpdumpd_exec mdnsd_exec mediatranscoding_exec mediatuner_exec memcgv2_activation_depth_exec microfuchsiad_exec migrate_legacy_obb_data_exec misctrl_exec mm_events_exec mmd_exec mtectrl_exec odrefresh_exec odsign_exec ot_ctl_exec ot_daemon_exec otapreopt_chroot_exec otapreopt_slot_exec perfetto_exec postinstall_exec postinstall_dexopt_exec prefetch_exec preloads_copy_exec preopt2cachename_exec prng_seeder_exec profcollectd_exec remount_exec rkp_cert_processor_exec rkpd_exec rss_hwm_reset_exec simpleperf_exec snapshotctl_exec snapuserd_exec stats_exec storaged_exec surfaceflinger_exec system_suspend_exec trace_redactor_exec traced_exec traced_perf_exec traced_probes_exec tradeinmode_exec uprobestats_exec vehicle_binding_util_exec vfio_handler_exec virtual_face_exec virtual_fingerprint_exec virtualizationservice_exec vmnic_exec wait_for_keymaster_exec wifi_mainline_supplicant_exec ))
+(typeattribute data_file_type)
+(expandtypeattribute (data_file_type) false)
+(typeattributeset data_file_type (incremental_control_file system_data_root_file system_data_file system_userdir_file packages_list_file game_mode_intervention_list_file vendor_data_file vendor_userdir_file unencrypted_data_file install_data_file drm_data_file adb_data_file anr_data_file tombstone_data_file tombstone_wifi_data_file apex_data_file apk_data_file apk_tmp_file apk_private_data_file apk_private_tmp_file dalvikcache_data_file ota_data_file ota_package_file user_profile_root_file user_profile_data_file profman_dump_data_file prereboot_data_file resourcecache_data_file shell_data_file property_data_file bootchart_data_file dropbox_data_file heapdump_data_file nativetest_data_file shell_test_data_file ringtone_file preloads_data_file preloads_media_file dhcp_data_file server_configurable_flags_data_file staging_data_file shutdown_checkpoints_system_data_file adb_keys_file apex_system_server_data_file apex_module_data_file apex_ota_reserved_file apex_rollback_data_file appcompat_data_file audio_data_file audioserver_data_file bluetooth_data_file bluetooth_logs_data_file bootstat_data_file boottrace_data_file camera_data_file credstore_data_file gatekeeper_data_file incident_data_file keychain_data_file keystore_data_file media_data_file media_rw_data_file media_userdir_file misc_user_data_file net_data_file network_watchlist_data_file nfc_data_file nfc_logs_data_file radio_data_file recovery_data_file shared_relro_file snapshotctl_log_data_file stats_config_data_file stats_data_file systemkeys_data_file textclassifier_data_file trace_data_file vpn_data_file wifi_data_file vold_data_file tee_data_file update_engine_data_file update_engine_log_data_file snapuserd_log_data_file method_trace_data_file gsi_data_file radio_core_data_file app_data_file privapp_data_file system_app_data_file cache_file overlayfs_file cache_backup_file cache_private_backup_file cache_recovery_file wallpaper_file shortcut_manager_icons icon_file asec_apk_file asec_public_file asec_image_file backup_data_file fingerprintd_data_file fingerprint_vendor_data_file app_fuse_file face_vendor_data_file iris_vendor_data_file bluetooth_socket misc_logd_file system_wpa_socket system_ndebug_socket system_unsolzygote_socket wpa_socket audiohal_data_file storaged_data_file wm_trace_data_file accessibility_trace_data_file perfetto_traces_data_file perfetto_traces_bugreport_data_file perfetto_traces_profiling_data_file perfetto_configs_data_file uprobestats_configs_data_file sdk_sandbox_system_data_file sdk_sandbox_data_file app_exec_data_file rollback_data_file checkin_data_file ota_image_data_file gsi_persistent_data_file emergency_data_file profcollectd_data_file apex_art_data_file apex_art_staging_data_file apex_compos_data_file apex_virt_data_file apex_tethering_data_file apex_uwb_data_file apex_appsearch_data_file apex_permission_data_file apex_scheduling_data_file apex_wifi_data_file font_data_file dmesgd_data_file odrefresh_data_file odsign_data_file odsign_metrics_file virtualizationservice_data_file environ_system_data_file bootanim_data_file connectivityblob_data_file mainline_supplicant_data_file apk_metadata_file storage_area_app_dir storage_area_dir storage_area_content_file storage_area_key_file ))
+(typeattribute core_data_file_type)
+(expandtypeattribute (core_data_file_type) false)
+(typeattributeset core_data_file_type (incremental_control_file system_data_root_file system_data_file system_userdir_file packages_list_file game_mode_intervention_list_file vendor_userdir_file unencrypted_data_file install_data_file drm_data_file adb_data_file anr_data_file tombstone_data_file apex_data_file apk_data_file apk_tmp_file apk_private_data_file apk_private_tmp_file dalvikcache_data_file ota_data_file ota_package_file user_profile_root_file user_profile_data_file profman_dump_data_file prereboot_data_file resourcecache_data_file shell_data_file property_data_file bootchart_data_file dropbox_data_file heapdump_data_file nativetest_data_file shell_test_data_file ringtone_file preloads_data_file preloads_media_file dhcp_data_file server_configurable_flags_data_file staging_data_file shutdown_checkpoints_system_data_file mirror_data_file adb_keys_file apex_system_server_data_file apex_module_data_file apex_ota_reserved_file apex_rollback_data_file appcompat_data_file audio_data_file audioserver_data_file bluetooth_data_file bluetooth_logs_data_file bootstat_data_file boottrace_data_file camera_data_file credstore_data_file gatekeeper_data_file incident_data_file keychain_data_file keystore_data_file media_data_file media_rw_data_file media_userdir_file misc_user_data_file net_data_file network_watchlist_data_file nfc_data_file nfc_logs_data_file radio_data_file recovery_data_file shared_relro_file snapshotctl_log_data_file stats_config_data_file stats_data_file systemkeys_data_file textclassifier_data_file trace_data_file vpn_data_file wifi_data_file vold_data_file update_engine_data_file update_engine_log_data_file snapuserd_log_data_file method_trace_data_file gsi_data_file radio_core_data_file app_data_file privapp_data_file system_app_data_file cache_file overlayfs_file cache_backup_file cache_private_backup_file cache_recovery_file wallpaper_file shortcut_manager_icons icon_file asec_apk_file asec_public_file asec_image_file backup_data_file fingerprintd_data_file app_fuse_file bluetooth_socket misc_logd_file system_wpa_socket system_ndebug_socket system_unsolzygote_socket wpa_socket audiohal_data_file storaged_data_file wm_trace_data_file accessibility_trace_data_file perfetto_traces_data_file perfetto_traces_bugreport_data_file perfetto_traces_profiling_data_file perfetto_configs_data_file uprobestats_configs_data_file sdk_sandbox_system_data_file sdk_sandbox_data_file app_exec_data_file rollback_data_file checkin_data_file ota_image_data_file gsi_persistent_data_file emergency_data_file profcollectd_data_file apex_art_data_file apex_art_staging_data_file apex_compos_data_file apex_virt_data_file apex_tethering_data_file apex_uwb_data_file apex_appsearch_data_file apex_permission_data_file apex_scheduling_data_file apex_wifi_data_file font_data_file dmesgd_data_file odrefresh_data_file odsign_data_file odsign_metrics_file virtualizationservice_data_file vm_data_file environ_system_data_file bootanim_data_file connectivityblob_data_file mainline_supplicant_data_file apk_metadata_file storage_area_app_dir storage_area_dir storage_area_content_file storage_area_key_file ))
+(typeattribute app_data_file_type)
+(expandtypeattribute (app_data_file_type) false)
+(typeattributeset app_data_file_type (shell_data_file bluetooth_data_file nfc_data_file radio_data_file app_data_file privapp_data_file system_app_data_file sdk_sandbox_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))
+(typeattribute system_file_type)
+(typeattributeset system_file_type (adbd_exec aidl_lazy_test_server_exec apexd_exec bootanim_exec bootstat_exec bufferhubd_exec cameraserver_exec charger_exec crash_dump_exec credstore_exec dhcp_exec dnsmasq_exec drmserver_exec dumpstate_exec e2fs_exec early_virtmgr_exec extra_free_kbytes_exec system_file system_asan_options_file system_event_log_tags_file system_lib_file system_bootstrap_lib_file system_group_file system_linker_exec system_linker_config_file system_passwd_file system_seccomp_policy_file system_security_cacerts_file tcpdump_exec system_zoneinfo_file cgroup_desc_file task_profiles_file art_apex_dir bootanim_oem_file logcat_exec file_contexts_file mac_perms_file property_contexts_file seapp_contexts_file sepolicy_file service_contexts_file keystore2_key_contexts_file hwservice_contexts_file tee_service_contexts_file fingerprintd_exec flags_health_check_exec fsck_exec gatekeeperd_exec hwservicemanager_exec idmap_exec init_exec inputflinger_exec installd_exec keystore_exec llkd_exec lmkd_exec logd_exec mediadrmserver_exec mediaextractor_exec mediametrics_exec mediaserver_exec mediaswcodec_exec netd_exec netutils_wrapper_exec performanced_exec profman_exec recovery_persist_exec recovery_refresh_exec rs_exec runas_exec sdcardd_exec servicemanager_exec sgdisk_exec shell_exec simpleperf_app_runner_exec statsd_exec su_exec tombstoned_exec toolbox_exec uncrypt_exec update_engine_exec update_verifier_exec usbd_exec vdc_exec virtual_camera_exec virtual_touchpad_exec virtualizationmanager_exec vold_exec vold_prepare_subdirs_exec watchdogd_exec wificond_exec zygote_exec aconfigd_exec aconfigd_mainline_exec apex_test_prepostinstall_exec art_boot_exec art_exec_exec artd_exec atrace_exec audioserver_exec auditctl_exec automotive_display_service_exec bert_collector_exec blank_screen_exec blkid_exec boringssl_self_test_exec bpfloader_exec canhalconfigurator_exec clatd_exec compos_verify_exec composd_exec cppreopts_exec crosvm_exec derive_classpath_exec derive_sdk_exec dex2oat_exec dexopt_chroot_setup_exec dexoptanalyzer_exec dmesgd_exec evsmanagerd_exec system_perfetto_config_file oatdump_exec fd_server_exec compos_exec compos_key_helper_exec system_font_fallback_file system_aconfig_storage_file fuseblkd_exec fuseblkd_untrusted_exec fwk_bufferhub_exec gki_apex_prepostinstall_exec gpuservice_exec gsid_exec hal_allocator_default_exec hal_keymint_system_exec heapprofd_exec hidl_lazy_test_server_exec incident_exec incident_helper_exec incidentd_exec iw_exec kcmdlinectrl_exec linkerconfig_exec linux_vm_setup_exec lpdumpd_exec mdnsd_exec mediatranscoding_exec mediatuner_exec memcgv2_activation_depth_exec microfuchsiad_exec migrate_legacy_obb_data_exec misctrl_exec mm_events_exec mmd_exec mtectrl_exec odrefresh_exec odsign_exec ot_ctl_exec ot_daemon_exec otapreopt_chroot_exec otapreopt_slot_exec perfetto_exec postinstall_exec postinstall_dexopt_exec prefetch_exec preloads_copy_exec preopt2cachename_exec prng_seeder_exec profcollectd_exec remount_exec rkp_cert_processor_exec rkpd_exec rss_hwm_reset_exec simpleperf_exec snapshotctl_exec snapuserd_exec stats_exec storaged_exec surfaceflinger_exec system_suspend_exec trace_redactor_exec traced_exec traced_perf_exec traced_probes_exec tradeinmode_exec uprobestats_exec vehicle_binding_util_exec vfio_handler_exec virtual_face_exec virtual_fingerprint_exec virtualizationservice_exec vmnic_exec wait_for_keymaster_exec wifi_mainline_supplicant_exec ))
+(typeattribute system_dlkm_file_type)
+(typeattributeset system_dlkm_file_type (system_dlkm_file ))
+(typeattribute vendor_file_type)
+(typeattributeset vendor_file_type (vendor_cgroup_desc_file vendor_task_profiles_file vendor_hal_file vendor_file vendor_app_file vendor_configs_file same_process_hal_file vndk_sp_file vendor_framework_file vendor_overlay_file vendor_public_lib_file vendor_public_framework_file vendor_microdroid_file vendor_boot_ota_file vendor_keylayout_file vendor_keychars_file vendor_idc_file vendor_uuid_mapping_config_file vendor_vm_file vendor_vm_data_file vendor_apex_file vendor_apex_metadata_file vendor_service_contexts_file vendor_kernel_modules vendor_misc_writer_exec vendor_shell_exec vendor_toolbox_exec vendor_boringssl_self_test_exec vendor_aconfig_storage_file ))
+(typeattribute proc_type)
+(expandtypeattribute (proc_type) false)
+(typeattributeset proc_type (proc proc_security proc_drop_caches proc_overcommit_memory proc_min_free_order_shift proc_kpageflags proc_watermark_boost_factor proc_percpu_pagelist_high_fraction usermodehelper proc_qtaguid_ctrl proc_qtaguid_stat proc_bluetooth_writable proc_abi proc_asound proc_bootconfig proc_bpf proc_buddyinfo proc_cgroups proc_cmdline proc_cpu_alignment proc_cpuinfo proc_dirty proc_diskstats proc_extra_free_kbytes proc_filesystems proc_fs_verity proc_hostname proc_hung_task proc_interrupts proc_iomem proc_kallsyms proc_keys proc_kmsg proc_loadavg proc_locks proc_lowmemorykiller proc_max_map_count proc_meminfo proc_misc proc_modules proc_mounts proc_net proc_net_tcp_udp proc_page_cluster proc_pagetypeinfo proc_panic proc_perf proc_pid_max proc_pipe_conf proc_pressure_cpu proc_pressure_io proc_pressure_mem proc_random proc_sched proc_slabinfo proc_stat proc_swaps proc_sysrq proc_timer proc_tty_drivers proc_uid_cputime_showstat proc_uid_cputime_removeuid proc_uid_io_stats proc_uid_procstat_set proc_uid_time_in_state proc_uid_concurrent_active_time proc_uid_concurrent_policy_time proc_uid_cpupower proc_uptime proc_version proc_vmallocinfo proc_vmstat proc_watermark_scale_factor proc_zoneinfo proc_vendor_sched proc_allocinfo config_gz proc_dt_avf ))
+(typeattribute proc_net_type)
+(expandtypeattribute (proc_net_type) true)
+(typeattributeset proc_net_type (proc_net ))
+(typeattribute sysfs_type)
+(typeattributeset sysfs_type (sysfs_usermodehelper sysfs sysfs_android_usb sysfs_uio sysfs_batteryinfo sysfs_bluetooth_writable sysfs_cma sysfs_devfreq_cur sysfs_devfreq_dir sysfs_devices_block sysfs_dm sysfs_dm_verity sysfs_dma_heap sysfs_dmabuf_stats sysfs_dt_firmware_android sysfs_extcon sysfs_ion sysfs_ipv4 sysfs_kernel_notes sysfs_leds sysfs_loop sysfs_gpu sysfs_hwrandom sysfs_nfc_power_writable sysfs_wake_lock sysfs_net sysfs_power sysfs_rtc sysfs_mem_sleep sysfs_suspend_stats sysfs_switch sysfs_sync_on_suspend sysfs_transparent_hugepage sysfs_lru_gen_enabled sysfs_usb sysfs_wakeup sysfs_wakeup_reasons sysfs_fs_ext4_features sysfs_fs_f2fs sysfs_fs_fuse_bpf sysfs_fs_fuse_features sysfs_fs_incfs_features sysfs_fs_incfs_metrics sysfs_vendor_sched sysfs_devices_cs_etm sysfs_devices_system_cpu sysfs_lowmemorykiller sysfs_wlan_fwpath sysfs_vibrator sysfs_uhid sysfs_thermal sysfs_zram sysfs_zram_uevent sysfs_udc sysfs_dt_avf sysfs_uprobe sysfs_pgsize_migration sysfs_firmware_acpi_tables ))
+(typeattribute debugfs_type)
+(typeattributeset debugfs_type (debugfs debugfs_kprobes debugfs_mmc debugfs_mm_events_tracing debugfs_trace_marker debugfs_tracing debugfs_tracing_debug debugfs_tracing_instances debugfs_tracing_printk_formats debugfs_wakeup_sources debugfs_wifi_tracing debugfs_bootreceiver_tracing debugfs_kcov ))
+(typeattribute tracefs_type)
+(typeattributeset tracefs_type (debugfs_mm_events_tracing debugfs_trace_marker debugfs_tracing debugfs_tracing_debug debugfs_tracing_instances debugfs_tracing_printk_formats debugfs_wifi_tracing debugfs_bootreceiver_tracing ))
+(typeattribute sdcard_type)
+(typeattributeset sdcard_type (fuseblk sdcardfs vfat exfat ))
+(typeattribute node_type)
+(typeattributeset node_type (node ))
+(typeattribute netif_type)
+(typeattributeset netif_type (netif ))
+(typeattribute port_type)
+(typeattributeset port_type (port ))
+(typeattribute property_type)
+(typeattributeset property_type (apexd_prop bootloader_boot_reason_prop device_config_activity_manager_native_boot_prop device_config_boot_count_prop device_config_input_native_boot_prop device_config_netd_native_prop device_config_reset_performed_prop firstboot_prop boottime_prop charger_prop cold_boot_done_prop ctl_adbd_prop ctl_apexd_prop ctl_bootanim_prop ctl_bugreport_prop ctl_console_prop ctl_dumpstate_prop ctl_fuse_prop ctl_gsid_prop ctl_interface_restart_prop ctl_interface_stop_prop ctl_mdnsd_prop ctl_restart_prop ctl_rildaemon_prop ctl_sigstop_prop dynamic_system_prop heapprofd_enabled_prop llkd_prop lpdumpd_prop mmc_prop mock_ota_prop net_dns_prop overlay_prop persistent_properties_ready_prop safemode_prop system_lmk_prop system_trace_prop test_boot_reason_prop time_prop traced_enabled_prop traced_lazy_prop aac_drc_prop adaptive_haptics_prop apex_ready_prop arm64_memtag_prop binder_cache_bluetooth_server_prop binder_cache_system_server_prop binder_cache_telephony_server_prop boot_status_prop bootanim_system_prop bootloader_prop boottime_public_prop bq_config_prop build_bootimage_prop build_prop composd_vm_art_prop device_config_aconfig_flags_prop device_config_camera_native_prop device_config_edgetpu_native_prop device_config_media_native_prop device_config_nnapi_native_prop device_config_runtime_native_boot_prop device_config_runtime_native_prop device_config_surface_flinger_native_boot_prop device_config_vendor_system_native_prop device_config_vendor_system_native_boot_prop drm_forcel3_prop fingerprint_prop gwp_asan_prop hal_instrumentation_prop userdebug_or_eng_prop init_service_status_prop libc_debug_prop module_sdkextensions_prop nnapi_ext_deny_product_prop persist_wm_debug_prop power_debug_prop property_service_version_prop provisioned_prop restorecon_prop retaildemo_prop servicemanager_prop smart_idle_maint_enabled_prop socket_hook_prop sqlite_log_prop surfaceflinger_display_prop system_boot_reason_prop system_jvmti_agent_prop traced_oome_heap_session_count_prop ab_update_gki_prop usb_prop userspace_reboot_exported_prop vold_status_prop vts_status_prop enable_16k_pages_prop profcollectd_etr_prop config_prop cppreopt_prop dalvik_prop debuggerd_prop device_logging_prop dhcp_prop dumpstate_prop exported3_system_prop exported_dumpstate_prop exported_secure_prop heapprofd_prop net_radio_prop pan_result_prop persist_debug_prop shell_prop test_harness_prop theme_prop use_memfd_prop vold_prop apexd_config_prop apexd_select_prop aaudio_config_prop apk_verity_prop audio_config_prop bootanim_config_prop bluetooth_config_prop build_attestation_prop build_config_prop build_odm_prop build_vendor_prop camera_calibration_prop camera_config_prop camera2_extensions_prop camerax_extensions_prop charger_config_prop codec2_config_prop composd_vm_vendor_prop cpu_variant_prop debugfs_restriction_prop drm_service_config_prop exported_camera_prop exported_config_prop exported_default_prop ffs_config_prop framework_watchdog_config_prop graphics_config_prop hdmi_config_prop hw_timeout_multiplier_prop hypervisor_prop hypervisor_restricted_prop incremental_prop input_device_config_prop keyguard_config_prop keystore_config_prop lmkd_config_prop media_config_prop media_variant_prop mediadrm_config_prop mm_events_config_prop oem_unlock_prop ota_build_prop packagemanager_config_prop quick_start_prop recovery_config_prop recovery_usb_config_prop sendbug_config_prop soc_prop storage_config_prop storagemanager_config_prop surfaceflinger_prop suspend_prop systemsound_config_prop telephony_config_prop threadnetwork_config_prop tombstone_config_prop usb_config_prop userspace_reboot_config_prop vehicle_hal_prop vendor_security_patch_level_prop vendor_socket_hook_prop virtual_ab_prop vndk_prop vts_config_prop vold_config_prop wifi_config_prop zram_config_prop zygote_config_prop dck_prop tuner_config_prop usb_uvc_enabled_prop setupwizard_mode_prop pm_archiving_enabled_prop trusty_security_vm_sys_vendor_prop adbd_config_prop audio_prop bluetooth_a2dp_offload_prop bluetooth_audio_hal_prop bluetooth_finder_prop bluetooth_prop bpf_progs_loaded_prop charger_status_prop ctl_default_prop ctl_interface_start_prop ctl_start_prop ctl_stop_prop dalvik_config_prop dalvik_dynamic_config_prop dalvik_runtime_prop debug_prop device_config_memory_safety_native_boot_prop device_config_memory_safety_native_prop dumpstate_options_prop exported_system_prop exported_bluetooth_prop exported_overlay_prop exported_pm_prop future_pm_prop ffs_control_prop framework_status_prop gesture_prop graphics_config_writable_prop hal_dumpstate_config_prop sota_prop hwservicemanager_prop lmkd_prop locale_prop logd_prop logpersistd_logging_prop log_prop log_tag_prop lowpan_prop nfc_prop ota_prop permissive_mte_prop powerctl_prop qemu_hw_prop qemu_sf_lcd_density_prop radio_control_prop radio_prop serialno_prop surfaceflinger_color_prop system_prop system_user_mode_emulation_prop telephony_status_prop timezone_prop usb_control_prop vold_post_fs_data_prop wifi_hal_prop wifi_log_prop wifi_prop zram_control_prop default_prop rebootescrow_hal_prop virtual_face_hal_prop virtual_face_prop virtual_fingerprint_hal_prop virtual_fingerprint_prop persist_vendor_debug_wifi_prop vendor_default_prop adbd_prop adbd_tradeinmode_prop apexd_payload_metadata_prop ctl_snapuserd_prop ctl_prefetch_prop ctl_uprobestats_prop crashrecovery_prop debug_tracing_desktop_mode_visible_tasks_prop device_config_core_experiments_team_internal_prop device_config_lmkd_native_prop device_config_mglru_native_prop device_config_mmd_native_prop device_config_profcollect_native_boot_prop device_config_remote_key_provisioning_native_prop device_config_statsd_native_prop device_config_statsd_native_boot_prop device_config_storage_native_boot_prop device_config_sys_traced_prop device_config_window_manager_native_boot_prop device_config_configuration_prop device_config_connectivity_prop device_config_swcodec_native_prop device_config_tethering_u_or_later_native_prop dmesgd_start_prop fastbootd_protocol_prop gsid_prop init_perf_lsm_hooks_prop init_service_status_private_prop init_storage_prop init_svc_debug_prop kcmdline_prop keystore_diagnostics_prop keystore_listen_prop last_boot_reason_prop localization_prop logd_auditrate_prop lower_kptr_restrict_prop mmd_prop net_464xlat_fromvendor_prop net_connectivity_prop netd_stable_secret_prop next_boot_prop odsign_prop misctrl_prop perf_drop_caches_prop pm_prop prefetch_service_prop profcollectd_node_id_prop radio_cdma_ecm_prop remote_prov_prop remote_prov_cert_prop rollback_test_prop setupwizard_prop snapshotctl_prop snapuserd_prop system_adbd_prop system_audio_config_prop timezone_metadata_prop traced_perf_enabled_prop uprobestats_start_with_config_prop tuner_server_ctl_prop userspace_reboot_log_prop userspace_reboot_test_prop verity_status_prop zygote_wrap_prop ctl_mediatranscoding_prop ctl_odsign_prop virtualizationservice_prop ctl_apex_load_prop sensors_config_prop hypervisor_pvmfw_prop hypervisor_virtualizationmanager_prop game_manager_config_prop hidl_memory_prop suspend_debug_prop system_service_enable_prop ctl_artd_pre_reboot_prop trusty_security_vm_sys_prop hint_manager_config_prop bionic_linker_16kb_app_compat_prop device_config_virtualization_framework_native_prop fstype_prop log_file_logger_prop persist_sysui_builder_extras_prop persist_sysui_ranking_update_prop page_size_prop pm_16kb_app_compat_prop avf_virtualizationservice_prop high_barometer_quality_prop prefetch_boot_prop widevine_sys_vendor_prop ))
+(typeattribute core_property_type)
+(typeattributeset core_property_type (restorecon_prop usb_prop config_prop cppreopt_prop dalvik_prop debuggerd_prop dhcp_prop dumpstate_prop net_radio_prop pan_result_prop persist_debug_prop shell_prop vold_prop audio_prop debug_prop logd_prop nfc_prop ota_prop powerctl_prop radio_prop system_prop ))
+(typeattribute log_property_type)
+(typeattributeset log_property_type (log_prop log_tag_prop wifi_log_prop ))
+(typeattribute extended_core_property_type)
+(typeattribute system_property_type)
+(expandtypeattribute (system_property_type) false)
+(typeattributeset system_property_type (apexd_prop bootloader_boot_reason_prop device_config_activity_manager_native_boot_prop device_config_boot_count_prop device_config_input_native_boot_prop device_config_netd_native_prop device_config_reset_performed_prop firstboot_prop boottime_prop charger_prop cold_boot_done_prop ctl_adbd_prop ctl_apexd_prop ctl_bootanim_prop ctl_bugreport_prop ctl_console_prop ctl_dumpstate_prop ctl_fuse_prop ctl_gsid_prop ctl_interface_restart_prop ctl_interface_stop_prop ctl_mdnsd_prop ctl_restart_prop ctl_rildaemon_prop ctl_sigstop_prop dynamic_system_prop heapprofd_enabled_prop llkd_prop lpdumpd_prop mmc_prop mock_ota_prop net_dns_prop overlay_prop persistent_properties_ready_prop safemode_prop system_lmk_prop system_trace_prop test_boot_reason_prop time_prop traced_enabled_prop traced_lazy_prop aac_drc_prop adaptive_haptics_prop apex_ready_prop arm64_memtag_prop binder_cache_bluetooth_server_prop binder_cache_system_server_prop binder_cache_telephony_server_prop boot_status_prop bootanim_system_prop bootloader_prop boottime_public_prop bq_config_prop build_bootimage_prop build_prop composd_vm_art_prop device_config_aconfig_flags_prop device_config_camera_native_prop device_config_edgetpu_native_prop device_config_media_native_prop device_config_nnapi_native_prop device_config_runtime_native_boot_prop device_config_runtime_native_prop device_config_surface_flinger_native_boot_prop device_config_vendor_system_native_prop device_config_vendor_system_native_boot_prop drm_forcel3_prop fingerprint_prop gwp_asan_prop hal_instrumentation_prop userdebug_or_eng_prop init_service_status_prop libc_debug_prop module_sdkextensions_prop nnapi_ext_deny_product_prop persist_wm_debug_prop power_debug_prop property_service_version_prop provisioned_prop restorecon_prop retaildemo_prop servicemanager_prop smart_idle_maint_enabled_prop socket_hook_prop sqlite_log_prop surfaceflinger_display_prop system_boot_reason_prop system_jvmti_agent_prop traced_oome_heap_session_count_prop ab_update_gki_prop usb_prop userspace_reboot_exported_prop vold_status_prop vts_status_prop enable_16k_pages_prop profcollectd_etr_prop config_prop cppreopt_prop dalvik_prop debuggerd_prop device_logging_prop dhcp_prop dumpstate_prop exported3_system_prop exported_dumpstate_prop exported_secure_prop heapprofd_prop net_radio_prop pan_result_prop persist_debug_prop shell_prop test_harness_prop theme_prop use_memfd_prop vold_prop apexd_config_prop apexd_select_prop aaudio_config_prop apk_verity_prop audio_config_prop bootanim_config_prop bluetooth_config_prop build_attestation_prop build_config_prop build_odm_prop build_vendor_prop camera_calibration_prop camera_config_prop camera2_extensions_prop camerax_extensions_prop charger_config_prop codec2_config_prop composd_vm_vendor_prop cpu_variant_prop debugfs_restriction_prop drm_service_config_prop exported_camera_prop exported_config_prop exported_default_prop ffs_config_prop framework_watchdog_config_prop graphics_config_prop hdmi_config_prop hw_timeout_multiplier_prop hypervisor_prop hypervisor_restricted_prop incremental_prop input_device_config_prop keyguard_config_prop keystore_config_prop lmkd_config_prop media_config_prop media_variant_prop mediadrm_config_prop mm_events_config_prop oem_unlock_prop ota_build_prop packagemanager_config_prop quick_start_prop recovery_config_prop recovery_usb_config_prop sendbug_config_prop soc_prop storage_config_prop storagemanager_config_prop surfaceflinger_prop suspend_prop systemsound_config_prop telephony_config_prop threadnetwork_config_prop tombstone_config_prop usb_config_prop userspace_reboot_config_prop vehicle_hal_prop vendor_security_patch_level_prop vendor_socket_hook_prop virtual_ab_prop vndk_prop vts_config_prop vold_config_prop wifi_config_prop zram_config_prop zygote_config_prop dck_prop tuner_config_prop usb_uvc_enabled_prop setupwizard_mode_prop pm_archiving_enabled_prop trusty_security_vm_sys_vendor_prop adbd_config_prop audio_prop bluetooth_a2dp_offload_prop bluetooth_audio_hal_prop bluetooth_finder_prop bluetooth_prop bpf_progs_loaded_prop charger_status_prop ctl_default_prop ctl_interface_start_prop ctl_start_prop ctl_stop_prop dalvik_config_prop dalvik_dynamic_config_prop dalvik_runtime_prop debug_prop device_config_memory_safety_native_boot_prop device_config_memory_safety_native_prop dumpstate_options_prop exported_system_prop exported_bluetooth_prop exported_overlay_prop exported_pm_prop future_pm_prop ffs_control_prop framework_status_prop gesture_prop graphics_config_writable_prop hal_dumpstate_config_prop sota_prop hwservicemanager_prop lmkd_prop locale_prop logd_prop logpersistd_logging_prop log_prop log_tag_prop lowpan_prop nfc_prop ota_prop permissive_mte_prop powerctl_prop qemu_hw_prop qemu_sf_lcd_density_prop radio_control_prop radio_prop serialno_prop surfaceflinger_color_prop system_prop system_user_mode_emulation_prop telephony_status_prop timezone_prop usb_control_prop vold_post_fs_data_prop wifi_hal_prop wifi_log_prop wifi_prop zram_control_prop default_prop virtual_face_prop virtual_fingerprint_prop adbd_prop adbd_tradeinmode_prop apexd_payload_metadata_prop ctl_snapuserd_prop ctl_prefetch_prop ctl_uprobestats_prop crashrecovery_prop debug_tracing_desktop_mode_visible_tasks_prop device_config_core_experiments_team_internal_prop device_config_lmkd_native_prop device_config_mglru_native_prop device_config_mmd_native_prop device_config_profcollect_native_boot_prop device_config_remote_key_provisioning_native_prop device_config_statsd_native_prop device_config_statsd_native_boot_prop device_config_storage_native_boot_prop device_config_sys_traced_prop device_config_window_manager_native_boot_prop device_config_configuration_prop device_config_connectivity_prop device_config_swcodec_native_prop device_config_tethering_u_or_later_native_prop dmesgd_start_prop fastbootd_protocol_prop gsid_prop init_perf_lsm_hooks_prop init_service_status_private_prop init_storage_prop init_svc_debug_prop kcmdline_prop keystore_diagnostics_prop keystore_listen_prop last_boot_reason_prop localization_prop logd_auditrate_prop lower_kptr_restrict_prop mmd_prop net_464xlat_fromvendor_prop net_connectivity_prop netd_stable_secret_prop next_boot_prop odsign_prop misctrl_prop perf_drop_caches_prop pm_prop prefetch_service_prop profcollectd_node_id_prop radio_cdma_ecm_prop remote_prov_prop remote_prov_cert_prop rollback_test_prop setupwizard_prop snapshotctl_prop snapuserd_prop system_adbd_prop system_audio_config_prop timezone_metadata_prop traced_perf_enabled_prop uprobestats_start_with_config_prop tuner_server_ctl_prop userspace_reboot_log_prop userspace_reboot_test_prop verity_status_prop zygote_wrap_prop ctl_mediatranscoding_prop ctl_odsign_prop virtualizationservice_prop ctl_apex_load_prop sensors_config_prop hypervisor_pvmfw_prop hypervisor_virtualizationmanager_prop game_manager_config_prop hidl_memory_prop suspend_debug_prop system_service_enable_prop ctl_artd_pre_reboot_prop trusty_security_vm_sys_prop hint_manager_config_prop bionic_linker_16kb_app_compat_prop device_config_virtualization_framework_native_prop fstype_prop log_file_logger_prop persist_sysui_builder_extras_prop persist_sysui_ranking_update_prop page_size_prop pm_16kb_app_compat_prop avf_virtualizationservice_prop high_barometer_quality_prop prefetch_boot_prop widevine_sys_vendor_prop ))
+(typeattribute system_internal_property_type)
+(expandtypeattribute (system_internal_property_type) false)
+(typeattributeset system_internal_property_type (apexd_prop bootloader_boot_reason_prop device_config_activity_manager_native_boot_prop device_config_boot_count_prop device_config_input_native_boot_prop device_config_netd_native_prop device_config_reset_performed_prop firstboot_prop boottime_prop charger_prop cold_boot_done_prop ctl_adbd_prop ctl_apexd_prop ctl_bootanim_prop ctl_bugreport_prop ctl_console_prop ctl_dumpstate_prop ctl_fuse_prop ctl_gsid_prop ctl_interface_restart_prop ctl_interface_stop_prop ctl_mdnsd_prop ctl_restart_prop ctl_rildaemon_prop ctl_sigstop_prop dynamic_system_prop heapprofd_enabled_prop llkd_prop lpdumpd_prop mmc_prop mock_ota_prop net_dns_prop overlay_prop persistent_properties_ready_prop safemode_prop system_lmk_prop system_trace_prop test_boot_reason_prop time_prop traced_enabled_prop traced_lazy_prop default_prop adbd_prop adbd_tradeinmode_prop apexd_payload_metadata_prop ctl_snapuserd_prop ctl_prefetch_prop ctl_uprobestats_prop crashrecovery_prop debug_tracing_desktop_mode_visible_tasks_prop device_config_core_experiments_team_internal_prop device_config_lmkd_native_prop device_config_mglru_native_prop device_config_mmd_native_prop device_config_profcollect_native_boot_prop device_config_remote_key_provisioning_native_prop device_config_statsd_native_prop device_config_statsd_native_boot_prop device_config_storage_native_boot_prop device_config_sys_traced_prop device_config_window_manager_native_boot_prop device_config_configuration_prop device_config_connectivity_prop device_config_swcodec_native_prop device_config_tethering_u_or_later_native_prop dmesgd_start_prop fastbootd_protocol_prop gsid_prop init_perf_lsm_hooks_prop init_service_status_private_prop init_storage_prop init_svc_debug_prop kcmdline_prop keystore_diagnostics_prop keystore_listen_prop last_boot_reason_prop localization_prop logd_auditrate_prop lower_kptr_restrict_prop mmd_prop net_464xlat_fromvendor_prop net_connectivity_prop netd_stable_secret_prop next_boot_prop odsign_prop misctrl_prop perf_drop_caches_prop pm_prop prefetch_service_prop profcollectd_node_id_prop radio_cdma_ecm_prop remote_prov_prop remote_prov_cert_prop rollback_test_prop setupwizard_prop snapshotctl_prop snapuserd_prop system_adbd_prop system_audio_config_prop timezone_metadata_prop traced_perf_enabled_prop uprobestats_start_with_config_prop tuner_server_ctl_prop userspace_reboot_log_prop userspace_reboot_test_prop verity_status_prop zygote_wrap_prop ctl_mediatranscoding_prop ctl_odsign_prop virtualizationservice_prop ctl_apex_load_prop sensors_config_prop hypervisor_pvmfw_prop hypervisor_virtualizationmanager_prop game_manager_config_prop hidl_memory_prop suspend_debug_prop system_service_enable_prop ctl_artd_pre_reboot_prop trusty_security_vm_sys_prop hint_manager_config_prop ))
+(typeattribute system_restricted_property_type)
+(expandtypeattribute (system_restricted_property_type) false)
+(typeattributeset system_restricted_property_type (aac_drc_prop adaptive_haptics_prop apex_ready_prop arm64_memtag_prop binder_cache_bluetooth_server_prop binder_cache_system_server_prop binder_cache_telephony_server_prop boot_status_prop bootanim_system_prop bootloader_prop boottime_public_prop bq_config_prop build_bootimage_prop build_prop composd_vm_art_prop device_config_aconfig_flags_prop device_config_camera_native_prop device_config_edgetpu_native_prop device_config_media_native_prop device_config_nnapi_native_prop device_config_runtime_native_boot_prop device_config_runtime_native_prop device_config_surface_flinger_native_boot_prop device_config_vendor_system_native_prop device_config_vendor_system_native_boot_prop drm_forcel3_prop fingerprint_prop gwp_asan_prop hal_instrumentation_prop userdebug_or_eng_prop init_service_status_prop libc_debug_prop module_sdkextensions_prop nnapi_ext_deny_product_prop persist_wm_debug_prop power_debug_prop property_service_version_prop provisioned_prop restorecon_prop retaildemo_prop servicemanager_prop smart_idle_maint_enabled_prop socket_hook_prop sqlite_log_prop surfaceflinger_display_prop system_boot_reason_prop system_jvmti_agent_prop traced_oome_heap_session_count_prop ab_update_gki_prop usb_prop userspace_reboot_exported_prop vold_status_prop vts_status_prop enable_16k_pages_prop profcollectd_etr_prop config_prop cppreopt_prop dalvik_prop debuggerd_prop device_logging_prop dhcp_prop dumpstate_prop exported3_system_prop exported_dumpstate_prop exported_secure_prop heapprofd_prop net_radio_prop pan_result_prop persist_debug_prop shell_prop test_harness_prop theme_prop use_memfd_prop vold_prop bionic_linker_16kb_app_compat_prop device_config_virtualization_framework_native_prop fstype_prop log_file_logger_prop persist_sysui_builder_extras_prop persist_sysui_ranking_update_prop page_size_prop pm_16kb_app_compat_prop ))
+(typeattribute system_public_property_type)
+(expandtypeattribute (system_public_property_type) false)
+(typeattributeset system_public_property_type (apexd_config_prop apexd_select_prop aaudio_config_prop apk_verity_prop audio_config_prop bootanim_config_prop bluetooth_config_prop build_attestation_prop build_config_prop build_odm_prop build_vendor_prop camera_calibration_prop camera_config_prop camera2_extensions_prop camerax_extensions_prop charger_config_prop codec2_config_prop composd_vm_vendor_prop cpu_variant_prop debugfs_restriction_prop drm_service_config_prop exported_camera_prop exported_config_prop exported_default_prop ffs_config_prop framework_watchdog_config_prop graphics_config_prop hdmi_config_prop hw_timeout_multiplier_prop hypervisor_prop hypervisor_restricted_prop incremental_prop input_device_config_prop keyguard_config_prop keystore_config_prop lmkd_config_prop media_config_prop media_variant_prop mediadrm_config_prop mm_events_config_prop oem_unlock_prop ota_build_prop packagemanager_config_prop quick_start_prop recovery_config_prop recovery_usb_config_prop sendbug_config_prop soc_prop storage_config_prop storagemanager_config_prop surfaceflinger_prop suspend_prop systemsound_config_prop telephony_config_prop threadnetwork_config_prop tombstone_config_prop usb_config_prop userspace_reboot_config_prop vehicle_hal_prop vendor_security_patch_level_prop vendor_socket_hook_prop virtual_ab_prop vndk_prop vts_config_prop vold_config_prop wifi_config_prop zram_config_prop zygote_config_prop dck_prop tuner_config_prop usb_uvc_enabled_prop setupwizard_mode_prop pm_archiving_enabled_prop trusty_security_vm_sys_vendor_prop adbd_config_prop audio_prop bluetooth_a2dp_offload_prop bluetooth_audio_hal_prop bluetooth_finder_prop bluetooth_prop bpf_progs_loaded_prop charger_status_prop ctl_default_prop ctl_interface_start_prop ctl_start_prop ctl_stop_prop dalvik_config_prop dalvik_dynamic_config_prop dalvik_runtime_prop debug_prop device_config_memory_safety_native_boot_prop device_config_memory_safety_native_prop dumpstate_options_prop exported_system_prop exported_bluetooth_prop exported_overlay_prop exported_pm_prop future_pm_prop ffs_control_prop framework_status_prop gesture_prop graphics_config_writable_prop hal_dumpstate_config_prop sota_prop hwservicemanager_prop lmkd_prop locale_prop logd_prop logpersistd_logging_prop log_prop log_tag_prop lowpan_prop nfc_prop ota_prop permissive_mte_prop powerctl_prop qemu_hw_prop qemu_sf_lcd_density_prop radio_control_prop radio_prop serialno_prop surfaceflinger_color_prop system_prop system_user_mode_emulation_prop telephony_status_prop timezone_prop usb_control_prop vold_post_fs_data_prop wifi_hal_prop wifi_log_prop wifi_prop zram_control_prop virtual_face_prop virtual_fingerprint_prop avf_virtualizationservice_prop high_barometer_quality_prop prefetch_boot_prop widevine_sys_vendor_prop ))
+(typeattribute keystore2_key_type)
+(typeattributeset keystore2_key_type (keystore wifi_key shell_key su_key vold_key odsign_key locksettings_key resume_on_reboot_key ))
+(typeattribute vendor_property_type)
+(expandtypeattribute (vendor_property_type) false)
+(typeattributeset vendor_property_type (rebootescrow_hal_prop virtual_face_hal_prop virtual_fingerprint_hal_prop persist_vendor_debug_wifi_prop vendor_default_prop ))
+(typeattribute vendor_internal_property_type)
+(expandtypeattribute (vendor_internal_property_type) false)
+(typeattributeset vendor_internal_property_type (rebootescrow_hal_prop virtual_face_hal_prop virtual_fingerprint_hal_prop vendor_default_prop ))
+(typeattribute vendor_restricted_property_type)
+(expandtypeattribute (vendor_restricted_property_type) false)
+(typeattribute vendor_public_property_type)
+(expandtypeattribute (vendor_public_property_type) false)
+(typeattributeset vendor_public_property_type (persist_vendor_debug_wifi_prop ))
+(typeattribute system_server_service)
+(typeattributeset system_server_service (device_config_updatable_service ondevicepersonalization_system_service profiling_service accessibility_service account_service activity_service activity_task_service adb_service adservices_manager_service alarm_service app_binding_service app_function_service app_hibernation_service app_integrity_service app_prediction_service app_search_service appops_service appwidget_service archive_service assetatlas_service attestation_verification_service audio_service auth_service autofill_service backup_service batterystats_service battery_service binder_calls_stats_service blob_store_service bluetooth_manager_service broadcastradio_service cacheinfo_service cameraproxy_service clipboard_service cloudsearch_service contexthub_service contextual_search_service crossprofileapps_service IProxyService_service companion_device_service connectivity_native_service connectivity_service connmetrics_service consumer_ir_service content_capture_service content_suggestions_service content_service country_detector_service coverage_service cpuinfo_service cpu_monitor_service credential_service dataloader_manager_service dbinfo_service device_config_service device_policy_service device_state_service deviceidle_service device_identifiers_service devicestoragemonitor_service diskstats_service display_service domain_verification_service color_display_service ecm_enhanced_confirmation_service external_vibrator_service file_integrity_service font_service netd_listener_service network_watchlist_service devicelock_service DockObserver_service dreams_service dropbox_service ethernet_service biometric_service bugreport_service platform_compat_service face_service fingerprint_service fwk_altitude_service fwk_stats_service fwk_sensor_service fwk_vibrator_control_service game_service gfxinfo_service gnss_time_update_service grammatical_inflection_service graphicsstats_service hardware_service hardware_properties_service hdmi_control_service healthconnect_service hint_service imms_service incremental_service input_method_service input_service intrusion_detection_service ipsec_service iris_service jobscheduler_service launcherapps_service legacy_permission_service light_service locale_service location_service location_time_zone_manager_service lock_settings_service looper_stats_service media_communication_service media_metrics_service media_projection_service media_quality_service media_router_service media_session_service meminfo_service memtrackproxy_service midi_service mount_service music_recognition_service nearby_service netpolicy_service netstats_service network_management_service network_score_service network_stack_service network_time_update_service notification_service oem_lock_service otadexopt_service overlay_service pac_proxy_service package_service package_native_service people_service permission_service permissionmgr_service permission_checker_service persistent_data_block_service pinner_service powerstats_service power_service print_service processinfo_service procstats_service reboot_readiness_service recovery_service registry_service remote_auth_service remote_provisioning_service resources_manager_service restrictions_service role_service rollback_service runtime_service rttmanager_service samplingprofiler_service scheduling_policy_service search_service search_ui_service sec_key_att_app_id_provider_service security_state_service selection_toolbar_service sensitive_content_protection_service sensorservice_service sensor_privacy_service serial_service servicediscovery_service settings_service shortcut_service slice_service smartspace_service statusbar_service storagestats_service sdk_sandbox_service system_config_service system_server_dumper_service system_update_service soundtrigger_middleware_service speech_recognition_service tare_service task_service testharness_service textclassification_service textservices_service texttospeech_service telecom_service thermal_service threadnetwork_service timedetector_service timezonedetector_service translation_service trust_service tv_ad_service tv_iapp_service tv_input_service tv_tuner_resource_mgr_service uimode_service updatelock_service uri_grants_service usagestats_service usb_service user_service uwb_service vcn_management_service vibrator_service vibrator_manager_service virtual_device_service virtual_device_native_service voiceinteraction_service vpn_management_service vr_manager_service wallpaper_service wallpaper_effects_generation_service webviewupdate_service wifip2p_service wifiscanner_service wifi_service wifiaware_service wifi_usd_service window_service inputflinger_service tethering_service emergency_affordance_service ambient_context_service authentication_policy_service attention_service bg_install_control_service communal_service dynamic_system_service feature_flags_service fwk_devicestate_service incidentcompanion_service logcat_service on_device_intelligence_service protolog_configuration_service resolver_service safety_center_service statsbootstrap_service statscompanion_service statsmanager_service tracingproxy_service tradeinmode_service transparency_service vm_tethering_service wearable_sensing_service dynamic_instrumentation_service advanced_protection_service ranging_service ))
+(typeattribute app_api_service)
+(typeattributeset app_api_service (batteryproperties_service gatekeeper_service gpu_service credstore_service mediatranscoding_service profiling_service surfaceflinger_service accessibility_service account_service activity_service activity_task_service alarm_service app_function_service app_hibernation_service app_prediction_service app_search_service appops_service appwidget_service archive_service assetatlas_service attestation_verification_service audio_service auth_service autofill_service backup_service batterystats_service blob_store_service bluetooth_manager_service broadcastradio_service clipboard_service cloudsearch_service contexthub_service contextual_search_service crossprofileapps_service IProxyService_service companion_device_service connectivity_native_service connectivity_service connmetrics_service consumer_ir_service content_capture_service content_suggestions_service content_service country_detector_service credential_service device_policy_service device_state_service deviceidle_service device_identifiers_service display_service domain_verification_service color_display_service ecm_enhanced_confirmation_service file_integrity_service font_service devicelock_service dreams_service dropbox_service ethernet_service biometric_service bugreport_service platform_compat_service face_service fingerprint_service fwk_stats_service game_service grammatical_inflection_service graphicsstats_service hardware_properties_service hdmi_control_service healthconnect_service hint_service imms_service input_method_service input_service intrusion_detection_service ipsec_service iris_service jobscheduler_service launcherapps_service legacy_permission_service light_service locale_service location_service lock_settings_service media_communication_service media_metrics_service media_projection_service media_quality_service media_router_service media_session_service memtrackproxy_service midi_service mount_service music_recognition_service nearby_service netpolicy_service netstats_service network_management_service notification_service pac_proxy_service package_service package_native_service people_service permission_service permissionmgr_service permission_checker_service persistent_data_block_service powerstats_service power_service print_service procstats_service reboot_readiness_service registry_service remote_auth_service restrictions_service role_service rollback_service rttmanager_service search_service search_ui_service sec_key_att_app_id_provider_service security_state_service selection_toolbar_service sensitive_content_protection_service sensorservice_service sensor_privacy_service servicediscovery_service settings_service shortcut_service slice_service smartspace_service statusbar_service storagestats_service sdk_sandbox_service speech_recognition_service tare_service textclassification_service textservices_service texttospeech_service telecom_service thermal_service threadnetwork_service timedetector_service timezonedetector_service translation_service trust_service tv_ad_service tv_iapp_service tv_input_service tv_tuner_resource_mgr_service uimode_service uri_grants_service usagestats_service usb_service user_service uwb_service vcn_management_service vibrator_service vibrator_manager_service virtual_device_service virtual_device_native_service voiceinteraction_service vpn_management_service wallpaper_service wallpaper_effects_generation_service webviewupdate_service wifip2p_service wifiscanner_service wifi_service wifiaware_service wifi_usd_service tethering_service ambient_context_service communal_service feature_flags_service incidentcompanion_service mediatuner_service on_device_intelligence_service protolog_configuration_service safety_center_service wearable_sensing_service dynamic_instrumentation_service advanced_protection_service ranging_service ))
+(typeattribute ephemeral_app_api_service)
+(typeattributeset ephemeral_app_api_service (batteryproperties_service gpu_service surfaceflinger_service accessibility_service account_service activity_service activity_task_service alarm_service app_search_service appops_service appwidget_service assetatlas_service audio_service autofill_service backup_service batterystats_service bluetooth_manager_service clipboard_service IProxyService_service companion_device_service connectivity_native_service connectivity_service connmetrics_service consumer_ir_service content_capture_service content_suggestions_service content_service country_detector_service credential_service deviceidle_service device_identifiers_service display_service font_service devicelock_service dreams_service dropbox_service platform_compat_service game_service grammatical_inflection_service graphicsstats_service hardware_properties_service hint_service imms_service input_method_service input_service ipsec_service jobscheduler_service launcherapps_service legacy_permission_service light_service locale_service location_service media_communication_service media_metrics_service media_projection_service media_quality_service media_router_service media_session_service memtrackproxy_service midi_service mount_service music_recognition_service netpolicy_service netstats_service network_management_service notification_service package_service package_native_service permission_service permissionmgr_service permission_checker_service power_service print_service procstats_service registry_service restrictions_service rttmanager_service search_service security_state_service selection_toolbar_service sensorservice_service sensor_privacy_service servicediscovery_service settings_service statusbar_service storagestats_service speech_recognition_service textclassification_service textservices_service texttospeech_service telecom_service thermal_service timedetector_service translation_service tv_ad_service tv_iapp_service tv_input_service uimode_service uri_grants_service usagestats_service user_service vcn_management_service vibrator_service vibrator_manager_service virtual_device_native_service voiceinteraction_service webviewupdate_service tethering_service ))
+(typeattribute system_api_service)
+(typeattributeset system_api_service (device_config_updatable_service ondevicepersonalization_system_service adb_service adservices_manager_service app_hibernation_service app_integrity_service cacheinfo_service cpuinfo_service credential_service dbinfo_service device_state_service diskstats_service color_display_service gfxinfo_service intrusion_detection_service lock_settings_service meminfo_service network_score_service oem_lock_service overlay_service persistent_data_block_service resources_manager_service serial_service system_config_service system_server_dumper_service updatelock_service window_service inputflinger_service authentication_policy_service bg_install_control_service dynamic_system_service incidentcompanion_service protolog_configuration_service safety_center_service statsmanager_service ))
+(typeattribute protected_service)
+(typeattributeset protected_service (hal_audio_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_confirmationui_service hal_contexthub_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_composer_service hal_health_service hal_health_storage_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service ))
+(typeattribute service_manager_type)
+(typeattributeset service_manager_type (aidl_lazy_test_service apc_service apex_service artd_service artd_pre_reboot_service audioserver_service authorization_service batteryproperties_service bluetooth_service cameraserver_service fwk_camera_service default_android_service device_config_updatable_service dexopt_chroot_setup_service dnsresolver_service drmserver_service dumpstate_service evsmanagerd_service fingerprintd_service fwk_automotive_display_service gatekeeper_service gpu_service idmap_service incident_service installd_service credstore_service keystore_compat_hal_service keystore_maintenance_service keystore_metrics_service keystore_service legacykeystore_service lpdump_service mdns_service mediaserver_service mediametrics_service mediaextractor_service mediadrmserver_service mediatranscoding_service netd_service nfc_service ondevicepersonalization_system_service ot_daemon_service profiling_service radio_service secure_element_service service_manager_service storaged_service surfaceflinger_service system_app_service system_net_netd_service system_suspend_control_internal_service system_suspend_control_service update_engine_service update_engine_stable_service virtualization_service virtual_camera_service virtual_touchpad_service vold_service vr_hwc_service vrflinger_vsync_service accessibility_service account_service activity_service activity_task_service adb_service adservices_manager_service alarm_service app_binding_service app_function_service app_hibernation_service app_integrity_service app_prediction_service app_search_service appops_service appwidget_service archive_service assetatlas_service attestation_verification_service audio_service auth_service autofill_service backup_service batterystats_service battery_service binder_calls_stats_service blob_store_service bluetooth_manager_service broadcastradio_service cacheinfo_service cameraproxy_service clipboard_service cloudsearch_service contexthub_service contextual_search_service crossprofileapps_service IProxyService_service companion_device_service connectivity_native_service connectivity_service connmetrics_service consumer_ir_service content_capture_service content_suggestions_service content_service country_detector_service coverage_service cpuinfo_service cpu_monitor_service credential_service dataloader_manager_service dbinfo_service device_config_service device_policy_service device_state_service deviceidle_service device_identifiers_service devicestoragemonitor_service diskstats_service display_service domain_verification_service color_display_service ecm_enhanced_confirmation_service external_vibrator_service file_integrity_service font_service netd_listener_service network_watchlist_service devicelock_service DockObserver_service dreams_service dropbox_service ethernet_service biometric_service bugreport_service platform_compat_service face_service fingerprint_service fwk_altitude_service fwk_stats_service fwk_sensor_service fwk_vibrator_control_service game_service gfxinfo_service gnss_time_update_service grammatical_inflection_service graphicsstats_service hardware_service hardware_properties_service hdmi_control_service healthconnect_service hint_service imms_service incremental_service input_method_service input_service intrusion_detection_service ipsec_service iris_service jobscheduler_service launcherapps_service legacy_permission_service light_service locale_service location_service location_time_zone_manager_service lock_settings_service looper_stats_service media_communication_service media_metrics_service media_projection_service media_quality_service media_router_service media_session_service meminfo_service memtrackproxy_service midi_service mount_service music_recognition_service nearby_service netpolicy_service netstats_service network_management_service network_score_service network_stack_service network_time_update_service notification_service oem_lock_service otadexopt_service overlay_service pac_proxy_service package_service package_native_service people_service permission_service permissionmgr_service permission_checker_service persistent_data_block_service pinner_service powerstats_service power_service print_service processinfo_service procstats_service reboot_readiness_service recovery_service registry_service remote_auth_service remote_provisioning_service resources_manager_service restrictions_service role_service rollback_service runtime_service rttmanager_service samplingprofiler_service scheduling_policy_service search_service search_ui_service sec_key_att_app_id_provider_service security_state_service selection_toolbar_service sensitive_content_protection_service sensorservice_service sensor_privacy_service serial_service servicediscovery_service settings_service shortcut_service slice_service smartspace_service statusbar_service storagestats_service sdk_sandbox_service system_config_service system_server_dumper_service system_update_service soundtrigger_middleware_service speech_recognition_service tare_service task_service testharness_service textclassification_service textservices_service texttospeech_service telecom_service thermal_service threadnetwork_service timedetector_service timezonedetector_service translation_service trust_service tv_ad_service tv_iapp_service tv_input_service tv_tuner_resource_mgr_service uimode_service updatelock_service uri_grants_service usagestats_service usb_service user_service uwb_service vcn_management_service vibrator_service vibrator_manager_service virtual_device_service virtual_device_native_service voiceinteraction_service vpn_management_service vr_manager_service wallpaper_service wallpaper_effects_generation_service webviewupdate_service wifip2p_service wifiscanner_service wifi_service wifinl80211_service wifiaware_service wifi_usd_service window_service inputflinger_service tethering_service emergency_affordance_service hal_audio_service hal_audiocontrol_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_cas_service hal_codec2_service hal_confirmationui_service hal_contexthub_service hal_drm_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_allocator_service hal_graphics_composer_service hal_graphics_mapper_service hal_health_service hal_health_storage_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_neuralnetworks_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service ambient_context_service authentication_policy_service attention_service bg_install_control_service compos_service communal_service dynamic_system_service feature_flags_service fwk_devicestate_service gsi_service incidentcompanion_service logcat_service logd_service mediatuner_service mmd_service on_device_intelligence_service profcollectd_service protolog_configuration_service resolver_service rkpd_registrar_service rkpd_refresh_service rkp_cert_processor_service safety_center_service stats_service statsbootstrap_service statscompanion_service statsmanager_service tracingproxy_service tradeinmode_service transparency_service vfio_handler_service virtualization_maintenance_service vm_tethering_service vmnic_service microfuchsia_service uce_service fwk_vold_service wearable_sensing_service wifi_mainline_supplicant_service dynamic_instrumentation_service advanced_protection_service ranging_service ))
+(typeattribute hwservice_manager_type)
+(typeattributeset hwservice_manager_type (default_android_hwservice fwk_camera_hwservice fwk_display_hwservice fwk_scheduler_hwservice fwk_sensor_hwservice fwk_stats_hwservice fwk_automotive_display_hwservice hal_atrace_hwservice hal_audio_hwservice hal_audiocontrol_hwservice hal_authsecret_hwservice hal_bluetooth_hwservice hal_bootctl_hwservice hal_broadcastradio_hwservice hal_camera_hwservice hal_can_bus_hwservice hal_can_controller_hwservice hal_confirmationui_hwservice hal_contexthub_hwservice hal_dumpstate_hwservice hal_evs_hwservice hal_face_hwservice hal_fingerprint_hwservice hal_gatekeeper_hwservice hal_gnss_hwservice hal_graphics_composer_hwservice hal_health_hwservice hal_health_storage_hwservice hal_input_classifier_hwservice hal_ir_hwservice hal_keymaster_hwservice hal_light_hwservice hal_lowpan_hwservice hal_memtrack_hwservice hal_nfc_hwservice hal_oemlock_hwservice hal_power_hwservice hal_power_stats_hwservice hal_secure_element_hwservice hal_sensors_hwservice hal_telephony_hwservice hal_tetheroffload_hwservice hal_thermal_hwservice hal_tv_cec_hwservice hal_tv_input_hwservice hal_tv_tuner_hwservice hal_usb_gadget_hwservice hal_usb_hwservice hal_vehicle_hwservice hal_vibrator_hwservice hal_vr_hwservice hal_weaver_hwservice hal_wifi_hostapd_hwservice hal_wifi_hwservice hal_wifi_supplicant_hwservice system_net_netd_hwservice system_suspend_hwservice system_wifi_keystore_hwservice fwk_bufferhub_hwservice hal_cas_hwservice hal_codec2_hwservice hal_configstore_ISurfaceFlingerConfigs hal_drm_hwservice hal_graphics_allocator_hwservice hal_graphics_mapper_hwservice hal_neuralnetworks_hwservice hal_omx_hwservice hal_renderscript_hwservice hidl_allocator_hwservice hidl_base_hwservice hidl_manager_hwservice hidl_memory_hwservice hidl_token_hwservice hal_lazy_test_hwservice ))
+(typeattribute same_process_hwservice)
+(typeattributeset same_process_hwservice (hal_graphics_mapper_hwservice hal_renderscript_hwservice ))
+(typeattribute coredomain_hwservice)
+(typeattributeset coredomain_hwservice (fwk_camera_hwservice fwk_display_hwservice fwk_scheduler_hwservice fwk_sensor_hwservice fwk_stats_hwservice fwk_automotive_display_hwservice system_net_netd_hwservice system_suspend_hwservice system_wifi_keystore_hwservice fwk_bufferhub_hwservice hidl_allocator_hwservice hidl_manager_hwservice hidl_memory_hwservice hidl_token_hwservice ))
+(typeattribute protected_hwservice)
+(typeattributeset protected_hwservice (default_android_hwservice fwk_camera_hwservice fwk_display_hwservice fwk_scheduler_hwservice fwk_sensor_hwservice fwk_stats_hwservice fwk_automotive_display_hwservice hal_atrace_hwservice hal_audio_hwservice hal_audiocontrol_hwservice hal_authsecret_hwservice hal_bluetooth_hwservice hal_bootctl_hwservice hal_broadcastradio_hwservice hal_camera_hwservice hal_can_bus_hwservice hal_can_controller_hwservice hal_confirmationui_hwservice hal_contexthub_hwservice hal_dumpstate_hwservice hal_evs_hwservice hal_face_hwservice hal_fingerprint_hwservice hal_gatekeeper_hwservice hal_gnss_hwservice hal_graphics_composer_hwservice hal_health_hwservice hal_health_storage_hwservice hal_input_classifier_hwservice hal_ir_hwservice hal_keymaster_hwservice hal_light_hwservice hal_lowpan_hwservice hal_memtrack_hwservice hal_nfc_hwservice hal_oemlock_hwservice hal_power_hwservice hal_power_stats_hwservice hal_secure_element_hwservice hal_sensors_hwservice hal_telephony_hwservice hal_tetheroffload_hwservice hal_thermal_hwservice hal_tv_cec_hwservice hal_tv_input_hwservice hal_tv_tuner_hwservice hal_usb_gadget_hwservice hal_usb_hwservice hal_vehicle_hwservice hal_vibrator_hwservice hal_vr_hwservice hal_weaver_hwservice hal_wifi_hostapd_hwservice hal_wifi_hwservice hal_wifi_supplicant_hwservice system_net_netd_hwservice system_suspend_hwservice system_wifi_keystore_hwservice hal_lazy_test_hwservice ))
+(typeattribute vndservice_manager_type)
+(typeattributeset vndservice_manager_type (service_manager_vndservice default_android_vndservice ))
+(typeattribute hal_service_type)
+(typeattributeset hal_service_type (hal_audio_service hal_audiocontrol_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_cas_service hal_codec2_service hal_confirmationui_service hal_contexthub_service hal_drm_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_allocator_service hal_graphics_composer_service hal_graphics_mapper_service hal_health_service hal_health_storage_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_neuralnetworks_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service ))
+(typeattribute mlstrustedsubject)
+(typeattributeset mlstrustedsubject (adbd artd bluetooth bufferhubd drmserver dumpstate pdx_display_client_endpoint_socket pdx_display_manager_endpoint_socket pdx_display_screenshot_endpoint_socket pdx_display_vsync_endpoint_socket pdx_performance_client_endpoint_socket pdx_bufferhub_client_endpoint_socket heapprofd hwservicemanager incidentd init installd kernel keystore llkd lmkd logd mdnsd mediadrmserver mediaextractor mediaserver netd network_stack nfc performanced prng_seeder radio rss_hwm_reset runas servicemanager shell simpleperf_app_runner statsd surfaceflinger system_app system_server tombstoned traced traced_perf traced_probes uncrypt vendor_init vold vold_prepare_subdirs webview_zygote zygote aconfigd aconfigd_mainline cppreopts device_as_webcam otapreopt_slot postinstall_dexopt profcollectd simpleperf_boot storaged virtualizationservice ))
+(typeattribute mlstrustedobject)
+(typeattributeset mlstrustedobject (ashmem_device ashmem_libcutils_device binder_device hwbinder_device pmsg_device gpu_device mtp_device ptmx_device kmsg_device null_device random_device owntty_device zero_device fuse_device ion_device dmabuf_heap_device dmabuf_system_heap_device dmabuf_system_secure_heap_device uhid_device tun_device usbaccessory_device usb_device proc_qtaguid_ctrl proc_qtaguid_stat selinuxfs cgroup sysfs sysfs_bluetooth_writable sysfs_kernel_notes sysfs_nfc_power_writable inotify devpts fuse fuseblk sdcardfs vfat exfat debugfs_trace_marker debugfs_tracing debugfs_tracing_debug functionfs anr_data_file tombstone_data_file apk_tmp_file apk_private_tmp_file ota_package_file user_profile_data_file shell_data_file heapdump_data_file ringtone_file media_rw_data_file radio_data_file shared_relro_file trace_data_file method_trace_data_file system_app_data_file cache_file cache_backup_file cache_recovery_file wallpaper_file shortcut_manager_icons asec_apk_file backup_data_file app_fuse_file dnsproxyd_socket fwmarkd_socket logd_socket logdr_socket logdw_socket mdnsd_socket property_socket statsdw_socket system_ndebug_socket system_unsolzygote_socket tombstoned_crash_socket tombstoned_java_trace_socket traced_consumer_socket traced_perf_socket traced_producer_socket heapprofd_socket pdx_display_client_endpoint_socket pdx_display_manager_endpoint_socket pdx_display_screenshot_endpoint_socket pdx_display_vsync_endpoint_socket pdx_performance_client_endpoint_socket pdx_bufferhub_client_endpoint_socket system_server_tmpfs traced_tmpfs wm_trace_data_file virtualizationservice_data_file kvm_device prng_seeder_socket aconfigd_socket aconfigd_mainline_socket heapprofd_tmpfs ))
+(typeattribute appdomain)
+(typeattributeset appdomain (bluetooth ephemeral_app gmscore_app isolated_app isolated_compute_app mediaprovider network_stack nfc platform_app priv_app radio rkpdapp runas_app secure_element shared_relro shell simpleperf system_app traceur_app untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 device_as_webcam mediaprovider_app permissioncontroller_app sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next vmlauncher_app vzwomatrigger_app ))
+(typeattribute untrusted_app_all)
+(typeattributeset untrusted_app_all (runas_app simpleperf untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 ))
+(typeattribute isolated_app_all)
+(typeattributeset isolated_app_all (isolated_app isolated_compute_app ))
+(typeattribute isolated_compute_allowed_service)
+(typeattributeset isolated_compute_allowed_service (audioserver_service cameraserver_service mediaserver_service content_capture_service device_state_service speech_recognition_service hal_codec2_service on_device_intelligence_service ))
+(typeattribute isolated_compute_allowed_device)
+(typeattributeset isolated_compute_allowed_device (hwbinder_device gpu_device ion_device dmabuf_system_heap_device ))
+(typeattribute netdomain)
+(typeattributeset netdomain (adbd bluetooth dhcp dnsmasq drmserver dumpstate ephemeral_app gmscore_app mdnsd mediadrmserver mediaprovider mediaserver netd network_stack nfc platform_app priv_app radio rkpdapp runas_app shell system_app system_server untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine adbd_tradeinmode clatd ot_daemon rkp_cert_processor sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next vmlauncher_app ))
+(typeattribute bluetoothdomain)
+(typeattributeset bluetoothdomain (platform_app priv_app radio runas_app system_server untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 ))
+(typeattribute binderservicedomain)
+(typeattributeset binderservicedomain (audioserver cameraserver credstore drmserver evsmanagerd gatekeeperd idmap inputflinger keystore logd mediadrmserver mediaextractor mediametrics mediaserver mediatranscoding nfc radio secure_element surfaceflinger system_app system_server virtual_touchpad gsid mediatuner rkpd ))
+(typeattribute bpfdomain)
+(expandtypeattribute (bpfdomain) false)
+(typeattributeset bpfdomain (bpfloader charger_vendor gpuservice lmkd netd netutils_wrapper network_stack system_server mediaprovider_app uprobestats ))
+(typeattribute update_engine_common)
+(typeattributeset update_engine_common (update_engine ))
+(typeattribute coredomain)
+(typeattributeset coredomain (adbd apexd app_zygote artd atrace audioserver blkid blkid_untrusted bluetooth bootanim bootstat bpfloader bufferhubd cameraserver charger crash_dump credstore crosvm dhcp dnsmasq drmserver dumpstate e2fs early_virtmgr ephemeral_app evsmanagerd extra_free_kbytes fastbootd fingerprintd flags_health_check fsck fsck_untrusted gatekeeperd gmscore_app gpuservice healthd heapprofd hwservicemanager idmap incident incident_helper incidentd init inputflinger installd isolated_app isolated_compute_app kernel keystore llkd lmkd logd logpersist mdnsd mediadrmserver mediaextractor mediametrics mediaprovider mediaserver mediaswcodec mediatranscoding modprobe netd netutils_wrapper network_stack nfc perfetto performanced platform_app postinstall priv_app prng_seeder profman radio recovery recovery_persist recovery_refresh rkpdapp rs rss_hwm_reset runas runas_app sdcardd secure_element servicemanager sgdisk shared_relro shell simpleperf simpleperf_app_runner slideshow statsd surfaceflinger system_app system_server tombstoned toolbox traced traced_perf traced_probes traceur_app ueventd uncrypt untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine update_verifier usbd vdc virtual_camera virtual_touchpad virtualizationmanager vold vold_prepare_subdirs watchdogd webview_zygote wificond zygote aconfigd aconfigd_mainline adbd_tradeinmode apex_test_prepostinstall apexd_derive_classpath art_boot art_exec auditctl automotive_display_service bert_collector blank_screen boringssl_self_test canhalconfigurator clatd compos_fd_server compos_verify composd cppreopts derive_classpath derive_sdk device_as_webcam dex2oat dexopt_chroot_setup dmesgd fuseblkd fuseblkd_untrusted fwk_bufferhub gki_apex_prepostinstall gsid hal_allocator_default hal_keymint_system iw kcmdlinectrl linkerconfig linux_vm_setup lpdumpd mediaprovider_app mediatuner memcgv2_activation_depth microfuchsiad migrate_legacy_obb_data misctrl mm_events mmd mtectrl odrefresh odsign ot_ctl ot_daemon otapreopt_chroot otapreopt_slot permissioncontroller_app postinstall_dexopt prefetch preloads_copy preopt2cachename profcollectd remount rkp_cert_processor rkpd sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next simpleperf_boot snapshotctl snapuserd stats storaged system_server_startup system_suspend trace_redactor tradeinmode uprobestats vehicle_binding_util vfio_handler virtual_face virtual_fingerprint virtualizationservice vmlauncher_app vmnic wait_for_keymaster wifi_mainline_supplicant ))
+(typeattribute vendor_hwservice_type)
+(typeattribute coredomain_socket)
+(expandtypeattribute (coredomain_socket) false)
+(typeattributeset coredomain_socket (drmserver_socket adbd_socket bluetooth_socket dnsproxyd_socket dumpstate_socket fwmarkd_socket lmkd_socket logd_socket logdr_socket logdw_socket mdns_socket mdnsd_socket misc_logd_file mtpd_socket ot_daemon_socket property_socket racoon_socket recovery_socket snapuserd_socket snapuserd_proxy_socket statsdw_socket system_wpa_socket system_ndebug_socket system_unsolzygote_socket tombstoned_crash_socket tombstoned_intercept_socket traced_consumer_socket traced_perf_socket traced_producer_socket uncrypt_socket zygote_socket heapprofd_socket pdx_display_client_endpoint_socket pdx_display_client_channel_socket pdx_display_manager_endpoint_socket pdx_display_manager_channel_socket pdx_display_screenshot_endpoint_socket pdx_display_screenshot_channel_socket pdx_display_vsync_endpoint_socket pdx_display_vsync_channel_socket pdx_performance_client_endpoint_socket pdx_performance_client_channel_socket pdx_bufferhub_client_endpoint_socket pdx_bufferhub_client_channel_socket prng_seeder_socket aconfigd_socket aconfigd_mainline_socket ))
+(typeattribute socket_between_core_and_vendor_violators)
+(expandtypeattribute (socket_between_core_and_vendor_violators) false)
+(typeattribute unconstrained_vsock_violators)
+(expandtypeattribute (unconstrained_vsock_violators) false)
+(typeattribute vendor_executes_system_violators)
+(expandtypeattribute (vendor_executes_system_violators) false)
+(typeattribute data_between_core_and_vendor_violators)
+(expandtypeattribute (data_between_core_and_vendor_violators) false)
+(typeattribute system_executes_vendor_violators)
+(expandtypeattribute (system_executes_vendor_violators) false)
+(typeattribute system_writes_vendor_properties_violators)
+(expandtypeattribute (system_writes_vendor_properties_violators) false)
+(typeattribute system_writes_mnt_vendor_violators)
+(expandtypeattribute (system_writes_mnt_vendor_violators) false)
+(typeattribute untrusted_app_visible_hwservice_violators)
+(expandtypeattribute (untrusted_app_visible_hwservice_violators) false)
+(typeattribute untrusted_app_visible_halserver_violators)
+(expandtypeattribute (untrusted_app_visible_halserver_violators) false)
+(typeattribute pdx_endpoint_dir_type)
+(typeattributeset pdx_endpoint_dir_type (pdx_display_dir pdx_performance_dir pdx_bufferhub_dir ))
+(typeattribute pdx_endpoint_socket_type)
+(expandtypeattribute (pdx_endpoint_socket_type) false)
+(typeattributeset pdx_endpoint_socket_type (pdx_display_client_endpoint_socket pdx_display_manager_endpoint_socket pdx_display_screenshot_endpoint_socket pdx_display_vsync_endpoint_socket pdx_performance_client_endpoint_socket pdx_bufferhub_client_endpoint_socket ))
+(typeattribute pdx_channel_socket_type)
+(expandtypeattribute (pdx_channel_socket_type) false)
+(typeattributeset pdx_channel_socket_type (pdx_display_client_channel_socket pdx_display_manager_channel_socket pdx_display_screenshot_channel_socket pdx_display_vsync_channel_socket pdx_performance_client_channel_socket pdx_bufferhub_client_channel_socket ))
+(typeattribute pdx_display_client_endpoint_dir_type)
+(typeattributeset pdx_display_client_endpoint_dir_type (pdx_display_dir ))
+(typeattribute pdx_display_client_endpoint_socket_type)
+(typeattributeset pdx_display_client_endpoint_socket_type (pdx_display_client_endpoint_socket ))
+(typeattribute pdx_display_client_channel_socket_type)
+(typeattributeset pdx_display_client_channel_socket_type (pdx_display_client_channel_socket ))
+(typeattribute pdx_display_client_server_type)
+(typeattributeset pdx_display_client_server_type (surfaceflinger ))
+(typeattribute pdx_display_manager_endpoint_dir_type)
+(typeattributeset pdx_display_manager_endpoint_dir_type (pdx_display_dir ))
+(typeattribute pdx_display_manager_endpoint_socket_type)
+(typeattributeset pdx_display_manager_endpoint_socket_type (pdx_display_manager_endpoint_socket ))
+(typeattribute pdx_display_manager_channel_socket_type)
+(typeattributeset pdx_display_manager_channel_socket_type (pdx_display_manager_channel_socket ))
+(typeattribute pdx_display_manager_server_type)
+(typeattributeset pdx_display_manager_server_type (surfaceflinger ))
+(typeattribute pdx_display_screenshot_endpoint_dir_type)
+(typeattributeset pdx_display_screenshot_endpoint_dir_type (pdx_display_dir ))
+(typeattribute pdx_display_screenshot_endpoint_socket_type)
+(typeattributeset pdx_display_screenshot_endpoint_socket_type (pdx_display_screenshot_endpoint_socket ))
+(typeattribute pdx_display_screenshot_channel_socket_type)
+(typeattributeset pdx_display_screenshot_channel_socket_type (pdx_display_screenshot_channel_socket ))
+(typeattribute pdx_display_screenshot_server_type)
+(typeattributeset pdx_display_screenshot_server_type (surfaceflinger ))
+(typeattribute pdx_display_vsync_endpoint_dir_type)
+(typeattributeset pdx_display_vsync_endpoint_dir_type (pdx_display_dir ))
+(typeattribute pdx_display_vsync_endpoint_socket_type)
+(typeattributeset pdx_display_vsync_endpoint_socket_type (pdx_display_vsync_endpoint_socket ))
+(typeattribute pdx_display_vsync_channel_socket_type)
+(typeattributeset pdx_display_vsync_channel_socket_type (pdx_display_vsync_channel_socket ))
+(typeattribute pdx_display_vsync_server_type)
+(typeattributeset pdx_display_vsync_server_type (surfaceflinger ))
+(typeattribute pdx_performance_client_endpoint_dir_type)
+(typeattributeset pdx_performance_client_endpoint_dir_type (pdx_performance_dir ))
+(typeattribute pdx_performance_client_endpoint_socket_type)
+(typeattributeset pdx_performance_client_endpoint_socket_type (pdx_performance_client_endpoint_socket ))
+(typeattribute pdx_performance_client_channel_socket_type)
+(typeattributeset pdx_performance_client_channel_socket_type (pdx_performance_client_channel_socket ))
+(typeattribute pdx_performance_client_server_type)
+(typeattributeset pdx_performance_client_server_type (performanced ))
+(typeattribute pdx_bufferhub_client_endpoint_dir_type)
+(typeattributeset pdx_bufferhub_client_endpoint_dir_type (pdx_bufferhub_dir ))
+(typeattribute pdx_bufferhub_client_endpoint_socket_type)
+(typeattributeset pdx_bufferhub_client_endpoint_socket_type (pdx_bufferhub_client_endpoint_socket ))
+(typeattribute pdx_bufferhub_client_channel_socket_type)
+(typeattributeset pdx_bufferhub_client_channel_socket_type (pdx_bufferhub_client_channel_socket ))
+(typeattribute pdx_bufferhub_client_server_type)
+(typeattributeset pdx_bufferhub_client_server_type (bufferhubd ))
+(typeattribute halserverdomain)
+(typeattributeset halserverdomain (charger_vendor mediaswcodec hal_allocator_default hal_keymint_system virtual_face virtual_fingerprint virtualizationservice ))
+(typeattribute halclientdomain)
+(expandtypeattribute (halclientdomain) true)
+(typeattributeset halclientdomain (adbd atrace audioserver bluetooth bootanim bufferhubd cameraserver charger credstore crosvm dumpstate early_virtmgr evsmanagerd gatekeeperd isolated_compute_app keystore mediadrmserver mediaextractor mediaserver mediaswcodec mediatranscoding network_stack nfc radio rkpdapp secure_element shell statsd surfaceflinger system_app system_server traced_probes traceur_app update_engine update_verifier usbd virtual_camera virtualizationmanager vold wificond automotive_display_service blank_screen canhalconfigurator fwk_bufferhub mediatuner odsign ot_daemon snapshotctl storaged vehicle_binding_util virtualizationservice ))
+(typeattribute hal_automotive_socket_exemption)
+(typeattribute hal_allocator)
+(expandtypeattribute (hal_allocator) true)
+(typeattributeset hal_allocator (hal_allocator_default ))
+(typeattribute hal_allocator_client)
+(expandtypeattribute (hal_allocator_client) true)
+(typeattributeset hal_allocator_client (audioserver cameraserver isolated_compute_app mediaextractor mediaserver mediaswcodec mediatranscoding system_server ))
+(typeattribute hal_allocator_server)
+(expandtypeattribute (hal_allocator_server) false)
+(typeattributeset hal_allocator_server (hal_allocator_default ))
+(typeattribute hal_atrace)
+(expandtypeattribute (hal_atrace) true)
+(typeattribute hal_atrace_client)
+(expandtypeattribute (hal_atrace_client) true)
+(typeattributeset hal_atrace_client (atrace shell traced_probes traceur_app ))
+(typeattribute hal_atrace_server)
+(expandtypeattribute (hal_atrace_server) false)
+(typeattribute hal_audio)
+(expandtypeattribute (hal_audio) true)
+(typeattribute hal_audio_client)
+(expandtypeattribute (hal_audio_client) true)
+(typeattributeset hal_audio_client (audioserver bluetooth dumpstate system_server ))
+(typeattribute hal_audio_server)
+(expandtypeattribute (hal_audio_server) false)
+(typeattribute hal_audiocontrol)
+(expandtypeattribute (hal_audiocontrol) true)
+(typeattribute hal_audiocontrol_client)
+(expandtypeattribute (hal_audiocontrol_client) true)
+(typeattributeset hal_audiocontrol_client (dumpstate ))
+(typeattribute hal_audiocontrol_server)
+(expandtypeattribute (hal_audiocontrol_server) false)
+(typeattribute hal_authgraph)
+(expandtypeattribute (hal_authgraph) true)
+(typeattribute hal_authgraph_client)
+(expandtypeattribute (hal_authgraph_client) true)
+(typeattributeset hal_authgraph_client (dumpstate system_server ))
+(typeattribute hal_authgraph_server)
+(expandtypeattribute (hal_authgraph_server) false)
+(typeattribute hal_authsecret)
+(expandtypeattribute (hal_authsecret) true)
+(typeattribute hal_authsecret_client)
+(expandtypeattribute (hal_authsecret_client) true)
+(typeattributeset hal_authsecret_client (dumpstate system_server ))
+(typeattribute hal_authsecret_server)
+(expandtypeattribute (hal_authsecret_server) false)
+(typeattribute hal_bluetooth)
+(expandtypeattribute (hal_bluetooth) true)
+(typeattribute hal_bluetooth_client)
+(expandtypeattribute (hal_bluetooth_client) true)
+(typeattributeset hal_bluetooth_client (bluetooth dumpstate system_server ))
+(typeattribute hal_bluetooth_server)
+(expandtypeattribute (hal_bluetooth_server) false)
+(typeattribute hal_bootctl)
+(expandtypeattribute (hal_bootctl) true)
+(typeattribute hal_bootctl_client)
+(expandtypeattribute (hal_bootctl_client) true)
+(typeattributeset hal_bootctl_client (system_server update_engine update_verifier vold snapshotctl ))
+(typeattribute hal_bootctl_server)
+(expandtypeattribute (hal_bootctl_server) false)
+(typeattribute hal_broadcastradio)
+(expandtypeattribute (hal_broadcastradio) true)
+(typeattribute hal_broadcastradio_client)
+(expandtypeattribute (hal_broadcastradio_client) true)
+(typeattributeset hal_broadcastradio_client (dumpstate system_server ))
+(typeattribute hal_broadcastradio_server)
+(expandtypeattribute (hal_broadcastradio_server) false)
+(typeattribute hal_camera)
+(expandtypeattribute (hal_camera) true)
+(typeattribute hal_camera_client)
+(expandtypeattribute (hal_camera_client) true)
+(typeattributeset hal_camera_client (cameraserver dumpstate ))
+(typeattribute hal_camera_server)
+(expandtypeattribute (hal_camera_server) false)
+(typeattribute hal_can_bus)
+(expandtypeattribute (hal_can_bus) true)
+(typeattribute hal_can_bus_client)
+(expandtypeattribute (hal_can_bus_client) true)
+(typeattribute hal_can_bus_server)
+(expandtypeattribute (hal_can_bus_server) false)
+(typeattribute hal_can_controller)
+(expandtypeattribute (hal_can_controller) true)
+(typeattribute hal_can_controller_client)
+(expandtypeattribute (hal_can_controller_client) true)
+(typeattributeset hal_can_controller_client (canhalconfigurator ))
+(typeattribute hal_can_controller_server)
+(expandtypeattribute (hal_can_controller_server) false)
+(typeattribute hal_cas)
+(expandtypeattribute (hal_cas) true)
+(typeattribute hal_cas_client)
+(expandtypeattribute (hal_cas_client) true)
+(typeattributeset hal_cas_client (mediaextractor ))
+(typeattribute hal_cas_server)
+(expandtypeattribute (hal_cas_server) false)
+(typeattribute hal_codec2)
+(expandtypeattribute (hal_codec2) true)
+(typeattributeset hal_codec2 (mediaswcodec ))
+(typeattribute hal_codec2_client)
+(expandtypeattribute (hal_codec2_client) true)
+(typeattributeset hal_codec2_client (cameraserver dumpstate isolated_compute_app mediaserver mediaswcodec mediatranscoding surfaceflinger system_server virtual_camera ))
+(typeattribute hal_codec2_server)
+(expandtypeattribute (hal_codec2_server) false)
+(typeattributeset hal_codec2_server (mediaswcodec ))
+(typeattribute hal_configstore)
+(expandtypeattribute (hal_configstore) true)
+(typeattribute hal_configstore_client)
+(expandtypeattribute (hal_configstore_client) true)
+(typeattributeset hal_configstore_client (bootanim mediaserver mediatranscoding surfaceflinger system_server ))
+(typeattribute hal_configstore_server)
+(expandtypeattribute (hal_configstore_server) false)
+(typeattribute hal_confirmationui)
+(expandtypeattribute (hal_confirmationui) true)
+(typeattribute hal_confirmationui_client)
+(expandtypeattribute (hal_confirmationui_client) true)
+(typeattributeset hal_confirmationui_client (keystore ))
+(typeattribute hal_confirmationui_server)
+(expandtypeattribute (hal_confirmationui_server) false)
+(typeattribute hal_contexthub)
+(expandtypeattribute (hal_contexthub) true)
+(typeattribute hal_contexthub_client)
+(expandtypeattribute (hal_contexthub_client) true)
+(typeattributeset hal_contexthub_client (dumpstate system_server ))
+(typeattribute hal_contexthub_server)
+(expandtypeattribute (hal_contexthub_server) false)
+(typeattribute hal_drm)
+(expandtypeattribute (hal_drm) true)
+(typeattribute hal_drm_client)
+(expandtypeattribute (hal_drm_client) true)
+(typeattributeset hal_drm_client (dumpstate mediadrmserver mediaserver ))
+(typeattribute hal_drm_server)
+(expandtypeattribute (hal_drm_server) false)
+(typeattribute hal_dumpstate)
+(expandtypeattribute (hal_dumpstate) true)
+(typeattribute hal_dumpstate_client)
+(expandtypeattribute (hal_dumpstate_client) true)
+(typeattributeset hal_dumpstate_client (dumpstate system_app ))
+(typeattribute hal_dumpstate_server)
+(expandtypeattribute (hal_dumpstate_server) false)
+(typeattribute hal_evs)
+(expandtypeattribute (hal_evs) true)
+(typeattribute hal_evs_client)
+(expandtypeattribute (hal_evs_client) true)
+(typeattributeset hal_evs_client (dumpstate evsmanagerd ))
+(typeattribute hal_evs_server)
+(expandtypeattribute (hal_evs_server) false)
+(typeattribute hal_face)
+(expandtypeattribute (hal_face) true)
+(typeattributeset hal_face (virtual_face ))
+(typeattribute hal_face_client)
+(expandtypeattribute (hal_face_client) true)
+(typeattributeset hal_face_client (dumpstate system_server ))
+(typeattribute hal_face_server)
+(expandtypeattribute (hal_face_server) false)
+(typeattributeset hal_face_server (virtual_face ))
+(typeattribute hal_fastboot)
+(expandtypeattribute (hal_fastboot) true)
+(typeattribute hal_fastboot_client)
+(expandtypeattribute (hal_fastboot_client) true)
+(typeattribute hal_fastboot_server)
+(expandtypeattribute (hal_fastboot_server) false)
+(typeattribute hal_fingerprint)
+(expandtypeattribute (hal_fingerprint) true)
+(typeattributeset hal_fingerprint (virtual_fingerprint ))
+(typeattribute hal_fingerprint_client)
+(expandtypeattribute (hal_fingerprint_client) true)
+(typeattributeset hal_fingerprint_client (dumpstate system_server ))
+(typeattribute hal_fingerprint_server)
+(expandtypeattribute (hal_fingerprint_server) false)
+(typeattributeset hal_fingerprint_server (virtual_fingerprint ))
+(typeattribute hal_gatekeeper)
+(expandtypeattribute (hal_gatekeeper) true)
+(typeattribute hal_gatekeeper_client)
+(expandtypeattribute (hal_gatekeeper_client) true)
+(typeattributeset hal_gatekeeper_client (gatekeeperd ))
+(typeattribute hal_gatekeeper_server)
+(expandtypeattribute (hal_gatekeeper_server) false)
+(typeattribute hal_gnss)
+(expandtypeattribute (hal_gnss) true)
+(typeattribute hal_gnss_client)
+(expandtypeattribute (hal_gnss_client) true)
+(typeattributeset hal_gnss_client (dumpstate system_server ))
+(typeattribute hal_gnss_server)
+(expandtypeattribute (hal_gnss_server) false)
+(typeattribute hal_graphics_allocator)
+(expandtypeattribute (hal_graphics_allocator) true)
+(typeattribute hal_graphics_allocator_client)
+(expandtypeattribute (hal_graphics_allocator_client) true)
+(typeattributeset hal_graphics_allocator_client (adbd bootanim bufferhubd cameraserver crosvm dumpstate mediadrmserver mediaserver mediaswcodec mediatranscoding surfaceflinger system_server virtual_camera automotive_display_service fwk_bufferhub ))
+(typeattribute hal_graphics_allocator_server)
+(expandtypeattribute (hal_graphics_allocator_server) false)
+(typeattribute hal_graphics_composer)
+(expandtypeattribute (hal_graphics_composer) true)
+(typeattribute hal_graphics_composer_client)
+(expandtypeattribute (hal_graphics_composer_client) true)
+(typeattributeset hal_graphics_composer_client (bootanim dumpstate surfaceflinger automotive_display_service ))
+(typeattribute hal_graphics_composer_server)
+(expandtypeattribute (hal_graphics_composer_server) false)
+(typeattribute hal_health)
+(expandtypeattribute (hal_health) true)
+(typeattributeset hal_health (charger_vendor ))
+(typeattribute hal_health_client)
+(expandtypeattribute (hal_health_client) true)
+(typeattributeset hal_health_client (charger dumpstate statsd system_server traced_probes storaged ))
+(typeattribute hal_health_server)
+(expandtypeattribute (hal_health_server) false)
+(typeattributeset hal_health_server (charger_vendor ))
+(typeattribute hal_health_storage)
+(expandtypeattribute (hal_health_storage) true)
+(typeattribute hal_health_storage_client)
+(expandtypeattribute (hal_health_storage_client) true)
+(typeattributeset hal_health_storage_client (vold ))
+(typeattribute hal_health_storage_server)
+(expandtypeattribute (hal_health_storage_server) false)
+(typeattribute hal_identity)
+(expandtypeattribute (hal_identity) true)
+(typeattribute hal_identity_client)
+(expandtypeattribute (hal_identity_client) true)
+(typeattributeset hal_identity_client (credstore dumpstate ))
+(typeattribute hal_identity_server)
+(expandtypeattribute (hal_identity_server) false)
+(typeattribute hal_input_classifier)
+(expandtypeattribute (hal_input_classifier) true)
+(typeattribute hal_input_classifier_client)
+(expandtypeattribute (hal_input_classifier_client) true)
+(typeattributeset hal_input_classifier_client (system_server ))
+(typeattribute hal_input_classifier_server)
+(expandtypeattribute (hal_input_classifier_server) false)
+(typeattribute hal_input_processor)
+(expandtypeattribute (hal_input_processor) true)
+(typeattribute hal_input_processor_client)
+(expandtypeattribute (hal_input_processor_client) true)
+(typeattributeset hal_input_processor_client (dumpstate system_server ))
+(typeattribute hal_input_processor_server)
+(expandtypeattribute (hal_input_processor_server) false)
+(typeattribute hal_ir)
+(expandtypeattribute (hal_ir) true)
+(typeattribute hal_ir_client)
+(expandtypeattribute (hal_ir_client) true)
+(typeattributeset hal_ir_client (system_server ))
+(typeattribute hal_ir_server)
+(expandtypeattribute (hal_ir_server) false)
+(typeattribute hal_ivn)
+(expandtypeattribute (hal_ivn) true)
+(typeattribute hal_ivn_client)
+(expandtypeattribute (hal_ivn_client) true)
+(typeattribute hal_ivn_server)
+(expandtypeattribute (hal_ivn_server) false)
+(typeattribute hal_keymaster)
+(expandtypeattribute (hal_keymaster) true)
+(typeattribute hal_keymaster_client)
+(expandtypeattribute (hal_keymaster_client) true)
+(typeattributeset hal_keymaster_client (keystore odsign ))
+(typeattribute hal_keymaster_server)
+(expandtypeattribute (hal_keymaster_server) false)
+(typeattribute hal_keymint)
+(expandtypeattribute (hal_keymint) true)
+(typeattributeset hal_keymint (hal_keymint_system ))
+(typeattribute hal_keymint_client)
+(expandtypeattribute (hal_keymint_client) true)
+(typeattributeset hal_keymint_client (credstore dumpstate keystore rkpdapp system_server ))
+(typeattribute hal_keymint_server)
+(expandtypeattribute (hal_keymint_server) false)
+(typeattributeset hal_keymint_server (hal_keymint_system ))
+(typeattribute hal_light)
+(expandtypeattribute (hal_light) true)
+(typeattribute hal_light_client)
+(expandtypeattribute (hal_light_client) true)
+(typeattributeset hal_light_client (dumpstate system_server blank_screen ))
+(typeattribute hal_light_server)
+(expandtypeattribute (hal_light_server) false)
+(typeattribute hal_lowpan)
+(expandtypeattribute (hal_lowpan) true)
+(typeattribute hal_lowpan_client)
+(expandtypeattribute (hal_lowpan_client) true)
+(typeattribute hal_lowpan_server)
+(expandtypeattribute (hal_lowpan_server) false)
+(typeattribute hal_macsec)
+(expandtypeattribute (hal_macsec) true)
+(typeattribute hal_macsec_client)
+(expandtypeattribute (hal_macsec_client) true)
+(typeattribute hal_macsec_server)
+(expandtypeattribute (hal_macsec_server) false)
+(typeattribute hal_mediaquality)
+(expandtypeattribute (hal_mediaquality) true)
+(typeattribute hal_mediaquality_client)
+(expandtypeattribute (hal_mediaquality_client) true)
+(typeattributeset hal_mediaquality_client (system_server ))
+(typeattribute hal_mediaquality_server)
+(expandtypeattribute (hal_mediaquality_server) false)
+(typeattribute hal_memtrack)
+(expandtypeattribute (hal_memtrack) true)
+(typeattribute hal_memtrack_client)
+(expandtypeattribute (hal_memtrack_client) true)
+(typeattributeset hal_memtrack_client (dumpstate system_server ))
+(typeattribute hal_memtrack_server)
+(expandtypeattribute (hal_memtrack_server) false)
+(typeattribute hal_neuralnetworks)
+(expandtypeattribute (hal_neuralnetworks) true)
+(typeattribute hal_neuralnetworks_client)
+(expandtypeattribute (hal_neuralnetworks_client) true)
+(typeattributeset hal_neuralnetworks_client (dumpstate system_server ))
+(typeattribute hal_neuralnetworks_server)
+(expandtypeattribute (hal_neuralnetworks_server) false)
+(typeattribute hal_nfc)
+(expandtypeattribute (hal_nfc) true)
+(typeattribute hal_nfc_client)
+(expandtypeattribute (hal_nfc_client) true)
+(typeattributeset hal_nfc_client (dumpstate nfc ))
+(typeattribute hal_nfc_server)
+(expandtypeattribute (hal_nfc_server) false)
+(typeattribute hal_nlinterceptor)
+(expandtypeattribute (hal_nlinterceptor) true)
+(typeattribute hal_nlinterceptor_client)
+(expandtypeattribute (hal_nlinterceptor_client) true)
+(typeattributeset hal_nlinterceptor_client (wificond ))
+(typeattribute hal_nlinterceptor_server)
+(expandtypeattribute (hal_nlinterceptor_server) false)
+(typeattribute hal_oemlock)
+(expandtypeattribute (hal_oemlock) true)
+(typeattribute hal_oemlock_client)
+(expandtypeattribute (hal_oemlock_client) true)
+(typeattributeset hal_oemlock_client (dumpstate system_server ))
+(typeattribute hal_oemlock_server)
+(expandtypeattribute (hal_oemlock_server) false)
+(typeattribute hal_omx)
+(expandtypeattribute (hal_omx) true)
+(typeattribute hal_omx_client)
+(expandtypeattribute (hal_omx_client) true)
+(typeattributeset hal_omx_client (cameraserver mediaserver mediaswcodec mediatranscoding surfaceflinger system_server virtual_camera ))
+(typeattribute hal_omx_server)
+(expandtypeattribute (hal_omx_server) false)
+(typeattribute hal_power)
+(expandtypeattribute (hal_power) true)
+(typeattribute hal_power_client)
+(expandtypeattribute (hal_power_client) true)
+(typeattributeset hal_power_client (dumpstate statsd surfaceflinger system_server ))
+(typeattribute hal_power_server)
+(expandtypeattribute (hal_power_server) false)
+(typeattribute hal_power_stats)
+(expandtypeattribute (hal_power_stats) true)
+(typeattribute hal_power_stats_client)
+(expandtypeattribute (hal_power_stats_client) true)
+(typeattributeset hal_power_stats_client (dumpstate statsd system_server traced_probes ))
+(typeattribute hal_power_stats_server)
+(expandtypeattribute (hal_power_stats_server) false)
+(typeattribute hal_rebootescrow)
+(expandtypeattribute (hal_rebootescrow) true)
+(typeattribute hal_rebootescrow_client)
+(expandtypeattribute (hal_rebootescrow_client) true)
+(typeattributeset hal_rebootescrow_client (dumpstate system_server ))
+(typeattribute hal_rebootescrow_server)
+(expandtypeattribute (hal_rebootescrow_server) false)
+(typeattribute hal_remoteaccess)
+(expandtypeattribute (hal_remoteaccess) true)
+(typeattribute hal_remoteaccess_client)
+(expandtypeattribute (hal_remoteaccess_client) true)
+(typeattribute hal_remoteaccess_server)
+(expandtypeattribute (hal_remoteaccess_server) false)
+(typeattribute hal_secretkeeper)
+(expandtypeattribute (hal_secretkeeper) true)
+(typeattribute hal_secretkeeper_client)
+(expandtypeattribute (hal_secretkeeper_client) true)
+(typeattributeset hal_secretkeeper_client (dumpstate early_virtmgr system_server virtualizationmanager virtualizationservice ))
+(typeattribute hal_secretkeeper_server)
+(expandtypeattribute (hal_secretkeeper_server) false)
+(typeattribute hal_remotelyprovisionedcomponent_avf)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf) true)
+(typeattributeset hal_remotelyprovisionedcomponent_avf (virtualizationservice ))
+(typeattribute hal_remotelyprovisionedcomponent_avf_client)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf_client) true)
+(typeattributeset hal_remotelyprovisionedcomponent_avf_client (rkpdapp system_server ))
+(typeattribute hal_remotelyprovisionedcomponent_avf_server)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf_server) false)
+(typeattributeset hal_remotelyprovisionedcomponent_avf_server (virtualizationservice ))
+(typeattribute hal_secure_element)
+(expandtypeattribute (hal_secure_element) true)
+(typeattribute hal_secure_element_client)
+(expandtypeattribute (hal_secure_element_client) true)
+(typeattributeset hal_secure_element_client (secure_element ))
+(typeattribute hal_secure_element_server)
+(expandtypeattribute (hal_secure_element_server) false)
+(typeattribute hal_sensors)
+(expandtypeattribute (hal_sensors) true)
+(typeattribute hal_sensors_client)
+(expandtypeattribute (hal_sensors_client) true)
+(typeattributeset hal_sensors_client (dumpstate system_server ))
+(typeattribute hal_sensors_server)
+(expandtypeattribute (hal_sensors_server) false)
+(typeattribute hal_telephony)
+(expandtypeattribute (hal_telephony) true)
+(typeattribute hal_telephony_client)
+(expandtypeattribute (hal_telephony_client) true)
+(typeattributeset hal_telephony_client (bluetooth radio ))
+(typeattribute hal_telephony_server)
+(expandtypeattribute (hal_telephony_server) false)
+(typeattribute hal_tetheroffload)
+(expandtypeattribute (hal_tetheroffload) true)
+(typeattribute hal_tetheroffload_client)
+(expandtypeattribute (hal_tetheroffload_client) true)
+(typeattributeset hal_tetheroffload_client (network_stack system_server ))
+(typeattribute hal_tetheroffload_server)
+(expandtypeattribute (hal_tetheroffload_server) false)
+(typeattribute hal_thermal)
+(expandtypeattribute (hal_thermal) true)
+(typeattribute hal_thermal_client)
+(expandtypeattribute (hal_thermal_client) true)
+(typeattributeset hal_thermal_client (dumpstate statsd system_server ))
+(typeattribute hal_thermal_server)
+(expandtypeattribute (hal_thermal_server) false)
+(typeattribute hal_threadnetwork)
+(expandtypeattribute (hal_threadnetwork) true)
+(typeattribute hal_threadnetwork_client)
+(expandtypeattribute (hal_threadnetwork_client) true)
+(typeattributeset hal_threadnetwork_client (system_server ot_daemon ))
+(typeattribute hal_threadnetwork_server)
+(expandtypeattribute (hal_threadnetwork_server) false)
+(typeattribute hal_tv_cec)
+(expandtypeattribute (hal_tv_cec) true)
+(typeattribute hal_tv_cec_client)
+(expandtypeattribute (hal_tv_cec_client) true)
+(typeattributeset hal_tv_cec_client (system_server ))
+(typeattribute hal_tv_cec_server)
+(expandtypeattribute (hal_tv_cec_server) false)
+(typeattribute hal_tv_hdmi_cec)
+(expandtypeattribute (hal_tv_hdmi_cec) true)
+(typeattribute hal_tv_hdmi_cec_client)
+(expandtypeattribute (hal_tv_hdmi_cec_client) true)
+(typeattributeset hal_tv_hdmi_cec_client (system_server ))
+(typeattribute hal_tv_hdmi_cec_server)
+(expandtypeattribute (hal_tv_hdmi_cec_server) false)
+(typeattribute hal_tv_hdmi_connection)
+(expandtypeattribute (hal_tv_hdmi_connection) true)
+(typeattribute hal_tv_hdmi_connection_client)
+(expandtypeattribute (hal_tv_hdmi_connection_client) true)
+(typeattributeset hal_tv_hdmi_connection_client (system_server ))
+(typeattribute hal_tv_hdmi_connection_server)
+(expandtypeattribute (hal_tv_hdmi_connection_server) false)
+(typeattribute hal_tv_hdmi_earc)
+(expandtypeattribute (hal_tv_hdmi_earc) true)
+(typeattribute hal_tv_hdmi_earc_client)
+(expandtypeattribute (hal_tv_hdmi_earc_client) true)
+(typeattributeset hal_tv_hdmi_earc_client (system_server ))
+(typeattribute hal_tv_hdmi_earc_server)
+(expandtypeattribute (hal_tv_hdmi_earc_server) false)
+(typeattribute hal_tv_input)
+(expandtypeattribute (hal_tv_input) true)
+(typeattribute hal_tv_input_client)
+(expandtypeattribute (hal_tv_input_client) true)
+(typeattributeset hal_tv_input_client (system_server ))
+(typeattribute hal_tv_input_server)
+(expandtypeattribute (hal_tv_input_server) false)
+(typeattribute hal_tv_tuner)
+(expandtypeattribute (hal_tv_tuner) true)
+(typeattribute hal_tv_tuner_client)
+(expandtypeattribute (hal_tv_tuner_client) true)
+(typeattributeset hal_tv_tuner_client (mediatuner ))
+(typeattribute hal_tv_tuner_server)
+(expandtypeattribute (hal_tv_tuner_server) false)
+(typeattribute hal_usb)
+(expandtypeattribute (hal_usb) true)
+(typeattribute hal_usb_client)
+(expandtypeattribute (hal_usb_client) true)
+(typeattributeset hal_usb_client (system_server ))
+(typeattribute hal_usb_server)
+(expandtypeattribute (hal_usb_server) false)
+(typeattribute hal_usb_gadget)
+(expandtypeattribute (hal_usb_gadget) true)
+(typeattribute hal_usb_gadget_client)
+(expandtypeattribute (hal_usb_gadget_client) true)
+(typeattributeset hal_usb_gadget_client (system_server usbd ))
+(typeattribute hal_usb_gadget_server)
+(expandtypeattribute (hal_usb_gadget_server) false)
+(typeattribute hal_uwb)
+(expandtypeattribute (hal_uwb) true)
+(typeattribute hal_uwb_client)
+(expandtypeattribute (hal_uwb_client) true)
+(typeattributeset hal_uwb_client (system_server ))
+(typeattribute hal_uwb_server)
+(expandtypeattribute (hal_uwb_server) false)
+(typeattribute hal_uwb_vendor)
+(expandtypeattribute (hal_uwb_vendor) true)
+(typeattribute hal_uwb_vendor_client)
+(expandtypeattribute (hal_uwb_vendor_client) true)
+(typeattribute hal_uwb_vendor_server)
+(expandtypeattribute (hal_uwb_vendor_server) false)
+(typeattribute hal_vehicle)
+(expandtypeattribute (hal_vehicle) true)
+(typeattribute hal_vehicle_client)
+(expandtypeattribute (hal_vehicle_client) true)
+(typeattributeset hal_vehicle_client (dumpstate vehicle_binding_util ))
+(typeattribute hal_vehicle_server)
+(expandtypeattribute (hal_vehicle_server) false)
+(typeattribute hal_vibrator)
+(expandtypeattribute (hal_vibrator) true)
+(typeattribute hal_vibrator_client)
+(expandtypeattribute (hal_vibrator_client) true)
+(typeattributeset hal_vibrator_client (dumpstate system_server ))
+(typeattribute hal_vibrator_server)
+(expandtypeattribute (hal_vibrator_server) false)
+(typeattribute hal_vr)
+(expandtypeattribute (hal_vr) true)
+(typeattribute hal_vr_client)
+(expandtypeattribute (hal_vr_client) true)
+(typeattributeset hal_vr_client (system_server ))
+(typeattribute hal_vr_server)
+(expandtypeattribute (hal_vr_server) false)
+(typeattribute hal_weaver)
+(expandtypeattribute (hal_weaver) true)
+(typeattribute hal_weaver_client)
+(expandtypeattribute (hal_weaver_client) true)
+(typeattributeset hal_weaver_client (dumpstate system_server ))
+(typeattribute hal_weaver_server)
+(expandtypeattribute (hal_weaver_server) false)
+(typeattribute hal_wifi)
+(expandtypeattribute (hal_wifi) true)
+(typeattribute hal_wifi_client)
+(expandtypeattribute (hal_wifi_client) true)
+(typeattributeset hal_wifi_client (dumpstate system_server ))
+(typeattribute hal_wifi_server)
+(expandtypeattribute (hal_wifi_server) false)
+(typeattribute hal_wifi_hostapd)
+(expandtypeattribute (hal_wifi_hostapd) true)
+(typeattribute hal_wifi_hostapd_client)
+(expandtypeattribute (hal_wifi_hostapd_client) true)
+(typeattributeset hal_wifi_hostapd_client (system_server ))
+(typeattribute hal_wifi_hostapd_server)
+(expandtypeattribute (hal_wifi_hostapd_server) false)
+(typeattribute hal_wifi_supplicant)
+(expandtypeattribute (hal_wifi_supplicant) true)
+(typeattribute hal_wifi_supplicant_client)
+(expandtypeattribute (hal_wifi_supplicant_client) true)
+(typeattributeset hal_wifi_supplicant_client (system_server ))
+(typeattribute hal_wifi_supplicant_server)
+(expandtypeattribute (hal_wifi_supplicant_server) false)
+(typeattribute automotive_display_service_server)
+(typeattributeset automotive_display_service_server (automotive_display_service ))
+(typeattribute camera_service_server)
+(typeattributeset camera_service_server (cameraserver ))
+(typeattribute display_service_server)
+(typeattributeset display_service_server (surfaceflinger ))
+(typeattribute evsmanager_service_server)
+(typeattributeset evsmanager_service_server (evsmanagerd ))
+(typeattribute remote_provisioning_service_server)
+(typeattributeset remote_provisioning_service_server (system_server ))
+(typeattribute scheduler_service_server)
+(typeattributeset scheduler_service_server (system_server ))
+(typeattribute sensor_service_server)
+(typeattributeset sensor_service_server (system_server ))
+(typeattribute stats_service_server)
+(typeattributeset stats_service_server (system_server ))
+(typeattribute system_suspend_internal_server)
+(typeattributeset system_suspend_internal_server (system_suspend ))
+(typeattribute system_suspend_server)
+(typeattributeset system_suspend_server (system_suspend ))
+(typeattribute wifi_keystore_service_server)
+(typeattributeset wifi_keystore_service_server (wificond ))
+(typeattribute super_block_device_type)
+(typeattributeset super_block_device_type (super_block_device ))
+(typeattribute dmabuf_heap_device_type)
+(expandtypeattribute (dmabuf_heap_device_type) false)
+(typeattributeset dmabuf_heap_device_type (dmabuf_heap_device dmabuf_system_heap_device dmabuf_system_secure_heap_device ))
+(typeattribute vm_manager_device_type)
+(typeattributeset vm_manager_device_type (kvm_device ))
+(typeattribute gsi_metadata_file_type)
+(typeattributeset gsi_metadata_file_type (gsi_metadata_file gsi_public_metadata_file ))
+(typeattribute apex_data_file_type)
+(typeattributeset apex_data_file_type (apex_system_server_data_file apex_art_data_file apex_compos_data_file apex_virt_data_file apex_tethering_data_file apex_uwb_data_file apex_appsearch_data_file apex_permission_data_file apex_scheduling_data_file apex_wifi_data_file ))
+(typeattribute charger_type)
+(typeattributeset charger_type (charger charger_vendor ))
+(typeattribute dalvik_config_prop_type)
+(typeattributeset dalvik_config_prop_type (dalvik_config_prop dalvik_dynamic_config_prop ))
+(typeattribute tee_service_type)
+(typeattributeset tee_service_type (test_pkvm_tee_service ))
+(typeattribute hal_vm_capabilities)
+(expandtypeattribute (hal_vm_capabilities) true)
+(typeattribute hal_vm_capabilities_client)
+(expandtypeattribute (hal_vm_capabilities_client) true)
+(typeattributeset hal_vm_capabilities_client (dumpstate ))
+(typeattribute hal_vm_capabilities_server)
+(expandtypeattribute (hal_vm_capabilities_server) false)
+(type adbd)
+(roletype object_r adbd)
+(type adbd_exec)
+(roletype object_r adbd_exec)
+(type aidl_lazy_test_server)
+(roletype object_r aidl_lazy_test_server)
+(type aidl_lazy_test_server_exec)
+(roletype object_r aidl_lazy_test_server_exec)
+(type apexd)
+(roletype object_r apexd)
+(type apexd_exec)
+(roletype object_r apexd_exec)
+(type appdomain_tmpfs)
+(roletype object_r appdomain_tmpfs)
+(type app_zygote)
+(roletype object_r app_zygote)
+(type app_zygote_tmpfs)
+(roletype object_r app_zygote_tmpfs)
+(type artd)
+(roletype object_r artd)
+(type atrace)
+(roletype object_r atrace)
+(type audioserver)
+(roletype object_r audioserver)
+(type audioserver_tmpfs)
+(roletype object_r audioserver_tmpfs)
+(type blkid)
+(roletype object_r blkid)
+(type blkid_untrusted)
+(roletype object_r blkid_untrusted)
+(type bluetooth)
+(roletype object_r bluetooth)
+(type bootanim)
+(roletype object_r bootanim)
+(type bootanim_exec)
+(roletype object_r bootanim_exec)
+(type bootstat)
+(roletype object_r bootstat)
+(type bootstat_exec)
+(roletype object_r bootstat_exec)
+(type bpfloader)
+(roletype object_r bpfloader)
+(type bufferhubd)
+(roletype object_r bufferhubd)
+(type bufferhubd_exec)
+(roletype object_r bufferhubd_exec)
+(type cameraserver)
+(roletype object_r cameraserver)
+(type cameraserver_exec)
+(roletype object_r cameraserver_exec)
+(type cameraserver_tmpfs)
+(roletype object_r cameraserver_tmpfs)
+(type charger)
+(roletype object_r charger)
+(type charger_exec)
+(roletype object_r charger_exec)
+(type charger_vendor)
+(roletype object_r charger_vendor)
+(type crash_dump)
+(roletype object_r crash_dump)
+(type crash_dump_exec)
+(roletype object_r crash_dump_exec)
+(type credstore)
+(roletype object_r credstore)
+(type credstore_exec)
+(roletype object_r credstore_exec)
+(type crosvm)
+(roletype object_r crosvm)
+(type device)
+(roletype object_r device)
+(type ashmem_device)
+(roletype object_r ashmem_device)
+(type ashmem_libcutils_device)
+(roletype object_r ashmem_libcutils_device)
+(type audio_device)
+(roletype object_r audio_device)
+(type binder_device)
+(roletype object_r binder_device)
+(type hwbinder_device)
+(roletype object_r hwbinder_device)
+(type vndbinder_device)
+(roletype object_r vndbinder_device)
+(type block_device)
+(roletype object_r block_device)
+(type bt_device)
+(roletype object_r bt_device)
+(type camera_device)
+(roletype object_r camera_device)
+(type dm_device)
+(roletype object_r dm_device)
+(type ublk_block_device)
+(roletype object_r ublk_block_device)
+(type dm_user_device)
+(roletype object_r dm_user_device)
+(type ublk_control_device)
+(roletype object_r ublk_control_device)
+(type keychord_device)
+(roletype object_r keychord_device)
+(type loop_control_device)
+(roletype object_r loop_control_device)
+(type loop_device)
+(roletype object_r loop_device)
+(type pmsg_device)
+(roletype object_r pmsg_device)
+(type radio_device)
+(roletype object_r radio_device)
+(type ram_device)
+(roletype object_r ram_device)
+(type rtc_device)
+(roletype object_r rtc_device)
+(type vd_device)
+(roletype object_r vd_device)
+(type vold_device)
+(roletype object_r vold_device)
+(type console_device)
+(roletype object_r console_device)
+(type fscklogs)
+(roletype object_r fscklogs)
+(type gpu_device)
+(roletype object_r gpu_device)
+(type graphics_device)
+(roletype object_r graphics_device)
+(type hw_random_device)
+(roletype object_r hw_random_device)
+(type input_device)
+(roletype object_r input_device)
+(type port_device)
+(roletype object_r port_device)
+(type lowpan_device)
+(roletype object_r lowpan_device)
+(type mtp_device)
+(roletype object_r mtp_device)
+(type nfc_device)
+(roletype object_r nfc_device)
+(type ptmx_device)
+(roletype object_r ptmx_device)
+(type kmsg_device)
+(roletype object_r kmsg_device)
+(type kmsg_debug_device)
+(roletype object_r kmsg_debug_device)
+(type null_device)
+(roletype object_r null_device)
+(type random_device)
+(roletype object_r random_device)
+(type secure_element_device)
+(roletype object_r secure_element_device)
+(type sensors_device)
+(roletype object_r sensors_device)
+(type serial_device)
+(roletype object_r serial_device)
+(type socket_device)
+(roletype object_r socket_device)
+(type owntty_device)
+(roletype object_r owntty_device)
+(type tty_device)
+(roletype object_r tty_device)
+(type video_device)
+(roletype object_r video_device)
+(type zero_device)
+(roletype object_r zero_device)
+(type fuse_device)
+(roletype object_r fuse_device)
+(type iio_device)
+(roletype object_r iio_device)
+(type ion_device)
+(roletype object_r ion_device)
+(type dmabuf_heap_device)
+(roletype object_r dmabuf_heap_device)
+(type dmabuf_system_heap_device)
+(roletype object_r dmabuf_system_heap_device)
+(type dmabuf_system_secure_heap_device)
+(roletype object_r dmabuf_system_secure_heap_device)
+(type qtaguid_device)
+(roletype object_r qtaguid_device)
+(type watchdog_device)
+(roletype object_r watchdog_device)
+(type uhid_device)
+(roletype object_r uhid_device)
+(type uio_device)
+(roletype object_r uio_device)
+(type tun_device)
+(roletype object_r tun_device)
+(type usbaccessory_device)
+(roletype object_r usbaccessory_device)
+(type usb_device)
+(roletype object_r usb_device)
+(type usb_serial_device)
+(roletype object_r usb_serial_device)
+(type gnss_device)
+(roletype object_r gnss_device)
+(type properties_device)
+(roletype object_r properties_device)
+(type properties_serial)
+(roletype object_r properties_serial)
+(type property_info)
+(roletype object_r property_info)
+(type hidraw_device)
+(roletype object_r hidraw_device)
+(type hci_attach_dev)
+(roletype object_r hci_attach_dev)
+(type rpmsg_device)
+(roletype object_r rpmsg_device)
+(type root_block_device)
+(roletype object_r root_block_device)
+(type frp_block_device)
+(roletype object_r frp_block_device)
+(type system_block_device)
+(roletype object_r system_block_device)
+(type recovery_block_device)
+(roletype object_r recovery_block_device)
+(type boot_block_device)
+(roletype object_r boot_block_device)
+(type dtbo_block_device)
+(roletype object_r dtbo_block_device)
+(type userdata_block_device)
+(roletype object_r userdata_block_device)
+(type zoned_block_device)
+(roletype object_r zoned_block_device)
+(type cache_block_device)
+(roletype object_r cache_block_device)
+(type swap_block_device)
+(roletype object_r swap_block_device)
+(type metadata_block_device)
+(roletype object_r metadata_block_device)
+(type misc_block_device)
+(roletype object_r misc_block_device)
+(type super_block_device)
+(roletype object_r super_block_device)
+(type sdcard_block_device)
+(roletype object_r sdcard_block_device)
+(type userdata_sysdev)
+(roletype object_r userdata_sysdev)
+(type rootdisk_sysdev)
+(roletype object_r rootdisk_sysdev)
+(type vfio_device)
+(roletype object_r vfio_device)
+(type dhcp)
+(roletype object_r dhcp)
+(type dhcp_exec)
+(roletype object_r dhcp_exec)
+(type dnsmasq)
+(roletype object_r dnsmasq)
+(type dnsmasq_exec)
+(roletype object_r dnsmasq_exec)
+(type drmserver)
+(roletype object_r drmserver)
+(type drmserver_exec)
+(roletype object_r drmserver_exec)
+(type drmserver_socket)
+(roletype object_r drmserver_socket)
+(type dumpstate)
+(roletype object_r dumpstate)
+(type dumpstate_exec)
+(roletype object_r dumpstate_exec)
+(type e2fs)
+(roletype object_r e2fs)
+(type e2fs_exec)
+(roletype object_r e2fs_exec)
+(type early_virtmgr)
+(roletype object_r early_virtmgr)
+(type early_virtmgr_exec)
+(roletype object_r early_virtmgr_exec)
+(type ephemeral_app)
+(roletype object_r ephemeral_app)
+(type evsmanagerd)
+(roletype object_r evsmanagerd)
+(type extra_free_kbytes)
+(roletype object_r extra_free_kbytes)
+(type extra_free_kbytes_exec)
+(roletype object_r extra_free_kbytes_exec)
+(type fastbootd)
+(roletype object_r fastbootd)
+(type labeledfs)
+(roletype object_r labeledfs)
+(type pipefs)
+(roletype object_r pipefs)
+(type sockfs)
+(roletype object_r sockfs)
+(type rootfs)
+(roletype object_r rootfs)
+(type proc)
+(roletype object_r proc)
+(type binderfs)
+(roletype object_r binderfs)
+(type binderfs_logs)
+(roletype object_r binderfs_logs)
+(type binderfs_logs_proc)
+(roletype object_r binderfs_logs_proc)
+(type binderfs_logs_stats)
+(roletype object_r binderfs_logs_stats)
+(type binderfs_logs_transactions)
+(roletype object_r binderfs_logs_transactions)
+(type binderfs_logs_transaction_history)
+(roletype object_r binderfs_logs_transaction_history)
+(type binderfs_features)
+(roletype object_r binderfs_features)
+(type proc_security)
+(roletype object_r proc_security)
+(type proc_drop_caches)
+(roletype object_r proc_drop_caches)
+(type proc_overcommit_memory)
+(roletype object_r proc_overcommit_memory)
+(type proc_min_free_order_shift)
+(roletype object_r proc_min_free_order_shift)
+(type proc_kpageflags)
+(roletype object_r proc_kpageflags)
+(type proc_watermark_boost_factor)
+(roletype object_r proc_watermark_boost_factor)
+(type proc_percpu_pagelist_high_fraction)
+(roletype object_r proc_percpu_pagelist_high_fraction)
+(type usermodehelper)
+(roletype object_r usermodehelper)
+(type sysfs_usermodehelper)
+(roletype object_r sysfs_usermodehelper)
+(type proc_qtaguid_ctrl)
+(roletype object_r proc_qtaguid_ctrl)
+(type proc_qtaguid_stat)
+(roletype object_r proc_qtaguid_stat)
+(type proc_bluetooth_writable)
+(roletype object_r proc_bluetooth_writable)
+(type proc_abi)
+(roletype object_r proc_abi)
+(type proc_asound)
+(roletype object_r proc_asound)
+(type proc_bootconfig)
+(roletype object_r proc_bootconfig)
+(type proc_bpf)
+(roletype object_r proc_bpf)
+(type proc_buddyinfo)
+(roletype object_r proc_buddyinfo)
+(type proc_cgroups)
+(roletype object_r proc_cgroups)
+(type proc_cmdline)
+(roletype object_r proc_cmdline)
+(type proc_cpu_alignment)
+(roletype object_r proc_cpu_alignment)
+(type proc_cpuinfo)
+(roletype object_r proc_cpuinfo)
+(type proc_dirty)
+(roletype object_r proc_dirty)
+(type proc_diskstats)
+(roletype object_r proc_diskstats)
+(type proc_extra_free_kbytes)
+(roletype object_r proc_extra_free_kbytes)
+(type proc_filesystems)
+(roletype object_r proc_filesystems)
+(type proc_fs_verity)
+(roletype object_r proc_fs_verity)
+(type proc_hostname)
+(roletype object_r proc_hostname)
+(type proc_hung_task)
+(roletype object_r proc_hung_task)
+(type proc_interrupts)
+(roletype object_r proc_interrupts)
+(type proc_iomem)
+(roletype object_r proc_iomem)
+(type proc_kallsyms)
+(roletype object_r proc_kallsyms)
+(type proc_keys)
+(roletype object_r proc_keys)
+(type proc_kmsg)
+(roletype object_r proc_kmsg)
+(type proc_loadavg)
+(roletype object_r proc_loadavg)
+(type proc_locks)
+(roletype object_r proc_locks)
+(type proc_lowmemorykiller)
+(roletype object_r proc_lowmemorykiller)
+(type proc_max_map_count)
+(roletype object_r proc_max_map_count)
+(type proc_meminfo)
+(roletype object_r proc_meminfo)
+(type proc_misc)
+(roletype object_r proc_misc)
+(type proc_modules)
+(roletype object_r proc_modules)
+(type proc_mounts)
+(roletype object_r proc_mounts)
+(type proc_net)
+(roletype object_r proc_net)
+(type proc_net_tcp_udp)
+(roletype object_r proc_net_tcp_udp)
+(type proc_page_cluster)
+(roletype object_r proc_page_cluster)
+(type proc_pagetypeinfo)
+(roletype object_r proc_pagetypeinfo)
+(type proc_panic)
+(roletype object_r proc_panic)
+(type proc_perf)
+(roletype object_r proc_perf)
+(type proc_pid_max)
+(roletype object_r proc_pid_max)
+(type proc_pipe_conf)
+(roletype object_r proc_pipe_conf)
+(type proc_pressure_cpu)
+(roletype object_r proc_pressure_cpu)
+(type proc_pressure_io)
+(roletype object_r proc_pressure_io)
+(type proc_pressure_mem)
+(roletype object_r proc_pressure_mem)
+(type proc_random)
+(roletype object_r proc_random)
+(type proc_sched)
+(roletype object_r proc_sched)
+(type proc_slabinfo)
+(roletype object_r proc_slabinfo)
+(type proc_stat)
+(roletype object_r proc_stat)
+(type proc_swaps)
+(roletype object_r proc_swaps)
+(type proc_sysrq)
+(roletype object_r proc_sysrq)
+(type proc_timer)
+(roletype object_r proc_timer)
+(type proc_tty_drivers)
+(roletype object_r proc_tty_drivers)
+(type proc_uid_cputime_showstat)
+(roletype object_r proc_uid_cputime_showstat)
+(type proc_uid_cputime_removeuid)
+(roletype object_r proc_uid_cputime_removeuid)
+(type proc_uid_io_stats)
+(roletype object_r proc_uid_io_stats)
+(type proc_uid_procstat_set)
+(roletype object_r proc_uid_procstat_set)
+(type proc_uid_time_in_state)
+(roletype object_r proc_uid_time_in_state)
+(type proc_uid_concurrent_active_time)
+(roletype object_r proc_uid_concurrent_active_time)
+(type proc_uid_concurrent_policy_time)
+(roletype object_r proc_uid_concurrent_policy_time)
+(type proc_uid_cpupower)
+(roletype object_r proc_uid_cpupower)
+(type proc_uptime)
+(roletype object_r proc_uptime)
+(type proc_version)
+(roletype object_r proc_version)
+(type proc_vmallocinfo)
+(roletype object_r proc_vmallocinfo)
+(type proc_vmstat)
+(roletype object_r proc_vmstat)
+(type proc_watermark_scale_factor)
+(roletype object_r proc_watermark_scale_factor)
+(type proc_zoneinfo)
+(roletype object_r proc_zoneinfo)
+(type proc_vendor_sched)
+(roletype object_r proc_vendor_sched)
+(type selinuxfs)
+(roletype object_r selinuxfs)
+(type fusectlfs)
+(roletype object_r fusectlfs)
+(type cgroup)
+(roletype object_r cgroup)
+(type cgroup_v2)
+(roletype object_r cgroup_v2)
+(type sysfs)
+(roletype object_r sysfs)
+(type sysfs_android_usb)
+(roletype object_r sysfs_android_usb)
+(type sysfs_uio)
+(roletype object_r sysfs_uio)
+(type sysfs_batteryinfo)
+(roletype object_r sysfs_batteryinfo)
+(type sysfs_bluetooth_writable)
+(roletype object_r sysfs_bluetooth_writable)
+(type sysfs_cma)
+(roletype object_r sysfs_cma)
+(type sysfs_devfreq_cur)
+(roletype object_r sysfs_devfreq_cur)
+(type sysfs_devfreq_dir)
+(roletype object_r sysfs_devfreq_dir)
+(type sysfs_devices_block)
+(roletype object_r sysfs_devices_block)
+(type sysfs_dm)
+(roletype object_r sysfs_dm)
+(type sysfs_dm_verity)
+(roletype object_r sysfs_dm_verity)
+(type sysfs_dma_heap)
+(roletype object_r sysfs_dma_heap)
+(type sysfs_dmabuf_stats)
+(roletype object_r sysfs_dmabuf_stats)
+(type sysfs_dt_firmware_android)
+(roletype object_r sysfs_dt_firmware_android)
+(type sysfs_extcon)
+(roletype object_r sysfs_extcon)
+(type sysfs_ion)
+(roletype object_r sysfs_ion)
+(type sysfs_ipv4)
+(roletype object_r sysfs_ipv4)
+(type sysfs_kernel_notes)
+(roletype object_r sysfs_kernel_notes)
+(type sysfs_leds)
+(roletype object_r sysfs_leds)
+(type sysfs_loop)
+(roletype object_r sysfs_loop)
+(type sysfs_gpu)
+(roletype object_r sysfs_gpu)
+(type sysfs_hwrandom)
+(roletype object_r sysfs_hwrandom)
+(type sysfs_nfc_power_writable)
+(roletype object_r sysfs_nfc_power_writable)
+(type sysfs_wake_lock)
+(roletype object_r sysfs_wake_lock)
+(type sysfs_net)
+(roletype object_r sysfs_net)
+(type sysfs_power)
+(roletype object_r sysfs_power)
+(type sysfs_rtc)
+(roletype object_r sysfs_rtc)
+(type sysfs_mem_sleep)
+(roletype object_r sysfs_mem_sleep)
+(type sysfs_suspend_stats)
+(roletype object_r sysfs_suspend_stats)
+(type sysfs_switch)
+(roletype object_r sysfs_switch)
+(type sysfs_sync_on_suspend)
+(roletype object_r sysfs_sync_on_suspend)
+(type sysfs_transparent_hugepage)
+(roletype object_r sysfs_transparent_hugepage)
+(type sysfs_lru_gen_enabled)
+(roletype object_r sysfs_lru_gen_enabled)
+(type sysfs_usb)
+(roletype object_r sysfs_usb)
+(type sysfs_wakeup)
+(roletype object_r sysfs_wakeup)
+(type sysfs_wakeup_reasons)
+(roletype object_r sysfs_wakeup_reasons)
+(type sysfs_fs_ext4_features)
+(roletype object_r sysfs_fs_ext4_features)
+(type sysfs_fs_f2fs)
+(roletype object_r sysfs_fs_f2fs)
+(type sysfs_fs_fuse_bpf)
+(roletype object_r sysfs_fs_fuse_bpf)
+(type sysfs_fs_fuse_features)
+(roletype object_r sysfs_fs_fuse_features)
+(type sysfs_fs_incfs_features)
+(roletype object_r sysfs_fs_incfs_features)
+(type sysfs_fs_incfs_metrics)
+(roletype object_r sysfs_fs_incfs_metrics)
+(type sysfs_vendor_sched)
+(roletype object_r sysfs_vendor_sched)
+(type fs_bpf)
+(roletype object_r fs_bpf)
+(type fs_bpf_tethering)
+(roletype object_r fs_bpf_tethering)
+(type fs_bpf_vendor)
+(roletype object_r fs_bpf_vendor)
+(type configfs)
+(roletype object_r configfs)
+(type sysfs_devices_cs_etm)
+(roletype object_r sysfs_devices_cs_etm)
+(type sysfs_devices_system_cpu)
+(roletype object_r sysfs_devices_system_cpu)
+(type sysfs_lowmemorykiller)
+(roletype object_r sysfs_lowmemorykiller)
+(type sysfs_wlan_fwpath)
+(roletype object_r sysfs_wlan_fwpath)
+(type sysfs_vibrator)
+(roletype object_r sysfs_vibrator)
+(type sysfs_uhid)
+(roletype object_r sysfs_uhid)
+(type sysfs_thermal)
+(roletype object_r sysfs_thermal)
+(type sysfs_zram)
+(roletype object_r sysfs_zram)
+(type sysfs_zram_uevent)
+(roletype object_r sysfs_zram_uevent)
+(type inotify)
+(roletype object_r inotify)
+(type devpts)
+(roletype object_r devpts)
+(type tmpfs)
+(roletype object_r tmpfs)
+(type shm)
+(roletype object_r shm)
+(type mqueue)
+(roletype object_r mqueue)
+(type fuse)
+(roletype object_r fuse)
+(type fuseblk)
+(roletype object_r fuseblk)
+(type sdcardfs)
+(roletype object_r sdcardfs)
+(type vfat)
+(roletype object_r vfat)
+(type exfat)
+(roletype object_r exfat)
+(type debugfs)
+(roletype object_r debugfs)
+(type debugfs_kprobes)
+(roletype object_r debugfs_kprobes)
+(type debugfs_mmc)
+(roletype object_r debugfs_mmc)
+(type debugfs_mm_events_tracing)
+(roletype object_r debugfs_mm_events_tracing)
+(type debugfs_trace_marker)
+(roletype object_r debugfs_trace_marker)
+(type debugfs_tracing)
+(roletype object_r debugfs_tracing)
+(type debugfs_tracing_debug)
+(roletype object_r debugfs_tracing_debug)
+(type debugfs_tracing_instances)
+(roletype object_r debugfs_tracing_instances)
+(type debugfs_tracing_printk_formats)
+(roletype object_r debugfs_tracing_printk_formats)
+(type debugfs_wakeup_sources)
+(roletype object_r debugfs_wakeup_sources)
+(type debugfs_wifi_tracing)
+(roletype object_r debugfs_wifi_tracing)
+(type securityfs)
+(roletype object_r securityfs)
+(type pstorefs)
+(roletype object_r pstorefs)
+(type functionfs)
+(roletype object_r functionfs)
+(type oemfs)
+(roletype object_r oemfs)
+(type usbfs)
+(roletype object_r usbfs)
+(type binfmt_miscfs)
+(roletype object_r binfmt_miscfs)
+(type app_fusefs)
+(roletype object_r app_fusefs)
+(type unlabeled)
+(roletype object_r unlabeled)
+(type system_file)
+(roletype object_r system_file)
+(type system_asan_options_file)
+(roletype object_r system_asan_options_file)
+(type system_event_log_tags_file)
+(roletype object_r system_event_log_tags_file)
+(type system_lib_file)
+(roletype object_r system_lib_file)
+(type system_bootstrap_lib_file)
+(roletype object_r system_bootstrap_lib_file)
+(type system_group_file)
+(roletype object_r system_group_file)
+(type system_linker_exec)
+(roletype object_r system_linker_exec)
+(type system_linker_config_file)
+(roletype object_r system_linker_config_file)
+(type system_passwd_file)
+(roletype object_r system_passwd_file)
+(type system_seccomp_policy_file)
+(roletype object_r system_seccomp_policy_file)
+(type system_security_cacerts_file)
+(roletype object_r system_security_cacerts_file)
+(type tcpdump_exec)
+(roletype object_r tcpdump_exec)
+(type system_zoneinfo_file)
+(roletype object_r system_zoneinfo_file)
+(type cgroup_desc_file)
+(roletype object_r cgroup_desc_file)
+(type vendor_cgroup_desc_file)
+(roletype object_r vendor_cgroup_desc_file)
+(type task_profiles_file)
+(roletype object_r task_profiles_file)
+(type vendor_task_profiles_file)
+(roletype object_r vendor_task_profiles_file)
+(type art_apex_dir)
+(roletype object_r art_apex_dir)
+(type linkerconfig_file)
+(roletype object_r linkerconfig_file)
+(type incremental_control_file)
+(roletype object_r incremental_control_file)
+(type bootanim_oem_file)
+(roletype object_r bootanim_oem_file)
+(type vendor_hal_file)
+(roletype object_r vendor_hal_file)
+(type vendor_file)
+(roletype object_r vendor_file)
+(type vendor_app_file)
+(roletype object_r vendor_app_file)
+(type vendor_configs_file)
+(roletype object_r vendor_configs_file)
+(type same_process_hal_file)
+(roletype object_r same_process_hal_file)
+(type vndk_sp_file)
+(roletype object_r vndk_sp_file)
+(type vendor_framework_file)
+(roletype object_r vendor_framework_file)
+(type vendor_overlay_file)
+(roletype object_r vendor_overlay_file)
+(type vendor_public_lib_file)
+(roletype object_r vendor_public_lib_file)
+(type vendor_public_framework_file)
+(roletype object_r vendor_public_framework_file)
+(type vendor_microdroid_file)
+(roletype object_r vendor_microdroid_file)
+(type vendor_boot_ota_file)
+(roletype object_r vendor_boot_ota_file)
+(type vendor_keylayout_file)
+(roletype object_r vendor_keylayout_file)
+(type vendor_keychars_file)
+(roletype object_r vendor_keychars_file)
+(type vendor_idc_file)
+(roletype object_r vendor_idc_file)
+(type vendor_uuid_mapping_config_file)
+(roletype object_r vendor_uuid_mapping_config_file)
+(type vendor_vm_file)
+(roletype object_r vendor_vm_file)
+(type vendor_vm_data_file)
+(roletype object_r vendor_vm_data_file)
+(type metadata_file)
+(roletype object_r metadata_file)
+(type vold_metadata_file)
+(roletype object_r vold_metadata_file)
+(type gsi_metadata_file)
+(roletype object_r gsi_metadata_file)
+(type gsi_public_metadata_file)
+(roletype object_r gsi_public_metadata_file)
+(type password_slot_metadata_file)
+(roletype object_r password_slot_metadata_file)
+(type apex_metadata_file)
+(roletype object_r apex_metadata_file)
+(type ota_metadata_file)
+(roletype object_r ota_metadata_file)
+(type metadata_bootstat_file)
+(roletype object_r metadata_bootstat_file)
+(type userspace_reboot_metadata_file)
+(roletype object_r userspace_reboot_metadata_file)
+(type staged_install_file)
+(roletype object_r staged_install_file)
+(type watchdog_metadata_file)
+(roletype object_r watchdog_metadata_file)
+(type repair_mode_metadata_file)
+(roletype object_r repair_mode_metadata_file)
+(type aconfig_storage_metadata_file)
+(roletype object_r aconfig_storage_metadata_file)
+(type aconfig_storage_flags_metadata_file)
+(roletype object_r aconfig_storage_flags_metadata_file)
+(type dev_cpu_variant)
+(roletype object_r dev_cpu_variant)
+(type runtime_event_log_tags_file)
+(roletype object_r runtime_event_log_tags_file)
+(type logcat_exec)
+(roletype object_r logcat_exec)
+(type cgroup_rc_file)
+(roletype object_r cgroup_rc_file)
+(type coredump_file)
+(roletype object_r coredump_file)
+(type system_data_root_file)
+(roletype object_r system_data_root_file)
+(type system_data_file)
+(roletype object_r system_data_file)
+(type system_userdir_file)
+(roletype object_r system_userdir_file)
+(type packages_list_file)
+(roletype object_r packages_list_file)
+(type game_mode_intervention_list_file)
+(roletype object_r game_mode_intervention_list_file)
+(type vendor_data_file)
+(roletype object_r vendor_data_file)
+(type vendor_userdir_file)
+(roletype object_r vendor_userdir_file)
+(type unencrypted_data_file)
+(roletype object_r unencrypted_data_file)
+(type install_data_file)
+(roletype object_r install_data_file)
+(type drm_data_file)
+(roletype object_r drm_data_file)
+(type adb_data_file)
+(roletype object_r adb_data_file)
+(type anr_data_file)
+(roletype object_r anr_data_file)
+(type tombstone_data_file)
+(roletype object_r tombstone_data_file)
+(type tombstone_wifi_data_file)
+(roletype object_r tombstone_wifi_data_file)
+(type apex_data_file)
+(roletype object_r apex_data_file)
+(type apk_data_file)
+(roletype object_r apk_data_file)
+(type apk_tmp_file)
+(roletype object_r apk_tmp_file)
+(type apk_private_data_file)
+(roletype object_r apk_private_data_file)
+(type apk_private_tmp_file)
+(roletype object_r apk_private_tmp_file)
+(type dalvikcache_data_file)
+(roletype object_r dalvikcache_data_file)
+(type ota_data_file)
+(roletype object_r ota_data_file)
+(type ota_package_file)
+(roletype object_r ota_package_file)
+(type user_profile_root_file)
+(roletype object_r user_profile_root_file)
+(type user_profile_data_file)
+(roletype object_r user_profile_data_file)
+(type profman_dump_data_file)
+(roletype object_r profman_dump_data_file)
+(type prereboot_data_file)
+(roletype object_r prereboot_data_file)
+(type resourcecache_data_file)
+(roletype object_r resourcecache_data_file)
+(type shell_data_file)
+(roletype object_r shell_data_file)
+(type property_data_file)
+(roletype object_r property_data_file)
+(type bootchart_data_file)
+(roletype object_r bootchart_data_file)
+(type dropbox_data_file)
+(roletype object_r dropbox_data_file)
+(type heapdump_data_file)
+(roletype object_r heapdump_data_file)
+(type nativetest_data_file)
+(roletype object_r nativetest_data_file)
+(type shell_test_data_file)
+(roletype object_r shell_test_data_file)
+(type ringtone_file)
+(roletype object_r ringtone_file)
+(type preloads_data_file)
+(roletype object_r preloads_data_file)
+(type preloads_media_file)
+(roletype object_r preloads_media_file)
+(type dhcp_data_file)
+(roletype object_r dhcp_data_file)
+(type server_configurable_flags_data_file)
+(roletype object_r server_configurable_flags_data_file)
+(type staging_data_file)
+(roletype object_r staging_data_file)
+(type vendor_apex_file)
+(roletype object_r vendor_apex_file)
+(type vendor_apex_metadata_file)
+(roletype object_r vendor_apex_metadata_file)
+(type shutdown_checkpoints_system_data_file)
+(roletype object_r shutdown_checkpoints_system_data_file)
+(type mnt_media_rw_file)
+(roletype object_r mnt_media_rw_file)
+(type mnt_user_file)
+(roletype object_r mnt_user_file)
+(type mnt_pass_through_file)
+(roletype object_r mnt_pass_through_file)
+(type mnt_expand_file)
+(roletype object_r mnt_expand_file)
+(type mnt_sdcard_file)
+(roletype object_r mnt_sdcard_file)
+(type storage_file)
+(roletype object_r storage_file)
+(type mnt_media_rw_stub_file)
+(roletype object_r mnt_media_rw_stub_file)
+(type storage_stub_file)
+(roletype object_r storage_stub_file)
+(type mnt_vendor_file)
+(roletype object_r mnt_vendor_file)
+(type mnt_product_file)
+(roletype object_r mnt_product_file)
+(type apex_mnt_dir)
+(roletype object_r apex_mnt_dir)
+(type apex_info_file)
+(roletype object_r apex_info_file)
+(type postinstall_mnt_dir)
+(roletype object_r postinstall_mnt_dir)
+(type postinstall_file)
+(roletype object_r postinstall_file)
+(type postinstall_apex_mnt_dir)
+(roletype object_r postinstall_apex_mnt_dir)
+(type mirror_data_file)
+(roletype object_r mirror_data_file)
+(type adb_keys_file)
+(roletype object_r adb_keys_file)
+(type apex_system_server_data_file)
+(roletype object_r apex_system_server_data_file)
+(type apex_module_data_file)
+(roletype object_r apex_module_data_file)
+(type apex_ota_reserved_file)
+(roletype object_r apex_ota_reserved_file)
+(type apex_rollback_data_file)
+(roletype object_r apex_rollback_data_file)
+(type appcompat_data_file)
+(roletype object_r appcompat_data_file)
+(type audio_data_file)
+(roletype object_r audio_data_file)
+(type audioserver_data_file)
+(roletype object_r audioserver_data_file)
+(type bluetooth_data_file)
+(roletype object_r bluetooth_data_file)
+(type bluetooth_logs_data_file)
+(roletype object_r bluetooth_logs_data_file)
+(type bootstat_data_file)
+(roletype object_r bootstat_data_file)
+(type boottrace_data_file)
+(roletype object_r boottrace_data_file)
+(type camera_data_file)
+(roletype object_r camera_data_file)
+(type credstore_data_file)
+(roletype object_r credstore_data_file)
+(type gatekeeper_data_file)
+(roletype object_r gatekeeper_data_file)
+(type incident_data_file)
+(roletype object_r incident_data_file)
+(type keychain_data_file)
+(roletype object_r keychain_data_file)
+(type keystore_data_file)
+(roletype object_r keystore_data_file)
+(type media_data_file)
+(roletype object_r media_data_file)
+(type media_rw_data_file)
+(roletype object_r media_rw_data_file)
+(type media_userdir_file)
+(roletype object_r media_userdir_file)
+(type misc_user_data_file)
+(roletype object_r misc_user_data_file)
+(type net_data_file)
+(roletype object_r net_data_file)
+(type network_watchlist_data_file)
+(roletype object_r network_watchlist_data_file)
+(type nfc_data_file)
+(roletype object_r nfc_data_file)
+(type nfc_logs_data_file)
+(roletype object_r nfc_logs_data_file)
+(type radio_data_file)
+(roletype object_r radio_data_file)
+(type recovery_data_file)
+(roletype object_r recovery_data_file)
+(type shared_relro_file)
+(roletype object_r shared_relro_file)
+(type snapshotctl_log_data_file)
+(roletype object_r snapshotctl_log_data_file)
+(type stats_config_data_file)
+(roletype object_r stats_config_data_file)
+(type stats_data_file)
+(roletype object_r stats_data_file)
+(type systemkeys_data_file)
+(roletype object_r systemkeys_data_file)
+(type textclassifier_data_file)
+(roletype object_r textclassifier_data_file)
+(type trace_data_file)
+(roletype object_r trace_data_file)
+(type vpn_data_file)
+(roletype object_r vpn_data_file)
+(type wifi_data_file)
+(roletype object_r wifi_data_file)
+(type vold_data_file)
+(roletype object_r vold_data_file)
+(type tee_data_file)
+(roletype object_r tee_data_file)
+(type update_engine_data_file)
+(roletype object_r update_engine_data_file)
+(type update_engine_log_data_file)
+(roletype object_r update_engine_log_data_file)
+(type snapuserd_log_data_file)
+(roletype object_r snapuserd_log_data_file)
+(type method_trace_data_file)
+(roletype object_r method_trace_data_file)
+(type gsi_data_file)
+(roletype object_r gsi_data_file)
+(type radio_core_data_file)
+(roletype object_r radio_core_data_file)
+(type app_data_file)
+(roletype object_r app_data_file)
+(type privapp_data_file)
+(roletype object_r privapp_data_file)
+(type system_app_data_file)
+(roletype object_r system_app_data_file)
+(type cache_file)
+(roletype object_r cache_file)
+(type overlayfs_file)
+(roletype object_r overlayfs_file)
+(type cache_backup_file)
+(roletype object_r cache_backup_file)
+(type cache_private_backup_file)
+(roletype object_r cache_private_backup_file)
+(type cache_recovery_file)
+(roletype object_r cache_recovery_file)
+(type efs_file)
+(roletype object_r efs_file)
+(type wallpaper_file)
+(roletype object_r wallpaper_file)
+(type shortcut_manager_icons)
+(roletype object_r shortcut_manager_icons)
+(type icon_file)
+(roletype object_r icon_file)
+(type asec_apk_file)
+(roletype object_r asec_apk_file)
+(type asec_public_file)
+(roletype object_r asec_public_file)
+(type asec_image_file)
+(roletype object_r asec_image_file)
+(type backup_data_file)
+(roletype object_r backup_data_file)
+(type bluetooth_efs_file)
+(roletype object_r bluetooth_efs_file)
+(type fingerprintd_data_file)
+(roletype object_r fingerprintd_data_file)
+(type fingerprint_vendor_data_file)
+(roletype object_r fingerprint_vendor_data_file)
+(type app_fuse_file)
+(roletype object_r app_fuse_file)
+(type face_vendor_data_file)
+(roletype object_r face_vendor_data_file)
+(type iris_vendor_data_file)
+(roletype object_r iris_vendor_data_file)
+(type adbd_socket)
+(roletype object_r adbd_socket)
+(type bluetooth_socket)
+(roletype object_r bluetooth_socket)
+(type dnsproxyd_socket)
+(roletype object_r dnsproxyd_socket)
+(type dumpstate_socket)
+(roletype object_r dumpstate_socket)
+(type fwmarkd_socket)
+(roletype object_r fwmarkd_socket)
+(type lmkd_socket)
+(roletype object_r lmkd_socket)
+(type logd_socket)
+(roletype object_r logd_socket)
+(type logdr_socket)
+(roletype object_r logdr_socket)
+(type logdw_socket)
+(roletype object_r logdw_socket)
+(type mdns_socket)
+(roletype object_r mdns_socket)
+(type mdnsd_socket)
+(roletype object_r mdnsd_socket)
+(type misc_logd_file)
+(roletype object_r misc_logd_file)
+(type mtpd_socket)
+(roletype object_r mtpd_socket)
+(type ot_daemon_socket)
+(roletype object_r ot_daemon_socket)
+(type property_socket)
+(roletype object_r property_socket)
+(type racoon_socket)
+(roletype object_r racoon_socket)
+(type recovery_socket)
+(roletype object_r recovery_socket)
+(type rild_socket)
+(roletype object_r rild_socket)
+(type rild_debug_socket)
+(roletype object_r rild_debug_socket)
+(type snapuserd_socket)
+(roletype object_r snapuserd_socket)
+(type snapuserd_proxy_socket)
+(roletype object_r snapuserd_proxy_socket)
+(type statsdw_socket)
+(roletype object_r statsdw_socket)
+(type system_wpa_socket)
+(roletype object_r system_wpa_socket)
+(type system_ndebug_socket)
+(roletype object_r system_ndebug_socket)
+(type system_unsolzygote_socket)
+(roletype object_r system_unsolzygote_socket)
+(type tombstoned_crash_socket)
+(roletype object_r tombstoned_crash_socket)
+(type tombstoned_java_trace_socket)
+(roletype object_r tombstoned_java_trace_socket)
+(type tombstoned_intercept_socket)
+(roletype object_r tombstoned_intercept_socket)
+(type traced_consumer_socket)
+(roletype object_r traced_consumer_socket)
+(type traced_perf_socket)
+(roletype object_r traced_perf_socket)
+(type traced_producer_socket)
+(roletype object_r traced_producer_socket)
+(type uncrypt_socket)
+(roletype object_r uncrypt_socket)
+(type wpa_socket)
+(roletype object_r wpa_socket)
+(type zygote_socket)
+(roletype object_r zygote_socket)
+(type heapprofd_socket)
+(roletype object_r heapprofd_socket)
+(type gps_control)
+(roletype object_r gps_control)
+(type pdx_display_dir)
+(roletype object_r pdx_display_dir)
+(type pdx_performance_dir)
+(roletype object_r pdx_performance_dir)
+(type pdx_bufferhub_dir)
+(roletype object_r pdx_bufferhub_dir)
+(type pdx_display_client_endpoint_socket)
+(roletype object_r pdx_display_client_endpoint_socket)
+(type pdx_display_client_channel_socket)
+(roletype object_r pdx_display_client_channel_socket)
+(type pdx_display_manager_endpoint_socket)
+(roletype object_r pdx_display_manager_endpoint_socket)
+(type pdx_display_manager_channel_socket)
+(roletype object_r pdx_display_manager_channel_socket)
+(type pdx_display_screenshot_endpoint_socket)
+(roletype object_r pdx_display_screenshot_endpoint_socket)
+(type pdx_display_screenshot_channel_socket)
+(roletype object_r pdx_display_screenshot_channel_socket)
+(type pdx_display_vsync_endpoint_socket)
+(roletype object_r pdx_display_vsync_endpoint_socket)
+(type pdx_display_vsync_channel_socket)
+(roletype object_r pdx_display_vsync_channel_socket)
+(type pdx_performance_client_endpoint_socket)
+(roletype object_r pdx_performance_client_endpoint_socket)
+(type pdx_performance_client_channel_socket)
+(roletype object_r pdx_performance_client_channel_socket)
+(type pdx_bufferhub_client_endpoint_socket)
+(roletype object_r pdx_bufferhub_client_endpoint_socket)
+(type pdx_bufferhub_client_channel_socket)
+(roletype object_r pdx_bufferhub_client_channel_socket)
+(type file_contexts_file)
+(roletype object_r file_contexts_file)
+(type mac_perms_file)
+(roletype object_r mac_perms_file)
+(type property_contexts_file)
+(roletype object_r property_contexts_file)
+(type seapp_contexts_file)
+(roletype object_r seapp_contexts_file)
+(type sepolicy_file)
+(roletype object_r sepolicy_file)
+(type service_contexts_file)
+(roletype object_r service_contexts_file)
+(type keystore2_key_contexts_file)
+(roletype object_r keystore2_key_contexts_file)
+(type vendor_service_contexts_file)
+(roletype object_r vendor_service_contexts_file)
+(type hwservice_contexts_file)
+(roletype object_r hwservice_contexts_file)
+(type vndservice_contexts_file)
+(roletype object_r vndservice_contexts_file)
+(type debugfs_bootreceiver_tracing)
+(roletype object_r debugfs_bootreceiver_tracing)
+(type vendor_kernel_modules)
+(roletype object_r vendor_kernel_modules)
+(type system_dlkm_file)
+(roletype object_r system_dlkm_file)
+(type audiohal_data_file)
+(roletype object_r audiohal_data_file)
+(type sysfs_udc)
+(roletype object_r sysfs_udc)
+(type tee_service_contexts_file)
+(roletype object_r tee_service_contexts_file)
+(type fingerprintd)
+(roletype object_r fingerprintd)
+(type fingerprintd_exec)
+(roletype object_r fingerprintd_exec)
+(type flags_health_check)
+(roletype object_r flags_health_check)
+(type flags_health_check_exec)
+(roletype object_r flags_health_check_exec)
+(type fsck)
+(roletype object_r fsck)
+(type fsck_exec)
+(roletype object_r fsck_exec)
+(type fsck_untrusted)
+(roletype object_r fsck_untrusted)
+(type gatekeeperd)
+(roletype object_r gatekeeperd)
+(type gatekeeperd_exec)
+(roletype object_r gatekeeperd_exec)
+(type gmscore_app)
+(roletype object_r gmscore_app)
+(type gpuservice)
+(roletype object_r gpuservice)
+(type hal_graphics_composer_server_tmpfs)
+(roletype object_r hal_graphics_composer_server_tmpfs)
+(typeattribute hal_graphics_composer_client_tmpfs)
+(expandtypeattribute (hal_graphics_composer_client_tmpfs) true)
+(typeattributeset hal_graphics_composer_client_tmpfs (surfaceflinger_tmpfs ))
+(type healthd)
+(roletype object_r healthd)
+(type heapprofd)
+(roletype object_r heapprofd)
+(type default_android_hwservice)
+(roletype object_r default_android_hwservice)
+(type fwk_camera_hwservice)
+(roletype object_r fwk_camera_hwservice)
+(type fwk_display_hwservice)
+(roletype object_r fwk_display_hwservice)
+(type fwk_scheduler_hwservice)
+(roletype object_r fwk_scheduler_hwservice)
+(type fwk_sensor_hwservice)
+(roletype object_r fwk_sensor_hwservice)
+(type fwk_stats_hwservice)
+(roletype object_r fwk_stats_hwservice)
+(type fwk_automotive_display_hwservice)
+(roletype object_r fwk_automotive_display_hwservice)
+(type hal_atrace_hwservice)
+(roletype object_r hal_atrace_hwservice)
+(type hal_audio_hwservice)
+(roletype object_r hal_audio_hwservice)
+(type hal_audiocontrol_hwservice)
+(roletype object_r hal_audiocontrol_hwservice)
+(type hal_authsecret_hwservice)
+(roletype object_r hal_authsecret_hwservice)
+(type hal_bluetooth_hwservice)
+(roletype object_r hal_bluetooth_hwservice)
+(type hal_bootctl_hwservice)
+(roletype object_r hal_bootctl_hwservice)
+(type hal_broadcastradio_hwservice)
+(roletype object_r hal_broadcastradio_hwservice)
+(type hal_camera_hwservice)
+(roletype object_r hal_camera_hwservice)
+(type hal_can_bus_hwservice)
+(roletype object_r hal_can_bus_hwservice)
+(type hal_can_controller_hwservice)
+(roletype object_r hal_can_controller_hwservice)
+(type hal_confirmationui_hwservice)
+(roletype object_r hal_confirmationui_hwservice)
+(type hal_contexthub_hwservice)
+(roletype object_r hal_contexthub_hwservice)
+(type hal_dumpstate_hwservice)
+(roletype object_r hal_dumpstate_hwservice)
+(type hal_evs_hwservice)
+(roletype object_r hal_evs_hwservice)
+(type hal_face_hwservice)
+(roletype object_r hal_face_hwservice)
+(type hal_fingerprint_hwservice)
+(roletype object_r hal_fingerprint_hwservice)
+(type hal_gatekeeper_hwservice)
+(roletype object_r hal_gatekeeper_hwservice)
+(type hal_gnss_hwservice)
+(roletype object_r hal_gnss_hwservice)
+(type hal_graphics_composer_hwservice)
+(roletype object_r hal_graphics_composer_hwservice)
+(type hal_health_hwservice)
+(roletype object_r hal_health_hwservice)
+(type hal_health_storage_hwservice)
+(roletype object_r hal_health_storage_hwservice)
+(type hal_input_classifier_hwservice)
+(roletype object_r hal_input_classifier_hwservice)
+(type hal_ir_hwservice)
+(roletype object_r hal_ir_hwservice)
+(type hal_keymaster_hwservice)
+(roletype object_r hal_keymaster_hwservice)
+(type hal_light_hwservice)
+(roletype object_r hal_light_hwservice)
+(type hal_lowpan_hwservice)
+(roletype object_r hal_lowpan_hwservice)
+(type hal_memtrack_hwservice)
+(roletype object_r hal_memtrack_hwservice)
+(type hal_nfc_hwservice)
+(roletype object_r hal_nfc_hwservice)
+(type hal_oemlock_hwservice)
+(roletype object_r hal_oemlock_hwservice)
+(type hal_power_hwservice)
+(roletype object_r hal_power_hwservice)
+(type hal_power_stats_hwservice)
+(roletype object_r hal_power_stats_hwservice)
+(type hal_secure_element_hwservice)
+(roletype object_r hal_secure_element_hwservice)
+(type hal_sensors_hwservice)
+(roletype object_r hal_sensors_hwservice)
+(type hal_telephony_hwservice)
+(roletype object_r hal_telephony_hwservice)
+(type hal_tetheroffload_hwservice)
+(roletype object_r hal_tetheroffload_hwservice)
+(type hal_thermal_hwservice)
+(roletype object_r hal_thermal_hwservice)
+(type hal_tv_cec_hwservice)
+(roletype object_r hal_tv_cec_hwservice)
+(type hal_tv_input_hwservice)
+(roletype object_r hal_tv_input_hwservice)
+(type hal_tv_tuner_hwservice)
+(roletype object_r hal_tv_tuner_hwservice)
+(type hal_usb_gadget_hwservice)
+(roletype object_r hal_usb_gadget_hwservice)
+(type hal_usb_hwservice)
+(roletype object_r hal_usb_hwservice)
+(type hal_vehicle_hwservice)
+(roletype object_r hal_vehicle_hwservice)
+(type hal_vibrator_hwservice)
+(roletype object_r hal_vibrator_hwservice)
+(type hal_vr_hwservice)
+(roletype object_r hal_vr_hwservice)
+(type hal_weaver_hwservice)
+(roletype object_r hal_weaver_hwservice)
+(type hal_wifi_hostapd_hwservice)
+(roletype object_r hal_wifi_hostapd_hwservice)
+(type hal_wifi_hwservice)
+(roletype object_r hal_wifi_hwservice)
+(type hal_wifi_supplicant_hwservice)
+(roletype object_r hal_wifi_supplicant_hwservice)
+(type system_net_netd_hwservice)
+(roletype object_r system_net_netd_hwservice)
+(type system_suspend_hwservice)
+(roletype object_r system_suspend_hwservice)
+(type system_wifi_keystore_hwservice)
+(roletype object_r system_wifi_keystore_hwservice)
+(type fwk_bufferhub_hwservice)
+(roletype object_r fwk_bufferhub_hwservice)
+(type hal_cas_hwservice)
+(roletype object_r hal_cas_hwservice)
+(type hal_codec2_hwservice)
+(roletype object_r hal_codec2_hwservice)
+(type hal_configstore_ISurfaceFlingerConfigs)
+(roletype object_r hal_configstore_ISurfaceFlingerConfigs)
+(type hal_drm_hwservice)
+(roletype object_r hal_drm_hwservice)
+(type hal_graphics_allocator_hwservice)
+(roletype object_r hal_graphics_allocator_hwservice)
+(type hal_graphics_mapper_hwservice)
+(roletype object_r hal_graphics_mapper_hwservice)
+(type hal_neuralnetworks_hwservice)
+(roletype object_r hal_neuralnetworks_hwservice)
+(type hal_omx_hwservice)
+(roletype object_r hal_omx_hwservice)
+(type hal_renderscript_hwservice)
+(roletype object_r hal_renderscript_hwservice)
+(type hidl_allocator_hwservice)
+(roletype object_r hidl_allocator_hwservice)
+(type hidl_base_hwservice)
+(roletype object_r hidl_base_hwservice)
+(type hidl_manager_hwservice)
+(roletype object_r hidl_manager_hwservice)
+(type hidl_memory_hwservice)
+(roletype object_r hidl_memory_hwservice)
+(type hidl_token_hwservice)
+(roletype object_r hidl_token_hwservice)
+(type hwservicemanager)
+(roletype object_r hwservicemanager)
+(type hwservicemanager_exec)
+(roletype object_r hwservicemanager_exec)
+(type idmap)
+(roletype object_r idmap)
+(type idmap_exec)
+(roletype object_r idmap_exec)
+(type incident)
+(roletype object_r incident)
+(type incident_helper)
+(roletype object_r incident_helper)
+(type incidentd)
+(roletype object_r incidentd)
+(type init)
+(roletype object_r init)
+(type init_exec)
+(roletype object_r init_exec)
+(type init_tmpfs)
+(roletype object_r init_tmpfs)
+(type inputflinger)
+(roletype object_r inputflinger)
+(type inputflinger_exec)
+(roletype object_r inputflinger_exec)
+(type installd)
+(roletype object_r installd)
+(type installd_exec)
+(roletype object_r installd_exec)
+(type isolated_app)
+(roletype object_r isolated_app)
+(type isolated_compute_app)
+(roletype object_r isolated_compute_app)
+(type kernel)
+(roletype object_r kernel)
+(type keystore)
+(roletype object_r keystore)
+(type keystore_exec)
+(roletype object_r keystore_exec)
+(type wifi_key)
+(roletype object_r wifi_key)
+(type llkd)
+(roletype object_r llkd)
+(type llkd_exec)
+(roletype object_r llkd_exec)
+(type lmkd)
+(roletype object_r lmkd)
+(type lmkd_exec)
+(roletype object_r lmkd_exec)
+(type logd)
+(roletype object_r logd)
+(type logd_exec)
+(roletype object_r logd_exec)
+(type logpersist)
+(roletype object_r logpersist)
+(type mdnsd)
+(roletype object_r mdnsd)
+(type mediadrmserver)
+(roletype object_r mediadrmserver)
+(type mediadrmserver_exec)
+(roletype object_r mediadrmserver_exec)
+(type mediaextractor)
+(roletype object_r mediaextractor)
+(type mediaextractor_exec)
+(roletype object_r mediaextractor_exec)
+(type mediaextractor_tmpfs)
+(roletype object_r mediaextractor_tmpfs)
+(type mediametrics)
+(roletype object_r mediametrics)
+(type mediametrics_exec)
+(roletype object_r mediametrics_exec)
+(type mediaprovider)
+(roletype object_r mediaprovider)
+(type mediaserver)
+(roletype object_r mediaserver)
+(type mediaserver_exec)
+(roletype object_r mediaserver_exec)
+(type mediaserver_tmpfs)
+(roletype object_r mediaserver_tmpfs)
+(type mediaswcodec)
+(roletype object_r mediaswcodec)
+(type mediaswcodec_exec)
+(roletype object_r mediaswcodec_exec)
+(type mediatranscoding)
+(roletype object_r mediatranscoding)
+(type modprobe)
+(roletype object_r modprobe)
+(type mtp)
+(roletype object_r mtp)
+(type node)
+(roletype object_r node)
+(type netif)
+(roletype object_r netif)
+(type port)
+(roletype object_r port)
+(type netd)
+(roletype object_r netd)
+(type netd_exec)
+(roletype object_r netd_exec)
+(type netutils_wrapper)
+(roletype object_r netutils_wrapper)
+(type netutils_wrapper_exec)
+(roletype object_r netutils_wrapper_exec)
+(type network_stack)
+(roletype object_r network_stack)
+(type nfc)
+(roletype object_r nfc)
+(type perfetto)
+(roletype object_r perfetto)
+(type performanced)
+(roletype object_r performanced)
+(type performanced_exec)
+(roletype object_r performanced_exec)
+(type platform_app)
+(roletype object_r platform_app)
+(type postinstall)
+(roletype object_r postinstall)
+(type ppp)
+(roletype object_r ppp)
+(type priv_app)
+(roletype object_r priv_app)
+(type prng_seeder)
+(roletype object_r prng_seeder)
+(type profman)
+(roletype object_r profman)
+(type profman_exec)
+(roletype object_r profman_exec)
+(type apexd_prop)
+(roletype object_r apexd_prop)
+(type bootloader_boot_reason_prop)
+(roletype object_r bootloader_boot_reason_prop)
+(type device_config_activity_manager_native_boot_prop)
+(roletype object_r device_config_activity_manager_native_boot_prop)
+(type device_config_boot_count_prop)
+(roletype object_r device_config_boot_count_prop)
+(type device_config_input_native_boot_prop)
+(roletype object_r device_config_input_native_boot_prop)
+(type device_config_netd_native_prop)
+(roletype object_r device_config_netd_native_prop)
+(type device_config_reset_performed_prop)
+(roletype object_r device_config_reset_performed_prop)
+(type firstboot_prop)
+(roletype object_r firstboot_prop)
+(type boottime_prop)
+(roletype object_r boottime_prop)
+(type charger_prop)
+(roletype object_r charger_prop)
+(type cold_boot_done_prop)
+(roletype object_r cold_boot_done_prop)
+(type ctl_adbd_prop)
+(roletype object_r ctl_adbd_prop)
+(type ctl_apexd_prop)
+(roletype object_r ctl_apexd_prop)
+(type ctl_bootanim_prop)
+(roletype object_r ctl_bootanim_prop)
+(type ctl_bugreport_prop)
+(roletype object_r ctl_bugreport_prop)
+(type ctl_console_prop)
+(roletype object_r ctl_console_prop)
+(type ctl_dumpstate_prop)
+(roletype object_r ctl_dumpstate_prop)
+(type ctl_fuse_prop)
+(roletype object_r ctl_fuse_prop)
+(type ctl_gsid_prop)
+(roletype object_r ctl_gsid_prop)
+(type ctl_interface_restart_prop)
+(roletype object_r ctl_interface_restart_prop)
+(type ctl_interface_stop_prop)
+(roletype object_r ctl_interface_stop_prop)
+(type ctl_mdnsd_prop)
+(roletype object_r ctl_mdnsd_prop)
+(type ctl_restart_prop)
+(roletype object_r ctl_restart_prop)
+(type ctl_rildaemon_prop)
+(roletype object_r ctl_rildaemon_prop)
+(type ctl_sigstop_prop)
+(roletype object_r ctl_sigstop_prop)
+(type dynamic_system_prop)
+(roletype object_r dynamic_system_prop)
+(type heapprofd_enabled_prop)
+(roletype object_r heapprofd_enabled_prop)
+(type llkd_prop)
+(roletype object_r llkd_prop)
+(type lpdumpd_prop)
+(roletype object_r lpdumpd_prop)
+(type mmc_prop)
+(roletype object_r mmc_prop)
+(type mock_ota_prop)
+(roletype object_r mock_ota_prop)
+(type net_dns_prop)
+(roletype object_r net_dns_prop)
+(type overlay_prop)
+(roletype object_r overlay_prop)
+(type persistent_properties_ready_prop)
+(roletype object_r persistent_properties_ready_prop)
+(type safemode_prop)
+(roletype object_r safemode_prop)
+(type system_lmk_prop)
+(roletype object_r system_lmk_prop)
+(type system_trace_prop)
+(roletype object_r system_trace_prop)
+(type test_boot_reason_prop)
+(roletype object_r test_boot_reason_prop)
+(type time_prop)
+(roletype object_r time_prop)
+(type traced_enabled_prop)
+(roletype object_r traced_enabled_prop)
+(type traced_lazy_prop)
+(roletype object_r traced_lazy_prop)
+(type aac_drc_prop)
+(roletype object_r aac_drc_prop)
+(type adaptive_haptics_prop)
+(roletype object_r adaptive_haptics_prop)
+(type apex_ready_prop)
+(roletype object_r apex_ready_prop)
+(type arm64_memtag_prop)
+(roletype object_r arm64_memtag_prop)
+(type binder_cache_bluetooth_server_prop)
+(roletype object_r binder_cache_bluetooth_server_prop)
+(type binder_cache_system_server_prop)
+(roletype object_r binder_cache_system_server_prop)
+(type binder_cache_telephony_server_prop)
+(roletype object_r binder_cache_telephony_server_prop)
+(type boot_status_prop)
+(roletype object_r boot_status_prop)
+(type bootanim_system_prop)
+(roletype object_r bootanim_system_prop)
+(type bootloader_prop)
+(roletype object_r bootloader_prop)
+(type boottime_public_prop)
+(roletype object_r boottime_public_prop)
+(type bq_config_prop)
+(roletype object_r bq_config_prop)
+(type build_bootimage_prop)
+(roletype object_r build_bootimage_prop)
+(type build_prop)
+(roletype object_r build_prop)
+(type composd_vm_art_prop)
+(roletype object_r composd_vm_art_prop)
+(type device_config_aconfig_flags_prop)
+(roletype object_r device_config_aconfig_flags_prop)
+(type device_config_camera_native_prop)
+(roletype object_r device_config_camera_native_prop)
+(type device_config_edgetpu_native_prop)
+(roletype object_r device_config_edgetpu_native_prop)
+(type device_config_media_native_prop)
+(roletype object_r device_config_media_native_prop)
+(type device_config_nnapi_native_prop)
+(roletype object_r device_config_nnapi_native_prop)
+(type device_config_runtime_native_boot_prop)
+(roletype object_r device_config_runtime_native_boot_prop)
+(type device_config_runtime_native_prop)
+(roletype object_r device_config_runtime_native_prop)
+(type device_config_surface_flinger_native_boot_prop)
+(roletype object_r device_config_surface_flinger_native_boot_prop)
+(type device_config_vendor_system_native_prop)
+(roletype object_r device_config_vendor_system_native_prop)
+(type device_config_vendor_system_native_boot_prop)
+(roletype object_r device_config_vendor_system_native_boot_prop)
+(type drm_forcel3_prop)
+(roletype object_r drm_forcel3_prop)
+(type fingerprint_prop)
+(roletype object_r fingerprint_prop)
+(type gwp_asan_prop)
+(roletype object_r gwp_asan_prop)
+(type hal_instrumentation_prop)
+(roletype object_r hal_instrumentation_prop)
+(type userdebug_or_eng_prop)
+(roletype object_r userdebug_or_eng_prop)
+(type init_service_status_prop)
+(roletype object_r init_service_status_prop)
+(type libc_debug_prop)
+(roletype object_r libc_debug_prop)
+(type module_sdkextensions_prop)
+(roletype object_r module_sdkextensions_prop)
+(type nnapi_ext_deny_product_prop)
+(roletype object_r nnapi_ext_deny_product_prop)
+(type persist_wm_debug_prop)
+(roletype object_r persist_wm_debug_prop)
+(type power_debug_prop)
+(roletype object_r power_debug_prop)
+(type property_service_version_prop)
+(roletype object_r property_service_version_prop)
+(type provisioned_prop)
+(roletype object_r provisioned_prop)
+(type restorecon_prop)
+(roletype object_r restorecon_prop)
+(type retaildemo_prop)
+(roletype object_r retaildemo_prop)
+(type servicemanager_prop)
+(roletype object_r servicemanager_prop)
+(type smart_idle_maint_enabled_prop)
+(roletype object_r smart_idle_maint_enabled_prop)
+(type socket_hook_prop)
+(roletype object_r socket_hook_prop)
+(type sqlite_log_prop)
+(roletype object_r sqlite_log_prop)
+(type surfaceflinger_display_prop)
+(roletype object_r surfaceflinger_display_prop)
+(type system_boot_reason_prop)
+(roletype object_r system_boot_reason_prop)
+(type system_jvmti_agent_prop)
+(roletype object_r system_jvmti_agent_prop)
+(type traced_oome_heap_session_count_prop)
+(roletype object_r traced_oome_heap_session_count_prop)
+(type ab_update_gki_prop)
+(roletype object_r ab_update_gki_prop)
+(type usb_prop)
+(roletype object_r usb_prop)
+(type userspace_reboot_exported_prop)
+(roletype object_r userspace_reboot_exported_prop)
+(type vold_status_prop)
+(roletype object_r vold_status_prop)
+(type vts_status_prop)
+(roletype object_r vts_status_prop)
+(type enable_16k_pages_prop)
+(roletype object_r enable_16k_pages_prop)
+(type profcollectd_etr_prop)
+(roletype object_r profcollectd_etr_prop)
+(type config_prop)
+(roletype object_r config_prop)
+(type cppreopt_prop)
+(roletype object_r cppreopt_prop)
+(type dalvik_prop)
+(roletype object_r dalvik_prop)
+(type debuggerd_prop)
+(roletype object_r debuggerd_prop)
+(type device_logging_prop)
+(roletype object_r device_logging_prop)
+(type dhcp_prop)
+(roletype object_r dhcp_prop)
+(type dumpstate_prop)
+(roletype object_r dumpstate_prop)
+(type exported3_system_prop)
+(roletype object_r exported3_system_prop)
+(type exported_dumpstate_prop)
+(roletype object_r exported_dumpstate_prop)
+(type exported_secure_prop)
+(roletype object_r exported_secure_prop)
+(type heapprofd_prop)
+(roletype object_r heapprofd_prop)
+(type net_radio_prop)
+(roletype object_r net_radio_prop)
+(type pan_result_prop)
+(roletype object_r pan_result_prop)
+(type persist_debug_prop)
+(roletype object_r persist_debug_prop)
+(type shell_prop)
+(roletype object_r shell_prop)
+(type test_harness_prop)
+(roletype object_r test_harness_prop)
+(type theme_prop)
+(roletype object_r theme_prop)
+(type use_memfd_prop)
+(roletype object_r use_memfd_prop)
+(type vold_prop)
+(roletype object_r vold_prop)
+(type apexd_config_prop)
+(roletype object_r apexd_config_prop)
+(type apexd_select_prop)
+(roletype object_r apexd_select_prop)
+(type aaudio_config_prop)
+(roletype object_r aaudio_config_prop)
+(type apk_verity_prop)
+(roletype object_r apk_verity_prop)
+(type audio_config_prop)
+(roletype object_r audio_config_prop)
+(type bootanim_config_prop)
+(roletype object_r bootanim_config_prop)
+(type bluetooth_config_prop)
+(roletype object_r bluetooth_config_prop)
+(type build_attestation_prop)
+(roletype object_r build_attestation_prop)
+(type build_config_prop)
+(roletype object_r build_config_prop)
+(type build_odm_prop)
+(roletype object_r build_odm_prop)
+(type build_vendor_prop)
+(roletype object_r build_vendor_prop)
+(type camera_calibration_prop)
+(roletype object_r camera_calibration_prop)
+(type camera_config_prop)
+(roletype object_r camera_config_prop)
+(type camera2_extensions_prop)
+(roletype object_r camera2_extensions_prop)
+(type camerax_extensions_prop)
+(roletype object_r camerax_extensions_prop)
+(type charger_config_prop)
+(roletype object_r charger_config_prop)
+(type codec2_config_prop)
+(roletype object_r codec2_config_prop)
+(type composd_vm_vendor_prop)
+(roletype object_r composd_vm_vendor_prop)
+(type cpu_variant_prop)
+(roletype object_r cpu_variant_prop)
+(type debugfs_restriction_prop)
+(roletype object_r debugfs_restriction_prop)
+(type drm_service_config_prop)
+(roletype object_r drm_service_config_prop)
+(type exported_camera_prop)
+(roletype object_r exported_camera_prop)
+(type exported_config_prop)
+(roletype object_r exported_config_prop)
+(type exported_default_prop)
+(roletype object_r exported_default_prop)
+(type ffs_config_prop)
+(roletype object_r ffs_config_prop)
+(type framework_watchdog_config_prop)
+(roletype object_r framework_watchdog_config_prop)
+(type graphics_config_prop)
+(roletype object_r graphics_config_prop)
+(type hdmi_config_prop)
+(roletype object_r hdmi_config_prop)
+(type hw_timeout_multiplier_prop)
+(roletype object_r hw_timeout_multiplier_prop)
+(type hypervisor_prop)
+(roletype object_r hypervisor_prop)
+(type hypervisor_restricted_prop)
+(roletype object_r hypervisor_restricted_prop)
+(type incremental_prop)
+(roletype object_r incremental_prop)
+(type input_device_config_prop)
+(roletype object_r input_device_config_prop)
+(type keyguard_config_prop)
+(roletype object_r keyguard_config_prop)
+(type keystore_config_prop)
+(roletype object_r keystore_config_prop)
+(type lmkd_config_prop)
+(roletype object_r lmkd_config_prop)
+(type media_config_prop)
+(roletype object_r media_config_prop)
+(type media_variant_prop)
+(roletype object_r media_variant_prop)
+(type mediadrm_config_prop)
+(roletype object_r mediadrm_config_prop)
+(type mm_events_config_prop)
+(roletype object_r mm_events_config_prop)
+(type oem_unlock_prop)
+(roletype object_r oem_unlock_prop)
+(type ota_build_prop)
+(roletype object_r ota_build_prop)
+(type packagemanager_config_prop)
+(roletype object_r packagemanager_config_prop)
+(type quick_start_prop)
+(roletype object_r quick_start_prop)
+(type recovery_config_prop)
+(roletype object_r recovery_config_prop)
+(type recovery_usb_config_prop)
+(roletype object_r recovery_usb_config_prop)
+(type sendbug_config_prop)
+(roletype object_r sendbug_config_prop)
+(type soc_prop)
+(roletype object_r soc_prop)
+(type storage_config_prop)
+(roletype object_r storage_config_prop)
+(type storagemanager_config_prop)
+(roletype object_r storagemanager_config_prop)
+(type surfaceflinger_prop)
+(roletype object_r surfaceflinger_prop)
+(type suspend_prop)
+(roletype object_r suspend_prop)
+(type systemsound_config_prop)
+(roletype object_r systemsound_config_prop)
+(type telephony_config_prop)
+(roletype object_r telephony_config_prop)
+(type threadnetwork_config_prop)
+(roletype object_r threadnetwork_config_prop)
+(type tombstone_config_prop)
+(roletype object_r tombstone_config_prop)
+(type usb_config_prop)
+(roletype object_r usb_config_prop)
+(type userspace_reboot_config_prop)
+(roletype object_r userspace_reboot_config_prop)
+(type vehicle_hal_prop)
+(roletype object_r vehicle_hal_prop)
+(type vendor_security_patch_level_prop)
+(roletype object_r vendor_security_patch_level_prop)
+(type vendor_socket_hook_prop)
+(roletype object_r vendor_socket_hook_prop)
+(type virtual_ab_prop)
+(roletype object_r virtual_ab_prop)
+(type vndk_prop)
+(roletype object_r vndk_prop)
+(type vts_config_prop)
+(roletype object_r vts_config_prop)
+(type vold_config_prop)
+(roletype object_r vold_config_prop)
+(type wifi_config_prop)
+(roletype object_r wifi_config_prop)
+(type zram_config_prop)
+(roletype object_r zram_config_prop)
+(type zygote_config_prop)
+(roletype object_r zygote_config_prop)
+(type dck_prop)
+(roletype object_r dck_prop)
+(type tuner_config_prop)
+(roletype object_r tuner_config_prop)
+(type usb_uvc_enabled_prop)
+(roletype object_r usb_uvc_enabled_prop)
+(type setupwizard_mode_prop)
+(roletype object_r setupwizard_mode_prop)
+(type pm_archiving_enabled_prop)
+(roletype object_r pm_archiving_enabled_prop)
+(type trusty_security_vm_sys_vendor_prop)
+(roletype object_r trusty_security_vm_sys_vendor_prop)
+(type adbd_config_prop)
+(roletype object_r adbd_config_prop)
+(type audio_prop)
+(roletype object_r audio_prop)
+(type bluetooth_a2dp_offload_prop)
+(roletype object_r bluetooth_a2dp_offload_prop)
+(type bluetooth_audio_hal_prop)
+(roletype object_r bluetooth_audio_hal_prop)
+(type bluetooth_finder_prop)
+(roletype object_r bluetooth_finder_prop)
+(type bluetooth_prop)
+(roletype object_r bluetooth_prop)
+(type bpf_progs_loaded_prop)
+(roletype object_r bpf_progs_loaded_prop)
+(type charger_status_prop)
+(roletype object_r charger_status_prop)
+(type ctl_default_prop)
+(roletype object_r ctl_default_prop)
+(type ctl_interface_start_prop)
+(roletype object_r ctl_interface_start_prop)
+(type ctl_start_prop)
+(roletype object_r ctl_start_prop)
+(type ctl_stop_prop)
+(roletype object_r ctl_stop_prop)
+(type dalvik_config_prop)
+(roletype object_r dalvik_config_prop)
+(type dalvik_dynamic_config_prop)
+(roletype object_r dalvik_dynamic_config_prop)
+(type dalvik_runtime_prop)
+(roletype object_r dalvik_runtime_prop)
+(type debug_prop)
+(roletype object_r debug_prop)
+(type device_config_memory_safety_native_boot_prop)
+(roletype object_r device_config_memory_safety_native_boot_prop)
+(type device_config_memory_safety_native_prop)
+(roletype object_r device_config_memory_safety_native_prop)
+(type dumpstate_options_prop)
+(roletype object_r dumpstate_options_prop)
+(type exported_system_prop)
+(roletype object_r exported_system_prop)
+(type exported_bluetooth_prop)
+(roletype object_r exported_bluetooth_prop)
+(type exported_overlay_prop)
+(roletype object_r exported_overlay_prop)
+(type exported_pm_prop)
+(roletype object_r exported_pm_prop)
+(type future_pm_prop)
+(roletype object_r future_pm_prop)
+(type ffs_control_prop)
+(roletype object_r ffs_control_prop)
+(type framework_status_prop)
+(roletype object_r framework_status_prop)
+(type gesture_prop)
+(roletype object_r gesture_prop)
+(type graphics_config_writable_prop)
+(roletype object_r graphics_config_writable_prop)
+(type hal_dumpstate_config_prop)
+(roletype object_r hal_dumpstate_config_prop)
+(type sota_prop)
+(roletype object_r sota_prop)
+(type hwservicemanager_prop)
+(roletype object_r hwservicemanager_prop)
+(type lmkd_prop)
+(roletype object_r lmkd_prop)
+(type locale_prop)
+(roletype object_r locale_prop)
+(type logd_prop)
+(roletype object_r logd_prop)
+(type logpersistd_logging_prop)
+(roletype object_r logpersistd_logging_prop)
+(type log_prop)
+(roletype object_r log_prop)
+(type log_tag_prop)
+(roletype object_r log_tag_prop)
+(type lowpan_prop)
+(roletype object_r lowpan_prop)
+(type nfc_prop)
+(roletype object_r nfc_prop)
+(type ota_prop)
+(roletype object_r ota_prop)
+(type permissive_mte_prop)
+(roletype object_r permissive_mte_prop)
+(type powerctl_prop)
+(roletype object_r powerctl_prop)
+(type qemu_hw_prop)
+(roletype object_r qemu_hw_prop)
+(type qemu_sf_lcd_density_prop)
+(roletype object_r qemu_sf_lcd_density_prop)
+(type radio_control_prop)
+(roletype object_r radio_control_prop)
+(type radio_prop)
+(roletype object_r radio_prop)
+(type serialno_prop)
+(roletype object_r serialno_prop)
+(type surfaceflinger_color_prop)
+(roletype object_r surfaceflinger_color_prop)
+(type system_prop)
+(roletype object_r system_prop)
+(type system_user_mode_emulation_prop)
+(roletype object_r system_user_mode_emulation_prop)
+(type telephony_status_prop)
+(roletype object_r telephony_status_prop)
+(type timezone_prop)
+(roletype object_r timezone_prop)
+(type usb_control_prop)
+(roletype object_r usb_control_prop)
+(type vold_post_fs_data_prop)
+(roletype object_r vold_post_fs_data_prop)
+(type wifi_hal_prop)
+(roletype object_r wifi_hal_prop)
+(type wifi_log_prop)
+(roletype object_r wifi_log_prop)
+(type wifi_prop)
+(roletype object_r wifi_prop)
+(type zram_control_prop)
+(roletype object_r zram_control_prop)
+(type default_prop)
+(roletype object_r default_prop)
+(type rebootescrow_hal_prop)
+(roletype object_r rebootescrow_hal_prop)
+(type virtual_face_hal_prop)
+(roletype object_r virtual_face_hal_prop)
+(type virtual_face_prop)
+(roletype object_r virtual_face_prop)
+(type virtual_fingerprint_hal_prop)
+(roletype object_r virtual_fingerprint_hal_prop)
+(type virtual_fingerprint_prop)
+(roletype object_r virtual_fingerprint_prop)
+(type persist_vendor_debug_wifi_prop)
+(roletype object_r persist_vendor_debug_wifi_prop)
+(type vendor_default_prop)
+(roletype object_r vendor_default_prop)
+(type radio)
+(roletype object_r radio)
+(type recovery)
+(roletype object_r recovery)
+(type recovery_persist)
+(roletype object_r recovery_persist)
+(type recovery_persist_exec)
+(roletype object_r recovery_persist_exec)
+(type recovery_refresh)
+(roletype object_r recovery_refresh)
+(type recovery_refresh_exec)
+(roletype object_r recovery_refresh_exec)
+(type rkpdapp)
+(roletype object_r rkpdapp)
+(type rs)
+(roletype object_r rs)
+(type rs_exec)
+(roletype object_r rs_exec)
+(type rss_hwm_reset)
+(roletype object_r rss_hwm_reset)
+(type runas)
+(roletype object_r runas)
+(type runas_exec)
+(roletype object_r runas_exec)
+(type runas_app)
+(roletype object_r runas_app)
+(type sdcardd)
+(roletype object_r sdcardd)
+(type sdcardd_exec)
+(roletype object_r sdcardd_exec)
+(type secure_element)
+(roletype object_r secure_element)
+(type aidl_lazy_test_service)
+(roletype object_r aidl_lazy_test_service)
+(type apc_service)
+(roletype object_r apc_service)
+(type apex_service)
+(roletype object_r apex_service)
+(type artd_service)
+(roletype object_r artd_service)
+(type artd_pre_reboot_service)
+(roletype object_r artd_pre_reboot_service)
+(type audioserver_service)
+(roletype object_r audioserver_service)
+(type authorization_service)
+(roletype object_r authorization_service)
+(type batteryproperties_service)
+(roletype object_r batteryproperties_service)
+(type bluetooth_service)
+(roletype object_r bluetooth_service)
+(type cameraserver_service)
+(roletype object_r cameraserver_service)
+(type fwk_camera_service)
+(roletype object_r fwk_camera_service)
+(type default_android_service)
+(roletype object_r default_android_service)
+(type device_config_updatable_service)
+(roletype object_r device_config_updatable_service)
+(type dexopt_chroot_setup_service)
+(roletype object_r dexopt_chroot_setup_service)
+(type dnsresolver_service)
+(roletype object_r dnsresolver_service)
+(type drmserver_service)
+(roletype object_r drmserver_service)
+(type dumpstate_service)
+(roletype object_r dumpstate_service)
+(type evsmanagerd_service)
+(roletype object_r evsmanagerd_service)
+(type fingerprintd_service)
+(roletype object_r fingerprintd_service)
+(type fwk_automotive_display_service)
+(roletype object_r fwk_automotive_display_service)
+(type gatekeeper_service)
+(roletype object_r gatekeeper_service)
+(type gpu_service)
+(roletype object_r gpu_service)
+(type idmap_service)
+(roletype object_r idmap_service)
+(type incident_service)
+(roletype object_r incident_service)
+(type installd_service)
+(roletype object_r installd_service)
+(type credstore_service)
+(roletype object_r credstore_service)
+(type keystore_compat_hal_service)
+(roletype object_r keystore_compat_hal_service)
+(type keystore_maintenance_service)
+(roletype object_r keystore_maintenance_service)
+(type keystore_metrics_service)
+(roletype object_r keystore_metrics_service)
+(type keystore_service)
+(roletype object_r keystore_service)
+(type legacykeystore_service)
+(roletype object_r legacykeystore_service)
+(type lpdump_service)
+(roletype object_r lpdump_service)
+(type mdns_service)
+(roletype object_r mdns_service)
+(type mediaserver_service)
+(roletype object_r mediaserver_service)
+(type mediametrics_service)
+(roletype object_r mediametrics_service)
+(type mediaextractor_service)
+(roletype object_r mediaextractor_service)
+(type mediadrmserver_service)
+(roletype object_r mediadrmserver_service)
+(type mediatranscoding_service)
+(roletype object_r mediatranscoding_service)
+(type netd_service)
+(roletype object_r netd_service)
+(type nfc_service)
+(roletype object_r nfc_service)
+(type ondevicepersonalization_system_service)
+(roletype object_r ondevicepersonalization_system_service)
+(type ot_daemon_service)
+(roletype object_r ot_daemon_service)
+(type profiling_service)
+(roletype object_r profiling_service)
+(type radio_service)
+(roletype object_r radio_service)
+(type secure_element_service)
+(roletype object_r secure_element_service)
+(type service_manager_service)
+(roletype object_r service_manager_service)
+(type storaged_service)
+(roletype object_r storaged_service)
+(type surfaceflinger_service)
+(roletype object_r surfaceflinger_service)
+(type system_app_service)
+(roletype object_r system_app_service)
+(type system_net_netd_service)
+(roletype object_r system_net_netd_service)
+(type system_suspend_control_internal_service)
+(roletype object_r system_suspend_control_internal_service)
+(type system_suspend_control_service)
+(roletype object_r system_suspend_control_service)
+(type update_engine_service)
+(roletype object_r update_engine_service)
+(type update_engine_stable_service)
+(roletype object_r update_engine_stable_service)
+(type virtualization_service)
+(roletype object_r virtualization_service)
+(type virtual_camera_service)
+(roletype object_r virtual_camera_service)
+(type virtual_touchpad_service)
+(roletype object_r virtual_touchpad_service)
+(type vold_service)
+(roletype object_r vold_service)
+(type vr_hwc_service)
+(roletype object_r vr_hwc_service)
+(type vrflinger_vsync_service)
+(roletype object_r vrflinger_vsync_service)
+(type accessibility_service)
+(roletype object_r accessibility_service)
+(type account_service)
+(roletype object_r account_service)
+(type activity_service)
+(roletype object_r activity_service)
+(type activity_task_service)
+(roletype object_r activity_task_service)
+(type adb_service)
+(roletype object_r adb_service)
+(type adservices_manager_service)
+(roletype object_r adservices_manager_service)
+(type alarm_service)
+(roletype object_r alarm_service)
+(type app_binding_service)
+(roletype object_r app_binding_service)
+(type app_function_service)
+(roletype object_r app_function_service)
+(type app_hibernation_service)
+(roletype object_r app_hibernation_service)
+(type app_integrity_service)
+(roletype object_r app_integrity_service)
+(type app_prediction_service)
+(roletype object_r app_prediction_service)
+(type app_search_service)
+(roletype object_r app_search_service)
+(type appops_service)
+(roletype object_r appops_service)
+(type appwidget_service)
+(roletype object_r appwidget_service)
+(type archive_service)
+(roletype object_r archive_service)
+(type assetatlas_service)
+(roletype object_r assetatlas_service)
+(type attestation_verification_service)
+(roletype object_r attestation_verification_service)
+(type audio_service)
+(roletype object_r audio_service)
+(type auth_service)
+(roletype object_r auth_service)
+(type autofill_service)
+(roletype object_r autofill_service)
+(type backup_service)
+(roletype object_r backup_service)
+(type batterystats_service)
+(roletype object_r batterystats_service)
+(type battery_service)
+(roletype object_r battery_service)
+(type binder_calls_stats_service)
+(roletype object_r binder_calls_stats_service)
+(type blob_store_service)
+(roletype object_r blob_store_service)
+(type bluetooth_manager_service)
+(roletype object_r bluetooth_manager_service)
+(type broadcastradio_service)
+(roletype object_r broadcastradio_service)
+(type cacheinfo_service)
+(roletype object_r cacheinfo_service)
+(type cameraproxy_service)
+(roletype object_r cameraproxy_service)
+(type clipboard_service)
+(roletype object_r clipboard_service)
+(type cloudsearch_service)
+(roletype object_r cloudsearch_service)
+(type contexthub_service)
+(roletype object_r contexthub_service)
+(type contextual_search_service)
+(roletype object_r contextual_search_service)
+(type crossprofileapps_service)
+(roletype object_r crossprofileapps_service)
+(type IProxyService_service)
+(roletype object_r IProxyService_service)
+(type companion_device_service)
+(roletype object_r companion_device_service)
+(type connectivity_native_service)
+(roletype object_r connectivity_native_service)
+(type connectivity_service)
+(roletype object_r connectivity_service)
+(type connmetrics_service)
+(roletype object_r connmetrics_service)
+(type consumer_ir_service)
+(roletype object_r consumer_ir_service)
+(type content_capture_service)
+(roletype object_r content_capture_service)
+(type content_suggestions_service)
+(roletype object_r content_suggestions_service)
+(type content_service)
+(roletype object_r content_service)
+(type country_detector_service)
+(roletype object_r country_detector_service)
+(type coverage_service)
+(roletype object_r coverage_service)
+(type cpuinfo_service)
+(roletype object_r cpuinfo_service)
+(type cpu_monitor_service)
+(roletype object_r cpu_monitor_service)
+(type credential_service)
+(roletype object_r credential_service)
+(type dataloader_manager_service)
+(roletype object_r dataloader_manager_service)
+(type dbinfo_service)
+(roletype object_r dbinfo_service)
+(type device_config_service)
+(roletype object_r device_config_service)
+(type device_policy_service)
+(roletype object_r device_policy_service)
+(type device_state_service)
+(roletype object_r device_state_service)
+(type deviceidle_service)
+(roletype object_r deviceidle_service)
+(type device_identifiers_service)
+(roletype object_r device_identifiers_service)
+(type devicestoragemonitor_service)
+(roletype object_r devicestoragemonitor_service)
+(type diskstats_service)
+(roletype object_r diskstats_service)
+(type display_service)
+(roletype object_r display_service)
+(type domain_verification_service)
+(roletype object_r domain_verification_service)
+(type color_display_service)
+(roletype object_r color_display_service)
+(type ecm_enhanced_confirmation_service)
+(roletype object_r ecm_enhanced_confirmation_service)
+(type external_vibrator_service)
+(roletype object_r external_vibrator_service)
+(type file_integrity_service)
+(roletype object_r file_integrity_service)
+(type font_service)
+(roletype object_r font_service)
+(type netd_listener_service)
+(roletype object_r netd_listener_service)
+(type network_watchlist_service)
+(roletype object_r network_watchlist_service)
+(type devicelock_service)
+(roletype object_r devicelock_service)
+(type DockObserver_service)
+(roletype object_r DockObserver_service)
+(type dreams_service)
+(roletype object_r dreams_service)
+(type dropbox_service)
+(roletype object_r dropbox_service)
+(type ethernet_service)
+(roletype object_r ethernet_service)
+(type biometric_service)
+(roletype object_r biometric_service)
+(type bugreport_service)
+(roletype object_r bugreport_service)
+(type platform_compat_service)
+(roletype object_r platform_compat_service)
+(type face_service)
+(roletype object_r face_service)
+(type fingerprint_service)
+(roletype object_r fingerprint_service)
+(type fwk_altitude_service)
+(roletype object_r fwk_altitude_service)
+(type fwk_stats_service)
+(roletype object_r fwk_stats_service)
+(type fwk_sensor_service)
+(roletype object_r fwk_sensor_service)
+(type fwk_vibrator_control_service)
+(roletype object_r fwk_vibrator_control_service)
+(type game_service)
+(roletype object_r game_service)
+(type gfxinfo_service)
+(roletype object_r gfxinfo_service)
+(type gnss_time_update_service)
+(roletype object_r gnss_time_update_service)
+(type grammatical_inflection_service)
+(roletype object_r grammatical_inflection_service)
+(type graphicsstats_service)
+(roletype object_r graphicsstats_service)
+(type hardware_service)
+(roletype object_r hardware_service)
+(type hardware_properties_service)
+(roletype object_r hardware_properties_service)
+(type hdmi_control_service)
+(roletype object_r hdmi_control_service)
+(type healthconnect_service)
+(roletype object_r healthconnect_service)
+(type hint_service)
+(roletype object_r hint_service)
+(type imms_service)
+(roletype object_r imms_service)
+(type incremental_service)
+(roletype object_r incremental_service)
+(type input_method_service)
+(roletype object_r input_method_service)
+(type input_service)
+(roletype object_r input_service)
+(type intrusion_detection_service)
+(roletype object_r intrusion_detection_service)
+(type ipsec_service)
+(roletype object_r ipsec_service)
+(type iris_service)
+(roletype object_r iris_service)
+(type jobscheduler_service)
+(roletype object_r jobscheduler_service)
+(type launcherapps_service)
+(roletype object_r launcherapps_service)
+(type legacy_permission_service)
+(roletype object_r legacy_permission_service)
+(type light_service)
+(roletype object_r light_service)
+(type locale_service)
+(roletype object_r locale_service)
+(type location_service)
+(roletype object_r location_service)
+(type location_time_zone_manager_service)
+(roletype object_r location_time_zone_manager_service)
+(type lock_settings_service)
+(roletype object_r lock_settings_service)
+(type looper_stats_service)
+(roletype object_r looper_stats_service)
+(type media_communication_service)
+(roletype object_r media_communication_service)
+(type media_metrics_service)
+(roletype object_r media_metrics_service)
+(type media_projection_service)
+(roletype object_r media_projection_service)
+(type media_quality_service)
+(roletype object_r media_quality_service)
+(type media_router_service)
+(roletype object_r media_router_service)
+(type media_session_service)
+(roletype object_r media_session_service)
+(type meminfo_service)
+(roletype object_r meminfo_service)
+(type memtrackproxy_service)
+(roletype object_r memtrackproxy_service)
+(type midi_service)
+(roletype object_r midi_service)
+(type mount_service)
+(roletype object_r mount_service)
+(type music_recognition_service)
+(roletype object_r music_recognition_service)
+(type nearby_service)
+(roletype object_r nearby_service)
+(type netpolicy_service)
+(roletype object_r netpolicy_service)
+(type netstats_service)
+(roletype object_r netstats_service)
+(type network_management_service)
+(roletype object_r network_management_service)
+(type network_score_service)
+(roletype object_r network_score_service)
+(type network_stack_service)
+(roletype object_r network_stack_service)
+(type network_time_update_service)
+(roletype object_r network_time_update_service)
+(type notification_service)
+(roletype object_r notification_service)
+(type oem_lock_service)
+(roletype object_r oem_lock_service)
+(type otadexopt_service)
+(roletype object_r otadexopt_service)
+(type overlay_service)
+(roletype object_r overlay_service)
+(type pac_proxy_service)
+(roletype object_r pac_proxy_service)
+(type package_service)
+(roletype object_r package_service)
+(type package_native_service)
+(roletype object_r package_native_service)
+(type people_service)
+(roletype object_r people_service)
+(type permission_service)
+(roletype object_r permission_service)
+(type permissionmgr_service)
+(roletype object_r permissionmgr_service)
+(type permission_checker_service)
+(roletype object_r permission_checker_service)
+(type persistent_data_block_service)
+(roletype object_r persistent_data_block_service)
+(type pinner_service)
+(roletype object_r pinner_service)
+(type powerstats_service)
+(roletype object_r powerstats_service)
+(type power_service)
+(roletype object_r power_service)
+(type print_service)
+(roletype object_r print_service)
+(type processinfo_service)
+(roletype object_r processinfo_service)
+(type procstats_service)
+(roletype object_r procstats_service)
+(type reboot_readiness_service)
+(roletype object_r reboot_readiness_service)
+(type recovery_service)
+(roletype object_r recovery_service)
+(type registry_service)
+(roletype object_r registry_service)
+(type remote_auth_service)
+(roletype object_r remote_auth_service)
+(type remote_provisioning_service)
+(roletype object_r remote_provisioning_service)
+(type resources_manager_service)
+(roletype object_r resources_manager_service)
+(type restrictions_service)
+(roletype object_r restrictions_service)
+(type role_service)
+(roletype object_r role_service)
+(type rollback_service)
+(roletype object_r rollback_service)
+(type runtime_service)
+(roletype object_r runtime_service)
+(type rttmanager_service)
+(roletype object_r rttmanager_service)
+(type samplingprofiler_service)
+(roletype object_r samplingprofiler_service)
+(type scheduling_policy_service)
+(roletype object_r scheduling_policy_service)
+(type search_service)
+(roletype object_r search_service)
+(type search_ui_service)
+(roletype object_r search_ui_service)
+(type sec_key_att_app_id_provider_service)
+(roletype object_r sec_key_att_app_id_provider_service)
+(type security_state_service)
+(roletype object_r security_state_service)
+(type selection_toolbar_service)
+(roletype object_r selection_toolbar_service)
+(type sensitive_content_protection_service)
+(roletype object_r sensitive_content_protection_service)
+(type sensorservice_service)
+(roletype object_r sensorservice_service)
+(type sensor_privacy_service)
+(roletype object_r sensor_privacy_service)
+(type serial_service)
+(roletype object_r serial_service)
+(type servicediscovery_service)
+(roletype object_r servicediscovery_service)
+(type settings_service)
+(roletype object_r settings_service)
+(type shortcut_service)
+(roletype object_r shortcut_service)
+(type slice_service)
+(roletype object_r slice_service)
+(type smartspace_service)
+(roletype object_r smartspace_service)
+(type statusbar_service)
+(roletype object_r statusbar_service)
+(type storagestats_service)
+(roletype object_r storagestats_service)
+(type sdk_sandbox_service)
+(roletype object_r sdk_sandbox_service)
+(type system_config_service)
+(roletype object_r system_config_service)
+(type system_server_dumper_service)
+(roletype object_r system_server_dumper_service)
+(type system_update_service)
+(roletype object_r system_update_service)
+(type soundtrigger_middleware_service)
+(roletype object_r soundtrigger_middleware_service)
+(type speech_recognition_service)
+(roletype object_r speech_recognition_service)
+(type tare_service)
+(roletype object_r tare_service)
+(type task_service)
+(roletype object_r task_service)
+(type testharness_service)
+(roletype object_r testharness_service)
+(type textclassification_service)
+(roletype object_r textclassification_service)
+(type textservices_service)
+(roletype object_r textservices_service)
+(type texttospeech_service)
+(roletype object_r texttospeech_service)
+(type telecom_service)
+(roletype object_r telecom_service)
+(type thermal_service)
+(roletype object_r thermal_service)
+(type threadnetwork_service)
+(roletype object_r threadnetwork_service)
+(type timedetector_service)
+(roletype object_r timedetector_service)
+(type timezonedetector_service)
+(roletype object_r timezonedetector_service)
+(type translation_service)
+(roletype object_r translation_service)
+(type trust_service)
+(roletype object_r trust_service)
+(type tv_ad_service)
+(roletype object_r tv_ad_service)
+(type tv_iapp_service)
+(roletype object_r tv_iapp_service)
+(type tv_input_service)
+(roletype object_r tv_input_service)
+(type tv_tuner_resource_mgr_service)
+(roletype object_r tv_tuner_resource_mgr_service)
+(type uimode_service)
+(roletype object_r uimode_service)
+(type updatelock_service)
+(roletype object_r updatelock_service)
+(type uri_grants_service)
+(roletype object_r uri_grants_service)
+(type usagestats_service)
+(roletype object_r usagestats_service)
+(type usb_service)
+(roletype object_r usb_service)
+(type user_service)
+(roletype object_r user_service)
+(type uwb_service)
+(roletype object_r uwb_service)
+(type vcn_management_service)
+(roletype object_r vcn_management_service)
+(type vibrator_service)
+(roletype object_r vibrator_service)
+(type vibrator_manager_service)
+(roletype object_r vibrator_manager_service)
+(type virtual_device_service)
+(roletype object_r virtual_device_service)
+(type virtual_device_native_service)
+(roletype object_r virtual_device_native_service)
+(type voiceinteraction_service)
+(roletype object_r voiceinteraction_service)
+(type vpn_management_service)
+(roletype object_r vpn_management_service)
+(type vr_manager_service)
+(roletype object_r vr_manager_service)
+(type wallpaper_service)
+(roletype object_r wallpaper_service)
+(type wallpaper_effects_generation_service)
+(roletype object_r wallpaper_effects_generation_service)
+(type webviewupdate_service)
+(roletype object_r webviewupdate_service)
+(type wifip2p_service)
+(roletype object_r wifip2p_service)
+(type wifiscanner_service)
+(roletype object_r wifiscanner_service)
+(type wifi_service)
+(roletype object_r wifi_service)
+(type wifinl80211_service)
+(roletype object_r wifinl80211_service)
+(type wifiaware_service)
+(roletype object_r wifiaware_service)
+(type wifi_usd_service)
+(roletype object_r wifi_usd_service)
+(type window_service)
+(roletype object_r window_service)
+(type inputflinger_service)
+(roletype object_r inputflinger_service)
+(type tethering_service)
+(roletype object_r tethering_service)
+(type emergency_affordance_service)
+(roletype object_r emergency_affordance_service)
+(type hal_audio_service)
+(roletype object_r hal_audio_service)
+(type hal_audiocontrol_service)
+(roletype object_r hal_audiocontrol_service)
+(type hal_authgraph_service)
+(roletype object_r hal_authgraph_service)
+(type hal_authsecret_service)
+(roletype object_r hal_authsecret_service)
+(type hal_bluetooth_service)
+(roletype object_r hal_bluetooth_service)
+(type hal_bootctl_service)
+(roletype object_r hal_bootctl_service)
+(type hal_broadcastradio_service)
+(roletype object_r hal_broadcastradio_service)
+(type hal_camera_service)
+(roletype object_r hal_camera_service)
+(type hal_can_controller_service)
+(roletype object_r hal_can_controller_service)
+(type hal_cas_service)
+(roletype object_r hal_cas_service)
+(type hal_codec2_service)
+(roletype object_r hal_codec2_service)
+(type hal_confirmationui_service)
+(roletype object_r hal_confirmationui_service)
+(type hal_contexthub_service)
+(roletype object_r hal_contexthub_service)
+(type hal_drm_service)
+(roletype object_r hal_drm_service)
+(type hal_dumpstate_service)
+(roletype object_r hal_dumpstate_service)
+(type hal_evs_service)
+(roletype object_r hal_evs_service)
+(type hal_face_service)
+(roletype object_r hal_face_service)
+(type hal_fastboot_service)
+(roletype object_r hal_fastboot_service)
+(type hal_fingerprint_service)
+(roletype object_r hal_fingerprint_service)
+(type hal_gnss_service)
+(roletype object_r hal_gnss_service)
+(type hal_graphics_allocator_service)
+(roletype object_r hal_graphics_allocator_service)
+(type hal_graphics_composer_service)
+(roletype object_r hal_graphics_composer_service)
+(type hal_graphics_mapper_service)
+(roletype object_r hal_graphics_mapper_service)
+(type hal_health_service)
+(roletype object_r hal_health_service)
+(type hal_health_storage_service)
+(roletype object_r hal_health_storage_service)
+(type hal_identity_service)
+(roletype object_r hal_identity_service)
+(type hal_input_processor_service)
+(roletype object_r hal_input_processor_service)
+(type hal_ir_service)
+(roletype object_r hal_ir_service)
+(type hal_ivn_service)
+(roletype object_r hal_ivn_service)
+(type hal_keymint_service)
+(roletype object_r hal_keymint_service)
+(type hal_light_service)
+(roletype object_r hal_light_service)
+(type hal_macsec_service)
+(roletype object_r hal_macsec_service)
+(type hal_mediaquality_service)
+(roletype object_r hal_mediaquality_service)
+(type hal_memtrack_service)
+(roletype object_r hal_memtrack_service)
+(type hal_neuralnetworks_service)
+(roletype object_r hal_neuralnetworks_service)
+(type hal_nfc_service)
+(roletype object_r hal_nfc_service)
+(type hal_oemlock_service)
+(roletype object_r hal_oemlock_service)
+(type hal_power_service)
+(roletype object_r hal_power_service)
+(type hal_power_stats_service)
+(roletype object_r hal_power_stats_service)
+(type hal_radio_service)
+(roletype object_r hal_radio_service)
+(type hal_rebootescrow_service)
+(roletype object_r hal_rebootescrow_service)
+(type hal_remoteaccess_service)
+(roletype object_r hal_remoteaccess_service)
+(type hal_remotelyprovisionedcomponent_avf_service)
+(roletype object_r hal_remotelyprovisionedcomponent_avf_service)
+(type hal_remotelyprovisionedcomponent_service)
+(roletype object_r hal_remotelyprovisionedcomponent_service)
+(type hal_sensors_service)
+(roletype object_r hal_sensors_service)
+(type hal_secretkeeper_service)
+(roletype object_r hal_secretkeeper_service)
+(type hal_secureclock_service)
+(roletype object_r hal_secureclock_service)
+(type hal_secure_element_service)
+(roletype object_r hal_secure_element_service)
+(type hal_sharedsecret_service)
+(roletype object_r hal_sharedsecret_service)
+(type hal_system_suspend_service)
+(roletype object_r hal_system_suspend_service)
+(type hal_tetheroffload_service)
+(roletype object_r hal_tetheroffload_service)
+(type hal_thermal_service)
+(roletype object_r hal_thermal_service)
+(type hal_tv_hdmi_cec_service)
+(roletype object_r hal_tv_hdmi_cec_service)
+(type hal_tv_hdmi_connection_service)
+(roletype object_r hal_tv_hdmi_connection_service)
+(type hal_tv_hdmi_earc_service)
+(roletype object_r hal_tv_hdmi_earc_service)
+(type hal_tv_input_service)
+(roletype object_r hal_tv_input_service)
+(type hal_threadnetwork_service)
+(roletype object_r hal_threadnetwork_service)
+(type hal_tv_tuner_service)
+(roletype object_r hal_tv_tuner_service)
+(type hal_usb_service)
+(roletype object_r hal_usb_service)
+(type hal_usb_gadget_service)
+(roletype object_r hal_usb_gadget_service)
+(type hal_uwb_service)
+(roletype object_r hal_uwb_service)
+(type hal_vehicle_service)
+(roletype object_r hal_vehicle_service)
+(type hal_vibrator_service)
+(roletype object_r hal_vibrator_service)
+(type hal_weaver_service)
+(roletype object_r hal_weaver_service)
+(type hal_nlinterceptor_service)
+(roletype object_r hal_nlinterceptor_service)
+(type hal_wifi_service)
+(roletype object_r hal_wifi_service)
+(type hal_wifi_hostapd_service)
+(roletype object_r hal_wifi_hostapd_service)
+(type hal_wifi_supplicant_service)
+(roletype object_r hal_wifi_supplicant_service)
+(type hal_gatekeeper_service)
+(roletype object_r hal_gatekeeper_service)
+(type hal_vm_capabilities_service)
+(roletype object_r hal_vm_capabilities_service)
+(type servicemanager)
+(roletype object_r servicemanager)
+(type servicemanager_exec)
+(roletype object_r servicemanager_exec)
+(type sgdisk)
+(roletype object_r sgdisk)
+(type sgdisk_exec)
+(roletype object_r sgdisk_exec)
+(type shared_relro)
+(roletype object_r shared_relro)
+(type shell)
+(roletype object_r shell)
+(type shell_exec)
+(roletype object_r shell_exec)
+(type simpleperf)
+(roletype object_r simpleperf)
+(type simpleperf_app_runner)
+(roletype object_r simpleperf_app_runner)
+(type simpleperf_app_runner_exec)
+(roletype object_r simpleperf_app_runner_exec)
+(type slideshow)
+(roletype object_r slideshow)
+(type statsd)
+(roletype object_r statsd)
+(type statsd_exec)
+(roletype object_r statsd_exec)
+(type su)
+(roletype object_r su)
+(type su_exec)
+(roletype object_r su_exec)
+(type surfaceflinger)
+(roletype object_r surfaceflinger)
+(type surfaceflinger_tmpfs)
+(roletype object_r surfaceflinger_tmpfs)
+(type system_app)
+(roletype object_r system_app)
+(type system_server)
+(roletype object_r system_server)
+(type system_server_tmpfs)
+(roletype object_r system_server_tmpfs)
+(type tee)
+(roletype object_r tee)
+(type tee_device)
+(roletype object_r tee_device)
+(type tombstoned)
+(roletype object_r tombstoned)
+(type tombstoned_exec)
+(roletype object_r tombstoned_exec)
+(type toolbox)
+(roletype object_r toolbox)
+(type toolbox_exec)
+(roletype object_r toolbox_exec)
+(type traced)
+(roletype object_r traced)
+(type traced_tmpfs)
+(roletype object_r traced_tmpfs)
+(type traced_perf)
+(roletype object_r traced_perf)
+(type traced_probes)
+(roletype object_r traced_probes)
+(type traceur_app)
+(roletype object_r traceur_app)
+(type ueventd)
+(roletype object_r ueventd)
+(type ueventd_tmpfs)
+(roletype object_r ueventd_tmpfs)
+(type uncrypt)
+(roletype object_r uncrypt)
+(type uncrypt_exec)
+(roletype object_r uncrypt_exec)
+(type untrusted_app)
+(roletype object_r untrusted_app)
+(type untrusted_app_32)
+(roletype object_r untrusted_app_32)
+(type untrusted_app_30)
+(roletype object_r untrusted_app_30)
+(type untrusted_app_29)
+(roletype object_r untrusted_app_29)
+(type untrusted_app_27)
+(roletype object_r untrusted_app_27)
+(type untrusted_app_25)
+(roletype object_r untrusted_app_25)
+(type update_engine)
+(roletype object_r update_engine)
+(type update_engine_exec)
+(roletype object_r update_engine_exec)
+(type update_verifier)
+(roletype object_r update_verifier)
+(type update_verifier_exec)
+(roletype object_r update_verifier_exec)
+(type usbd)
+(roletype object_r usbd)
+(type usbd_exec)
+(roletype object_r usbd_exec)
+(type vdc)
+(roletype object_r vdc)
+(type vdc_exec)
+(roletype object_r vdc_exec)
+(type vendor_init)
+(roletype object_r vendor_init)
+(type vendor_misc_writer)
+(roletype object_r vendor_misc_writer)
+(type vendor_misc_writer_exec)
+(roletype object_r vendor_misc_writer_exec)
+(type vendor_modprobe)
+(roletype object_r vendor_modprobe)
+(type vendor_shell)
+(roletype object_r vendor_shell)
+(type vendor_shell_exec)
+(roletype object_r vendor_shell_exec)
+(type vendor_toolbox_exec)
+(roletype object_r vendor_toolbox_exec)
+(type virtual_camera)
+(roletype object_r virtual_camera)
+(type virtual_camera_exec)
+(roletype object_r virtual_camera_exec)
+(type virtual_touchpad)
+(roletype object_r virtual_touchpad)
+(type virtual_touchpad_exec)
+(roletype object_r virtual_touchpad_exec)
+(type virtualizationmanager)
+(roletype object_r virtualizationmanager)
+(type virtualizationmanager_exec)
+(roletype object_r virtualizationmanager_exec)
+(type service_manager_vndservice)
+(roletype object_r service_manager_vndservice)
+(type default_android_vndservice)
+(roletype object_r default_android_vndservice)
+(type vndservicemanager)
+(roletype object_r vndservicemanager)
+(type vold)
+(roletype object_r vold)
+(type vold_exec)
+(roletype object_r vold_exec)
+(type vold_prepare_subdirs)
+(roletype object_r vold_prepare_subdirs)
+(type vold_prepare_subdirs_exec)
+(roletype object_r vold_prepare_subdirs_exec)
+(type watchdogd)
+(roletype object_r watchdogd)
+(type watchdogd_exec)
+(roletype object_r watchdogd_exec)
+(type webview_zygote)
+(roletype object_r webview_zygote)
+(type webview_zygote_exec)
+(roletype object_r webview_zygote_exec)
+(type webview_zygote_tmpfs)
+(roletype object_r webview_zygote_tmpfs)
+(type wificond)
+(roletype object_r wificond)
+(type wificond_exec)
+(roletype object_r wificond_exec)
+(type zygote)
+(roletype object_r zygote)
+(type zygote_tmpfs)
+(roletype object_r zygote_tmpfs)
+(type zygote_exec)
+(roletype object_r zygote_exec)
+(typeattribute hal_lazy_test)
+(expandtypeattribute (hal_lazy_test) true)
+(typeattribute hal_lazy_test_client)
+(expandtypeattribute (hal_lazy_test_client) true)
+(typeattribute hal_lazy_test_server)
+(expandtypeattribute (hal_lazy_test_server) false)
+(typeattribute mlsvendorcompat)
+(typeattribute system_and_vendor_property_type)
+(expandtypeattribute (system_and_vendor_property_type) false)
+(typeattribute sdk_sandbox_all)
+(typeattributeset sdk_sandbox_all (sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next ))
+(typeattribute sdk_sandbox_current)
+(typeattributeset sdk_sandbox_current (sdk_sandbox_34 sdk_sandbox_audit ))
+(typeattribute adbd_common)
+(typeattributeset adbd_common (adbd adbd_tradeinmode ))
+(typeattribute update_provider)
+(expandtypeattribute (update_provider) false)
+(type aconfigd)
+(roletype object_r aconfigd)
+(type aconfigd_exec)
+(roletype object_r aconfigd_exec)
+(type aconfigd_mainline)
+(roletype object_r aconfigd_mainline)
+(type aconfigd_mainline_exec)
+(roletype object_r aconfigd_mainline_exec)
+(type adbd_tradeinmode)
+(roletype object_r adbd_tradeinmode)
+(type apex_test_prepostinstall)
+(roletype object_r apex_test_prepostinstall)
+(type apex_test_prepostinstall_exec)
+(roletype object_r apex_test_prepostinstall_exec)
+(type apexd_devpts)
+(roletype object_r apexd_devpts)
+(type apexd_derive_classpath)
+(roletype object_r apexd_derive_classpath)
+(type app_zygote_userfaultfd)
+(roletype object_r app_zygote_userfaultfd)
+(type art_boot)
+(roletype object_r art_boot)
+(type art_boot_exec)
+(roletype object_r art_boot_exec)
+(type art_exec)
+(roletype object_r art_exec)
+(type art_exec_exec)
+(roletype object_r art_exec_exec)
+(type artd_exec)
+(roletype object_r artd_exec)
+(type artd_tmpfs)
+(roletype object_r artd_tmpfs)
+(typeattribute artd_subprocess_type)
+(typeattributeset artd_subprocess_type (profman derive_classpath dex2oat odrefresh ))
+(type artd_userfaultfd)
+(roletype object_r artd_userfaultfd)
+(type atrace_exec)
+(roletype object_r atrace_exec)
+(type audioserver_exec)
+(roletype object_r audioserver_exec)
+(type auditctl)
+(roletype object_r auditctl)
+(type auditctl_exec)
+(roletype object_r auditctl_exec)
+(type automotive_display_service)
+(roletype object_r automotive_display_service)
+(type automotive_display_service_exec)
+(roletype object_r automotive_display_service_exec)
+(type bert_collector)
+(roletype object_r bert_collector)
+(type bert_collector_exec)
+(roletype object_r bert_collector_exec)
+(type blank_screen)
+(roletype object_r blank_screen)
+(type blank_screen_exec)
+(roletype object_r blank_screen_exec)
+(type blkid_exec)
+(roletype object_r blkid_exec)
+(type bluetooth_userfaultfd)
+(roletype object_r bluetooth_userfaultfd)
+(type boringssl_self_test)
+(roletype object_r boringssl_self_test)
+(type boringssl_self_test_exec)
+(roletype object_r boringssl_self_test_exec)
+(type vendor_boringssl_self_test)
+(roletype object_r vendor_boringssl_self_test)
+(type vendor_boringssl_self_test_exec)
+(roletype object_r vendor_boringssl_self_test_exec)
+(type boringssl_self_test_marker)
+(roletype object_r boringssl_self_test_marker)
+(type bpfloader_exec)
+(roletype object_r bpfloader_exec)
+(type canhalconfigurator)
+(roletype object_r canhalconfigurator)
+(type canhalconfigurator_exec)
+(roletype object_r canhalconfigurator_exec)
+(type clatd)
+(roletype object_r clatd)
+(type clatd_exec)
+(roletype object_r clatd_exec)
+(type compos_fd_server)
+(roletype object_r compos_fd_server)
+(type compos_verify)
+(roletype object_r compos_verify)
+(type compos_verify_exec)
+(roletype object_r compos_verify_exec)
+(type composd)
+(roletype object_r composd)
+(type composd_exec)
+(roletype object_r composd_exec)
+(type cppreopts)
+(roletype object_r cppreopts)
+(type cppreopts_exec)
+(roletype object_r cppreopts_exec)
+(type crosvm_exec)
+(roletype object_r crosvm_exec)
+(type crosvm_tmpfs)
+(roletype object_r crosvm_tmpfs)
+(type derive_classpath)
+(roletype object_r derive_classpath)
+(type derive_classpath_exec)
+(roletype object_r derive_classpath_exec)
+(type derive_sdk)
+(roletype object_r derive_sdk)
+(type derive_sdk_exec)
+(roletype object_r derive_sdk_exec)
+(type device_as_webcam)
+(roletype object_r device_as_webcam)
+(type device_as_webcam_userfaultfd)
+(roletype object_r device_as_webcam_userfaultfd)
+(type dex2oat)
+(roletype object_r dex2oat)
+(type dex2oat_exec)
+(roletype object_r dex2oat_exec)
+(type dex2oat_userfaultfd)
+(roletype object_r dex2oat_userfaultfd)
+(type dexopt_chroot_setup)
+(roletype object_r dexopt_chroot_setup)
+(type dexopt_chroot_setup_exec)
+(roletype object_r dexopt_chroot_setup_exec)
+(type dexopt_chroot_setup_tmpfs)
+(roletype object_r dexopt_chroot_setup_tmpfs)
+(type dexopt_chroot_setup_userfaultfd)
+(roletype object_r dexopt_chroot_setup_userfaultfd)
+(type dexoptanalyzer_exec)
+(roletype object_r dexoptanalyzer_exec)
+(type dmesgd)
+(roletype object_r dmesgd)
+(type dmesgd_exec)
+(roletype object_r dmesgd_exec)
+(type dumpstate_tmpfs)
+(roletype object_r dumpstate_tmpfs)
+(type ephemeral_app_userfaultfd)
+(roletype object_r ephemeral_app_userfaultfd)
+(type evsmanagerd_exec)
+(roletype object_r evsmanagerd_exec)
+(type fastbootd_iouring)
+(roletype object_r fastbootd_iouring)
+(type proc_allocinfo)
+(roletype object_r proc_allocinfo)
+(type config_gz)
+(roletype object_r config_gz)
+(type fs_bpf_net_private)
+(roletype object_r fs_bpf_net_private)
+(type fs_bpf_net_shared)
+(roletype object_r fs_bpf_net_shared)
+(type fs_bpf_netd_readonly)
+(roletype object_r fs_bpf_netd_readonly)
+(type fs_bpf_netd_shared)
+(roletype object_r fs_bpf_netd_shared)
+(type fs_bpf_loader)
+(roletype object_r fs_bpf_loader)
+(type fs_bpf_uprobestats)
+(roletype object_r fs_bpf_uprobestats)
+(type fs_bpf_memevents)
+(roletype object_r fs_bpf_memevents)
+(type storaged_data_file)
+(roletype object_r storaged_data_file)
+(type wm_trace_data_file)
+(roletype object_r wm_trace_data_file)
+(type accessibility_trace_data_file)
+(roletype object_r accessibility_trace_data_file)
+(type perfetto_traces_data_file)
+(roletype object_r perfetto_traces_data_file)
+(type perfetto_traces_bugreport_data_file)
+(roletype object_r perfetto_traces_bugreport_data_file)
+(type perfetto_traces_profiling_data_file)
+(roletype object_r perfetto_traces_profiling_data_file)
+(type perfetto_configs_data_file)
+(roletype object_r perfetto_configs_data_file)
+(type system_perfetto_config_file)
+(roletype object_r system_perfetto_config_file)
+(type uprobestats_configs_data_file)
+(roletype object_r uprobestats_configs_data_file)
+(type oatdump_exec)
+(roletype object_r oatdump_exec)
+(type sdk_sandbox_system_data_file)
+(roletype object_r sdk_sandbox_system_data_file)
+(type sdk_sandbox_data_file)
+(roletype object_r sdk_sandbox_data_file)
+(type debugfs_kcov)
+(roletype object_r debugfs_kcov)
+(type app_exec_data_file)
+(roletype object_r app_exec_data_file)
+(type rollback_data_file)
+(roletype object_r rollback_data_file)
+(type checkin_data_file)
+(roletype object_r checkin_data_file)
+(type ota_image_data_file)
+(roletype object_r ota_image_data_file)
+(type gsi_persistent_data_file)
+(roletype object_r gsi_persistent_data_file)
+(type emergency_data_file)
+(roletype object_r emergency_data_file)
+(type profcollectd_data_file)
+(roletype object_r profcollectd_data_file)
+(type apex_art_data_file)
+(roletype object_r apex_art_data_file)
+(type apex_art_staging_data_file)
+(roletype object_r apex_art_staging_data_file)
+(type apex_compos_data_file)
+(roletype object_r apex_compos_data_file)
+(type apex_virt_data_file)
+(roletype object_r apex_virt_data_file)
+(type apex_tethering_data_file)
+(roletype object_r apex_tethering_data_file)
+(type apex_uwb_data_file)
+(roletype object_r apex_uwb_data_file)
+(type apex_appsearch_data_file)
+(roletype object_r apex_appsearch_data_file)
+(type apex_permission_data_file)
+(roletype object_r apex_permission_data_file)
+(type apex_scheduling_data_file)
+(roletype object_r apex_scheduling_data_file)
+(type apex_wifi_data_file)
+(roletype object_r apex_wifi_data_file)
+(type font_data_file)
+(roletype object_r font_data_file)
+(type dmesgd_data_file)
+(roletype object_r dmesgd_data_file)
+(type odrefresh_data_file)
+(roletype object_r odrefresh_data_file)
+(type odsign_data_file)
+(roletype object_r odsign_data_file)
+(type odsign_metrics_file)
+(roletype object_r odsign_metrics_file)
+(type virtualizationservice_data_file)
+(roletype object_r virtualizationservice_data_file)
+(type vm_data_file)
+(roletype object_r vm_data_file)
+(type environ_system_data_file)
+(roletype object_r environ_system_data_file)
+(type bootanim_data_file)
+(roletype object_r bootanim_data_file)
+(type kvm_device)
+(roletype object_r kvm_device)
+(type fd_server_exec)
+(roletype object_r fd_server_exec)
+(type compos_exec)
+(roletype object_r compos_exec)
+(type compos_key_helper_exec)
+(roletype object_r compos_key_helper_exec)
+(type prng_seeder_socket)
+(roletype object_r prng_seeder_socket)
+(type sysfs_dt_avf)
+(roletype object_r sysfs_dt_avf)
+(type proc_dt_avf)
+(roletype object_r proc_dt_avf)
+(type system_font_fallback_file)
+(roletype object_r system_font_fallback_file)
+(type sysfs_uprobe)
+(roletype object_r sysfs_uprobe)
+(type aconfigd_socket)
+(roletype object_r aconfigd_socket)
+(type aconfigd_mainline_socket)
+(roletype object_r aconfigd_mainline_socket)
+(type system_aconfig_storage_file)
+(roletype object_r system_aconfig_storage_file)
+(type vendor_aconfig_storage_file)
+(roletype object_r vendor_aconfig_storage_file)
+(type connectivityblob_data_file)
+(roletype object_r connectivityblob_data_file)
+(type mainline_supplicant_data_file)
+(roletype object_r mainline_supplicant_data_file)
+(type pre_reboot_dexopt_file)
+(roletype object_r pre_reboot_dexopt_file)
+(type pre_reboot_dexopt_artd_file)
+(roletype object_r pre_reboot_dexopt_artd_file)
+(type apk_metadata_file)
+(roletype object_r apk_metadata_file)
+(type sysfs_pgsize_migration)
+(roletype object_r sysfs_pgsize_migration)
+(type sysfs_firmware_acpi_tables)
+(roletype object_r sysfs_firmware_acpi_tables)
+(type storage_area_app_dir)
+(roletype object_r storage_area_app_dir)
+(type storage_area_dir)
+(roletype object_r storage_area_dir)
+(type storage_area_content_file)
+(roletype object_r storage_area_content_file)
+(type storage_area_key_file)
+(roletype object_r storage_area_key_file)
+(type tradeinmode_metadata_file)
+(roletype object_r tradeinmode_metadata_file)
+(type prefetch_metadata_file)
+(roletype object_r prefetch_metadata_file)
+(type libprocessgroup_metadata_file)
+(roletype object_r libprocessgroup_metadata_file)
+(type fuseblkd_exec)
+(roletype object_r fuseblkd_exec)
+(type fuseblkd)
+(roletype object_r fuseblkd)
+(type fuseblkd_untrusted_exec)
+(roletype object_r fuseblkd_untrusted_exec)
+(type fuseblkd_untrusted)
+(roletype object_r fuseblkd_untrusted)
+(type fwk_bufferhub)
+(roletype object_r fwk_bufferhub)
+(type fwk_bufferhub_exec)
+(roletype object_r fwk_bufferhub_exec)
+(type gki_apex_prepostinstall)
+(roletype object_r gki_apex_prepostinstall)
+(type gki_apex_prepostinstall_exec)
+(roletype object_r gki_apex_prepostinstall_exec)
+(type gmscore_app_userfaultfd)
+(roletype object_r gmscore_app_userfaultfd)
+(type gpuservice_exec)
+(roletype object_r gpuservice_exec)
+(type gsid)
+(roletype object_r gsid)
+(type gsid_exec)
+(roletype object_r gsid_exec)
+(type hal_allocator_default)
+(roletype object_r hal_allocator_default)
+(type hal_allocator_default_exec)
+(roletype object_r hal_allocator_default_exec)
+(type hal_keymint_system)
+(roletype object_r hal_keymint_system)
+(type hal_keymint_system_exec)
+(roletype object_r hal_keymint_system_exec)
+(type heapprofd_exec)
+(roletype object_r heapprofd_exec)
+(type heapprofd_tmpfs)
+(roletype object_r heapprofd_tmpfs)
+(type hidl_lazy_test_server)
+(roletype object_r hidl_lazy_test_server)
+(type hidl_lazy_test_server_exec)
+(roletype object_r hidl_lazy_test_server_exec)
+(type hal_lazy_test_hwservice)
+(roletype object_r hal_lazy_test_hwservice)
+(type incident_exec)
+(roletype object_r incident_exec)
+(type incident_helper_exec)
+(roletype object_r incident_helper_exec)
+(type incidentd_exec)
+(roletype object_r incidentd_exec)
+(type isolated_app_userfaultfd)
+(roletype object_r isolated_app_userfaultfd)
+(type isolated_compute_app_userfaultfd)
+(roletype object_r isolated_compute_app_userfaultfd)
+(type iw)
+(roletype object_r iw)
+(type iw_exec)
+(roletype object_r iw_exec)
+(type kcmdlinectrl)
+(roletype object_r kcmdlinectrl)
+(type kcmdlinectrl_exec)
+(roletype object_r kcmdlinectrl_exec)
+(type shell_key)
+(roletype object_r shell_key)
+(type su_key)
+(roletype object_r su_key)
+(type vold_key)
+(roletype object_r vold_key)
+(type odsign_key)
+(roletype object_r odsign_key)
+(type locksettings_key)
+(roletype object_r locksettings_key)
+(type resume_on_reboot_key)
+(roletype object_r resume_on_reboot_key)
+(type linkerconfig)
+(roletype object_r linkerconfig)
+(type linkerconfig_exec)
+(roletype object_r linkerconfig_exec)
+(type linux_vm_setup)
+(roletype object_r linux_vm_setup)
+(type linux_vm_setup_exec)
+(roletype object_r linux_vm_setup_exec)
+(type lpdumpd)
+(roletype object_r lpdumpd)
+(type lpdumpd_exec)
+(roletype object_r lpdumpd_exec)
+(type mdnsd_exec)
+(roletype object_r mdnsd_exec)
+(type mediaprovider_userfaultfd)
+(roletype object_r mediaprovider_userfaultfd)
+(type mediaprovider_app)
+(roletype object_r mediaprovider_app)
+(type mediaprovider_app_userfaultfd)
+(roletype object_r mediaprovider_app_userfaultfd)
+(type mediatranscoding_exec)
+(roletype object_r mediatranscoding_exec)
+(type mediatranscoding_tmpfs)
+(roletype object_r mediatranscoding_tmpfs)
+(type mediatuner)
+(roletype object_r mediatuner)
+(type mediatuner_exec)
+(roletype object_r mediatuner_exec)
+(type memcgv2_activation_depth)
+(roletype object_r memcgv2_activation_depth)
+(type memcgv2_activation_depth_exec)
+(roletype object_r memcgv2_activation_depth_exec)
+(type microfuchsiad)
+(roletype object_r microfuchsiad)
+(type microfuchsiad_exec)
+(roletype object_r microfuchsiad_exec)
+(type migrate_legacy_obb_data)
+(roletype object_r migrate_legacy_obb_data)
+(type migrate_legacy_obb_data_exec)
+(roletype object_r migrate_legacy_obb_data_exec)
+(type misctrl)
+(roletype object_r misctrl)
+(type misctrl_exec)
+(roletype object_r misctrl_exec)
+(type mm_events)
+(roletype object_r mm_events)
+(type mm_events_exec)
+(roletype object_r mm_events_exec)
+(type mmd)
+(roletype object_r mmd)
+(type mmd_exec)
+(roletype object_r mmd_exec)
+(type mtectrl)
+(roletype object_r mtectrl)
+(type mtectrl_exec)
+(roletype object_r mtectrl_exec)
+(type network_stack_userfaultfd)
+(roletype object_r network_stack_userfaultfd)
+(type nfc_userfaultfd)
+(roletype object_r nfc_userfaultfd)
+(type odrefresh)
+(roletype object_r odrefresh)
+(type odrefresh_exec)
+(roletype object_r odrefresh_exec)
+(type odrefresh_userfaultfd)
+(roletype object_r odrefresh_userfaultfd)
+(type odsign)
+(roletype object_r odsign)
+(type odsign_exec)
+(roletype object_r odsign_exec)
+(type odsign_devpts)
+(roletype object_r odsign_devpts)
+(type ot_ctl)
+(roletype object_r ot_ctl)
+(type ot_ctl_exec)
+(roletype object_r ot_ctl_exec)
+(type ot_daemon)
+(roletype object_r ot_daemon)
+(type ot_daemon_exec)
+(roletype object_r ot_daemon_exec)
+(type otapreopt_chroot)
+(roletype object_r otapreopt_chroot)
+(type otapreopt_chroot_exec)
+(roletype object_r otapreopt_chroot_exec)
+(type otapreopt_slot)
+(roletype object_r otapreopt_slot)
+(type otapreopt_slot_exec)
+(roletype object_r otapreopt_slot_exec)
+(type perfetto_exec)
+(roletype object_r perfetto_exec)
+(type perfetto_tmpfs)
+(roletype object_r perfetto_tmpfs)
+(type permissioncontroller_app)
+(roletype object_r permissioncontroller_app)
+(type permissioncontroller_app_userfaultfd)
+(roletype object_r permissioncontroller_app_userfaultfd)
+(type platform_app_userfaultfd)
+(roletype object_r platform_app_userfaultfd)
+(type postinstall_exec)
+(roletype object_r postinstall_exec)
+(type postinstall_dexopt)
+(roletype object_r postinstall_dexopt)
+(type postinstall_dexopt_exec)
+(roletype object_r postinstall_dexopt_exec)
+(type postinstall_dexopt_tmpfs)
+(roletype object_r postinstall_dexopt_tmpfs)
+(type prefetch)
+(roletype object_r prefetch)
+(type prefetch_exec)
+(roletype object_r prefetch_exec)
+(type preloads_copy)
+(roletype object_r preloads_copy)
+(type preloads_copy_exec)
+(roletype object_r preloads_copy_exec)
+(type preopt2cachename)
+(roletype object_r preopt2cachename)
+(type preopt2cachename_exec)
+(roletype object_r preopt2cachename_exec)
+(type priv_app_userfaultfd)
+(roletype object_r priv_app_userfaultfd)
+(type priv_app_devpts)
+(roletype object_r priv_app_devpts)
+(type prng_seeder_exec)
+(roletype object_r prng_seeder_exec)
+(type profcollectd)
+(roletype object_r profcollectd)
+(type profcollectd_exec)
+(roletype object_r profcollectd_exec)
+(type adbd_prop)
+(roletype object_r adbd_prop)
+(type adbd_tradeinmode_prop)
+(roletype object_r adbd_tradeinmode_prop)
+(type apexd_payload_metadata_prop)
+(roletype object_r apexd_payload_metadata_prop)
+(type ctl_snapuserd_prop)
+(roletype object_r ctl_snapuserd_prop)
+(type ctl_prefetch_prop)
+(roletype object_r ctl_prefetch_prop)
+(type ctl_uprobestats_prop)
+(roletype object_r ctl_uprobestats_prop)
+(type crashrecovery_prop)
+(roletype object_r crashrecovery_prop)
+(type debug_tracing_desktop_mode_visible_tasks_prop)
+(roletype object_r debug_tracing_desktop_mode_visible_tasks_prop)
+(type device_config_core_experiments_team_internal_prop)
+(roletype object_r device_config_core_experiments_team_internal_prop)
+(type device_config_lmkd_native_prop)
+(roletype object_r device_config_lmkd_native_prop)
+(type device_config_mglru_native_prop)
+(roletype object_r device_config_mglru_native_prop)
+(type device_config_mmd_native_prop)
+(roletype object_r device_config_mmd_native_prop)
+(type device_config_profcollect_native_boot_prop)
+(roletype object_r device_config_profcollect_native_boot_prop)
+(type device_config_remote_key_provisioning_native_prop)
+(roletype object_r device_config_remote_key_provisioning_native_prop)
+(type device_config_statsd_native_prop)
+(roletype object_r device_config_statsd_native_prop)
+(type device_config_statsd_native_boot_prop)
+(roletype object_r device_config_statsd_native_boot_prop)
+(type device_config_storage_native_boot_prop)
+(roletype object_r device_config_storage_native_boot_prop)
+(type device_config_sys_traced_prop)
+(roletype object_r device_config_sys_traced_prop)
+(type device_config_window_manager_native_boot_prop)
+(roletype object_r device_config_window_manager_native_boot_prop)
+(type device_config_configuration_prop)
+(roletype object_r device_config_configuration_prop)
+(type device_config_connectivity_prop)
+(roletype object_r device_config_connectivity_prop)
+(type device_config_swcodec_native_prop)
+(roletype object_r device_config_swcodec_native_prop)
+(type device_config_tethering_u_or_later_native_prop)
+(roletype object_r device_config_tethering_u_or_later_native_prop)
+(type dmesgd_start_prop)
+(roletype object_r dmesgd_start_prop)
+(type fastbootd_protocol_prop)
+(roletype object_r fastbootd_protocol_prop)
+(type gsid_prop)
+(roletype object_r gsid_prop)
+(type init_perf_lsm_hooks_prop)
+(roletype object_r init_perf_lsm_hooks_prop)
+(type init_service_status_private_prop)
+(roletype object_r init_service_status_private_prop)
+(type init_storage_prop)
+(roletype object_r init_storage_prop)
+(type init_svc_debug_prop)
+(roletype object_r init_svc_debug_prop)
+(type kcmdline_prop)
+(roletype object_r kcmdline_prop)
+(type keystore_diagnostics_prop)
+(roletype object_r keystore_diagnostics_prop)
+(type keystore_listen_prop)
+(roletype object_r keystore_listen_prop)
+(type last_boot_reason_prop)
+(roletype object_r last_boot_reason_prop)
+(type localization_prop)
+(roletype object_r localization_prop)
+(type logd_auditrate_prop)
+(roletype object_r logd_auditrate_prop)
+(type lower_kptr_restrict_prop)
+(roletype object_r lower_kptr_restrict_prop)
+(type mmd_prop)
+(roletype object_r mmd_prop)
+(type net_464xlat_fromvendor_prop)
+(roletype object_r net_464xlat_fromvendor_prop)
+(type net_connectivity_prop)
+(roletype object_r net_connectivity_prop)
+(type netd_stable_secret_prop)
+(roletype object_r netd_stable_secret_prop)
+(type next_boot_prop)
+(roletype object_r next_boot_prop)
+(type odsign_prop)
+(roletype object_r odsign_prop)
+(type misctrl_prop)
+(roletype object_r misctrl_prop)
+(type perf_drop_caches_prop)
+(roletype object_r perf_drop_caches_prop)
+(type pm_prop)
+(roletype object_r pm_prop)
+(type prefetch_service_prop)
+(roletype object_r prefetch_service_prop)
+(type profcollectd_node_id_prop)
+(roletype object_r profcollectd_node_id_prop)
+(type radio_cdma_ecm_prop)
+(roletype object_r radio_cdma_ecm_prop)
+(type remote_prov_prop)
+(roletype object_r remote_prov_prop)
+(type remote_prov_cert_prop)
+(roletype object_r remote_prov_cert_prop)
+(type rollback_test_prop)
+(roletype object_r rollback_test_prop)
+(type setupwizard_prop)
+(roletype object_r setupwizard_prop)
+(type snapshotctl_prop)
+(roletype object_r snapshotctl_prop)
+(type snapuserd_prop)
+(roletype object_r snapuserd_prop)
+(type system_adbd_prop)
+(roletype object_r system_adbd_prop)
+(type system_audio_config_prop)
+(roletype object_r system_audio_config_prop)
+(type timezone_metadata_prop)
+(roletype object_r timezone_metadata_prop)
+(type traced_perf_enabled_prop)
+(roletype object_r traced_perf_enabled_prop)
+(type uprobestats_start_with_config_prop)
+(roletype object_r uprobestats_start_with_config_prop)
+(type tuner_server_ctl_prop)
+(roletype object_r tuner_server_ctl_prop)
+(type userspace_reboot_log_prop)
+(roletype object_r userspace_reboot_log_prop)
+(type userspace_reboot_test_prop)
+(roletype object_r userspace_reboot_test_prop)
+(type verity_status_prop)
+(roletype object_r verity_status_prop)
+(type zygote_wrap_prop)
+(roletype object_r zygote_wrap_prop)
+(type ctl_mediatranscoding_prop)
+(roletype object_r ctl_mediatranscoding_prop)
+(type ctl_odsign_prop)
+(roletype object_r ctl_odsign_prop)
+(type virtualizationservice_prop)
+(roletype object_r virtualizationservice_prop)
+(type ctl_apex_load_prop)
+(roletype object_r ctl_apex_load_prop)
+(type sensors_config_prop)
+(roletype object_r sensors_config_prop)
+(type hypervisor_pvmfw_prop)
+(roletype object_r hypervisor_pvmfw_prop)
+(type hypervisor_virtualizationmanager_prop)
+(roletype object_r hypervisor_virtualizationmanager_prop)
+(type game_manager_config_prop)
+(roletype object_r game_manager_config_prop)
+(type hidl_memory_prop)
+(roletype object_r hidl_memory_prop)
+(type suspend_debug_prop)
+(roletype object_r suspend_debug_prop)
+(type system_service_enable_prop)
+(roletype object_r system_service_enable_prop)
+(type ctl_artd_pre_reboot_prop)
+(roletype object_r ctl_artd_pre_reboot_prop)
+(type trusty_security_vm_sys_prop)
+(roletype object_r trusty_security_vm_sys_prop)
+(type hint_manager_config_prop)
+(roletype object_r hint_manager_config_prop)
+(type bionic_linker_16kb_app_compat_prop)
+(roletype object_r bionic_linker_16kb_app_compat_prop)
+(type device_config_virtualization_framework_native_prop)
+(roletype object_r device_config_virtualization_framework_native_prop)
+(type fstype_prop)
+(roletype object_r fstype_prop)
+(type log_file_logger_prop)
+(roletype object_r log_file_logger_prop)
+(type persist_sysui_builder_extras_prop)
+(roletype object_r persist_sysui_builder_extras_prop)
+(type persist_sysui_ranking_update_prop)
+(roletype object_r persist_sysui_ranking_update_prop)
+(type page_size_prop)
+(roletype object_r page_size_prop)
+(type pm_16kb_app_compat_prop)
+(roletype object_r pm_16kb_app_compat_prop)
+(type avf_virtualizationservice_prop)
+(roletype object_r avf_virtualizationservice_prop)
+(type high_barometer_quality_prop)
+(roletype object_r high_barometer_quality_prop)
+(type prefetch_boot_prop)
+(roletype object_r prefetch_boot_prop)
+(type widevine_sys_vendor_prop)
+(roletype object_r widevine_sys_vendor_prop)
+(type radio_userfaultfd)
+(roletype object_r radio_userfaultfd)
+(type remount)
+(roletype object_r remount)
+(type remount_exec)
+(roletype object_r remount_exec)
+(type rkp_cert_processor)
+(roletype object_r rkp_cert_processor)
+(type rkp_cert_processor_exec)
+(roletype object_r rkp_cert_processor_exec)
+(type rkpd)
+(roletype object_r rkpd)
+(type rkpd_exec)
+(roletype object_r rkpd_exec)
+(type rkpdapp_userfaultfd)
+(roletype object_r rkpdapp_userfaultfd)
+(type rss_hwm_reset_exec)
+(roletype object_r rss_hwm_reset_exec)
+(type runas_app_userfaultfd)
+(roletype object_r runas_app_userfaultfd)
+(type sdk_sandbox_34)
+(roletype object_r sdk_sandbox_34)
+(type sdk_sandbox_34_userfaultfd)
+(roletype object_r sdk_sandbox_34_userfaultfd)
+(type sdk_sandbox_audit)
+(roletype object_r sdk_sandbox_audit)
+(type sdk_sandbox_audit_userfaultfd)
+(roletype object_r sdk_sandbox_audit_userfaultfd)
+(type sdk_sandbox_next)
+(roletype object_r sdk_sandbox_next)
+(type sdk_sandbox_next_userfaultfd)
+(roletype object_r sdk_sandbox_next_userfaultfd)
+(type secure_element_userfaultfd)
+(roletype object_r secure_element_userfaultfd)
+(type ambient_context_service)
+(roletype object_r ambient_context_service)
+(type authentication_policy_service)
+(roletype object_r authentication_policy_service)
+(type attention_service)
+(roletype object_r attention_service)
+(type bg_install_control_service)
+(roletype object_r bg_install_control_service)
+(type compos_service)
+(roletype object_r compos_service)
+(type communal_service)
+(roletype object_r communal_service)
+(type dynamic_system_service)
+(roletype object_r dynamic_system_service)
+(type feature_flags_service)
+(roletype object_r feature_flags_service)
+(type fwk_devicestate_service)
+(roletype object_r fwk_devicestate_service)
+(type gsi_service)
+(roletype object_r gsi_service)
+(type incidentcompanion_service)
+(roletype object_r incidentcompanion_service)
+(type logcat_service)
+(roletype object_r logcat_service)
+(type logd_service)
+(roletype object_r logd_service)
+(type mediatuner_service)
+(roletype object_r mediatuner_service)
+(type mmd_service)
+(roletype object_r mmd_service)
+(type on_device_intelligence_service)
+(roletype object_r on_device_intelligence_service)
+(type profcollectd_service)
+(roletype object_r profcollectd_service)
+(type protolog_configuration_service)
+(roletype object_r protolog_configuration_service)
+(type resolver_service)
+(roletype object_r resolver_service)
+(type rkpd_registrar_service)
+(roletype object_r rkpd_registrar_service)
+(type rkpd_refresh_service)
+(roletype object_r rkpd_refresh_service)
+(type rkp_cert_processor_service)
+(roletype object_r rkp_cert_processor_service)
+(type safety_center_service)
+(roletype object_r safety_center_service)
+(type stats_service)
+(roletype object_r stats_service)
+(type statsbootstrap_service)
+(roletype object_r statsbootstrap_service)
+(type statscompanion_service)
+(roletype object_r statscompanion_service)
+(type statsmanager_service)
+(roletype object_r statsmanager_service)
+(type tracingproxy_service)
+(roletype object_r tracingproxy_service)
+(type tradeinmode_service)
+(roletype object_r tradeinmode_service)
+(type transparency_service)
+(roletype object_r transparency_service)
+(type vfio_handler_service)
+(roletype object_r vfio_handler_service)
+(type virtualization_maintenance_service)
+(roletype object_r virtualization_maintenance_service)
+(type vm_tethering_service)
+(roletype object_r vm_tethering_service)
+(type vmnic_service)
+(roletype object_r vmnic_service)
+(type microfuchsia_service)
+(roletype object_r microfuchsia_service)
+(type uce_service)
+(roletype object_r uce_service)
+(type fwk_vold_service)
+(roletype object_r fwk_vold_service)
+(type wearable_sensing_service)
+(roletype object_r wearable_sensing_service)
+(type wifi_mainline_supplicant_service)
+(roletype object_r wifi_mainline_supplicant_service)
+(type dynamic_instrumentation_service)
+(roletype object_r dynamic_instrumentation_service)
+(type advanced_protection_service)
+(roletype object_r advanced_protection_service)
+(type ranging_service)
+(roletype object_r ranging_service)
+(type shared_relro_userfaultfd)
+(roletype object_r shared_relro_userfaultfd)
+(type shell_userfaultfd)
+(roletype object_r shell_userfaultfd)
+(type simpleperf_exec)
+(roletype object_r simpleperf_exec)
+(type simpleperf_userfaultfd)
+(roletype object_r simpleperf_userfaultfd)
+(type simpleperf_boot)
+(roletype object_r simpleperf_boot)
+(type simpleperf_boot_data_file)
+(roletype object_r simpleperf_boot_data_file)
+(type snapshotctl)
+(roletype object_r snapshotctl)
+(type snapshotctl_exec)
+(roletype object_r snapshotctl_exec)
+(type snapuserd)
+(roletype object_r snapuserd)
+(type snapuserd_exec)
+(roletype object_r snapuserd_exec)
+(type snapuserd_iouring)
+(roletype object_r snapuserd_iouring)
+(type stats)
+(roletype object_r stats)
+(type stats_exec)
+(roletype object_r stats_exec)
+(type statsd_iouring)
+(roletype object_r statsd_iouring)
+(type storaged)
+(roletype object_r storaged)
+(type storaged_exec)
+(roletype object_r storaged_exec)
+(type surfaceflinger_exec)
+(roletype object_r surfaceflinger_exec)
+(type system_app_userfaultfd)
+(roletype object_r system_app_userfaultfd)
+(type system_server_userfaultfd)
+(roletype object_r system_server_userfaultfd)
+(type system_server_startup)
+(roletype object_r system_server_startup)
+(type system_server_startup_tmpfs)
+(roletype object_r system_server_startup_tmpfs)
+(type system_suspend)
+(roletype object_r system_suspend)
+(type system_suspend_exec)
+(roletype object_r system_suspend_exec)
+(type test_pkvm_tee_service)
+(roletype object_r test_pkvm_tee_service)
+(type trace_redactor_exec)
+(roletype object_r trace_redactor_exec)
+(type trace_redactor)
+(roletype object_r trace_redactor)
+(type traced_exec)
+(roletype object_r traced_exec)
+(type traced_perf_exec)
+(roletype object_r traced_perf_exec)
+(type traced_probes_exec)
+(roletype object_r traced_probes_exec)
+(type traced_probes_tmpfs)
+(roletype object_r traced_probes_tmpfs)
+(type traceur_app_userfaultfd)
+(roletype object_r traceur_app_userfaultfd)
+(type tradeinmode)
+(roletype object_r tradeinmode)
+(type tradeinmode_exec)
+(roletype object_r tradeinmode_exec)
+(type untrusted_app_userfaultfd)
+(roletype object_r untrusted_app_userfaultfd)
+(type untrusted_app_25_userfaultfd)
+(roletype object_r untrusted_app_25_userfaultfd)
+(type untrusted_app_27_userfaultfd)
+(roletype object_r untrusted_app_27_userfaultfd)
+(type untrusted_app_29_userfaultfd)
+(roletype object_r untrusted_app_29_userfaultfd)
+(type untrusted_app_30_userfaultfd)
+(roletype object_r untrusted_app_30_userfaultfd)
+(type untrusted_app_32_userfaultfd)
+(roletype object_r untrusted_app_32_userfaultfd)
+(type untrusted_app_all_devpts)
+(roletype object_r untrusted_app_all_devpts)
+(type uprobestats)
+(roletype object_r uprobestats)
+(type uprobestats_exec)
+(roletype object_r uprobestats_exec)
+(type vehicle_binding_util)
+(roletype object_r vehicle_binding_util)
+(type vehicle_binding_util_exec)
+(roletype object_r vehicle_binding_util_exec)
+(type vfio_handler)
+(roletype object_r vfio_handler)
+(type vfio_handler_exec)
+(roletype object_r vfio_handler_exec)
+(type virtual_face)
+(roletype object_r virtual_face)
+(type virtual_face_exec)
+(roletype object_r virtual_face_exec)
+(type virtual_fingerprint)
+(roletype object_r virtual_fingerprint)
+(type virtual_fingerprint_exec)
+(roletype object_r virtual_fingerprint_exec)
+(type virtualizationservice)
+(roletype object_r virtualizationservice)
+(type virtualizationservice_exec)
+(roletype object_r virtualizationservice_exec)
+(type vmlauncher_app)
+(roletype object_r vmlauncher_app)
+(type vmlauncher_app_userfaultfd)
+(roletype object_r vmlauncher_app_userfaultfd)
+(type vmnic)
+(roletype object_r vmnic)
+(type vmnic_exec)
+(roletype object_r vmnic_exec)
+(type vzwomatrigger_app)
+(roletype object_r vzwomatrigger_app)
+(type vzwomatrigger_app_userfaultfd)
+(roletype object_r vzwomatrigger_app_userfaultfd)
+(type wait_for_keymaster)
+(roletype object_r wait_for_keymaster)
+(type wait_for_keymaster_exec)
+(roletype object_r wait_for_keymaster_exec)
+(type webview_zygote_userfaultfd)
+(roletype object_r webview_zygote_userfaultfd)
+(type wifi_mainline_supplicant)
+(roletype object_r wifi_mainline_supplicant)
+(type wifi_mainline_supplicant_exec)
+(roletype object_r wifi_mainline_supplicant_exec)
+(type zygote_userfaultfd)
+(roletype object_r zygote_userfaultfd)
+(user u)
+(userrole u object_r)
+(userrole u r)
+(userlevel u (s0 ))
+(userrange u ((s0 ) (s0 (range c0 c1023))))
+(sensitivity s0)
+(sensitivitycategory s0 (c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 c10 c11 c12 c13 c14 c15 c16 c17 c18 c19 c20 c21 c22 c23 c24 c25 c26 c27 c28 c29 c30 c31 c32 c33 c34 c35 c36 c37 c38 c39 c40 c41 c42 c43 c44 c45 c46 c47 c48 c49 c50 c51 c52 c53 c54 c55 c56 c57 c58 c59 c60 c61 c62 c63 c64 c65 c66 c67 c68 c69 c70 c71 c72 c73 c74 c75 c76 c77 c78 c79 c80 c81 c82 c83 c84 c85 c86 c87 c88 c89 c90 c91 c92 c93 c94 c95 c96 c97 c98 c99 c100 c101 c102 c103 c104 c105 c106 c107 c108 c109 c110 c111 c112 c113 c114 c115 c116 c117 c118 c119 c120 c121 c122 c123 c124 c125 c126 c127 c128 c129 c130 c131 c132 c133 c134 c135 c136 c137 c138 c139 c140 c141 c142 c143 c144 c145 c146 c147 c148 c149 c150 c151 c152 c153 c154 c155 c156 c157 c158 c159 c160 c161 c162 c163 c164 c165 c166 c167 c168 c169 c170 c171 c172 c173 c174 c175 c176 c177 c178 c179 c180 c181 c182 c183 c184 c185 c186 c187 c188 c189 c190 c191 c192 c193 c194 c195 c196 c197 c198 c199 c200 c201 c202 c203 c204 c205 c206 c207 c208 c209 c210 c211 c212 c213 c214 c215 c216 c217 c218 c219 c220 c221 c222 c223 c224 c225 c226 c227 c228 c229 c230 c231 c232 c233 c234 c235 c236 c237 c238 c239 c240 c241 c242 c243 c244 c245 c246 c247 c248 c249 c250 c251 c252 c253 c254 c255 c256 c257 c258 c259 c260 c261 c262 c263 c264 c265 c266 c267 c268 c269 c270 c271 c272 c273 c274 c275 c276 c277 c278 c279 c280 c281 c282 c283 c284 c285 c286 c287 c288 c289 c290 c291 c292 c293 c294 c295 c296 c297 c298 c299 c300 c301 c302 c303 c304 c305 c306 c307 c308 c309 c310 c311 c312 c313 c314 c315 c316 c317 c318 c319 c320 c321 c322 c323 c324 c325 c326 c327 c328 c329 c330 c331 c332 c333 c334 c335 c336 c337 c338 c339 c340 c341 c342 c343 c344 c345 c346 c347 c348 c349 c350 c351 c352 c353 c354 c355 c356 c357 c358 c359 c360 c361 c362 c363 c364 c365 c366 c367 c368 c369 c370 c371 c372 c373 c374 c375 c376 c377 c378 c379 c380 c381 c382 c383 c384 c385 c386 c387 c388 c389 c390 c391 c392 c393 c394 c395 c396 c397 c398 c399 c400 c401 c402 c403 c404 c405 c406 c407 c408 c409 c410 c411 c412 c413 c414 c415 c416 c417 c418 c419 c420 c421 c422 c423 c424 c425 c426 c427 c428 c429 c430 c431 c432 c433 c434 c435 c436 c437 c438 c439 c440 c441 c442 c443 c444 c445 c446 c447 c448 c449 c450 c451 c452 c453 c454 c455 c456 c457 c458 c459 c460 c461 c462 c463 c464 c465 c466 c467 c468 c469 c470 c471 c472 c473 c474 c475 c476 c477 c478 c479 c480 c481 c482 c483 c484 c485 c486 c487 c488 c489 c490 c491 c492 c493 c494 c495 c496 c497 c498 c499 c500 c501 c502 c503 c504 c505 c506 c507 c508 c509 c510 c511 c512 c513 c514 c515 c516 c517 c518 c519 c520 c521 c522 c523 c524 c525 c526 c527 c528 c529 c530 c531 c532 c533 c534 c535 c536 c537 c538 c539 c540 c541 c542 c543 c544 c545 c546 c547 c548 c549 c550 c551 c552 c553 c554 c555 c556 c557 c558 c559 c560 c561 c562 c563 c564 c565 c566 c567 c568 c569 c570 c571 c572 c573 c574 c575 c576 c577 c578 c579 c580 c581 c582 c583 c584 c585 c586 c587 c588 c589 c590 c591 c592 c593 c594 c595 c596 c597 c598 c599 c600 c601 c602 c603 c604 c605 c606 c607 c608 c609 c610 c611 c612 c613 c614 c615 c616 c617 c618 c619 c620 c621 c622 c623 c624 c625 c626 c627 c628 c629 c630 c631 c632 c633 c634 c635 c636 c637 c638 c639 c640 c641 c642 c643 c644 c645 c646 c647 c648 c649 c650 c651 c652 c653 c654 c655 c656 c657 c658 c659 c660 c661 c662 c663 c664 c665 c666 c667 c668 c669 c670 c671 c672 c673 c674 c675 c676 c677 c678 c679 c680 c681 c682 c683 c684 c685 c686 c687 c688 c689 c690 c691 c692 c693 c694 c695 c696 c697 c698 c699 c700 c701 c702 c703 c704 c705 c706 c707 c708 c709 c710 c711 c712 c713 c714 c715 c716 c717 c718 c719 c720 c721 c722 c723 c724 c725 c726 c727 c728 c729 c730 c731 c732 c733 c734 c735 c736 c737 c738 c739 c740 c741 c742 c743 c744 c745 c746 c747 c748 c749 c750 c751 c752 c753 c754 c755 c756 c757 c758 c759 c760 c761 c762 c763 c764 c765 c766 c767 c768 c769 c770 c771 c772 c773 c774 c775 c776 c777 c778 c779 c780 c781 c782 c783 c784 c785 c786 c787 c788 c789 c790 c791 c792 c793 c794 c795 c796 c797 c798 c799 c800 c801 c802 c803 c804 c805 c806 c807 c808 c809 c810 c811 c812 c813 c814 c815 c816 c817 c818 c819 c820 c821 c822 c823 c824 c825 c826 c827 c828 c829 c830 c831 c832 c833 c834 c835 c836 c837 c838 c839 c840 c841 c842 c843 c844 c845 c846 c847 c848 c849 c850 c851 c852 c853 c854 c855 c856 c857 c858 c859 c860 c861 c862 c863 c864 c865 c866 c867 c868 c869 c870 c871 c872 c873 c874 c875 c876 c877 c878 c879 c880 c881 c882 c883 c884 c885 c886 c887 c888 c889 c890 c891 c892 c893 c894 c895 c896 c897 c898 c899 c900 c901 c902 c903 c904 c905 c906 c907 c908 c909 c910 c911 c912 c913 c914 c915 c916 c917 c918 c919 c920 c921 c922 c923 c924 c925 c926 c927 c928 c929 c930 c931 c932 c933 c934 c935 c936 c937 c938 c939 c940 c941 c942 c943 c944 c945 c946 c947 c948 c949 c950 c951 c952 c953 c954 c955 c956 c957 c958 c959 c960 c961 c962 c963 c964 c965 c966 c967 c968 c969 c970 c971 c972 c973 c974 c975 c976 c977 c978 c979 c980 c981 c982 c983 c984 c985 c986 c987 c988 c989 c990 c991 c992 c993 c994 c995 c996 c997 c998 c999 c1000 c1001 c1002 c1003 c1004 c1005 c1006 c1007 c1008 c1009 c1010 c1011 c1012 c1013 c1014 c1015 c1016 c1017 c1018 c1019 c1020 c1021 c1022 c1023 ))
+(sensitivityorder (s0 ))
+(category c0)
+(category c1)
+(category c2)
+(category c3)
+(category c4)
+(category c5)
+(category c6)
+(category c7)
+(category c8)
+(category c9)
+(category c10)
+(category c11)
+(category c12)
+(category c13)
+(category c14)
+(category c15)
+(category c16)
+(category c17)
+(category c18)
+(category c19)
+(category c20)
+(category c21)
+(category c22)
+(category c23)
+(category c24)
+(category c25)
+(category c26)
+(category c27)
+(category c28)
+(category c29)
+(category c30)
+(category c31)
+(category c32)
+(category c33)
+(category c34)
+(category c35)
+(category c36)
+(category c37)
+(category c38)
+(category c39)
+(category c40)
+(category c41)
+(category c42)
+(category c43)
+(category c44)
+(category c45)
+(category c46)
+(category c47)
+(category c48)
+(category c49)
+(category c50)
+(category c51)
+(category c52)
+(category c53)
+(category c54)
+(category c55)
+(category c56)
+(category c57)
+(category c58)
+(category c59)
+(category c60)
+(category c61)
+(category c62)
+(category c63)
+(category c64)
+(category c65)
+(category c66)
+(category c67)
+(category c68)
+(category c69)
+(category c70)
+(category c71)
+(category c72)
+(category c73)
+(category c74)
+(category c75)
+(category c76)
+(category c77)
+(category c78)
+(category c79)
+(category c80)
+(category c81)
+(category c82)
+(category c83)
+(category c84)
+(category c85)
+(category c86)
+(category c87)
+(category c88)
+(category c89)
+(category c90)
+(category c91)
+(category c92)
+(category c93)
+(category c94)
+(category c95)
+(category c96)
+(category c97)
+(category c98)
+(category c99)
+(category c100)
+(category c101)
+(category c102)
+(category c103)
+(category c104)
+(category c105)
+(category c106)
+(category c107)
+(category c108)
+(category c109)
+(category c110)
+(category c111)
+(category c112)
+(category c113)
+(category c114)
+(category c115)
+(category c116)
+(category c117)
+(category c118)
+(category c119)
+(category c120)
+(category c121)
+(category c122)
+(category c123)
+(category c124)
+(category c125)
+(category c126)
+(category c127)
+(category c128)
+(category c129)
+(category c130)
+(category c131)
+(category c132)
+(category c133)
+(category c134)
+(category c135)
+(category c136)
+(category c137)
+(category c138)
+(category c139)
+(category c140)
+(category c141)
+(category c142)
+(category c143)
+(category c144)
+(category c145)
+(category c146)
+(category c147)
+(category c148)
+(category c149)
+(category c150)
+(category c151)
+(category c152)
+(category c153)
+(category c154)
+(category c155)
+(category c156)
+(category c157)
+(category c158)
+(category c159)
+(category c160)
+(category c161)
+(category c162)
+(category c163)
+(category c164)
+(category c165)
+(category c166)
+(category c167)
+(category c168)
+(category c169)
+(category c170)
+(category c171)
+(category c172)
+(category c173)
+(category c174)
+(category c175)
+(category c176)
+(category c177)
+(category c178)
+(category c179)
+(category c180)
+(category c181)
+(category c182)
+(category c183)
+(category c184)
+(category c185)
+(category c186)
+(category c187)
+(category c188)
+(category c189)
+(category c190)
+(category c191)
+(category c192)
+(category c193)
+(category c194)
+(category c195)
+(category c196)
+(category c197)
+(category c198)
+(category c199)
+(category c200)
+(category c201)
+(category c202)
+(category c203)
+(category c204)
+(category c205)
+(category c206)
+(category c207)
+(category c208)
+(category c209)
+(category c210)
+(category c211)
+(category c212)
+(category c213)
+(category c214)
+(category c215)
+(category c216)
+(category c217)
+(category c218)
+(category c219)
+(category c220)
+(category c221)
+(category c222)
+(category c223)
+(category c224)
+(category c225)
+(category c226)
+(category c227)
+(category c228)
+(category c229)
+(category c230)
+(category c231)
+(category c232)
+(category c233)
+(category c234)
+(category c235)
+(category c236)
+(category c237)
+(category c238)
+(category c239)
+(category c240)
+(category c241)
+(category c242)
+(category c243)
+(category c244)
+(category c245)
+(category c246)
+(category c247)
+(category c248)
+(category c249)
+(category c250)
+(category c251)
+(category c252)
+(category c253)
+(category c254)
+(category c255)
+(category c256)
+(category c257)
+(category c258)
+(category c259)
+(category c260)
+(category c261)
+(category c262)
+(category c263)
+(category c264)
+(category c265)
+(category c266)
+(category c267)
+(category c268)
+(category c269)
+(category c270)
+(category c271)
+(category c272)
+(category c273)
+(category c274)
+(category c275)
+(category c276)
+(category c277)
+(category c278)
+(category c279)
+(category c280)
+(category c281)
+(category c282)
+(category c283)
+(category c284)
+(category c285)
+(category c286)
+(category c287)
+(category c288)
+(category c289)
+(category c290)
+(category c291)
+(category c292)
+(category c293)
+(category c294)
+(category c295)
+(category c296)
+(category c297)
+(category c298)
+(category c299)
+(category c300)
+(category c301)
+(category c302)
+(category c303)
+(category c304)
+(category c305)
+(category c306)
+(category c307)
+(category c308)
+(category c309)
+(category c310)
+(category c311)
+(category c312)
+(category c313)
+(category c314)
+(category c315)
+(category c316)
+(category c317)
+(category c318)
+(category c319)
+(category c320)
+(category c321)
+(category c322)
+(category c323)
+(category c324)
+(category c325)
+(category c326)
+(category c327)
+(category c328)
+(category c329)
+(category c330)
+(category c331)
+(category c332)
+(category c333)
+(category c334)
+(category c335)
+(category c336)
+(category c337)
+(category c338)
+(category c339)
+(category c340)
+(category c341)
+(category c342)
+(category c343)
+(category c344)
+(category c345)
+(category c346)
+(category c347)
+(category c348)
+(category c349)
+(category c350)
+(category c351)
+(category c352)
+(category c353)
+(category c354)
+(category c355)
+(category c356)
+(category c357)
+(category c358)
+(category c359)
+(category c360)
+(category c361)
+(category c362)
+(category c363)
+(category c364)
+(category c365)
+(category c366)
+(category c367)
+(category c368)
+(category c369)
+(category c370)
+(category c371)
+(category c372)
+(category c373)
+(category c374)
+(category c375)
+(category c376)
+(category c377)
+(category c378)
+(category c379)
+(category c380)
+(category c381)
+(category c382)
+(category c383)
+(category c384)
+(category c385)
+(category c386)
+(category c387)
+(category c388)
+(category c389)
+(category c390)
+(category c391)
+(category c392)
+(category c393)
+(category c394)
+(category c395)
+(category c396)
+(category c397)
+(category c398)
+(category c399)
+(category c400)
+(category c401)
+(category c402)
+(category c403)
+(category c404)
+(category c405)
+(category c406)
+(category c407)
+(category c408)
+(category c409)
+(category c410)
+(category c411)
+(category c412)
+(category c413)
+(category c414)
+(category c415)
+(category c416)
+(category c417)
+(category c418)
+(category c419)
+(category c420)
+(category c421)
+(category c422)
+(category c423)
+(category c424)
+(category c425)
+(category c426)
+(category c427)
+(category c428)
+(category c429)
+(category c430)
+(category c431)
+(category c432)
+(category c433)
+(category c434)
+(category c435)
+(category c436)
+(category c437)
+(category c438)
+(category c439)
+(category c440)
+(category c441)
+(category c442)
+(category c443)
+(category c444)
+(category c445)
+(category c446)
+(category c447)
+(category c448)
+(category c449)
+(category c450)
+(category c451)
+(category c452)
+(category c453)
+(category c454)
+(category c455)
+(category c456)
+(category c457)
+(category c458)
+(category c459)
+(category c460)
+(category c461)
+(category c462)
+(category c463)
+(category c464)
+(category c465)
+(category c466)
+(category c467)
+(category c468)
+(category c469)
+(category c470)
+(category c471)
+(category c472)
+(category c473)
+(category c474)
+(category c475)
+(category c476)
+(category c477)
+(category c478)
+(category c479)
+(category c480)
+(category c481)
+(category c482)
+(category c483)
+(category c484)
+(category c485)
+(category c486)
+(category c487)
+(category c488)
+(category c489)
+(category c490)
+(category c491)
+(category c492)
+(category c493)
+(category c494)
+(category c495)
+(category c496)
+(category c497)
+(category c498)
+(category c499)
+(category c500)
+(category c501)
+(category c502)
+(category c503)
+(category c504)
+(category c505)
+(category c506)
+(category c507)
+(category c508)
+(category c509)
+(category c510)
+(category c511)
+(category c512)
+(category c513)
+(category c514)
+(category c515)
+(category c516)
+(category c517)
+(category c518)
+(category c519)
+(category c520)
+(category c521)
+(category c522)
+(category c523)
+(category c524)
+(category c525)
+(category c526)
+(category c527)
+(category c528)
+(category c529)
+(category c530)
+(category c531)
+(category c532)
+(category c533)
+(category c534)
+(category c535)
+(category c536)
+(category c537)
+(category c538)
+(category c539)
+(category c540)
+(category c541)
+(category c542)
+(category c543)
+(category c544)
+(category c545)
+(category c546)
+(category c547)
+(category c548)
+(category c549)
+(category c550)
+(category c551)
+(category c552)
+(category c553)
+(category c554)
+(category c555)
+(category c556)
+(category c557)
+(category c558)
+(category c559)
+(category c560)
+(category c561)
+(category c562)
+(category c563)
+(category c564)
+(category c565)
+(category c566)
+(category c567)
+(category c568)
+(category c569)
+(category c570)
+(category c571)
+(category c572)
+(category c573)
+(category c574)
+(category c575)
+(category c576)
+(category c577)
+(category c578)
+(category c579)
+(category c580)
+(category c581)
+(category c582)
+(category c583)
+(category c584)
+(category c585)
+(category c586)
+(category c587)
+(category c588)
+(category c589)
+(category c590)
+(category c591)
+(category c592)
+(category c593)
+(category c594)
+(category c595)
+(category c596)
+(category c597)
+(category c598)
+(category c599)
+(category c600)
+(category c601)
+(category c602)
+(category c603)
+(category c604)
+(category c605)
+(category c606)
+(category c607)
+(category c608)
+(category c609)
+(category c610)
+(category c611)
+(category c612)
+(category c613)
+(category c614)
+(category c615)
+(category c616)
+(category c617)
+(category c618)
+(category c619)
+(category c620)
+(category c621)
+(category c622)
+(category c623)
+(category c624)
+(category c625)
+(category c626)
+(category c627)
+(category c628)
+(category c629)
+(category c630)
+(category c631)
+(category c632)
+(category c633)
+(category c634)
+(category c635)
+(category c636)
+(category c637)
+(category c638)
+(category c639)
+(category c640)
+(category c641)
+(category c642)
+(category c643)
+(category c644)
+(category c645)
+(category c646)
+(category c647)
+(category c648)
+(category c649)
+(category c650)
+(category c651)
+(category c652)
+(category c653)
+(category c654)
+(category c655)
+(category c656)
+(category c657)
+(category c658)
+(category c659)
+(category c660)
+(category c661)
+(category c662)
+(category c663)
+(category c664)
+(category c665)
+(category c666)
+(category c667)
+(category c668)
+(category c669)
+(category c670)
+(category c671)
+(category c672)
+(category c673)
+(category c674)
+(category c675)
+(category c676)
+(category c677)
+(category c678)
+(category c679)
+(category c680)
+(category c681)
+(category c682)
+(category c683)
+(category c684)
+(category c685)
+(category c686)
+(category c687)
+(category c688)
+(category c689)
+(category c690)
+(category c691)
+(category c692)
+(category c693)
+(category c694)
+(category c695)
+(category c696)
+(category c697)
+(category c698)
+(category c699)
+(category c700)
+(category c701)
+(category c702)
+(category c703)
+(category c704)
+(category c705)
+(category c706)
+(category c707)
+(category c708)
+(category c709)
+(category c710)
+(category c711)
+(category c712)
+(category c713)
+(category c714)
+(category c715)
+(category c716)
+(category c717)
+(category c718)
+(category c719)
+(category c720)
+(category c721)
+(category c722)
+(category c723)
+(category c724)
+(category c725)
+(category c726)
+(category c727)
+(category c728)
+(category c729)
+(category c730)
+(category c731)
+(category c732)
+(category c733)
+(category c734)
+(category c735)
+(category c736)
+(category c737)
+(category c738)
+(category c739)
+(category c740)
+(category c741)
+(category c742)
+(category c743)
+(category c744)
+(category c745)
+(category c746)
+(category c747)
+(category c748)
+(category c749)
+(category c750)
+(category c751)
+(category c752)
+(category c753)
+(category c754)
+(category c755)
+(category c756)
+(category c757)
+(category c758)
+(category c759)
+(category c760)
+(category c761)
+(category c762)
+(category c763)
+(category c764)
+(category c765)
+(category c766)
+(category c767)
+(category c768)
+(category c769)
+(category c770)
+(category c771)
+(category c772)
+(category c773)
+(category c774)
+(category c775)
+(category c776)
+(category c777)
+(category c778)
+(category c779)
+(category c780)
+(category c781)
+(category c782)
+(category c783)
+(category c784)
+(category c785)
+(category c786)
+(category c787)
+(category c788)
+(category c789)
+(category c790)
+(category c791)
+(category c792)
+(category c793)
+(category c794)
+(category c795)
+(category c796)
+(category c797)
+(category c798)
+(category c799)
+(category c800)
+(category c801)
+(category c802)
+(category c803)
+(category c804)
+(category c805)
+(category c806)
+(category c807)
+(category c808)
+(category c809)
+(category c810)
+(category c811)
+(category c812)
+(category c813)
+(category c814)
+(category c815)
+(category c816)
+(category c817)
+(category c818)
+(category c819)
+(category c820)
+(category c821)
+(category c822)
+(category c823)
+(category c824)
+(category c825)
+(category c826)
+(category c827)
+(category c828)
+(category c829)
+(category c830)
+(category c831)
+(category c832)
+(category c833)
+(category c834)
+(category c835)
+(category c836)
+(category c837)
+(category c838)
+(category c839)
+(category c840)
+(category c841)
+(category c842)
+(category c843)
+(category c844)
+(category c845)
+(category c846)
+(category c847)
+(category c848)
+(category c849)
+(category c850)
+(category c851)
+(category c852)
+(category c853)
+(category c854)
+(category c855)
+(category c856)
+(category c857)
+(category c858)
+(category c859)
+(category c860)
+(category c861)
+(category c862)
+(category c863)
+(category c864)
+(category c865)
+(category c866)
+(category c867)
+(category c868)
+(category c869)
+(category c870)
+(category c871)
+(category c872)
+(category c873)
+(category c874)
+(category c875)
+(category c876)
+(category c877)
+(category c878)
+(category c879)
+(category c880)
+(category c881)
+(category c882)
+(category c883)
+(category c884)
+(category c885)
+(category c886)
+(category c887)
+(category c888)
+(category c889)
+(category c890)
+(category c891)
+(category c892)
+(category c893)
+(category c894)
+(category c895)
+(category c896)
+(category c897)
+(category c898)
+(category c899)
+(category c900)
+(category c901)
+(category c902)
+(category c903)
+(category c904)
+(category c905)
+(category c906)
+(category c907)
+(category c908)
+(category c909)
+(category c910)
+(category c911)
+(category c912)
+(category c913)
+(category c914)
+(category c915)
+(category c916)
+(category c917)
+(category c918)
+(category c919)
+(category c920)
+(category c921)
+(category c922)
+(category c923)
+(category c924)
+(category c925)
+(category c926)
+(category c927)
+(category c928)
+(category c929)
+(category c930)
+(category c931)
+(category c932)
+(category c933)
+(category c934)
+(category c935)
+(category c936)
+(category c937)
+(category c938)
+(category c939)
+(category c940)
+(category c941)
+(category c942)
+(category c943)
+(category c944)
+(category c945)
+(category c946)
+(category c947)
+(category c948)
+(category c949)
+(category c950)
+(category c951)
+(category c952)
+(category c953)
+(category c954)
+(category c955)
+(category c956)
+(category c957)
+(category c958)
+(category c959)
+(category c960)
+(category c961)
+(category c962)
+(category c963)
+(category c964)
+(category c965)
+(category c966)
+(category c967)
+(category c968)
+(category c969)
+(category c970)
+(category c971)
+(category c972)
+(category c973)
+(category c974)
+(category c975)
+(category c976)
+(category c977)
+(category c978)
+(category c979)
+(category c980)
+(category c981)
+(category c982)
+(category c983)
+(category c984)
+(category c985)
+(category c986)
+(category c987)
+(category c988)
+(category c989)
+(category c990)
+(category c991)
+(category c992)
+(category c993)
+(category c994)
+(category c995)
+(category c996)
+(category c997)
+(category c998)
+(category c999)
+(category c1000)
+(category c1001)
+(category c1002)
+(category c1003)
+(category c1004)
+(category c1005)
+(category c1006)
+(category c1007)
+(category c1008)
+(category c1009)
+(category c1010)
+(category c1011)
+(category c1012)
+(category c1013)
+(category c1014)
+(category c1015)
+(category c1016)
+(category c1017)
+(category c1018)
+(category c1019)
+(category c1020)
+(category c1021)
+(category c1022)
+(category c1023)
+(categoryorder (c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 c10 c11 c12 c13 c14 c15 c16 c17 c18 c19 c20 c21 c22 c23 c24 c25 c26 c27 c28 c29 c30 c31 c32 c33 c34 c35 c36 c37 c38 c39 c40 c41 c42 c43 c44 c45 c46 c47 c48 c49 c50 c51 c52 c53 c54 c55 c56 c57 c58 c59 c60 c61 c62 c63 c64 c65 c66 c67 c68 c69 c70 c71 c72 c73 c74 c75 c76 c77 c78 c79 c80 c81 c82 c83 c84 c85 c86 c87 c88 c89 c90 c91 c92 c93 c94 c95 c96 c97 c98 c99 c100 c101 c102 c103 c104 c105 c106 c107 c108 c109 c110 c111 c112 c113 c114 c115 c116 c117 c118 c119 c120 c121 c122 c123 c124 c125 c126 c127 c128 c129 c130 c131 c132 c133 c134 c135 c136 c137 c138 c139 c140 c141 c142 c143 c144 c145 c146 c147 c148 c149 c150 c151 c152 c153 c154 c155 c156 c157 c158 c159 c160 c161 c162 c163 c164 c165 c166 c167 c168 c169 c170 c171 c172 c173 c174 c175 c176 c177 c178 c179 c180 c181 c182 c183 c184 c185 c186 c187 c188 c189 c190 c191 c192 c193 c194 c195 c196 c197 c198 c199 c200 c201 c202 c203 c204 c205 c206 c207 c208 c209 c210 c211 c212 c213 c214 c215 c216 c217 c218 c219 c220 c221 c222 c223 c224 c225 c226 c227 c228 c229 c230 c231 c232 c233 c234 c235 c236 c237 c238 c239 c240 c241 c242 c243 c244 c245 c246 c247 c248 c249 c250 c251 c252 c253 c254 c255 c256 c257 c258 c259 c260 c261 c262 c263 c264 c265 c266 c267 c268 c269 c270 c271 c272 c273 c274 c275 c276 c277 c278 c279 c280 c281 c282 c283 c284 c285 c286 c287 c288 c289 c290 c291 c292 c293 c294 c295 c296 c297 c298 c299 c300 c301 c302 c303 c304 c305 c306 c307 c308 c309 c310 c311 c312 c313 c314 c315 c316 c317 c318 c319 c320 c321 c322 c323 c324 c325 c326 c327 c328 c329 c330 c331 c332 c333 c334 c335 c336 c337 c338 c339 c340 c341 c342 c343 c344 c345 c346 c347 c348 c349 c350 c351 c352 c353 c354 c355 c356 c357 c358 c359 c360 c361 c362 c363 c364 c365 c366 c367 c368 c369 c370 c371 c372 c373 c374 c375 c376 c377 c378 c379 c380 c381 c382 c383 c384 c385 c386 c387 c388 c389 c390 c391 c392 c393 c394 c395 c396 c397 c398 c399 c400 c401 c402 c403 c404 c405 c406 c407 c408 c409 c410 c411 c412 c413 c414 c415 c416 c417 c418 c419 c420 c421 c422 c423 c424 c425 c426 c427 c428 c429 c430 c431 c432 c433 c434 c435 c436 c437 c438 c439 c440 c441 c442 c443 c444 c445 c446 c447 c448 c449 c450 c451 c452 c453 c454 c455 c456 c457 c458 c459 c460 c461 c462 c463 c464 c465 c466 c467 c468 c469 c470 c471 c472 c473 c474 c475 c476 c477 c478 c479 c480 c481 c482 c483 c484 c485 c486 c487 c488 c489 c490 c491 c492 c493 c494 c495 c496 c497 c498 c499 c500 c501 c502 c503 c504 c505 c506 c507 c508 c509 c510 c511 c512 c513 c514 c515 c516 c517 c518 c519 c520 c521 c522 c523 c524 c525 c526 c527 c528 c529 c530 c531 c532 c533 c534 c535 c536 c537 c538 c539 c540 c541 c542 c543 c544 c545 c546 c547 c548 c549 c550 c551 c552 c553 c554 c555 c556 c557 c558 c559 c560 c561 c562 c563 c564 c565 c566 c567 c568 c569 c570 c571 c572 c573 c574 c575 c576 c577 c578 c579 c580 c581 c582 c583 c584 c585 c586 c587 c588 c589 c590 c591 c592 c593 c594 c595 c596 c597 c598 c599 c600 c601 c602 c603 c604 c605 c606 c607 c608 c609 c610 c611 c612 c613 c614 c615 c616 c617 c618 c619 c620 c621 c622 c623 c624 c625 c626 c627 c628 c629 c630 c631 c632 c633 c634 c635 c636 c637 c638 c639 c640 c641 c642 c643 c644 c645 c646 c647 c648 c649 c650 c651 c652 c653 c654 c655 c656 c657 c658 c659 c660 c661 c662 c663 c664 c665 c666 c667 c668 c669 c670 c671 c672 c673 c674 c675 c676 c677 c678 c679 c680 c681 c682 c683 c684 c685 c686 c687 c688 c689 c690 c691 c692 c693 c694 c695 c696 c697 c698 c699 c700 c701 c702 c703 c704 c705 c706 c707 c708 c709 c710 c711 c712 c713 c714 c715 c716 c717 c718 c719 c720 c721 c722 c723 c724 c725 c726 c727 c728 c729 c730 c731 c732 c733 c734 c735 c736 c737 c738 c739 c740 c741 c742 c743 c744 c745 c746 c747 c748 c749 c750 c751 c752 c753 c754 c755 c756 c757 c758 c759 c760 c761 c762 c763 c764 c765 c766 c767 c768 c769 c770 c771 c772 c773 c774 c775 c776 c777 c778 c779 c780 c781 c782 c783 c784 c785 c786 c787 c788 c789 c790 c791 c792 c793 c794 c795 c796 c797 c798 c799 c800 c801 c802 c803 c804 c805 c806 c807 c808 c809 c810 c811 c812 c813 c814 c815 c816 c817 c818 c819 c820 c821 c822 c823 c824 c825 c826 c827 c828 c829 c830 c831 c832 c833 c834 c835 c836 c837 c838 c839 c840 c841 c842 c843 c844 c845 c846 c847 c848 c849 c850 c851 c852 c853 c854 c855 c856 c857 c858 c859 c860 c861 c862 c863 c864 c865 c866 c867 c868 c869 c870 c871 c872 c873 c874 c875 c876 c877 c878 c879 c880 c881 c882 c883 c884 c885 c886 c887 c888 c889 c890 c891 c892 c893 c894 c895 c896 c897 c898 c899 c900 c901 c902 c903 c904 c905 c906 c907 c908 c909 c910 c911 c912 c913 c914 c915 c916 c917 c918 c919 c920 c921 c922 c923 c924 c925 c926 c927 c928 c929 c930 c931 c932 c933 c934 c935 c936 c937 c938 c939 c940 c941 c942 c943 c944 c945 c946 c947 c948 c949 c950 c951 c952 c953 c954 c955 c956 c957 c958 c959 c960 c961 c962 c963 c964 c965 c966 c967 c968 c969 c970 c971 c972 c973 c974 c975 c976 c977 c978 c979 c980 c981 c982 c983 c984 c985 c986 c987 c988 c989 c990 c991 c992 c993 c994 c995 c996 c997 c998 c999 c1000 c1001 c1002 c1003 c1004 c1005 c1006 c1007 c1008 c1009 c1010 c1011 c1012 c1013 c1014 c1015 c1016 c1017 c1018 c1019 c1020 c1021 c1022 c1023 ))
+;;* lmx 340 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_1 domain (process (fork)))
+;;* lme
+
+;;* lmx 340 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_2 domain (process (fork)))
+;;* lme
+
+;;* lmx 340 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_3 domain (process (fork)))
+;;* lme
+
+;;* lmx 341 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_4 domain (process (fork)))
+;;* lme
+
+;;* lmx 341 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_5 domain (process (fork)))
+;;* lme
+
+;;* lmx 341 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_6 domain (process (fork)))
+;;* lme
+
+;;* lmx 342 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_7 domain (process (fork)))
+;;* lme
+
+;;* lmx 342 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_8 domain (process (fork)))
+;;* lme
+
+;;* lmx 342 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_9 domain (process (fork)))
+;;* lme
+
+;;* lmx 343 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_10 domain (process (fork)))
+;;* lme
+
+;;* lmx 343 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_11 domain (process (fork)))
+;;* lme
+
+;;* lmx 343 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_12 domain (process (fork)))
+;;* lme
+
+;;* lmx 344 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_13 domain (process (fork)))
+;;* lme
+
+;;* lmx 344 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_14 domain (process (fork)))
+;;* lme
+
+;;* lmx 344 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_15 domain (process (fork)))
+;;* lme
+
+;;* lmx 345 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_16 domain (process (fork)))
+;;* lme
+
+;;* lmx 345 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_17 domain (process (fork)))
+;;* lme
+
+;;* lmx 345 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_18 domain (process (fork)))
+;;* lme
+
+;;* lmx 346 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_19 domain (process (fork)))
+;;* lme
+
+;;* lmx 346 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_20 domain (process (fork)))
+;;* lme
+
+;;* lmx 346 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_21 domain (process (fork)))
+;;* lme
+
+;;* lmx 347 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_22 domain (process (fork)))
+;;* lme
+
+;;* lmx 347 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_23 domain (process (fork)))
+;;* lme
+
+;;* lmx 347 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_24 domain (process (fork)))
+;;* lme
+
+;;* lmx 348 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_25 domain (process (fork)))
+;;* lme
+
+;;* lmx 348 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_26 domain (process (fork)))
+;;* lme
+
+;;* lmx 348 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_27 domain (process (fork)))
+;;* lme
+
+;;* lmx 349 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_28 domain (process (fork)))
+;;* lme
+
+;;* lmx 349 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_29 domain (process (fork)))
+;;* lme
+
+;;* lmx 349 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_30 domain (process (fork)))
+;;* lme
+
+;;* lmx 350 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_31 domain (process (fork)))
+;;* lme
+
+;;* lmx 350 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_32 domain (process (fork)))
+;;* lme
+
+;;* lmx 350 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_33 domain (process (fork)))
+;;* lme
+
+;;* lmx 351 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_34 domain (process (fork)))
+;;* lme
+
+;;* lmx 351 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_35 domain (process (fork)))
+;;* lme
+
+;;* lmx 351 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_36 domain (process (fork)))
+;;* lme
+
+;;* lmx 352 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_37 domain (process (fork)))
+;;* lme
+
+;;* lmx 352 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_38 domain (process (fork)))
+;;* lme
+
+;;* lmx 352 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_39 domain (process (fork)))
+;;* lme
+
+;;* lmx 353 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_40 domain (process (fork)))
+;;* lme
+
+;;* lmx 353 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_41 domain (process (fork)))
+;;* lme
+
+;;* lmx 353 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_42 domain (process (fork)))
+;;* lme
+
+;;* lmx 354 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_43 domain (process (fork)))
+;;* lme
+
+;;* lmx 354 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_44 domain (process (fork)))
+;;* lme
+
+;;* lmx 354 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_45 domain (process (fork)))
+;;* lme
+
+;;* lmx 355 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_46 domain (process (fork)))
+;;* lme
+
+;;* lmx 355 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_47 domain (process (fork)))
+;;* lme
+
+;;* lmx 355 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_48 domain (process (fork)))
+;;* lme
+
+;;* lmx 356 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_49 domain (process (fork)))
+;;* lme
+
+;;* lmx 356 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_50 domain (process (fork)))
+;;* lme
+
+;;* lmx 356 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_51 domain (process (fork)))
+;;* lme
+
+;;* lmx 357 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_52 domain (process (fork)))
+;;* lme
+
+;;* lmx 357 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_53 domain (process (fork)))
+;;* lme
+
+;;* lmx 357 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_54 domain (process (fork)))
+;;* lme
+
+;;* lmx 358 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_55 domain (process (fork)))
+;;* lme
+
+;;* lmx 358 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_56 domain (process (fork)))
+;;* lme
+
+;;* lmx 358 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_57 domain (process (fork)))
+;;* lme
+
+;;* lmx 359 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_58 domain (process (fork)))
+;;* lme
+
+;;* lmx 359 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_59 domain (process (fork)))
+;;* lme
+
+;;* lmx 359 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_60 domain (process (fork)))
+;;* lme
+
+;;* lmx 360 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_61 domain (process (fork)))
+;;* lme
+
+;;* lmx 360 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_62 domain (process (fork)))
+;;* lme
+
+;;* lmx 360 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_63 domain (process (fork)))
+;;* lme
+
+;;* lmx 361 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_64 domain (process (fork)))
+;;* lme
+
+;;* lmx 361 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_65 domain (process (fork)))
+;;* lme
+
+;;* lmx 361 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_66 domain (process (fork)))
+;;* lme
+
+;;* lmx 362 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_67 domain (process (fork)))
+;;* lme
+
+;;* lmx 362 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_68 domain (process (fork)))
+;;* lme
+
+;;* lmx 362 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_69 domain (process (fork)))
+;;* lme
+
+;;* lmx 363 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_70 domain (process (fork)))
+;;* lme
+
+;;* lmx 363 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_71 domain (process (fork)))
+;;* lme
+
+;;* lmx 363 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_72 domain (process (fork)))
+;;* lme
+
+;;* lmx 364 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_73 domain (process (fork)))
+;;* lme
+
+;;* lmx 364 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_74 domain (process (fork)))
+;;* lme
+
+;;* lmx 364 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_75 domain (process (fork)))
+;;* lme
+
+;;* lmx 365 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_76 domain (process (fork)))
+;;* lme
+
+;;* lmx 365 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_77 domain (process (fork)))
+;;* lme
+
+;;* lmx 365 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_78 domain (process (fork)))
+;;* lme
+
+;;* lmx 366 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_79 domain (process (fork)))
+;;* lme
+
+;;* lmx 366 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_80 domain (process (fork)))
+;;* lme
+
+;;* lmx 366 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_81 domain (process (fork)))
+;;* lme
+
+;;* lmx 367 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_82 domain (process (fork)))
+;;* lme
+
+;;* lmx 367 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_83 domain (process (fork)))
+;;* lme
+
+;;* lmx 367 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_84 domain (process (fork)))
+;;* lme
+
+;;* lmx 368 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_85 domain (process (fork)))
+;;* lme
+
+;;* lmx 368 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_86 domain (process (fork)))
+;;* lme
+
+;;* lmx 368 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_87 domain (process (fork)))
+;;* lme
+
+;;* lmx 369 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_88 domain (process (fork)))
+;;* lme
+
+;;* lmx 369 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_89 domain (process (fork)))
+;;* lme
+
+;;* lmx 369 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_90 domain (process (fork)))
+;;* lme
+
+;;* lmx 370 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_91 domain (process (fork)))
+;;* lme
+
+;;* lmx 370 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_92 domain (process (fork)))
+;;* lme
+
+;;* lmx 370 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_93 domain (process (fork)))
+;;* lme
+
+;;* lmx 371 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_94 domain (process (fork)))
+;;* lme
+
+;;* lmx 371 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_95 domain (process (fork)))
+;;* lme
+
+;;* lmx 371 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_96 domain (process (fork)))
+;;* lme
+
+;;* lmx 372 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_97 domain (process (fork)))
+;;* lme
+
+;;* lmx 372 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_98 domain (process (fork)))
+;;* lme
+
+;;* lmx 372 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_99 domain (process (fork)))
+;;* lme
+
+;;* lmx 373 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_100 domain (process (fork)))
+;;* lme
+
+;;* lmx 373 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_101 domain (process (fork)))
+;;* lme
+
+;;* lmx 373 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_102 domain (process (fork)))
+;;* lme
+
+;;* lmx 374 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_103 domain (process (fork)))
+;;* lme
+
+;;* lmx 374 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_104 domain (process (fork)))
+;;* lme
+
+;;* lmx 374 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_105 domain (process (fork)))
+;;* lme
+
+;;* lmx 375 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_106 domain (process (fork)))
+;;* lme
+
+;;* lmx 375 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_107 domain (process (fork)))
+;;* lme
+
+;;* lmx 375 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_108 domain (process (fork)))
+;;* lme
+
+;;* lmx 376 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_109 domain (process (fork)))
+;;* lme
+
+;;* lmx 376 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_110 domain (process (fork)))
+;;* lme
+
+;;* lmx 376 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_111 domain (process (fork)))
+;;* lme
+
+;;* lmx 377 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_112 domain (process (fork)))
+;;* lme
+
+;;* lmx 377 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_113 domain (process (fork)))
+;;* lme
+
+;;* lmx 377 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_114 domain (process (fork)))
+;;* lme
+
+;;* lmx 378 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_115 domain (process (fork)))
+;;* lme
+
+;;* lmx 378 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_116 domain (process (fork)))
+;;* lme
+
+;;* lmx 378 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_117 domain (process (fork)))
+;;* lme
+
+;;* lmx 379 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_118 domain (process (fork)))
+;;* lme
+
+;;* lmx 379 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_119 domain (process (fork)))
+;;* lme
+
+;;* lmx 379 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_120 domain (process (fork)))
+;;* lme
+
+;;* lmx 382 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_121 domain (process (fork)))
+;;* lme
+
+;;* lmx 382 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_122 domain (process (fork)))
+;;* lme
+
+;;* lmx 382 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_123 domain (process (fork)))
+;;* lme
+
+;;* lmx 383 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_124 domain (process (fork)))
+;;* lme
+
+;;* lmx 383 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_125 domain (process (fork)))
+;;* lme
+
+;;* lmx 383 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_126 domain (process (fork)))
+;;* lme
+
+;;* lmx 384 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_127 domain (process (fork)))
+;;* lme
+
+;;* lmx 384 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_128 domain (process (fork)))
+;;* lme
+
+;;* lmx 384 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_129 domain (process (fork)))
+;;* lme
+
+;;* lmx 385 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_130 domain (process (fork)))
+;;* lme
+
+;;* lmx 385 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_131 domain (process (fork)))
+;;* lme
+
+;;* lmx 385 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_132 domain (process (fork)))
+;;* lme
+
+;;* lmx 386 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_133 domain (process (fork)))
+;;* lme
+
+;;* lmx 386 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_134 domain (process (fork)))
+;;* lme
+
+;;* lmx 386 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_135 domain (process (fork)))
+;;* lme
+
+;;* lmx 387 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_136 domain (process (fork)))
+;;* lme
+
+;;* lmx 387 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_137 domain (process (fork)))
+;;* lme
+
+;;* lmx 387 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_138 domain (process (fork)))
+;;* lme
+
+;;* lmx 388 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_139 domain (process (fork)))
+;;* lme
+
+;;* lmx 388 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_140 domain (process (fork)))
+;;* lme
+
+;;* lmx 388 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_141 domain (process (fork)))
+;;* lme
+
+;;* lmx 389 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_142 domain (process (fork)))
+;;* lme
+
+;;* lmx 389 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_143 domain (process (fork)))
+;;* lme
+
+;;* lmx 389 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_144 domain (process (fork)))
+;;* lme
+
+;;* lmx 390 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_145 domain (process (fork)))
+;;* lme
+
+;;* lmx 390 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_146 domain (process (fork)))
+;;* lme
+
+;;* lmx 390 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_147 domain (process (fork)))
+;;* lme
+
+;;* lmx 391 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_148 domain (process (fork)))
+;;* lme
+
+;;* lmx 391 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_149 domain (process (fork)))
+;;* lme
+
+;;* lmx 391 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_150 domain (process (fork)))
+;;* lme
+
+;;* lmx 392 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_151 domain (process (fork)))
+;;* lme
+
+;;* lmx 392 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_152 domain (process (fork)))
+;;* lme
+
+;;* lmx 392 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_153 domain (process (fork)))
+;;* lme
+
+;;* lmx 393 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_154 domain (process (fork)))
+;;* lme
+
+;;* lmx 393 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_155 domain (process (fork)))
+;;* lme
+
+;;* lmx 393 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_156 domain (process (fork)))
+;;* lme
+
+;;* lmx 394 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_157 domain (process (fork)))
+;;* lme
+
+;;* lmx 394 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_158 domain (process (fork)))
+;;* lme
+
+;;* lmx 394 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_159 domain (process (fork)))
+;;* lme
+
+;;* lmx 395 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_160 domain (process (fork)))
+;;* lme
+
+;;* lmx 395 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_161 domain (process (fork)))
+;;* lme
+
+;;* lmx 395 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_162 domain (process (fork)))
+;;* lme
+
+;;* lmx 396 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_163 domain (process (fork)))
+;;* lme
+
+;;* lmx 396 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_164 domain (process (fork)))
+;;* lme
+
+;;* lmx 396 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_165 domain (process (fork)))
+;;* lme
+
+;;* lmx 397 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_166 domain (process (fork)))
+;;* lme
+
+;;* lmx 397 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_167 domain (process (fork)))
+;;* lme
+
+;;* lmx 397 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_168 domain (process (fork)))
+;;* lme
+
+;;* lmx 398 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_169 domain (process (fork)))
+;;* lme
+
+;;* lmx 398 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_170 domain (process (fork)))
+;;* lme
+
+;;* lmx 398 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_171 domain (process (fork)))
+;;* lme
+
+;;* lmx 399 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_172 domain (process (fork)))
+;;* lme
+
+;;* lmx 399 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_173 domain (process (fork)))
+;;* lme
+
+;;* lmx 399 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_174 domain (process (fork)))
+;;* lme
+
+;;* lmx 400 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_175 domain (process (fork)))
+;;* lme
+
+;;* lmx 400 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_176 domain (process (fork)))
+;;* lme
+
+;;* lmx 400 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_177 domain (process (fork)))
+;;* lme
+
+;;* lmx 401 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_178 domain (process (fork)))
+;;* lme
+
+;;* lmx 401 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_179 domain (process (fork)))
+;;* lme
+
+;;* lmx 401 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_180 domain (process (fork)))
+;;* lme
+
+;;* lmx 402 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_181 domain (process (fork)))
+;;* lme
+
+;;* lmx 402 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_182 domain (process (fork)))
+;;* lme
+
+;;* lmx 402 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_183 domain (process (fork)))
+;;* lme
+
+;;* lmx 403 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_184 domain (process (fork)))
+;;* lme
+
+;;* lmx 403 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_185 domain (process (fork)))
+;;* lme
+
+;;* lmx 403 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_186 domain (process (fork)))
+;;* lme
+
+;;* lmx 404 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_187 domain (process (fork)))
+;;* lme
+
+;;* lmx 404 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_188 domain (process (fork)))
+;;* lme
+
+;;* lmx 404 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_189 domain (process (fork)))
+;;* lme
+
+;;* lmx 405 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_190 domain (process (fork)))
+;;* lme
+
+;;* lmx 405 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_191 domain (process (fork)))
+;;* lme
+
+;;* lmx 405 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_192 domain (process (fork)))
+;;* lme
+
+;;* lmx 406 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_193 domain (process (fork)))
+;;* lme
+
+;;* lmx 406 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_194 domain (process (fork)))
+;;* lme
+
+;;* lmx 406 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_195 domain (process (fork)))
+;;* lme
+
+;;* lmx 407 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_196 domain (process (fork)))
+;;* lme
+
+;;* lmx 407 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_197 domain (process (fork)))
+;;* lme
+
+;;* lmx 407 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_198 domain (process (fork)))
+;;* lme
+
+;;* lmx 408 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_199 domain (process (fork)))
+;;* lme
+
+;;* lmx 408 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_200 domain (process (fork)))
+;;* lme
+
+;;* lmx 408 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_201 domain (process (fork)))
+;;* lme
+
+;;* lmx 411 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_202 domain (process (fork)))
+;;* lme
+
+;;* lmx 411 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_203 domain (process (fork)))
+;;* lme
+
+;;* lmx 411 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_204 domain (process (fork)))
+;;* lme
+
+;;* lmx 412 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_205 domain (process (fork)))
+;;* lme
+
+;;* lmx 412 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_206 domain (process (fork)))
+;;* lme
+
+;;* lmx 412 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_207 domain (process (fork)))
+;;* lme
+
+;;* lmx 413 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_208 domain (process (fork)))
+;;* lme
+
+;;* lmx 413 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_209 domain (process (fork)))
+;;* lme
+
+;;* lmx 413 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_210 domain (process (fork)))
+;;* lme
+
+;;* lmx 414 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_211 domain (process (fork)))
+;;* lme
+
+;;* lmx 414 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_212 domain (process (fork)))
+;;* lme
+
+;;* lmx 414 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_213 domain (process (fork)))
+;;* lme
+
+;;* lmx 415 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_214 domain (process (fork)))
+;;* lme
+
+;;* lmx 415 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_215 domain (process (fork)))
+;;* lme
+
+;;* lmx 415 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_216 domain (process (fork)))
+;;* lme
+
+;;* lmx 416 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_217 domain (process (fork)))
+;;* lme
+
+;;* lmx 416 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_218 domain (process (fork)))
+;;* lme
+
+;;* lmx 416 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_219 domain (process (fork)))
+;;* lme
+
+;;* lmx 417 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_220 domain (process (fork)))
+;;* lme
+
+;;* lmx 417 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_221 domain (process (fork)))
+;;* lme
+
+;;* lmx 417 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_222 domain (process (fork)))
+;;* lme
+
+;;* lmx 418 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_223 domain (process (fork)))
+;;* lme
+
+;;* lmx 418 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_224 domain (process (fork)))
+;;* lme
+
+;;* lmx 418 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_225 domain (process (fork)))
+;;* lme
+
+;;* lmx 472 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_226 domain (process (fork)))
+;;* lme
+
+;;* lmx 472 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_227 domain (process (fork)))
+;;* lme
+
+;;* lmx 472 system/sepolicy/public/attributes
+
+(neverallow base_typeattr_228 domain (process (fork)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 apexd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 bootloader_boot_reason_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_activity_manager_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_boot_count_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_input_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 11 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_netd_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 12 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_reset_performed_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 firstboot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 boottime_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 charger_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 cold_boot_done_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_adbd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_apexd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_bootanim_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_bugreport_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_console_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_dumpstate_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_fuse_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_gsid_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_interface_restart_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_interface_stop_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_mdnsd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_restart_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_rildaemon_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ctl_sigstop_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 dynamic_system_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 heapprofd_enabled_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 llkd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 lpdumpd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 mmc_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 mock_ota_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 net_dns_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 overlay_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 persistent_properties_ready_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 safemode_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 system_lmk_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 system_trace_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 test_boot_reason_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 time_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 traced_enabled_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 traced_lazy_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 aac_drc_prop (property_service (set)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 adaptive_haptics_prop (property_service (set)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 apex_ready_prop (property_service (set)))
+;;* lme
+
+;;* lmx 56 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 arm64_memtag_prop (property_service (set)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 binder_cache_bluetooth_server_prop (property_service (set)))
+;;* lme
+
+;;* lmx 58 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 binder_cache_system_server_prop (property_service (set)))
+;;* lme
+
+;;* lmx 59 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 binder_cache_telephony_server_prop (property_service (set)))
+;;* lme
+
+;;* lmx 60 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 boot_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 bootanim_system_prop (property_service (set)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 bootloader_prop (property_service (set)))
+;;* lme
+
+;;* lmx 63 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 boottime_public_prop (property_service (set)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 bq_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 65 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 build_bootimage_prop (property_service (set)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 build_prop (property_service (set)))
+;;* lme
+
+;;* lmx 67 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 composd_vm_art_prop (property_service (set)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_aconfig_flags_prop (property_service (set)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_camera_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 70 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_edgetpu_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 71 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_media_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_nnapi_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 73 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_runtime_native_boot_prop (property_service (set)))
+;;* lme
+
+;;* lmx 74 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_runtime_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 75 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_surface_flinger_native_boot_prop (property_service (set)))
+;;* lme
+
+;;* lmx 76 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_vendor_system_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 77 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_config_vendor_system_native_boot_prop (property_service (set)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 drm_forcel3_prop (property_service (set)))
+;;* lme
+
+;;* lmx 79 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 fingerprint_prop (property_service (set)))
+;;* lme
+
+;;* lmx 80 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 gwp_asan_prop (property_service (set)))
+;;* lme
+
+;;* lmx 81 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 hal_instrumentation_prop (property_service (set)))
+;;* lme
+
+;;* lmx 82 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 userdebug_or_eng_prop (property_service (set)))
+;;* lme
+
+;;* lmx 83 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 init_service_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 84 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 libc_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 85 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 module_sdkextensions_prop (property_service (set)))
+;;* lme
+
+;;* lmx 86 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 nnapi_ext_deny_product_prop (property_service (set)))
+;;* lme
+
+;;* lmx 87 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 persist_wm_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 88 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 power_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 89 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 property_service_version_prop (property_service (set)))
+;;* lme
+
+;;* lmx 90 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 provisioned_prop (property_service (set)))
+;;* lme
+
+;;* lmx 91 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 restorecon_prop (property_service (set)))
+;;* lme
+
+;;* lmx 92 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 retaildemo_prop (property_service (set)))
+;;* lme
+
+;;* lmx 93 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 servicemanager_prop (property_service (set)))
+;;* lme
+
+;;* lmx 94 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 smart_idle_maint_enabled_prop (property_service (set)))
+;;* lme
+
+;;* lmx 95 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 socket_hook_prop (property_service (set)))
+;;* lme
+
+;;* lmx 96 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 sqlite_log_prop (property_service (set)))
+;;* lme
+
+;;* lmx 97 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 surfaceflinger_display_prop (property_service (set)))
+;;* lme
+
+;;* lmx 98 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 system_boot_reason_prop (property_service (set)))
+;;* lme
+
+;;* lmx 99 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 system_jvmti_agent_prop (property_service (set)))
+;;* lme
+
+;;* lmx 100 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 traced_oome_heap_session_count_prop (property_service (set)))
+;;* lme
+
+;;* lmx 101 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 ab_update_gki_prop (property_service (set)))
+;;* lme
+
+;;* lmx 102 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 usb_prop (property_service (set)))
+;;* lme
+
+;;* lmx 103 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 userspace_reboot_exported_prop (property_service (set)))
+;;* lme
+
+;;* lmx 104 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 vold_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 105 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 vts_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 enable_16k_pages_prop (property_service (set)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 profcollectd_etr_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 cppreopt_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 dalvik_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 debuggerd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 device_logging_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 dhcp_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 dumpstate_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 exported3_system_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 exported_dumpstate_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 exported_secure_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 heapprofd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 net_radio_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 pan_result_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 persist_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 shell_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 test_harness_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 theme_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 use_memfd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 vold_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init apexd_config_prop (property_service (set)))
+(allow vendor_init apexd_config_prop (file (read getattr map open)))
+;;* lmx 136 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 apexd_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init apexd_select_prop (property_service (set)))
+(allow vendor_init apexd_select_prop (file (read getattr map open)))
+;;* lmx 137 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 apexd_select_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init aaudio_config_prop (property_service (set)))
+(allow vendor_init aaudio_config_prop (file (read getattr map open)))
+;;* lmx 138 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 aaudio_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init apk_verity_prop (property_service (set)))
+(allow vendor_init apk_verity_prop (file (read getattr map open)))
+;;* lmx 139 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 apk_verity_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init audio_config_prop (property_service (set)))
+(allow vendor_init audio_config_prop (file (read getattr map open)))
+;;* lmx 140 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 audio_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init bootanim_config_prop (property_service (set)))
+(allow vendor_init bootanim_config_prop (file (read getattr map open)))
+;;* lmx 141 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 bootanim_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init bluetooth_config_prop (property_service (set)))
+(allow vendor_init bluetooth_config_prop (file (read getattr map open)))
+;;* lmx 142 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 bluetooth_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init build_attestation_prop (property_service (set)))
+(allow vendor_init build_attestation_prop (file (read getattr map open)))
+;;* lmx 143 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 build_attestation_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init build_config_prop (property_service (set)))
+(allow vendor_init build_config_prop (file (read getattr map open)))
+;;* lmx 144 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 build_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init build_odm_prop (property_service (set)))
+(allow vendor_init build_odm_prop (file (read getattr map open)))
+;;* lmx 145 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 build_odm_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init build_vendor_prop (property_service (set)))
+(allow vendor_init build_vendor_prop (file (read getattr map open)))
+;;* lmx 146 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 build_vendor_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camera_calibration_prop (property_service (set)))
+(allow vendor_init camera_calibration_prop (file (read getattr map open)))
+;;* lmx 147 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 camera_calibration_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camera_config_prop (property_service (set)))
+(allow vendor_init camera_config_prop (file (read getattr map open)))
+;;* lmx 148 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 camera_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camera2_extensions_prop (property_service (set)))
+(allow vendor_init camera2_extensions_prop (file (read getattr map open)))
+;;* lmx 149 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 camera2_extensions_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camerax_extensions_prop (property_service (set)))
+(allow vendor_init camerax_extensions_prop (file (read getattr map open)))
+;;* lmx 150 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 camerax_extensions_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init charger_config_prop (property_service (set)))
+(allow vendor_init charger_config_prop (file (read getattr map open)))
+;;* lmx 151 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 charger_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init codec2_config_prop (property_service (set)))
+(allow vendor_init codec2_config_prop (file (read getattr map open)))
+;;* lmx 152 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 codec2_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init composd_vm_vendor_prop (property_service (set)))
+(allow vendor_init composd_vm_vendor_prop (file (read getattr map open)))
+;;* lmx 153 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 composd_vm_vendor_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init cpu_variant_prop (property_service (set)))
+(allow vendor_init cpu_variant_prop (file (read getattr map open)))
+;;* lmx 154 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 cpu_variant_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init debugfs_restriction_prop (property_service (set)))
+(allow vendor_init debugfs_restriction_prop (file (read getattr map open)))
+;;* lmx 155 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 debugfs_restriction_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init drm_service_config_prop (property_service (set)))
+(allow vendor_init drm_service_config_prop (file (read getattr map open)))
+;;* lmx 156 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 drm_service_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_camera_prop (property_service (set)))
+(allow vendor_init exported_camera_prop (file (read getattr map open)))
+;;* lmx 157 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 exported_camera_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_config_prop (property_service (set)))
+(allow vendor_init exported_config_prop (file (read getattr map open)))
+;;* lmx 158 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 exported_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_default_prop (property_service (set)))
+(allow vendor_init exported_default_prop (file (read getattr map open)))
+;;* lmx 159 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 exported_default_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init ffs_config_prop (property_service (set)))
+(allow vendor_init ffs_config_prop (file (read getattr map open)))
+;;* lmx 160 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 ffs_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init framework_watchdog_config_prop (property_service (set)))
+(allow vendor_init framework_watchdog_config_prop (file (read getattr map open)))
+;;* lmx 161 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 framework_watchdog_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init graphics_config_prop (property_service (set)))
+(allow vendor_init graphics_config_prop (file (read getattr map open)))
+;;* lmx 162 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 graphics_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init hdmi_config_prop (property_service (set)))
+(allow vendor_init hdmi_config_prop (file (read getattr map open)))
+;;* lmx 163 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 hdmi_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init hw_timeout_multiplier_prop (property_service (set)))
+(allow vendor_init hw_timeout_multiplier_prop (file (read getattr map open)))
+;;* lmx 164 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 hw_timeout_multiplier_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init hypervisor_prop (property_service (set)))
+(allow vendor_init hypervisor_prop (file (read getattr map open)))
+;;* lmx 165 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 hypervisor_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init hypervisor_restricted_prop (property_service (set)))
+(allow vendor_init hypervisor_restricted_prop (file (read getattr map open)))
+;;* lmx 166 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 hypervisor_restricted_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init incremental_prop (property_service (set)))
+(allow vendor_init incremental_prop (file (read getattr map open)))
+;;* lmx 167 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 incremental_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init input_device_config_prop (property_service (set)))
+(allow vendor_init input_device_config_prop (file (read getattr map open)))
+;;* lmx 168 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 input_device_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init keyguard_config_prop (property_service (set)))
+(allow vendor_init keyguard_config_prop (file (read getattr map open)))
+;;* lmx 169 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 keyguard_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init keystore_config_prop (property_service (set)))
+(allow vendor_init keystore_config_prop (file (read getattr map open)))
+;;* lmx 170 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 keystore_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init lmkd_config_prop (property_service (set)))
+(allow vendor_init lmkd_config_prop (file (read getattr map open)))
+;;* lmx 171 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 lmkd_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init media_config_prop (property_service (set)))
+(allow vendor_init media_config_prop (file (read getattr map open)))
+;;* lmx 172 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 media_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init media_variant_prop (property_service (set)))
+(allow vendor_init media_variant_prop (file (read getattr map open)))
+;;* lmx 173 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 media_variant_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init mediadrm_config_prop (property_service (set)))
+(allow vendor_init mediadrm_config_prop (file (read getattr map open)))
+;;* lmx 174 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 mediadrm_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init mm_events_config_prop (property_service (set)))
+(allow vendor_init mm_events_config_prop (file (read getattr map open)))
+;;* lmx 175 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 mm_events_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init oem_unlock_prop (property_service (set)))
+(allow vendor_init oem_unlock_prop (file (read getattr map open)))
+;;* lmx 176 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 oem_unlock_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init ota_build_prop (property_service (set)))
+(allow vendor_init ota_build_prop (file (read getattr map open)))
+;;* lmx 177 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 ota_build_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init packagemanager_config_prop (property_service (set)))
+(allow vendor_init packagemanager_config_prop (file (read getattr map open)))
+;;* lmx 178 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 packagemanager_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init quick_start_prop (property_service (set)))
+(allow vendor_init quick_start_prop (file (read getattr map open)))
+;;* lmx 179 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 quick_start_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init recovery_config_prop (property_service (set)))
+(allow vendor_init recovery_config_prop (file (read getattr map open)))
+;;* lmx 180 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 recovery_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init recovery_usb_config_prop (property_service (set)))
+(allow vendor_init recovery_usb_config_prop (file (read getattr map open)))
+;;* lmx 181 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 recovery_usb_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init sendbug_config_prop (property_service (set)))
+(allow vendor_init sendbug_config_prop (file (read getattr map open)))
+;;* lmx 182 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 sendbug_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init soc_prop (property_service (set)))
+(allow vendor_init soc_prop (file (read getattr map open)))
+;;* lmx 183 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 soc_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init storage_config_prop (property_service (set)))
+(allow vendor_init storage_config_prop (file (read getattr map open)))
+;;* lmx 184 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 storage_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init storagemanager_config_prop (property_service (set)))
+(allow vendor_init storagemanager_config_prop (file (read getattr map open)))
+;;* lmx 185 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 storagemanager_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init surfaceflinger_prop (property_service (set)))
+(allow vendor_init surfaceflinger_prop (file (read getattr map open)))
+;;* lmx 186 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 surfaceflinger_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init suspend_prop (property_service (set)))
+(allow vendor_init suspend_prop (file (read getattr map open)))
+;;* lmx 187 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 suspend_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init systemsound_config_prop (property_service (set)))
+(allow vendor_init systemsound_config_prop (file (read getattr map open)))
+;;* lmx 188 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 systemsound_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init telephony_config_prop (property_service (set)))
+(allow vendor_init telephony_config_prop (file (read getattr map open)))
+;;* lmx 189 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 telephony_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init threadnetwork_config_prop (property_service (set)))
+(allow vendor_init threadnetwork_config_prop (file (read getattr map open)))
+;;* lmx 190 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 threadnetwork_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init tombstone_config_prop (property_service (set)))
+(allow vendor_init tombstone_config_prop (file (read getattr map open)))
+;;* lmx 191 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 tombstone_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init usb_config_prop (property_service (set)))
+(allow vendor_init usb_config_prop (file (read getattr map open)))
+;;* lmx 192 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 usb_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init userspace_reboot_config_prop (property_service (set)))
+(allow vendor_init userspace_reboot_config_prop (file (read getattr map open)))
+;;* lmx 193 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 userspace_reboot_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vehicle_hal_prop (property_service (set)))
+(allow vendor_init vehicle_hal_prop (file (read getattr map open)))
+;;* lmx 194 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vehicle_hal_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vendor_security_patch_level_prop (property_service (set)))
+(allow vendor_init vendor_security_patch_level_prop (file (read getattr map open)))
+;;* lmx 195 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vendor_security_patch_level_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vendor_socket_hook_prop (property_service (set)))
+(allow vendor_init vendor_socket_hook_prop (file (read getattr map open)))
+;;* lmx 196 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vendor_socket_hook_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init virtual_ab_prop (property_service (set)))
+(allow vendor_init virtual_ab_prop (file (read getattr map open)))
+;;* lmx 197 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 virtual_ab_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vndk_prop (property_service (set)))
+(allow vendor_init vndk_prop (file (read getattr map open)))
+;;* lmx 198 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vndk_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vts_config_prop (property_service (set)))
+(allow vendor_init vts_config_prop (file (read getattr map open)))
+;;* lmx 199 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vts_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vold_config_prop (property_service (set)))
+(allow vendor_init vold_config_prop (file (read getattr map open)))
+;;* lmx 200 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 vold_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init wifi_config_prop (property_service (set)))
+(allow vendor_init wifi_config_prop (file (read getattr map open)))
+;;* lmx 201 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 wifi_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init zram_config_prop (property_service (set)))
+(allow vendor_init zram_config_prop (file (read getattr map open)))
+;;* lmx 202 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 zram_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init zygote_config_prop (property_service (set)))
+(allow vendor_init zygote_config_prop (file (read getattr map open)))
+;;* lmx 203 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 zygote_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init dck_prop (property_service (set)))
+(allow vendor_init dck_prop (file (read getattr map open)))
+;;* lmx 204 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 dck_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init tuner_config_prop (property_service (set)))
+(allow vendor_init tuner_config_prop (file (read getattr map open)))
+;;* lmx 205 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 tuner_config_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init usb_uvc_enabled_prop (property_service (set)))
+(allow vendor_init usb_uvc_enabled_prop (file (read getattr map open)))
+;;* lmx 206 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 usb_uvc_enabled_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init setupwizard_mode_prop (property_service (set)))
+(allow vendor_init setupwizard_mode_prop (file (read getattr map open)))
+;;* lmx 207 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 setupwizard_mode_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init pm_archiving_enabled_prop (property_service (set)))
+(allow vendor_init pm_archiving_enabled_prop (file (read getattr map open)))
+;;* lmx 208 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 pm_archiving_enabled_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init trusty_security_vm_sys_vendor_prop (property_service (set)))
+(allow vendor_init trusty_security_vm_sys_vendor_prop (file (read getattr map open)))
+;;* lmx 209 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_230 trusty_security_vm_sys_vendor_prop (property_service (set)))
+;;* lme
+
+;;* lmx 276 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_229 default_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 279 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_231 rebootescrow_hal_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 282 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_231 virtual_face_hal_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 288 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_231 virtual_fingerprint_hal_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 358 system/sepolicy/public/property.te
+
+(neverallow base_typeattr_231 vendor_default_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/attributes
+
+(neverallow base_typeattr_232 domain (process (fork)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/attributes
+
+(neverallow base_typeattr_233 domain (process (fork)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/attributes
+
+(neverallow base_typeattr_234 domain (process (fork)))
+;;* lme
+
+(allow init aconfigd_exec (file (read getattr map execute open)))
+(allow init aconfigd (process (transition)))
+(allow aconfigd aconfigd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init aconfigd (process (noatsecure)))
+(allow init aconfigd (process (siginh rlimitinh)))
+(typetransition init aconfigd_exec process aconfigd)
+(allow aconfigd metadata_file (dir (search)))
+(allow aconfigd aconfig_storage_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow aconfigd aconfig_storage_flags_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow aconfigd aconfig_storage_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow aconfigd aconfig_storage_flags_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow aconfigd kmsg_device (chr_file (write)))
+(allow aconfigd vendor_aconfig_storage_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow aconfigd vendor_aconfig_storage_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow aconfigd apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow aconfigd apex_mnt_dir (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit aconfigd apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 37 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_235 aconfigd (process (transition)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_236 aconfigd (process (dyntransition)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_237 aconfig_storage_metadata_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_237 aconfig_storage_metadata_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_237 aconfig_storage_flags_metadata_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 70 system/sepolicy/private/aconfigd.te
+
+(neverallow base_typeattr_237 aconfig_storage_flags_metadata_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow init aconfigd_mainline_exec (file (read getattr map execute open)))
+(allow init aconfigd_mainline (process (transition)))
+(allow aconfigd_mainline aconfigd_mainline_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init aconfigd_mainline (process (noatsecure)))
+(allow init aconfigd_mainline (process (siginh rlimitinh)))
+(typetransition init aconfigd_mainline_exec process aconfigd_mainline)
+(allow aconfigd_mainline metadata_file (dir (search)))
+(allow aconfigd_mainline aconfig_storage_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow aconfigd_mainline aconfig_storage_flags_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow aconfigd_mainline aconfig_storage_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow aconfigd_mainline aconfig_storage_flags_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow aconfigd_mainline kmsg_device (chr_file (write)))
+(allow aconfigd_mainline apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow aconfigd_mainline apex_mnt_dir (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit aconfigd_mainline apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 37 system/sepolicy/private/aconfigd_mainline.te
+
+(neverallow base_typeattr_235 aconfigd_mainline (process (transition)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/aconfigd_mainline.te
+
+(neverallow base_typeattr_236 aconfigd_mainline (process (dyntransition)))
+;;* lme
+
+(allow init adbd_exec (file (read getattr map execute open)))
+(allow init adbd (process (transition)))
+(allow adbd adbd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init adbd (process (noatsecure)))
+(allow init adbd (process (siginh rlimitinh)))
+(typetransition init adbd_exec process adbd)
+(allow adbd shell_exec (file (read getattr map execute open)))
+(allow adbd shell (process (transition)))
+(allow shell shell_exec (file (read getattr map execute open entrypoint)))
+(allow shell adbd (process (sigchld)))
+(dontaudit adbd shell (process (noatsecure)))
+(allow adbd shell (process (siginh rlimitinh)))
+(typetransition adbd shell_exec process shell)
+(allow adbd self (process (setcurrent)))
+(allow adbd adbd_tradeinmode (process (dyntransition)))
+(allow adbd traced_consumer_socket (sock_file (write)))
+(allow adbd traced (unix_stream_socket (connectto)))
+(allow adbd shell (process (signal noatsecure)))
+(allow adbd self (capability (setgid setuid)))
+(allow adbd self (cap_userns (setgid setuid)))
+(allow adbd self (capability (setpcap)))
+(allow adbd self (cap_userns (setpcap)))
+(dontaudit adbd self (capability (sys_resource)))
+(dontaudit adbd self (cap_userns (sys_resource)))
+(allow adbd functionfs (dir (search)))
+(allow adbd functionfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx adbd functionfs (ioctl file (0x6703 0x6782)))
+(allow adbd trace_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd trace_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd profman_dump_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd profman_dump_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd tmpfs (dir (search)))
+(allow adbd rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd tmpfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow adbd fuse (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow adbd sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd anr_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd anr_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd vendor_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd vendor_framework_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd property_socket (sock_file (write)))
+(allow adbd init (unix_stream_socket (connectto)))
+(allow adbd shell_prop (property_service (set)))
+(allow adbd shell_prop (file (read getattr map open)))
+(allow adbd property_socket (sock_file (write)))
+(allow adbd init (unix_stream_socket (connectto)))
+(allow adbd powerctl_prop (property_service (set)))
+(allow adbd powerctl_prop (file (read getattr map open)))
+(allow adbd ffs_config_prop (file (read getattr map open)))
+(allow adbd property_socket (sock_file (write)))
+(allow adbd init (unix_stream_socket (connectto)))
+(allow adbd ffs_control_prop (property_service (set)))
+(allow adbd ffs_control_prop (file (read getattr map open)))
+(allow adbd property_socket (sock_file (write)))
+(allow adbd init (unix_stream_socket (connectto)))
+(allow adbd adbd_tradeinmode_prop (property_service (set)))
+(allow adbd adbd_tradeinmode_prop (file (read getattr map open)))
+(allow adbd property_socket (sock_file (write)))
+(allow adbd init (unix_stream_socket (connectto)))
+(allow adbd ctl_mdnsd_prop (property_service (set)))
+(allow adbd ctl_mdnsd_prop (file (read getattr map open)))
+(allow adbd system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow adbd servicemanager (binder (call transfer)))
+(allow servicemanager adbd (binder (call transfer)))
+(allow servicemanager adbd (dir (search)))
+(allow servicemanager adbd (file (read open)))
+(allow servicemanager adbd (process (getattr)))
+(allow adbd surfaceflinger (binder (call transfer)))
+(allow surfaceflinger adbd (binder (transfer)))
+(allow adbd surfaceflinger (fd (use)))
+(allow adbd gpuservice (binder (call transfer)))
+(allow gpuservice adbd (binder (transfer)))
+(allow adbd gpuservice (fd (use)))
+(allow adbd gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow adbd gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow adbd system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd adb_keys_file (dir (search)))
+(allow adbd adb_keys_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd app_data_file (dir (search)))
+(allow adbd app_data_file (sock_file (write)))
+(allow adbd appdomain (unix_stream_socket (connectto)))
+(allow adbd zygote_exec (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd kernel (security (read_policy)))
+(allow adbd service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd property_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd sepolicy_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd config_gz (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd proc_net_tcp_udp (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd gpu_service (service_manager (find)))
+(allow adbd surfaceflinger_service (service_manager (find)))
+(allow adbd bootchart_data_file (dir (search)))
+(allow adbd bootchart_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd storage_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd storage_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd mnt_user_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd mnt_user_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow adbd media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd perfetto (process (signal)))
+(allow adbd perfetto_traces_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd perfetto_traces_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd perfetto_configs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow adbd perfetto_configs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd shell (unix_stream_socket (read write shutdown)))
+(allow adbd shell (fd (use)))
+(allow adbd shell_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow adbd shell_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd vendor_apex_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd vendor_apex_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd apex_data_file (dir (search)))
+(allow adbd staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd tombstone_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd tombstone_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd shell_test_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow adbd shell_test_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow adbd shell_test_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lmx 220 system/sepolicy/private/adbd.te
+
+(neverallow adbd base_typeattr_238 (process (transition)))
+;;* lme
+
+;;* lmx 226 system/sepolicy/private/adbd.te
+
+(neverallow adbd base_typeattr_239 (process (dyntransition)))
+;;* lme
+
+;;* lmx 229 system/sepolicy/private/adbd.te
+
+(neverallow base_typeattr_235 adbd (process (transition)))
+;;* lme
+
+;;* lmx 230 system/sepolicy/private/adbd.te
+
+(neverallow base_typeattr_236 adbd (process (dyntransition)))
+;;* lme
+
+(allow adbd_common mdnsd_socket (sock_file (write)))
+(allow adbd_common mdnsd (unix_stream_socket (connectto)))
+(dontaudit adbd_common self (socket (create)))
+(dontaudit adbd_common self (vsock_socket (create)))
+(allow adbd_common self (vsock_socket (read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+(allow adbd_common device_logging_prop (file (read getattr map open)))
+(allow adbd_common devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow adbd_common system_adbd_prop (file (read getattr map open)))
+(allow adbd_common test_harness_prop (file (read getattr map open)))
+(allow adbd_common property_socket (sock_file (write)))
+(allow adbd_common init (unix_stream_socket (connectto)))
+(allow adbd_common adbd_prop (property_service (set)))
+(allow adbd_common adbd_prop (file (read getattr map open)))
+(allow adbd_common property_socket (sock_file (write)))
+(allow adbd_common init (unix_stream_socket (connectto)))
+(allow adbd_common adbd_config_prop (property_service (set)))
+(allow adbd_common adbd_config_prop (file (read getattr map open)))
+(allow adbd_common serialno_prop (file (read getattr map open)))
+(allow adbd_tradeinmode tradeinmode_exec (file (read getattr map execute open)))
+(allow adbd_tradeinmode tradeinmode (process (transition)))
+(allow tradeinmode tradeinmode_exec (file (read getattr map execute open entrypoint)))
+(allow tradeinmode adbd_tradeinmode (process (sigchld)))
+(dontaudit adbd_tradeinmode tradeinmode (process (noatsecure)))
+(allow adbd_tradeinmode tradeinmode (process (siginh rlimitinh)))
+(typetransition adbd_tradeinmode tradeinmode_exec process tradeinmode)
+(allow adbd_tradeinmode adbd (unix_stream_socket (read write getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+(allow adbd_tradeinmode adbd (fd (use)))
+(allow adbd_tradeinmode adbd (unix_dgram_socket (write connect)))
+(allow adbd_tradeinmode functionfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd_tradeinmode functionfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow adbd_tradeinmode proc_uptime (file (ioctl read getattr lock map open watch watch_reads)))
+(allow adbd_tradeinmode rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow adbd_tradeinmode property_socket (sock_file (write)))
+(allow adbd_tradeinmode init (unix_stream_socket (connectto)))
+(allow adbd_tradeinmode ffs_control_prop (property_service (set)))
+(allow adbd_tradeinmode ffs_control_prop (file (read getattr map open)))
+(allow init apexd_exec (file (read getattr map execute open)))
+(allow init apexd (process (transition)))
+(allow apexd apexd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init apexd (process (noatsecure)))
+(allow init apexd (process (siginh rlimitinh)))
+(typetransition init apexd_exec process apexd)
+(allow apexd servicemanager (binder (call transfer)))
+(allow servicemanager apexd (binder (call transfer)))
+(allow servicemanager apexd (dir (search)))
+(allow servicemanager apexd (file (read open)))
+(allow servicemanager apexd (process (getattr)))
+(allow apexd apex_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_240 apex_service (service_manager (add)))
+;;* lme
+
+(allow apexd apex_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow apexd apex_data_file (file (relabelfrom)))
+(allow apexd metadata_file (dir (search)))
+(allow apexd apex_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow apexd apex_ota_reserved_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_ota_reserved_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow apexd apex_data_file_type (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_data_file_type (file (ioctl read write create getattr setattr lock relabelto append map unlink rename open watch watch_reads)))
+(allow apexd apex_module_data_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_module_data_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow apexd apex_rollback_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_rollback_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow apexd system_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd system_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx apexd loop_device (ioctl blk_file (0x1261)))
+(allowx apexd loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) (range 0x4c08 0x4c0a))))
+(allow apexd dev_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd dev_type (blk_file (getattr)))
+(allow apexd vd_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd self (capability (chown dac_override dac_read_search fowner sys_admin)))
+(allow apexd self (cap_userns (chown dac_override dac_read_search fowner sys_admin)))
+(dontaudit apexd self (capability (fsetid)))
+(dontaudit apexd self (cap_userns (fsetid)))
+(allow apexd apex_mnt_dir (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd apex_mnt_dir (filesystem (mount unmount)))
+(allow apexd apex_mnt_dir (dir (mounton)))
+(allow apexd apex_mnt_dir (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow apexd apex_mnt_dir (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename mounton open watch watch_reads)))
+(allow apexd apex_info_file (file (relabelto)))
+(allow apexd apex_info_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd staging_data_file (file (unlink)))
+(allow apexd staging_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd staging_data_file (file (ioctl read getattr lock map link open watch watch_reads)))
+(allow apexd staging_data_file (file (relabelto)))
+(allow apexd staging_data_file (file (rename)))
+(allow apexd vendor_apex_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd vendor_apex_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd labeledfs (filesystem (mount unmount)))
+(allow apexd sysfs_type (dir (search)))
+(allow apexd sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd sysfs_dm (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd sysfs_loop (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd sysfs_loop (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow apexd kmsg_device (chr_file (write lock append map open)))
+(allow apexd property_socket (sock_file (write)))
+(allow apexd init (unix_stream_socket (connectto)))
+(allow apexd powerctl_prop (property_service (set)))
+(allow apexd powerctl_prop (file (read getattr map open)))
+(allow apexd property_socket (sock_file (write)))
+(allow apexd init (unix_stream_socket (connectto)))
+(allow apexd ctl_apexd_prop (property_service (set)))
+(allow apexd ctl_apexd_prop (file (read getattr map open)))
+(allow apexd property_socket (sock_file (write)))
+(allow apexd init (unix_stream_socket (connectto)))
+(allow apexd ctl_apex_load_prop (property_service (set)))
+(allow apexd ctl_apex_load_prop (file (read getattr map open)))
+(allow apexd vold_service (service_manager (find)))
+(allow apexd vold (binder (call transfer)))
+(allow vold apexd (binder (transfer)))
+(allow apexd vold (fd (use)))
+(allow apexd system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow apexd system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow apexd devpts (chr_file (read write)))
+(typetransition apexd devpts chr_file apexd_devpts)
+(allow apexd apexd_devpts (chr_file (ioctl read write getattr open)))
+(allowx apexd apexd_devpts (ioctl chr_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+;;* lmx 146 system/sepolicy/private/apexd.te
+
+(neverallowx base_typeattr_236 apexd_devpts (ioctl chr_file (0x5412)))
+;;* lme
+
+(allow apexd file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allowx apexd staging_data_file (ioctl file (0x6601)))
+(allowx apexd staging_data_file (ioctl file (0xf512)))
+(allow apexd cold_boot_done_prop (file (read getattr map open)))
+(allow apexd apexd_config_prop (file (read getattr map open)))
+(allow apexd apexd_select_prop (file (read getattr map open)))
+(allow apexd apexd_payload_metadata_prop (file (read getattr map open)))
+(allow apexd property_socket (sock_file (write)))
+(allow apexd init (unix_stream_socket (connectto)))
+(allow apexd apexd_prop (property_service (set)))
+(allow apexd apexd_prop (file (read getattr map open)))
+(allow apexd otapreopt_chroot (fd (use)))
+(allow apexd postinstall_apex_mnt_dir (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow apexd postinstall_apex_mnt_dir (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow apexd postinstall_apex_mnt_dir (lnk_file (create)))
+(allow apexd proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow apexd dexopt_chroot_setup (fd (use)))
+(allow apexd derive_classpath_exec (file (read getattr map execute open)))
+(allow apexd apexd_derive_classpath (process (transition)))
+(allow apexd_derive_classpath derive_classpath_exec (file (read getattr map execute open entrypoint)))
+(allow apexd_derive_classpath apexd (process (sigchld)))
+(dontaudit apexd apexd_derive_classpath (process (noatsecure)))
+(allow apexd apexd_derive_classpath (process (siginh rlimitinh)))
+(typetransition apexd derive_classpath_exec process apexd_derive_classpath)
+(allow apexd property_socket (sock_file (write)))
+(allow apexd init (unix_stream_socket (connectto)))
+(allow apexd apex_ready_prop (property_service (set)))
+(allow apexd apex_ready_prop (file (read getattr map open)))
+(allow apexd statsdw_socket (sock_file (write)))
+(allow apexd statsd (unix_dgram_socket (sendto)))
+(allow apexd statsbootstrap_service (service_manager (find)))
+(allow apexd system_server (binder (call transfer)))
+(allow system_server apexd (binder (transfer)))
+(allow apexd system_server (fd (use)))
+;;* lmx 202 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_241 apex_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 203 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_241 apex_metadata_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 204 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_242 apex_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 205 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_242 apex_metadata_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 206 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_240 apex_mnt_dir (lnk_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 208 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_243 apex_module_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 209 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_243 apex_module_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 211 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_243 apex_rollback_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 212 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_243 apex_rollback_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 215 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_241 apexd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 218 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_240 apex_info_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 226 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_244 apex_mnt_dir (filesystem (mount unmount)))
+;;* lme
+
+;;* lmx 227 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_245 apex_mnt_dir (dir (mounton)))
+;;* lme
+
+;;* lmx 232 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_246 apex_service (service_manager (find)))
+;;* lme
+
+;;* lmx 234 system/sepolicy/private/apexd.te
+
+(neverallow base_typeattr_247 apexd (binder (call)))
+;;* lme
+
+;;* lmx 236 system/sepolicy/private/apexd.te
+
+(neverallow domain apexd (process (ptrace)))
+;;* lme
+
+(allow apexd_derive_classpath apexd (fd (use)))
+(allow apexd_derive_classpath apex_mnt_dir (file (write open)))
+(allow apexd_derive_classpath apexd_devpts (chr_file (read write)))
+(allow base_typeattr_248 proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_248 proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_248 proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain test_harness_prop (file (read getattr map open)))
+(allow appdomain boot_status_prop (file (read getattr map open)))
+(allow appdomain dalvik_config_prop_type (file (read getattr map open)))
+(allow appdomain media_config_prop (file (read getattr map open)))
+(allow appdomain packagemanager_config_prop (file (read getattr map open)))
+(allow appdomain radio_control_prop (file (read getattr map open)))
+(allow appdomain surfaceflinger_color_prop (file (read getattr map open)))
+(allow appdomain systemsound_config_prop (file (read getattr map open)))
+(allow appdomain telephony_config_prop (file (read getattr map open)))
+(allow appdomain userspace_reboot_config_prop (file (read getattr map open)))
+(allow appdomain vold_config_prop (file (read getattr map open)))
+(allow appdomain adbd_config_prop (file (read getattr map open)))
+(allow appdomain dck_prop (file (read getattr map open)))
+(allow appdomain persist_wm_debug_prop (file (read getattr map open)))
+(allow appdomain persist_sysui_builder_extras_prop (file (read getattr map open)))
+(allow appdomain persist_sysui_ranking_update_prop (file (read getattr map open)))
+(allow appdomain traced_oome_heap_session_count_prop (file (read getattr map open)))
+(allow appdomain camera2_extensions_prop (file (read getattr map open)))
+(allow appdomain camerax_extensions_prop (file (read getattr map open)))
+(dontaudit appdomain storage_stub_file (dir (getattr)))
+(dontaudit appdomain system_data_file (dir (write)))
+(dontaudit appdomain vendor_default_prop (file (read)))
+(allow base_typeattr_249 mnt_media_rw_file (dir (search)))
+(allow appdomain system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow appdomain sendbug_config_prop (file (read getattr map open)))
+(allow appdomain graphics_config_prop (file (read getattr map open)))
+(allow appdomain camera_calibration_prop (file (read getattr map open)))
+(allow appdomain sqlite_log_prop (file (read getattr map open)))
+(allow appdomain font_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain font_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain apex_module_data_file (dir (search)))
+(allow appdomain apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain apex_art_data_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow appdomain tombstone_data_file (file (read getattr)))
+(allow base_typeattr_250 shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow base_typeattr_250 toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow base_typeattr_250 vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_250 vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_250 vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_250 vendor_app_file (file (execute)))
+(allow base_typeattr_251 vendor_microdroid_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 vendor_microdroid_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_251 vendor_microdroid_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain sdk_sandbox_all (binder (call transfer)))
+(allow sdk_sandbox_all appdomain (binder (transfer)))
+(allow appdomain sdk_sandbox_all (fd (use)))
+(allow appdomain virtual_camera (binder (call transfer)))
+(allow virtual_camera appdomain (binder (transfer)))
+(allow appdomain virtual_camera (fd (use)))
+(allow base_typeattr_251 storage_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 storage_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_251 mnt_user_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 mnt_user_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_251 sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_251 fuse (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_251 sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_251 fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_251 media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_251 media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_251 usb_device (chr_file (ioctl read write getattr)))
+(allow base_typeattr_251 usbaccessory_device (chr_file (read write getattr)))
+(allow base_typeattr_250 logd_socket (sock_file (write)))
+(allow base_typeattr_250 logd (unix_stream_socket (connectto)))
+(allow base_typeattr_251 keystore (keystore2_key (delete get_info grant rebind update use)))
+(allow base_typeattr_251 keystore_maintenance_service (service_manager (find)))
+(allow keystore base_typeattr_251 (dir (search)))
+(allow keystore base_typeattr_251 (file (read open)))
+(allow keystore base_typeattr_251 (process (getattr)))
+(allow base_typeattr_251 apc_service (service_manager (find)))
+(allow base_typeattr_251 keystore_service (service_manager (find)))
+(allow base_typeattr_251 legacykeystore_service (service_manager (find)))
+(allow base_typeattr_251 keystore (binder (call transfer)))
+(allow keystore base_typeattr_251 (binder (transfer)))
+(allow base_typeattr_251 keystore (fd (use)))
+(allow keystore base_typeattr_251 (binder (call transfer)))
+(allow base_typeattr_251 keystore (binder (transfer)))
+(allow keystore base_typeattr_251 (fd (use)))
+(allow credstore base_typeattr_251 (dir (search)))
+(allow credstore base_typeattr_251 (file (read open)))
+(allow credstore base_typeattr_251 (process (getattr)))
+(allow base_typeattr_251 credstore_service (service_manager (find)))
+(allow base_typeattr_251 credstore (binder (call transfer)))
+(allow credstore base_typeattr_251 (binder (transfer)))
+(allow base_typeattr_251 credstore (fd (use)))
+(allow credstore base_typeattr_251 (binder (call transfer)))
+(allow base_typeattr_251 credstore (binder (transfer)))
+(allow credstore base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 persistent_data_block_service (service_manager (find)))
+(allow base_typeattr_251 pdx_display_client_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 pdx_display_client_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_251 pdx_display_client_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow base_typeattr_251 pdx_display_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow base_typeattr_251 pdx_display_client_server_type (fd (use)))
+(allow pdx_display_client_server_type base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 pdx_display_manager_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 pdx_display_manager_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_251 pdx_display_manager_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow base_typeattr_251 pdx_display_manager_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow base_typeattr_251 pdx_display_manager_server_type (fd (use)))
+(allow pdx_display_manager_server_type base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 pdx_display_vsync_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 pdx_display_vsync_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_251 pdx_display_vsync_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow base_typeattr_251 pdx_display_vsync_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow base_typeattr_251 pdx_display_vsync_server_type (fd (use)))
+(allow pdx_display_vsync_server_type base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 pdx_performance_client_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_251 pdx_performance_client_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_251 pdx_performance_client_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow base_typeattr_251 pdx_performance_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow base_typeattr_251 pdx_performance_client_server_type (fd (use)))
+(allow pdx_performance_client_server_type base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 pdx_bufferhub_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow base_typeattr_251 pdx_bufferhub_client_server_type (fd (use)))
+(allow pdx_bufferhub_client_server_type base_typeattr_251 (fd (use)))
+(allow base_typeattr_251 tun_device (chr_file (ioctl read write getattr append)))
+(allowx base_typeattr_251 tun_device (ioctl chr_file (0x54d2)))
+(allow appdomain self (process (execmem)))
+(allow appdomain ashmem_device (chr_file (execute)))
+(allow appdomain ashmem_libcutils_device (chr_file (execute)))
+(allow appdomain zygote (fd (use)))
+(allow appdomain app_zygote (fd (use)))
+(allow appdomain zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow appdomain zygote (process (sigchld)))
+(allow appdomain dalvikcache_data_file (dir (getattr search)))
+(allow appdomain dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_252 rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_252 tmpfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_249 tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain zygote (fifo_file (write)))
+(allow appdomain shell (process (sigchld)))
+(allow appdomain adbd (process (sigchld)))
+(allow appdomain devpts (chr_file (ioctl read write getattr)))
+(allow appdomain system_server (fd (use)))
+(allow appdomain system_server (fifo_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow appdomain system_server (unix_stream_socket (read write getattr getopt setopt shutdown)))
+(allow appdomain system_server (tcp_socket (read write getattr getopt shutdown)))
+(allow appdomain vold (fd (use)))
+(allow appdomain appdomain (fifo_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow appdomain surfaceflinger (unix_stream_socket (read write getattr getopt setopt shutdown)))
+(allow base_typeattr_253 app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_253 privapp_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_253 storage_area_content_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow base_typeattr_253 app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_253 privapp_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_253 storage_area_content_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_253 storage_area_app_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_253 storage_area_dir (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allowx base_typeattr_253 app_data_file (ioctl file (0x6686)))
+(allowx base_typeattr_253 privapp_data_file (ioctl file (0x6686)))
+(allowx base_typeattr_253 storage_area_content_file (ioctl file (0x6686)))
+(allow base_typeattr_252 app_data_file (file (read write getattr map)))
+(allow base_typeattr_252 privapp_data_file (file (read write getattr map)))
+(allow base_typeattr_252 system_app_data_file (file (read write getattr map)))
+(allow base_typeattr_252 storage_area_content_file (file (read write getattr map)))
+(allow appdomain sdk_sandbox_data_file (file (read getattr)))
+(allow appdomain mnt_expand_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain keychain_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain keychain_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain keychain_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain misc_user_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain misc_user_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_254 textclassifier_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_254 textclassifier_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_254 textclassifier_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain oemfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain oemfs (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow appdomain system_file (file (getattr map execute execute_no_trans)))
+(allow appdomain system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain system_file (lnk_file (read getattr open)))
+(allow base_typeattr_254 vendor_file (dir (read open)))
+(allow appdomain vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain vendor_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain vendor_framework_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain vendor_framework_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain vendor_public_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain vendor_public_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain vendor_public_lib_file (file (read getattr map execute open)))
+(allow appdomain vendor_public_framework_file (file (read getattr map execute open)))
+(allow appdomain wallpaper_file (file (read write getattr map)))
+(allow appdomain ringtone_file (file (read write getattr map)))
+(allow appdomain shortcut_manager_icons (file (read getattr map)))
+(allow appdomain icon_file (file (read getattr map)))
+(allow appdomain anr_data_file (dir (search)))
+(allow appdomain anr_data_file (file (append open)))
+(allow appdomain tombstoned_java_trace_socket (sock_file (write)))
+(allow appdomain tombstoned (unix_stream_socket (connectto)))
+(allow appdomain tombstoned (fd (use)))
+(allow appdomain dumpstate (fifo_file (append)))
+(allow appdomain incidentd (fifo_file (append)))
+(allow appdomain dumpstate (fd (use)))
+(allow appdomain dumpstate (unix_stream_socket (read write getattr getopt shutdown)))
+(allow appdomain dumpstate (fifo_file (write getattr)))
+(allow appdomain shell_data_file (file (write getattr)))
+(allow appdomain incidentd (fd (use)))
+(allow appdomain incidentd (fifo_file (write getattr)))
+(allow appdomain statsdw_socket (sock_file (write)))
+(allow appdomain statsd (unix_dgram_socket (sendto)))
+(allow appdomain user_profile_root_file (dir (search)))
+(allow appdomain user_profile_data_file (dir (write lock open add_name remove_name search)))
+(allow appdomain user_profile_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow appdomain traced (fd (use)))
+(allow appdomain traced_tmpfs (file (read write getattr map)))
+(allow appdomain traced_producer_socket (sock_file (write)))
+(allow appdomain traced (unix_stream_socket (connectto)))
+(allow traced appdomain (fd (use)))
+(allow base_typeattr_254 gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_254 gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_254 sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain servicemanager (binder (call transfer)))
+(allow servicemanager appdomain (binder (call transfer)))
+(allow servicemanager appdomain (dir (search)))
+(allow servicemanager appdomain (file (read open)))
+(allow servicemanager appdomain (process (getattr)))
+(allow appdomain binderservicedomain (binder (call transfer)))
+(allow binderservicedomain appdomain (binder (transfer)))
+(allow appdomain binderservicedomain (fd (use)))
+(allow appdomain appdomain (binder (call transfer)))
+(allow appdomain appdomain (binder (transfer)))
+(allow appdomain appdomain (fd (use)))
+(allow appdomain ephemeral_app (binder (call transfer)))
+(allow ephemeral_app appdomain (binder (transfer)))
+(allow appdomain ephemeral_app (fd (use)))
+(allow base_typeattr_254 gpuservice (binder (call transfer)))
+(allow gpuservice base_typeattr_254 (binder (transfer)))
+(allow base_typeattr_254 gpuservice (fd (use)))
+(allow appdomain hal_graphics_composer (fd (use)))
+(allow appdomain appdomain (unix_stream_socket (read write getattr getopt shutdown)))
+(allow appdomain backup_data_file (file (read write getattr map)))
+(allow appdomain cache_backup_file (file (read write getattr map)))
+(allow appdomain cache_backup_file (dir (getattr)))
+(allow appdomain system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain system_data_file (file (read getattr map)))
+(allow base_typeattr_252 media_rw_data_file (file (read getattr)))
+(allow base_typeattr_254 radio_data_file (file (read write getattr)))
+(allow appdomain dalvikcache_data_file (file (execute)))
+(allow appdomain dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain shared_relro_file (dir (search)))
+(allow appdomain shared_relro_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain apk_data_file (dir (ioctl read getattr lock open search)))
+(allow appdomain apk_data_file (file (ioctl read getattr lock map execute open execute_no_trans)))
+(allow appdomain resourcecache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain resourcecache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow appdomain logdr_socket (sock_file (write)))
+(allow appdomain logd (unix_stream_socket (connectto)))
+(allow appdomain zygote (unix_dgram_socket (write)))
+(allow appdomain console_device (chr_file (read write)))
+(allowx base_typeattr_255 self (ioctl tcp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx base_typeattr_255 self (ioctl udp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx base_typeattr_255 self (ioctl rawip_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx base_typeattr_255 self (ioctl tcp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx base_typeattr_255 self (ioctl udp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx base_typeattr_255 self (ioctl rawip_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx base_typeattr_255 self (ioctl tcp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx base_typeattr_255 self (ioctl udp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx base_typeattr_255 self (ioctl rawip_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allow base_typeattr_254 ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_254 dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_254 dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_254 hal_audio (fd (use)))
+(allow base_typeattr_254 hal_camera (fd (use)))
+(allow base_typeattr_254 hal_tv_tuner_server (fd (use)))
+(allow base_typeattr_254 hal_power_server (fd (use)))
+(allow base_typeattr_254 hal_renderscript_hwservice (hwservice_manager (find)))
+(allow appdomain same_process_hal_file (file (read getattr map execute open)))
+(allow appdomain proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain app_fuse_file (file (read write getattr append map)))
+(allow appdomain runas_exec (file (getattr)))
+(allow appdomain high_barometer_quality_prop (file (read getattr map open)))
+(allow appdomain adbd (unix_stream_socket (connectto)))
+(allow appdomain adbd (fd (use)))
+(allow appdomain adbd (unix_stream_socket (ioctl read write getattr getopt shutdown)))
+(allow appdomain cache_file (dir (getattr)))
+(allow appdomain dropbox_data_file (file (read getattr)))
+(allow appdomain audioserver_tmpfs (file (read write getattr map)))
+(allow appdomain system_server_tmpfs (file (read write getattr map)))
+(allow appdomain zygote_tmpfs (file (read map)))
+;;* lmx 522 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_256 self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow base_typeattr_256 self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow base_typeattr_256 self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow base_typeattr_256 self (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+;;* lmx 525 system/sepolicy/private/app.te
+
+(neverallow appdomain dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 528 system/sepolicy/private/app.te
+
+(neverallow isolated_app graphics_device (chr_file (read write)))
+(neverallow shell graphics_device (chr_file (read write)))
+(neverallow untrusted_app graphics_device (chr_file (read write)))
+;;* lme
+
+;;* lmx 531 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_257 nfc_device (chr_file (read write)))
+;;* lme
+
+;;* lmx 533 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_255 hci_attach_dev (chr_file (read write)))
+;;* lme
+
+;;* lmx 534 system/sepolicy/private/app.te
+
+(neverallow appdomain tee_device (chr_file (read write)))
+;;* lme
+
+;;* lmx 544 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_258 domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow base_typeattr_258 domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow base_typeattr_258 domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow base_typeattr_258 domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow base_typeattr_258 domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 550 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_258 domain (netlink_kobject_uevent_socket (write append)))
+;;* lme
+
+;;* lmx 553 system/sepolicy/private/app.te
+
+(neverallow appdomain socket_device (sock_file (write)))
+;;* lme
+
+;;* lmx 556 system/sepolicy/private/app.te
+
+(neverallow appdomain adbd_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 557 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_259 rild_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 560 system/sepolicy/private/app.te
+
+(neverallow appdomain base_typeattr_260 (process (ptrace)))
+;;* lme
+
+;;* lmx 574 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_261 appdomain (process (ptrace)))
+;;* lme
+
+;;* lmx 578 system/sepolicy/private/app.te
+
+(neverallow appdomain base_typeattr_260 (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 579 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 base_typeattr_260 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 588 system/sepolicy/private/app.te
+
+(neverallow appdomain base_typeattr_263 (process (sigkill sigstop signal)))
+;;* lme
+
+;;* lmx 592 system/sepolicy/private/app.te
+
+(neverallow appdomain rootfs (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain rootfs (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 596 system/sepolicy/private/app.te
+
+(neverallow appdomain system_file_type (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_file_type (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 600 system/sepolicy/private/app.te
+
+(neverallow appdomain exec_type (file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 607 system/sepolicy/private/app.te
+
+(neverallow appdomain system_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain system_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 611 system/sepolicy/private/app.te
+
+(neverallow appdomain drm_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain drm_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 614 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_264 apk_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 617 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_264 apk_private_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 620 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_264 apk_private_tmp_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_private_tmp_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 623 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 shell_data_file (file (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (dir (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (lnk_file (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (chr_file (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (blk_file (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (sock_file (create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_262 shell_data_file (fifo_file (create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 626 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_255 bluetooth_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_255 bluetooth_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 627 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_265 credstore_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_265 credstore_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_265 credstore_data_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_265 credstore_data_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_265 credstore_data_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_265 credstore_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_265 credstore_data_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 630 system/sepolicy/private/app.te
+
+(neverallow appdomain keystore_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain keystore_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 633 system/sepolicy/private/app.te
+
+(neverallow appdomain systemkeys_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain systemkeys_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 636 system/sepolicy/private/app.te
+
+(neverallow appdomain wifi_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain wifi_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 639 system/sepolicy/private/app.te
+
+(neverallow appdomain dhcp_data_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain dhcp_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 644 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_264 apk_tmp_file (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow base_typeattr_264 apk_tmp_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 647 system/sepolicy/private/app.te
+
+(neverallow appdomain efs_file (file (write)))
+(neverallow appdomain efs_file (dir (write)))
+(neverallow appdomain efs_file (lnk_file (write)))
+(neverallow appdomain efs_file (chr_file (write)))
+(neverallow appdomain efs_file (blk_file (write)))
+(neverallow appdomain efs_file (sock_file (write)))
+(neverallow appdomain efs_file (fifo_file (write)))
+;;* lme
+
+;;* lmx 648 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 efs_file (file (read)))
+(neverallow base_typeattr_262 efs_file (dir (read)))
+(neverallow base_typeattr_262 efs_file (lnk_file (read)))
+(neverallow base_typeattr_262 efs_file (chr_file (read)))
+(neverallow base_typeattr_262 efs_file (blk_file (read)))
+(neverallow base_typeattr_262 efs_file (sock_file (read)))
+(neverallow base_typeattr_262 efs_file (fifo_file (read)))
+;;* lme
+
+;;* lmx 652 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_266 sysfs (file (write)))
+(neverallow base_typeattr_266 sysfs (dir (write)))
+(neverallow base_typeattr_266 sysfs (lnk_file (write)))
+(neverallow base_typeattr_266 sysfs (chr_file (write)))
+(neverallow base_typeattr_266 sysfs (blk_file (write)))
+(neverallow base_typeattr_266 sysfs (sock_file (write)))
+(neverallow base_typeattr_266 sysfs (fifo_file (write)))
+;;* lme
+
+;;* lmx 654 system/sepolicy/private/app.te
+
+(neverallow appdomain proc (file (write)))
+(neverallow appdomain proc (dir (write)))
+(neverallow appdomain proc (lnk_file (write)))
+(neverallow appdomain proc (chr_file (write)))
+(neverallow appdomain proc (blk_file (write)))
+(neverallow appdomain proc (sock_file (write)))
+(neverallow appdomain proc (fifo_file (write)))
+;;* lme
+
+;;* lmx 657 system/sepolicy/private/app.te
+
+(neverallow appdomain kernel (system (syslog_read syslog_mod syslog_console)))
+;;* lme
+
+;;* lmx 660 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 base_typeattr_236 (security (compute_av check_context)))
+;;* lme
+
+;;* lmx 661 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 base_typeattr_236 (netlink_selinux_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 665 system/sepolicy/private/app.te
+
+(neverallow appdomain fs_type (filesystem (mount remount unmount relabelfrom relabelto associate quotamod quotaget watch)))
+;;* lme
+
+;;* lmx 676 system/sepolicy/private/app.te
+
+(neverallow appdomain dev_type (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain rootfs (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain tmpfs (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain system_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain apk_data_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain cache_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow appdomain cache_recovery_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 682 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 input_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 690 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_267 bluetooth_a2dp_offload_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow base_typeattr_267 bluetooth_audio_hal_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow base_typeattr_267 bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow base_typeattr_267 exported_bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lme
+
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app nfc_prop (property_service (set)))
+(allow system_app nfc_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app radio_control_prop (property_service (set)))
+(allow system_app radio_control_prop (file (read getattr map open)))
+;;* lmx 699 system/sepolicy/private/app.te
+
+(neverallow appdomain proc_uid_time_in_state (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 702 system/sepolicy/private/app.te
+
+(neverallow appdomain proc_uid_concurrent_active_time (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 705 system/sepolicy/private/app.te
+
+(neverallow appdomain proc_uid_concurrent_policy_time (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 708 system/sepolicy/private/app.te
+
+(neverallow appdomain proc_uid_cpupower (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 713 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 proc_net_tcp_udp (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 721 system/sepolicy/private/app.te
+
+(neverallow appdomain system_bootstrap_lib_file (file (read write append map execute open execute_no_trans)))
+;;* lme
+
+;;* lmx 723 system/sepolicy/private/app.te
+
+(neverallow appdomain system_bootstrap_lib_file (dir (read getattr open search)))
+;;* lme
+
+;;* lmx 742 system/sepolicy/private/app.te
+
+(neverallow isolated_app_all base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow bluetooth base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow nfc base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow radio base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow shared_relro base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow system_app base_typeattr_268 (file (execute execute_no_trans)))
+(neverallow sdk_sandbox_all base_typeattr_268 (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 751 system/sepolicy/private/app.te
+
+(neverallow appdomain audio_device (chr_file (read write)))
+(neverallow appdomain camera_device (chr_file (read write)))
+(neverallow appdomain dm_device (chr_file (read write)))
+(neverallow appdomain radio_device (chr_file (read write)))
+(neverallow appdomain rpmsg_device (chr_file (read write)))
+;;* lme
+
+;;* lmx 758 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_269 video_device (chr_file (read write)))
+;;* lme
+
+;;* lmx 770 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_270 apk_data_file (dir (watch watch_reads)))
+;;* lme
+
+;;* lmx 778 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_270 apk_data_file (file (watch watch_reads)))
+;;* lme
+
+;;* lmx 782 system/sepolicy/private/app.te
+
+(neverallow appdomain system_server (udp_socket (ioctl create setattr lock relabelfrom relabelto append bind listen accept shutdown name_bind)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 base_typeattr_271 (process (transition)))
+;;* lme
+
+;;* lmx 793 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 base_typeattr_260 (process (dyntransition)))
+;;* lme
+
+;;* lmx 796 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_272 storage_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit appdomain system_font_fallback_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 800 system/sepolicy/private/app.te
+
+(neverallow appdomain system_font_fallback_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 802 system/sepolicy/private/app.te
+
+(neverallow base_typeattr_262 tombstone_data_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(typetransition base_typeattr_251 storage_area_dir fifo_file storage_area_content_file)
+(typetransition base_typeattr_251 storage_area_dir sock_file storage_area_content_file)
+(typetransition base_typeattr_251 storage_area_dir lnk_file storage_area_content_file)
+(typetransition base_typeattr_251 storage_area_dir dir storage_area_content_file)
+(typetransition base_typeattr_251 storage_area_dir file storage_area_content_file)
+;;* lmx 20 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 23 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 26 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 30 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all base_typeattr_273 (file (read)))
+(neverallow isolated_app_all base_typeattr_273 (file (read)))
+(neverallow ephemeral_app base_typeattr_273 (file (read)))
+(neverallow isolated_app base_typeattr_273 (file (read)))
+(neverallow isolated_compute_app base_typeattr_273 (file (read)))
+(neverallow mediaprovider base_typeattr_273 (file (read)))
+(neverallow untrusted_app base_typeattr_273 (file (read)))
+(neverallow untrusted_app_30 base_typeattr_273 (file (read)))
+(neverallow untrusted_app_29 base_typeattr_273 (file (read)))
+(neverallow untrusted_app_27 base_typeattr_273 (file (read)))
+(neverallow untrusted_app_25 base_typeattr_273 (file (read)))
+(neverallow mediaprovider_app base_typeattr_273 (file (read)))
+;;* lme
+
+;;* lmx 31 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all debugfs_type (file (read)))
+(neverallow untrusted_app_all debugfs_type (lnk_file (read)))
+(neverallow isolated_app_all debugfs_type (file (read)))
+(neverallow isolated_app_all debugfs_type (lnk_file (read)))
+(neverallow ephemeral_app debugfs_type (file (read)))
+(neverallow ephemeral_app debugfs_type (lnk_file (read)))
+(neverallow isolated_app debugfs_type (file (read)))
+(neverallow isolated_app debugfs_type (lnk_file (read)))
+(neverallow isolated_compute_app debugfs_type (file (read)))
+(neverallow isolated_compute_app debugfs_type (lnk_file (read)))
+(neverallow mediaprovider debugfs_type (file (read)))
+(neverallow mediaprovider debugfs_type (lnk_file (read)))
+(neverallow untrusted_app debugfs_type (file (read)))
+(neverallow untrusted_app debugfs_type (lnk_file (read)))
+(neverallow untrusted_app_30 debugfs_type (file (read)))
+(neverallow untrusted_app_30 debugfs_type (lnk_file (read)))
+(neverallow untrusted_app_29 debugfs_type (file (read)))
+(neverallow untrusted_app_29 debugfs_type (lnk_file (read)))
+(neverallow untrusted_app_27 debugfs_type (file (read)))
+(neverallow untrusted_app_27 debugfs_type (lnk_file (read)))
+(neverallow untrusted_app_25 debugfs_type (file (read)))
+(neverallow untrusted_app_25 debugfs_type (lnk_file (read)))
+(neverallow mediaprovider_app debugfs_type (file (read)))
+(neverallow mediaprovider_app debugfs_type (lnk_file (read)))
+;;* lme
+
+;;* lmx 36 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all service_manager_type (service_manager (add)))
+(neverallow isolated_app_all service_manager_type (service_manager (add)))
+(neverallow ephemeral_app service_manager_type (service_manager (add)))
+(neverallow isolated_app service_manager_type (service_manager (add)))
+(neverallow isolated_compute_app service_manager_type (service_manager (add)))
+(neverallow mediaprovider service_manager_type (service_manager (add)))
+(neverallow untrusted_app service_manager_type (service_manager (add)))
+(neverallow untrusted_app_30 service_manager_type (service_manager (add)))
+(neverallow untrusted_app_29 service_manager_type (service_manager (add)))
+(neverallow untrusted_app_27 service_manager_type (service_manager (add)))
+(neverallow untrusted_app_25 service_manager_type (service_manager (add)))
+(neverallow mediaprovider_app service_manager_type (service_manager (add)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 40 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all vndservice_manager_type (service_manager (add find list)))
+(neverallow isolated_app_all vndservice_manager_type (service_manager (add find list)))
+(neverallow ephemeral_app vndservice_manager_type (service_manager (add find list)))
+(neverallow isolated_app vndservice_manager_type (service_manager (add find list)))
+(neverallow isolated_compute_app vndservice_manager_type (service_manager (add find list)))
+(neverallow mediaprovider vndservice_manager_type (service_manager (add find list)))
+(neverallow untrusted_app vndservice_manager_type (service_manager (add find list)))
+(neverallow untrusted_app_30 vndservice_manager_type (service_manager (add find list)))
+(neverallow untrusted_app_29 vndservice_manager_type (service_manager (add find list)))
+(neverallow untrusted_app_27 vndservice_manager_type (service_manager (add find list)))
+(neverallow untrusted_app_25 vndservice_manager_type (service_manager (add find list)))
+(neverallow mediaprovider_app vndservice_manager_type (service_manager (add find list)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 property_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 init (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 46 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 property_type (property_service (set)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_all apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_all apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_all apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_all apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_all apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app_all apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app_all apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow ephemeral_app apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow ephemeral_app apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_compute_app apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_compute_app apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow mediaprovider apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow mediaprovider apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_30 apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_30 apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_29 apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_29 apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_27 apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_27 apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_25 apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow untrusted_app_25 apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow mediaprovider_app apk_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app apk_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_private_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow mediaprovider_app apk_private_tmp_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_private_tmp_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app apk_private_tmp_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_private_tmp_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app apk_private_tmp_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_all apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app apk_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app apk_private_tmp_file (file (ioctl write create setattr lock relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all net_dns_prop (file (read)))
+(neverallow isolated_app_all net_dns_prop (file (read)))
+(neverallow ephemeral_app net_dns_prop (file (read)))
+(neverallow isolated_app net_dns_prop (file (read)))
+(neverallow isolated_compute_app net_dns_prop (file (read)))
+(neverallow mediaprovider net_dns_prop (file (read)))
+(neverallow untrusted_app net_dns_prop (file (read)))
+(neverallow untrusted_app_30 net_dns_prop (file (read)))
+(neverallow untrusted_app_29 net_dns_prop (file (read)))
+(neverallow untrusted_app_27 net_dns_prop (file (read)))
+(neverallow untrusted_app_25 net_dns_prop (file (read)))
+(neverallow mediaprovider_app net_dns_prop (file (read)))
+;;* lme
+
+;;* lmx 56 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all radio_cdma_ecm_prop (file (read)))
+(neverallow isolated_app_all radio_cdma_ecm_prop (file (read)))
+(neverallow ephemeral_app radio_cdma_ecm_prop (file (read)))
+(neverallow isolated_app radio_cdma_ecm_prop (file (read)))
+(neverallow isolated_compute_app radio_cdma_ecm_prop (file (read)))
+(neverallow mediaprovider radio_cdma_ecm_prop (file (read)))
+(neverallow untrusted_app radio_cdma_ecm_prop (file (read)))
+(neverallow untrusted_app_30 radio_cdma_ecm_prop (file (read)))
+(neverallow untrusted_app_29 radio_cdma_ecm_prop (file (read)))
+(neverallow untrusted_app_27 radio_cdma_ecm_prop (file (read)))
+(neverallow untrusted_app_25 radio_cdma_ecm_prop (file (read)))
+(neverallow mediaprovider_app radio_cdma_ecm_prop (file (read)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow isolated_app_all app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow ephemeral_app app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow isolated_app app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow isolated_compute_app app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow mediaprovider app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow untrusted_app app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow untrusted_app_30 app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow untrusted_app_29 app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow untrusted_app_27 app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow untrusted_app_25 app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+(neverallow mediaprovider_app app_exec_data_file (file (write create setattr relabelfrom relabelto append link rename)))
+;;* lme
+
+;;* lmx 73 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_275 app_data_file (file (execute_no_trans)))
+(neverallow base_typeattr_275 privapp_data_file (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 75 system/sepolicy/private/app_neverallows.te
+
+(neverallow appdomain storage_area_content_file (file (execute)))
+;;* lme
+
+;;* lmx 83 system/sepolicy/private/app_neverallows.te
+
+(neverallow appdomain storage_area_app_dir (file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (dir (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (lnk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (chr_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (blk_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (sock_file (write create setattr relabelfrom relabelto append unlink link rename)))
+(neverallow appdomain storage_area_app_dir (fifo_file (write create setattr relabelfrom relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 97 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_276 dex2oat_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all mlstrustedsubject (process (fork)))
+(neverallow isolated_app_all mlstrustedsubject (process (fork)))
+(neverallow ephemeral_app mlstrustedsubject (process (fork)))
+(neverallow isolated_app mlstrustedsubject (process (fork)))
+(neverallow isolated_compute_app mlstrustedsubject (process (fork)))
+(neverallow mediaprovider mlstrustedsubject (process (fork)))
+(neverallow untrusted_app mlstrustedsubject (process (fork)))
+(neverallow untrusted_app_30 mlstrustedsubject (process (fork)))
+(neverallow untrusted_app_29 mlstrustedsubject (process (fork)))
+(neverallow untrusted_app_27 mlstrustedsubject (process (fork)))
+(neverallow untrusted_app_25 mlstrustedsubject (process (fork)))
+(neverallow mediaprovider_app mlstrustedsubject (process (fork)))
+;;* lme
+
+;;* lmx 115 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all file_type (file (link)))
+(neverallow isolated_app_all file_type (file (link)))
+(neverallow ephemeral_app file_type (file (link)))
+(neverallow isolated_app file_type (file (link)))
+(neverallow isolated_compute_app file_type (file (link)))
+(neverallow mediaprovider file_type (file (link)))
+(neverallow untrusted_app file_type (file (link)))
+(neverallow untrusted_app_30 file_type (file (link)))
+(neverallow untrusted_app_29 file_type (file (link)))
+(neverallow untrusted_app_27 file_type (file (link)))
+(neverallow untrusted_app_25 file_type (file (link)))
+(neverallow mediaprovider_app file_type (file (link)))
+;;* lme
+
+;;* lmx 118 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app sysfs_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 121 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow isolated_app_all sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow ephemeral_app sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow isolated_app sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow isolated_compute_app sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow mediaprovider sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow untrusted_app sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow untrusted_app_30 sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow untrusted_app_29 sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow untrusted_app_27 sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow untrusted_app_25 sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+(neverallow mediaprovider_app sysfs_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 124 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 128 system/sepolicy/private/app_neverallows.te
+
+(neverallowx untrusted_app_all domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_all domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_all domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_all domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx isolated_app_all domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx isolated_app_all domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx isolated_app_all domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx isolated_app_all domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx ephemeral_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx ephemeral_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx ephemeral_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx ephemeral_app domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx isolated_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx isolated_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx isolated_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx isolated_app domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx isolated_compute_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx isolated_compute_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx isolated_compute_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx isolated_compute_app domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx mediaprovider domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_30 domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_30 domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_30 domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_30 domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_29 domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_29 domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_29 domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_29 domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_27 domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_27 domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_27 domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_27 domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_25 domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_25 domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_25 domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx untrusted_app_25 domain (ioctl icmp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx mediaprovider_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx mediaprovider_app domain (ioctl icmp_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 128 system/sepolicy/private/app_neverallows.te
+
+(neverallowx untrusted_app_all domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_all domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_all domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_all domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app_all domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app_all domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app_all domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app_all domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx ephemeral_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx ephemeral_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx ephemeral_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx ephemeral_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_compute_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_compute_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_compute_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx isolated_compute_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_30 domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_30 domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_30 domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_30 domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_29 domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_29 domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_29 domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_29 domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_27 domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_27 domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_27 domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_27 domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_25 domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_25 domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_25 domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx untrusted_app_25 domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaprovider_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 128 system/sepolicy/private/app_neverallows.te
+
+(neverallowx untrusted_app_all domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_all domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_all domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_all domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app_all domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app_all domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app_all domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app_all domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx ephemeral_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx ephemeral_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx ephemeral_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx ephemeral_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_compute_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_compute_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_compute_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx isolated_compute_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_30 domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_30 domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_30 domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_30 domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_29 domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_29 domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_29 domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_29 domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_27 domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_27 domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_27 domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_27 domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_25 domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_25 domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_25 domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx untrusted_app_25 domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaprovider_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+;;* lmx 129 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow isolated_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow isolated_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow mediaprovider base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow mediaprovider base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow untrusted_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_selinux_socket (ioctl)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+;;* lme
+
+;;* lmx 142 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app_all base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_all base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow isolated_app_all base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow ephemeral_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow isolated_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow isolated_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow isolated_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow isolated_compute_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow mediaprovider base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow mediaprovider base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow mediaprovider base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow mediaprovider base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow mediaprovider base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app_30 base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app_29 base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app_27 base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow untrusted_app_25 base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow mediaprovider_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 147 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app_all base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow ephemeral_app base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_app base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow isolated_compute_app base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_30 base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_29 base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_27 base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow untrusted_app_25 base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+(neverallow mediaprovider_app base_typeattr_236 (vsock_socket (ioctl create setattr lock relabelfrom relabelto append map bind connect listen accept setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 150 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow isolated_app_all domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow ephemeral_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow isolated_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow isolated_compute_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow mediaprovider domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow untrusted_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow untrusted_app_30 domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow untrusted_app_29 domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow untrusted_app_27 domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow untrusted_app_25 domain (netlink_route_socket (bind nlmsg_readpriv)))
+(neverallow mediaprovider_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+;;* lme
+
+;;* lmx 151 system/sepolicy/private/app_neverallows.te
+
+(neverallow priv_app domain (netlink_route_socket (bind nlmsg_readpriv)))
+;;* lme
+
+;;* lmx 160 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_277 domain (netlink_route_socket (nlmsg_getneigh)))
+;;* lme
+
+;;* lmx 163 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_274 cache_recovery_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 164 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_274 cache_recovery_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 187 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_274 base_typeattr_278 (file (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (dir (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (lnk_file (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (chr_file (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (blk_file (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (sock_file (create unlink)))
+(neverallow base_typeattr_274 base_typeattr_278 (fifo_file (create unlink)))
+;;* lme
+
+;;* lmx 190 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_279 fuse_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 193 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all tun_device (chr_file (open)))
+(neverallow isolated_app_all tun_device (chr_file (open)))
+(neverallow ephemeral_app tun_device (chr_file (open)))
+(neverallow isolated_app tun_device (chr_file (open)))
+(neverallow isolated_compute_app tun_device (chr_file (open)))
+(neverallow mediaprovider tun_device (chr_file (open)))
+(neverallow untrusted_app tun_device (chr_file (open)))
+(neverallow untrusted_app_30 tun_device (chr_file (open)))
+(neverallow untrusted_app_29 tun_device (chr_file (open)))
+(neverallow untrusted_app_27 tun_device (chr_file (open)))
+(neverallow untrusted_app_25 tun_device (chr_file (open)))
+(neverallow mediaprovider_app tun_device (chr_file (open)))
+;;* lme
+
+;;* lmx 197 system/sepolicy/private/app_neverallows.te
+
+(neverallowx untrusted_app_all tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx isolated_app_all tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx ephemeral_app tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx isolated_app tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx isolated_compute_app tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx mediaprovider tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx untrusted_app tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx untrusted_app_30 tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx untrusted_app_29 tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx untrusted_app_27 tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx untrusted_app_25 tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+(neverallowx mediaprovider_app tun_device (ioctl chr_file ((range 0x0 0x53ff) (range 0x5500 0xffff))))
+;;* lme
+
+;;* lmx 197 system/sepolicy/private/app_neverallows.te
+
+(neverallowx untrusted_app_all tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx isolated_app_all tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx ephemeral_app tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx isolated_app tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx isolated_compute_app tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx mediaprovider tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx untrusted_app tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx untrusted_app_30 tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx untrusted_app_29 tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx untrusted_app_27 tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx untrusted_app_25 tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+(neverallowx mediaprovider_app tun_device (ioctl chr_file ((range 0x5400 0x544f) (range 0x5452 0x54d1) (range 0x54d3 0x54ff))))
+;;* lme
+
+;;* lmx 200 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 201 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow isolated_app_all anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow ephemeral_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow isolated_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow isolated_compute_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow mediaprovider anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow untrusted_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow untrusted_app_30 anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow untrusted_app_29 anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow untrusted_app_27 anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow untrusted_app_25 anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow mediaprovider_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 220 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_all proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_asound (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_kmsg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_loadavg (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_mounts (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_pagetypeinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_slabinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_stat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_swaps (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_uptime (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app proc_allocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 224 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_279 proc_filesystems (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 227 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app_all config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow ephemeral_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow isolated_compute_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_30 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_29 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_27 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow untrusted_app_25 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+(neverallow mediaprovider_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 230 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 234 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all system_file (file (lock)))
+(neverallow isolated_app_all system_file (file (lock)))
+(neverallow ephemeral_app system_file (file (lock)))
+(neverallow isolated_app system_file (file (lock)))
+(neverallow isolated_compute_app system_file (file (lock)))
+(neverallow mediaprovider system_file (file (lock)))
+(neverallow untrusted_app system_file (file (lock)))
+(neverallow untrusted_app_30 system_file (file (lock)))
+(neverallow untrusted_app_29 system_file (file (lock)))
+(neverallow untrusted_app_27 system_file (file (lock)))
+(neverallow untrusted_app_25 system_file (file (lock)))
+(neverallow mediaprovider_app system_file (file (lock)))
+;;* lme
+
+;;* lmx 238 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all base_typeattr_236 (hwservice_manager (add list)))
+(neverallow isolated_app_all base_typeattr_236 (hwservice_manager (add list)))
+(neverallow ephemeral_app base_typeattr_236 (hwservice_manager (add list)))
+(neverallow isolated_app base_typeattr_236 (hwservice_manager (add list)))
+(neverallow isolated_compute_app base_typeattr_236 (hwservice_manager (add list)))
+(neverallow mediaprovider base_typeattr_236 (hwservice_manager (add list)))
+(neverallow untrusted_app base_typeattr_236 (hwservice_manager (add list)))
+(neverallow untrusted_app_30 base_typeattr_236 (hwservice_manager (add list)))
+(neverallow untrusted_app_29 base_typeattr_236 (hwservice_manager (add list)))
+(neverallow untrusted_app_27 base_typeattr_236 (hwservice_manager (add list)))
+(neverallow untrusted_app_25 base_typeattr_236 (hwservice_manager (add list)))
+(neverallow mediaprovider_app base_typeattr_236 (hwservice_manager (add list)))
+;;* lme
+
+;;* lmx 253 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all protected_hwservice (hwservice_manager (find)))
+(neverallow isolated_app_all protected_hwservice (hwservice_manager (find)))
+(neverallow ephemeral_app protected_hwservice (hwservice_manager (find)))
+(neverallow isolated_app protected_hwservice (hwservice_manager (find)))
+(neverallow isolated_compute_app protected_hwservice (hwservice_manager (find)))
+(neverallow mediaprovider protected_hwservice (hwservice_manager (find)))
+(neverallow untrusted_app protected_hwservice (hwservice_manager (find)))
+(neverallow untrusted_app_30 protected_hwservice (hwservice_manager (find)))
+(neverallow untrusted_app_29 protected_hwservice (hwservice_manager (find)))
+(neverallow untrusted_app_27 protected_hwservice (hwservice_manager (find)))
+(neverallow untrusted_app_25 protected_hwservice (hwservice_manager (find)))
+(neverallow mediaprovider_app protected_hwservice (hwservice_manager (find)))
+;;* lme
+
+;;* lmx 254 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all protected_service (service_manager (find)))
+(neverallow isolated_app_all protected_service (service_manager (find)))
+(neverallow ephemeral_app protected_service (service_manager (find)))
+(neverallow isolated_app protected_service (service_manager (find)))
+(neverallow isolated_compute_app protected_service (service_manager (find)))
+(neverallow mediaprovider protected_service (service_manager (find)))
+(neverallow untrusted_app protected_service (service_manager (find)))
+(neverallow untrusted_app_30 protected_service (service_manager (find)))
+(neverallow untrusted_app_29 protected_service (service_manager (find)))
+(neverallow untrusted_app_27 protected_service (service_manager (find)))
+(neverallow untrusted_app_25 protected_service (service_manager (find)))
+(neverallow mediaprovider_app protected_service (service_manager (find)))
+;;* lme
+
+;;* lmx 257 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 264 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_280 proc_tty_drivers (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 265 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow isolated_app_all proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow ephemeral_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow isolated_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow isolated_compute_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow mediaprovider proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow untrusted_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow mediaprovider_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 268 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 269 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 277 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_276 mnt_sdcard_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 280 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all incident_service (service_manager (find)))
+(neverallow isolated_app_all incident_service (service_manager (find)))
+(neverallow ephemeral_app incident_service (service_manager (find)))
+(neverallow isolated_app incident_service (service_manager (find)))
+(neverallow isolated_compute_app incident_service (service_manager (find)))
+(neverallow mediaprovider incident_service (service_manager (find)))
+(neverallow untrusted_app incident_service (service_manager (find)))
+(neverallow untrusted_app_30 incident_service (service_manager (find)))
+(neverallow untrusted_app_29 incident_service (service_manager (find)))
+(neverallow untrusted_app_27 incident_service (service_manager (find)))
+(neverallow untrusted_app_25 incident_service (service_manager (find)))
+(neverallow mediaprovider_app incident_service (service_manager (find)))
+;;* lme
+
+;;* lmx 283 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all stats_service (service_manager (find)))
+(neverallow isolated_app_all stats_service (service_manager (find)))
+(neverallow ephemeral_app stats_service (service_manager (find)))
+(neverallow isolated_app stats_service (service_manager (find)))
+(neverallow isolated_compute_app stats_service (service_manager (find)))
+(neverallow mediaprovider stats_service (service_manager (find)))
+(neverallow untrusted_app stats_service (service_manager (find)))
+(neverallow untrusted_app_30 stats_service (service_manager (find)))
+(neverallow untrusted_app_29 stats_service (service_manager (find)))
+(neverallow untrusted_app_27 stats_service (service_manager (find)))
+(neverallow untrusted_app_25 stats_service (service_manager (find)))
+(neverallow mediaprovider_app stats_service (service_manager (find)))
+;;* lme
+
+;;* lmx 293 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_281 userdebug_or_eng_prop (file (read)))
+;;* lme
+
+;;* lmx 307 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_282 mdnsd_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 315 system/sepolicy/private/app_neverallows.te
+
+(neverallow base_typeattr_282 mdnsd (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 321 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow ephemeral_app domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_compute_app domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_30 domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_29 domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_27 domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow untrusted_app_25 domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow mediaprovider_app domain (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 324 system/sepolicy/private/app_neverallows.te
+
+(neverallow untrusted_app_all hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow ephemeral_app hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_compute_app hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_30 hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_29 hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_27 hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow untrusted_app_25 hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow mediaprovider_app hidraw_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(typetransition app_zygote tmpfs file app_zygote_tmpfs)
+(allow app_zygote app_zygote_tmpfs (file (read write getattr map)))
+(allow app_zygote self (capability (setgid setuid)))
+(allow app_zygote self (cap_userns (setgid setuid)))
+(allow app_zygote self (capability (setpcap)))
+(allow app_zygote self (cap_userns (setpcap)))
+(allow app_zygote self (process (setcurrent)))
+(allow app_zygote isolated_app (process (dyntransition)))
+(allow app_zygote self (process (execmem)))
+(allow app_zygote app_zygote_tmpfs (file (execute)))
+(allow app_zygote debugfs_trace_marker (file (getattr)))
+(allow app_zygote system_server (process (getpgid)))
+(allow app_zygote isolated_app (process (setpgid)))
+(dontaudit app_zygote mnt_expand_file (dir (getattr)))
+(allow app_zygote seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote selinuxfs (file (write lock append map open)))
+(allow app_zygote kernel (security (check_context)))
+(allow app_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote selinuxfs (file (write lock append map open)))
+(allow app_zygote kernel (security (compute_av)))
+(allow app_zygote self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow app_zygote zygote_tmpfs (file (read getattr)))
+(allow app_zygote zygote (fd (use)))
+(allow app_zygote zygote (process (sigchld)))
+(allow app_zygote dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote dalvikcache_data_file (file (execute)))
+(allow app_zygote app_zygote_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su app_zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 63 system/sepolicy/private/app_zygote.te
+
+(neverallow base_typeattr_283 app_zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow app_zygote apex_module_data_file (dir (search)))
+(allow app_zygote apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote apex_art_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote apk_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow app_zygote oemfs (dir (search)))
+(allow app_zygote vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow app_zygote vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote vendor_apex_metadata_file (dir (getattr search)))
+(allow app_zygote system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote system_data_file (file (read getattr map)))
+(allow app_zygote system_unsolzygote_socket (sock_file (write)))
+(allow app_zygote system_server (unix_dgram_socket (sendto)))
+(allow app_zygote device_config_runtime_native_prop (file (read getattr map open)))
+(allow app_zygote device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow app_zygote odsign_prop (file (read getattr map open)))
+(allow app_zygote resourcecache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow app_zygote resourcecache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+;;* lmx 105 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_284 (process (dyntransition)))
+;;* lme
+
+;;* lmx 108 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_285 (process (transition)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_236 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 116 system/sepolicy/private/app_zygote.te
+
+(neverallow base_typeattr_286 app_zygote (process (dyntransition)))
+;;* lme
+
+;;* lmx 119 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote property_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 120 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote property_type (property_service (set)))
+;;* lme
+
+;;* lmx 123 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote app_data_file_type (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 129 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_287 (service_manager (find)))
+;;* lme
+
+;;* lmx 132 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote gpu_device (chr_file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 135 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 152 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote domain (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow app_zygote domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow app_zygote domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow app_zygote domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_route_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh)))
+(neverallow app_zygote domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow app_zygote domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow app_zygote domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow app_zygote domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow app_zygote domain (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow app_zygote domain (icmp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow app_zygote domain (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (vsock_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow app_zygote domain (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 163 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_288 (unix_dgram_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 170 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_289 (unix_stream_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind connectto)))
+;;* lme
+
+;;* lmx 173 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote base_typeattr_236 (process (ptrace)))
+;;* lme
+
+;;* lmx 182 system/sepolicy/private/app_zygote.te
+
+(neverallow app_zygote bluetooth_a2dp_offload_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow app_zygote bluetooth_audio_hal_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow app_zygote bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow app_zygote exported_bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lme
+
+(allow init art_boot_exec (file (read getattr map execute open)))
+(allow init art_boot (process (transition)))
+(allow art_boot art_boot_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init art_boot (process (noatsecure)))
+(allow init art_boot (process (siginh rlimitinh)))
+(typetransition init art_boot_exec process art_boot)
+(allow art_boot device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow art_boot device_config_runtime_native_prop (file (read getattr map open)))
+(allow art_boot property_socket (sock_file (write)))
+(allow art_boot init (unix_stream_socket (connectto)))
+(allow art_boot dalvik_config_prop_type (property_service (set)))
+(allow art_boot dalvik_config_prop_type (file (read getattr map open)))
+(allow init art_exec_exec (file (read getattr map execute open)))
+(allow init art_exec (process (transition)))
+(allow art_exec art_exec_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init art_exec (process (noatsecure)))
+(allow init art_exec (process (siginh rlimitinh)))
+(typetransition init art_exec_exec process art_exec)
+(allow art_exec artd_exec (file (read getattr map execute open)))
+(allow art_exec artd (process (transition)))
+(allow artd artd_exec (file (read getattr map execute open entrypoint)))
+(allow artd art_exec (process (sigchld)))
+(dontaudit art_exec artd (process (noatsecure)))
+(allow art_exec artd (process (siginh rlimitinh)))
+(typetransition art_exec artd_exec process artd)
+(allow art_exec self (capability (sys_chroot)))
+(allow art_exec self (cap_userns (sys_chroot)))
+(allow art_exec pre_reboot_dexopt_file (dir (search)))
+(allow artd servicemanager (binder (call transfer)))
+(allow servicemanager artd (binder (call transfer)))
+(allow servicemanager artd (dir (search)))
+(allow servicemanager artd (file (read open)))
+(allow servicemanager artd (process (getattr)))
+(allow artd artd_service (service_manager (add find)))
+;;* lmx 12 system/sepolicy/private/artd.te
+
+(neverallow base_typeattr_290 artd_service (service_manager (add)))
+;;* lme
+
+(allow artd artd_pre_reboot_service (service_manager (add find)))
+;;* lmx 13 system/sepolicy/private/artd.te
+
+(neverallow base_typeattr_290 artd_pre_reboot_service (service_manager (add)))
+;;* lme
+
+(allow artd dumpstate (fifo_file (write getattr)))
+(allow artd dumpstate (fd (use)))
+(allow init artd_exec (file (read getattr map execute open)))
+(allow init artd (process (transition)))
+(allow artd artd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init artd (process (noatsecure)))
+(allow init artd (process (siginh rlimitinh)))
+(typetransition init artd_exec process artd)
+(allow artd device_config_runtime_native_prop (file (read getattr map open)))
+(allow artd device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow artd odsign_prop (file (read getattr map open)))
+(typetransition artd tmpfs file artd_tmpfs)
+(allow artd artd_tmpfs (file (read write getattr map)))
+(allow artd artd_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su artd_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 35 system/sepolicy/private/artd.te
+
+(neverallow base_typeattr_290 artd_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow artd mnt_expand_file (dir (getattr search)))
+(allow artd apk_data_file (dir (ioctl read write create getattr setattr lock relabelfrom open watch watch_reads add_name remove_name search)))
+(allow artd apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom open watch watch_reads add_name remove_name search)))
+(allow artd apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd oemfs (dir (getattr search)))
+(allow artd vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd vendor_apex_metadata_file (dir (getattr search)))
+(allow artd vendor_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd vendor_framework_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd vendor_framework_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd dalvikcache_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow artd dalvikcache_data_file (file (ioctl read write create getattr setattr lock relabelto append map unlink rename open watch watch_reads)))
+(allow artd apex_module_data_file (dir (getattr search)))
+(allow artd apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd apex_art_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd self (capability (chown dac_override dac_read_search fowner)))
+(allow artd self (cap_userns (chown dac_override dac_read_search fowner)))
+(allow artd user_profile_root_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd user_profile_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow artd user_profile_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow artd app_data_file_type (dir (ioctl read write create getattr setattr lock relabelfrom relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow artd app_data_file_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink rename open watch watch_reads)))
+(allow artd privapp_data_file (lnk_file (read getattr)))
+(allow artd file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd selinuxfs (file (write lock append map open)))
+(allow artd kernel (security (check_context)))
+(allow artd rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd system_data_root_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd mnt_expand_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd system_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd system_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd art_exec_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow artd profman_exec (file (read getattr map execute open)))
+(allow artd profman (process (transition)))
+(allow profman profman_exec (file (read getattr map execute open entrypoint)))
+(allow profman artd (process (sigchld)))
+(dontaudit artd profman (process (noatsecure)))
+(allow artd profman (process (siginh rlimitinh)))
+(typetransition artd profman_exec process profman)
+(allow artd dex2oat_exec (file (read getattr map execute open)))
+(allow artd dex2oat (process (transition)))
+(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
+(allow dex2oat artd (process (sigchld)))
+(dontaudit artd dex2oat (process (noatsecure)))
+(allow artd dex2oat (process (siginh rlimitinh)))
+(typetransition artd dex2oat_exec process dex2oat)
+(allow artd artd_subprocess_type (process (sigkill)))
+(allow artd profman (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd profman (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd profman (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd dex2oat (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow artd dex2oat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd dex2oat (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow artd artd_tmpfs (file (open)))
+(allow artd art_exec (fd (use)))
+(allow artd self (capability (sys_admin)))
+(allow artd self (cap_userns (sys_admin)))
+(allow artd derive_classpath_exec (file (read getattr map execute open)))
+(allow artd derive_classpath (process (transition)))
+(allow derive_classpath derive_classpath_exec (file (read getattr map execute open entrypoint)))
+(allow derive_classpath artd (process (sigchld)))
+(dontaudit artd derive_classpath (process (noatsecure)))
+(allow artd derive_classpath (process (siginh rlimitinh)))
+(typetransition artd derive_classpath_exec process derive_classpath)
+(allow artd odrefresh_exec (file (read getattr map execute open)))
+(allow artd odrefresh (process (transition)))
+(allow odrefresh odrefresh_exec (file (read getattr map execute open entrypoint)))
+(allow odrefresh artd (process (sigchld)))
+(dontaudit artd odrefresh (process (noatsecure)))
+(allow artd odrefresh (process (siginh rlimitinh)))
+(typetransition artd odrefresh_exec process odrefresh)
+(allow artd pre_reboot_dexopt_file (dir (getattr search)))
+(allow artd rootfs (file (read getattr open)))
+(allow artd pre_reboot_dexopt_artd_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow artd pre_reboot_dexopt_artd_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow artd apex_art_data_file (dir (relabelto)))
+(allow artd odrefresh_data_file (dir (relabelto)))
+(allow artd apex_art_data_file (dir (mounton)))
+(allow artd odrefresh_data_file (dir (mounton)))
+(allow artd pre_reboot_dexopt_artd_file (dir (mounton)))
+;;* lmx 189 system/sepolicy/private/artd.te
+
+(neverallow artd base_typeattr_291 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 193 system/sepolicy/private/artd.te
+
+(neverallow artd base_typeattr_292 (process (transition)))
+;;* lme
+
+;;* lmx 200 system/sepolicy/private/artd.te
+
+(neverallow artd_subprocess_type self (process (setpgid)))
+;;* lme
+
+;;* lmx 201 system/sepolicy/private/artd.te
+
+(neverallow artd_subprocess_type base_typeattr_292 (process (transition)))
+;;* lme
+
+(allow atrace boottrace_data_file (dir (search)))
+(allow atrace boottrace_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow atrace debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow atrace debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow atrace debugfs_trace_marker (file (getattr)))
+(allow atrace traced_probes (fd (use)))
+(allow atrace traced_probes (fifo_file (write getattr)))
+(allow atrace property_socket (sock_file (write)))
+(allow atrace init (unix_stream_socket (connectto)))
+(allow atrace debug_prop (property_service (set)))
+(allow atrace debug_prop (file (read getattr map open)))
+(allow atrace base_typeattr_293 (service_manager (find)))
+(allow atrace servicemanager (service_manager (list)))
+(allow atrace servicemanager (binder (call transfer)))
+(allow servicemanager atrace (binder (call transfer)))
+(allow servicemanager atrace (dir (search)))
+(allow servicemanager atrace (file (read open)))
+(allow servicemanager atrace (process (getattr)))
+(allow atrace surfaceflinger (binder (call)))
+(allow atrace system_server (binder (call)))
+(allow atrace cameraserver (binder (call)))
+(dontaudit atrace hwservice_manager_type (hwservice_manager (find)))
+(dontaudit atrace service_manager_type (service_manager (find)))
+(dontaudit atrace domain (binder (call)))
+(allow atrace hwservicemanager_prop (file (read getattr map open)))
+(dontaudit atrace debugfs_tracing_debug (file (audit_access)))
+(allow init audioserver_exec (file (read getattr map execute open)))
+(allow init audioserver (process (transition)))
+(allow audioserver audioserver_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init audioserver (process (noatsecure)))
+(allow init audioserver (process (siginh rlimitinh)))
+(typetransition init audioserver_exec process audioserver)
+(typetransition audioserver tmpfs file audioserver_tmpfs)
+(allow audioserver audioserver_tmpfs (file (read write getattr map)))
+(allow audioserver sdcard_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow audioserver sdcard_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver sdcard_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver fuse (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow audioserver fuse (file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver fuse (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver servicemanager (binder (call transfer)))
+(allow servicemanager audioserver (binder (call transfer)))
+(allow servicemanager audioserver (dir (search)))
+(allow servicemanager audioserver (file (read open)))
+(allow servicemanager audioserver (process (getattr)))
+(allow audioserver binderservicedomain (binder (call transfer)))
+(allow binderservicedomain audioserver (binder (transfer)))
+(allow audioserver binderservicedomain (fd (use)))
+(allow audioserver appdomain (binder (call transfer)))
+(allow appdomain audioserver (binder (transfer)))
+(allow audioserver appdomain (fd (use)))
+(allow audioserver system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow audioserver system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow audioserver audioserver_service (service_manager (add find)))
+;;* lmx 32 system/sepolicy/private/audioserver.te
+
+(neverallow base_typeattr_294 audioserver_service (service_manager (add)))
+;;* lme
+
+(allow audioserver activity_service (service_manager (find)))
+(allow audioserver appops_service (service_manager (find)))
+(allow audioserver batterystats_service (service_manager (find)))
+(allow audioserver external_vibrator_service (service_manager (find)))
+(allow audioserver package_native_service (service_manager (find)))
+(allow audioserver permission_service (service_manager (find)))
+(allow audioserver permission_checker_service (service_manager (find)))
+(allow audioserver power_service (service_manager (find)))
+(allow audioserver scheduling_policy_service (service_manager (find)))
+(allow audioserver mediametrics_service (service_manager (find)))
+(allow audioserver sensor_privacy_service (service_manager (find)))
+(allow audioserver soundtrigger_middleware_service (service_manager (find)))
+(allow audioserver audio_service (service_manager (find)))
+(allow audioserver virtual_device_native_service (service_manager (find)))
+(allow audioserver property_socket (sock_file (write)))
+(allow audioserver init (unix_stream_socket (connectto)))
+(allow audioserver bluetooth_a2dp_offload_prop (property_service (set)))
+(allow audioserver bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow audioserver property_socket (sock_file (write)))
+(allow audioserver init (unix_stream_socket (connectto)))
+(allow audioserver bluetooth_audio_hal_prop (property_service (set)))
+(allow audioserver bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow audioserver property_socket (sock_file (write)))
+(allow audioserver init (unix_stream_socket (connectto)))
+(allow audioserver bluetooth_prop (property_service (set)))
+(allow audioserver bluetooth_prop (file (read getattr map open)))
+(allow audioserver property_socket (sock_file (write)))
+(allow audioserver init (unix_stream_socket (connectto)))
+(allow audioserver exported_bluetooth_prop (property_service (set)))
+(allow audioserver exported_bluetooth_prop (file (read getattr map open)))
+(allow audioserver audio_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow audioserver audio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow audioserver audio_device (chr_file (read write)))
+(allow audioserver bluetooth_socket (sock_file (write)))
+(allow audioserver bluetooth (unix_stream_socket (connectto)))
+(allow audioserver adbd (fd (use)))
+(allow audioserver adbd (unix_stream_socket (read write)))
+(allow audioserver shell (fifo_file (read write)))
+(allow audioserver property_socket (sock_file (write)))
+(allow audioserver init (unix_stream_socket (connectto)))
+(allow audioserver log_tag_prop (property_service (set)))
+(allow audioserver log_tag_prop (file (read getattr map open)))
+(allow audioserver hal_audio_server (process (signal)))
+(allow audioserver sensorservice_service (service_manager (find)))
+(allow audioserver system_server (unix_stream_socket (read write)))
+(allow audioserver sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow audioserver self (capability2 (block_suspend)))
+(allow audioserver self (cap2_userns (block_suspend)))
+(allow audioserver system_suspend_server (binder (call transfer)))
+(allow system_suspend_server audioserver (binder (transfer)))
+(allow audioserver system_suspend_server (fd (use)))
+(allow audioserver system_suspend_hwservice (hwservice_manager (find)))
+(allow audioserver hwservicemanager (binder (call transfer)))
+(allow hwservicemanager audioserver (binder (call transfer)))
+(allow hwservicemanager audioserver (dir (search)))
+(allow hwservicemanager audioserver (file (read map open)))
+(allow hwservicemanager audioserver (process (getattr)))
+(allow audioserver hwservicemanager_prop (file (read getattr map open)))
+(allow audioserver hidl_manager_hwservice (hwservice_manager (find)))
+(allow audioserver hal_system_suspend_service (service_manager (find)))
+(allow audioserver servicemanager (binder (call transfer)))
+(allow servicemanager audioserver (binder (call transfer)))
+(allow servicemanager audioserver (dir (search)))
+(allow servicemanager audioserver (file (read open)))
+(allow servicemanager audioserver (process (getattr)))
+(allow audioserver audio_config_prop (file (read getattr map open)))
+(allow audioserver system_audio_config_prop (file (read getattr map open)))
+;;* lmx 102 system/sepolicy/private/audioserver.te
+
+(neverallow audioserver fs_type (file (execute_no_trans)))
+(neverallow audioserver file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 114 system/sepolicy/private/audioserver.te
+
+(neverallow audioserver domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow audioserver domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 115 system/sepolicy/private/audioserver.te
+
+(neverallow audioserver domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(allow init auditctl_exec (file (read getattr map execute open)))
+(allow init auditctl (process (transition)))
+(allow auditctl auditctl_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init auditctl (process (noatsecure)))
+(allow init auditctl (process (siginh rlimitinh)))
+(typetransition init auditctl_exec process auditctl)
+(allow auditctl self (capability (audit_control)))
+(allow auditctl self (cap_userns (audit_control)))
+(allow auditctl self (netlink_audit_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_write)))
+(allow automotive_display_service fwk_automotive_display_hwservice (hwservice_manager (add find)))
+(allow automotive_display_service hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 8 system/sepolicy/private/automotive_display_service.te
+
+(neverallow base_typeattr_295 fwk_automotive_display_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow init automotive_display_service_exec (file (read getattr map execute open)))
+(allow init automotive_display_service (process (transition)))
+(allow automotive_display_service automotive_display_service_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init automotive_display_service (process (noatsecure)))
+(allow init automotive_display_service (process (siginh rlimitinh)))
+(typetransition init automotive_display_service_exec process automotive_display_service)
+(allow automotive_display_service servicemanager (binder (call transfer)))
+(allow servicemanager automotive_display_service (binder (call transfer)))
+(allow servicemanager automotive_display_service (dir (search)))
+(allow servicemanager automotive_display_service (file (read open)))
+(allow servicemanager automotive_display_service (process (getattr)))
+(allow automotive_display_service hwservicemanager (binder (call transfer)))
+(allow hwservicemanager automotive_display_service (binder (call transfer)))
+(allow hwservicemanager automotive_display_service (dir (search)))
+(allow hwservicemanager automotive_display_service (file (read map open)))
+(allow hwservicemanager automotive_display_service (process (getattr)))
+(allow automotive_display_service hwservicemanager_prop (file (read getattr map open)))
+(allow automotive_display_service surfaceflinger_service (service_manager (find)))
+(allow automotive_display_service surfaceflinger (binder (call transfer)))
+(allow surfaceflinger automotive_display_service (binder (transfer)))
+(allow automotive_display_service surfaceflinger (fd (use)))
+(allow automotive_display_service hal_graphics_mapper_hwservice (hwservice_manager (find)))
+(allow automotive_display_service hidl_token_hwservice (hwservice_manager (find)))
+(allow automotive_display_service gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow automotive_display_service gpu_device (dir (search)))
+(allow automotive_display_service fwk_automotive_display_service (service_manager (add find)))
+;;* lmx 41 system/sepolicy/private/automotive_display_service.te
+
+(neverallow base_typeattr_295 fwk_automotive_display_service (service_manager (add)))
+;;* lme
+
+(allow automotive_display_service hal_evs (binder (call transfer)))
+(allow hal_evs automotive_display_service (binder (transfer)))
+(allow automotive_display_service hal_evs (fd (use)))
+(allow init bert_collector_exec (file (read getattr map execute open)))
+(allow init bert_collector (process (transition)))
+(allow bert_collector bert_collector_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init bert_collector (process (noatsecure)))
+(allow init bert_collector (process (siginh rlimitinh)))
+(typetransition init bert_collector_exec process bert_collector)
+(allow bert_collector sysfs_firmware_acpi_tables (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bert_collector sysfs_firmware_acpi_tables (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bert_collector sysfs_firmware_acpi_tables (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow bert_collector servicemanager (binder (call transfer)))
+(allow servicemanager bert_collector (binder (call transfer)))
+(allow servicemanager bert_collector (dir (search)))
+(allow servicemanager bert_collector (file (read open)))
+(allow servicemanager bert_collector (process (getattr)))
+(allow bert_collector system_server (binder (call transfer)))
+(allow system_server bert_collector (binder (transfer)))
+(allow bert_collector system_server (fd (use)))
+(allow bert_collector dropbox_service (service_manager (find)))
+(allow bert_collector proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow binderservicedomain dumpstate (fd (use)))
+(allow binderservicedomain incidentd (fd (use)))
+(allow binderservicedomain dumpstate (unix_stream_socket (read write getattr getopt)))
+(allow binderservicedomain incidentd (unix_stream_socket (read write getattr getopt)))
+(allow binderservicedomain dumpstate (fifo_file (write getattr)))
+(allow binderservicedomain incidentd (fifo_file (write getattr)))
+(allow binderservicedomain shell_data_file (file (write getattr)))
+(allow binderservicedomain devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow binderservicedomain console_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow binderservicedomain appdomain (fd (use)))
+(allow binderservicedomain appdomain (fifo_file (write)))
+(allow binderservicedomain permission_service (service_manager (find)))
+(allow binderservicedomain keystore (keystore2_key (delete get_info rebind use)))
+(allow keystore binderservicedomain (dir (search)))
+(allow keystore binderservicedomain (file (read open)))
+(allow keystore binderservicedomain (process (getattr)))
+(allow binderservicedomain apc_service (service_manager (find)))
+(allow binderservicedomain keystore_service (service_manager (find)))
+(allow binderservicedomain legacykeystore_service (service_manager (find)))
+(allow binderservicedomain keystore (binder (call transfer)))
+(allow keystore binderservicedomain (binder (transfer)))
+(allow binderservicedomain keystore (fd (use)))
+(allow keystore binderservicedomain (binder (call transfer)))
+(allow binderservicedomain keystore (binder (transfer)))
+(allow keystore binderservicedomain (fd (use)))
+(allow binderservicedomain apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow binderservicedomain apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow binderservicedomain vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow binderservicedomain vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow binderservicedomain vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init blank_screen_exec (file (read getattr map execute open)))
+(allow init blank_screen (process (transition)))
+(allow blank_screen blank_screen_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init blank_screen (process (noatsecure)))
+(allow init blank_screen (process (siginh rlimitinh)))
+(typetransition init blank_screen_exec process blank_screen)
+(allow blkid block_device (dir (search)))
+(allow blkid userdata_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow blkid dm_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow blkid vold (fd (use)))
+(allow blkid vold (fifo_file (read write getattr)))
+(allow blkid blkid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+;;* lmx 21 system/sepolicy/private/blkid.te
+
+(neverallow base_typeattr_296 blkid (process (transition)))
+;;* lme
+
+;;* lmx 22 system/sepolicy/private/blkid.te
+
+(neverallow base_typeattr_236 blkid (process (dyntransition)))
+;;* lme
+
+;;* lmx 23 system/sepolicy/private/blkid.te
+
+(neverallow blkid base_typeattr_297 (file (entrypoint)))
+;;* lme
+
+(allow blkid_untrusted block_device (dir (search)))
+(allow blkid_untrusted vold_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow blkid_untrusted vold (fd (use)))
+(allow blkid_untrusted vold (fifo_file (read write getattr)))
+(allow blkid_untrusted blkid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+;;* lmx 33 system/sepolicy/private/blkid_untrusted.te
+
+(neverallow blkid_untrusted dm_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted root_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted system_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted recovery_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted boot_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted userdata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted cache_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted swap_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow blkid_untrusted metadata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 36 system/sepolicy/private/blkid_untrusted.te
+
+(neverallow base_typeattr_296 blkid_untrusted (process (transition)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/blkid_untrusted.te
+
+(neverallow base_typeattr_236 blkid_untrusted (process (dyntransition)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/blkid_untrusted.te
+
+(neverallow blkid_untrusted base_typeattr_297 (file (entrypoint)))
+;;* lme
+
+(typetransition bluetooth tmpfs file appdomain_tmpfs)
+(allow bluetooth bluetooth_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su bluetooth_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 5 system/sepolicy/private/bluetooth.te
+
+(neverallow base_typeattr_298 bluetooth_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow bluetooth appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 5 system/sepolicy/private/bluetooth.te
+
+(neverallow base_typeattr_299 base_typeattr_298 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/bluetooth.te
+
+(neverallow base_typeattr_300 bluetooth (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/bluetooth.te
+
+(neverallow base_typeattr_301 bluetooth (process (ptrace)))
+;;* lme
+
+(typetransition bluetooth bluetooth_data_file sock_file bluetooth_socket)
+(allowx bluetooth self (ioctl udp_socket (0x6900 0x6902)))
+(allowx bluetooth self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx bluetooth self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow bluetooth sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bluetooth self (capability2 (block_suspend)))
+(allow bluetooth self (cap2_userns (block_suspend)))
+(allow bluetooth system_suspend_server (binder (call transfer)))
+(allow system_suspend_server bluetooth (binder (transfer)))
+(allow bluetooth system_suspend_server (fd (use)))
+(allow bluetooth system_suspend_hwservice (hwservice_manager (find)))
+(allow bluetooth hwservicemanager (binder (call transfer)))
+(allow hwservicemanager bluetooth (binder (call transfer)))
+(allow hwservicemanager bluetooth (dir (search)))
+(allow hwservicemanager bluetooth (file (read map open)))
+(allow hwservicemanager bluetooth (process (getattr)))
+(allow bluetooth hwservicemanager_prop (file (read getattr map open)))
+(allow bluetooth hidl_manager_hwservice (hwservice_manager (find)))
+(allow bluetooth hal_system_suspend_service (service_manager (find)))
+(allow bluetooth servicemanager (binder (call transfer)))
+(allow servicemanager bluetooth (binder (call transfer)))
+(allow servicemanager bluetooth (dir (search)))
+(allow servicemanager bluetooth (file (read open)))
+(allow servicemanager bluetooth (process (getattr)))
+(allow bluetooth bluetooth_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow bluetooth bluetooth_data_file (file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow bluetooth bluetooth_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow bluetooth bluetooth_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow bluetooth bluetooth_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow bluetooth bluetooth_logs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow bluetooth bluetooth_logs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow bluetooth bluetooth_socket (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow bluetooth self (capability (net_admin)))
+(allow bluetooth self (cap_userns (net_admin)))
+(allow bluetooth self (capability2 (wake_alarm)))
+(allow bluetooth self (cap2_userns (wake_alarm)))
+(allow bluetooth self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow bluetooth self (capability (net_bind_service net_admin net_raw)))
+(allow bluetooth self (cap_userns (net_bind_service net_admin net_raw)))
+(allow bluetooth self (tun_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow bluetooth tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx bluetooth tun_device (ioctl chr_file (0x54ca 0x54d2)))
+(allow bluetooth efs_file (dir (search)))
+(allow bluetooth uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bluetooth gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bluetooth gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bluetooth proc_bluetooth_writable (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bluetooth proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bluetooth incremental_prop (file (read getattr map open)))
+(allow bluetooth device_logging_prop (file (read getattr map open)))
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth binder_cache_bluetooth_server_prop (property_service (set)))
+(allow bluetooth binder_cache_bluetooth_server_prop (file (read getattr map open)))
+;;* lmx 55 system/sepolicy/private/bluetooth.te
+
+(neverallow base_typeattr_302 binder_cache_bluetooth_server_prop (property_service (set)))
+;;* lme
+
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth bluetooth_a2dp_offload_prop (property_service (set)))
+(allow bluetooth bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth bluetooth_audio_hal_prop (property_service (set)))
+(allow bluetooth bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth bluetooth_prop (property_service (set)))
+(allow bluetooth bluetooth_prop (file (read getattr map open)))
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth exported_bluetooth_prop (property_service (set)))
+(allow bluetooth exported_bluetooth_prop (file (read getattr map open)))
+(allow bluetooth property_socket (sock_file (write)))
+(allow bluetooth init (unix_stream_socket (connectto)))
+(allow bluetooth pan_result_prop (property_service (set)))
+(allow bluetooth pan_result_prop (file (read getattr map open)))
+(allow bluetooth audioserver_service (service_manager (find)))
+(allow bluetooth bluetooth_service (service_manager (find)))
+(allow bluetooth drmserver_service (service_manager (find)))
+(allow bluetooth mediaserver_service (service_manager (find)))
+(allow bluetooth radio_service (service_manager (find)))
+(allow bluetooth app_api_service (service_manager (find)))
+(allow bluetooth system_api_service (service_manager (find)))
+(allow bluetooth network_stack_service (service_manager (find)))
+(allow bluetooth system_suspend_control_service (service_manager (find)))
+(allow bluetooth hal_audio_service (service_manager (find)))
+(allow bluetooth shell_data_file (file (read)))
+(allow bluetooth self (capability (sys_nice)))
+(allow bluetooth self (cap_userns (sys_nice)))
+(allow bluetooth runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 97 system/sepolicy/private/bluetooth.te
+
+(neverallow bluetooth self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow bluetooth self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+;;* lme
+
+;;* lmx 98 system/sepolicy/private/bluetooth.te
+
+(neverallow bluetooth self (capability2 (mac_override mac_admin syslog audit_read perfmon checkpoint_restore bpf)))
+(neverallow bluetooth self (cap2_userns (mac_override mac_admin syslog audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+(allow bluetoothdomain bluetooth (unix_stream_socket (ioctl read write getattr getopt setopt shutdown)))
+(allow init bootanim_exec (file (read getattr map execute open)))
+(allow init bootanim (process (transition)))
+(allow bootanim bootanim_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init bootanim (process (noatsecure)))
+(allow init bootanim (process (siginh rlimitinh)))
+(typetransition init bootanim_exec process bootanim)
+(dontaudit bootanim unlabeled (dir (search)))
+(dontaudit bootanim vendor_default_prop (file (read)))
+(allow bootanim bootloader_boot_reason_prop (file (read getattr map open)))
+(allow bootanim bootanim_config_prop (file (read getattr map open)))
+(allow bootanim property_socket (sock_file (write)))
+(allow bootanim init (unix_stream_socket (connectto)))
+(allow bootanim bootanim_system_prop (property_service (set)))
+(allow bootanim bootanim_system_prop (file (read getattr map open)))
+(allow bootanim bootanim_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim bootanim_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim bootanim_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim servicemanager (binder (call transfer)))
+(allow servicemanager bootanim (binder (call transfer)))
+(allow servicemanager bootanim (dir (search)))
+(allow servicemanager bootanim (file (read open)))
+(allow servicemanager bootanim (process (getattr)))
+(allow bootanim surfaceflinger (binder (call transfer)))
+(allow surfaceflinger bootanim (binder (transfer)))
+(allow bootanim surfaceflinger (fd (use)))
+(allow bootanim audioserver (binder (call transfer)))
+(allow audioserver bootanim (binder (transfer)))
+(allow bootanim audioserver (fd (use)))
+(allow bootanim hwservicemanager (binder (call transfer)))
+(allow hwservicemanager bootanim (binder (call transfer)))
+(allow hwservicemanager bootanim (dir (search)))
+(allow hwservicemanager bootanim (file (read map open)))
+(allow hwservicemanager bootanim (process (getattr)))
+(allow bootanim gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bootanim gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim oemfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim bootanim_oem_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim audio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim audio_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bootanim audioserver_service (service_manager (find)))
+(allow bootanim surfaceflinger_service (service_manager (find)))
+(allow bootanim surfaceflinger (unix_stream_socket (read write)))
+(allow bootanim ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bootanim dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim hal_graphics_allocator (fd (use)))
+(allow bootanim hal_graphics_composer (fd (use)))
+(allow bootanim proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootanim system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bootanim statsdw_socket (sock_file (write)))
+(allow bootanim statsd (unix_dgram_socket (sendto)))
+(allow init bootstat_exec (file (read getattr map execute open)))
+(allow init bootstat (process (transition)))
+(allow bootstat bootstat_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init bootstat (process (noatsecure)))
+(allow init bootstat (process (siginh rlimitinh)))
+(typetransition init bootstat_exec process bootstat)
+(allow bootstat boottime_prop (file (read getattr map open)))
+(allow bootstat property_socket (sock_file (write)))
+(allow bootstat init (unix_stream_socket (connectto)))
+(allow bootstat bootloader_boot_reason_prop (property_service (set)))
+(allow bootstat bootloader_boot_reason_prop (file (read getattr map open)))
+(allow bootstat property_socket (sock_file (write)))
+(allow bootstat init (unix_stream_socket (connectto)))
+(allow bootstat system_boot_reason_prop (property_service (set)))
+(allow bootstat system_boot_reason_prop (file (read getattr map open)))
+(allow bootstat property_socket (sock_file (write)))
+(allow bootstat init (unix_stream_socket (connectto)))
+(allow bootstat last_boot_reason_prop (property_service (set)))
+(allow bootstat last_boot_reason_prop (file (read getattr map open)))
+(allow bootstat runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootstat bootstat_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow bootstat bootstat_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow bootstat metadata_file (dir (search)))
+(allow bootstat metadata_bootstat_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow bootstat metadata_bootstat_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow bootstat pstorefs (dir (search)))
+(allow bootstat pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bootstat kernel (system (syslog_read)))
+(allow bootstat logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow bootstat logdr_socket (sock_file (write)))
+(allow bootstat logd (unix_stream_socket (connectto)))
+(allow bootstat statsdw_socket (sock_file (write)))
+(allow bootstat statsd (unix_dgram_socket (sendto)))
+;;* lmx 44 system/sepolicy/private/bootstat.te
+
+(neverallow base_typeattr_303 system_boot_reason_prop (property_service (set)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/private/bootstat.te
+
+(neverallow base_typeattr_304 bootloader_boot_reason_prop (file (ioctl read getattr lock map open watch watch_reads)))
+(neverallow base_typeattr_304 last_boot_reason_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 59 system/sepolicy/private/bootstat.te
+
+(neverallow bootanim last_boot_reason_prop (file (ioctl read getattr lock map open watch watch_reads)))
+(neverallow recovery last_boot_reason_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/bootstat.te
+
+(neverallow base_typeattr_305 bootloader_boot_reason_prop (property_service (set)))
+(neverallow base_typeattr_305 last_boot_reason_prop (property_service (set)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/bootstat.te
+
+(neverallow system_server bootloader_boot_reason_prop (property_service (set)))
+;;* lme
+
+(allow init boringssl_self_test_exec (file (read getattr map execute open)))
+(allow init boringssl_self_test (process (transition)))
+(allow boringssl_self_test boringssl_self_test_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init boringssl_self_test (process (noatsecure)))
+(allow init boringssl_self_test (process (siginh rlimitinh)))
+(typetransition init boringssl_self_test_exec process boringssl_self_test)
+(allow init vendor_boringssl_self_test_exec (file (read getattr map execute open)))
+(allow init vendor_boringssl_self_test (process (transition)))
+(allow vendor_boringssl_self_test vendor_boringssl_self_test_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vendor_boringssl_self_test (process (noatsecure)))
+(allow init vendor_boringssl_self_test (process (siginh rlimitinh)))
+(typetransition init vendor_boringssl_self_test_exec process vendor_boringssl_self_test)
+(allow boringssl_self_test boringssl_self_test_marker (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vendor_boringssl_self_test boringssl_self_test_marker (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow boringssl_self_test boringssl_self_test_marker (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow vendor_boringssl_self_test boringssl_self_test_marker (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow boringssl_self_test kmsg_debug_device (chr_file (ioctl write getattr lock append map open)))
+(allow vendor_boringssl_self_test kmsg_debug_device (chr_file (ioctl write getattr lock append map open)))
+;;* lmx 66 system/sepolicy/private/boringssl_self_test.te
+
+(neverallow base_typeattr_306 boringssl_self_test_marker (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 74 system/sepolicy/private/boringssl_self_test.te
+
+(neverallow base_typeattr_306 boringssl_self_test_marker (dir (write)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/bpfdomain.te
+
+(neverallow base_typeattr_307 self (capability (net_admin net_raw)))
+(neverallow base_typeattr_307 self (cap_userns (net_admin net_raw)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/bpfdomain.te
+
+(neverallow base_typeattr_308 base_typeattr_236 (bpf (map_create map_read map_write prog_load prog_run)))
+;;* lme
+
+(allow bpfdomain fs_bpf (dir (search)))
+(allow bpfdomain bpffs_type (lnk_file (read)))
+(allow bpfdomain bpf_progs_loaded_prop (file (read getattr map open)))
+(allow bpfloader kmsg_device (chr_file (write lock append map open)))
+(allow bpfloader bpffs_type (dir (read write create setattr open add_name remove_name search)))
+(allow bpfloader bpffs_type (file (read create getattr setattr rename)))
+(allow bpfloader bpffs_type (lnk_file (read create getattr)))
+(allow base_typeattr_309 fs_bpf (filesystem (associate)))
+(allow bpfloader self (bpf (map_create map_read map_write prog_load prog_run)))
+(allow bpfloader self (capability (chown net_admin sys_admin)))
+(allow bpfloader sysfs_fs_fuse_bpf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow bpfloader proc_bpf (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bpfloader property_socket (sock_file (write)))
+(allow bpfloader init (unix_stream_socket (connectto)))
+(allow bpfloader bpf_progs_loaded_prop (property_service (set)))
+(allow bpfloader bpf_progs_loaded_prop (file (read getattr map open)))
+(allow bpfloader bpfloader_exec (file (execute_no_trans)))
+;;* lmx 32 system/sepolicy/private/bpfloader.te
+
+(neverallow domain bpffs_type (dir (ioctl lock relabelfrom relabelto append map unlink link rename execute quotaon audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads reparent rmdir)))
+;;* lme
+
+;;* lmx 33 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 bpffs_type (dir (read write create setattr open add_name remove_name)))
+;;* lme
+
+;;* lmx 35 system/sepolicy/private/bpfloader.te
+
+(neverallow domain bpffs_type (file (ioctl lock relabelfrom relabelto append unlink link execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 36 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 bpffs_type (file (create setattr map rename open)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_311 fs_bpf (file (read getattr)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 fs_bpf_loader (file (read getattr)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_312 fs_bpf_net_private (file (read getattr)))
+;;* lme
+
+;;* lmx 40 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_313 fs_bpf_net_shared (file (read getattr)))
+;;* lme
+
+;;* lmx 41 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_314 fs_bpf_netd_readonly (file (read getattr)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_315 fs_bpf_netd_shared (file (read getattr)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_312 fs_bpf_tethering (file (read getattr)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_316 fs_bpf_uprobestats (file (read getattr)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_317 base_typeattr_318 (file (write)))
+;;* lme
+
+;;* lmx 47 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 bpffs_type (lnk_file (ioctl write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_308 bpffs_type (lnk_file (read)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 base_typeattr_236 (bpf (prog_load)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_308 base_typeattr_236 (bpf (map_create map_read map_write prog_run)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 fs_bpf_loader (bpf (map_create map_read map_write prog_load prog_run)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 fs_bpf_loader (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_319 bpfloader_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 59 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_320 fs_bpf_vendor (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/bpfloader.te
+
+(neverallow bpfloader base_typeattr_236 (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow bpfloader base_typeattr_236 (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow bpfloader base_typeattr_236 (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/bpfloader.te
+
+(neverallow domain bpfloader (process (ptrace)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/bpfloader.te
+
+(neverallow base_typeattr_310 proc_bpf (file (write)))
+;;* lme
+
+(allow init bufferhubd_exec (file (read getattr map execute open)))
+(allow init bufferhubd (process (transition)))
+(allow bufferhubd bufferhubd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init bufferhubd (process (noatsecure)))
+(allow init bufferhubd (process (siginh rlimitinh)))
+(typetransition init bufferhubd_exec process bufferhubd)
+(allow init pdx_bufferhub_client_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow bufferhubd pdx_bufferhub_client_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow bufferhubd self (process (setsockcreate)))
+(allow bufferhubd pdx_bufferhub_client_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 8 system/sepolicy/private/bufferhubd.te
+
+(neverallow base_typeattr_321 pdx_bufferhub_client_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow bufferhubd pdx_performance_client_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow bufferhubd pdx_performance_client_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bufferhubd pdx_performance_client_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow bufferhubd pdx_performance_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow bufferhubd pdx_performance_client_server_type (fd (use)))
+(allow pdx_performance_client_server_type bufferhubd (fd (use)))
+(allow bufferhubd gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow bufferhubd ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow bufferhubd hal_omx_server (fd (use)))
+(allow bufferhubd hal_codec2_server (fd (use)))
+(allow camera_service_server fwk_camera_hwservice (hwservice_manager (add find)))
+(allow camera_service_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 1 system/sepolicy/private/camera_service_server.te
+
+(neverallow base_typeattr_322 fwk_camera_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow init cameraserver_exec (file (read getattr map execute open)))
+(allow init cameraserver (process (transition)))
+(allow cameraserver cameraserver_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init cameraserver (process (noatsecure)))
+(allow init cameraserver (process (siginh rlimitinh)))
+(typetransition init cameraserver_exec process cameraserver)
+(typetransition cameraserver tmpfs file cameraserver_tmpfs)
+(allow cameraserver cameraserver_tmpfs (file (read write getattr map)))
+(allow cameraserver gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow cameraserver gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow cameraserver virtual_camera (binder (call)))
+(allow cameraserver servicemanager (binder (call transfer)))
+(allow servicemanager cameraserver (binder (call transfer)))
+(allow servicemanager cameraserver (dir (search)))
+(allow servicemanager cameraserver (file (read open)))
+(allow servicemanager cameraserver (process (getattr)))
+(allow cameraserver binderservicedomain (binder (call transfer)))
+(allow binderservicedomain cameraserver (binder (transfer)))
+(allow cameraserver binderservicedomain (fd (use)))
+(allow cameraserver appdomain (binder (call transfer)))
+(allow appdomain cameraserver (binder (transfer)))
+(allow cameraserver appdomain (fd (use)))
+(allow cameraserver hal_camera_server (process (signal)))
+(allow cameraserver ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow cameraserver dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow cameraserver hal_graphics_composer (fd (use)))
+(allow cameraserver cameraserver_service (service_manager (add find)))
+;;* lmx 26 system/sepolicy/private/cameraserver.te
+
+(neverallow base_typeattr_323 cameraserver_service (service_manager (add)))
+;;* lme
+
+(allow cameraserver fwk_camera_service (service_manager (add find)))
+;;* lmx 27 system/sepolicy/private/cameraserver.te
+
+(neverallow base_typeattr_323 fwk_camera_service (service_manager (add)))
+;;* lme
+
+(allow cameraserver fwk_camera_hwservice (hwservice_manager (add find)))
+(allow cameraserver hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 28 system/sepolicy/private/cameraserver.te
+
+(neverallow base_typeattr_323 fwk_camera_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow cameraserver activity_service (service_manager (find)))
+(allow cameraserver appops_service (service_manager (find)))
+(allow cameraserver audioserver_service (service_manager (find)))
+(allow cameraserver batterystats_service (service_manager (find)))
+(allow cameraserver cameraproxy_service (service_manager (find)))
+(allow cameraserver mediaserver_service (service_manager (find)))
+(allow cameraserver package_native_service (service_manager (find)))
+(allow cameraserver permission_checker_service (service_manager (find)))
+(allow cameraserver processinfo_service (service_manager (find)))
+(allow cameraserver scheduling_policy_service (service_manager (find)))
+(allow cameraserver sensor_privacy_service (service_manager (find)))
+(allow cameraserver surfaceflinger_service (service_manager (find)))
+(allow cameraserver hidl_token_hwservice (hwservice_manager (find)))
+(allow cameraserver hal_camera_service (service_manager (find)))
+(allow cameraserver virtual_camera_service (service_manager (find)))
+(allow cameraserver surfaceflinger (unix_stream_socket (read write)))
+(allow cameraserver adbd (fd (use)))
+(allow cameraserver adbd (unix_stream_socket (read write)))
+(allow cameraserver shell (fd (use)))
+(allow cameraserver shell (unix_stream_socket (read write)))
+(allow cameraserver shell (fifo_file (read write)))
+(allow cameraserver self (capability (sys_nice)))
+(allow cameraserver self (cap_userns (sys_nice)))
+(allow cameraserver mediametrics_service (service_manager (find)))
+;;* lmx 79 system/sepolicy/private/cameraserver.te
+
+(neverallow cameraserver fs_type (file (execute_no_trans)))
+(neverallow cameraserver file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 91 system/sepolicy/private/cameraserver.te
+
+(neverallow cameraserver domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow cameraserver domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 92 system/sepolicy/private/cameraserver.te
+
+(neverallow cameraserver domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(allow init canhalconfigurator_exec (file (read getattr map execute open)))
+(allow init canhalconfigurator (process (transition)))
+(allow canhalconfigurator canhalconfigurator_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init canhalconfigurator (process (noatsecure)))
+(allow init canhalconfigurator (process (siginh rlimitinh)))
+(typetransition init canhalconfigurator_exec process canhalconfigurator)
+(allow canhalconfigurator servicemanager (binder (call transfer)))
+(allow servicemanager canhalconfigurator (binder (call transfer)))
+(allow servicemanager canhalconfigurator (dir (search)))
+(allow servicemanager canhalconfigurator (file (read open)))
+(allow servicemanager canhalconfigurator (process (getattr)))
+(allow hal_can_controller canhalconfigurator (binder (call transfer)))
+(allow canhalconfigurator hal_can_controller (binder (transfer)))
+(allow hal_can_controller canhalconfigurator (fd (use)))
+(allow charger property_socket (sock_file (write)))
+(allow charger init (unix_stream_socket (connectto)))
+(allow charger system_prop (property_service (set)))
+(allow charger system_prop (file (read getattr map open)))
+(allow charger property_socket (sock_file (write)))
+(allow charger init (unix_stream_socket (connectto)))
+(allow charger exported_system_prop (property_service (set)))
+(allow charger exported_system_prop (file (read getattr map open)))
+(allow charger property_socket (sock_file (write)))
+(allow charger init (unix_stream_socket (connectto)))
+(allow charger exported3_system_prop (property_service (set)))
+(allow charger exported3_system_prop (file (read getattr map open)))
+(allow charger charger_prop (file (read getattr map open)))
+;;* lmx 16 system/sepolicy/private/charger.te
+
+(neverallow base_typeattr_324 charger_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow charger_type property_socket (sock_file (write)))
+(allow charger_type init (unix_stream_socket (connectto)))
+(allow charger_type charger_status_prop (property_service (set)))
+(allow charger_type charger_status_prop (file (read getattr map open)))
+(allow charger_type charger_config_prop (file (read getattr map open)))
+(allow charger_type recovery_config_prop (file (read getattr map open)))
+(allow charger_type kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow charger_type rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type self (capability (sys_boot sys_tty_config)))
+(allow charger_type self (cap_userns (sys_boot sys_tty_config)))
+(allow charger_type sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow charger_type self (capability2 (block_suspend)))
+(allow charger_type self (cap2_userns (block_suspend)))
+(allow charger_type system_suspend_server (binder (call transfer)))
+(allow system_suspend_server charger_type (binder (transfer)))
+(allow charger_type system_suspend_server (fd (use)))
+(allow charger_type system_suspend_hwservice (hwservice_manager (find)))
+(allow charger_type hwservicemanager (binder (call transfer)))
+(allow hwservicemanager charger_type (binder (call transfer)))
+(allow hwservicemanager charger_type (dir (search)))
+(allow hwservicemanager charger_type (file (read map open)))
+(allow hwservicemanager charger_type (process (getattr)))
+(allow charger_type hwservicemanager_prop (file (read getattr map open)))
+(allow charger_type hidl_manager_hwservice (hwservice_manager (find)))
+(allow charger_type hal_system_suspend_service (service_manager (find)))
+(allow charger_type servicemanager (binder (call transfer)))
+(allow servicemanager charger_type (binder (call transfer)))
+(allow servicemanager charger_type (dir (search)))
+(allow servicemanager charger_type (file (read open)))
+(allow servicemanager charger_type (process (getattr)))
+(allow charger_type self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow charger_type sysfs_power (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow charger_type sysfs_batteryinfo (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type sysfs_batteryinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type sysfs_batteryinfo (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type pstorefs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type graphics_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow charger_type input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow charger_type input_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow charger_type tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow charger_type proc_sysrq (file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 54 system/sepolicy/private/charger_type.te
+
+(neverallow base_typeattr_230 charger_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/charger_type.te
+
+(neverallow base_typeattr_325 charger_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 76 system/sepolicy/private/charger_type.te
+
+(neverallow base_typeattr_326 charger_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_326 charger_status_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow clatd system_server (fd (use)))
+(allow clatd system_server (packet_socket (read write)))
+(allow clatd system_server (rawip_socket (read write)))
+(allow clatd tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow compos_fd_server composd (fd (use)))
+(allow compos_fd_server apex_art_staging_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow compos_fd_server apex_art_staging_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow compos_fd_server apex_art_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow compos_fd_server apex_art_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow compos_fd_server composd (fifo_file (write)))
+(allow compos_fd_server composd (fifo_file (read)))
+(allow compos_fd_server self (vsock_socket (read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 26 system/sepolicy/private/compos_fd_server.te
+
+(neverallow base_typeattr_327 compos_fd_server (process (transition)))
+;;* lme
+
+;;* lmx 27 system/sepolicy/private/compos_fd_server.te
+
+(neverallow base_typeattr_236 compos_fd_server (process (dyntransition)))
+;;* lme
+
+(allow compos_verify servicemanager (binder (call transfer)))
+(allow servicemanager compos_verify (binder (call transfer)))
+(allow servicemanager compos_verify (dir (search)))
+(allow servicemanager compos_verify (file (read open)))
+(allow servicemanager compos_verify (process (getattr)))
+(allow compos_verify virtualizationmanager_exec (file (read getattr map execute open)))
+(allow compos_verify virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager compos_verify (process (sigchld)))
+(dontaudit compos_verify virtualizationmanager (process (noatsecure)))
+(allow compos_verify virtualizationmanager (process (siginh rlimitinh)))
+(typetransition compos_verify virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm compos_verify (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager compos_verify (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm compos_verify (fd (use)))
+(allow virtualizationmanager compos_verify (fd (use)))
+(allow compos_verify virtualizationmanager (fd (use)))
+(allow crosvm compos_verify (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager compos_verify (fifo_file (ioctl read write getattr)))
+(allow compos_verify virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow compos_verify hypervisor_prop (file (read getattr map open)))
+(allow compos_verify virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager compos_verify (dir (search)))
+(allow virtualizationmanager compos_verify (file (read)))
+(allow virtualizationmanager compos_verify (lnk_file (read)))
+(allow compos_verify apex_module_data_file (dir (search)))
+(allow compos_verify apex_compos_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow compos_verify apex_compos_data_file (file (ioctl read write create getattr lock append map open watch watch_reads)))
+(allow compos_verify apex_art_data_file (dir (search)))
+(allow compos_verify apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow compos_verify odsign (fd (use)))
+(allow compos_verify odsign_devpts (chr_file (read write)))
+;;* lmx 23 system/sepolicy/private/compos_verify.te
+
+(neverallow base_typeattr_328 compos_verify (process (transition)))
+;;* lme
+
+;;* lmx 24 system/sepolicy/private/compos_verify.te
+
+(neverallow base_typeattr_236 compos_verify (process (dyntransition)))
+;;* lme
+
+(allow init composd_exec (file (read getattr map execute open)))
+(allow init composd (process (transition)))
+(allow composd composd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init composd (process (noatsecure)))
+(allow init composd (process (siginh rlimitinh)))
+(typetransition init composd_exec process composd)
+(allow composd servicemanager (binder (call transfer)))
+(allow servicemanager composd (binder (call transfer)))
+(allow servicemanager composd (dir (search)))
+(allow servicemanager composd (file (read open)))
+(allow servicemanager composd (process (getattr)))
+(allow composd compos_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/composd.te
+
+(neverallow base_typeattr_327 compos_service (service_manager (add)))
+;;* lme
+
+(allow composd system_server (binder (call transfer)))
+(allow system_server composd (binder (transfer)))
+(allow composd system_server (fd (use)))
+(allow composd virtualizationmanager_exec (file (read getattr map execute open)))
+(allow composd virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager composd (process (sigchld)))
+(dontaudit composd virtualizationmanager (process (noatsecure)))
+(allow composd virtualizationmanager (process (siginh rlimitinh)))
+(typetransition composd virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm composd (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager composd (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm composd (fd (use)))
+(allow virtualizationmanager composd (fd (use)))
+(allow composd virtualizationmanager (fd (use)))
+(allow crosvm composd (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager composd (fifo_file (ioctl read write getattr)))
+(allow composd virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow composd hypervisor_prop (file (read getattr map open)))
+(allow composd virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager composd (dir (search)))
+(allow virtualizationmanager composd (file (read)))
+(allow virtualizationmanager composd (lnk_file (read)))
+(allow composd apex_art_data_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow composd apex_art_staging_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow composd apex_art_staging_data_file (file (getattr unlink)))
+(allow composd apex_art_data_file (file (ioctl read write unlink open)))
+(allowx composd apex_art_data_file (ioctl file (0x6685)))
+(allow composd apex_module_data_file (dir (search)))
+(allow composd apex_compos_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow composd apex_compos_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow composd fd_server_exec (file (read getattr map execute open)))
+(allow composd compos_fd_server (process (transition)))
+(allow compos_fd_server fd_server_exec (file (read getattr map execute open entrypoint)))
+(allow compos_fd_server composd (process (sigchld)))
+(dontaudit composd compos_fd_server (process (noatsecure)))
+(allow composd compos_fd_server (process (siginh rlimitinh)))
+(typetransition composd fd_server_exec process compos_fd_server)
+(allow composd compos_fd_server (process (signal)))
+(allow composd composd_vm_art_prop (file (read getattr map open)))
+(allow composd composd_vm_vendor_prop (file (read getattr map open)))
+(allow composd dalvik_config_prop_type (file (read getattr map open)))
+(allow composd device_config_runtime_native_boot_prop (file (read getattr map open)))
+;;* lmx 42 system/sepolicy/private/composd.te
+
+(neverallow composd apex_art_data_file (file (create)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/composd.te
+
+(neverallow base_typeattr_235 composd_vm_art_prop (property_service (set)))
+;;* lme
+
+(allow coredomain apex_ready_prop (file (read getattr map open)))
+(allow coredomain boot_status_prop (file (read getattr map open)))
+(allow coredomain camera_config_prop (file (read getattr map open)))
+(allow coredomain dalvik_config_prop_type (file (read getattr map open)))
+(allow coredomain dalvik_runtime_prop (file (read getattr map open)))
+(allow coredomain exported_pm_prop (file (read getattr map open)))
+(allow coredomain ffs_config_prop (file (read getattr map open)))
+(allow coredomain graphics_config_prop (file (read getattr map open)))
+(allow coredomain graphics_config_writable_prop (file (read getattr map open)))
+(allow coredomain hdmi_config_prop (file (read getattr map open)))
+(allow coredomain init_service_status_private_prop (file (read getattr map open)))
+(allow coredomain lmkd_config_prop (file (read getattr map open)))
+(allow coredomain localization_prop (file (read getattr map open)))
+(allow coredomain pm_prop (file (read getattr map open)))
+(allow coredomain radio_control_prop (file (read getattr map open)))
+(allow coredomain rollback_test_prop (file (read getattr map open)))
+(allow coredomain setupwizard_prop (file (read getattr map open)))
+(allow coredomain setupwizard_mode_prop (file (read getattr map open)))
+(allow coredomain sqlite_log_prop (file (read getattr map open)))
+(allow coredomain storagemanager_config_prop (file (read getattr map open)))
+(allow coredomain surfaceflinger_color_prop (file (read getattr map open)))
+(allow coredomain systemsound_config_prop (file (read getattr map open)))
+(allow coredomain telephony_config_prop (file (read getattr map open)))
+(allow coredomain usb_config_prop (file (read getattr map open)))
+(allow coredomain usb_control_prop (file (read getattr map open)))
+(allow coredomain userspace_reboot_config_prop (file (read getattr map open)))
+(allow coredomain vold_config_prop (file (read getattr map open)))
+(allow coredomain vts_status_prop (file (read getattr map open)))
+(allow coredomain zygote_config_prop (file (read getattr map open)))
+(allow coredomain zygote_wrap_prop (file (read getattr map open)))
+(allow coredomain default_prop (file (read getattr map open)))
+;;* lmx 35 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_329 sysfs_leds (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_330 vendor_app_file (dir (read getattr open search)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_331 vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 90 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_332 vendor_overlay_file (dir (read getattr open search)))
+;;* lme
+
+;;* lmx 111 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_332 vendor_overlay_file (file (open)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_333 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_334 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_335 device (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_335 device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow coredomain debugfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_336 debugfs_tracing (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_337 inotify (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_338 pstorefs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_339 configfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_340 functionfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_337 usbfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_337 binfmt_miscfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/coredomain.te
+
+(neverallow base_typeattr_341 base_typeattr_342 (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 253 system/sepolicy/private/coredomain.te
+
+(neverallow coredomain radio_device (chr_file (ioctl read write append open)))
+(neverallow coredomain iio_device (chr_file (ioctl read write append open)))
+;;* lme
+
+;;* lmx 257 system/sepolicy/private/coredomain.te
+
+(neverallow coredomain tee_device (chr_file (ioctl read write append open)))
+;;* lme
+
+(allow init cppreopts_exec (file (read getattr map execute open)))
+(allow init cppreopts (process (transition)))
+(allow cppreopts cppreopts_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init cppreopts (process (noatsecure)))
+(allow init cppreopts (process (siginh rlimitinh)))
+(typetransition init cppreopts_exec process cppreopts)
+(allow cppreopts preopt2cachename_exec (file (read getattr map execute open)))
+(allow cppreopts preopt2cachename (process (transition)))
+(allow preopt2cachename preopt2cachename_exec (file (read getattr map execute open entrypoint)))
+(allow preopt2cachename cppreopts (process (sigchld)))
+(dontaudit cppreopts preopt2cachename (process (noatsecure)))
+(allow cppreopts preopt2cachename (process (siginh rlimitinh)))
+(typetransition cppreopts preopt2cachename_exec process preopt2cachename)
+(allow cppreopts dalvikcache_data_file (dir (write add_name remove_name search)))
+(allow cppreopts dalvikcache_data_file (file (read write create getattr unlink rename open)))
+(allow cppreopts shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow cppreopts system_file (dir (read open)))
+(allow cppreopts toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(dontaudit cppreopts postinstall_mnt_dir (dir (search)))
+(dontaudit crash_dump dev_type (chr_file (read write)))
+(dontaudit crash_dump devpts (chr_file (read write)))
+(allow crash_dump base_typeattr_343 (process (sigchld sigkill sigstop signal ptrace)))
+(allow crash_dump apex_art_data_file (dir (getattr search)))
+(allow crash_dump apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump system_bootstrap_lib_file (dir (getattr search)))
+(allow crash_dump system_bootstrap_lib_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump vendor_apex_metadata_file (dir (getattr search)))
+(dontaudit crash_dump self (capability (sys_ptrace)))
+(dontaudit crash_dump self (cap_userns (sys_ptrace)))
+(allow crash_dump domain (fd (use)))
+(allow crash_dump domain (fifo_file (read write)))
+(allow crash_dump domain (fifo_file (append)))
+(allow crash_dump domain (process (getattr)))
+(allow crash_dump domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crash_dump domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump exec_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump dalvikcache_data_file (dir (getattr search)))
+(allow crash_dump dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump apex_module_data_file (dir (getattr search)))
+(allow crash_dump proc_uptime (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crash_dump apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump vendor_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crash_dump same_process_hal_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crash_dump vendor_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump vendor_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump same_process_hal_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump same_process_hal_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump shell_test_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crash_dump shell_test_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump shell_test_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crash_dump tombstoned_crash_socket (sock_file (write)))
+(allow crash_dump tombstoned (unix_stream_socket (connectto)))
+(allow crash_dump system_ndebug_socket (sock_file (write)))
+(allow crash_dump system_server (unix_stream_socket (connectto)))
+(allow crash_dump anr_data_file (file (getattr append)))
+(allow crash_dump tombstone_data_file (file (getattr append)))
+(allow crash_dump logdr_socket (sock_file (write)))
+(allow crash_dump logd (unix_stream_socket (connectto)))
+(dontaudit crash_dump core_data_file_type (dir (search)))
+(dontaudit crash_dump vendor_file_type (dir (search)))
+(dontaudit crash_dump app_data_file_type (file (read open)))
+(dontaudit crash_dump app_data_file_type (lnk_file (read open)))
+(dontaudit crash_dump property_type (file (read open)))
+(dontaudit crash_dump property_type (lnk_file (read open)))
+(dontaudit crash_dump system_data_file (file (read open)))
+(dontaudit crash_dump system_data_file (lnk_file (read open)))
+(allow crash_dump misctrl_prop (file (read getattr map open)))
+;;* lmx 121 system/sepolicy/private/crash_dump.te
+
+(neverallow domain crash_dump_exec (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 140 system/sepolicy/private/crash_dump.te
+
+(neverallow crash_dump apexd (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump bpfloader (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump init (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump kernel (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump keystore (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump llkd (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump logd (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump ueventd (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump vendor_init (process (sigkill sigstop signal ptrace)))
+(neverallow crash_dump vold (process (sigkill sigstop signal ptrace)))
+;;* lme
+
+;;* lmx 142 system/sepolicy/private/crash_dump.te
+
+(neverallow crash_dump self (process (ptrace)))
+;;* lme
+
+;;* lmx 143 system/sepolicy/private/crash_dump.te
+
+(neverallow crash_dump gpu_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow init credstore_exec (file (read getattr map execute open)))
+(allow init credstore (process (transition)))
+(allow credstore credstore_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init credstore (process (noatsecure)))
+(allow init credstore (process (siginh rlimitinh)))
+(typetransition init credstore_exec process credstore)
+(allow credstore remote_prov_prop (file (read getattr map open)))
+(allow credstore remote_provisioning_service (service_manager (find)))
+(allow credstore servicemanager (binder (call transfer)))
+(allow servicemanager credstore (binder (call transfer)))
+(allow servicemanager credstore (dir (search)))
+(allow servicemanager credstore (file (read open)))
+(allow servicemanager credstore (process (getattr)))
+(allow credstore system_server (binder (call transfer)))
+(allow system_server credstore (binder (transfer)))
+(allow credstore system_server (fd (use)))
+(allow credstore credstore_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow credstore credstore_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow credstore credstore_service (service_manager (add find)))
+;;* lmx 22 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_344 credstore_service (service_manager (add)))
+;;* lme
+
+(allow credstore sec_key_att_app_id_provider_service (service_manager (find)))
+(allow credstore dropbox_service (service_manager (find)))
+(allow credstore authorization_service (service_manager (find)))
+(allow credstore keystore (keystore2 (get_auth_token)))
+(allow credstore cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow credstore cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow credstore cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow credstore cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow credstore cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow credstore cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow crosvm vm_manager_device_type (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 40 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_345 kvm_device (chr_file (getattr)))
+;;* lme
+
+;;* lmx 41 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_346 kvm_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/credstore.te
+
+(neverallowx base_typeattr_347 kvm_device (ioctl chr_file ((range 0x0 0xadff) (range 0xaf00 0xffff))))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/credstore.te
+
+(neverallowx base_typeattr_347 kvm_device (ioctl chr_file ((range 0xae00 0xae02) (range 0xae04 0xaeff))))
+;;* lme
+
+;;* lmx 47 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_348 vm_manager_device_type (chr_file (getattr)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_349 vm_manager_device_type (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(typetransition crosvm tmpfs file crosvm_tmpfs)
+(allow crosvm crosvm_tmpfs (file (read write getattr map)))
+(allow crosvm early_virtmgr (fd (use)))
+(allow crosvm virtualizationmanager (fd (use)))
+(allow crosvm early_virtmgr (fifo_file (write)))
+(allow crosvm virtualizationmanager (fifo_file (write)))
+(allow crosvm vendor_microdroid_file (file (ioctl read getattr lock)))
+(allow crosvm apk_data_file (file (ioctl read getattr lock)))
+(allow crosvm shell_data_file (file (ioctl read getattr lock)))
+(allow crosvm staging_data_file (file (ioctl read getattr lock)))
+(allow crosvm app_data_file (file (ioctl read getattr lock)))
+(allow crosvm privapp_data_file (file (ioctl read getattr lock)))
+(allow crosvm apex_compos_data_file (file (ioctl read getattr lock)))
+(allow crosvm apex_virt_data_file (file (ioctl read getattr lock)))
+(allow crosvm virtualizationservice_data_file (file (ioctl read getattr lock)))
+(allow crosvm vm_data_file (file (ioctl read getattr lock)))
+(allow crosvm virtualizationservice_data_file (dir (search)))
+(allow crosvm vm_data_file (dir (search)))
+(allow crosvm self (capability (sys_nice)))
+(allow crosvm self (cap_userns (sys_nice)))
+(allow crosvm early_virtmgr (unix_stream_socket (read write getattr accept getopt)))
+(allow crosvm virtualizationmanager (unix_stream_socket (read write getattr accept getopt)))
+(allow crosvm app_data_file (file (write)))
+(allow crosvm privapp_data_file (file (write)))
+(allow crosvm apex_compos_data_file (file (write)))
+(allow crosvm apex_virt_data_file (file (write)))
+(allow crosvm virtualizationservice_data_file (file (write)))
+(allow crosvm vm_data_file (file (write)))
+(allow crosvm adbd (fd (use)))
+(allow crosvm adbd (unix_stream_socket (read write)))
+(allow crosvm devpts (chr_file (ioctl read write getattr)))
+(allow crosvm device (dir (read open)))
+(allow crosvm same_process_hal_file (file (read getattr map execute open)))
+(allow crosvm gpu_device (chr_file (ioctl read write getattr map open)))
+(allow crosvm hal_graphics_allocator (fd (use)))
+(allow crosvm hal_graphics_allocator_server (binder (call)))
+(allow crosvm surfaceflinger (fd (use)))
+(allow crosvm vmlauncher_app (binder (call transfer)))
+(allow crosvm servicemanager (binder (call transfer)))
+(allow crosvm virtualization_service (service_manager (find)))
+(allow crosvm virtualizationservice (binder (call transfer)))
+(allow crosvm audioserver (binder (call transfer)))
+(allow audioserver crosvm (binder (transfer)))
+(allow crosvm audioserver (fd (use)))
+(allow crosvm audioserver_service (service_manager (find)))
+(allow crosvm fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow crosvm fuse (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow crosvm mnt_user_file (dir (search)))
+(allow crosvm virtualizationservice_data_file (dir (write add_name remove_name)))
+(allow crosvm virtualizationservice_data_file (sock_file (write create unlink)))
+(dontaudit crosvm self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow crosvm shell_data_file (file (write)))
+(dontaudit crosvm early_virtmgr (fifo_file (read getattr)))
+(dontaudit crosvm virtualizationmanager (fifo_file (read getattr)))
+(allow crosvm self (tcp_socket (read write create bind listen accept setopt)))
+(allow crosvm port (tcp_socket (name_bind)))
+(allow crosvm adbd (unix_stream_socket (ioctl)))
+(allow crosvm node (tcp_socket (node_bind)))
+(allow crosvm vfio_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow crosvm vfio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow crosvm virtualizationservice_data_file (file (read)))
+(allow crosvm tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx crosvm tun_device (ioctl chr_file (0x54d0 0x54d2 0x54d8)))
+(allow crosvm self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx crosvm self (ioctl udp_socket (0x8921)))
+(allow crosvm vmnic (fd (use)))
+(allow crosvm kmsg_debug_device (chr_file (write lock append map open)))
+;;* lmx 189 system/sepolicy/private/credstore.te
+
+(neverallow crosvm apk_data_file (file (open)))
+(neverallow crosvm staging_data_file (file (open)))
+(neverallow crosvm app_data_file (file (open)))
+(neverallow crosvm privapp_data_file (file (open)))
+(neverallow crosvm virtualizationservice_data_file (file (open)))
+(neverallow crosvm vm_data_file (file (open)))
+(neverallow crosvm storage_area_content_file (file (open)))
+;;* lme
+
+;;* lmx 192 system/sepolicy/private/credstore.te
+
+(neverallow crosvm base_typeattr_350 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 217 system/sepolicy/private/credstore.te
+
+(neverallow crosvm base_typeattr_351 (file (read)))
+;;* lme
+
+;;* lmx 228 system/sepolicy/private/credstore.te
+
+(neverallow base_typeattr_352 crosvm_exec (file (execute execute_no_trans)))
+;;* lme
+
+(allow init derive_classpath_exec (file (read getattr map execute open)))
+(allow init derive_classpath (process (transition)))
+(allow derive_classpath derive_classpath_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init derive_classpath (process (noatsecure)))
+(allow init derive_classpath (process (siginh rlimitinh)))
+(typetransition init derive_classpath_exec process derive_classpath)
+(allow derive_classpath apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow derive_classpath vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow derive_classpath environ_system_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow derive_classpath environ_system_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow derive_classpath unlabeled (dir (search)))
+(allow derive_classpath postinstall_apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow derive_classpath postinstall_dexopt (dir (search)))
+(allow derive_classpath postinstall_dexopt (fd (use)))
+(allow derive_classpath postinstall_dexopt (file (read)))
+(allow derive_classpath postinstall_dexopt (lnk_file (read)))
+(allow derive_classpath postinstall_dexopt_tmpfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow derive_classpath artd (fd (use)))
+(allow derive_classpath pre_reboot_dexopt_artd_file (file (read write open)))
+(allow init derive_sdk_exec (file (read getattr map execute open)))
+(allow init derive_sdk (process (transition)))
+(allow derive_sdk derive_sdk_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init derive_sdk (process (noatsecure)))
+(allow init derive_sdk (process (siginh rlimitinh)))
+(typetransition init derive_sdk_exec process derive_sdk)
+(allow derive_sdk apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow derive_sdk vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow derive_sdk property_socket (sock_file (write)))
+(allow derive_sdk init (unix_stream_socket (connectto)))
+(allow derive_sdk module_sdkextensions_prop (property_service (set)))
+(allow derive_sdk module_sdkextensions_prop (file (read getattr map open)))
+;;* lmx 13 system/sepolicy/private/derive_sdk.te
+
+(neverallow base_typeattr_353 module_sdkextensions_prop (property_service (set)))
+;;* lme
+
+(allow derive_sdk dumpstate (fd (use)))
+(allow derive_sdk dumpstate (unix_stream_socket (read write)))
+(allow derive_sdk shell_data_file (file (read write getattr append)))
+(typetransition device_as_webcam tmpfs file appdomain_tmpfs)
+(allow device_as_webcam device_as_webcam_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su device_as_webcam_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 4 system/sepolicy/private/device_as_webcam.te
+
+(neverallow base_typeattr_354 device_as_webcam_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow device_as_webcam appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 4 system/sepolicy/private/device_as_webcam.te
+
+(neverallow base_typeattr_355 base_typeattr_354 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/device_as_webcam.te
+
+(neverallow base_typeattr_356 device_as_webcam (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/device_as_webcam.te
+
+(neverallow base_typeattr_357 device_as_webcam (process (ptrace)))
+;;* lme
+
+(allow device_as_webcam system_app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow device_as_webcam system_app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow device_as_webcam app_api_service (service_manager (find)))
+(allow device_as_webcam cameraserver_service (service_manager (find)))
+(allow device_as_webcam usb_uvc_enabled_prop (file (read getattr map open)))
+(allow device_as_webcam device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow device_as_webcam video_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow device_as_webcam video_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow dex2oat dex2oat_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su dex2oat_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 5 system/sepolicy/private/dex2oat.te
+
+(neverallow base_typeattr_358 dex2oat_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow dex2oat apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat vendor_framework_file (dir (getattr search)))
+(allow dex2oat vendor_framework_file (file (read getattr map open)))
+(allow dex2oat vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat vendor_apex_metadata_file (dir (getattr search)))
+(allow dex2oat tmpfs (file (read getattr map)))
+(allow dex2oat dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat dalvikcache_data_file (file (write)))
+(allow dex2oat system_file (file (lock)))
+(allow dex2oat postinstall_file (file (lock)))
+(allow dex2oat asec_apk_file (file (read map)))
+(allow dex2oat unlabeled (file (read map)))
+(allow dex2oat oemfs (file (read map)))
+(allow dex2oat apk_tmp_file (dir (search)))
+(allow dex2oat apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat user_profile_data_file (file (read getattr lock map)))
+(allow dex2oat app_data_file (file (read write getattr lock map)))
+(allow dex2oat privapp_data_file (file (read write getattr lock map)))
+(allow dex2oat apex_module_data_file (dir (search)))
+(allow dex2oat odsign_devpts (chr_file (read write)))
+(allow dex2oat apex_art_staging_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat apex_art_staging_data_file (file (read write getattr map unlink)))
+(allow dex2oat apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat device_config_runtime_native_prop (file (read getattr map open)))
+(allow dex2oat device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow dex2oat apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat artd (fd (use)))
+(allow dex2oat installd (fd (use)))
+(allow dex2oat odrefresh (fd (use)))
+(allow dex2oat odsign (fd (use)))
+(allow dex2oat proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat postinstall_dexopt (fd (use)))
+(allow dex2oat postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dex2oat postinstall_file (filesystem (getattr)))
+(allow dex2oat postinstall_file (lnk_file (read getattr)))
+(allow dex2oat postinstall_file (file (read)))
+(allow dex2oat postinstall_file (file (getattr execute open)))
+(allow dex2oat postinstall_apex_mnt_dir (dir (getattr search)))
+(allow dex2oat postinstall_apex_mnt_dir (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat postinstall_apex_mnt_dir (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat ota_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow dex2oat ota_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dex2oat ota_data_file (lnk_file (read create)))
+(allow dex2oat ota_data_file (file (write create setattr lock append map open)))
+(allow dex2oat apexd (fd (use)))
+;;* lmx 115 system/sepolicy/private/dex2oat.te
+
+(neverallow dex2oat app_data_file_type (file (open)))
+(neverallow dex2oat app_data_file_type (lnk_file (open)))
+(neverallow dex2oat app_data_file_type (sock_file (open)))
+(neverallow dex2oat app_data_file_type (fifo_file (open)))
+;;* lme
+
+(allow dexopt_chroot_setup servicemanager (binder (call transfer)))
+(allow servicemanager dexopt_chroot_setup (binder (call transfer)))
+(allow servicemanager dexopt_chroot_setup (dir (search)))
+(allow servicemanager dexopt_chroot_setup (file (read open)))
+(allow servicemanager dexopt_chroot_setup (process (getattr)))
+(allow dexopt_chroot_setup dexopt_chroot_setup_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow base_typeattr_359 dexopt_chroot_setup_service (service_manager (add)))
+;;* lme
+
+(allow dexopt_chroot_setup dumpstate (fifo_file (write getattr)))
+(allow dexopt_chroot_setup dumpstate (fd (use)))
+(allow init dexopt_chroot_setup_exec (file (read getattr map execute open)))
+(allow init dexopt_chroot_setup (process (transition)))
+(allow dexopt_chroot_setup dexopt_chroot_setup_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init dexopt_chroot_setup (process (noatsecure)))
+(allow init dexopt_chroot_setup (process (siginh rlimitinh)))
+(typetransition init dexopt_chroot_setup_exec process dexopt_chroot_setup)
+(typetransition dexopt_chroot_setup tmpfs file dexopt_chroot_setup_tmpfs)
+(allow dexopt_chroot_setup dexopt_chroot_setup_tmpfs (file (read write getattr map)))
+(allow dexopt_chroot_setup apex_module_data_file (dir (getattr search)))
+(allow dexopt_chroot_setup apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dexopt_chroot_setup apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup apex_art_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup dexopt_chroot_setup_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su dexopt_chroot_setup_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 24 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow base_typeattr_359 dexopt_chroot_setup_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow dexopt_chroot_setup self (capability (sys_chroot sys_admin)))
+(allow dexopt_chroot_setup self (cap_userns (sys_chroot sys_admin)))
+(allow dexopt_chroot_setup pre_reboot_dexopt_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow dexopt_chroot_setup pre_reboot_dexopt_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dexopt_chroot_setup proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup block_device (dir (getattr search)))
+(allow dexopt_chroot_setup device (dir (mounton)))
+(allow dexopt_chroot_setup rootfs (dir (mounton)))
+(allow dexopt_chroot_setup proc (dir (mounton)))
+(allow dexopt_chroot_setup binderfs (dir (mounton)))
+(allow dexopt_chroot_setup selinuxfs (dir (mounton)))
+(allow dexopt_chroot_setup fusectlfs (dir (mounton)))
+(allow dexopt_chroot_setup cgroup (dir (mounton)))
+(allow dexopt_chroot_setup cgroup_v2 (dir (mounton)))
+(allow dexopt_chroot_setup sysfs (dir (mounton)))
+(allow dexopt_chroot_setup fs_bpf (dir (mounton)))
+(allow dexopt_chroot_setup devpts (dir (mounton)))
+(allow dexopt_chroot_setup tmpfs (dir (mounton)))
+(allow dexopt_chroot_setup debugfs_tracing_debug (dir (mounton)))
+(allow dexopt_chroot_setup pstorefs (dir (mounton)))
+(allow dexopt_chroot_setup functionfs (dir (mounton)))
+(allow dexopt_chroot_setup binfmt_miscfs (dir (mounton)))
+(allow dexopt_chroot_setup system_file (dir (mounton)))
+(allow dexopt_chroot_setup system_lib_file (dir (mounton)))
+(allow dexopt_chroot_setup linkerconfig_file (dir (mounton)))
+(allow dexopt_chroot_setup vendor_file (dir (mounton)))
+(allow dexopt_chroot_setup vendor_configs_file (dir (mounton)))
+(allow dexopt_chroot_setup metadata_file (dir (mounton)))
+(allow dexopt_chroot_setup system_data_root_file (dir (mounton)))
+(allow dexopt_chroot_setup system_data_file (dir (mounton)))
+(allow dexopt_chroot_setup apk_data_file (dir (mounton)))
+(allow dexopt_chroot_setup mnt_expand_file (dir (mounton)))
+(allow dexopt_chroot_setup apex_mnt_dir (dir (mounton)))
+(allow dexopt_chroot_setup pre_reboot_dexopt_file (dir (mounton)))
+(allow dexopt_chroot_setup labeledfs (filesystem (mount)))
+(allow dexopt_chroot_setup tmpfs (filesystem (mount)))
+(allow dexopt_chroot_setup labeledfs (filesystem (unmount)))
+(allow dexopt_chroot_setup proc (filesystem (unmount)))
+(allow dexopt_chroot_setup binderfs (filesystem (unmount)))
+(allow dexopt_chroot_setup selinuxfs (filesystem (unmount)))
+(allow dexopt_chroot_setup fusectlfs (filesystem (unmount)))
+(allow dexopt_chroot_setup cgroup (filesystem (unmount)))
+(allow dexopt_chroot_setup cgroup_v2 (filesystem (unmount)))
+(allow dexopt_chroot_setup sysfs (filesystem (unmount)))
+(allow dexopt_chroot_setup fs_bpf (filesystem (unmount)))
+(allow dexopt_chroot_setup devpts (filesystem (unmount)))
+(allow dexopt_chroot_setup tmpfs (filesystem (unmount)))
+(allow dexopt_chroot_setup debugfs_tracing_debug (filesystem (unmount)))
+(allow dexopt_chroot_setup pstorefs (filesystem (unmount)))
+(allow dexopt_chroot_setup functionfs (filesystem (unmount)))
+(allow dexopt_chroot_setup binfmt_miscfs (filesystem (unmount)))
+(allow dexopt_chroot_setup apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dexopt_chroot_setup apex_mnt_dir (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup apex_mnt_dir (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dexopt_chroot_setup linkerconfig_file (dir (write add_name)))
+(allow dexopt_chroot_setup linkerconfig_file (file (write create)))
+(allow dexopt_chroot_setup tmpfs (filesystem (relabelfrom)))
+(allow dexopt_chroot_setup art_exec_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dexopt_chroot_setup apexd_exec (file (read getattr map execute open)))
+(allow dexopt_chroot_setup apexd (process (transition)))
+(allow apexd apexd_exec (file (read getattr map execute open entrypoint)))
+(allow apexd dexopt_chroot_setup (process (sigchld)))
+(dontaudit dexopt_chroot_setup apexd (process (noatsecure)))
+(allow dexopt_chroot_setup apexd (process (siginh rlimitinh)))
+(typetransition dexopt_chroot_setup apexd_exec process apexd)
+(allow dexopt_chroot_setup linkerconfig_exec (file (read getattr map execute open)))
+(allow dexopt_chroot_setup linkerconfig (process (transition)))
+(allow linkerconfig linkerconfig_exec (file (read getattr map execute open entrypoint)))
+(allow linkerconfig dexopt_chroot_setup (process (sigchld)))
+(dontaudit dexopt_chroot_setup linkerconfig (process (noatsecure)))
+(allow dexopt_chroot_setup linkerconfig (process (siginh rlimitinh)))
+(typetransition dexopt_chroot_setup linkerconfig_exec process linkerconfig)
+(allow dexopt_chroot_setup property_socket (sock_file (write)))
+(allow dexopt_chroot_setup init (unix_stream_socket (connectto)))
+(allow dexopt_chroot_setup snapshotctl_prop (property_service (set)))
+(allow dexopt_chroot_setup snapshotctl_prop (file (read getattr map open)))
+(allow dexopt_chroot_setup apk_data_file (dir (getattr search)))
+;;* lmx 143 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow dexopt_chroot_setup base_typeattr_291 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 146 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow base_typeattr_235 dexopt_chroot_setup (process (transition)))
+;;* lme
+
+;;* lmx 147 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow base_typeattr_236 dexopt_chroot_setup (process (dyntransition)))
+;;* lme
+
+;;* lmx 158 system/sepolicy/private/dexopt_chroot_setup.te
+
+(neverallow base_typeattr_360 pre_reboot_dexopt_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+(allow init dhcp_exec (file (read getattr map execute open)))
+(allow init dhcp (process (transition)))
+(allow dhcp dhcp_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init dhcp (process (noatsecure)))
+(allow init dhcp (process (siginh rlimitinh)))
+(typetransition init dhcp_exec process dhcp)
+(typetransition dhcp system_data_file dir dhcp_data_file)
+(typetransition dhcp system_data_file file dhcp_data_file)
+(allow dhcp property_socket (sock_file (write)))
+(allow dhcp init (unix_stream_socket (connectto)))
+(allow dhcp dhcp_prop (property_service (set)))
+(allow dhcp dhcp_prop (file (read getattr map open)))
+(allow dhcp property_socket (sock_file (write)))
+(allow dhcp init (unix_stream_socket (connectto)))
+(allow dhcp pan_result_prop (property_service (set)))
+(allow dhcp pan_result_prop (file (read getattr map open)))
+(allow dhcp cgroup (dir (write create add_name)))
+(allow dhcp cgroup_v2 (dir (write create add_name)))
+(allow dhcp self (capability (setgid setuid net_bind_service net_admin net_raw)))
+(allow dhcp self (cap_userns (setgid setuid net_bind_service net_admin net_raw)))
+(allow dhcp self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow dhcp self (netlink_route_socket (nlmsg_write)))
+(allow dhcp shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dhcp system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dhcp toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dhcp proc_net_type (file (write)))
+(allow dhcp dhcp_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow dhcp dhcp_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dhcp netd (fd (use)))
+(allow dhcp netd (fifo_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow dhcp netd (udp_socket (read write)))
+(allow dhcp netd (unix_stream_socket (read write)))
+(allow dhcp netd (unix_dgram_socket (read write)))
+(allow dhcp netd (netlink_route_socket (read write)))
+(allow dhcp netd (netlink_nflog_socket (read write)))
+(allow dhcp netd (netlink_kobject_uevent_socket (read write)))
+(allow display_service_server fwk_display_hwservice (hwservice_manager (add find)))
+(allow display_service_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 1 system/sepolicy/private/display_service_server.te
+
+(neverallow base_typeattr_361 fwk_display_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow init dmesgd_exec (file (read getattr map execute open)))
+(allow init dmesgd (process (transition)))
+(allow dmesgd dmesgd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init dmesgd (process (noatsecure)))
+(allow init dmesgd (process (siginh rlimitinh)))
+(typetransition init dmesgd_exec process dmesgd)
+(allow dmesgd dmesgd_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow dmesgd dmesgd_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dmesgd kernel (system (syslog_read)))
+(allow dmesgd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dmesgd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dmesgd servicemanager (binder (call transfer)))
+(allow servicemanager dmesgd (binder (call transfer)))
+(allow servicemanager dmesgd (dir (search)))
+(allow servicemanager dmesgd (file (read open)))
+(allow servicemanager dmesgd (process (getattr)))
+(allow dmesgd system_server (binder (call transfer)))
+(allow system_server dmesgd (binder (transfer)))
+(allow dmesgd system_server (fd (use)))
+(allow dmesgd dropbox_service (service_manager (find)))
+(allow dmesgd proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx dnsmasq self (ioctl udp_socket (0x6900 0x6902)))
+(allowx dnsmasq self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx dnsmasq self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow dnsmasq self (capability (dac_override dac_read_search)))
+(allow dnsmasq self (cap_userns (dac_override dac_read_search)))
+(allow dnsmasq self (capability (setgid setuid net_bind_service net_admin net_raw)))
+(allow dnsmasq self (cap_userns (setgid setuid net_bind_service net_admin net_raw)))
+(allow dnsmasq dhcp_data_file (dir (write lock open add_name remove_name search)))
+(allow dnsmasq dhcp_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dnsmasq netd (fd (use)))
+(allow dnsmasq netd (fifo_file (read write getattr)))
+(allow dnsmasq netd (netlink_kobject_uevent_socket (read write)))
+(allow dnsmasq netd (netlink_nflog_socket (read write)))
+(allow dnsmasq netd (netlink_route_socket (read write)))
+(allow dnsmasq netd (unix_stream_socket (read write getattr)))
+(allow dnsmasq netd (unix_dgram_socket (read write)))
+(allow dnsmasq netd (udp_socket (read write)))
+(allow domain init (process (sigchld)))
+(allow domain self (process (fork sigchld sigkill sigstop signull signal getsched setsched getsession getpgid getcap setcap getattr setrlimit)))
+(allow base_typeattr_362 self (process (setpgid)))
+(allow domain self (fd (use)))
+(allow domain proc (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain proc_net_type (dir (search)))
+(allow domain self (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain self (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain self (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain self (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain self (fifo_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain self (unix_dgram_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown sendto)))
+(allow domain self (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown connectto)))
+(allow domain init (fd (use)))
+(allow domain device_config_aconfig_flags_prop (file (read getattr map open)))
+(allow domain tmpfs (dir (getattr search)))
+(allow domain rootfs (dir (search)))
+(allow domain rootfs (lnk_file (read getattr)))
+(allow domain device (dir (search)))
+(allow domain dev_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain devpts (dir (search)))
+(allow domain dmabuf_heap_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain socket_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain owntty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain null_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain zero_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain ashmem_device (chr_file (ioctl read write getattr lock append map)))
+(allow domain ashmem_libcutils_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_363 binder_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_363 servicemanager_prop (file (read getattr map open)))
+(dontaudit domain hwservicemanager_exec (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx domain binder_device (ioctl chr_file (0x6201 0x6203 (range 0x6205 0x6209) (range 0x620b 0x620d) (range 0x6210 0x6211))))
+(allow domain binderfs (dir (getattr search)))
+(allow domain binderfs_logs_proc (dir (search)))
+(allow domain binderfs_features (dir (search)))
+(allow domain binderfs_features (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_364 hwbinder_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain ptmx_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain random_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow domain proc_random (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain proc_random (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain properties_device (dir (getattr search)))
+(allow domain properties_serial (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain property_info (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain log_property_type (file (read getattr map open)))
+(dontaudit domain property_type (file (audit_access)))
+(allow domain property_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain init (key (search)))
+(allow domain vold (key (search)))
+(allow domain logdw_socket (sock_file (write)))
+(allow domain logd (unix_dgram_socket (sendto)))
+(allow domain pmsg_device (chr_file (write lock append map open)))
+(allow domain system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain system_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain system_seccomp_policy_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain system_security_cacerts_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain system_file (lnk_file (read getattr)))
+(allow domain system_seccomp_policy_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_security_cacerts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_group_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_passwd_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_linker_exec (file (read getattr map execute open)))
+(allow domain system_linker_config_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_lib_file (file (read getattr map execute open)))
+(allow domain system_linker_exec (lnk_file (read getattr open)))
+(allow domain system_lib_file (lnk_file (read getattr open)))
+(allow domain system_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain system_file (file (read getattr map execute open)))
+(allow coredomain system_file (file (read getattr map execute open)))
+(allow domain vendor_hal_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain same_process_hal_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_229 same_process_hal_file (file (read getattr map execute open)))
+(allow domain vndk_sp_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain vndk_sp_file (file (read getattr map execute open)))
+(allow domain vendor_configs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain vendor_configs_file (file (read getattr map open)))
+(allow domain vendor_file_type (lnk_file (read getattr open)))
+(allow domain vendor_file (dir (getattr search)))
+(allow base_typeattr_229 vendor_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_229 vendor_file_type (file (read getattr map execute open)))
+(allow base_typeattr_229 vendor_file_type (lnk_file (read getattr)))
+(allow domain sysfs (lnk_file (read getattr)))
+(allow domain system_zoneinfo_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain system_zoneinfo_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain sysfs_devices_system_cpu (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain sysfs_devices_system_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_devices_system_cpu (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_usb (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain sysfs_usb (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_usb (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_transparent_hugepage (dir (search)))
+(allow domain sysfs_transparent_hugepage (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain system_data_file (dir (getattr)))
+(allow coredomain system_data_file (dir (getattr)))
+(allow domain system_data_root_file (dir (getattr search)))
+(allow domain system_data_file (dir (search)))
+(allow appdomain system_userdir_file (dir (getattr search)))
+(allow coredomain system_userdir_file (dir (getattr search)))
+(allow appdomain media_userdir_file (dir (search)))
+(allow coredomain media_userdir_file (dir (search)))
+(allow domain vendor_userdir_file (dir (getattr search)))
+(allow domain vendor_data_file (dir (getattr search)))
+(allow domain proc (lnk_file (read getattr)))
+(allow domain proc_cpuinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain dev_cpu_variant (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain proc_perf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain selinuxfs (dir (search)))
+(allow domain selinuxfs (file (getattr)))
+(allow domain sysfs (dir (search)))
+(allow domain selinuxfs (filesystem (getattr)))
+(allow domain debugfs (dir (search)))
+(allow domain debugfs_tracing (dir (search)))
+(allow domain debugfs_tracing_debug (dir (search)))
+(allow domain debugfs_trace_marker (file (write lock append map open)))
+(allow domain self (lockdown (integrity confidentiality)))
+(allow domain fs_type (filesystem (getattr)))
+(allow domain fs_type (dir (getattr)))
+(allowx domain domain (ioctl tcp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx domain domain (ioctl udp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx domain domain (ioctl rawip_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx domain domain (ioctl icmp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx domain domain (ioctl tcp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx domain domain (ioctl udp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx domain domain (ioctl rawip_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx domain domain (ioctl icmp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx domain domain (ioctl tcp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx domain domain (ioctl udp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx domain domain (ioctl rawip_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx domain domain (ioctl icmp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx domain domain (ioctl unix_stream_socket (0x5401 0x5411 (range 0x5413 0x5414) 0x541b (range 0x5450 0x5451))))
+(allowx domain domain (ioctl unix_dgram_socket (0x5401 0x5411 (range 0x5413 0x5414) 0x541b (range 0x5450 0x5451))))
+(allowx domain pdx_channel_socket_type (ioctl unix_stream_socket (0x5401 0x5411 (range 0x5413 0x5414) 0x541b (range 0x5450 0x5451))))
+(allowx domain pdx_channel_socket_type (ioctl unix_dgram_socket (0x5401 0x5411 (range 0x5413 0x5414) 0x541b (range 0x5450 0x5451))))
+(allowx domain devpts (ioctl chr_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl file ((range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl dir ((range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl lnk_file ((range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl blk_file ((range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl sock_file ((range 0x5450 0x5451))))
+(allowx domain dev_type (ioctl fifo_file ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl file ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl dir ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl lnk_file ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl blk_file ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl sock_file ((range 0x5450 0x5451))))
+(allowx domain domain (ioctl fifo_file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl dir ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl lnk_file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl blk_file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl sock_file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl fifo_file ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl file ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl dir ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl lnk_file ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl blk_file ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl sock_file ((range 0x5450 0x5451))))
+(allowx domain file_type (ioctl fifo_file ((range 0x5450 0x5451))))
+(allowx domain tun_device (ioctl chr_file ((range 0x5450 0x5451))))
+(allowx domain fs_type (ioctl file (0x5401)))
+(allowx domain file_type (ioctl file (0x5401)))
+(allowx domain domain (ioctl fifo_file (0x5401)))
+(allowx domain dev_type (ioctl blk_file (0x1268 0x1272)))
+(allowx domain file_type (ioctl file ((range 0xf501 0xf502) 0xf505 (range 0xf50c 0xf50e))))
+(allowx domain sdcard_type (ioctl file ((range 0xf501 0xf502) 0xf505 (range 0xf50c 0xf50e))))
+(allow base_typeattr_365 hwservice_manager_type (hwservice_manager (add find)))
+(allow base_typeattr_365 vndservice_manager_type (service_manager (add find)))
+(allow domain apex_mnt_dir (dir (getattr search)))
+(allow domain apex_mnt_dir (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_pgsize_migration (dir (search)))
+(allow domain sysfs_pgsize_migration (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain bionic_linker_16kb_app_compat_prop (file (read getattr map open)))
+(allow domain device_config_media_native_prop (file (read getattr map open)))
+(allow domain crash_dump_exec (file (read getattr map execute open)))
+(allow domain crash_dump (process (transition)))
+(allow crash_dump crash_dump_exec (file (read getattr map execute open entrypoint)))
+(allow crash_dump domain (process (sigchld)))
+(dontaudit domain crash_dump (process (noatsecure)))
+(allow domain crash_dump (process (siginh rlimitinh)))
+(typetransition domain crash_dump_exec process crash_dump)
+(allow domain crash_dump (process (sigchld)))
+(allow domain heapprofd_prop (file (read getattr map open)))
+(allow heapprofd base_typeattr_366 (process (signal)))
+(allow base_typeattr_366 heapprofd_socket (sock_file (write)))
+(allow base_typeattr_366 heapprofd (unix_stream_socket (connectto)))
+(allow heapprofd base_typeattr_366 (fd (use)))
+(allow base_typeattr_366 heapprofd_tmpfs (file (read write getattr map)))
+(allow base_typeattr_366 heapprofd (fd (use)))
+(allow heapprofd base_typeattr_366 (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow heapprofd base_typeattr_366 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf base_typeattr_367 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf base_typeattr_367 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf base_typeattr_367 (process (signal)))
+(allow base_typeattr_367 traced_perf_socket (sock_file (write)))
+(allow base_typeattr_367 traced_perf (unix_stream_socket (connectto)))
+(allow traced_perf base_typeattr_367 (fd (use)))
+(allow domain sysfs_fs_incfs_features (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain sysfs_fs_incfs_features (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_fs_incfs_features (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_fs_fuse_features (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain sysfs_fs_fuse_features (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain sysfs_fs_fuse_features (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain cgroup (dir (search)))
+(allow base_typeattr_368 cgroup (dir (write lock open add_name remove_name search)))
+(allow base_typeattr_368 cgroup (file (write lock append map open)))
+(allow domain cgroup_v2 (dir (search)))
+(allow base_typeattr_368 cgroup_v2 (dir (write lock open add_name remove_name search)))
+(allow base_typeattr_368 cgroup_v2 (file (write lock append map open)))
+(allow domain cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain cgroup_rc_file (dir (search)))
+(allow domain cgroup_rc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain task_profiles_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain vendor_cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain vendor_task_profiles_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain libprocessgroup_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain libprocessgroup_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain use_memfd_prop (file (read getattr map open)))
+(allow domain module_sdkextensions_prop (file (read getattr map open)))
+(allow domain bq_config_prop (file (read getattr map open)))
+(allow domain permissive_mte_prop (file (read getattr map open)))
+(allow domain device_config_memory_safety_native_boot_prop (file (read getattr map open)))
+(allow domain device_config_memory_safety_native_prop (file (read getattr map open)))
+(allow domain device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow domain device_config_runtime_native_prop (file (read getattr map open)))
+(allow appdomain core_property_type (file (read getattr map open)))
+(allow coredomain core_property_type (file (read getattr map open)))
+(allow shell core_property_type (file (read getattr map open)))
+(allow appdomain exported3_system_prop (file (read getattr map open)))
+(allow coredomain exported3_system_prop (file (read getattr map open)))
+(allow shell exported3_system_prop (file (read getattr map open)))
+(allow appdomain exported_camera_prop (file (read getattr map open)))
+(allow coredomain exported_camera_prop (file (read getattr map open)))
+(allow shell exported_camera_prop (file (read getattr map open)))
+(allow coredomain userspace_reboot_exported_prop (file (read getattr map open)))
+(allow shell userspace_reboot_exported_prop (file (read getattr map open)))
+(allow coredomain userspace_reboot_log_prop (file (read getattr map open)))
+(allow shell userspace_reboot_log_prop (file (read getattr map open)))
+(allow coredomain userspace_reboot_test_prop (file (read getattr map open)))
+(allow shell userspace_reboot_test_prop (file (read getattr map open)))
+(allow base_typeattr_369 vendor_default_prop (file (read getattr map open)))
+(allow domain aaudio_config_prop (file (read getattr map open)))
+(allow domain apexd_select_prop (file (read getattr map open)))
+(allow domain arm64_memtag_prop (file (read getattr map open)))
+(allow domain bluetooth_config_prop (file (read getattr map open)))
+(allow domain bootloader_prop (file (read getattr map open)))
+(allow domain build_odm_prop (file (read getattr map open)))
+(allow domain build_prop (file (read getattr map open)))
+(allow domain build_vendor_prop (file (read getattr map open)))
+(allow domain debug_prop (file (read getattr map open)))
+(allow domain exported_config_prop (file (read getattr map open)))
+(allow domain exported_default_prop (file (read getattr map open)))
+(allow domain exported_dumpstate_prop (file (read getattr map open)))
+(allow domain exported_secure_prop (file (read getattr map open)))
+(allow domain exported_system_prop (file (read getattr map open)))
+(allow domain fingerprint_prop (file (read getattr map open)))
+(allow domain framework_status_prop (file (read getattr map open)))
+(allow domain gwp_asan_prop (file (read getattr map open)))
+(allow domain hal_instrumentation_prop (file (read getattr map open)))
+(allow domain hw_timeout_multiplier_prop (file (read getattr map open)))
+(allow domain init_service_status_prop (file (read getattr map open)))
+(allow domain libc_debug_prop (file (read getattr map open)))
+(allow domain locale_prop (file (read getattr map open)))
+(allow domain logd_prop (file (read getattr map open)))
+(allow domain mediadrm_config_prop (file (read getattr map open)))
+(allow domain property_service_version_prop (file (read getattr map open)))
+(allow domain soc_prop (file (read getattr map open)))
+(allow domain socket_hook_prop (file (read getattr map open)))
+(allow domain surfaceflinger_prop (file (read getattr map open)))
+(allow domain telephony_status_prop (file (read getattr map open)))
+(allow domain timezone_prop (file (read getattr map open)))
+(allow base_typeattr_370 userdebug_or_eng_prop (file (read getattr map open)))
+(allow domain vendor_socket_hook_prop (file (read getattr map open)))
+(allow domain vndk_prop (file (read getattr map open)))
+(allow domain vold_status_prop (file (read getattr map open)))
+(allow domain vts_config_prop (file (read getattr map open)))
+(allow domain binder_cache_bluetooth_server_prop (file (read getattr map open)))
+(allow domain binder_cache_system_server_prop (file (read getattr map open)))
+(allow domain binder_cache_telephony_server_prop (file (read getattr map open)))
+;;* lmx 525 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 binderfs_logs_transactions (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 529 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_371 binderfs_logs_transaction_history (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow domain kernel (key (search)))
+(allow domain linkerconfig_file (dir (search)))
+(allow domain linkerconfig_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain boringssl_self_test_marker (dir (search)))
+(allow domain log_file_logger_prop (file (read getattr map open)))
+(allow domain prng_seeder_socket (sock_file (write)))
+(allow domain prng_seeder (unix_stream_socket (connectto)))
+(allow base_typeattr_372 shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow base_typeattr_372 toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow domain aconfig_storage_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow domain aconfig_storage_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain aconfig_storage_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain system_aconfig_storage_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow coredomain system_aconfig_storage_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow appdomain system_aconfig_storage_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow appdomain system_aconfig_storage_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow coredomain system_aconfig_storage_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow coredomain system_aconfig_storage_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow domain metadata_file (dir (search)))
+;;* lmx 604 system/sepolicy/private/domain.te
+
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl file (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl dir (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl lnk_file (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl blk_file (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl sock_file (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl fifo_file (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl tcp_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl udp_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl rawip_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl packet_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl key_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl unix_stream_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl unix_dgram_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_route_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_tcpdiag_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_nflog_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_xfrm_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_selinux_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_audit_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_dnrt_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_kobject_uevent_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl appletalk_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl tun_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_iscsi_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_fib_lookup_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_connector_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_netfilter_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_generic_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_scsitransport_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_rdma_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netlink_crypto_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl sctp_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl icmp_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl ax25_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl ipx_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl netrom_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl atmpvc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl x25_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl rose_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl decnet_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl atmsvc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl rds_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl irda_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl pppox_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl llc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl can_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl tipc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl bluetooth_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl iucv_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl rxrpc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl isdn_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl phonet_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl ieee802154_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl caif_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl alg_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl nfc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl vsock_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl kcm_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl qipcrtr_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl smc_socket (0x0)))
+(neverallowx base_typeattr_236 base_typeattr_236 (ioctl xdp_socket (0x0)))
+;;* lme
+
+;;* lmx 608 system/sepolicy/private/domain.te
+
+(neverallowx domain domain (ioctl socket (0x8905)))
+(neverallowx domain domain (ioctl tcp_socket (0x8905)))
+(neverallowx domain domain (ioctl udp_socket (0x8905)))
+(neverallowx domain domain (ioctl rawip_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_socket (0x8905)))
+(neverallowx domain domain (ioctl packet_socket (0x8905)))
+(neverallowx domain domain (ioctl key_socket (0x8905)))
+(neverallowx domain domain (ioctl unix_stream_socket (0x8905)))
+(neverallowx domain domain (ioctl unix_dgram_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_route_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_tcpdiag_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_nflog_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_xfrm_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_selinux_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_audit_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_dnrt_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_kobject_uevent_socket (0x8905)))
+(neverallowx domain domain (ioctl appletalk_socket (0x8905)))
+(neverallowx domain domain (ioctl tun_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_iscsi_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_fib_lookup_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_connector_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_netfilter_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_generic_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_scsitransport_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_rdma_socket (0x8905)))
+(neverallowx domain domain (ioctl netlink_crypto_socket (0x8905)))
+(neverallowx domain domain (ioctl sctp_socket (0x8905)))
+(neverallowx domain domain (ioctl icmp_socket (0x8905)))
+(neverallowx domain domain (ioctl ax25_socket (0x8905)))
+(neverallowx domain domain (ioctl ipx_socket (0x8905)))
+(neverallowx domain domain (ioctl netrom_socket (0x8905)))
+(neverallowx domain domain (ioctl atmpvc_socket (0x8905)))
+(neverallowx domain domain (ioctl x25_socket (0x8905)))
+(neverallowx domain domain (ioctl rose_socket (0x8905)))
+(neverallowx domain domain (ioctl decnet_socket (0x8905)))
+(neverallowx domain domain (ioctl atmsvc_socket (0x8905)))
+(neverallowx domain domain (ioctl rds_socket (0x8905)))
+(neverallowx domain domain (ioctl irda_socket (0x8905)))
+(neverallowx domain domain (ioctl pppox_socket (0x8905)))
+(neverallowx domain domain (ioctl llc_socket (0x8905)))
+(neverallowx domain domain (ioctl can_socket (0x8905)))
+(neverallowx domain domain (ioctl tipc_socket (0x8905)))
+(neverallowx domain domain (ioctl bluetooth_socket (0x8905)))
+(neverallowx domain domain (ioctl iucv_socket (0x8905)))
+(neverallowx domain domain (ioctl rxrpc_socket (0x8905)))
+(neverallowx domain domain (ioctl isdn_socket (0x8905)))
+(neverallowx domain domain (ioctl phonet_socket (0x8905)))
+(neverallowx domain domain (ioctl ieee802154_socket (0x8905)))
+(neverallowx domain domain (ioctl caif_socket (0x8905)))
+(neverallowx domain domain (ioctl alg_socket (0x8905)))
+(neverallowx domain domain (ioctl nfc_socket (0x8905)))
+(neverallowx domain domain (ioctl vsock_socket (0x8905)))
+(neverallowx domain domain (ioctl kcm_socket (0x8905)))
+(neverallowx domain domain (ioctl qipcrtr_socket (0x8905)))
+(neverallowx domain domain (ioctl smc_socket (0x8905)))
+(neverallowx domain domain (ioctl xdp_socket (0x8905)))
+;;* lme
+
+;;* lmx 613 system/sepolicy/private/domain.te
+
+(neverallowx base_typeattr_236 devpts (ioctl chr_file (0x5412)))
+;;* lme
+
+;;* lmx 616 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_373 unlabeled (file (create)))
+(neverallow base_typeattr_373 unlabeled (dir (create)))
+(neverallow base_typeattr_373 unlabeled (lnk_file (create)))
+(neverallow base_typeattr_373 unlabeled (chr_file (create)))
+(neverallow base_typeattr_373 unlabeled (blk_file (create)))
+(neverallow base_typeattr_373 unlabeled (sock_file (create)))
+(neverallow base_typeattr_373 unlabeled (fifo_file (create)))
+;;* lme
+
+;;* lmx 625 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_374 self (capability (mknod)))
+(neverallow base_typeattr_374 self (cap_userns (mknod)))
+;;* lme
+
+;;* lmx 628 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 self (memprotect (mmap_zero)))
+;;* lme
+
+;;* lmx 631 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 self (capability2 (mac_override)))
+(neverallow base_typeattr_236 self (cap2_userns (mac_override)))
+;;* lme
+
+;;* lmx 636 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 self (capability2 (mac_admin)))
+(neverallow base_typeattr_236 self (cap2_userns (mac_admin)))
+;;* lme
+
+;;* lmx 640 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 kernel (security (load_policy)))
+;;* lme
+
+;;* lmx 646 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 kernel (security (setenforce)))
+;;* lme
+
+;;* lmx 647 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_375 kernel (security (setcheckreqprot)))
+;;* lme
+
+;;* lmx 650 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 kernel (security (setbool)))
+;;* lme
+
+;;* lmx 655 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 kernel (security (setsecparam)))
+;;* lme
+
+;;* lmx 663 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_376 hw_random_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 669 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_377 keychord_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 672 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_378 (file (entrypoint)))
+;;* lme
+
+(dontaudit domain postinstall_mnt_dir (dir (audit_access)))
+;;* lmx 684 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_377 port_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 685 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 port_device (chr_file (ioctl read write lock relabelfrom append map link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 688 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 usermodehelper (file (write append)))
+;;* lme
+
+;;* lmx 689 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_379 sysfs_usermodehelper (file (write append)))
+;;* lme
+
+;;* lmx 690 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 proc_security (file (read write append open)))
+;;* lme
+
+;;* lmx 694 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 init (binder (impersonate call set_context_mgr transfer)))
+;;* lme
+
+;;* lmx 695 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 vendor_init (binder (impersonate call set_context_mgr transfer)))
+;;* lme
+
+;;* lmx 698 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_380 binderfs_logs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_380 binderfs_logs_proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 699 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_371 binderfs_logs_stats (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 703 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_381 block_device (blk_file (read write open)))
+;;* lme
+
+;;* lmx 708 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_236 (chr_file (rename)))
+(neverallow base_typeattr_236 base_typeattr_236 (blk_file (rename)))
+;;* lme
+
+;;* lmx 712 system/sepolicy/private/domain.te
+
+(neverallow domain device (chr_file (read write open)))
+;;* lme
+
+;;* lmx 715 system/sepolicy/private/domain.te
+
+(neverallow domain cache_file (file (execute)))
+(neverallow domain cache_backup_file (file (execute)))
+(neverallow domain cache_private_backup_file (file (execute)))
+(neverallow domain cache_recovery_file (file (execute)))
+;;* lme
+
+;;* lmx 718 system/sepolicy/private/domain.te
+
+(neverallow domain nativetest_data_file (file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain nativetest_data_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain nativetest_data_file (chr_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain nativetest_data_file (blk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain nativetest_data_file (sock_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain nativetest_data_file (fifo_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 719 system/sepolicy/private/domain.te
+
+(neverallow domain nativetest_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 720 system/sepolicy/private/domain.te
+
+(neverallow domain nativetest_data_file (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 722 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_382 shell_test_data_file (file (write create setattr relabelfrom append unlink link rename)))
+(neverallow base_typeattr_382 shell_test_data_file (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow base_typeattr_382 shell_test_data_file (chr_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow base_typeattr_382 shell_test_data_file (blk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow base_typeattr_382 shell_test_data_file (sock_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow base_typeattr_382 shell_test_data_file (fifo_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 723 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_382 shell_test_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 724 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_383 shell_test_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 725 system/sepolicy/private/domain.te
+
+(neverallow heapprofd shell_test_data_file (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 726 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_382 shell_test_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 729 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 property_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 730 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 property_data_file (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 731 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 property_type (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 732 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 properties_device (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 733 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 properties_serial (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 747 system/sepolicy/private/domain.te
+
+(neverallow domain exec_type (file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (dir (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (chr_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (blk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (sock_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain exec_type (fifo_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (dir (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (chr_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (blk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (sock_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain system_file_type (fifo_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (dir (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (lnk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (chr_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (blk_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (sock_file (write create setattr relabelfrom append unlink link rename)))
+(neverallow domain vendor_file_type (fifo_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 749 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_375 exec_type (file (relabelto)))
+(neverallow base_typeattr_375 exec_type (dir (relabelto)))
+(neverallow base_typeattr_375 exec_type (lnk_file (relabelto)))
+(neverallow base_typeattr_375 exec_type (chr_file (relabelto)))
+(neverallow base_typeattr_375 exec_type (blk_file (relabelto)))
+(neverallow base_typeattr_375 exec_type (sock_file (relabelto)))
+(neverallow base_typeattr_375 exec_type (fifo_file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (dir (relabelto)))
+(neverallow base_typeattr_375 system_file_type (lnk_file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (chr_file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (blk_file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (sock_file (relabelto)))
+(neverallow base_typeattr_375 system_file_type (fifo_file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (dir (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (lnk_file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (chr_file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (blk_file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (sock_file (relabelto)))
+(neverallow base_typeattr_375 vendor_file_type (fifo_file (relabelto)))
+;;* lme
+
+;;* lmx 752 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 exec_type (file (mounton)))
+(neverallow base_typeattr_236 exec_type (dir (mounton)))
+(neverallow base_typeattr_236 exec_type (lnk_file (mounton)))
+(neverallow base_typeattr_236 exec_type (chr_file (mounton)))
+(neverallow base_typeattr_236 exec_type (blk_file (mounton)))
+(neverallow base_typeattr_236 exec_type (sock_file (mounton)))
+(neverallow base_typeattr_236 exec_type (fifo_file (mounton)))
+;;* lme
+
+;;* lmx 755 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 rootfs (file (write create setattr relabelto append unlink link rename)))
+;;* lme
+
+;;* lmx 759 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_384 (filesystem (relabelto)))
+;;* lme
+
+;;* lmx 765 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 contextmount_type (file (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (dir (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (lnk_file (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (chr_file (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (blk_file (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (sock_file (create setattr relabelfrom relabelto append link rename)))
+(neverallow base_typeattr_236 contextmount_type (fifo_file (create setattr relabelfrom relabelto append link rename)))
+;;* lme
+
+;;* lmx 766 system/sepolicy/private/domain.te
+
+(neverallow domain contextmount_type (file (write unlink)))
+(neverallow domain contextmount_type (dir (write unlink)))
+(neverallow domain contextmount_type (lnk_file (write unlink)))
+(neverallow domain contextmount_type (chr_file (write unlink)))
+(neverallow domain contextmount_type (blk_file (write unlink)))
+(neverallow domain contextmount_type (sock_file (write unlink)))
+(neverallow domain contextmount_type (fifo_file (write unlink)))
+;;* lme
+
+;;* lmx 773 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 default_android_service (service_manager (add find list)))
+;;* lme
+
+;;* lmx 774 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 default_android_vndservice (service_manager (add find list)))
+;;* lme
+
+;;* lmx 775 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 default_android_hwservice (hwservice_manager (add find list)))
+;;* lme
+
+;;* lmx 784 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 hidl_base_hwservice (hwservice_manager (find)))
+;;* lme
+
+;;* lmx 788 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 mmc_prop (property_service (set)))
+;;* lme
+
+;;* lmx 789 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 vndk_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 mmc_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 exported_default_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 exported_secure_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 vendor_default_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 storage_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 791 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 hw_timeout_multiplier_prop (property_service (set)))
+;;* lme
+
+;;* lmx 800 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_385 exported_pm_prop (property_service (set)))
+;;* lme
+
+;;* lmx 800 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_386 exported_pm_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 806 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_380 future_pm_prop (property_service (set)))
+;;* lme
+
+;;* lmx 807 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_380 future_pm_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit domain future_pm_prop (file (read)))
+;;* lmx 813 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 aac_drc_prop (property_service (set)))
+;;* lme
+
+;;* lmx 814 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 build_prop (property_service (set)))
+;;* lme
+
+;;* lmx 815 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 userdebug_or_eng_prop (property_service (set)))
+;;* lme
+
+;;* lmx 837 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_387 serialno_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 845 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_388 frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 859 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_389 metadata_block_device (blk_file (ioctl read write lock append link rename open)))
+;;* lme
+
+;;* lmx 870 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_390 system_block_device (blk_file (write append)))
+;;* lme
+
+;;* lmx 873 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_391 base_typeattr_236 (binder (set_context_mgr)))
+;;* lme
+
+;;* lmx 875 system/sepolicy/private/domain.te
+
+(neverallow servicemanager hwbinder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 876 system/sepolicy/private/domain.te
+
+(neverallow servicemanager vndbinder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 877 system/sepolicy/private/domain.te
+
+(neverallow hwservicemanager binder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 878 system/sepolicy/private/domain.te
+
+(neverallow hwservicemanager vndbinder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 879 system/sepolicy/private/domain.te
+
+(neverallow vndservicemanager binder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 880 system/sepolicy/private/domain.te
+
+(neverallow vndservicemanager hwbinder_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 882 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_392 base_typeattr_393 (service_manager (find)))
+;;* lme
+
+;;* lmx 919 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_394 vndbinder_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lme
+
+;;* lmx 927 system/sepolicy/private/domain.te
+
+(neverallow ueventd vndbinder_device (chr_file (ioctl read write append)))
+;;* lme
+
+;;* lmx 930 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_395 vndservice_manager_type (service_manager (add find list)))
+;;* lme
+
+;;* lmx 937 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_395 vndservicemanager (binder (impersonate call set_context_mgr transfer)))
+;;* lme
+
+;;* lmx 954 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_396 base_typeattr_397 (socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (tcp_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (udp_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (rawip_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (packet_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (key_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (unix_stream_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (unix_dgram_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_route_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_tcpdiag_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_nflog_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_xfrm_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_selinux_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_audit_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_dnrt_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_kobject_uevent_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (appletalk_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (tun_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_iscsi_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_fib_lookup_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_connector_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_netfilter_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_generic_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_scsitransport_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_rdma_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netlink_crypto_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (sctp_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (icmp_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (ax25_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (ipx_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (netrom_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (atmpvc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (x25_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (rose_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (decnet_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (atmsvc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (rds_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (irda_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (pppox_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (llc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (can_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (tipc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (bluetooth_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (iucv_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (rxrpc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (isdn_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (phonet_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (ieee802154_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (caif_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (alg_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (nfc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (vsock_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (kcm_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (qipcrtr_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (smc_socket (connect sendto)))
+(neverallow base_typeattr_396 base_typeattr_397 (xdp_socket (connect sendto)))
+;;* lme
+
+;;* lmx 954 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_396 base_typeattr_397 (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 967 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_398 core_data_file_type (sock_file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_398 coredomain_socket (sock_file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_398 unlabeled (sock_file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 981 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_392 base_typeattr_399 (sock_file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 997 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_400 base_typeattr_401 (sock_file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1021 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_402 base_typeattr_403 (file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_402 base_typeattr_403 (lnk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_402 base_typeattr_403 (chr_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_402 base_typeattr_403 (blk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_402 base_typeattr_403 (sock_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_402 base_typeattr_403 (fifo_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1036 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_402 base_typeattr_404 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1053 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_405 core_data_file_type (file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_405 core_data_file_type (lnk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_405 core_data_file_type (chr_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_405 core_data_file_type (blk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_405 core_data_file_type (sock_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_405 core_data_file_type (fifo_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1053 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_406 base_typeattr_407 (file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_406 base_typeattr_407 (lnk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_406 base_typeattr_407 (chr_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_406 base_typeattr_407 (blk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_406 base_typeattr_407 (sock_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_406 base_typeattr_407 (fifo_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1053 system/sepolicy/private/domain.te
+
+(neverallow vendor_init unencrypted_data_file (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1077 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_405 base_typeattr_408 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1077 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_406 base_typeattr_409 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1077 system/sepolicy/private/domain.te
+
+(neverallow vendor_init unencrypted_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1109 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_410 system_data_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1121 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_411 vendor_data_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1134 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_412 vendor_data_file (file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_412 vendor_data_file (lnk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_412 vendor_data_file (chr_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_412 vendor_data_file (blk_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_412 vendor_data_file (sock_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_412 vendor_data_file (fifo_file (create setattr lock relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1145 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_413 vendor_shell_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1156 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_414 base_typeattr_415 (file (execute execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1181 system/sepolicy/private/domain.te
+
+(neverallow coredomain base_typeattr_416 (file (entrypoint)))
+;;* lme
+
+;;* lmx 1181 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_229 base_typeattr_417 (file (entrypoint)))
+;;* lme
+
+;;* lmx 1198 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_418 base_typeattr_419 (file (execute)))
+;;* lme
+
+;;* lmx 1217 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_420 base_typeattr_421 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 1228 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_414 base_typeattr_422 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1268 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_423 zygote (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 1269 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_424 zygote_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 1271 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_425 webview_zygote (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 1272 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_424 webview_zygote (sock_file (write)))
+;;* lme
+
+;;* lmx 1273 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_424 app_zygote (sock_file (write)))
+;;* lme
+
+;;* lmx 1275 system/sepolicy/private/domain.te
+
+(neverallow domain tombstoned_crash_socket (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 1279 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_426 tombstoned_intercept_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 1280 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_426 tombstoned_intercept_socket (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 1283 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_427 heapdump_data_file (file (read)))
+;;* lme
+
+;;* lmx 1301 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_236 (sem (create destroy getattr setattr read write associate unix_read unix_write)))
+(neverallow base_typeattr_236 base_typeattr_236 (msg (send receive)))
+(neverallow base_typeattr_236 base_typeattr_236 (msgq (create destroy getattr setattr read write associate unix_read unix_write enqueue)))
+(neverallow base_typeattr_236 base_typeattr_236 (shm (create destroy getattr setattr read write associate unix_read unix_write lock)))
+;;* lme
+
+;;* lmx 1305 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 dev_type (lnk_file (mounton)))
+(neverallow base_typeattr_236 dev_type (sock_file (mounton)))
+(neverallow base_typeattr_236 dev_type (fifo_file (mounton)))
+(neverallow base_typeattr_236 fs_type (lnk_file (mounton)))
+(neverallow base_typeattr_236 fs_type (sock_file (mounton)))
+(neverallow base_typeattr_236 fs_type (fifo_file (mounton)))
+(neverallow base_typeattr_236 file_type (lnk_file (mounton)))
+(neverallow base_typeattr_236 file_type (sock_file (mounton)))
+(neverallow base_typeattr_236 file_type (fifo_file (mounton)))
+;;* lme
+
+;;* lmx 1310 system/sepolicy/private/domain.te
+
+(neverallow domain su_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1322 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_428 (file (execmod)))
+;;* lme
+
+;;* lmx 1327 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 self (process (execstack execheap)))
+;;* lme
+
+;;* lmx 1331 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_429 file_type (file (execmod)))
+;;* lme
+
+;;* lmx 1339 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_430 domain (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 1358 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_431 system_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1361 system/sepolicy/private/domain.te
+
+(neverallow installd system_data_file (file (write create setattr relabelto append link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1374 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_432 shell (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 1388 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_433 base_typeattr_434 (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 1397 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_435 app_data_file (lnk_file (read)))
+(neverallow base_typeattr_435 privapp_data_file (lnk_file (read)))
+;;* lme
+
+;;* lmx 1404 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_436 shell_data_file (lnk_file (read)))
+;;* lme
+
+;;* lmx 1411 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_437 (service_manager (list)))
+;;* lme
+
+;;* lmx 1416 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_438 (hwservice_manager (list)))
+;;* lme
+
+;;* lmx 1435 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 domain (file (execute execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1441 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_380 debugfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_380 debugfs (lnk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1444 system/sepolicy/private/domain.te
+
+(neverallow domain debugfs_type (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1447 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_439 fusectlfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1456 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_440 profman_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1462 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 base_typeattr_441 (system (module_load)))
+;;* lme
+
+;;* lmx 1466 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 self (capability (setfcap)))
+(neverallow base_typeattr_236 self (cap_userns (setfcap)))
+;;* lme
+
+;;* lmx 1469 system/sepolicy/private/domain.te
+
+(neverallow domain crash_dump (process (noatsecure)))
+;;* lme
+
+;;* lmx 1473 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_442 coredomain_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 1478 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_236 same_process_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 1489 system/sepolicy/private/domain.te
+
+(neverallow domain proc_type (dir (write create link rename add_name remove_name reparent rmdir)))
+(neverallow domain sysfs_type (dir (write create link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1492 system/sepolicy/private/domain.te
+
+(neverallow domain cgroup (file (create)))
+;;* lme
+
+;;* lmx 1493 system/sepolicy/private/domain.te
+
+(neverallow domain cgroup_v2 (file (create)))
+;;* lme
+
+(dontaudit domain proc_type (dir (write)))
+(dontaudit domain sysfs_type (dir (write)))
+(dontaudit domain cgroup (file (create)))
+(dontaudit domain cgroup_v2 (file (create)))
+;;* lmx 1516 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_443 mnt_vendor_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1519 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_444 vendor_public_lib_file (file (execute execute_no_trans)))
+(neverallow base_typeattr_444 vendor_public_framework_file (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1530 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_229 mnt_product_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1533 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_445 sysfs_batteryinfo (file (read open)))
+;;* lme
+
+;;* lmx 1556 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_446 hal_codec2_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 1565 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_447 ashmem_device (chr_file (open)))
+;;* lme
+
+;;* lmx 1567 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_448 debugfs_tracing_printk_formats (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1589 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_449 misc_block_device (blk_file (ioctl read write lock relabelfrom append link rename open)))
+;;* lme
+
+;;* lmx 1603 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_450 self (capability (sys_ptrace)))
+(neverallow base_typeattr_450 self (cap_userns (sys_ptrace)))
+;;* lme
+
+;;* lmx 1606 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_451 base_typeattr_236 (keystore2_key (gen_unique_id)))
+;;* lme
+
+;;* lmx 1607 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_424 base_typeattr_236 (keystore2_key (use_dev_id)))
+;;* lme
+
+;;* lmx 1608 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_424 keystore (keystore2 (clear_ns lock reset unlock)))
+;;* lme
+
+;;* lmx 1615 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 debugfs_tracing_debug (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1624 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_427 dropbox_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1630 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_427 dropbox_data_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1643 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_435 app_data_file (file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (dir (create unlink)))
+(neverallow base_typeattr_435 app_data_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (fifo_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (dir (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (fifo_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (dir (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (fifo_file (create unlink)))
+;;* lme
+
+;;* lmx 1645 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_452 storage_area_app_dir (dir (create unlink)))
+(neverallow base_typeattr_452 storage_area_dir (dir (create unlink)))
+;;* lme
+
+;;* lmx 1672 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_453 app_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_453 privapp_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_453 storage_area_content_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1674 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_454 storage_area_app_dir (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_454 storage_area_dir (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1689 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_455 storage_area_key_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_455 storage_area_key_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_455 storage_area_key_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_455 storage_area_key_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_455 storage_area_key_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_455 storage_area_key_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_455 storage_area_key_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1713 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_456 app_data_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_456 privapp_data_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_456 storage_area_content_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1715 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_457 storage_area_app_dir (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_457 storage_area_dir (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1737 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_458 app_data_file (file (open)))
+(neverallow base_typeattr_458 app_data_file (lnk_file (open)))
+(neverallow base_typeattr_458 app_data_file (chr_file (open)))
+(neverallow base_typeattr_458 app_data_file (blk_file (open)))
+(neverallow base_typeattr_458 app_data_file (sock_file (open)))
+(neverallow base_typeattr_458 app_data_file (fifo_file (open)))
+(neverallow base_typeattr_458 privapp_data_file (file (open)))
+(neverallow base_typeattr_458 privapp_data_file (lnk_file (open)))
+(neverallow base_typeattr_458 privapp_data_file (chr_file (open)))
+(neverallow base_typeattr_458 privapp_data_file (blk_file (open)))
+(neverallow base_typeattr_458 privapp_data_file (sock_file (open)))
+(neverallow base_typeattr_458 privapp_data_file (fifo_file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (lnk_file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (chr_file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (blk_file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (sock_file (open)))
+(neverallow base_typeattr_458 storage_area_content_file (fifo_file (open)))
+;;* lme
+
+;;* lmx 1748 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_435 app_data_file (file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (dir (create unlink)))
+(neverallow base_typeattr_435 app_data_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 app_data_file (fifo_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (dir (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 privapp_data_file (fifo_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (dir (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (lnk_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (chr_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (blk_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (sock_file (create unlink)))
+(neverallow base_typeattr_435 storage_area_content_file (fifo_file (create unlink)))
+;;* lme
+
+;;* lmx 1758 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_459 app_data_file (file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (dir (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (lnk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (chr_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (blk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (sock_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 app_data_file (fifo_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (dir (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (lnk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (chr_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (blk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (sock_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 privapp_data_file (fifo_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (dir (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (lnk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (chr_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (blk_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (sock_file (relabelfrom relabelto)))
+(neverallow base_typeattr_459 storage_area_content_file (fifo_file (relabelfrom relabelto)))
+;;* lme
+
+;;* lmx 1760 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_452 storage_area_app_dir (dir (relabelfrom relabelto)))
+(neverallow base_typeattr_452 storage_area_dir (dir (relabelfrom relabelto)))
+;;* lme
+
+;;* lmx 1783 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_460 staging_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1798 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_461 staging_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 1800 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_462 staging_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1805 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_463 staging_data_file (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1809 system/sepolicy/private/domain.te
+
+(neverallow apexd staging_data_file (file (write create setattr relabelfrom append execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1816 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_464 base_typeattr_465 (file (execute)))
+;;* lme
+
+;;* lmx 1846 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_466 base_typeattr_467 (file (execute)))
+;;* lme
+
+;;* lmx 1853 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 cgroup_rc_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1866 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_468 dalvikcache_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1878 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_468 dalvikcache_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1893 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_469 apex_art_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1906 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_469 apex_art_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1918 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_260 base_typeattr_268 (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1946 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_470 self (capability (dac_override)))
+(neverallow base_typeattr_470 self (cap_userns (dac_override)))
+;;* lme
+
+;;* lmx 1956 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_471 self (capability (dac_read_search)))
+(neverallow base_typeattr_471 self (cap_userns (dac_read_search)))
+;;* lme
+
+;;* lmx 1976 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_472 base_typeattr_473 (filesystem (mount remount relabelfrom relabelto)))
+;;* lme
+
+;;* lmx 1978 system/sepolicy/private/domain.te
+
+(neverallow domain base_typeattr_474 (filesystem (mount remount relabelfrom relabelto)))
+;;* lme
+
+;;* lmx 1997 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_475 self (capability (sys_rawio)))
+(neverallow base_typeattr_475 self (cap_userns (sys_rawio)))
+;;* lme
+
+;;* lmx 2006 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_476 mirror_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 2009 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_385 net_dns_prop (property_service (set)))
+;;* lme
+
+;;* lmx 2010 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_371 net_dns_prop (file (read)))
+;;* lme
+
+;;* lmx 2013 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_427 pm_prop (property_service (set)))
+;;* lme
+
+;;* lmx 2014 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_229 pm_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 2017 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_477 firstboot_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 2021 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_478 dalvik_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 2024 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_230 debugfs_kprobes (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 2028 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_479 vendor_file (file (write create setattr relabelfrom append unlink link rename execute open execute_no_trans)))
+;;* lme
+
+;;* lmx 2045 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_480 base_typeattr_481 (socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (tcp_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (udp_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (rawip_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (packet_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (key_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (unix_stream_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (unix_dgram_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_route_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_tcpdiag_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_nflog_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_xfrm_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_selinux_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_audit_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_dnrt_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_kobject_uevent_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (appletalk_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (tun_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_iscsi_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_fib_lookup_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_connector_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_netfilter_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_generic_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_scsitransport_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_rdma_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netlink_crypto_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (sctp_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (icmp_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (ax25_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (ipx_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (netrom_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (atmpvc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (x25_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (rose_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (decnet_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (atmsvc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (rds_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (irda_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (pppox_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (llc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (can_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (tipc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (bluetooth_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (iucv_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (rxrpc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (isdn_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (phonet_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (ieee802154_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (caif_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (alg_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (nfc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (vsock_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (kcm_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (qipcrtr_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (smc_socket (connect sendto)))
+(neverallow base_typeattr_480 base_typeattr_481 (xdp_socket (connect sendto)))
+;;* lme
+
+;;* lmx 2045 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_480 base_typeattr_481 (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 2066 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_482 base_typeattr_483 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 2113 system/sepolicy/private/domain.te
+
+(neverallow domain mlsvendorcompat (process (fork)))
+;;* lme
+
+;;* lmx 2117 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_484 system_file_type (file (mounton)))
+(neverallow base_typeattr_484 system_file_type (dir (mounton)))
+(neverallow base_typeattr_484 system_file_type (lnk_file (mounton)))
+(neverallow base_typeattr_484 system_file_type (chr_file (mounton)))
+(neverallow base_typeattr_484 system_file_type (blk_file (mounton)))
+(neverallow base_typeattr_484 system_file_type (sock_file (mounton)))
+(neverallow base_typeattr_484 system_file_type (fifo_file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (dir (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (lnk_file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (chr_file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (blk_file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (sock_file (mounton)))
+(neverallow base_typeattr_484 vendor_file_type (fifo_file (mounton)))
+;;* lme
+
+;;* lmx 2126 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_380 mm_events_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 2145 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_485 proc_kallsyms (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 2151 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_486 base_typeattr_487 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 2167 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_488 sysfs_devices_cs_etm (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 2177 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_489 self (capability2 (perfmon)))
+;;* lme
+
+;;* lmx 2197 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_490 shell_data_file (file (open)))
+;;* lme
+
+;;* lmx 2215 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_491 shell_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 2228 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_492 shell_data_file (dir (open)))
+;;* lme
+
+;;* lmx 2243 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_492 shell_data_file (dir (search)))
+;;* lme
+
+;;* lmx 2255 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_493 system_app_data_file (file (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (dir (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (lnk_file (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (chr_file (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (blk_file (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (sock_file (create unlink open)))
+(neverallow base_typeattr_493 system_app_data_file (fifo_file (create unlink open)))
+;;* lme
+
+;;* lmx 2262 system/sepolicy/private/domain.te
+
+(neverallow untrusted_app_all system_app_data_file (file (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (dir (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (lnk_file (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (chr_file (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (blk_file (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (sock_file (create unlink open)))
+(neverallow untrusted_app_all system_app_data_file (fifo_file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (dir (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (lnk_file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (chr_file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (blk_file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (sock_file (create unlink open)))
+(neverallow isolated_app_all system_app_data_file (fifo_file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (dir (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (lnk_file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (chr_file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (blk_file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (sock_file (create unlink open)))
+(neverallow ephemeral_app system_app_data_file (fifo_file (create unlink open)))
+(neverallow priv_app system_app_data_file (file (create unlink open)))
+(neverallow priv_app system_app_data_file (dir (create unlink open)))
+(neverallow priv_app system_app_data_file (lnk_file (create unlink open)))
+(neverallow priv_app system_app_data_file (chr_file (create unlink open)))
+(neverallow priv_app system_app_data_file (blk_file (create unlink open)))
+(neverallow priv_app system_app_data_file (sock_file (create unlink open)))
+(neverallow priv_app system_app_data_file (fifo_file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (dir (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (lnk_file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (chr_file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (blk_file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (sock_file (create unlink open)))
+(neverallow sdk_sandbox_all system_app_data_file (fifo_file (create unlink open)))
+;;* lme
+
+;;* lmx 2264 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 mtectrl (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 2265 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_235 kcmdlinectrl (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 2268 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_494 checkin_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_494 checkin_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 2270 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_495 proc (file (mounton)))
+(neverallow base_typeattr_495 proc (dir (mounton)))
+;;* lme
+
+;;* lmx 2271 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_496 proc_type (file (mounton)))
+(neverallow base_typeattr_496 proc_type (dir (mounton)))
+;;* lme
+
+;;* lmx 2275 system/sepolicy/private/domain.te
+
+(neverallow base_typeattr_497 sysfs_pgsize_migration (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 2278 system/sepolicy/private/domain.te
+
+(neverallow domain base_typeattr_236 (vsock_socket (relabelfrom relabelto)))
+;;* lme
+
+(allow init drmserver_exec (file (read getattr map execute open)))
+(allow init drmserver (process (transition)))
+(allow drmserver drmserver_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init drmserver (process (noatsecure)))
+(allow init drmserver (process (siginh rlimitinh)))
+(typetransition init drmserver_exec process drmserver)
+(typetransition drmserver apk_data_file sock_file drmserver_socket)
+(allow drmserver drm_service_config_prop (file (read getattr map open)))
+(allow drmserver servicemanager (binder (call transfer)))
+(allow servicemanager drmserver (binder (call transfer)))
+(allow servicemanager drmserver (dir (search)))
+(allow servicemanager drmserver (file (read open)))
+(allow servicemanager drmserver (process (getattr)))
+(allow drmserver system_server (binder (call transfer)))
+(allow system_server drmserver (binder (transfer)))
+(allow drmserver system_server (fd (use)))
+(allow drmserver appdomain (binder (call transfer)))
+(allow appdomain drmserver (binder (transfer)))
+(allow drmserver appdomain (fd (use)))
+(allow drmserver mediametrics (binder (call transfer)))
+(allow mediametrics drmserver (binder (transfer)))
+(allow drmserver mediametrics (fd (use)))
+(allow drmserver system_server (fd (use)))
+(allow drmserver mediaserver (binder (call transfer)))
+(allow mediaserver drmserver (binder (transfer)))
+(allow drmserver mediaserver (fd (use)))
+(allow drmserver sdcard_type (dir (search)))
+(allow drmserver fuse (dir (search)))
+(allow drmserver drm_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow drmserver drm_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow drmserver app_data_file (file (read write getattr map)))
+(allow drmserver privapp_data_file (file (read write getattr map)))
+(allow drmserver sdcard_type (file (read write getattr map)))
+(allow drmserver fuse (file (read write getattr map)))
+(allow drmserver efs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver efs_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver efs_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver apk_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(auditallow drmserver apk_data_file (dir (write add_name)))
+(allow drmserver drmserver_socket (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(auditallow drmserver drmserver_socket (sock_file (create)))
+(allow drmserver apk_data_file (sock_file (unlink)))
+(allow drmserver media_rw_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver media_rw_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver media_rw_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver apk_data_file (file (read getattr map)))
+(allow drmserver asec_apk_file (file (read getattr map)))
+(allow drmserver ringtone_file (file (read getattr map)))
+(allow drmserver radio_data_file (file (read getattr map)))
+(allow drmserver oemfs (dir (search)))
+(allow drmserver oemfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver vendor_overlay_file (file (read map)))
+(allow drmserver drmserver_service (service_manager (add find)))
+;;* lmx 61 system/sepolicy/private/drmserver.te
+
+(neverallow base_typeattr_498 drmserver_service (service_manager (add)))
+;;* lme
+
+(allow drmserver permission_service (service_manager (find)))
+(allow drmserver mediametrics_service (service_manager (find)))
+(allow drmserver selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver selinuxfs (file (write lock append map open)))
+(allow drmserver kernel (security (compute_av)))
+(allow drmserver self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow drmserver cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow drmserver system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow drmserver system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init dumpstate_exec (file (read getattr map execute open)))
+(allow init dumpstate (process (transition)))
+(allow dumpstate dumpstate_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init dumpstate (process (noatsecure)))
+(allow init dumpstate (process (siginh rlimitinh)))
+(typetransition init dumpstate_exec process dumpstate)
+(allow dumpstate vdc_exec (file (read getattr map execute open)))
+(allow dumpstate vdc (process (transition)))
+(allow vdc vdc_exec (file (read getattr map execute open entrypoint)))
+(allow vdc dumpstate (process (sigchld)))
+(dontaudit dumpstate vdc (process (noatsecure)))
+(allow dumpstate vdc (process (siginh rlimitinh)))
+(typetransition dumpstate vdc_exec process vdc)
+(typetransition dumpstate tmpfs file dumpstate_tmpfs)
+(allow dumpstate dumpstate_tmpfs (file (read write getattr map)))
+(allow dumpstate system_file (file (lock)))
+(allow dumpstate storaged_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate aconfig_storage_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate aconfig_storage_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate aconfig_storage_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate incidentd (binder (call transfer)))
+(allow incidentd dumpstate (binder (transfer)))
+(allow dumpstate incidentd (fd (use)))
+(allow dumpstate incident (process (sigkill signal)))
+(allow dumpstate storaged (binder (call transfer)))
+(allow storaged dumpstate (binder (transfer)))
+(allow dumpstate storaged (fd (use)))
+(allow dumpstate statsd (binder (call transfer)))
+(allow statsd dumpstate (binder (transfer)))
+(allow dumpstate statsd (fd (use)))
+(allow dumpstate gpuservice (binder (call transfer)))
+(allow gpuservice dumpstate (binder (transfer)))
+(allow dumpstate gpuservice (fd (use)))
+(allow dumpstate idmap (binder (call transfer)))
+(allow idmap dumpstate (binder (transfer)))
+(allow dumpstate idmap (fd (use)))
+(allow dumpstate automotive_display_service (binder (call transfer)))
+(allow automotive_display_service dumpstate (binder (transfer)))
+(allow dumpstate automotive_display_service (fd (use)))
+(allow dumpstate virtual_camera (binder (call transfer)))
+(allow virtual_camera dumpstate (binder (transfer)))
+(allow dumpstate virtual_camera (fd (use)))
+(allow dumpstate ot_daemon (binder (call transfer)))
+(allow ot_daemon dumpstate (binder (transfer)))
+(allow dumpstate ot_daemon (fd (use)))
+(allow dumpstate boottime_prop (file (read getattr map open)))
+(allow dumpstate misctrl_prop (file (read getattr map open)))
+(allow dumpstate mediatranscoding (process (signal)))
+(allow dumpstate netd (process (signal)))
+(allow dumpstate statsd (process (signal)))
+(allow dumpstate virtual_camera (process (signal)))
+(allow dumpstate ot_daemon (process (signal)))
+(dontaudit dumpstate keystore (process (signal)))
+(allow dumpstate dev_type (blk_file (getattr)))
+(allow dumpstate webview_zygote (process (signal)))
+(allow dumpstate sysfs_dmabuf_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit dumpstate update_engine (binder (call)))
+(allow dumpstate proc_net_tcp_udp (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pid_max (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate config_gz (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate incidentcompanion_service (binder (call transfer)))
+(allow incidentcompanion_service dumpstate (binder (transfer)))
+(allow dumpstate incidentcompanion_service (fd (use)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate dumpstate_prop (property_service (set)))
+(allow dumpstate dumpstate_prop (file (read getattr map open)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate exported_dumpstate_prop (property_service (set)))
+(allow dumpstate exported_dumpstate_prop (file (read getattr map open)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate dumpstate_options_prop (property_service (set)))
+(allow dumpstate dumpstate_options_prop (file (read getattr map open)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate ctl_dumpstate_prop (property_service (set)))
+(allow dumpstate ctl_dumpstate_prop (file (read getattr map open)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate lpdumpd_prop (property_service (set)))
+(allow dumpstate lpdumpd_prop (file (read getattr map open)))
+(allow dumpstate lpdumpd (binder (call transfer)))
+(allow lpdumpd dumpstate (binder (transfer)))
+(allow dumpstate lpdumpd (fd (use)))
+(allow dumpstate hypervisor_prop (file (read getattr map open)))
+(allow dumpstate gsid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate property_socket (sock_file (write)))
+(allow dumpstate init (unix_stream_socket (connectto)))
+(allow dumpstate ctl_gsid_prop (property_service (set)))
+(allow dumpstate ctl_gsid_prop (file (read getattr map open)))
+(allow dumpstate gsid (binder (call transfer)))
+(allow gsid dumpstate (binder (transfer)))
+(allow dumpstate gsid (fd (use)))
+(dontaudit dumpstate binderfs_logs_transactions (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate binderfs_logs_transaction_history (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate ota_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate ota_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate ota_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate perfetto_exec (file (read getattr map execute open)))
+(allow dumpstate perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(allow perfetto dumpstate (process (sigchld)))
+(dontaudit dumpstate perfetto (process (noatsecure)))
+(allow dumpstate perfetto (process (siginh rlimitinh)))
+(typetransition dumpstate perfetto_exec process perfetto)
+(allow dumpstate perfetto (process (signal)))
+(allow dumpstate perfetto_traces_data_file (dir (search)))
+(allow dumpstate perfetto_traces_bugreport_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow dumpstate perfetto_traces_bugreport_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow perfetto dumpstate_tmpfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow perfetto dumpstate (fd (use)))
+(allow dumpstate system_dlkm_file (dir (getattr)))
+(allow dumpstate derive_sdk_exec (file (read getattr map execute open)))
+(allow dumpstate derive_sdk (process (transition)))
+(allow derive_sdk derive_sdk_exec (file (read getattr map execute open entrypoint)))
+(allow derive_sdk dumpstate (process (sigchld)))
+(dontaudit dumpstate derive_sdk (process (noatsecure)))
+(allow dumpstate derive_sdk (process (siginh rlimitinh)))
+(typetransition dumpstate derive_sdk_exec process derive_sdk)
+(allow dumpstate servicemanager (binder (call transfer)))
+(allow servicemanager dumpstate (binder (call transfer)))
+(allow servicemanager dumpstate (dir (search)))
+(allow servicemanager dumpstate (file (read open)))
+(allow servicemanager dumpstate (process (getattr)))
+(allow dumpstate sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow dumpstate self (capability2 (block_suspend)))
+(allow dumpstate self (cap2_userns (block_suspend)))
+(allow dumpstate system_suspend_server (binder (call transfer)))
+(allow system_suspend_server dumpstate (binder (transfer)))
+(allow dumpstate system_suspend_server (fd (use)))
+(allow dumpstate system_suspend_hwservice (hwservice_manager (find)))
+(allow dumpstate hwservicemanager (binder (call transfer)))
+(allow hwservicemanager dumpstate (binder (call transfer)))
+(allow hwservicemanager dumpstate (dir (search)))
+(allow hwservicemanager dumpstate (file (read map open)))
+(allow hwservicemanager dumpstate (process (getattr)))
+(allow dumpstate hwservicemanager_prop (file (read getattr map open)))
+(allow dumpstate hidl_manager_hwservice (hwservice_manager (find)))
+(allow dumpstate hal_system_suspend_service (service_manager (find)))
+(allow dumpstate servicemanager (binder (call transfer)))
+(allow servicemanager dumpstate (binder (call transfer)))
+(allow servicemanager dumpstate (dir (search)))
+(allow servicemanager dumpstate (file (read open)))
+(allow servicemanager dumpstate (process (getattr)))
+(allow dumpstate self (capability (setgid setuid sys_resource)))
+(allow dumpstate self (cap_userns (setgid setuid sys_resource)))
+(allow dumpstate domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate self (capability (kill net_admin net_raw)))
+(allow dumpstate self (cap_userns (kill net_admin net_raw)))
+(allow dumpstate system_file (file (execute_no_trans)))
+(allow dumpstate toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate self (capability (chown dac_override dac_read_search fowner fsetid)))
+(allow dumpstate self (cap_userns (chown dac_override dac_read_search fowner fsetid)))
+(allow dumpstate anr_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow dumpstate anr_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dumpstate system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate app_data_file_type (file (append)))
+(allow dumpstate self (capability2 (syslog)))
+(allow dumpstate self (cap2_userns (syslog)))
+(allow dumpstate kernel (system (syslog_read)))
+(allow dumpstate pstorefs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate domain (process (getattr)))
+(allow dumpstate appdomain (process (signal)))
+(allow dumpstate app_zygote (process (signal)))
+(allow dumpstate system_server (process (signal)))
+(allow dumpstate zygote (process (signal)))
+(allow dumpstate hal_audio_server (process (signal)))
+(allow dumpstate hal_audiocontrol_server (process (signal)))
+(allow dumpstate hal_bluetooth_server (process (signal)))
+(allow dumpstate hal_broadcastradio_server (process (signal)))
+(allow dumpstate hal_camera_server (process (signal)))
+(allow dumpstate hal_codec2_server (process (signal)))
+(allow dumpstate hal_drm_server (process (signal)))
+(allow dumpstate hal_evs_server (process (signal)))
+(allow dumpstate hal_face_server (process (signal)))
+(allow dumpstate hal_fingerprint_server (process (signal)))
+(allow dumpstate hal_graphics_allocator_server (process (signal)))
+(allow dumpstate hal_graphics_composer_server (process (signal)))
+(allow dumpstate hal_health_server (process (signal)))
+(allow dumpstate hal_input_processor_server (process (signal)))
+(allow dumpstate hal_neuralnetworks_server (process (signal)))
+(allow dumpstate hal_omx_server (process (signal)))
+(allow dumpstate hal_power_server (process (signal)))
+(allow dumpstate hal_power_stats_server (process (signal)))
+(allow dumpstate hal_sensors_server (process (signal)))
+(allow dumpstate hal_thermal_server (process (signal)))
+(allow dumpstate hal_vehicle_server (process (signal)))
+(allow dumpstate hal_vr_server (process (signal)))
+(allow dumpstate system_suspend_server (process (signal)))
+(allow dumpstate audioserver (process (signal)))
+(allow dumpstate cameraserver (process (signal)))
+(allow dumpstate drmserver (process (signal)))
+(allow dumpstate evsmanagerd (process (signal)))
+(allow dumpstate inputflinger (process (signal)))
+(allow dumpstate mediadrmserver (process (signal)))
+(allow dumpstate mediaextractor (process (signal)))
+(allow dumpstate mediametrics (process (signal)))
+(allow dumpstate mediaserver (process (signal)))
+(allow dumpstate mediaswcodec (process (signal)))
+(allow dumpstate sdcardd (process (signal)))
+(allow dumpstate surfaceflinger (process (signal)))
+(allow dumpstate vold (process (signal)))
+(allow dumpstate tombstoned_intercept_socket (sock_file (write)))
+(allow dumpstate tombstoned (unix_stream_socket (connectto)))
+(allow dumpstate sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate sysfs_devices_block (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate sysfs_loop (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate sysfs_usb (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate sysfs_zram (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit dumpstate sysfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate block_device (dir (getattr search)))
+(allow dumpstate rootfs (dir (getattr search)))
+(allow dumpstate selinuxfs (dir (getattr search)))
+(allow dumpstate tmpfs (dir (getattr search)))
+(allow dumpstate metadata_file (dir (getattr search)))
+(allow dumpstate storage_file (dir (getattr search)))
+(allow dumpstate cache_file (dir (getattr search)))
+(allow dumpstate fuse_device (chr_file (getattr)))
+(allow dumpstate dm_device (blk_file (getattr)))
+(allow dumpstate cache_block_device (blk_file (getattr)))
+(allow dumpstate rootfs (lnk_file (read getattr)))
+(allow dumpstate cache_file (lnk_file (read getattr)))
+(allow dumpstate cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate binderservicedomain (binder (call transfer)))
+(allow binderservicedomain dumpstate (binder (transfer)))
+(allow dumpstate binderservicedomain (fd (use)))
+(allow dumpstate appdomain (binder (call transfer)))
+(allow dumpstate artd (binder (call transfer)))
+(allow dumpstate netd (binder (call transfer)))
+(allow dumpstate wificond (binder (call transfer)))
+(allow appdomain dumpstate (binder (transfer)))
+(allow artd dumpstate (binder (transfer)))
+(allow netd dumpstate (binder (transfer)))
+(allow wificond dumpstate (binder (transfer)))
+(allow dumpstate appdomain (fd (use)))
+(allow dumpstate artd (fd (use)))
+(allow dumpstate netd (fd (use)))
+(allow dumpstate wificond (fd (use)))
+(allow hal_audio_server dumpstate (fifo_file (write)))
+(allow hal_audio_server dumpstate (fd (use)))
+(allow hal_audiocontrol_server dumpstate (fifo_file (write)))
+(allow hal_audiocontrol_server dumpstate (fd (use)))
+(allow hal_authgraph_server dumpstate (fifo_file (write)))
+(allow hal_authgraph_server dumpstate (fd (use)))
+(allow hal_authsecret_server dumpstate (fifo_file (write)))
+(allow hal_authsecret_server dumpstate (fd (use)))
+(allow hal_bluetooth_server dumpstate (fifo_file (write)))
+(allow hal_bluetooth_server dumpstate (fd (use)))
+(allow hal_broadcastradio_server dumpstate (fifo_file (write)))
+(allow hal_broadcastradio_server dumpstate (fd (use)))
+(allow hal_camera_server dumpstate (fifo_file (write)))
+(allow hal_camera_server dumpstate (fd (use)))
+(allow hal_codec2_server dumpstate (fifo_file (write)))
+(allow hal_codec2_server dumpstate (fd (use)))
+(allow hal_contexthub_server dumpstate (fifo_file (write)))
+(allow hal_contexthub_server dumpstate (fd (use)))
+(allow hal_drm_server dumpstate (fifo_file (write)))
+(allow hal_drm_server dumpstate (fd (use)))
+(allow hal_dumpstate_server dumpstate (fifo_file (write)))
+(allow hal_dumpstate_server dumpstate (fd (use)))
+(allow hal_evs_server dumpstate (fifo_file (write)))
+(allow hal_evs_server dumpstate (fd (use)))
+(allow hal_face_server dumpstate (fifo_file (write)))
+(allow hal_face_server dumpstate (fd (use)))
+(allow hal_fingerprint_server dumpstate (fifo_file (write)))
+(allow hal_fingerprint_server dumpstate (fd (use)))
+(allow hal_gnss_server dumpstate (fifo_file (write)))
+(allow hal_gnss_server dumpstate (fd (use)))
+(allow hal_graphics_allocator_server dumpstate (fifo_file (write)))
+(allow hal_graphics_allocator_server dumpstate (fd (use)))
+(allow hal_graphics_composer_server dumpstate (fifo_file (write)))
+(allow hal_graphics_composer_server dumpstate (fd (use)))
+(allow hal_health_server dumpstate (fifo_file (write)))
+(allow hal_health_server dumpstate (fd (use)))
+(allow hal_identity_server dumpstate (fifo_file (write)))
+(allow hal_identity_server dumpstate (fd (use)))
+(allow hal_input_processor_server dumpstate (fifo_file (write)))
+(allow hal_input_processor_server dumpstate (fd (use)))
+(allow hal_keymint_server dumpstate (fifo_file (write)))
+(allow hal_keymint_server dumpstate (fd (use)))
+(allow hal_light_server dumpstate (fifo_file (write)))
+(allow hal_light_server dumpstate (fd (use)))
+(allow hal_memtrack_server dumpstate (fifo_file (write)))
+(allow hal_memtrack_server dumpstate (fd (use)))
+(allow hal_neuralnetworks_server dumpstate (fifo_file (write)))
+(allow hal_neuralnetworks_server dumpstate (fd (use)))
+(allow hal_nfc_server dumpstate (fifo_file (write)))
+(allow hal_nfc_server dumpstate (fd (use)))
+(allow hal_oemlock_server dumpstate (fifo_file (write)))
+(allow hal_oemlock_server dumpstate (fd (use)))
+(allow hal_power_server dumpstate (fifo_file (write)))
+(allow hal_power_server dumpstate (fd (use)))
+(allow hal_power_stats_server dumpstate (fifo_file (write)))
+(allow hal_power_stats_server dumpstate (fd (use)))
+(allow hal_rebootescrow_server dumpstate (fifo_file (write)))
+(allow hal_rebootescrow_server dumpstate (fd (use)))
+(allow hal_secretkeeper_server dumpstate (fifo_file (write)))
+(allow hal_secretkeeper_server dumpstate (fd (use)))
+(allow hal_sensors_server dumpstate (fifo_file (write)))
+(allow hal_sensors_server dumpstate (fd (use)))
+(allow hal_thermal_server dumpstate (fifo_file (write)))
+(allow hal_thermal_server dumpstate (fd (use)))
+(allow hal_vehicle_server dumpstate (fifo_file (write)))
+(allow hal_vehicle_server dumpstate (fd (use)))
+(allow hal_vm_capabilities_server dumpstate (fifo_file (write)))
+(allow hal_vm_capabilities_server dumpstate (fd (use)))
+(allow hal_weaver_server dumpstate (fifo_file (write)))
+(allow hal_weaver_server dumpstate (fd (use)))
+(allow hal_wifi_server dumpstate (fifo_file (write)))
+(allow hal_wifi_server dumpstate (fd (use)))
+(allow dumpstate self (capability (sys_ptrace)))
+(allow dumpstate self (cap_userns (sys_ptrace)))
+(allow dumpstate shell_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow dumpstate shell_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow dumpstate shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate bluetooth_data_file (dir (search)))
+(allow dumpstate bluetooth_logs_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate bluetooth_logs_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate nfc_logs_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate nfc_logs_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate apex_module_data_file (dir (search)))
+(allow dumpstate apex_system_server_data_file (dir (search)))
+(allow dumpstate apex_uwb_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate apex_uwb_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow dumpstate gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow dumpstate logdr_socket (sock_file (write)))
+(allow dumpstate logd (unix_stream_socket (connectto)))
+(allow dumpstate logd_socket (sock_file (write)))
+(allow dumpstate logd (unix_stream_socket (connectto)))
+(allow dumpstate runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_qtaguid_ctrl (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_qtaguid_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_buddyinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_modules (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pagetypeinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_slabinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_vmallocinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_allocinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate net_data_file (dir (search)))
+(allow dumpstate net_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate self (netlink_tcpdiag_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read)))
+(allow dumpstate tombstone_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate tombstone_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate cache_recovery_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate cache_recovery_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate recovery_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate recovery_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate update_engine_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate update_engine_log_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate update_engine_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate update_engine_log_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate snapuserd_log_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate snapuserd_log_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate misc_logd_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate misc_logd_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate prereboot_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate prereboot_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate app_fuse_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate overlayfs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate base_typeattr_499 (service_manager (find)))
+(dontaudit dumpstate hal_service_type (service_manager (find)))
+(dontaudit dumpstate apex_service (service_manager (find)))
+(dontaudit dumpstate dumpstate_service (service_manager (find)))
+(dontaudit dumpstate gatekeeper_service (service_manager (find)))
+(dontaudit dumpstate virtual_touchpad_service (service_manager (find)))
+(dontaudit dumpstate vold_service (service_manager (find)))
+(dontaudit dumpstate fwk_vold_service (service_manager (find)))
+(dontaudit dumpstate hwservice_manager_type (hwservice_manager (find)))
+(allow dumpstate servicemanager (service_manager (list)))
+(allow dumpstate hwservicemanager (hwservice_manager (list)))
+(allow dumpstate devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow dumpstate property_type (file (read getattr map open)))
+(allow dumpstate media_rw_data_file (dir (getattr)))
+(allow dumpstate proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_zoneinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate dumpstate_service (service_manager (add find)))
+;;* lmx 499 system/sepolicy/private/dumpstate.te
+
+(neverallow base_typeattr_500 dumpstate_service (service_manager (add)))
+;;* lme
+
+(allow dumpstate ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pressure_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pressure_mem (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pressure_io (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate proc_pid_max (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate installd (binder (call transfer)))
+(allow installd dumpstate (binder (transfer)))
+(allow dumpstate installd (fd (use)))
+(allow dumpstate self (netlink_xfrm_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read)))
+(allow dumpstate self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow dumpstate self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow dumpstate domain (socket (getattr)))
+(allow dumpstate domain (tcp_socket (getattr)))
+(allow dumpstate domain (udp_socket (getattr)))
+(allow dumpstate domain (rawip_socket (getattr)))
+(allow dumpstate domain (netlink_socket (getattr)))
+(allow dumpstate domain (packet_socket (getattr)))
+(allow dumpstate domain (key_socket (getattr)))
+(allow dumpstate domain (unix_stream_socket (getattr)))
+(allow dumpstate domain (unix_dgram_socket (getattr)))
+(allow dumpstate domain (netlink_route_socket (getattr)))
+(allow dumpstate domain (netlink_tcpdiag_socket (getattr)))
+(allow dumpstate domain (netlink_nflog_socket (getattr)))
+(allow dumpstate domain (netlink_xfrm_socket (getattr)))
+(allow dumpstate domain (netlink_selinux_socket (getattr)))
+(allow dumpstate domain (netlink_audit_socket (getattr)))
+(allow dumpstate domain (netlink_dnrt_socket (getattr)))
+(allow dumpstate domain (netlink_kobject_uevent_socket (getattr)))
+(allow dumpstate domain (appletalk_socket (getattr)))
+(allow dumpstate domain (tun_socket (getattr)))
+(allow dumpstate domain (netlink_iscsi_socket (getattr)))
+(allow dumpstate domain (netlink_fib_lookup_socket (getattr)))
+(allow dumpstate domain (netlink_connector_socket (getattr)))
+(allow dumpstate domain (netlink_netfilter_socket (getattr)))
+(allow dumpstate domain (netlink_generic_socket (getattr)))
+(allow dumpstate domain (netlink_scsitransport_socket (getattr)))
+(allow dumpstate domain (netlink_rdma_socket (getattr)))
+(allow dumpstate domain (netlink_crypto_socket (getattr)))
+(allow dumpstate domain (sctp_socket (getattr)))
+(allow dumpstate domain (icmp_socket (getattr)))
+(allow dumpstate domain (ax25_socket (getattr)))
+(allow dumpstate domain (ipx_socket (getattr)))
+(allow dumpstate domain (netrom_socket (getattr)))
+(allow dumpstate domain (atmpvc_socket (getattr)))
+(allow dumpstate domain (x25_socket (getattr)))
+(allow dumpstate domain (rose_socket (getattr)))
+(allow dumpstate domain (decnet_socket (getattr)))
+(allow dumpstate domain (atmsvc_socket (getattr)))
+(allow dumpstate domain (rds_socket (getattr)))
+(allow dumpstate domain (irda_socket (getattr)))
+(allow dumpstate domain (pppox_socket (getattr)))
+(allow dumpstate domain (llc_socket (getattr)))
+(allow dumpstate domain (can_socket (getattr)))
+(allow dumpstate domain (tipc_socket (getattr)))
+(allow dumpstate domain (bluetooth_socket (getattr)))
+(allow dumpstate domain (iucv_socket (getattr)))
+(allow dumpstate domain (rxrpc_socket (getattr)))
+(allow dumpstate domain (isdn_socket (getattr)))
+(allow dumpstate domain (phonet_socket (getattr)))
+(allow dumpstate domain (ieee802154_socket (getattr)))
+(allow dumpstate domain (caif_socket (getattr)))
+(allow dumpstate domain (alg_socket (getattr)))
+(allow dumpstate domain (nfc_socket (getattr)))
+(allow dumpstate domain (vsock_socket (getattr)))
+(allow dumpstate domain (kcm_socket (getattr)))
+(allow dumpstate domain (qipcrtr_socket (getattr)))
+(allow dumpstate domain (smc_socket (getattr)))
+(allow dumpstate domain (xdp_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (tcp_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (udp_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (rawip_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (packet_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (key_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (unix_stream_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (unix_dgram_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_route_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_tcpdiag_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_nflog_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_xfrm_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_selinux_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_audit_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_dnrt_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_kobject_uevent_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (appletalk_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (tun_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_iscsi_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_fib_lookup_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_connector_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_netfilter_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_generic_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_scsitransport_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_rdma_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netlink_crypto_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (sctp_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (icmp_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (ax25_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (ipx_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (netrom_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (atmpvc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (x25_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (rose_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (decnet_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (atmsvc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (rds_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (irda_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (pppox_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (llc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (can_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (tipc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (bluetooth_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (iucv_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (rxrpc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (isdn_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (phonet_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (ieee802154_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (caif_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (alg_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (nfc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (vsock_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (kcm_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (qipcrtr_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (smc_socket (getattr)))
+(allow dumpstate pdx_endpoint_socket_type (xdp_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (tcp_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (udp_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (rawip_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (packet_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (key_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (unix_stream_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (unix_dgram_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_route_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_tcpdiag_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_nflog_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_xfrm_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_selinux_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_audit_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_dnrt_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_kobject_uevent_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (appletalk_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (tun_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_iscsi_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_fib_lookup_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_connector_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_netfilter_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_generic_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_scsitransport_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_rdma_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netlink_crypto_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (sctp_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (icmp_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (ax25_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (ipx_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (netrom_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (atmpvc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (x25_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (rose_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (decnet_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (atmsvc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (rds_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (irda_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (pppox_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (llc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (can_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (tipc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (bluetooth_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (iucv_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (rxrpc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (isdn_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (phonet_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (ieee802154_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (caif_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (alg_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (nfc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (vsock_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (kcm_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (qipcrtr_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (smc_socket (getattr)))
+(allow dumpstate pdx_channel_socket_type (xdp_socket (getattr)))
+(allow dumpstate linkerconfig_file (dir (read open)))
+(dontaudit dumpstate mnt_user_file (dir (search)))
+(dontaudit dumpstate mnt_vendor_file (dir (search)))
+(dontaudit dumpstate mnt_product_file (dir (search)))
+(dontaudit dumpstate mirror_data_file (dir (search)))
+(dontaudit dumpstate linkerconfig_file (dir (getattr)))
+(dontaudit dumpstate mnt_user_file (dir (getattr)))
+(dontaudit dumpstate apex_mnt_dir (dir (getattr)))
+(dontaudit dumpstate mirror_data_file (dir (getattr)))
+(dontaudit dumpstate vm_data_file (dir (getattr)))
+(dontaudit dumpstate virtualizationservice (binder (call)))
+(allow dumpstate bufferhubd (binder (call transfer)))
+(allow bufferhubd dumpstate (binder (transfer)))
+(allow dumpstate bufferhubd (fd (use)))
+(allow dumpstate mediaswcodec (binder (call transfer)))
+(allow mediaswcodec dumpstate (binder (transfer)))
+(allow dumpstate mediaswcodec (fd (use)))
+(allow dumpstate snapshotctl_log_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate snapshotctl_log_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate binderfs_logs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate binderfs_logs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate binderfs_logs_proc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate binderfs_logs_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate shutdown_checkpoints_system_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow dumpstate shutdown_checkpoints_system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 577 system/sepolicy/private/dumpstate.te
+
+(neverallow dumpstate base_typeattr_236 (process (ptrace)))
+;;* lme
+
+;;* lmx 586 system/sepolicy/private/dumpstate.te
+
+(neverallow base_typeattr_501 dumpstate_service (service_manager (find)))
+;;* lme
+
+;;* lmx 596 system/sepolicy/private/dumpstate.te
+
+(neverallow base_typeattr_502 apex_uwb_data_file (dir (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 604 system/sepolicy/private/dumpstate.te
+
+(neverallow base_typeattr_502 apex_uwb_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow e2fs devpts (chr_file (ioctl read write getattr)))
+(allow e2fs dev_type (blk_file (getattr)))
+(allow e2fs block_device (dir (search)))
+(allow e2fs userdata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow e2fs metadata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow e2fs dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow e2fs zoned_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow e2fs vold (fd (use)))
+(allow e2fs sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow e2fs sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx e2fs dm_device (ioctl blk_file (0x125e 0x1277 (range 0x127b 0x127d) (range 0x1282 0x1283))))
+(allowx e2fs userdata_block_device (ioctl blk_file (0x125e 0x1277 (range 0x127b 0x127d) (range 0x1282 0x1283))))
+(allowx e2fs zoned_block_device (ioctl blk_file (0x125e 0x1277 (range 0x127b 0x127d) (range 0x1282 0x1283))))
+(allowx e2fs metadata_block_device (ioctl blk_file (0x125e 0x1277 (range 0x127b 0x127d) (range 0x1282 0x1283))))
+(allow e2fs proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow e2fs proc_mounts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow e2fs proc_swaps (file (ioctl read getattr lock map open watch watch_reads)))
+(allow e2fs sysfs_fs_ext4_features (dir (search)))
+(allow e2fs sysfs_fs_ext4_features (file (ioctl read getattr lock map open watch watch_reads)))
+(allow e2fs file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow early_virtmgr system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow early_virtmgr vm_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow early_virtmgr vm_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow early_virtmgr vm_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow early_virtmgr adbd (fd (use)))
+(allow early_virtmgr adbd (unix_stream_socket (read write getattr)))
+(allow early_virtmgr devpts (chr_file (ioctl read write getattr)))
+(allow early_virtmgr servicemanager (binder (call transfer)))
+(allow servicemanager early_virtmgr (binder (call transfer)))
+(allow servicemanager early_virtmgr (dir (search)))
+(allow servicemanager early_virtmgr (file (read open)))
+(allow servicemanager early_virtmgr (process (getattr)))
+(allow early_virtmgr crosvm_exec (file (read getattr map execute open)))
+(allow early_virtmgr crosvm (process (transition)))
+(allow crosvm crosvm_exec (file (read getattr map execute open entrypoint)))
+(allow crosvm early_virtmgr (process (sigchld)))
+(dontaudit early_virtmgr crosvm (process (noatsecure)))
+(allow early_virtmgr crosvm (process (siginh rlimitinh)))
+(typetransition early_virtmgr crosvm_exec process crosvm)
+(allow early_virtmgr crosvm (process (sigkill)))
+(allow early_virtmgr apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr apex_data_file (dir (search)))
+(dontaudit early_virtmgr self (dir (write)))
+(allow early_virtmgr self (vsock_socket (read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+(allow early_virtmgr hypervisor_prop (file (read getattr map open)))
+(allow early_virtmgr hypervisor_pvmfw_prop (file (read getattr map open)))
+(allow early_virtmgr hypervisor_restricted_prop (file (read getattr map open)))
+(allow early_virtmgr hypervisor_virtualizationmanager_prop (file (read getattr map open)))
+(allow early_virtmgr proc_dt_avf (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow early_virtmgr proc_dt_avf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr proc_dt_avf (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr sysfs_dt_avf (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow early_virtmgr sysfs_dt_avf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr sysfs_dt_avf (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr crosvm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow early_virtmgr crosvm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr crosvm (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow early_virtmgr self (capability (net_bind_service ipc_lock sys_resource)))
+(allow early_virtmgr self (cap_userns (net_bind_service ipc_lock sys_resource)))
+(allow early_virtmgr kmsg_debug_device (chr_file (write lock append map open)))
+;;* lmx 1 system/sepolicy/private/early_virtmgr.te
+
+(neverallow base_typeattr_503 vm_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/early_virtmgr.te
+
+(neverallow base_typeattr_504 vm_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/early_virtmgr.te
+
+(neverallow base_typeattr_505 early_virtmgr (vsock_socket (create bind connect listen accept)))
+;;* lme
+
+(typetransition ephemeral_app tmpfs file appdomain_tmpfs)
+(allow ephemeral_app ephemeral_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su ephemeral_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 17 system/sepolicy/private/ephemeral_app.te
+
+(neverallow base_typeattr_506 ephemeral_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow ephemeral_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 17 system/sepolicy/private/ephemeral_app.te
+
+(neverallow base_typeattr_507 base_typeattr_506 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 17 system/sepolicy/private/ephemeral_app.te
+
+(neverallow base_typeattr_508 ephemeral_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 17 system/sepolicy/private/ephemeral_app.te
+
+(neverallow base_typeattr_509 ephemeral_app (process (ptrace)))
+;;* lme
+
+(allow ephemeral_app sdcard_type (file (ioctl read write getattr lock append)))
+(allow ephemeral_app fuse (file (ioctl read write getattr lock append)))
+(allow ephemeral_app media_rw_data_file (file (ioctl read write getattr lock append)))
+(allow ephemeral_app privapp_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow ephemeral_app app_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow ephemeral_app privapp_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow ephemeral_app rs_exec (file (read getattr map execute open)))
+(allow ephemeral_app rs (process (transition)))
+(allow rs rs_exec (file (read getattr map execute open entrypoint)))
+(allow rs ephemeral_app (process (sigchld)))
+(dontaudit ephemeral_app rs (process (noatsecure)))
+(allow ephemeral_app rs (process (siginh rlimitinh)))
+(typetransition ephemeral_app rs_exec process rs)
+(allow ephemeral_app app_exec_data_file (file (ioctl read getattr lock map unlink execute open watch watch_reads)))
+(allow ephemeral_app audioserver_service (service_manager (find)))
+(allow ephemeral_app cameraserver_service (service_manager (find)))
+(allow ephemeral_app mediaserver_service (service_manager (find)))
+(allow ephemeral_app mediaextractor_service (service_manager (find)))
+(allow ephemeral_app mediametrics_service (service_manager (find)))
+(allow ephemeral_app mediadrmserver_service (service_manager (find)))
+(allow ephemeral_app drmserver_service (service_manager (find)))
+(allow ephemeral_app radio_service (service_manager (find)))
+(allow ephemeral_app ephemeral_app_api_service (service_manager (find)))
+(allow ephemeral_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow ephemeral_app ashmem_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 59 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app app_data_file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 65 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app debugfs_type (file (read)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app gpu_device (chr_file (execute)))
+;;* lme
+
+;;* lmx 75 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app sysfs (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 79 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 82 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app sdcard_type (file (create open)))
+(neverallow ephemeral_app fuse (file (create open)))
+(neverallow ephemeral_app media_rw_data_file (file (create open)))
+;;* lme
+
+;;* lmx 83 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app sdcard_type (dir (search)))
+(neverallow ephemeral_app fuse (dir (search)))
+(neverallow ephemeral_app media_rw_data_file (dir (search)))
+;;* lme
+
+;;* lmx 87 system/sepolicy/private/ephemeral_app.te
+
+(neverallow ephemeral_app proc_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow init evsmanagerd_exec (file (read getattr map execute open)))
+(allow init evsmanagerd (process (transition)))
+(allow evsmanagerd evsmanagerd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init evsmanagerd (process (noatsecure)))
+(allow init evsmanagerd (process (siginh rlimitinh)))
+(typetransition init evsmanagerd_exec process evsmanagerd)
+(allow evsmanagerd evsmanagerd_service (service_manager (add find)))
+;;* lmx 13 system/sepolicy/private/evsmanagerd.te
+
+(neverallow base_typeattr_510 evsmanagerd_service (service_manager (add)))
+;;* lme
+
+(allow evsmanagerd servicemanager (binder (call transfer)))
+(allow servicemanager evsmanagerd (binder (call transfer)))
+(allow servicemanager evsmanagerd (dir (search)))
+(allow servicemanager evsmanagerd (file (read open)))
+(allow servicemanager evsmanagerd (process (getattr)))
+(allow evsmanagerd system_server (binder (call transfer)))
+(allow system_server evsmanagerd (binder (transfer)))
+(allow evsmanagerd system_server (fd (use)))
+(allow evsmanagerd shell (fd (use)))
+(allow evsmanagerd shell (fifo_file (write)))
+(allow evsmanagerd hal_graphics_allocator (fd (use)))
+(allow evsmanagerd statsbootstrap_service (service_manager (find)))
+(allow evsmanagerd appdomain (binder (call transfer)))
+(allow appdomain evsmanagerd (binder (transfer)))
+(allow evsmanagerd appdomain (fd (use)))
+(allow evsmanagerd hal_evs_hwservice (hwservice_manager (add)))
+(allow evsmanagerd hidl_base_hwservice (hwservice_manager (add)))
+(allow init extra_free_kbytes_exec (file (read getattr map execute open)))
+(allow init extra_free_kbytes (process (transition)))
+(allow extra_free_kbytes extra_free_kbytes_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init extra_free_kbytes (process (noatsecure)))
+(allow init extra_free_kbytes (process (siginh rlimitinh)))
+(typetransition init extra_free_kbytes_exec process extra_free_kbytes)
+(allow extra_free_kbytes property_socket (sock_file (write)))
+(allow extra_free_kbytes init (unix_stream_socket (connectto)))
+(allow extra_free_kbytes init_storage_prop (property_service (set)))
+(allow extra_free_kbytes init_storage_prop (file (read getattr map open)))
+(allow extra_free_kbytes shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow extra_free_kbytes system_file (file (getattr map execute execute_no_trans)))
+(allow extra_free_kbytes toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow extra_free_kbytes proc_extra_free_kbytes (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow extra_free_kbytes proc_watermark_scale_factor (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow extra_free_kbytes proc_zoneinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow fastbootd self (capability (ipc_lock)))
+(allow fastbootd fastbootd_iouring (anon_inode (read write create map)))
+(allow fastbootd self (io_uring (sqpoll)))
+;;* lmx 170 system/sepolicy/private/fastbootd.te
+
+(neverallow base_typeattr_511 fastbootd_iouring (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit fastbootd self (capability (ipc_lock)))
+(dontaudit fastbootd self (cap_userns (ipc_lock)))
+;;* lmx 180 system/sepolicy/private/fastbootd.te
+
+(neverallow fastbootd data_file_type (file (execute execute_no_trans)))
+;;* lme
+
+(allow fs_type self (filesystem (associate)))
+(allow cgroup tmpfs (filesystem (associate)))
+(allow cgroup_v2 tmpfs (filesystem (associate)))
+(allow cgroup_rc_file tmpfs (filesystem (associate)))
+(allow sysfs_type sysfs (filesystem (associate)))
+(allow debugfs_type debugfs (filesystem (associate)))
+(allow debugfs_type debugfs_tracing (filesystem (associate)))
+(allow debugfs_type debugfs_tracing_debug (filesystem (associate)))
+(allow file_type labeledfs (filesystem (associate)))
+(allow file_type tmpfs (filesystem (associate)))
+(allow file_type rootfs (filesystem (associate)))
+(allow dev_type tmpfs (filesystem (associate)))
+(allow app_fuse_file app_fusefs (filesystem (associate)))
+(allow postinstall_file self (filesystem (associate)))
+(allow proc_net proc (filesystem (associate)))
+;;* lmx 218 system/sepolicy/private/file.te
+
+(neverallow fs_type file_type (filesystem (associate)))
+;;* lme
+
+(allow init fingerprintd_exec (file (read getattr map execute open)))
+(allow init fingerprintd (process (transition)))
+(allow fingerprintd fingerprintd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init fingerprintd (process (noatsecure)))
+(allow init fingerprintd (process (siginh rlimitinh)))
+(typetransition init fingerprintd_exec process fingerprintd)
+(allow fingerprintd servicemanager (binder (call transfer)))
+(allow servicemanager fingerprintd (binder (call transfer)))
+(allow servicemanager fingerprintd (dir (search)))
+(allow servicemanager fingerprintd (file (read open)))
+(allow servicemanager fingerprintd (process (getattr)))
+(allow fingerprintd system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow fingerprintd fingerprintd_service (service_manager (add find)))
+;;* lmx 11 system/sepolicy/private/fingerprintd.te
+
+(neverallow base_typeattr_512 fingerprintd_service (service_manager (add)))
+;;* lme
+
+(allow fingerprintd fingerprintd_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow fingerprintd fingerprintd_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow keystore fingerprintd (dir (search)))
+(allow keystore fingerprintd (file (read open)))
+(allow keystore fingerprintd (process (getattr)))
+(allow fingerprintd apc_service (service_manager (find)))
+(allow fingerprintd keystore_service (service_manager (find)))
+(allow fingerprintd legacykeystore_service (service_manager (find)))
+(allow fingerprintd keystore (binder (call transfer)))
+(allow keystore fingerprintd (binder (transfer)))
+(allow fingerprintd keystore (fd (use)))
+(allow keystore fingerprintd (binder (call transfer)))
+(allow fingerprintd keystore (binder (transfer)))
+(allow keystore fingerprintd (fd (use)))
+(allow fingerprintd keystore (keystore2 (add_auth)))
+(allow fingerprintd system_server (binder (call transfer)))
+(allow system_server fingerprintd (binder (transfer)))
+(allow fingerprintd system_server (fd (use)))
+(allow fingerprintd permission_service (service_manager (find)))
+(allow fingerprintd ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init flags_health_check_exec (file (read getattr map execute open)))
+(allow init flags_health_check (process (transition)))
+(allow flags_health_check flags_health_check_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init flags_health_check (process (noatsecure)))
+(allow init flags_health_check (process (siginh rlimitinh)))
+(typetransition init flags_health_check_exec process flags_health_check)
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_boot_count_prop (property_service (set)))
+(allow flags_health_check device_config_boot_count_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_core_experiments_team_internal_prop (property_service (set)))
+(allow flags_health_check device_config_core_experiments_team_internal_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_edgetpu_native_prop (property_service (set)))
+(allow flags_health_check device_config_edgetpu_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_reset_performed_prop (property_service (set)))
+(allow flags_health_check device_config_reset_performed_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_runtime_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_runtime_native_prop (property_service (set)))
+(allow flags_health_check device_config_runtime_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_input_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_input_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_lmkd_native_prop (property_service (set)))
+(allow flags_health_check device_config_lmkd_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_netd_native_prop (property_service (set)))
+(allow flags_health_check device_config_netd_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_nnapi_native_prop (property_service (set)))
+(allow flags_health_check device_config_nnapi_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_activity_manager_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_activity_manager_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_media_native_prop (property_service (set)))
+(allow flags_health_check device_config_media_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_mglru_native_prop (property_service (set)))
+(allow flags_health_check device_config_mglru_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_profcollect_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_profcollect_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_statsd_native_prop (property_service (set)))
+(allow flags_health_check device_config_statsd_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_statsd_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_statsd_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_storage_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_storage_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_swcodec_native_prop (property_service (set)))
+(allow flags_health_check device_config_swcodec_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_sys_traced_prop (property_service (set)))
+(allow flags_health_check device_config_sys_traced_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_window_manager_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_window_manager_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_configuration_prop (property_service (set)))
+(allow flags_health_check device_config_configuration_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_connectivity_prop (property_service (set)))
+(allow flags_health_check device_config_connectivity_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_surface_flinger_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_surface_flinger_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_aconfig_flags_prop (property_service (set)))
+(allow flags_health_check device_config_aconfig_flags_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_vendor_system_native_prop (property_service (set)))
+(allow flags_health_check device_config_vendor_system_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_vendor_system_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_vendor_system_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_virtualization_framework_native_prop (property_service (set)))
+(allow flags_health_check device_config_virtualization_framework_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_memory_safety_native_boot_prop (property_service (set)))
+(allow flags_health_check device_config_memory_safety_native_boot_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_memory_safety_native_prop (property_service (set)))
+(allow flags_health_check device_config_memory_safety_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_remote_key_provisioning_native_prop (property_service (set)))
+(allow flags_health_check device_config_remote_key_provisioning_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_camera_native_prop (property_service (set)))
+(allow flags_health_check device_config_camera_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_tethering_u_or_later_native_prop (property_service (set)))
+(allow flags_health_check device_config_tethering_u_or_later_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check device_config_mmd_native_prop (property_service (set)))
+(allow flags_health_check device_config_mmd_native_prop (file (read getattr map open)))
+(allow flags_health_check property_socket (sock_file (write)))
+(allow flags_health_check init (unix_stream_socket (connectto)))
+(allow flags_health_check next_boot_prop (property_service (set)))
+(allow flags_health_check next_boot_prop (file (read getattr map open)))
+(allow flags_health_check server_configurable_flags_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow flags_health_check server_configurable_flags_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lmx 50 system/sepolicy/private/flags_health_check.te
+
+(neverallow base_typeattr_513 server_configurable_flags_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 56 system/sepolicy/private/flags_health_check.te
+
+(neverallow base_typeattr_513 device_config_boot_count_prop (property_service (set)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/flags_health_check.te
+
+(neverallow base_typeattr_513 device_config_reset_performed_prop (property_service (set)))
+;;* lme
+
+(allow init fsck_exec (file (read getattr map execute open)))
+(allow init fsck (process (transition)))
+(allow fsck fsck_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init fsck (process (noatsecure)))
+(allow init fsck (process (siginh rlimitinh)))
+(typetransition init fsck_exec process fsck)
+(allow fsck system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow fsck system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow fsck metadata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck tmpfs (chr_file (ioctl read write)))
+(allow fsck devpts (chr_file (ioctl read write getattr)))
+(allow fsck vold (fd (use)))
+(allow fsck vold (fifo_file (read write getattr)))
+(allow fsck userdata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck cache_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck zoned_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck metadata_file (dir (getattr)))
+(allow fsck block_device (dir (search)))
+(allow fsck mirror_data_file (dir (search)))
+(allowx fsck dev_type (ioctl blk_file (0x125e 0x127c 0x1282)))
+(allow fsck dev_type (blk_file (getattr)))
+(allow fsck proc_mounts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow fsck proc_swaps (file (ioctl read getattr lock map open watch watch_reads)))
+(allow fsck sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow fsck rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow fsck sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+;;* lmx 77 system/sepolicy/private/fsck.te
+
+(neverallow fsck vold_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck root_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck system_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck recovery_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck boot_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck swap_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 80 system/sepolicy/private/fsck.te
+
+(neverallow base_typeattr_514 fsck (process (transition)))
+;;* lme
+
+;;* lmx 81 system/sepolicy/private/fsck.te
+
+(neverallow base_typeattr_236 fsck (process (dyntransition)))
+;;* lme
+
+;;* lmx 82 system/sepolicy/private/fsck.te
+
+(neverallow fsck base_typeattr_515 (file (entrypoint)))
+;;* lme
+
+(allow fsck system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow fsck system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow fsck_untrusted devpts (chr_file (ioctl read write getattr)))
+(allow fsck_untrusted vold (fd (use)))
+(allow fsck_untrusted vold (fifo_file (read write getattr)))
+(allow fsck_untrusted block_device (dir (search)))
+(allow fsck_untrusted vold_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fsck_untrusted proc_mounts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow fsck_untrusted dev_type (blk_file (getattr)))
+;;* lmx 45 system/sepolicy/private/fsck_untrusted.te
+
+(neverallow fsck_untrusted dm_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted root_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted system_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted recovery_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted boot_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted userdata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted cache_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted swap_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fsck_untrusted metadata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/fsck_untrusted.te
+
+(neverallow base_typeattr_296 fsck_untrusted (process (transition)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/fsck_untrusted.te
+
+(neverallow base_typeattr_236 fsck_untrusted (process (dyntransition)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/fsck_untrusted.te
+
+(neverallow fsck_untrusted base_typeattr_515 (file (entrypoint)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/private/fsck_untrusted.te
+
+(neverallow fsck_untrusted self (capability (setgid setuid sys_admin)))
+(neverallow fsck_untrusted self (cap_userns (setgid setuid sys_admin)))
+;;* lme
+
+(dontaudit fsck_untrusted sysfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit fsck_untrusted sysfs_dm (file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit fsck_untrusted sysfs_dm (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(dontaudit fsck_untrusted tmpfs (lnk_file (read)))
+(allow fuseblkd self (capability (sys_admin)))
+(allow fuseblkd self (cap_userns (sys_admin)))
+(allow fuseblkd fuse_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow fuseblkd fuseblk (filesystem (mount unmount)))
+(allow fuseblkd fuseblkd_untrusted (fd (use)))
+(allow fuseblkd block_device (dir (search)))
+(allow fuseblkd mnt_media_rw_file (dir (search)))
+(allow fuseblkd mnt_media_rw_stub_file (dir (mounton)))
+;;* lmx 30 system/sepolicy/private/fuseblkd.te
+
+(neverallow base_typeattr_516 fuseblkd (process (transition)))
+;;* lme
+
+;;* lmx 31 system/sepolicy/private/fuseblkd.te
+
+(neverallow base_typeattr_236 fuseblkd (process (dyntransition)))
+;;* lme
+
+;;* lmx 32 system/sepolicy/private/fuseblkd.te
+
+(neverallow fuseblkd base_typeattr_517 (file (entrypoint)))
+;;* lme
+
+(allow fuseblkd_untrusted fuseblkd_exec (file (read getattr map execute open)))
+(allow fuseblkd_untrusted fuseblkd (process (transition)))
+(allow fuseblkd fuseblkd_exec (file (read getattr map execute open entrypoint)))
+(allow fuseblkd fuseblkd_untrusted (process (sigchld)))
+(dontaudit fuseblkd_untrusted fuseblkd (process (noatsecure)))
+(allow fuseblkd_untrusted fuseblkd (process (siginh rlimitinh)))
+(typetransition fuseblkd_untrusted fuseblkd_exec process fuseblkd)
+(allow fuseblkd_untrusted vold (fd (use)))
+(allow fuseblkd_untrusted block_device (dir (search)))
+(allow fuseblkd_untrusted super_block_device (blk_file (getattr)))
+(allow fuseblkd_untrusted fuse_device (chr_file (read write getattr open)))
+(allow fuseblkd_untrusted mnt_media_rw_file (dir (getattr search)))
+(allow fuseblkd_untrusted mnt_media_rw_stub_file (dir (getattr)))
+(allow fuseblkd_untrusted sysfs_dm (dir (search)))
+(allow fuseblkd_untrusted sysfs_dm (file (read getattr open)))
+(allow fuseblkd_untrusted dm_device (blk_file (getattr)))
+(allow fuseblkd_untrusted tmpfs (lnk_file (read)))
+(allow fuseblkd_untrusted loop_device (blk_file (getattr)))
+(allow fuseblkd_untrusted proc_filesystems (file (read getattr open)))
+(dontaudit fuseblkd_untrusted self (capability (sys_admin)))
+;;* lmx 65 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow fuseblkd_untrusted dm_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted root_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted system_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted recovery_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted boot_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted userdata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted cache_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted swap_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow fuseblkd_untrusted metadata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow base_typeattr_296 fuseblkd_untrusted (process (transition)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow base_typeattr_236 fuseblkd_untrusted (process (dyntransition)))
+;;* lme
+
+;;* lmx 70 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow fuseblkd_untrusted base_typeattr_518 (file (entrypoint)))
+;;* lme
+
+;;* lmx 77 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow fuseblkd_untrusted self (capability (setgid setuid sys_admin)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow fuseblkd_untrusted self (capability (setgid setuid sys_admin)))
+(neverallow fuseblkd_untrusted self (cap_userns (setgid setuid sys_admin)))
+;;* lme
+
+;;* lmx 82 system/sepolicy/private/fuseblkd_untrusted.te
+
+(neverallow fuseblkd_untrusted fuseblk (filesystem (mount unmount relabelfrom relabelto)))
+;;* lme
+
+(allow fwk_bufferhub ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init fwk_bufferhub_exec (file (read getattr map execute open)))
+(allow init fwk_bufferhub (process (transition)))
+(allow fwk_bufferhub fwk_bufferhub_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init fwk_bufferhub (process (noatsecure)))
+(allow init fwk_bufferhub (process (siginh rlimitinh)))
+(typetransition init fwk_bufferhub_exec process fwk_bufferhub)
+(allow init gatekeeperd_exec (file (read getattr map execute open)))
+(allow init gatekeeperd (process (transition)))
+(allow gatekeeperd gatekeeperd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init gatekeeperd (process (noatsecure)))
+(allow init gatekeeperd (process (siginh rlimitinh)))
+(typetransition init gatekeeperd_exec process gatekeeperd)
+(allow gatekeeperd gsid_prop (file (read getattr map open)))
+(allow gatekeeperd servicemanager (binder (call transfer)))
+(allow servicemanager gatekeeperd (binder (call transfer)))
+(allow servicemanager gatekeeperd (dir (search)))
+(allow servicemanager gatekeeperd (file (read open)))
+(allow servicemanager gatekeeperd (process (getattr)))
+(allow gatekeeperd ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gatekeeperd system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gatekeeperd gatekeeper_service (service_manager (add find)))
+;;* lmx 25 system/sepolicy/private/gatekeeperd.te
+
+(neverallow base_typeattr_519 gatekeeper_service (service_manager (add)))
+;;* lme
+
+(allow keystore gatekeeperd (dir (search)))
+(allow keystore gatekeeperd (file (read open)))
+(allow keystore gatekeeperd (process (getattr)))
+(allow gatekeeperd apc_service (service_manager (find)))
+(allow gatekeeperd keystore_service (service_manager (find)))
+(allow gatekeeperd legacykeystore_service (service_manager (find)))
+(allow gatekeeperd keystore (binder (call transfer)))
+(allow keystore gatekeeperd (binder (transfer)))
+(allow gatekeeperd keystore (fd (use)))
+(allow keystore gatekeeperd (binder (call transfer)))
+(allow gatekeeperd keystore (binder (transfer)))
+(allow keystore gatekeeperd (fd (use)))
+(allow gatekeeperd keystore (keystore2 (add_auth)))
+(allow gatekeeperd authorization_service (service_manager (find)))
+(allow gatekeeperd system_server (binder (call)))
+(allow gatekeeperd permission_service (service_manager (find)))
+(allow gatekeeperd gatekeeper_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow gatekeeperd gatekeeper_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gatekeeperd hardware_properties_service (service_manager (find)))
+(allow gatekeeperd cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gatekeeperd cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gatekeeperd cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gatekeeperd cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gatekeeperd cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gatekeeperd cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gki_apex_prepostinstall shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow gki_apex_prepostinstall toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow gki_apex_prepostinstall gki_apex_prepostinstall_exec (file (execute_no_trans)))
+(allow gki_apex_prepostinstall servicemanager (binder (call transfer)))
+(allow servicemanager gki_apex_prepostinstall (binder (call transfer)))
+(allow servicemanager gki_apex_prepostinstall (dir (search)))
+(allow servicemanager gki_apex_prepostinstall (file (read open)))
+(allow servicemanager gki_apex_prepostinstall (process (getattr)))
+(allow gki_apex_prepostinstall update_engine_stable_service (service_manager (find)))
+(allow gki_apex_prepostinstall update_engine (binder (call transfer)))
+(allow update_engine gki_apex_prepostinstall (binder (transfer)))
+(allow gki_apex_prepostinstall update_engine (fd (use)))
+(allow gki_apex_prepostinstall apexd (fd (use)))
+(typetransition gmscore_app tmpfs file appdomain_tmpfs)
+(allow gmscore_app gmscore_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su gmscore_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/gmscore_app.te
+
+(neverallow base_typeattr_520 gmscore_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow gmscore_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/gmscore_app.te
+
+(neverallow base_typeattr_521 base_typeattr_520 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/gmscore_app.te
+
+(neverallow base_typeattr_522 gmscore_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/gmscore_app.te
+
+(neverallow base_typeattr_523 gmscore_app (process (ptrace)))
+;;* lme
+
+(allow gmscore_app sysfs_type (dir (search)))
+(allow gmscore_app sysfs_zram (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gmscore_app sysfs_zram (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app sysfs_zram (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gmscore_app rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app config_gz (file (read getattr open)))
+(allow gmscore_app update_engine (binder (call transfer)))
+(allow update_engine gmscore_app (binder (transfer)))
+(allow gmscore_app update_engine (fd (use)))
+(allow gmscore_app update_engine_service (service_manager (find)))
+(allow gmscore_app storaged (binder (call transfer)))
+(allow storaged gmscore_app (binder (transfer)))
+(allow gmscore_app storaged (fd (use)))
+(allow gmscore_app storaged_service (service_manager (find)))
+(allow gmscore_app system_update_service (service_manager (find)))
+(allow gmscore_app statsd (binder (call transfer)))
+(allow statsd gmscore_app (binder (transfer)))
+(allow gmscore_app statsd (fd (use)))
+(allow gmscore_app perfetto (fd (use)))
+(allow gmscore_app perfetto_traces_data_file (file (read getattr)))
+(allow gmscore_app keystore (keystore2_key (gen_unique_id)))
+(allow gmscore_app selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app exec_type (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app device (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit gmscore_app fs_bpf (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit gmscore_app kernel (security (compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot read_policy validate_trans)))
+(dontaudit gmscore_app net_dns_prop (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc_modules (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc_net (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit gmscore_app sysfs (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs_android_usb (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs_loop (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs_net (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app sysfs_net (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit gmscore_app wifi_hal_prop (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app wifi_prop (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit gmscore_app mirror_data_file (dir (search)))
+(dontaudit gmscore_app mnt_vendor_file (dir (search)))
+(allow gmscore_app self (process (ptrace)))
+(allow gmscore_app privapp_data_file (file (execute)))
+(allow gmscore_app system_linker_exec (file (execute_no_trans)))
+(allow gmscore_app privapp_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gmscore_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app gpuservice (binder (call transfer)))
+(allow gpuservice gmscore_app (binder (transfer)))
+(allow gmscore_app gpuservice (fd (use)))
+(allow gmscore_app gpu_service (service_manager (find)))
+(allow gmscore_app app_api_service (service_manager (find)))
+(allow gmscore_app system_api_service (service_manager (find)))
+(allow gmscore_app audioserver_service (service_manager (find)))
+(allow gmscore_app cameraserver_service (service_manager (find)))
+(allow gmscore_app drmserver_service (service_manager (find)))
+(allow gmscore_app mediadrmserver_service (service_manager (find)))
+(allow gmscore_app mediaextractor_service (service_manager (find)))
+(allow gmscore_app mediametrics_service (service_manager (find)))
+(allow gmscore_app mediaserver_service (service_manager (find)))
+(allow gmscore_app network_watchlist_service (service_manager (find)))
+(allow gmscore_app nfc_service (service_manager (find)))
+(allow gmscore_app oem_lock_service (service_manager (find)))
+(allow gmscore_app persistent_data_block_service (service_manager (find)))
+(allow gmscore_app radio_service (service_manager (find)))
+(allow gmscore_app recovery_service (service_manager (find)))
+(allow gmscore_app stats_service (service_manager (find)))
+(allow gmscore_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gmscore_app cache_recovery_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gmscore_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gmscore_app cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gmscore_app cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app ota_package_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gmscore_app ota_package_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gmscore_app checkin_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow gmscore_app checkin_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gmscore_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gmscore_app aconfigd_socket (sock_file (write)))
+(allow gmscore_app aconfigd (unix_stream_socket (connectto)))
+(allow gmscore_app aconfigd_mainline_socket (sock_file (write)))
+(allow gmscore_app aconfigd_mainline (unix_stream_socket (connectto)))
+(allow gmscore_app anr_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gmscore_app priv_app (tcp_socket (read write)))
+(allow gmscore_app virtual_ab_prop (file (read getattr map open)))
+(allow gmscore_app dck_prop (file (read getattr map open)))
+(allow gmscore_app remote_prov_prop (file (read getattr map open)))
+(allow gmscore_app quick_start_prop (file (read getattr map open)))
+;;* lmx 159 system/sepolicy/private/gmscore_app.te
+
+(neverallow base_typeattr_524 quick_start_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow gmscore_app bluetooth_finder_prop (file (read getattr map open)))
+;;* lmx 165 system/sepolicy/private/gmscore_app.te
+
+(neverallow gmscore_app sysfs_net (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 169 system/sepolicy/private/gmscore_app.te
+
+(neverallowx gmscore_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx gmscore_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx gmscore_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx gmscore_app domain (ioctl icmp_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 169 system/sepolicy/private/gmscore_app.te
+
+(neverallowx gmscore_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx gmscore_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx gmscore_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx gmscore_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 169 system/sepolicy/private/gmscore_app.te
+
+(neverallowx gmscore_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx gmscore_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx gmscore_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx gmscore_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+;;* lmx 170 system/sepolicy/private/gmscore_app.te
+
+(neverallow gmscore_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow gmscore_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+;;* lme
+
+;;* lmx 183 system/sepolicy/private/gmscore_app.te
+
+(neverallow gmscore_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow gmscore_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow gmscore_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow gmscore_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow gmscore_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow gmscore_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow gmscore_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+(allow init gpuservice_exec (file (read getattr map execute open)))
+(allow init gpuservice (process (transition)))
+(allow gpuservice gpuservice_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init gpuservice (process (noatsecure)))
+(allow init gpuservice (process (siginh rlimitinh)))
+(typetransition init gpuservice_exec process gpuservice)
+(allow gpuservice adbd (binder (call transfer)))
+(allow adbd gpuservice (binder (transfer)))
+(allow gpuservice adbd (fd (use)))
+(allow gpuservice shell (binder (call transfer)))
+(allow shell gpuservice (binder (transfer)))
+(allow gpuservice shell (fd (use)))
+(allow gpuservice system_server (binder (call transfer)))
+(allow system_server gpuservice (binder (transfer)))
+(allow gpuservice system_server (fd (use)))
+(allow gpuservice servicemanager (binder (call transfer)))
+(allow servicemanager gpuservice (binder (call transfer)))
+(allow servicemanager gpuservice (dir (search)))
+(allow servicemanager gpuservice (file (read open)))
+(allow servicemanager gpuservice (process (getattr)))
+(allow gpuservice gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow gpuservice same_process_hal_file (file (read getattr map execute open)))
+(allow gpuservice ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gpuservice hwservicemanager_prop (file (read getattr map open)))
+(allow gpuservice hwservicemanager (binder (call transfer)))
+(allow hwservicemanager gpuservice (binder (call transfer)))
+(allow hwservicemanager gpuservice (dir (search)))
+(allow hwservicemanager gpuservice (file (read map open)))
+(allow hwservicemanager gpuservice (process (getattr)))
+(allow gpuservice graphics_device (dir (search)))
+(allow gpuservice graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow gpuservice adbd (fd (use)))
+(allow gpuservice adbd (unix_stream_socket (read write getattr)))
+(allow gpuservice shell (fifo_file (read write getattr)))
+(allow gpuservice traced (fd (use)))
+(allow gpuservice traced_tmpfs (file (read write getattr map)))
+(allow gpuservice traced_producer_socket (sock_file (write)))
+(allow gpuservice traced (unix_stream_socket (connectto)))
+(allow traced gpuservice (fd (use)))
+(allow gpuservice devpts (chr_file (read write getattr)))
+(allow gpuservice dumpstate (fd (use)))
+(allow gpuservice dumpstate (fifo_file (write)))
+(allow gpuservice stats_service (service_manager (find)))
+(allow gpuservice statsmanager_service (service_manager (find)))
+(allow gpuservice statsd (binder (call transfer)))
+(allow statsd gpuservice (binder (transfer)))
+(allow gpuservice statsd (fd (use)))
+(allow gpuservice debugfs_tracing (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gpuservice self (perf_event (open cpu kernel write)))
+;;* lmx 52 system/sepolicy/private/gpuservice.te
+
+(neverallow gpuservice self (perf_event (tracepoint read)))
+;;* lme
+
+(allow gpuservice fs_bpf (file (read write)))
+(allow gpuservice bpfloader (bpf (map_read map_write prog_run)))
+(allow gpuservice gpu_service (service_manager (add find)))
+;;* lmx 61 system/sepolicy/private/gpuservice.te
+
+(neverallow base_typeattr_525 gpu_service (service_manager (add)))
+;;* lme
+
+(allow gpuservice property_socket (sock_file (write)))
+(allow gpuservice init (unix_stream_socket (connectto)))
+(allow gpuservice graphics_config_writable_prop (property_service (set)))
+(allow gpuservice graphics_config_writable_prop (file (read getattr map open)))
+;;* lmx 66 system/sepolicy/private/gpuservice.te
+
+(neverallow base_typeattr_526 graphics_config_writable_prop (property_service (set)))
+;;* lme
+
+(allow gpuservice permission_service (service_manager (find)))
+(allow init gsid_exec (file (read getattr map execute open)))
+(allow init gsid (process (transition)))
+(allow gsid gsid_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init gsid (process (noatsecure)))
+(allow init gsid (process (siginh rlimitinh)))
+(typetransition init gsid_exec process gsid)
+(allow gsid servicemanager (binder (call transfer)))
+(allow servicemanager gsid (binder (call transfer)))
+(allow servicemanager gsid (dir (search)))
+(allow servicemanager gsid (file (read open)))
+(allow servicemanager gsid (process (getattr)))
+(allow gsid gsi_service (service_manager (add find)))
+;;* lmx 11 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_527 gsi_service (service_manager (add)))
+;;* lme
+
+(allow gsid vold_service (service_manager (find)))
+(allow gsid vold (binder (call transfer)))
+(allow vold gsid (binder (transfer)))
+(allow gsid vold (fd (use)))
+(allow gsid property_socket (sock_file (write)))
+(allow gsid init (unix_stream_socket (connectto)))
+(allow gsid gsid_prop (property_service (set)))
+(allow gsid gsid_prop (file (read getattr map open)))
+(allow gsid dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow gsid dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow gsid self (capability (sys_admin)))
+(allow gsid self (cap_userns (sys_admin)))
+(dontaudit gsid self (capability (dac_override)))
+(dontaudit gsid self (cap_userns (dac_override)))
+(allow gsid loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow gsid loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx gsid loop_device (ioctl blk_file (0x1261)))
+(allowx gsid loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) (range 0x4c08 0x4c09))))
+(allow gsid sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid sysfs_dm (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid sysfs_fs_f2fs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid sysfs_fs_f2fs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid gsi_metadata_file_type (dir (search)))
+(allow gsid metadata_file (dir (search)))
+(allow gsid gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid super_block_device_type (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allowx gsid super_block_device_type (ioctl blk_file (0x1278 0x127a)))
+(allowx gsid userdata_block_device (ioctl blk_file (0x1278 0x127a)))
+(allowx gsid sdcard_block_device (ioctl blk_file (0x1278 0x127a)))
+(allow gsid mnt_media_rw_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid mnt_media_rw_stub_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow gsid vfat (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gsid vfat (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gsid sdcard_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid self (capability (sys_rawio)))
+(allow gsid self (cap_userns (sys_rawio)))
+;;* lmx 104 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_528 gsid_prop (property_service (set)))
+;;* lme
+
+(allow gsid userdata_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid metadata_file (dir (getattr search)))
+(allow gsid gsi_metadata_file_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gsid ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow gsid gsi_metadata_file_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gsid ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gsid file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow gsid gsi_metadata_file (file (relabelfrom)))
+(allow gsid gsi_public_metadata_file (file (relabelto)))
+(allow gsid gsi_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gsid ota_image_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow gsid gsi_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow gsid ota_image_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allowx gsid gsi_data_file (ioctl file (0x6601 0x660b)))
+(allowx gsid ota_image_data_file (ioctl file (0x6601 0x660b)))
+(allow gsid system_server (binder (call)))
+;;* lmx 176 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_529 gsi_metadata_file_type (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 183 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_529 base_typeattr_530 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_529 base_typeattr_530 (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_529 base_typeattr_530 (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_529 base_typeattr_530 (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_529 base_typeattr_530 (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_529 base_typeattr_530 (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 190 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_529 gsi_public_metadata_file (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow base_typeattr_529 gsi_public_metadata_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow base_typeattr_529 gsi_public_metadata_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow base_typeattr_529 gsi_public_metadata_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow base_typeattr_529 gsi_public_metadata_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow base_typeattr_529 gsi_public_metadata_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+;;* lme
+
+;;* lmx 196 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_262 gsi_metadata_file_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_262 gsi_metadata_file_type (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 202 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_531 gsi_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_531 gsi_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow base_typeattr_531 gsi_data_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_531 gsi_data_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_531 gsi_data_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_531 gsi_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_531 gsi_data_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 207 system/sepolicy/private/gsid.te
+
+(neverallow base_typeattr_527 gsi_data_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_527 gsi_data_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_527 gsi_data_file (chr_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_527 gsi_data_file (blk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_527 gsi_data_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_527 gsi_data_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow hal_allocator_client hal_allocator_server (binder (call transfer)))
+(allow hal_allocator_server hal_allocator_client (binder (transfer)))
+(allow hal_allocator_client hal_allocator_server (fd (use)))
+(allow hal_allocator_client hidl_allocator_hwservice (hwservice_manager (find)))
+(allow hal_allocator_server hidl_allocator_hwservice (hwservice_manager (add find)))
+(allow hal_allocator_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_allocator.te
+
+(neverallow base_typeattr_532 hidl_allocator_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_allocator.te
+
+(neverallow base_typeattr_533 hidl_allocator_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_allocator_client hidl_memory_hwservice (hwservice_manager (find)))
+(allow hal_allocator_client same_process_hal_file (file (read getattr map execute open)))
+(allow init hal_allocator_default_exec (file (read getattr map execute open)))
+(allow init hal_allocator_default (process (transition)))
+(allow hal_allocator_default hal_allocator_default_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init hal_allocator_default (process (noatsecure)))
+(allow init hal_allocator_default (process (siginh rlimitinh)))
+(typetransition init hal_allocator_default_exec process hal_allocator_default)
+(allow hal_allocator_default property_socket (sock_file (write)))
+(allow hal_allocator_default init (unix_stream_socket (connectto)))
+(allow hal_allocator_default hidl_memory_prop (property_service (set)))
+(allow hal_allocator_default hidl_memory_prop (file (read getattr map open)))
+(allow hal_atrace_client hal_atrace_server (binder (call transfer)))
+(allow hal_atrace_server hal_atrace_client (binder (transfer)))
+(allow hal_atrace_client hal_atrace_server (fd (use)))
+(allow hal_atrace_client hal_atrace_hwservice (hwservice_manager (find)))
+(allow hal_atrace_server hal_atrace_hwservice (hwservice_manager (add find)))
+(allow hal_atrace_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_atrace.te
+
+(neverallow base_typeattr_534 hal_atrace_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_atrace.te
+
+(neverallow base_typeattr_535 hal_atrace_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_audio_client hal_audio_server (binder (call transfer)))
+(allow hal_audio_server hal_audio_client (binder (transfer)))
+(allow hal_audio_client hal_audio_server (fd (use)))
+(allow hal_audio_server hal_audio_client (binder (call transfer)))
+(allow hal_audio_client hal_audio_server (binder (transfer)))
+(allow hal_audio_server hal_audio_client (fd (use)))
+(allow hal_audio_client hal_audio_hwservice (hwservice_manager (find)))
+(allow hal_audio_server hal_audio_hwservice (hwservice_manager (add find)))
+(allow hal_audio_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_audio.te
+
+(neverallow base_typeattr_536 hal_audio_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_audio.te
+
+(neverallow base_typeattr_537 hal_audio_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_audio_client hal_audio_service (service_manager (find)))
+(allow hal_audio_server hal_audio_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_audio.te
+
+(neverallow base_typeattr_536 hal_audio_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_audio.te
+
+(neverallow base_typeattr_538 hal_audio_service (service_manager (find)))
+;;* lme
+
+(allow hal_audio ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_audio_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_audio_server (binder (transfer)))
+(allow hal_audio_server servicemanager (fd (use)))
+(allow hal_audio proc (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_audio proc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_audio proc (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_audio proc_asound (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_audio proc_asound (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_audio proc_asound (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_audio_server audio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_audio_server audio_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_audio shell (fd (use)))
+(allow hal_audio shell (fifo_file (write)))
+(allow hal_audio dumpstate (fd (use)))
+(allow hal_audio dumpstate (fifo_file (write)))
+(allow hal_audio_server appdomain (fd (use)))
+(allow hal_audio_server system_server_tmpfs (file (read getattr map)))
+(allow hal_audio_server self (capability (sys_nice)))
+(allow hal_audio_server self (cap_userns (sys_nice)))
+(allow hal_audio vndbinder_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_audio vndservicemanager (binder (call transfer)))
+(allow vndservicemanager hal_audio (dir (search)))
+(allow vndservicemanager hal_audio (file (read map open)))
+(allow vndservicemanager hal_audio (process (getattr)))
+;;* lmx 39 system/sepolicy/private/hal_audio.te
+
+(neverallow hal_audio_server fs_type (file (execute_no_trans)))
+(neverallow hal_audio_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/hal_audio.te
+
+(neverallow base_typeattr_539 audio_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow hal_audio audio_config_prop (file (read getattr map open)))
+(allow hal_audio bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow hal_audio bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow hal_audiocontrol_client hal_audiocontrol_server (binder (call transfer)))
+(allow hal_audiocontrol_server hal_audiocontrol_client (binder (transfer)))
+(allow hal_audiocontrol_client hal_audiocontrol_server (fd (use)))
+(allow hal_audiocontrol_server hal_audiocontrol_client (binder (call transfer)))
+(allow hal_audiocontrol_client hal_audiocontrol_server (binder (transfer)))
+(allow hal_audiocontrol_server hal_audiocontrol_client (fd (use)))
+(allow hal_audiocontrol_client hal_audiocontrol_hwservice (hwservice_manager (find)))
+(allow hal_audiocontrol_server hal_audiocontrol_hwservice (hwservice_manager (add find)))
+(allow hal_audiocontrol_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_audiocontrol.te
+
+(neverallow base_typeattr_540 hal_audiocontrol_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_audiocontrol.te
+
+(neverallow base_typeattr_541 hal_audiocontrol_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_audiocontrol_client hal_audiocontrol_service (service_manager (find)))
+(allow hal_audiocontrol_server hal_audiocontrol_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_audiocontrol.te
+
+(neverallow base_typeattr_540 hal_audiocontrol_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_audiocontrol.te
+
+(neverallow base_typeattr_542 hal_audiocontrol_service (service_manager (find)))
+;;* lme
+
+(allow hal_audiocontrol_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_audiocontrol_server (binder (transfer)))
+(allow hal_audiocontrol_server servicemanager (fd (use)))
+(allow hal_authgraph_client hal_authgraph_server (binder (call transfer)))
+(allow hal_authgraph_server hal_authgraph_client (binder (transfer)))
+(allow hal_authgraph_client hal_authgraph_server (fd (use)))
+(allow hal_authgraph_client hal_authgraph_service (service_manager (find)))
+(allow hal_authgraph_server hal_authgraph_service (service_manager (add find)))
+;;* lmx 3 system/sepolicy/private/hal_authgraph.te
+
+(neverallow base_typeattr_543 hal_authgraph_service (service_manager (add)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/hal_authgraph.te
+
+(neverallow base_typeattr_544 hal_authgraph_service (service_manager (find)))
+;;* lme
+
+(allow hal_authgraph_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_authgraph_server (binder (transfer)))
+(allow hal_authgraph_server servicemanager (fd (use)))
+(allow hal_authgraph_server tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_authgraph_server ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_authsecret_client hal_authsecret_server (binder (call transfer)))
+(allow hal_authsecret_server hal_authsecret_client (binder (transfer)))
+(allow hal_authsecret_client hal_authsecret_server (fd (use)))
+(allow hal_authsecret_client hal_authsecret_hwservice (hwservice_manager (find)))
+(allow hal_authsecret_server hal_authsecret_hwservice (hwservice_manager (add find)))
+(allow hal_authsecret_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_authsecret.te
+
+(neverallow base_typeattr_545 hal_authsecret_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_authsecret.te
+
+(neverallow base_typeattr_546 hal_authsecret_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_authsecret_client hal_authsecret_service (service_manager (find)))
+(allow hal_authsecret_server hal_authsecret_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_authsecret.te
+
+(neverallow base_typeattr_545 hal_authsecret_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_authsecret.te
+
+(neverallow base_typeattr_547 hal_authsecret_service (service_manager (find)))
+;;* lme
+
+(allow hal_authsecret_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_authsecret_server (binder (transfer)))
+(allow hal_authsecret_server servicemanager (fd (use)))
+(allow hal_bluetooth_client hal_bluetooth_server (binder (call transfer)))
+(allow hal_bluetooth_server hal_bluetooth_client (binder (transfer)))
+(allow hal_bluetooth_client hal_bluetooth_server (fd (use)))
+(allow hal_bluetooth_server hal_bluetooth_client (binder (call transfer)))
+(allow hal_bluetooth_client hal_bluetooth_server (binder (transfer)))
+(allow hal_bluetooth_server hal_bluetooth_client (fd (use)))
+(allow hal_bluetooth_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_bluetooth_server (binder (transfer)))
+(allow hal_bluetooth_server servicemanager (fd (use)))
+(allow hal_bluetooth_client hal_bluetooth_hwservice (hwservice_manager (find)))
+(allow hal_bluetooth_server hal_bluetooth_hwservice (hwservice_manager (add find)))
+(allow hal_bluetooth_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hal_bluetooth.te
+
+(neverallow base_typeattr_548 hal_bluetooth_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_bluetooth.te
+
+(neverallow base_typeattr_549 hal_bluetooth_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_bluetooth_client hal_bluetooth_service (service_manager (find)))
+(allow hal_bluetooth_server hal_bluetooth_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_bluetooth.te
+
+(neverallow base_typeattr_548 hal_bluetooth_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_bluetooth.te
+
+(neverallow base_typeattr_550 hal_bluetooth_service (service_manager (find)))
+;;* lme
+
+(allow hal_bluetooth sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_bluetooth self (capability2 (block_suspend)))
+(allow hal_bluetooth self (cap2_userns (block_suspend)))
+(allow hal_bluetooth system_suspend_server (binder (call transfer)))
+(allow system_suspend_server hal_bluetooth (binder (transfer)))
+(allow hal_bluetooth system_suspend_server (fd (use)))
+(allow hal_bluetooth system_suspend_hwservice (hwservice_manager (find)))
+(allow hal_bluetooth hwservicemanager (binder (call transfer)))
+(allow hwservicemanager hal_bluetooth (binder (call transfer)))
+(allow hwservicemanager hal_bluetooth (dir (search)))
+(allow hwservicemanager hal_bluetooth (file (read map open)))
+(allow hwservicemanager hal_bluetooth (process (getattr)))
+(allow hal_bluetooth hwservicemanager_prop (file (read getattr map open)))
+(allow hal_bluetooth hidl_manager_hwservice (hwservice_manager (find)))
+(allow hal_bluetooth hal_system_suspend_service (service_manager (find)))
+(allow hal_bluetooth servicemanager (binder (call transfer)))
+(allow servicemanager hal_bluetooth (binder (call transfer)))
+(allow servicemanager hal_bluetooth (dir (search)))
+(allow servicemanager hal_bluetooth (file (read open)))
+(allow servicemanager hal_bluetooth (process (getattr)))
+(allow hal_bluetooth self (capability (net_admin)))
+(allow hal_bluetooth self (cap_userns (net_admin)))
+(allow hal_bluetooth bluetooth_efs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_bluetooth bluetooth_efs_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_bluetooth bluetooth_efs_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_bluetooth uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_bluetooth hci_attach_dev (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_bluetooth sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_bluetooth sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_bluetooth sysfs_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_bluetooth sysfs_bluetooth_writable (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_bluetooth self (capability2 (wake_alarm)))
+(allow hal_bluetooth self (cap2_userns (wake_alarm)))
+(allow hal_bluetooth property_socket (sock_file (write)))
+(allow hal_bluetooth init (unix_stream_socket (connectto)))
+(allow hal_bluetooth bluetooth_a2dp_offload_prop (property_service (set)))
+(allow hal_bluetooth bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow hal_bluetooth property_socket (sock_file (write)))
+(allow hal_bluetooth init (unix_stream_socket (connectto)))
+(allow hal_bluetooth bluetooth_audio_hal_prop (property_service (set)))
+(allow hal_bluetooth bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow hal_bluetooth property_socket (sock_file (write)))
+(allow hal_bluetooth init (unix_stream_socket (connectto)))
+(allow hal_bluetooth bluetooth_finder_prop (property_service (set)))
+(allow hal_bluetooth bluetooth_finder_prop (file (read getattr map open)))
+(allow hal_bluetooth property_socket (sock_file (write)))
+(allow hal_bluetooth init (unix_stream_socket (connectto)))
+(allow hal_bluetooth bluetooth_prop (property_service (set)))
+(allow hal_bluetooth bluetooth_prop (file (read getattr map open)))
+(allow hal_bluetooth property_socket (sock_file (write)))
+(allow hal_bluetooth init (unix_stream_socket (connectto)))
+(allow hal_bluetooth exported_bluetooth_prop (property_service (set)))
+(allow hal_bluetooth exported_bluetooth_prop (file (read getattr map open)))
+(allow hal_bluetooth proc_bluetooth_writable (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_bluetooth self (capability (sys_nice)))
+(allow hal_bluetooth self (cap_userns (sys_nice)))
+(allow hal_bootctl_client hal_bootctl_server (binder (call transfer)))
+(allow hal_bootctl_server hal_bootctl_client (binder (transfer)))
+(allow hal_bootctl_client hal_bootctl_server (fd (use)))
+(allow hal_bootctl_server hal_bootctl_client (binder (call transfer)))
+(allow hal_bootctl_client hal_bootctl_server (binder (transfer)))
+(allow hal_bootctl_server hal_bootctl_client (fd (use)))
+(allow hal_bootctl_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_bootctl_server (binder (call transfer)))
+(allow servicemanager hal_bootctl_server (dir (search)))
+(allow servicemanager hal_bootctl_server (file (read open)))
+(allow servicemanager hal_bootctl_server (process (getattr)))
+(allow hal_bootctl_client hal_bootctl_hwservice (hwservice_manager (find)))
+(allow hal_bootctl_server hal_bootctl_hwservice (hwservice_manager (add find)))
+(allow hal_bootctl_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hal_bootctl.te
+
+(neverallow base_typeattr_551 hal_bootctl_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_bootctl.te
+
+(neverallow base_typeattr_552 hal_bootctl_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_bootctl_server proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_bootctl_client hal_bootctl_service (service_manager (find)))
+(allow hal_bootctl_server hal_bootctl_service (service_manager (add find)))
+;;* lmx 10 system/sepolicy/private/hal_bootctl.te
+
+(neverallow base_typeattr_551 hal_bootctl_service (service_manager (add)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/hal_bootctl.te
+
+(neverallow base_typeattr_553 hal_bootctl_service (service_manager (find)))
+;;* lme
+
+(allow hal_broadcastradio_client hal_broadcastradio_server (binder (call transfer)))
+(allow hal_broadcastradio_server hal_broadcastradio_client (binder (transfer)))
+(allow hal_broadcastradio_client hal_broadcastradio_server (fd (use)))
+(allow hal_broadcastradio_server hal_broadcastradio_client (binder (call transfer)))
+(allow hal_broadcastradio_client hal_broadcastradio_server (binder (transfer)))
+(allow hal_broadcastradio_server hal_broadcastradio_client (fd (use)))
+(allow hal_broadcastradio_client hal_broadcastradio_hwservice (hwservice_manager (find)))
+(allow hal_broadcastradio_server hal_broadcastradio_hwservice (hwservice_manager (add find)))
+(allow hal_broadcastradio_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_broadcastradio.te
+
+(neverallow base_typeattr_554 hal_broadcastradio_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_broadcastradio.te
+
+(neverallow base_typeattr_555 hal_broadcastradio_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_broadcastradio_client hal_broadcastradio_service (service_manager (find)))
+(allow hal_broadcastradio_server hal_broadcastradio_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_broadcastradio.te
+
+(neverallow base_typeattr_554 hal_broadcastradio_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_broadcastradio.te
+
+(neverallow base_typeattr_556 hal_broadcastradio_service (service_manager (find)))
+;;* lme
+
+(allow hal_broadcastradio_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_broadcastradio_server (binder (transfer)))
+(allow hal_broadcastradio_server servicemanager (fd (use)))
+(allow hal_camera_client hal_camera_server (binder (call transfer)))
+(allow hal_camera_server hal_camera_client (binder (transfer)))
+(allow hal_camera_client hal_camera_server (fd (use)))
+(allow hal_camera_server hal_camera_client (binder (call transfer)))
+(allow hal_camera_client hal_camera_server (binder (transfer)))
+(allow hal_camera_server hal_camera_client (fd (use)))
+(allow hal_camera_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_camera_server (binder (call transfer)))
+(allow servicemanager hal_camera_server (dir (search)))
+(allow servicemanager hal_camera_server (file (read open)))
+(allow servicemanager hal_camera_server (process (getattr)))
+(allow hal_camera_client hal_camera_hwservice (hwservice_manager (find)))
+(allow hal_camera_server hal_camera_hwservice (hwservice_manager (add find)))
+(allow hal_camera_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 8 system/sepolicy/private/hal_camera.te
+
+(neverallow base_typeattr_557 hal_camera_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_camera.te
+
+(neverallow base_typeattr_558 hal_camera_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_camera_client hal_camera_service (service_manager (find)))
+(allow hal_camera_server hal_camera_service (service_manager (add find)))
+;;* lmx 9 system/sepolicy/private/hal_camera.te
+
+(neverallow base_typeattr_557 hal_camera_service (service_manager (add)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/hal_camera.te
+
+(neverallow base_typeattr_559 hal_camera_service (service_manager (find)))
+;;* lme
+
+(allow hal_camera device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_camera video_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_camera video_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_camera camera_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_camera ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_camera dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_camera_client hal_graphics_allocator (fd (use)))
+(allow hal_camera_server hal_graphics_allocator (fd (use)))
+(allow hal_camera base_typeattr_560 (fd (use)))
+(allow hal_camera surfaceflinger (fd (use)))
+(allow hal_camera hal_allocator_server (fd (use)))
+(allow hal_camera shell (fd (use)))
+(allow hal_camera shell (fifo_file (write)))
+;;* lmx 36 system/sepolicy/private/hal_camera.te
+
+(neverallow hal_camera_server fs_type (file (execute_no_trans)))
+(neverallow hal_camera_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/hal_camera.te
+
+(neverallow hal_camera_server domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow hal_camera_server domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow hal_camera_server domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/hal_camera.te
+
+(neverallow base_typeattr_561 camera_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow hal_can_controller_client hal_can_controller_server (binder (call transfer)))
+(allow hal_can_controller_server hal_can_controller_client (binder (transfer)))
+(allow hal_can_controller_client hal_can_controller_server (fd (use)))
+(allow hal_can_controller_server hal_can_controller_client (binder (call transfer)))
+(allow hal_can_controller_client hal_can_controller_server (binder (transfer)))
+(allow hal_can_controller_server hal_can_controller_client (fd (use)))
+(allow hal_can_controller_client hal_can_controller_hwservice (hwservice_manager (find)))
+(allow hal_can_controller_server hal_can_controller_hwservice (hwservice_manager (add find)))
+(allow hal_can_controller_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_562 hal_can_controller_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_563 hal_can_controller_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_can_bus_client hal_can_bus_server (binder (call transfer)))
+(allow hal_can_bus_server hal_can_bus_client (binder (transfer)))
+(allow hal_can_bus_client hal_can_bus_server (fd (use)))
+(allow hal_can_bus_server hal_can_bus_client (binder (call transfer)))
+(allow hal_can_bus_client hal_can_bus_server (binder (transfer)))
+(allow hal_can_bus_server hal_can_bus_client (fd (use)))
+(allow hal_can_bus_client hal_can_bus_hwservice (hwservice_manager (find)))
+(allow hal_can_bus_server hal_can_bus_hwservice (hwservice_manager (add find)))
+(allow hal_can_bus_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 9 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_564 hal_can_bus_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_565 hal_can_bus_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_can_controller_client hal_can_controller_service (service_manager (find)))
+(allow hal_can_controller_server hal_can_controller_service (service_manager (add find)))
+;;* lmx 12 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_562 hal_can_controller_service (service_manager (add)))
+;;* lme
+
+;;* lmx 12 system/sepolicy/private/hal_can.te
+
+(neverallow base_typeattr_566 hal_can_controller_service (service_manager (find)))
+;;* lme
+
+(allow hal_can_controller servicemanager (binder (call transfer)))
+(allow servicemanager hal_can_controller (binder (call transfer)))
+(allow servicemanager hal_can_controller (dir (search)))
+(allow servicemanager hal_can_controller (file (read open)))
+(allow servicemanager hal_can_controller (process (getattr)))
+(allow hal_cas_client hal_cas_server (binder (call transfer)))
+(allow hal_cas_server hal_cas_client (binder (transfer)))
+(allow hal_cas_client hal_cas_server (fd (use)))
+(allow hal_cas_server hal_cas_client (binder (call transfer)))
+(allow hal_cas_client hal_cas_server (binder (transfer)))
+(allow hal_cas_server hal_cas_client (fd (use)))
+(allow hal_cas_client hal_cas_hwservice (hwservice_manager (find)))
+(allow hal_cas_server hal_cas_hwservice (hwservice_manager (add find)))
+(allow hal_cas_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_cas.te
+
+(neverallow base_typeattr_567 hal_cas_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_cas.te
+
+(neverallow base_typeattr_568 hal_cas_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_cas_server hidl_memory_hwservice (hwservice_manager (find)))
+(allow hal_cas_client hal_cas_service (service_manager (find)))
+(allow hal_cas_server hal_cas_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/hal_cas.te
+
+(neverallow base_typeattr_567 hal_cas_service (service_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_cas.te
+
+(neverallow base_typeattr_569 hal_cas_service (service_manager (find)))
+;;* lme
+
+(allow hal_cas_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_cas_server (binder (transfer)))
+(allow hal_cas_server servicemanager (fd (use)))
+(allow hal_cas_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_cas_client (binder (transfer)))
+(allow hal_cas_client servicemanager (fd (use)))
+(allow hal_cas_server serialno_prop (file (read getattr map open)))
+(allow hal_cas system_data_file (file (read getattr)))
+(allow hal_cas cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_cas cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_cas cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_cas cgroup (dir (write search)))
+(allow hal_cas cgroup (file (write lock append map open)))
+(allow hal_cas cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_cas cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_cas cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_cas cgroup_v2 (dir (write search)))
+(allow hal_cas cgroup_v2 (file (write lock append map open)))
+(allow hal_cas ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_cas hal_graphics_allocator (fd (use)))
+(allow hal_cas tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 40 system/sepolicy/private/hal_cas.te
+
+(neverallow hal_cas_server fs_type (file (execute_no_trans)))
+(neverallow hal_cas_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/hal_cas.te
+
+(neverallowx hal_cas_server domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx hal_cas_server domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx hal_cas_server domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/hal_cas.te
+
+(neverallowx hal_cas_server domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx hal_cas_server domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx hal_cas_server domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/hal_cas.te
+
+(neverallowx hal_cas_server domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx hal_cas_server domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx hal_cas_server domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+(allow hal_codec2_client media_variant_prop (file (read getattr map open)))
+(allow hal_codec2_server media_variant_prop (file (read getattr map open)))
+(allow hal_codec2_client codec2_config_prop (file (read getattr map open)))
+(allow hal_codec2_server codec2_config_prop (file (read getattr map open)))
+(allow hal_codec2_client hal_codec2_server (binder (call transfer)))
+(allow hal_codec2_server hal_codec2_client (binder (transfer)))
+(allow hal_codec2_client hal_codec2_server (fd (use)))
+(allow hal_codec2_server hal_codec2_client (binder (call transfer)))
+(allow hal_codec2_client hal_codec2_server (binder (transfer)))
+(allow hal_codec2_server hal_codec2_client (fd (use)))
+(allow hal_codec2_client hal_codec2_hwservice (hwservice_manager (find)))
+(allow hal_codec2_server hal_codec2_hwservice (hwservice_manager (add find)))
+(allow hal_codec2_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 9 system/sepolicy/private/hal_codec2.te
+
+(neverallow base_typeattr_570 hal_codec2_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/hal_codec2.te
+
+(neverallow base_typeattr_571 hal_codec2_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_codec2_client hal_codec2_service (service_manager (find)))
+(allow hal_codec2_server hal_codec2_service (service_manager (add find)))
+;;* lmx 10 system/sepolicy/private/hal_codec2.te
+
+(neverallow base_typeattr_570 hal_codec2_service (service_manager (add)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/hal_codec2.te
+
+(neverallow base_typeattr_572 hal_codec2_service (service_manager (find)))
+;;* lme
+
+(allow hal_codec2_server hal_graphics_composer (fd (use)))
+(allow hal_codec2_server ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_codec2_server hal_camera (fd (use)))
+(allow hal_codec2_server bufferhubd (fd (use)))
+(allow hal_codec2_client ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_573 surfaceflinger_service (service_manager (find)))
+(allow hal_codec2_server su (fifo_file (read)))
+(allow hal_codec2_server hal_codec2_client (fifo_file (read)))
+(allow hal_codec2_server base_typeattr_254 (fifo_file (read)))
+(allow hal_configstore_client hal_configstore_server (binder (call transfer)))
+(allow hal_configstore_server hal_configstore_client (binder (transfer)))
+(allow hal_configstore_client hal_configstore_server (fd (use)))
+(allow hal_configstore_client hal_configstore_ISurfaceFlingerConfigs (hwservice_manager (find)))
+(allow hal_configstore_server hal_configstore_ISurfaceFlingerConfigs (hwservice_manager (add find)))
+(allow hal_configstore_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_configstore.te
+
+(neverallow base_typeattr_574 hal_configstore_ISurfaceFlingerConfigs (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_configstore.te
+
+(neverallow base_typeattr_575 hal_configstore_ISurfaceFlingerConfigs (hwservice_manager (find)))
+;;* lme
+
+(allow hal_configstore_server anr_data_file (file (append)))
+(allow hal_configstore_server dumpstate (fd (use)))
+(allow hal_configstore_server incidentd (fd (use)))
+(allow hal_configstore_server dumpstate (fifo_file (write append)))
+(allow hal_configstore_server incidentd (fifo_file (write append)))
+(allow hal_configstore_server system_server (fifo_file (write append)))
+(allow hal_configstore_server tombstoned (unix_stream_socket (connectto)))
+(allow hal_configstore_server tombstoned (fd (use)))
+(allow hal_configstore_server tombstoned_crash_socket (sock_file (write)))
+(allow hal_configstore_server tombstone_data_file (file (append)))
+;;* lmx 15 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server fs_type (file (execute_no_trans)))
+(neverallow hal_configstore_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 29 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server domain (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow hal_configstore_server domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow hal_configstore_server domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow hal_configstore_server domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_route_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh)))
+(neverallow hal_configstore_server domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow hal_configstore_server domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow hal_configstore_server domain (netlink_selinux_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow hal_configstore_server domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow hal_configstore_server domain (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_configstore_server domain (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server base_typeattr_576 (unix_stream_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind connectto)))
+(neverallow hal_configstore_server base_typeattr_576 (unix_dgram_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server base_typeattr_577 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server base_typeattr_577 (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow hal_configstore_server base_typeattr_577 (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server sdcard_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_configstore_server fuse (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_configstore_server fuseblk (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_configstore_server sdcardfs (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_configstore_server vfat (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_configstore_server exfat (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server sdcard_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server fuse (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server fuseblk (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server sdcardfs (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server vfat (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_configstore_server exfat (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 58 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server base_typeattr_236 (service_manager (add find list)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow hal_configstore_server self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow hal_configstore_server self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow hal_configstore_server self (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server base_typeattr_236 (process (ptrace)))
+;;* lme
+
+;;* lmx 67 system/sepolicy/private/hal_configstore.te
+
+(neverallow hal_configstore_server base_typeattr_236 (file (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (dir (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (lnk_file (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (chr_file (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (blk_file (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (sock_file (relabelfrom relabelto)))
+(neverallow hal_configstore_server base_typeattr_236 (fifo_file (relabelfrom relabelto)))
+;;* lme
+
+(allow hal_confirmationui_client hal_confirmationui_server (binder (call transfer)))
+(allow hal_confirmationui_server hal_confirmationui_client (binder (transfer)))
+(allow hal_confirmationui_client hal_confirmationui_server (fd (use)))
+(allow hal_confirmationui_client hal_confirmationui_hwservice (hwservice_manager (find)))
+(allow hal_confirmationui_server hal_confirmationui_hwservice (hwservice_manager (add find)))
+(allow hal_confirmationui_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_confirmationui.te
+
+(neverallow base_typeattr_578 hal_confirmationui_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_confirmationui.te
+
+(neverallow base_typeattr_579 hal_confirmationui_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_confirmationui_client hal_confirmationui_service (service_manager (find)))
+(allow hal_confirmationui_server hal_confirmationui_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_confirmationui.te
+
+(neverallow base_typeattr_578 hal_confirmationui_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_confirmationui.te
+
+(neverallow base_typeattr_580 hal_confirmationui_service (service_manager (find)))
+;;* lme
+
+(allow hal_confirmationui_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_confirmationui_server (binder (transfer)))
+(allow hal_confirmationui_server servicemanager (fd (use)))
+(allow hal_contexthub_client hal_contexthub_server (binder (call transfer)))
+(allow hal_contexthub_server hal_contexthub_client (binder (transfer)))
+(allow hal_contexthub_client hal_contexthub_server (fd (use)))
+(allow hal_contexthub_server hal_contexthub_client (binder (call transfer)))
+(allow hal_contexthub_client hal_contexthub_server (binder (transfer)))
+(allow hal_contexthub_server hal_contexthub_client (fd (use)))
+(allow hal_contexthub_server hal_contexthub_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_contexthub.te
+
+(neverallow base_typeattr_581 hal_contexthub_service (service_manager (add)))
+;;* lme
+
+(allow hal_contexthub_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_contexthub_server (binder (transfer)))
+(allow hal_contexthub_server servicemanager (fd (use)))
+(allow hal_contexthub_client hal_contexthub_service (service_manager (find)))
+(allow hal_contexthub_client hal_contexthub_hwservice (hwservice_manager (find)))
+(allow hal_contexthub_server hal_contexthub_hwservice (hwservice_manager (add find)))
+(allow hal_contexthub_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 10 system/sepolicy/private/hal_contexthub.te
+
+(neverallow base_typeattr_581 hal_contexthub_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/hal_contexthub.te
+
+(neverallow base_typeattr_582 hal_contexthub_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_drm_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_drm_server (binder (call transfer)))
+(allow servicemanager hal_drm_server (dir (search)))
+(allow servicemanager hal_drm_server (file (read open)))
+(allow servicemanager hal_drm_server (process (getattr)))
+(allow hal_drm_client hal_drm_server (binder (call transfer)))
+(allow hal_drm_server hal_drm_client (binder (transfer)))
+(allow hal_drm_client hal_drm_server (fd (use)))
+(allow hal_drm_server hal_drm_client (binder (call transfer)))
+(allow hal_drm_client hal_drm_server (binder (transfer)))
+(allow hal_drm_server hal_drm_client (fd (use)))
+(allow hal_drm_client hal_drm_hwservice (hwservice_manager (find)))
+(allow hal_drm_server hal_drm_hwservice (hwservice_manager (add find)))
+(allow hal_drm_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hal_drm.te
+
+(neverallow base_typeattr_583 hal_drm_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_drm.te
+
+(neverallow base_typeattr_584 hal_drm_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_drm_client hal_drm_service (service_manager (find)))
+(allow hal_drm_server hal_drm_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_drm.te
+
+(neverallow base_typeattr_583 hal_drm_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_drm.te
+
+(neverallow base_typeattr_585 hal_drm_service (service_manager (find)))
+;;* lme
+
+(allow hal_drm hidl_memory_hwservice (hwservice_manager (find)))
+(allow hal_drm self (process (execmem)))
+(allow hal_drm_server serialno_prop (file (read getattr map open)))
+(allow hal_drm_server drm_forcel3_prop (file (read getattr map open)))
+(allow hal_drm system_data_file (file (read getattr)))
+(allow hal_drm cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_drm cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_drm cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_drm cgroup (dir (write search)))
+(allow hal_drm cgroup (file (write lock append map open)))
+(allow hal_drm cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_drm cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_drm cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_drm cgroup_v2 (dir (write search)))
+(allow hal_drm cgroup_v2 (file (write lock append map open)))
+(allow hal_drm_server shell (fd (use)))
+(allow hal_drm_server shell (fifo_file (write)))
+(allow hal_drm ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_drm hal_graphics_allocator (fd (use)))
+(allow hal_drm hal_allocator_server (fd (use)))
+(allow hal_drm mediaserver (fd (use)))
+(allow hal_drm sysfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_drm tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_drm_server base_typeattr_560 (fd (use)))
+(allowx hal_drm self (ioctl tcp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx hal_drm self (ioctl udp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx hal_drm self (ioctl rawip_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx hal_drm self (ioctl tcp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx hal_drm self (ioctl udp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx hal_drm self (ioctl rawip_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx hal_drm self (ioctl tcp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx hal_drm self (ioctl udp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx hal_drm self (ioctl rawip_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+;;* lmx 61 system/sepolicy/private/hal_drm.te
+
+(neverallow hal_drm_server fs_type (file (execute_no_trans)))
+(neverallow hal_drm_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/hal_drm.te
+
+(neverallowx hal_drm_server domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx hal_drm_server domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx hal_drm_server domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/hal_drm.te
+
+(neverallowx hal_drm_server domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx hal_drm_server domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx hal_drm_server domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/hal_drm.te
+
+(neverallowx hal_drm_server domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx hal_drm_server domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx hal_drm_server domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+(allow hal_dumpstate_client hal_dumpstate_server (binder (call transfer)))
+(allow hal_dumpstate_server hal_dumpstate_client (binder (transfer)))
+(allow hal_dumpstate_client hal_dumpstate_server (fd (use)))
+(allow hal_dumpstate_server hal_dumpstate_client (binder (call transfer)))
+(allow hal_dumpstate_client hal_dumpstate_server (binder (transfer)))
+(allow hal_dumpstate_server hal_dumpstate_client (fd (use)))
+(allow hal_dumpstate_server property_socket (sock_file (write)))
+(allow hal_dumpstate_server init (unix_stream_socket (connectto)))
+(allow hal_dumpstate_server hal_dumpstate_config_prop (property_service (set)))
+(allow hal_dumpstate_server hal_dumpstate_config_prop (file (read getattr map open)))
+(allow hal_dumpstate_client hal_dumpstate_hwservice (hwservice_manager (find)))
+(allow hal_dumpstate_server hal_dumpstate_hwservice (hwservice_manager (add find)))
+(allow hal_dumpstate_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 7 system/sepolicy/private/hal_dumpstate.te
+
+(neverallow base_typeattr_586 hal_dumpstate_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_dumpstate.te
+
+(neverallow base_typeattr_587 hal_dumpstate_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_dumpstate_client hal_dumpstate_service (service_manager (find)))
+(allow hal_dumpstate_server hal_dumpstate_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/hal_dumpstate.te
+
+(neverallow base_typeattr_586 hal_dumpstate_service (service_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_dumpstate.te
+
+(neverallow base_typeattr_588 hal_dumpstate_service (service_manager (find)))
+;;* lme
+
+(allow hal_dumpstate_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_dumpstate_server (binder (transfer)))
+(allow hal_dumpstate_server servicemanager (fd (use)))
+(allow hal_dumpstate_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_dumpstate_server (binder (call transfer)))
+(allow servicemanager hal_dumpstate_server (dir (search)))
+(allow servicemanager hal_dumpstate_server (file (read open)))
+(allow servicemanager hal_dumpstate_server (process (getattr)))
+(allow hal_dumpstate shell_data_file (file (write)))
+(allow hal_dumpstate proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_dumpstate fscklogs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_dumpstate fscklogs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_dumpstate fscklogs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_evs_client hwservicemanager (binder (call transfer)))
+(allow hwservicemanager hal_evs_client (binder (call transfer)))
+(allow hwservicemanager hal_evs_client (dir (search)))
+(allow hwservicemanager hal_evs_client (file (read map open)))
+(allow hwservicemanager hal_evs_client (process (getattr)))
+(allow hal_evs_server hwservicemanager (binder (call transfer)))
+(allow hwservicemanager hal_evs_server (binder (call transfer)))
+(allow hwservicemanager hal_evs_server (dir (search)))
+(allow hwservicemanager hal_evs_server (file (read map open)))
+(allow hwservicemanager hal_evs_server (process (getattr)))
+(allow hal_evs_client hal_evs_server (binder (call transfer)))
+(allow hal_evs_server hal_evs_client (binder (transfer)))
+(allow hal_evs_client hal_evs_server (fd (use)))
+(allow hal_evs_server hal_evs_client (binder (call transfer)))
+(allow hal_evs_client hal_evs_server (binder (transfer)))
+(allow hal_evs_server hal_evs_client (fd (use)))
+(allow hal_evs_client hal_evs_hwservice (hwservice_manager (find)))
+(allow hal_evs_server hal_evs_hwservice (hwservice_manager (add find)))
+(allow hal_evs_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 12 system/sepolicy/private/hal_evs.te
+
+(neverallow base_typeattr_589 hal_evs_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow hal_evs_client hal_evs_service (service_manager (find)))
+(allow hal_evs_server hal_evs_service (service_manager (add find)))
+;;* lmx 15 system/sepolicy/private/hal_evs.te
+
+(neverallow base_typeattr_590 hal_evs_service (service_manager (add)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/private/hal_evs.te
+
+(neverallow base_typeattr_591 hal_evs_service (service_manager (find)))
+;;* lme
+
+(allow hal_face_client hal_face_server (binder (call transfer)))
+(allow hal_face_server hal_face_client (binder (transfer)))
+(allow hal_face_client hal_face_server (fd (use)))
+(allow hal_face_server hal_face_client (binder (call transfer)))
+(allow hal_face_client hal_face_server (binder (transfer)))
+(allow hal_face_server hal_face_client (fd (use)))
+(allow hal_face_client hal_face_hwservice (hwservice_manager (find)))
+(allow hal_face_server hal_face_hwservice (hwservice_manager (add find)))
+(allow hal_face_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_face.te
+
+(neverallow base_typeattr_592 hal_face_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_face.te
+
+(neverallow base_typeattr_593 hal_face_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_face_client hal_face_service (service_manager (find)))
+(allow hal_face_server hal_face_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_face.te
+
+(neverallow base_typeattr_592 hal_face_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_face.te
+
+(neverallow base_typeattr_594 hal_face_service (service_manager (find)))
+;;* lme
+
+(allow hal_face_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_face_server (binder (call transfer)))
+(allow servicemanager hal_face_server (dir (search)))
+(allow servicemanager hal_face_server (file (read open)))
+(allow servicemanager hal_face_server (process (getattr)))
+(allow hal_face ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_595 face_vendor_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_595 face_vendor_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow hal_fastboot_client hal_fastboot_server (binder (call transfer)))
+(allow hal_fastboot_server hal_fastboot_client (binder (transfer)))
+(allow hal_fastboot_client hal_fastboot_server (fd (use)))
+(allow hal_fastboot_client hal_fastboot_service (service_manager (find)))
+(allow hal_fastboot_server hal_fastboot_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_fastboot.te
+
+(neverallow base_typeattr_596 hal_fastboot_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_fastboot.te
+
+(neverallow base_typeattr_597 hal_fastboot_service (service_manager (find)))
+;;* lme
+
+(allow hal_fastboot_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_fastboot_server (binder (transfer)))
+(allow hal_fastboot_server servicemanager (fd (use)))
+(allow hal_fingerprint_client hal_fingerprint_server (binder (call transfer)))
+(allow hal_fingerprint_server hal_fingerprint_client (binder (transfer)))
+(allow hal_fingerprint_client hal_fingerprint_server (fd (use)))
+(allow hal_fingerprint_server hal_fingerprint_client (binder (call transfer)))
+(allow hal_fingerprint_client hal_fingerprint_server (binder (transfer)))
+(allow hal_fingerprint_server hal_fingerprint_client (fd (use)))
+(allow hal_fingerprint_client hal_fingerprint_hwservice (hwservice_manager (find)))
+(allow hal_fingerprint_server hal_fingerprint_hwservice (hwservice_manager (add find)))
+(allow hal_fingerprint_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_fingerprint.te
+
+(neverallow base_typeattr_598 hal_fingerprint_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_fingerprint.te
+
+(neverallow base_typeattr_599 hal_fingerprint_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_fingerprint_client hal_fingerprint_service (service_manager (find)))
+(allow hal_fingerprint_server hal_fingerprint_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_fingerprint.te
+
+(neverallow base_typeattr_598 hal_fingerprint_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_fingerprint.te
+
+(neverallow base_typeattr_600 hal_fingerprint_service (service_manager (find)))
+;;* lme
+
+(allow hal_fingerprint_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_fingerprint_server (binder (call transfer)))
+(allow servicemanager hal_fingerprint_server (dir (search)))
+(allow servicemanager hal_fingerprint_server (file (read open)))
+(allow servicemanager hal_fingerprint_server (process (getattr)))
+(allow hal_fingerprint ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_601 fingerprint_vendor_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow base_typeattr_601 fingerprint_vendor_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow hal_fingerprint cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_fingerprint cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_fingerprint cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_fingerprint cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_fingerprint cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_fingerprint cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_601 sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow base_typeattr_601 sysfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_601 sysfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_gatekeeper_client hal_gatekeeper_server (binder (call transfer)))
+(allow hal_gatekeeper_server hal_gatekeeper_client (binder (transfer)))
+(allow hal_gatekeeper_client hal_gatekeeper_server (fd (use)))
+(allow hal_gatekeeper_client hal_gatekeeper_hwservice (hwservice_manager (find)))
+(allow hal_gatekeeper_server hal_gatekeeper_hwservice (hwservice_manager (add find)))
+(allow hal_gatekeeper_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 3 system/sepolicy/private/hal_gatekeeper.te
+
+(neverallow base_typeattr_602 hal_gatekeeper_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/hal_gatekeeper.te
+
+(neverallow base_typeattr_603 hal_gatekeeper_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_gatekeeper_client hal_gatekeeper_service (service_manager (find)))
+(allow hal_gatekeeper_server hal_gatekeeper_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_gatekeeper.te
+
+(neverallow base_typeattr_602 hal_gatekeeper_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_gatekeeper.te
+
+(neverallow base_typeattr_604 hal_gatekeeper_service (service_manager (find)))
+;;* lme
+
+(allow hal_gatekeeper_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_gatekeeper_server (binder (transfer)))
+(allow hal_gatekeeper_server servicemanager (fd (use)))
+(allow hal_gatekeeper tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_gatekeeper ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_gnss_client hal_gnss_server (binder (call transfer)))
+(allow hal_gnss_server hal_gnss_client (binder (transfer)))
+(allow hal_gnss_client hal_gnss_server (fd (use)))
+(allow hal_gnss_server hal_gnss_client (binder (call transfer)))
+(allow hal_gnss_client hal_gnss_server (binder (transfer)))
+(allow hal_gnss_server hal_gnss_client (fd (use)))
+(allow hal_gnss_client hal_gnss_hwservice (hwservice_manager (find)))
+(allow hal_gnss_server hal_gnss_hwservice (hwservice_manager (add find)))
+(allow hal_gnss_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_gnss.te
+
+(neverallow base_typeattr_605 hal_gnss_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_gnss.te
+
+(neverallow base_typeattr_606 hal_gnss_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_gnss_client hal_gnss_service (service_manager (find)))
+(allow hal_gnss_server hal_gnss_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_gnss.te
+
+(neverallow base_typeattr_605 hal_gnss_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_gnss.te
+
+(neverallow base_typeattr_607 hal_gnss_service (service_manager (find)))
+;;* lme
+
+(allow hal_gnss_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_gnss_server (binder (call transfer)))
+(allow servicemanager hal_gnss_server (dir (search)))
+(allow servicemanager hal_gnss_server (file (read open)))
+(allow servicemanager hal_gnss_server (process (getattr)))
+(allow hal_gnss_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_gnss_client (binder (call transfer)))
+(allow servicemanager hal_gnss_client (dir (search)))
+(allow servicemanager hal_gnss_client (file (read open)))
+(allow servicemanager hal_gnss_client (process (getattr)))
+(allow hal_graphics_allocator_client hal_graphics_allocator_server (binder (call transfer)))
+(allow hal_graphics_allocator_server hal_graphics_allocator_client (binder (transfer)))
+(allow hal_graphics_allocator_client hal_graphics_allocator_server (fd (use)))
+(allow hal_graphics_allocator_client hal_graphics_allocator_hwservice (hwservice_manager (find)))
+(allow hal_graphics_allocator_server hal_graphics_allocator_hwservice (hwservice_manager (add find)))
+(allow hal_graphics_allocator_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_graphics_allocator.te
+
+(neverallow base_typeattr_608 hal_graphics_allocator_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_graphics_allocator.te
+
+(neverallow base_typeattr_609 hal_graphics_allocator_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_graphics_allocator_client hal_graphics_mapper_hwservice (hwservice_manager (find)))
+(allow hal_graphics_allocator_client hal_graphics_mapper_service (service_manager (find)))
+(allow hal_graphics_allocator_client same_process_hal_file (file (read getattr map execute open)))
+(allow hal_graphics_allocator gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_graphics_allocator gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_graphics_allocator ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_graphics_allocator dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_graphics_allocator dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_graphics_allocator self (capability (sys_nice)))
+(allow hal_graphics_allocator self (cap_userns (sys_nice)))
+(allow hal_graphics_allocator_client hal_graphics_allocator_service (service_manager (find)))
+(allow hal_graphics_allocator_server hal_graphics_allocator_service (service_manager (add find)))
+;;* lmx 22 system/sepolicy/private/hal_graphics_allocator.te
+
+(neverallow base_typeattr_608 hal_graphics_allocator_service (service_manager (add)))
+;;* lme
+
+;;* lmx 22 system/sepolicy/private/hal_graphics_allocator.te
+
+(neverallow base_typeattr_610 hal_graphics_allocator_service (service_manager (find)))
+;;* lme
+
+(allow hal_graphics_allocator_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_graphics_allocator_server (binder (transfer)))
+(allow hal_graphics_allocator_server servicemanager (fd (use)))
+(allow hal_graphics_allocator_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_graphics_allocator_client (binder (transfer)))
+(allow hal_graphics_allocator_client servicemanager (fd (use)))
+(allow hal_graphics_composer_client hal_graphics_composer_server (binder (call transfer)))
+(allow hal_graphics_composer_server hal_graphics_composer_client (binder (transfer)))
+(allow hal_graphics_composer_client hal_graphics_composer_server (fd (use)))
+(allow hal_graphics_composer_server hal_graphics_composer_client (binder (call transfer)))
+(allow hal_graphics_composer_client hal_graphics_composer_server (binder (transfer)))
+(allow hal_graphics_composer_server hal_graphics_composer_client (fd (use)))
+(allow hal_graphics_composer_client hal_graphics_composer_server_tmpfs (file (read write getattr map)))
+(allow hal_graphics_composer_server hal_graphics_composer_client_tmpfs (file (read write getattr map)))
+(allow hal_graphics_composer_client hal_graphics_composer_hwservice (hwservice_manager (find)))
+(allow hal_graphics_composer_server hal_graphics_composer_hwservice (hwservice_manager (add find)))
+(allow hal_graphics_composer_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 7 system/sepolicy/private/hal_graphics_composer.te
+
+(neverallow base_typeattr_611 hal_graphics_composer_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_graphics_composer.te
+
+(neverallow base_typeattr_612 hal_graphics_composer_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_graphics_composer_server hal_graphics_mapper_hwservice (hwservice_manager (find)))
+(allow hal_graphics_composer gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_graphics_composer gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_graphics_composer ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_graphics_composer dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_graphics_composer hal_graphics_allocator (fd (use)))
+(allow hal_graphics_composer graphics_device (dir (search)))
+(allow hal_graphics_composer graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_graphics_composer system_server (fd (use)))
+(allow hal_graphics_composer bootanim (fd (use)))
+(allow hal_graphics_composer appdomain (fd (use)))
+(allow hal_graphics_composer self (capability (sys_nice)))
+(allow hal_graphics_composer self (cap_userns (sys_nice)))
+(allow hal_graphics_composer_server hal_graphics_composer_client (fifo_file (write)))
+(allow hal_graphics_composer_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_graphics_composer_client (binder (transfer)))
+(allow hal_graphics_composer_client servicemanager (fd (use)))
+(allow hal_graphics_composer_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_graphics_composer_server (binder (transfer)))
+(allow hal_graphics_composer_server servicemanager (fd (use)))
+(allow hal_graphics_composer_client hal_graphics_composer_service (service_manager (find)))
+(allow hal_graphics_composer_server hal_graphics_composer_service (service_manager (add find)))
+;;* lmx 38 system/sepolicy/private/hal_graphics_composer.te
+
+(neverallow base_typeattr_611 hal_graphics_composer_service (service_manager (add)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/hal_graphics_composer.te
+
+(neverallow base_typeattr_613 hal_graphics_composer_service (service_manager (find)))
+;;* lme
+
+(allow hal_health_client hal_health_server (binder (call transfer)))
+(allow hal_health_server hal_health_client (binder (transfer)))
+(allow hal_health_client hal_health_server (fd (use)))
+(allow hal_health_server hal_health_client (binder (call transfer)))
+(allow hal_health_client hal_health_server (binder (transfer)))
+(allow hal_health_server hal_health_client (fd (use)))
+(allow hal_health_client hal_health_hwservice (hwservice_manager (find)))
+(allow hal_health_server hal_health_hwservice (hwservice_manager (add find)))
+(allow hal_health_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_health.te
+
+(neverallow base_typeattr_614 hal_health_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_health.te
+
+(neverallow base_typeattr_615 hal_health_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_health_client hal_health_service (service_manager (find)))
+(allow hal_health_server hal_health_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_health.te
+
+(neverallow base_typeattr_614 hal_health_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_health.te
+
+(neverallow base_typeattr_616 hal_health_service (service_manager (find)))
+;;* lme
+
+(allow hal_health_server self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_health_server sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_health_server sysfs_batteryinfo (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_health_server sysfs_batteryinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_health_server sysfs_batteryinfo (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_health_server sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_health_server self (capability2 (block_suspend)))
+(allow hal_health_server self (cap2_userns (block_suspend)))
+(allow hal_health_server system_suspend_server (binder (call transfer)))
+(allow system_suspend_server hal_health_server (binder (transfer)))
+(allow hal_health_server system_suspend_server (fd (use)))
+(allow hal_health_server system_suspend_hwservice (hwservice_manager (find)))
+(allow hal_health_server hwservicemanager (binder (call transfer)))
+(allow hwservicemanager hal_health_server (binder (call transfer)))
+(allow hwservicemanager hal_health_server (dir (search)))
+(allow hwservicemanager hal_health_server (file (read map open)))
+(allow hwservicemanager hal_health_server (process (getattr)))
+(allow hal_health_server hwservicemanager_prop (file (read getattr map open)))
+(allow hal_health_server hidl_manager_hwservice (hwservice_manager (find)))
+(allow hal_health_server hal_system_suspend_service (service_manager (find)))
+(allow hal_health_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_health_server (binder (call transfer)))
+(allow servicemanager hal_health_server (dir (search)))
+(allow servicemanager hal_health_server (file (read open)))
+(allow servicemanager hal_health_server (process (getattr)))
+(allow hal_health_server kmsg_device (chr_file (write getattr lock append map open)))
+(allow hal_health_server self (capability2 (wake_alarm)))
+(allow hal_health_server fs_bpf_vendor (dir (search)))
+(allow hal_health_server fs_bpf_vendor (file (read)))
+(allow hal_health_server bpfloader (bpf (prog_run)))
+(allow hal_health_storage_client hal_health_storage_server (binder (call transfer)))
+(allow hal_health_storage_server hal_health_storage_client (binder (transfer)))
+(allow hal_health_storage_client hal_health_storage_server (fd (use)))
+(allow hal_health_storage_server hal_health_storage_client (binder (call transfer)))
+(allow hal_health_storage_client hal_health_storage_server (binder (transfer)))
+(allow hal_health_storage_server hal_health_storage_client (fd (use)))
+(allow hal_health_storage_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_health_storage_server (binder (call transfer)))
+(allow servicemanager hal_health_storage_server (dir (search)))
+(allow servicemanager hal_health_storage_server (file (read open)))
+(allow servicemanager hal_health_storage_server (process (getattr)))
+(allow hal_health_storage_client hal_health_storage_hwservice (hwservice_manager (find)))
+(allow hal_health_storage_server hal_health_storage_hwservice (hwservice_manager (add find)))
+(allow hal_health_storage_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 7 system/sepolicy/private/hal_health_storage.te
+
+(neverallow base_typeattr_617 hal_health_storage_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_health_storage.te
+
+(neverallow base_typeattr_618 hal_health_storage_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_health_storage_client hal_health_storage_service (service_manager (find)))
+(allow hal_health_storage_server hal_health_storage_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/hal_health_storage.te
+
+(neverallow base_typeattr_617 hal_health_storage_service (service_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_health_storage.te
+
+(neverallow base_typeattr_619 hal_health_storage_service (service_manager (find)))
+;;* lme
+
+(allow hal_health_storage_server gsi_metadata_file_type (dir (search)))
+(allow hal_health_storage_server metadata_file (dir (search)))
+(allow hal_health_storage_server gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_health_storage_server proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_health_storage_server proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_identity_client hal_identity_server (binder (call transfer)))
+(allow hal_identity_server hal_identity_client (binder (transfer)))
+(allow hal_identity_client hal_identity_server (fd (use)))
+(allow hal_identity_client hal_identity_service (service_manager (find)))
+(allow hal_identity_server hal_identity_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_identity.te
+
+(neverallow base_typeattr_620 hal_identity_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_identity.te
+
+(neverallow base_typeattr_621 hal_identity_service (service_manager (find)))
+;;* lme
+
+(allow hal_identity_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_identity_server (binder (transfer)))
+(allow hal_identity_server servicemanager (fd (use)))
+(allow hal_input_classifier_client hal_input_classifier_server (binder (call transfer)))
+(allow hal_input_classifier_server hal_input_classifier_client (binder (transfer)))
+(allow hal_input_classifier_client hal_input_classifier_server (fd (use)))
+(allow hal_input_classifier_client hal_input_classifier_hwservice (hwservice_manager (find)))
+(allow hal_input_classifier_server hal_input_classifier_hwservice (hwservice_manager (add find)))
+(allow hal_input_classifier_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_input_classifier.te
+
+(neverallow base_typeattr_622 hal_input_classifier_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_input_classifier.te
+
+(neverallow base_typeattr_623 hal_input_classifier_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_input_processor_client hal_input_processor_server (binder (call transfer)))
+(allow hal_input_processor_server hal_input_processor_client (binder (transfer)))
+(allow hal_input_processor_client hal_input_processor_server (fd (use)))
+(allow hal_input_processor_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_input_processor_server (binder (transfer)))
+(allow hal_input_processor_server servicemanager (fd (use)))
+(allow hal_input_processor_client hal_input_processor_service (service_manager (find)))
+(allow hal_input_processor_server hal_input_processor_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_input_processor.te
+
+(neverallow base_typeattr_624 hal_input_processor_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_input_processor.te
+
+(neverallow base_typeattr_625 hal_input_processor_service (service_manager (find)))
+;;* lme
+
+(allow hal_input_processor_server dumpstate (fifo_file (write)))
+(allow hal_ir_client hal_ir_server (binder (call transfer)))
+(allow hal_ir_server hal_ir_client (binder (transfer)))
+(allow hal_ir_client hal_ir_server (fd (use)))
+(allow hal_ir_server hal_ir_client (binder (call transfer)))
+(allow hal_ir_client hal_ir_server (binder (transfer)))
+(allow hal_ir_server hal_ir_client (fd (use)))
+(allow hal_ir_client hal_ir_service (service_manager (find)))
+(allow hal_ir_server hal_ir_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_ir.te
+
+(neverallow base_typeattr_626 hal_ir_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_ir.te
+
+(neverallow base_typeattr_627 hal_ir_service (service_manager (find)))
+;;* lme
+
+(allow hal_ir_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_ir_server (binder (transfer)))
+(allow hal_ir_server servicemanager (fd (use)))
+(allow hal_ir_client hal_ir_hwservice (hwservice_manager (find)))
+(allow hal_ir_server hal_ir_hwservice (hwservice_manager (add find)))
+(allow hal_ir_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 8 system/sepolicy/private/hal_ir.te
+
+(neverallow base_typeattr_626 hal_ir_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_ir.te
+
+(neverallow base_typeattr_628 hal_ir_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_ivn_client hal_ivn_server (binder (call transfer)))
+(allow hal_ivn_server hal_ivn_client (binder (transfer)))
+(allow hal_ivn_client hal_ivn_server (fd (use)))
+(allow hal_ivn_client hal_ivn_service (service_manager (find)))
+(allow hal_ivn_server hal_ivn_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_ivn.te
+
+(neverallow base_typeattr_629 hal_ivn_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_ivn.te
+
+(neverallow base_typeattr_630 hal_ivn_service (service_manager (find)))
+;;* lme
+
+(allow hal_keymaster_client hal_keymaster_server (binder (call transfer)))
+(allow hal_keymaster_server hal_keymaster_client (binder (transfer)))
+(allow hal_keymaster_client hal_keymaster_server (fd (use)))
+(allow hal_keymaster_client hal_keymaster_hwservice (hwservice_manager (find)))
+(allow hal_keymaster_server hal_keymaster_hwservice (hwservice_manager (add find)))
+(allow hal_keymaster_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_keymaster.te
+
+(neverallow base_typeattr_631 hal_keymaster_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_keymaster.te
+
+(neverallow base_typeattr_632 hal_keymaster_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_keymaster tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_keymaster ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_keymint_client hal_keymint_server (binder (call transfer)))
+(allow hal_keymint_server hal_keymint_client (binder (transfer)))
+(allow hal_keymint_client hal_keymint_server (fd (use)))
+(allow hal_keymint_client hal_keymint_service (service_manager (find)))
+(allow hal_keymint_server hal_keymint_service (service_manager (add find)))
+;;* lmx 3 system/sepolicy/private/hal_keymint.te
+
+(neverallow base_typeattr_633 hal_keymint_service (service_manager (add)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/hal_keymint.te
+
+(neverallow base_typeattr_634 hal_keymint_service (service_manager (find)))
+;;* lme
+
+(allow hal_keymint_client hal_remotelyprovisionedcomponent_service (service_manager (find)))
+(allow hal_keymint_server hal_remotelyprovisionedcomponent_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_keymint.te
+
+(neverallow base_typeattr_633 hal_remotelyprovisionedcomponent_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_keymint.te
+
+(neverallow base_typeattr_634 hal_remotelyprovisionedcomponent_service (service_manager (find)))
+;;* lme
+
+(allow hal_keymint_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_keymint_server (binder (transfer)))
+(allow hal_keymint_server servicemanager (fd (use)))
+(allow base_typeattr_635 tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow base_typeattr_635 ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init hal_keymint_system_exec (file (read getattr map execute open)))
+(allow init hal_keymint_system (process (transition)))
+(allow hal_keymint_system hal_keymint_system_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init hal_keymint_system (process (noatsecure)))
+(allow init hal_keymint_system (process (siginh rlimitinh)))
+(typetransition init hal_keymint_system_exec process hal_keymint_system)
+(allow hal_keymint_system self (vsock_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_light_client hal_light_server (binder (call transfer)))
+(allow hal_light_server hal_light_client (binder (transfer)))
+(allow hal_light_client hal_light_server (fd (use)))
+(allow hal_light_server hal_light_client (binder (call transfer)))
+(allow hal_light_client hal_light_server (binder (transfer)))
+(allow hal_light_server hal_light_client (fd (use)))
+(allow hal_light_client hal_light_hwservice (hwservice_manager (find)))
+(allow hal_light_server hal_light_hwservice (hwservice_manager (add find)))
+(allow hal_light_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_light.te
+
+(neverallow base_typeattr_636 hal_light_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_light.te
+
+(neverallow base_typeattr_637 hal_light_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_light_client hal_light_service (service_manager (find)))
+(allow hal_light_server hal_light_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_light.te
+
+(neverallow base_typeattr_636 hal_light_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_light.te
+
+(neverallow base_typeattr_638 hal_light_service (service_manager (find)))
+;;* lme
+
+(allow hal_light_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_light_server (binder (transfer)))
+(allow hal_light_server servicemanager (fd (use)))
+(allow hal_light_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_light_client (binder (call transfer)))
+(allow servicemanager hal_light_client (dir (search)))
+(allow servicemanager hal_light_client (file (read open)))
+(allow servicemanager hal_light_client (process (getattr)))
+(allow hal_light_server dumpstate (fifo_file (write)))
+(allow hal_light sysfs_leds (lnk_file (read)))
+(allow hal_light sysfs_leds (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_light sysfs_leds (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_lowpan_client hal_lowpan_server (binder (call transfer)))
+(allow hal_lowpan_server hal_lowpan_client (binder (transfer)))
+(allow hal_lowpan_client hal_lowpan_server (fd (use)))
+(allow hal_lowpan_server hal_lowpan_client (binder (call transfer)))
+(allow hal_lowpan_client hal_lowpan_server (binder (transfer)))
+(allow hal_lowpan_server hal_lowpan_client (fd (use)))
+(allow hal_lowpan_client hal_lowpan_hwservice (hwservice_manager (find)))
+(allow hal_lowpan_server hal_lowpan_hwservice (hwservice_manager (add find)))
+(allow hal_lowpan_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 7 system/sepolicy/private/hal_lowpan.te
+
+(neverallow base_typeattr_639 hal_lowpan_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_lowpan.te
+
+(neverallow base_typeattr_640 hal_lowpan_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_lowpan_server property_socket (sock_file (write)))
+(allow hal_lowpan_server init (unix_stream_socket (connectto)))
+(allow hal_lowpan_server lowpan_prop (property_service (set)))
+(allow hal_lowpan_server lowpan_prop (file (read getattr map open)))
+(allow hal_lowpan_server lowpan_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 20 system/sepolicy/private/hal_lowpan.te
+
+(neverallow base_typeattr_641 lowpan_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow hal_macsec_client hal_macsec_server (binder (call transfer)))
+(allow hal_macsec_server hal_macsec_client (binder (transfer)))
+(allow hal_macsec_client hal_macsec_server (fd (use)))
+(allow hal_macsec_server hal_macsec_client (binder (call transfer)))
+(allow hal_macsec_client hal_macsec_server (binder (transfer)))
+(allow hal_macsec_server hal_macsec_client (fd (use)))
+(allow hal_macsec_client hal_macsec_service (service_manager (find)))
+(allow hal_macsec_server hal_macsec_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_macsec.te
+
+(neverallow base_typeattr_642 hal_macsec_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_macsec.te
+
+(neverallow base_typeattr_643 hal_macsec_service (service_manager (find)))
+;;* lme
+
+(allow hal_macsec_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_macsec_server (binder (call transfer)))
+(allow servicemanager hal_macsec_server (dir (search)))
+(allow servicemanager hal_macsec_server (file (read open)))
+(allow servicemanager hal_macsec_server (process (getattr)))
+(allow hal_mediaquality_client hal_mediaquality_server (binder (call transfer)))
+(allow hal_mediaquality_server hal_mediaquality_client (binder (transfer)))
+(allow hal_mediaquality_client hal_mediaquality_server (fd (use)))
+(allow hal_mediaquality_server hal_mediaquality_client (binder (call transfer)))
+(allow hal_mediaquality_client hal_mediaquality_server (binder (transfer)))
+(allow hal_mediaquality_server hal_mediaquality_client (fd (use)))
+(allow hal_mediaquality_client hal_mediaquality_service (service_manager (find)))
+(allow hal_mediaquality_server hal_mediaquality_service (service_manager (add find)))
+;;* lmx 1 system/sepolicy/private/hal_mediaquality.te
+
+(neverallow base_typeattr_644 hal_mediaquality_service (service_manager (add)))
+;;* lme
+
+;;* lmx 1 system/sepolicy/private/hal_mediaquality.te
+
+(neverallow base_typeattr_645 hal_mediaquality_service (service_manager (find)))
+;;* lme
+
+(allow hal_mediaquality_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_mediaquality_server (binder (transfer)))
+(allow hal_mediaquality_server servicemanager (fd (use)))
+(allow hal_mediaquality_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_mediaquality_client (binder (transfer)))
+(allow hal_mediaquality_client servicemanager (fd (use)))
+(allow hal_memtrack_client hal_memtrack_server (binder (call transfer)))
+(allow hal_memtrack_server hal_memtrack_client (binder (transfer)))
+(allow hal_memtrack_client hal_memtrack_server (fd (use)))
+(allow hal_memtrack_client hal_memtrack_hwservice (hwservice_manager (find)))
+(allow hal_memtrack_server hal_memtrack_hwservice (hwservice_manager (add find)))
+(allow hal_memtrack_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_memtrack.te
+
+(neverallow base_typeattr_646 hal_memtrack_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_memtrack.te
+
+(neverallow base_typeattr_647 hal_memtrack_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_memtrack_client hal_memtrack_service (service_manager (find)))
+(allow hal_memtrack_server hal_memtrack_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_memtrack.te
+
+(neverallow base_typeattr_646 hal_memtrack_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_memtrack.te
+
+(neverallow base_typeattr_648 hal_memtrack_service (service_manager (find)))
+;;* lme
+
+(allow hal_memtrack_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_memtrack_server (binder (transfer)))
+(allow hal_memtrack_server servicemanager (fd (use)))
+(allow hal_neuralnetworks_client hal_neuralnetworks_server (binder (call transfer)))
+(allow hal_neuralnetworks_server hal_neuralnetworks_client (binder (transfer)))
+(allow hal_neuralnetworks_client hal_neuralnetworks_server (fd (use)))
+(allow hal_neuralnetworks_server hal_neuralnetworks_client (binder (call transfer)))
+(allow hal_neuralnetworks_client hal_neuralnetworks_server (binder (transfer)))
+(allow hal_neuralnetworks_server hal_neuralnetworks_client (fd (use)))
+(allow hal_neuralnetworks_client hal_neuralnetworks_hwservice (hwservice_manager (find)))
+(allow hal_neuralnetworks_server hal_neuralnetworks_hwservice (hwservice_manager (add find)))
+(allow hal_neuralnetworks_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_neuralnetworks.te
+
+(neverallow base_typeattr_649 hal_neuralnetworks_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_neuralnetworks.te
+
+(neverallow base_typeattr_650 hal_neuralnetworks_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_neuralnetworks hidl_memory_hwservice (hwservice_manager (find)))
+(allow hal_neuralnetworks hal_allocator (fd (use)))
+(allow hal_neuralnetworks hal_graphics_mapper_hwservice (hwservice_manager (find)))
+(allow hal_neuralnetworks hal_graphics_allocator (fd (use)))
+(allow hal_neuralnetworks gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_neuralnetworks gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_neuralnetworks_server app_data_file (file (read write getattr map)))
+(allow hal_neuralnetworks_server privapp_data_file (file (read write getattr map)))
+(allow hal_neuralnetworks_server shell_data_file (file (read write getattr map)))
+(allow hal_neuralnetworks_server ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_neuralnetworks_server storage_file (file (read getattr map)))
+(allow hal_neuralnetworks_server apk_data_file (file (read getattr map)))
+(allow hal_neuralnetworks_client nnapi_ext_deny_product_prop (file (read getattr map open)))
+(allow hal_neuralnetworks_client device_config_nnapi_native_prop (file (read getattr map open)))
+;;* lmx 39 system/sepolicy/private/hal_neuralnetworks.te
+
+(neverallow base_typeattr_235 nnapi_ext_deny_product_prop (property_service (set)))
+;;* lme
+
+(allow hal_neuralnetworks_client hal_neuralnetworks_service (service_manager (find)))
+(allow hal_neuralnetworks_server hal_neuralnetworks_service (service_manager (add find)))
+;;* lmx 42 system/sepolicy/private/hal_neuralnetworks.te
+
+(neverallow base_typeattr_649 hal_neuralnetworks_service (service_manager (add)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/hal_neuralnetworks.te
+
+(neverallow base_typeattr_651 hal_neuralnetworks_service (service_manager (find)))
+;;* lme
+
+(allow hal_neuralnetworks_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_neuralnetworks_server (binder (transfer)))
+(allow hal_neuralnetworks_server servicemanager (fd (use)))
+(allow hal_neuralnetworks_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_neuralnetworks_server (binder (call transfer)))
+(allow servicemanager hal_neuralnetworks_server (dir (search)))
+(allow servicemanager hal_neuralnetworks_server (file (read open)))
+(allow servicemanager hal_neuralnetworks_server (process (getattr)))
+(allow hal_neuralnetworks_server dumpstate (fifo_file (write)))
+;;* lmx 17 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_652 self (capability (net_admin net_raw)))
+(neverallow base_typeattr_652 self (cap_userns (net_admin net_raw)))
+;;* lme
+
+;;* lmx 40 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_653 domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow base_typeattr_653 domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_654 domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/hal_neverallows.te
+
+(neverallow hal_uwb_vendor_server self (capability (net_raw)))
+(neverallow hal_uwb_vendor_server self (cap_userns (net_raw)))
+;;* lme
+
+;;* lmx 65 system/sepolicy/private/hal_neverallows.te
+
+(neverallow hal_uwb_vendor_server domain (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_route_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh)))
+(neverallow hal_uwb_vendor_server domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow hal_uwb_vendor_server domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow hal_uwb_vendor_server domain (netlink_selinux_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow hal_uwb_vendor_server domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow hal_uwb_vendor_server domain (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow hal_uwb_vendor_server domain (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 98 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_655 base_typeattr_656 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 100 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_235 halserverdomain (process (transition)))
+;;* lme
+
+;;* lmx 104 system/sepolicy/private/hal_neverallows.te
+
+(neverallow base_typeattr_236 halserverdomain (process (dyntransition)))
+;;* lme
+
+(allow hal_nfc_client hal_nfc_server (binder (call transfer)))
+(allow hal_nfc_server hal_nfc_client (binder (transfer)))
+(allow hal_nfc_client hal_nfc_server (fd (use)))
+(allow hal_nfc_server hal_nfc_client (binder (call transfer)))
+(allow hal_nfc_client hal_nfc_server (binder (transfer)))
+(allow hal_nfc_server hal_nfc_client (fd (use)))
+(allow hal_nfc_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_nfc_server (binder (transfer)))
+(allow hal_nfc_server servicemanager (fd (use)))
+(allow hal_nfc_client hal_nfc_hwservice (hwservice_manager (find)))
+(allow hal_nfc_server hal_nfc_hwservice (hwservice_manager (add find)))
+(allow hal_nfc_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hal_nfc.te
+
+(neverallow base_typeattr_657 hal_nfc_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_nfc.te
+
+(neverallow base_typeattr_658 hal_nfc_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_nfc_client hal_nfc_service (service_manager (find)))
+(allow hal_nfc_server hal_nfc_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_nfc.te
+
+(neverallow base_typeattr_657 hal_nfc_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_nfc.te
+
+(neverallow base_typeattr_659 hal_nfc_service (service_manager (find)))
+;;* lme
+
+(allow hal_nfc property_socket (sock_file (write)))
+(allow hal_nfc init (unix_stream_socket (connectto)))
+(allow hal_nfc nfc_prop (property_service (set)))
+(allow hal_nfc nfc_prop (file (read getattr map open)))
+(allow hal_nfc nfc_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_nlinterceptor_client hal_nlinterceptor_server (binder (call transfer)))
+(allow hal_nlinterceptor_server hal_nlinterceptor_client (binder (transfer)))
+(allow hal_nlinterceptor_client hal_nlinterceptor_server (fd (use)))
+(allow hal_nlinterceptor_client hal_nlinterceptor_service (service_manager (find)))
+(allow hal_nlinterceptor_server hal_nlinterceptor_service (service_manager (add find)))
+;;* lmx 3 system/sepolicy/private/hal_nlinterceptor.te
+
+(neverallow base_typeattr_660 hal_nlinterceptor_service (service_manager (add)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/hal_nlinterceptor.te
+
+(neverallow base_typeattr_661 hal_nlinterceptor_service (service_manager (find)))
+;;* lme
+
+(allow hal_nlinterceptor servicemanager (binder (call transfer)))
+(allow servicemanager hal_nlinterceptor (binder (transfer)))
+(allow hal_nlinterceptor servicemanager (fd (use)))
+(allow hal_nlinterceptor self (capability (net_admin)))
+(allow hal_nlinterceptor self (cap_userns (net_admin)))
+(allow hal_nlinterceptor self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_nlinterceptor self (netlink_route_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_write nlmsg_readpriv)))
+(allow hal_oemlock_client hal_oemlock_server (binder (call transfer)))
+(allow hal_oemlock_server hal_oemlock_client (binder (transfer)))
+(allow hal_oemlock_client hal_oemlock_server (fd (use)))
+(allow hal_oemlock_client hal_oemlock_hwservice (hwservice_manager (find)))
+(allow hal_oemlock_server hal_oemlock_hwservice (hwservice_manager (add find)))
+(allow hal_oemlock_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_oemlock.te
+
+(neverallow base_typeattr_662 hal_oemlock_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_oemlock.te
+
+(neverallow base_typeattr_663 hal_oemlock_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_oemlock_client hal_oemlock_service (service_manager (find)))
+(allow hal_oemlock_server hal_oemlock_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_oemlock.te
+
+(neverallow base_typeattr_662 hal_oemlock_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_oemlock.te
+
+(neverallow base_typeattr_664 hal_oemlock_service (service_manager (find)))
+;;* lme
+
+(allow hal_oemlock_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_oemlock_server (binder (transfer)))
+(allow hal_oemlock_server servicemanager (fd (use)))
+(allow hal_omx_server binderservicedomain (binder (call transfer)))
+(allow binderservicedomain hal_omx_server (binder (transfer)))
+(allow hal_omx_server binderservicedomain (fd (use)))
+(allow hal_omx_server base_typeattr_560 (binder (call transfer)))
+(allow base_typeattr_560 hal_omx_server (binder (transfer)))
+(allow hal_omx_server base_typeattr_560 (fd (use)))
+(allow hal_omx_server hal_graphics_composer (fd (use)))
+(allow hal_omx_server ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_omx_server hal_camera (fd (use)))
+(allow hal_omx_server anr_data_file (file (append)))
+(allow hal_omx_server dumpstate (fd (use)))
+(allow hal_omx_server incidentd (fd (use)))
+(allow hal_omx_server dumpstate (fifo_file (write append)))
+(allow hal_omx_server incidentd (fifo_file (write append)))
+(allow hal_omx_server system_server (fifo_file (write append)))
+(allow hal_omx_server tombstoned (unix_stream_socket (connectto)))
+(allow hal_omx_server tombstoned (fd (use)))
+(allow hal_omx_server tombstoned_crash_socket (sock_file (write)))
+(allow hal_omx_server tombstone_data_file (file (append)))
+(allow hal_omx_server bufferhubd (fd (use)))
+(allow hal_omx_client hal_omx_hwservice (hwservice_manager (find)))
+(allow hal_omx_server hal_omx_hwservice (hwservice_manager (add find)))
+(allow hal_omx_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 21 system/sepolicy/private/hal_omx.te
+
+(neverallow base_typeattr_665 hal_omx_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 21 system/sepolicy/private/hal_omx.te
+
+(neverallow base_typeattr_666 hal_omx_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_omx_client hidl_token_hwservice (hwservice_manager (find)))
+(allow hal_omx_client media_variant_prop (file (read getattr map open)))
+(allow hal_omx_server media_variant_prop (file (read getattr map open)))
+(allow hal_omx_client hal_omx_server (binder (call transfer)))
+(allow hal_omx_server hal_omx_client (binder (transfer)))
+(allow hal_omx_client hal_omx_server (fd (use)))
+(allow hal_omx_server hal_omx_client (binder (call transfer)))
+(allow hal_omx_client hal_omx_server (binder (transfer)))
+(allow hal_omx_server hal_omx_client (fd (use)))
+;;* lmx 37 system/sepolicy/private/hal_omx.te
+
+(neverallow hal_omx_server fs_type (file (execute_no_trans)))
+(neverallow hal_omx_server file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/hal_omx.te
+
+(neverallow hal_omx_server domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow hal_omx_server domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/hal_omx.te
+
+(neverallow hal_omx_server domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(allow hal_power_client hal_power_server (binder (call transfer)))
+(allow hal_power_server hal_power_client (binder (transfer)))
+(allow hal_power_client hal_power_server (fd (use)))
+(allow hal_power_server hal_power_client (binder (call transfer)))
+(allow hal_power_client hal_power_server (binder (transfer)))
+(allow hal_power_server hal_power_client (fd (use)))
+(allow hal_power_client hal_power_hwservice (hwservice_manager (find)))
+(allow hal_power_server hal_power_hwservice (hwservice_manager (add find)))
+(allow hal_power_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_power.te
+
+(neverallow base_typeattr_667 hal_power_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_power.te
+
+(neverallow base_typeattr_668 hal_power_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_power_client hal_power_service (service_manager (find)))
+(allow hal_power_server hal_power_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_power.te
+
+(neverallow base_typeattr_667 hal_power_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_power.te
+
+(neverallow base_typeattr_669 hal_power_service (service_manager (find)))
+;;* lme
+
+(allow hal_power_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_power_server (binder (transfer)))
+(allow hal_power_server servicemanager (fd (use)))
+(allow hal_power_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_power_client (binder (transfer)))
+(allow hal_power_client servicemanager (fd (use)))
+(allow hal_power_server property_socket (sock_file (write)))
+(allow hal_power_server init (unix_stream_socket (connectto)))
+(allow hal_power_server dalvik_dynamic_config_prop (property_service (set)))
+(allow hal_power_server dalvik_dynamic_config_prop (file (read getattr map open)))
+(allow hal_power_stats_client hal_power_stats_server (binder (call transfer)))
+(allow hal_power_stats_server hal_power_stats_client (binder (transfer)))
+(allow hal_power_stats_client hal_power_stats_server (fd (use)))
+(allow hal_power_stats_server hal_power_stats_client (binder (call transfer)))
+(allow hal_power_stats_client hal_power_stats_server (binder (transfer)))
+(allow hal_power_stats_server hal_power_stats_client (fd (use)))
+(allow hal_power_stats_client hal_power_stats_hwservice (hwservice_manager (find)))
+(allow hal_power_stats_server hal_power_stats_hwservice (hwservice_manager (add find)))
+(allow hal_power_stats_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_power_stats.te
+
+(neverallow base_typeattr_670 hal_power_stats_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_power_stats.te
+
+(neverallow base_typeattr_671 hal_power_stats_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_power_stats_client hal_power_stats_service (service_manager (find)))
+(allow hal_power_stats_server hal_power_stats_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_power_stats.te
+
+(neverallow base_typeattr_670 hal_power_stats_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_power_stats.te
+
+(neverallow base_typeattr_672 hal_power_stats_service (service_manager (find)))
+;;* lme
+
+(allow hal_power_stats_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_power_stats_server (binder (transfer)))
+(allow hal_power_stats_server servicemanager (fd (use)))
+(allow hal_power_stats_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_power_stats_client (binder (transfer)))
+(allow hal_power_stats_client servicemanager (fd (use)))
+(allow hal_rebootescrow_client hal_rebootescrow_server (binder (call transfer)))
+(allow hal_rebootescrow_server hal_rebootescrow_client (binder (transfer)))
+(allow hal_rebootescrow_client hal_rebootescrow_server (fd (use)))
+(allow hal_rebootescrow_client hal_rebootescrow_service (service_manager (find)))
+(allow hal_rebootescrow_server hal_rebootescrow_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_rebootescrow.te
+
+(neverallow base_typeattr_673 hal_rebootescrow_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_rebootescrow.te
+
+(neverallow base_typeattr_674 hal_rebootescrow_service (service_manager (find)))
+;;* lme
+
+(allow hal_rebootescrow_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_rebootescrow_server (binder (call transfer)))
+(allow servicemanager hal_rebootescrow_server (dir (search)))
+(allow servicemanager hal_rebootescrow_server (file (read open)))
+(allow servicemanager hal_rebootescrow_server (process (getattr)))
+(allow hal_remoteaccess_client hal_remoteaccess_server (binder (call transfer)))
+(allow hal_remoteaccess_server hal_remoteaccess_client (binder (transfer)))
+(allow hal_remoteaccess_client hal_remoteaccess_server (fd (use)))
+(allow hal_remoteaccess_server hal_remoteaccess_client (binder (call transfer)))
+(allow hal_remoteaccess_client hal_remoteaccess_server (binder (transfer)))
+(allow hal_remoteaccess_server hal_remoteaccess_client (fd (use)))
+(allow hal_remoteaccess_client hal_remoteaccess_service (service_manager (find)))
+(allow hal_remoteaccess_server hal_remoteaccess_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_remoteaccess.te
+
+(neverallow base_typeattr_675 hal_remoteaccess_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_remoteaccess.te
+
+(neverallow base_typeattr_676 hal_remoteaccess_service (service_manager (find)))
+;;* lme
+
+(allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_server (binder (call transfer)))
+(allow hal_remotelyprovisionedcomponent_avf_server hal_remotelyprovisionedcomponent_avf_client (binder (transfer)))
+(allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_server (fd (use)))
+(allow hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_service (service_manager (find)))
+(allow hal_remotelyprovisionedcomponent_avf_server hal_remotelyprovisionedcomponent_avf_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_remotelyprovisionedcomponent_avf.te
+
+(neverallow base_typeattr_677 hal_remotelyprovisionedcomponent_avf_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_remotelyprovisionedcomponent_avf.te
+
+(neverallow base_typeattr_678 hal_remotelyprovisionedcomponent_avf_service (service_manager (find)))
+;;* lme
+
+(allow hal_remotelyprovisionedcomponent_avf_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_remotelyprovisionedcomponent_avf_server (binder (call transfer)))
+(allow servicemanager hal_remotelyprovisionedcomponent_avf_server (dir (search)))
+(allow servicemanager hal_remotelyprovisionedcomponent_avf_server (file (read open)))
+(allow servicemanager hal_remotelyprovisionedcomponent_avf_server (process (getattr)))
+(allow hal_secretkeeper_client hal_secretkeeper_server (binder (call transfer)))
+(allow hal_secretkeeper_server hal_secretkeeper_client (binder (transfer)))
+(allow hal_secretkeeper_client hal_secretkeeper_server (fd (use)))
+(allow hal_secretkeeper_client hal_secretkeeper_service (service_manager (find)))
+(allow hal_secretkeeper_server hal_secretkeeper_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_secretkeeper.te
+
+(neverallow base_typeattr_679 hal_secretkeeper_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_secretkeeper.te
+
+(neverallow base_typeattr_680 hal_secretkeeper_service (service_manager (find)))
+;;* lme
+
+(allow hal_secretkeeper_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_secretkeeper_server (binder (call transfer)))
+(allow servicemanager hal_secretkeeper_server (dir (search)))
+(allow servicemanager hal_secretkeeper_server (file (read open)))
+(allow servicemanager hal_secretkeeper_server (process (getattr)))
+(allow hal_secretkeeper_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_secretkeeper_client (binder (call transfer)))
+(allow servicemanager hal_secretkeeper_client (dir (search)))
+(allow servicemanager hal_secretkeeper_client (file (read open)))
+(allow servicemanager hal_secretkeeper_client (process (getattr)))
+(allow hal_secretkeeper_server tee_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_secure_element_client hal_secure_element_server (binder (call transfer)))
+(allow hal_secure_element_server hal_secure_element_client (binder (transfer)))
+(allow hal_secure_element_client hal_secure_element_server (fd (use)))
+(allow hal_secure_element_server hal_secure_element_client (binder (call transfer)))
+(allow hal_secure_element_client hal_secure_element_server (binder (transfer)))
+(allow hal_secure_element_server hal_secure_element_client (fd (use)))
+(allow hal_secure_element_client hal_secure_element_hwservice (hwservice_manager (find)))
+(allow hal_secure_element_server hal_secure_element_hwservice (hwservice_manager (add find)))
+(allow hal_secure_element_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_secure_element.te
+
+(neverallow base_typeattr_681 hal_secure_element_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_secure_element.te
+
+(neverallow base_typeattr_682 hal_secure_element_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_secure_element_client hal_secure_element_service (service_manager (find)))
+(allow hal_secure_element_server hal_secure_element_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_secure_element.te
+
+(neverallow base_typeattr_681 hal_secure_element_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_secure_element.te
+
+(neverallow base_typeattr_683 hal_secure_element_service (service_manager (find)))
+;;* lme
+
+(allow hal_secure_element_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_secure_element_server (binder (call transfer)))
+(allow servicemanager hal_secure_element_server (dir (search)))
+(allow servicemanager hal_secure_element_server (file (read open)))
+(allow servicemanager hal_secure_element_server (process (getattr)))
+(allow hal_secure_element_client hal_secure_element_service (service_manager (find)))
+(allow hal_sensors_client hal_sensors_server (binder (call transfer)))
+(allow hal_sensors_server hal_sensors_client (binder (transfer)))
+(allow hal_sensors_client hal_sensors_server (fd (use)))
+(allow hal_sensors_client hal_sensors_hwservice (hwservice_manager (find)))
+(allow hal_sensors_server hal_sensors_hwservice (hwservice_manager (add find)))
+(allow hal_sensors_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_sensors.te
+
+(neverallow base_typeattr_684 hal_sensors_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_sensors.te
+
+(neverallow base_typeattr_685 hal_sensors_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_sensors base_typeattr_560 (fd (use)))
+(allow hal_sensors hal_allocator (fd (use)))
+(allow hal_sensors self (capability (sys_nice)))
+(allow hal_sensors self (cap_userns (sys_nice)))
+(allow hal_sensors_server hal_sensors_service (service_manager (add find)))
+;;* lmx 16 system/sepolicy/private/hal_sensors.te
+
+(neverallow base_typeattr_684 hal_sensors_service (service_manager (add)))
+;;* lme
+
+(allow hal_sensors_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_sensors_server (binder (transfer)))
+(allow hal_sensors_server servicemanager (fd (use)))
+(allow hal_sensors_client hal_sensors_service (service_manager (find)))
+(allow hal_telephony_client hal_telephony_server (binder (call transfer)))
+(allow hal_telephony_server hal_telephony_client (binder (transfer)))
+(allow hal_telephony_client hal_telephony_server (fd (use)))
+(allow hal_telephony_server hal_telephony_client (binder (call transfer)))
+(allow hal_telephony_client hal_telephony_server (binder (transfer)))
+(allow hal_telephony_server hal_telephony_client (fd (use)))
+(allow hal_telephony_client hal_telephony_hwservice (hwservice_manager (find)))
+(allow hal_telephony_server hal_telephony_hwservice (hwservice_manager (add find)))
+(allow hal_telephony_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_telephony.te
+
+(neverallow base_typeattr_686 hal_telephony_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_telephony.te
+
+(neverallow base_typeattr_687 hal_telephony_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_telephony_client hal_radio_service (service_manager (find)))
+(allow hal_telephony_server hal_radio_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_telephony.te
+
+(neverallow base_typeattr_686 hal_radio_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_telephony.te
+
+(neverallow base_typeattr_688 hal_radio_service (service_manager (find)))
+;;* lme
+
+(allowx hal_telephony_server self (ioctl udp_socket (0x6900 0x6902)))
+(allowx hal_telephony_server self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx hal_telephony_server self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow hal_telephony_server self (netlink_route_socket (nlmsg_write)))
+(allow hal_telephony_server self (capability (setgid setuid setpcap net_admin net_raw)))
+(allow hal_telephony_server self (cap_userns (setgid setuid setpcap net_admin net_raw)))
+(allow hal_telephony_server cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow hal_telephony_server cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow hal_telephony_server cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server radio_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_telephony_server radio_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server efs_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow hal_telephony_server efs_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow hal_telephony_server vendor_shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow hal_telephony_server bluetooth_efs_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server bluetooth_efs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_telephony_server telephony_config_prop (file (read getattr map open)))
+(allow hal_telephony_server property_socket (sock_file (write)))
+(allow hal_telephony_server init (unix_stream_socket (connectto)))
+(allow hal_telephony_server radio_control_prop (property_service (set)))
+(allow hal_telephony_server radio_control_prop (file (read getattr map open)))
+(allow hal_telephony_server property_socket (sock_file (write)))
+(allow hal_telephony_server init (unix_stream_socket (connectto)))
+(allow hal_telephony_server radio_prop (property_service (set)))
+(allow hal_telephony_server radio_prop (file (read getattr map open)))
+(allow hal_telephony_server property_socket (sock_file (write)))
+(allow hal_telephony_server init (unix_stream_socket (connectto)))
+(allow hal_telephony_server telephony_status_prop (property_service (set)))
+(allow hal_telephony_server telephony_status_prop (file (read getattr map open)))
+(allow hal_telephony_server tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_telephony_server self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_telephony_server self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_telephony_server self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_telephony_server sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_telephony_server self (capability2 (block_suspend)))
+(allow hal_telephony_server self (cap2_userns (block_suspend)))
+(allow hal_telephony_server system_suspend_server (binder (call transfer)))
+(allow system_suspend_server hal_telephony_server (binder (transfer)))
+(allow hal_telephony_server system_suspend_server (fd (use)))
+(allow hal_telephony_server system_suspend_hwservice (hwservice_manager (find)))
+(allow hal_telephony_server hwservicemanager (binder (call transfer)))
+(allow hwservicemanager hal_telephony_server (binder (call transfer)))
+(allow hwservicemanager hal_telephony_server (dir (search)))
+(allow hwservicemanager hal_telephony_server (file (read map open)))
+(allow hwservicemanager hal_telephony_server (process (getattr)))
+(allow hal_telephony_server hwservicemanager_prop (file (read getattr map open)))
+(allow hal_telephony_server hidl_manager_hwservice (hwservice_manager (find)))
+(allow hal_telephony_server hal_system_suspend_service (service_manager (find)))
+(allow hal_telephony_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_telephony_server (binder (call transfer)))
+(allow servicemanager hal_telephony_server (dir (search)))
+(allow servicemanager hal_telephony_server (file (read open)))
+(allow servicemanager hal_telephony_server (process (getattr)))
+(allow hal_telephony_server proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_telephony_server proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_telephony_server sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server sysfs_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_telephony_server self (socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_telephony_server hal_telephony_server (binder (call transfer)))
+(allow hal_telephony_server hal_telephony_server (binder (transfer)))
+(allow hal_telephony_server hal_telephony_server (fd (use)))
+(allow hal_tetheroffload_client hal_tetheroffload_server (binder (call transfer)))
+(allow hal_tetheroffload_server hal_tetheroffload_client (binder (transfer)))
+(allow hal_tetheroffload_client hal_tetheroffload_server (fd (use)))
+(allow hal_tetheroffload_server hal_tetheroffload_client (binder (call transfer)))
+(allow hal_tetheroffload_client hal_tetheroffload_server (binder (transfer)))
+(allow hal_tetheroffload_server hal_tetheroffload_client (fd (use)))
+(allow hal_tetheroffload_client hal_tetheroffload_hwservice (hwservice_manager (find)))
+(allow hal_tetheroffload_server hal_tetheroffload_hwservice (hwservice_manager (add find)))
+(allow hal_tetheroffload_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_tetheroffload.te
+
+(neverallow base_typeattr_689 hal_tetheroffload_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_tetheroffload.te
+
+(neverallow base_typeattr_690 hal_tetheroffload_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_tetheroffload_client hal_tetheroffload_service (service_manager (find)))
+(allow hal_tetheroffload_server hal_tetheroffload_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_tetheroffload.te
+
+(neverallow base_typeattr_689 hal_tetheroffload_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_tetheroffload.te
+
+(neverallow base_typeattr_691 hal_tetheroffload_service (service_manager (find)))
+;;* lme
+
+(allow hal_tetheroffload_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tetheroffload_server (binder (call transfer)))
+(allow servicemanager hal_tetheroffload_server (dir (search)))
+(allow servicemanager hal_tetheroffload_server (file (read open)))
+(allow servicemanager hal_tetheroffload_server (process (getattr)))
+(allow hal_tetheroffload_server hal_tetheroffload_client (netlink_netfilter_socket (read write getattr setopt)))
+(allow hal_thermal_client hal_thermal_server (binder (call transfer)))
+(allow hal_thermal_server hal_thermal_client (binder (transfer)))
+(allow hal_thermal_client hal_thermal_server (fd (use)))
+(allow hal_thermal_server hal_thermal_client (binder (call transfer)))
+(allow hal_thermal_client hal_thermal_server (binder (transfer)))
+(allow hal_thermal_server hal_thermal_client (fd (use)))
+(allow hal_thermal_client hal_thermal_hwservice (hwservice_manager (find)))
+(allow hal_thermal_server hal_thermal_hwservice (hwservice_manager (add find)))
+(allow hal_thermal_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_thermal.te
+
+(neverallow base_typeattr_692 hal_thermal_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_thermal.te
+
+(neverallow base_typeattr_693 hal_thermal_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_thermal_client hal_thermal_service (service_manager (find)))
+(allow hal_thermal_server hal_thermal_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_thermal.te
+
+(neverallow base_typeattr_692 hal_thermal_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_thermal.te
+
+(neverallow base_typeattr_694 hal_thermal_service (service_manager (find)))
+;;* lme
+
+(allow hal_thermal_server hal_thermal_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/hal_thermal.te
+
+(neverallow base_typeattr_692 hal_thermal_service (service_manager (add)))
+;;* lme
+
+(allow hal_thermal_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_thermal_server (binder (transfer)))
+(allow hal_thermal_server servicemanager (fd (use)))
+(allow hal_thermal_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_thermal_client (binder (transfer)))
+(allow hal_thermal_client servicemanager (fd (use)))
+(allow hal_threadnetwork_client hal_threadnetwork_server (binder (call transfer)))
+(allow hal_threadnetwork_server hal_threadnetwork_client (binder (transfer)))
+(allow hal_threadnetwork_client hal_threadnetwork_server (fd (use)))
+(allow hal_threadnetwork_server hal_threadnetwork_client (binder (call transfer)))
+(allow hal_threadnetwork_client hal_threadnetwork_server (binder (transfer)))
+(allow hal_threadnetwork_server hal_threadnetwork_client (fd (use)))
+(allow hal_threadnetwork_client hal_threadnetwork_service (service_manager (find)))
+(allow hal_threadnetwork_server hal_threadnetwork_service (service_manager (add find)))
+;;* lmx 4 system/sepolicy/private/hal_threadnetwork.te
+
+(neverallow base_typeattr_695 hal_threadnetwork_service (service_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_threadnetwork.te
+
+(neverallow base_typeattr_696 hal_threadnetwork_service (service_manager (find)))
+;;* lme
+
+(allow hal_threadnetwork_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_threadnetwork_server (binder (transfer)))
+(allow hal_threadnetwork_server servicemanager (fd (use)))
+(allow hal_threadnetwork_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_threadnetwork_client (binder (transfer)))
+(allow hal_threadnetwork_client servicemanager (fd (use)))
+(allow hal_tv_cec_client hal_tv_cec_server (binder (call transfer)))
+(allow hal_tv_cec_server hal_tv_cec_client (binder (transfer)))
+(allow hal_tv_cec_client hal_tv_cec_server (fd (use)))
+(allow hal_tv_cec_server hal_tv_cec_client (binder (call transfer)))
+(allow hal_tv_cec_client hal_tv_cec_server (binder (transfer)))
+(allow hal_tv_cec_server hal_tv_cec_client (fd (use)))
+(allow hal_tv_cec_client hal_tv_cec_hwservice (hwservice_manager (find)))
+(allow hal_tv_cec_server hal_tv_cec_hwservice (hwservice_manager (add find)))
+(allow hal_tv_cec_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_tv_cec.te
+
+(neverallow base_typeattr_697 hal_tv_cec_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_tv_cec.te
+
+(neverallow base_typeattr_698 hal_tv_cec_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server (binder (call transfer)))
+(allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client (binder (transfer)))
+(allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server (fd (use)))
+(allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client (binder (call transfer)))
+(allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server (binder (transfer)))
+(allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_client (fd (use)))
+(allow hal_tv_hdmi_cec_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_cec_client (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_cec_client (dir (search)))
+(allow servicemanager hal_tv_hdmi_cec_client (file (read open)))
+(allow servicemanager hal_tv_hdmi_cec_client (process (getattr)))
+(allow hal_tv_hdmi_cec_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_cec_server (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_cec_server (dir (search)))
+(allow servicemanager hal_tv_hdmi_cec_server (file (read open)))
+(allow servicemanager hal_tv_hdmi_cec_server (process (getattr)))
+(allow hal_tv_hdmi_cec_client hal_tv_hdmi_cec_service (service_manager (find)))
+(allow hal_tv_hdmi_cec_server hal_tv_hdmi_cec_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_cec.te
+
+(neverallow base_typeattr_699 hal_tv_hdmi_cec_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_cec.te
+
+(neverallow base_typeattr_700 hal_tv_hdmi_cec_service (service_manager (find)))
+;;* lme
+
+(allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server (binder (call transfer)))
+(allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client (binder (transfer)))
+(allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server (fd (use)))
+(allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client (binder (call transfer)))
+(allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server (binder (transfer)))
+(allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_client (fd (use)))
+(allow hal_tv_hdmi_connection_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_connection_client (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_connection_client (dir (search)))
+(allow servicemanager hal_tv_hdmi_connection_client (file (read open)))
+(allow servicemanager hal_tv_hdmi_connection_client (process (getattr)))
+(allow hal_tv_hdmi_connection_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_connection_server (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_connection_server (dir (search)))
+(allow servicemanager hal_tv_hdmi_connection_server (file (read open)))
+(allow servicemanager hal_tv_hdmi_connection_server (process (getattr)))
+(allow hal_tv_hdmi_connection_client hal_tv_hdmi_connection_service (service_manager (find)))
+(allow hal_tv_hdmi_connection_server hal_tv_hdmi_connection_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_connection.te
+
+(neverallow base_typeattr_701 hal_tv_hdmi_connection_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_connection.te
+
+(neverallow base_typeattr_702 hal_tv_hdmi_connection_service (service_manager (find)))
+;;* lme
+
+(allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server (binder (call transfer)))
+(allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client (binder (transfer)))
+(allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server (fd (use)))
+(allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client (binder (call transfer)))
+(allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server (binder (transfer)))
+(allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_client (fd (use)))
+(allow hal_tv_hdmi_earc_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_earc_client (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_earc_client (dir (search)))
+(allow servicemanager hal_tv_hdmi_earc_client (file (read open)))
+(allow servicemanager hal_tv_hdmi_earc_client (process (getattr)))
+(allow hal_tv_hdmi_earc_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_earc_server (binder (call transfer)))
+(allow servicemanager hal_tv_hdmi_earc_server (dir (search)))
+(allow servicemanager hal_tv_hdmi_earc_server (file (read open)))
+(allow servicemanager hal_tv_hdmi_earc_server (process (getattr)))
+(allow hal_tv_hdmi_earc_client hal_tv_hdmi_earc_service (service_manager (find)))
+(allow hal_tv_hdmi_earc_server hal_tv_hdmi_earc_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_earc.te
+
+(neverallow base_typeattr_703 hal_tv_hdmi_earc_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_tv_hdmi_earc.te
+
+(neverallow base_typeattr_704 hal_tv_hdmi_earc_service (service_manager (find)))
+;;* lme
+
+(allow hal_tv_input_client hal_tv_input_server (binder (call transfer)))
+(allow hal_tv_input_server hal_tv_input_client (binder (transfer)))
+(allow hal_tv_input_client hal_tv_input_server (fd (use)))
+(allow hal_tv_input_server hal_tv_input_client (binder (call transfer)))
+(allow hal_tv_input_client hal_tv_input_server (binder (transfer)))
+(allow hal_tv_input_server hal_tv_input_client (fd (use)))
+(allow hal_tv_input_client hal_tv_input_hwservice (hwservice_manager (find)))
+(allow hal_tv_input_server hal_tv_input_hwservice (hwservice_manager (add find)))
+(allow hal_tv_input_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_tv_input.te
+
+(neverallow base_typeattr_705 hal_tv_input_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_tv_input.te
+
+(neverallow base_typeattr_706 hal_tv_input_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_tv_input_client hal_tv_input_service (service_manager (find)))
+(allow hal_tv_input_server hal_tv_input_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_tv_input.te
+
+(neverallow base_typeattr_705 hal_tv_input_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_tv_input.te
+
+(neverallow base_typeattr_707 hal_tv_input_service (service_manager (find)))
+;;* lme
+
+(allow hal_tv_input_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_input_server (binder (transfer)))
+(allow hal_tv_input_server servicemanager (fd (use)))
+(allow hal_tv_input_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_input_client (binder (transfer)))
+(allow hal_tv_input_client servicemanager (fd (use)))
+(allow hal_tv_tuner_client hal_tv_tuner_server (binder (call transfer)))
+(allow hal_tv_tuner_server hal_tv_tuner_client (binder (transfer)))
+(allow hal_tv_tuner_client hal_tv_tuner_server (fd (use)))
+(allow hal_tv_tuner_server hal_tv_tuner_client (binder (call transfer)))
+(allow hal_tv_tuner_client hal_tv_tuner_server (binder (transfer)))
+(allow hal_tv_tuner_server hal_tv_tuner_client (fd (use)))
+(allow hal_tv_tuner_client hal_tv_tuner_hwservice (hwservice_manager (find)))
+(allow hal_tv_tuner_server hal_tv_tuner_hwservice (hwservice_manager (add find)))
+(allow hal_tv_tuner_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_tv_tuner.te
+
+(neverallow base_typeattr_708 hal_tv_tuner_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_tv_tuner.te
+
+(neverallow base_typeattr_709 hal_tv_tuner_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_tv_tuner_client hal_tv_tuner_service (service_manager (find)))
+(allow hal_tv_tuner_server hal_tv_tuner_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_tv_tuner.te
+
+(neverallow base_typeattr_708 hal_tv_tuner_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_tv_tuner.te
+
+(neverallow base_typeattr_710 hal_tv_tuner_service (service_manager (find)))
+;;* lme
+
+(allow hal_tv_tuner_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_tuner_server (binder (transfer)))
+(allow hal_tv_tuner_server servicemanager (fd (use)))
+(allow hal_tv_tuner_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_tv_tuner_client (binder (transfer)))
+(allow hal_tv_tuner_client servicemanager (fd (use)))
+(allow hal_usb_client hal_usb_server (binder (call transfer)))
+(allow hal_usb_server hal_usb_client (binder (transfer)))
+(allow hal_usb_client hal_usb_server (fd (use)))
+(allow hal_usb_server hal_usb_client (binder (call transfer)))
+(allow hal_usb_client hal_usb_server (binder (transfer)))
+(allow hal_usb_server hal_usb_client (fd (use)))
+(allow hal_usb_client hal_usb_service (service_manager (find)))
+(allow hal_usb_server hal_usb_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_usb.te
+
+(neverallow base_typeattr_711 hal_usb_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_usb.te
+
+(neverallow base_typeattr_712 hal_usb_service (service_manager (find)))
+;;* lme
+
+(allow hal_usb_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_usb_server (binder (transfer)))
+(allow hal_usb_server servicemanager (fd (use)))
+(allow hal_usb_client hal_usb_hwservice (hwservice_manager (find)))
+(allow hal_usb_server hal_usb_hwservice (hwservice_manager (add find)))
+(allow hal_usb_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 8 system/sepolicy/private/hal_usb.te
+
+(neverallow base_typeattr_711 hal_usb_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_usb.te
+
+(neverallow base_typeattr_713 hal_usb_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_usb self (netlink_kobject_uevent_socket (create)))
+(allow hal_usb self (netlink_kobject_uevent_socket (setopt)))
+(allow hal_usb self (netlink_kobject_uevent_socket (getopt)))
+(allow hal_usb self (netlink_kobject_uevent_socket (bind)))
+(allow hal_usb self (netlink_kobject_uevent_socket (read)))
+(allow hal_usb sysfs (dir (open)))
+(allow hal_usb sysfs (dir (read)))
+(allow hal_usb sysfs (file (read)))
+(allow hal_usb sysfs (file (open)))
+(allow hal_usb sysfs (file (write)))
+(allow hal_usb sysfs (file (getattr)))
+(allow hal_usb_gadget_client hal_usb_gadget_server (binder (call transfer)))
+(allow hal_usb_gadget_server hal_usb_gadget_client (binder (transfer)))
+(allow hal_usb_gadget_client hal_usb_gadget_server (fd (use)))
+(allow hal_usb_gadget_server hal_usb_gadget_client (binder (call transfer)))
+(allow hal_usb_gadget_client hal_usb_gadget_server (binder (transfer)))
+(allow hal_usb_gadget_server hal_usb_gadget_client (fd (use)))
+(allow hal_usb_gadget_client hal_usb_gadget_service (service_manager (find)))
+(allow hal_usb_gadget_server hal_usb_gadget_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_usb_gadget.te
+
+(neverallow base_typeattr_714 hal_usb_gadget_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_usb_gadget.te
+
+(neverallow base_typeattr_715 hal_usb_gadget_service (service_manager (find)))
+;;* lme
+
+(allow hal_usb_gadget_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_usb_gadget_server (binder (transfer)))
+(allow hal_usb_gadget_server servicemanager (fd (use)))
+(allow hal_usb_gadget_client hal_usb_gadget_hwservice (hwservice_manager (find)))
+(allow hal_usb_gadget_server hal_usb_gadget_hwservice (hwservice_manager (add find)))
+(allow hal_usb_gadget_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 8 system/sepolicy/private/hal_usb_gadget.te
+
+(neverallow base_typeattr_714 hal_usb_gadget_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/hal_usb_gadget.te
+
+(neverallow base_typeattr_716 hal_usb_gadget_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_usb_gadget_server configfs (lnk_file (read create unlink)))
+(allow hal_usb_gadget_server configfs (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow hal_usb_gadget_server configfs (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow hal_usb_gadget_server functionfs (dir (read search)))
+(allow hal_usb_gadget_server functionfs (file (read)))
+(allow hal_usb_gadget_server proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_usb_gadget_server usb_uvc_enabled_prop (file (read getattr map open)))
+(allow hal_uwb_client hal_uwb_server (binder (call transfer)))
+(allow hal_uwb_server hal_uwb_client (binder (transfer)))
+(allow hal_uwb_client hal_uwb_server (fd (use)))
+(allow hal_uwb_server hal_uwb_client (binder (call transfer)))
+(allow hal_uwb_client hal_uwb_server (binder (transfer)))
+(allow hal_uwb_server hal_uwb_client (fd (use)))
+(allow hal_uwb_client hal_uwb_service (service_manager (find)))
+(allow hal_uwb_server hal_uwb_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_uwb.te
+
+(neverallow base_typeattr_717 hal_uwb_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_uwb.te
+
+(neverallow base_typeattr_718 hal_uwb_service (service_manager (find)))
+;;* lme
+
+(allow hal_uwb_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_uwb_server (binder (transfer)))
+(allow hal_uwb_server servicemanager (fd (use)))
+(allow hal_uwb_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_uwb_client (binder (transfer)))
+(allow hal_uwb_client servicemanager (fd (use)))
+(allow hal_vehicle_client hal_vehicle_server (binder (call transfer)))
+(allow hal_vehicle_server hal_vehicle_client (binder (transfer)))
+(allow hal_vehicle_client hal_vehicle_server (fd (use)))
+(allow hal_vehicle_server hal_vehicle_client (binder (call transfer)))
+(allow hal_vehicle_client hal_vehicle_server (binder (transfer)))
+(allow hal_vehicle_server hal_vehicle_client (fd (use)))
+(allow hal_vehicle_client hal_vehicle_hwservice (hwservice_manager (find)))
+(allow hal_vehicle_server hal_vehicle_hwservice (hwservice_manager (add find)))
+(allow hal_vehicle_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hal_vehicle.te
+
+(neverallow base_typeattr_719 hal_vehicle_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_vehicle.te
+
+(neverallow base_typeattr_720 hal_vehicle_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_vehicle_client hal_vehicle_service (service_manager (find)))
+(allow hal_vehicle_server hal_vehicle_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/hal_vehicle.te
+
+(neverallow base_typeattr_719 hal_vehicle_service (service_manager (add)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/hal_vehicle.te
+
+(neverallow base_typeattr_721 hal_vehicle_service (service_manager (find)))
+;;* lme
+
+(allow hal_vibrator_client hal_vibrator_server (binder (call transfer)))
+(allow hal_vibrator_server hal_vibrator_client (binder (transfer)))
+(allow hal_vibrator_client hal_vibrator_server (fd (use)))
+(allow hal_vibrator_server hal_vibrator_client (binder (call transfer)))
+(allow hal_vibrator_client hal_vibrator_server (binder (transfer)))
+(allow hal_vibrator_server hal_vibrator_client (fd (use)))
+(allow hal_vibrator_client hal_vibrator_hwservice (hwservice_manager (find)))
+(allow hal_vibrator_server hal_vibrator_hwservice (hwservice_manager (add find)))
+(allow hal_vibrator_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_vibrator.te
+
+(neverallow base_typeattr_722 hal_vibrator_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_vibrator.te
+
+(neverallow base_typeattr_723 hal_vibrator_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_vibrator_client hal_vibrator_service (service_manager (find)))
+(allow hal_vibrator_server hal_vibrator_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_vibrator.te
+
+(neverallow base_typeattr_722 hal_vibrator_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_vibrator.te
+
+(neverallow base_typeattr_724 hal_vibrator_service (service_manager (find)))
+;;* lme
+
+(allow hal_vibrator_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_vibrator_server (binder (transfer)))
+(allow hal_vibrator_server servicemanager (fd (use)))
+(allow hal_vibrator_server dumpstate (fifo_file (write)))
+(allow hal_vibrator sysfs_vibrator (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow hal_vibrator sysfs_vibrator (dir (search)))
+(allow hal_vibrator fwk_vibrator_control_service (service_manager (find)))
+(allow hal_vm_capabilities_client hal_vm_capabilities_server (binder (call transfer)))
+(allow hal_vm_capabilities_server hal_vm_capabilities_client (binder (transfer)))
+(allow hal_vm_capabilities_client hal_vm_capabilities_server (fd (use)))
+(allow hal_vm_capabilities_client hal_vm_capabilities_service (service_manager (find)))
+(allow hal_vm_capabilities_server hal_vm_capabilities_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_vm_capabilities.te
+
+(neverallow base_typeattr_725 hal_vm_capabilities_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_vm_capabilities.te
+
+(neverallow base_typeattr_726 hal_vm_capabilities_service (service_manager (find)))
+;;* lme
+
+(allow hal_vm_capabilities_client servicemanager (binder (call transfer)))
+(allow servicemanager hal_vm_capabilities_client (binder (call transfer)))
+(allow servicemanager hal_vm_capabilities_client (dir (search)))
+(allow servicemanager hal_vm_capabilities_client (file (read open)))
+(allow servicemanager hal_vm_capabilities_client (process (getattr)))
+(allow hal_vm_capabilities_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_vm_capabilities_server (binder (call transfer)))
+(allow servicemanager hal_vm_capabilities_server (dir (search)))
+(allow servicemanager hal_vm_capabilities_server (file (read open)))
+(allow servicemanager hal_vm_capabilities_server (process (getattr)))
+(allow hal_vr_client hal_vr_server (binder (call transfer)))
+(allow hal_vr_server hal_vr_client (binder (transfer)))
+(allow hal_vr_client hal_vr_server (fd (use)))
+(allow hal_vr_server hal_vr_client (binder (call transfer)))
+(allow hal_vr_client hal_vr_server (binder (transfer)))
+(allow hal_vr_server hal_vr_client (fd (use)))
+(allow hal_vr_client hal_vr_hwservice (hwservice_manager (find)))
+(allow hal_vr_server hal_vr_hwservice (hwservice_manager (add find)))
+(allow hal_vr_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_vr.te
+
+(neverallow base_typeattr_727 hal_vr_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_vr.te
+
+(neverallow base_typeattr_728 hal_vr_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_weaver_client hal_weaver_server (binder (call transfer)))
+(allow hal_weaver_server hal_weaver_client (binder (transfer)))
+(allow hal_weaver_client hal_weaver_server (fd (use)))
+(allow hal_weaver_client hal_weaver_hwservice (hwservice_manager (find)))
+(allow hal_weaver_server hal_weaver_hwservice (hwservice_manager (add find)))
+(allow hal_weaver_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 4 system/sepolicy/private/hal_weaver.te
+
+(neverallow base_typeattr_729 hal_weaver_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/hal_weaver.te
+
+(neverallow base_typeattr_730 hal_weaver_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_weaver_client hal_weaver_service (service_manager (find)))
+(allow hal_weaver_server hal_weaver_service (service_manager (add find)))
+;;* lmx 5 system/sepolicy/private/hal_weaver.te
+
+(neverallow base_typeattr_729 hal_weaver_service (service_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_weaver.te
+
+(neverallow base_typeattr_731 hal_weaver_service (service_manager (find)))
+;;* lme
+
+(allow hal_weaver_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_weaver_server (binder (transfer)))
+(allow hal_weaver_server servicemanager (fd (use)))
+(allow hal_wifi_client hal_wifi_server (binder (call transfer)))
+(allow hal_wifi_server hal_wifi_client (binder (transfer)))
+(allow hal_wifi_client hal_wifi_server (fd (use)))
+(allow hal_wifi_server hal_wifi_client (binder (call transfer)))
+(allow hal_wifi_client hal_wifi_server (binder (transfer)))
+(allow hal_wifi_server hal_wifi_client (fd (use)))
+(allow hal_wifi_client hal_wifi_hwservice (hwservice_manager (find)))
+(allow hal_wifi_server hal_wifi_hwservice (hwservice_manager (add find)))
+(allow hal_wifi_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_wifi.te
+
+(neverallow base_typeattr_732 hal_wifi_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_wifi.te
+
+(neverallow base_typeattr_733 hal_wifi_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_wifi_client hal_wifi_service (service_manager (find)))
+(allow hal_wifi_server hal_wifi_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_wifi.te
+
+(neverallow base_typeattr_732 hal_wifi_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_wifi.te
+
+(neverallow base_typeattr_734 hal_wifi_service (service_manager (find)))
+;;* lme
+
+(allow hal_wifi_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_wifi_server (binder (call transfer)))
+(allow servicemanager hal_wifi_server (dir (search)))
+(allow servicemanager hal_wifi_server (file (read open)))
+(allow servicemanager hal_wifi_server (process (getattr)))
+(allow hal_wifi proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_wifi proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_wifi sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi sysfs_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi_server property_socket (sock_file (write)))
+(allow hal_wifi_server init (unix_stream_socket (connectto)))
+(allow hal_wifi_server wifi_hal_prop (property_service (set)))
+(allow hal_wifi_server wifi_hal_prop (file (read getattr map open)))
+(allow hal_wifi property_socket (sock_file (write)))
+(allow hal_wifi init (unix_stream_socket (connectto)))
+(allow hal_wifi wifi_prop (property_service (set)))
+(allow hal_wifi wifi_prop (file (read getattr map open)))
+(allow hal_wifi self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx hal_wifi self (ioctl udp_socket (0x8914 0x8924 0x8946)))
+(allow hal_wifi self (capability (net_admin net_raw)))
+(allow hal_wifi self (cap_userns (net_admin net_raw)))
+(allow hal_wifi self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi sysfs_wlan_fwpath (file (write lock append map open)))
+(allow hal_wifi proc_modules (file (read getattr open)))
+(allow hal_wifi dumpstate (fifo_file (write)))
+(allow hal_wifi_server tombstone_wifi_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow hal_wifi_server tombstone_wifi_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow hal_wifi_hostapd_client hal_wifi_hostapd_server (binder (call transfer)))
+(allow hal_wifi_hostapd_server hal_wifi_hostapd_client (binder (transfer)))
+(allow hal_wifi_hostapd_client hal_wifi_hostapd_server (fd (use)))
+(allow hal_wifi_hostapd_server hal_wifi_hostapd_client (binder (call transfer)))
+(allow hal_wifi_hostapd_client hal_wifi_hostapd_server (binder (transfer)))
+(allow hal_wifi_hostapd_server hal_wifi_hostapd_client (fd (use)))
+(allow hal_wifi_hostapd_client hal_wifi_hostapd_hwservice (hwservice_manager (find)))
+(allow hal_wifi_hostapd_server hal_wifi_hostapd_hwservice (hwservice_manager (add find)))
+(allow hal_wifi_hostapd_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow base_typeattr_735 hal_wifi_hostapd_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow base_typeattr_736 hal_wifi_hostapd_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_wifi_hostapd_client hal_wifi_hostapd_service (service_manager (find)))
+(allow hal_wifi_hostapd_server hal_wifi_hostapd_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow base_typeattr_735 hal_wifi_hostapd_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow base_typeattr_737 hal_wifi_hostapd_service (service_manager (find)))
+;;* lme
+
+(allow hal_wifi_hostapd_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_wifi_hostapd_server (binder (call transfer)))
+(allow servicemanager hal_wifi_hostapd_server (dir (search)))
+(allow servicemanager hal_wifi_hostapd_server (file (read open)))
+(allow servicemanager hal_wifi_hostapd_server (process (getattr)))
+(allow hal_wifi_hostapd_server dumpstate (fifo_file (write)))
+(allow hal_wifi_hostapd_server self (capability (net_admin net_raw)))
+(allow hal_wifi_hostapd_server self (cap_userns (net_admin net_raw)))
+(allow hal_wifi_hostapd_server sysfs_net (dir (search)))
+(allow hal_wifi_hostapd_server proc_net_type (file (read getattr open)))
+(allowx hal_wifi_hostapd_server self (ioctl udp_socket (0x6900 0x6902)))
+(allowx hal_wifi_hostapd_server self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx hal_wifi_hostapd_server self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow hal_wifi_hostapd_server self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi_hostapd_server self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi_hostapd_server self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi_hostapd_server self (netlink_route_socket (nlmsg_write)))
+;;* lmx 31 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow hal_wifi_hostapd_server sdcard_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_wifi_hostapd_server fuse (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 32 system/sepolicy/private/hal_wifi_hostapd.te
+
+(neverallow hal_wifi_hostapd_server sdcard_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_wifi_hostapd_server fuse (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow hal_wifi_supplicant_client hal_wifi_supplicant_server (binder (call transfer)))
+(allow hal_wifi_supplicant_server hal_wifi_supplicant_client (binder (transfer)))
+(allow hal_wifi_supplicant_client hal_wifi_supplicant_server (fd (use)))
+(allow hal_wifi_supplicant_server hal_wifi_supplicant_client (binder (call transfer)))
+(allow hal_wifi_supplicant_client hal_wifi_supplicant_server (binder (transfer)))
+(allow hal_wifi_supplicant_server hal_wifi_supplicant_client (fd (use)))
+(allow hal_wifi_supplicant_client hal_wifi_supplicant_hwservice (hwservice_manager (find)))
+(allow hal_wifi_supplicant_server hal_wifi_supplicant_hwservice (hwservice_manager (add find)))
+(allow hal_wifi_supplicant_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow base_typeattr_738 hal_wifi_supplicant_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow base_typeattr_739 hal_wifi_supplicant_hwservice (hwservice_manager (find)))
+;;* lme
+
+(allow hal_wifi_supplicant_client hal_wifi_supplicant_service (service_manager (find)))
+(allow hal_wifi_supplicant_server hal_wifi_supplicant_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow base_typeattr_738 hal_wifi_supplicant_service (service_manager (add)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow base_typeattr_740 hal_wifi_supplicant_service (service_manager (find)))
+;;* lme
+
+(allowx hal_wifi_supplicant self (ioctl udp_socket (0x6900 0x6902)))
+(allowx hal_wifi_supplicant self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx hal_wifi_supplicant self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow hal_wifi_supplicant sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_wifi_supplicant sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi_supplicant sysfs_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi_supplicant proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hal_wifi_supplicant proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi_supplicant proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hal_wifi_supplicant self (capability (setgid setuid net_admin net_raw)))
+(allow hal_wifi_supplicant self (cap_userns (setgid setuid net_admin net_raw)))
+(allow hal_wifi_supplicant cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow hal_wifi_supplicant cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow hal_wifi_supplicant self (netlink_route_socket (nlmsg_write)))
+(allow hal_wifi_supplicant self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi_supplicant self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow hal_wifi_supplicant self (packet_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx hal_wifi_supplicant self (ioctl packet_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx hal_wifi_supplicant self (ioctl packet_socket (0x6900 0x6902)))
+(allowx hal_wifi_supplicant self (ioctl packet_socket ((range 0x8906 0x8907) (range 0x890b 0x890d) (range 0x8910 0x8927) 0x8929 (range 0x8930 0x8939) (range 0x8940 0x8943) (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx hal_wifi_supplicant self (ioctl packet_socket ((range 0x8b00 0x8b02) (range 0x8b04 0x8b1d) (range 0x8b20 0x8b2d) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow keystore hal_wifi_supplicant (dir (search)))
+(allow keystore hal_wifi_supplicant (file (read open)))
+(allow keystore hal_wifi_supplicant (process (getattr)))
+(allow hal_wifi_supplicant apc_service (service_manager (find)))
+(allow hal_wifi_supplicant keystore_service (service_manager (find)))
+(allow hal_wifi_supplicant legacykeystore_service (service_manager (find)))
+(allow hal_wifi_supplicant keystore (binder (call transfer)))
+(allow keystore hal_wifi_supplicant (binder (transfer)))
+(allow hal_wifi_supplicant keystore (fd (use)))
+(allow keystore hal_wifi_supplicant (binder (call transfer)))
+(allow hal_wifi_supplicant keystore (binder (transfer)))
+(allow keystore hal_wifi_supplicant (fd (use)))
+(allow hal_wifi_supplicant_server servicemanager (binder (call transfer)))
+(allow servicemanager hal_wifi_supplicant_server (binder (call transfer)))
+(allow servicemanager hal_wifi_supplicant_server (dir (search)))
+(allow servicemanager hal_wifi_supplicant_server (file (read open)))
+(allow servicemanager hal_wifi_supplicant_server (process (getattr)))
+(allow hal_wifi_supplicant wifi_key (keystore2_key (get_info use)))
+;;* lmx 37 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow hal_wifi_supplicant_server sdcard_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow hal_wifi_supplicant_server fuse (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/hal_wifi_supplicant.te
+
+(neverallow hal_wifi_supplicant_server sdcard_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow hal_wifi_supplicant_server fuse (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow halclientdomain hwservicemanager (binder (call transfer)))
+(allow hwservicemanager halclientdomain (binder (call transfer)))
+(allow hwservicemanager halclientdomain (dir (search)))
+(allow hwservicemanager halclientdomain (file (read map open)))
+(allow hwservicemanager halclientdomain (process (getattr)))
+(allow halclientdomain hwservicemanager_prop (file (read getattr map open)))
+(allow halclientdomain hidl_manager_hwservice (hwservice_manager (find)))
+(allow halserverdomain hwservicemanager (binder (call transfer)))
+(allow hwservicemanager halserverdomain (binder (call transfer)))
+(allow hwservicemanager halserverdomain (dir (search)))
+(allow hwservicemanager halserverdomain (file (read map open)))
+(allow hwservicemanager halserverdomain (process (getattr)))
+(allow halserverdomain system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow halserverdomain hwservicemanager_prop (file (read getattr map open)))
+(allow init heapprofd_exec (file (read getattr map execute open)))
+(allow init heapprofd (process (transition)))
+(allow heapprofd heapprofd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init heapprofd (process (noatsecure)))
+(allow init heapprofd (process (siginh rlimitinh)))
+(typetransition init heapprofd_exec process heapprofd)
+(typetransition heapprofd tmpfs file heapprofd_tmpfs)
+(allow heapprofd heapprofd_tmpfs (file (read write getattr map)))
+(allow heapprofd property_socket (sock_file (write)))
+(allow heapprofd init (unix_stream_socket (connectto)))
+(allow heapprofd heapprofd_prop (property_service (set)))
+(allow heapprofd heapprofd_prop (file (read getattr map open)))
+(allow heapprofd self (capability (kill)))
+(dontaudit heapprofd domain (dir (open search)))
+(allow heapprofd traced (fd (use)))
+(allow heapprofd traced_tmpfs (file (read write getattr map)))
+(allow heapprofd traced_producer_socket (sock_file (write)))
+(allow heapprofd traced (unix_stream_socket (connectto)))
+(allow traced heapprofd (fd (use)))
+(allow heapprofd nativetest_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd nativetest_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd nativetest_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd system_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd system_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd system_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd vendor_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd vendor_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd vendor_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd shell_test_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd shell_test_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd shell_test_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow heapprofd apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd apex_art_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow heapprofd apex_module_data_file (dir (getattr search)))
+(allow heapprofd self (capability (dac_read_search)))
+(allow heapprofd self (cap_userns (dac_read_search)))
+(allow heapprofd packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 51 system/sepolicy/private/heapprofd.te
+
+(neverallow heapprofd hal_configstore_server (file (read)))
+(neverallow heapprofd apexd (file (read)))
+(neverallow heapprofd app_zygote (file (read)))
+(neverallow heapprofd bpfloader (file (read)))
+(neverallow heapprofd init (file (read)))
+(neverallow heapprofd kernel (file (read)))
+(neverallow heapprofd keystore (file (read)))
+(neverallow heapprofd llkd (file (read)))
+(neverallow heapprofd logd (file (read)))
+(neverallow heapprofd logpersist (file (read)))
+(neverallow heapprofd recovery (file (read)))
+(neverallow heapprofd recovery_persist (file (read)))
+(neverallow heapprofd recovery_refresh (file (read)))
+(neverallow heapprofd ueventd (file (read)))
+(neverallow heapprofd vendor_init (file (read)))
+(neverallow heapprofd vold (file (read)))
+(neverallow heapprofd webview_zygote (file (read)))
+(neverallow heapprofd zygote (file (read)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/heapprofd.te
+
+(neverallow heapprofd hal_configstore_server (process (signal)))
+(neverallow heapprofd apexd (process (signal)))
+(neverallow heapprofd app_zygote (process (signal)))
+(neverallow heapprofd bpfloader (process (signal)))
+(neverallow heapprofd init (process (signal)))
+(neverallow heapprofd kernel (process (signal)))
+(neverallow heapprofd keystore (process (signal)))
+(neverallow heapprofd llkd (process (signal)))
+(neverallow heapprofd logd (process (signal)))
+(neverallow heapprofd logpersist (process (signal)))
+(neverallow heapprofd recovery (process (signal)))
+(neverallow heapprofd recovery_persist (process (signal)))
+(neverallow heapprofd recovery_refresh (process (signal)))
+(neverallow heapprofd ueventd (process (signal)))
+(neverallow heapprofd vendor_init (process (signal)))
+(neverallow heapprofd vold (process (signal)))
+(neverallow heapprofd webview_zygote (process (signal)))
+(neverallow heapprofd zygote (process (signal)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/heapprofd.te
+
+(neverallow heapprofd vendor_file_type (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/heapprofd.te
+
+(neverallow heapprofd base_typeattr_741 (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 11 system/sepolicy/private/hwservice.te
+
+(neverallow domain base_typeattr_742 (hwservice_manager (add find)))
+;;* lme
+
+(allow init hwservicemanager_exec (file (read getattr map execute open)))
+(allow init hwservicemanager (process (transition)))
+(allow hwservicemanager hwservicemanager_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init hwservicemanager (process (noatsecure)))
+(allow init hwservicemanager (process (siginh rlimitinh)))
+(typetransition init hwservicemanager_exec process hwservicemanager)
+(allow hwservicemanager hidl_manager_hwservice (hwservice_manager (add find)))
+(allow hwservicemanager hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 5 system/sepolicy/private/hwservicemanager.te
+
+(neverallow base_typeattr_743 hidl_manager_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow hwservicemanager hidl_token_hwservice (hwservice_manager (add find)))
+(allow hwservicemanager hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/hwservicemanager.te
+
+(neverallow base_typeattr_743 hidl_token_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow hwservicemanager property_socket (sock_file (write)))
+(allow hwservicemanager init (unix_stream_socket (connectto)))
+(allow hwservicemanager ctl_interface_start_prop (property_service (set)))
+(allow hwservicemanager ctl_interface_start_prop (file (read getattr map open)))
+(allow hwservicemanager property_socket (sock_file (write)))
+(allow hwservicemanager init (unix_stream_socket (connectto)))
+(allow hwservicemanager hwservicemanager_prop (property_service (set)))
+(allow hwservicemanager hwservicemanager_prop (file (read getattr map open)))
+(allow hwservicemanager system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hwservicemanager system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow hwservicemanager apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hwservicemanager apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hwservicemanager vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager self (binder (set_context_mgr)))
+(allow hwservicemanager system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hwservicemanager hwservice_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow hwservicemanager selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow hwservicemanager selinuxfs (file (write lock append map open)))
+(allow hwservicemanager kernel (security (compute_av)))
+(allow hwservicemanager self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow init idmap_exec (file (read getattr map execute open)))
+(allow init idmap (process (transition)))
+(allow idmap idmap_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init idmap (process (noatsecure)))
+(allow init idmap (process (siginh rlimitinh)))
+(typetransition init idmap_exec process idmap)
+(allow idmap resourcecache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow idmap resourcecache_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow idmap apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap apk_data_file (dir (search)))
+(allow idmap apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap apk_private_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap apk_tmp_file (dir (search)))
+(allow idmap apk_private_tmp_file (dir (search)))
+(allow idmap vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow idmap vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow idmap vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow idmap servicemanager (binder (call transfer)))
+(allow servicemanager idmap (binder (call transfer)))
+(allow servicemanager idmap (dir (search)))
+(allow servicemanager idmap (file (read open)))
+(allow servicemanager idmap (process (getattr)))
+(allow idmap idmap_service (service_manager (add find)))
+;;* lmx 26 system/sepolicy/private/idmap.te
+
+(neverallow base_typeattr_744 idmap_service (service_manager (add)))
+;;* lme
+
+(allow shell incident_exec (file (read getattr map execute open)))
+(allow shell incident (process (transition)))
+(allow incident incident_exec (file (read getattr map execute open entrypoint)))
+(allow incident shell (process (sigchld)))
+(dontaudit shell incident (process (noatsecure)))
+(allow shell incident (process (siginh rlimitinh)))
+(typetransition shell incident_exec process incident)
+(allow dumpstate incident_exec (file (read getattr map execute open)))
+(allow dumpstate incident (process (transition)))
+(allow incident incident_exec (file (read getattr map execute open entrypoint)))
+(allow incident dumpstate (process (sigchld)))
+(dontaudit dumpstate incident (process (noatsecure)))
+(allow dumpstate incident (process (siginh rlimitinh)))
+(typetransition dumpstate incident_exec process incident)
+(allow incident shell (fd (use)))
+(allow incident dumpstate (fd (use)))
+(allow incident dumpstate (unix_stream_socket (read write)))
+(allow incident shell_data_file (file (write)))
+(allow incident devpts (chr_file (read write)))
+(allow incident adbd (fd (use)))
+(allow incident adbd (unix_stream_socket (read write)))
+(allow incident adbd (process (sigchld)))
+(allow incident servicemanager (binder (call transfer)))
+(allow servicemanager incident (binder (call transfer)))
+(allow servicemanager incident (dir (search)))
+(allow servicemanager incident (file (read open)))
+(allow servicemanager incident (process (getattr)))
+(allow incident incident_service (service_manager (find)))
+(allow incident incidentd (binder (call transfer)))
+(allow incidentd incident (binder (transfer)))
+(allow incident incidentd (fd (use)))
+(allow incident incidentd (fifo_file (write)))
+;;* lmx 37 system/sepolicy/private/incident.te
+
+(neverallow base_typeattr_745 incident_exec (file (execute execute_no_trans)))
+;;* lme
+
+(allow incidentd incident_helper_exec (file (read getattr map execute open)))
+(allow incidentd incident_helper (process (transition)))
+(allow incident_helper incident_helper_exec (file (read getattr map execute open entrypoint)))
+(allow incident_helper incidentd (process (sigchld)))
+(dontaudit incidentd incident_helper (process (noatsecure)))
+(allow incidentd incident_helper (process (siginh rlimitinh)))
+(typetransition incidentd incident_helper_exec process incident_helper)
+(allow incident_helper dumpstate (fd (use)))
+(allow incident_helper incident (fd (use)))
+(allow incident_helper incidentd (fd (use)))
+(allow incident_helper shell (fd (use)))
+(allow incident_helper dumpstate (fifo_file (read write getattr)))
+(allow incident_helper incident (fifo_file (read write getattr)))
+(allow incident_helper incidentd (fifo_file (read write getattr)))
+(allow incident_helper shell (fifo_file (read write getattr)))
+(allow incident_helper incidentd (unix_stream_socket (read write)))
+;;* lmx 14 system/sepolicy/private/incident_helper.te
+
+(neverallow base_typeattr_746 incident_helper_exec (file (execute execute_no_trans)))
+;;* lme
+
+(allow init incidentd_exec (file (read getattr map execute open)))
+(allow init incidentd (process (transition)))
+(allow incidentd incidentd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init incidentd (process (noatsecure)))
+(allow init incidentd (process (siginh rlimitinh)))
+(typetransition init incidentd_exec process incidentd)
+(allow incidentd servicemanager (binder (call transfer)))
+(allow servicemanager incidentd (binder (call transfer)))
+(allow servicemanager incidentd (dir (search)))
+(allow servicemanager incidentd (file (read open)))
+(allow servicemanager incidentd (process (getattr)))
+(allow incidentd sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow incidentd self (capability2 (block_suspend)))
+(allow incidentd self (cap2_userns (block_suspend)))
+(allow incidentd system_suspend_server (binder (call transfer)))
+(allow system_suspend_server incidentd (binder (transfer)))
+(allow incidentd system_suspend_server (fd (use)))
+(allow incidentd system_suspend_hwservice (hwservice_manager (find)))
+(allow incidentd hwservicemanager (binder (call transfer)))
+(allow hwservicemanager incidentd (binder (call transfer)))
+(allow hwservicemanager incidentd (dir (search)))
+(allow hwservicemanager incidentd (file (read map open)))
+(allow hwservicemanager incidentd (process (getattr)))
+(allow incidentd hwservicemanager_prop (file (read getattr map open)))
+(allow incidentd hidl_manager_hwservice (hwservice_manager (find)))
+(allow incidentd hal_system_suspend_service (service_manager (find)))
+(allow incidentd servicemanager (binder (call transfer)))
+(allow servicemanager incidentd (binder (call transfer)))
+(allow servicemanager incidentd (dir (search)))
+(allow servicemanager incidentd (file (read open)))
+(allow servicemanager incidentd (process (getattr)))
+(allow incidentd domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow incidentd domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd incident_helper (process (sigkill)))
+(allow incidentd system_file (file (execute_no_trans)))
+(allow incidentd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow incidentd proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd statsdw_socket (sock_file (write)))
+(allow incidentd statsd (unix_dgram_socket (sendto)))
+(allow incidentd proc_pagetypeinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd proc_meminfo (file (read open)))
+(allow incidentd sysfs_devices_system_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd domain (process (getattr)))
+(allow incidentd sysfs_batteryinfo (dir (search)))
+(allow incidentd sysfs_batteryinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd stats_service (service_manager (find)))
+(allow incidentd statsd (binder (call transfer)))
+(allow statsd incidentd (binder (transfer)))
+(allow incidentd statsd (fd (use)))
+(allow incidentd perfetto_traces_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow incidentd perfetto_traces_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd nfc_service (service_manager (find)))
+(allow incidentd incident_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow incidentd incident_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow incidentd servicemanager (binder (call transfer)))
+(allow servicemanager incidentd (binder (call transfer)))
+(allow servicemanager incidentd (dir (search)))
+(allow servicemanager incidentd (file (read open)))
+(allow servicemanager incidentd (process (getattr)))
+(allow incidentd hwservicemanager (binder (call transfer)))
+(allow hwservicemanager incidentd (binder (call transfer)))
+(allow hwservicemanager incidentd (dir (search)))
+(allow hwservicemanager incidentd (file (read map open)))
+(allow hwservicemanager incidentd (process (getattr)))
+(allow incidentd hwservicemanager (hwservice_manager (list)))
+(allow incidentd hwservicemanager_prop (file (read getattr map open)))
+(allow incidentd hidl_manager_hwservice (hwservice_manager (find)))
+(allow incidentd proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd proc_pid_max (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd appdomain (process (signal)))
+(allow incidentd ephemeral_app (process (signal)))
+(allow incidentd system_server (process (signal)))
+(allow incidentd hal_audio_server (process (signal)))
+(allow incidentd hal_bluetooth_server (process (signal)))
+(allow incidentd hal_camera_server (process (signal)))
+(allow incidentd hal_codec2_server (process (signal)))
+(allow incidentd hal_face_server (process (signal)))
+(allow incidentd hal_graphics_allocator_server (process (signal)))
+(allow incidentd hal_graphics_composer_server (process (signal)))
+(allow incidentd hal_health_server (process (signal)))
+(allow incidentd hal_omx_server (process (signal)))
+(allow incidentd hal_sensors_server (process (signal)))
+(allow incidentd hal_vr_server (process (signal)))
+(allow incidentd audioserver (process (signal)))
+(allow incidentd cameraserver (process (signal)))
+(allow incidentd drmserver (process (signal)))
+(allow incidentd inputflinger (process (signal)))
+(allow incidentd mediadrmserver (process (signal)))
+(allow incidentd mediaextractor (process (signal)))
+(allow incidentd mediametrics (process (signal)))
+(allow incidentd mediaserver (process (signal)))
+(allow incidentd sdcardd (process (signal)))
+(allow incidentd statsd (process (signal)))
+(allow incidentd surfaceflinger (process (signal)))
+(allow incidentd system_server (binder (call transfer)))
+(allow system_server incidentd (binder (transfer)))
+(allow incidentd system_server (fd (use)))
+(allow incidentd appdomain (binder (call transfer)))
+(allow appdomain incidentd (binder (transfer)))
+(allow incidentd appdomain (fd (use)))
+;;* lmx 122 system/sepolicy/private/incidentd.te
+
+(neverallow incidentd base_typeattr_236 (process (ptrace)))
+;;* lme
+
+(allow incidentd self (capability (kill)))
+(allow incidentd self (cap_userns (kill)))
+(allow incidentd tombstoned_intercept_socket (sock_file (write)))
+(allow incidentd tombstoned (unix_stream_socket (connectto)))
+(allow incidentd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow incidentd zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow incidentd device_config_runtime_native_prop (file (read getattr map open)))
+(allow incidentd device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow incidentd odsign_prop (file (read getattr map open)))
+(allow incidentd system_file (file (lock)))
+(dontaudit incidentd dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit incidentd apex_module_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit incidentd apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit incidentd tmpfs (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
+(allow incidentd apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd misc_logd_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow incidentd misc_logd_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd misc_logd_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow incidentd base_typeattr_747 (service_manager (find)))
+(allow incidentd incident_service (service_manager (add find)))
+;;* lmx 171 system/sepolicy/private/incidentd.te
+
+(neverallow base_typeattr_748 incident_service (service_manager (add)))
+;;* lme
+
+(allow incidentd dumpstate (fd (use)))
+(allow incidentd incident (fd (use)))
+(allow incidentd dumpstate (fifo_file (write)))
+(allow incidentd incident (fifo_file (write)))
+(allow incidentd incident (binder (call transfer)))
+(allow incident incidentd (binder (transfer)))
+(allow incidentd incident (fd (use)))
+(allow incidentd build_attestation_prop (file (read getattr map open)))
+;;* lmx 212 system/sepolicy/private/incidentd.te
+
+(neverallow base_typeattr_749 incident_data_file (file (write create getattr setattr lock append map unlink rename execute open execute_no_trans)))
+;;* lme
+
+;;* lmx 214 system/sepolicy/private/incidentd.te
+
+(neverallow base_typeattr_750 incident_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 216 system/sepolicy/private/incidentd.te
+
+(neverallow base_typeattr_749 incident_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+(typetransition init tmpfs file init_tmpfs)
+(allow init init_tmpfs (file (read write getattr map)))
+(allow init rootfs (file (read getattr map execute open)))
+(allow init slideshow (process (transition)))
+(allow slideshow rootfs (file (read getattr map execute open entrypoint)))
+(dontaudit init slideshow (process (noatsecure)))
+(allow init slideshow (process (siginh rlimitinh)))
+(allow init charger_exec (file (read getattr map execute open)))
+(allow init charger (process (transition)))
+(allow charger charger_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init charger (process (noatsecure)))
+(allow init charger (process (siginh rlimitinh)))
+(typetransition init charger_exec process charger)
+(allow init e2fs_exec (file (read getattr map execute open)))
+(allow init e2fs (process (transition)))
+(allow e2fs e2fs_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init e2fs (process (noatsecure)))
+(allow init e2fs (process (siginh rlimitinh)))
+(typetransition init e2fs_exec process e2fs)
+(allow init bpfloader_exec (file (read getattr map execute open)))
+(allow init bpfloader (process (transition)))
+(allow bpfloader bpfloader_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init bpfloader (process (noatsecure)))
+(allow init bpfloader (process (siginh rlimitinh)))
+(typetransition init bpfloader_exec process bpfloader)
+(allow init shell_exec (file (read getattr map execute open)))
+(allow init shell (process (transition)))
+(allow shell shell_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init shell (process (noatsecure)))
+(allow init shell (process (siginh rlimitinh)))
+(allow init init_exec (file (read getattr map execute open)))
+(allow init ueventd (process (transition)))
+(allow ueventd init_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init ueventd (process (noatsecure)))
+(allow init ueventd (process (siginh rlimitinh)))
+(allow init init_exec (file (read getattr map execute open)))
+(allow init vendor_init (process (transition)))
+(allow vendor_init init_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vendor_init (process (noatsecure)))
+(allow init vendor_init (process (siginh rlimitinh)))
+(allow init rootfs (file (read getattr map execute open)))
+(allow init toolbox_exec (file (read getattr map execute open)))
+(allow init modprobe (process (transition)))
+(allow modprobe rootfs (file (read getattr map execute open entrypoint)))
+(allow modprobe toolbox_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init modprobe (process (noatsecure)))
+(allow init modprobe (process (siginh rlimitinh)))
+(allow init sysfs_dm (file (read)))
+(allow init sysfs_loop (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init sysfs_loop (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init sysfs_type (file (read getattr)))
+(allow init dev_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init dev_type (blk_file (getattr)))
+(allow init proc_drop_caches (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init powerctl_prop (property_service (set)))
+(allow init powerctl_prop (file (read getattr map open)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init userspace_reboot_exported_prop (property_service (set)))
+(allow init userspace_reboot_exported_prop (file (read getattr map open)))
+(allow init self (perf_event (open cpu)))
+(allow init self (capability2 (perfmon)))
+(allow init self (cap2_userns (perfmon)))
+(allow init proc_kallsyms (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init snapuserd_socket (sock_file (write)))
+(allow init snapuserd (unix_stream_socket (connectto)))
+(allow init ota_metadata_file (dir (lock)))
+(allow init vd_device (blk_file (relabelto)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init init_perf_lsm_hooks_prop (property_service (set)))
+(allow init init_perf_lsm_hooks_prop (file (read getattr map open)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init vts_status_prop (property_service (set)))
+(allow init vts_status_prop (file (read getattr map open)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init bionic_linker_16kb_app_compat_prop (property_service (set)))
+(allow init bionic_linker_16kb_app_compat_prop (file (read getattr map open)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init pm_16kb_app_compat_prop (property_service (set)))
+(allow init pm_16kb_app_compat_prop (file (read getattr map open)))
+(allow init property_socket (sock_file (write)))
+(allow init init (unix_stream_socket (connectto)))
+(allow init ctl_prefetch_prop (property_service (set)))
+(allow init ctl_prefetch_prop (file (read getattr map open)))
+(allow init debugfs_bootreceiver_tracing (file (write lock append map open)))
+(allow init prng_seeder (unix_stream_socket (create bind listen)))
+(dontaudit init debugfs_tracing_debug (dir (write add_name)))
+(allow init base_typeattr_751 (chr_file (setattr)))
+(allow init tmpfs (chr_file (ioctl read write create getattr setattr lock append map unlink open watch watch_reads)))
+(allow init tmpfs (chr_file (relabelfrom)))
+(allow init kmsg_device (chr_file (write getattr relabelto)))
+(allow init vm_data_file (dir (write create getattr setattr relabelto mounton add_name search)))
+(allow init properties_device (dir (relabelto)))
+(allow init properties_serial (file (write relabelto)))
+(allow init property_type (file (read write create getattr setattr relabelto append map unlink rename open)))
+(allow init properties_device (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init property_info (file (relabelto)))
+(allow init device (file (relabelfrom)))
+(allow init runtime_event_log_tags_file (file (write create setattr relabelto open)))
+(allow init device (dir (relabelto)))
+(allow init dm_user_device (dir (relabelto)))
+(allow init socket_device (dir (relabelto)))
+(allow init lmkd_socket (sock_file (write)))
+(allow init lmkd (unix_stream_socket (connectto)))
+(allow init console_device (chr_file (relabelto)))
+(allow init ptmx_device (chr_file (relabelto)))
+(allow init null_device (chr_file (relabelto)))
+(allow init random_device (chr_file (relabelto)))
+(allow init tmpfs (chr_file (relabelfrom)))
+(allow init tmpfs (blk_file (relabelfrom)))
+(allow init tmpfs (blk_file (getattr)))
+(allow init block_device (dir (relabelto)))
+(allow init block_device (lnk_file (relabelto)))
+(allow init block_device (blk_file (relabelto)))
+(allow init dm_device (chr_file (relabelto)))
+(allow init dm_device (blk_file (relabelto)))
+(allow init dm_user_device (chr_file (relabelto)))
+(allow init kernel (fd (use)))
+(allow init tmpfs (lnk_file (read getattr relabelfrom)))
+(allow init system_block_device (lnk_file (relabelto)))
+(allow init system_block_device (blk_file (relabelto)))
+(allow init recovery_block_device (lnk_file (relabelto)))
+(allow init recovery_block_device (blk_file (relabelto)))
+(allow init userdata_block_device (lnk_file (relabelto)))
+(allow init userdata_block_device (blk_file (relabelto)))
+(allow init metadata_block_device (lnk_file (relabelto)))
+(allow init metadata_block_device (blk_file (relabelto)))
+(allow init misc_block_device (lnk_file (relabelto)))
+(allow init misc_block_device (blk_file (relabelto)))
+(allow init dtbo_block_device (lnk_file (relabelto)))
+(allow init super_block_device (lnk_file (relabelto)))
+(allow init mnt_sdcard_file (lnk_file (create)))
+(allow init self (capability (sys_resource)))
+(allow init self (cap_userns (sys_resource)))
+(allow init tmpfs (file (getattr unlink)))
+(allow init devpts (chr_file (read write open)))
+(allow init fscklogs (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init tmpfs (chr_file (write)))
+(allow init console_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init self (capability (sys_admin)))
+(allow init self (cap_userns (sys_admin)))
+(allow init self (capability (sys_chroot)))
+(allow init self (cap_userns (sys_chroot)))
+(allow init rootfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init rootfs (dir (mounton)))
+(allow init cgroup (dir (mounton)))
+(allow init system_file (dir (mounton)))
+(allow init linkerconfig_file (dir (mounton)))
+(allow init vendor_file (dir (mounton)))
+(allow init system_data_root_file (dir (mounton)))
+(allow init system_data_file (dir (mounton)))
+(allow init shell_data_file (dir (mounton)))
+(allow init mnt_user_file (dir (mounton)))
+(allow init storage_file (dir (mounton)))
+(allow init postinstall_mnt_dir (dir (mounton)))
+(allow init mirror_data_file (dir (mounton)))
+(allow init cache_file (dir (mounton)))
+(allow init system_dlkm_file (dir (mounton)))
+(allow init fs_bpf (dir (mounton)))
+(allow init device (dir (mounton)))
+(allow init apex_mnt_dir (dir (mounton)))
+(allow init art_apex_dir (dir (mounton)))
+(allow init rootfs (lnk_file (create unlink)))
+(allow init sysfs (dir (mounton)))
+(allow init tmpfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init tmpfs (dir (mounton)))
+(allow init cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init cgroup (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init cgroup_rc_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init vendor_cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init cgroup_v2 (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init cgroup_v2 (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init configfs (dir (mounton)))
+(allow init configfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init configfs (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init configfs (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init metadata_file (dir (mounton)))
+(allow init tmpfs (dir (relabelfrom)))
+(allow init self (capability (dac_override dac_read_search)))
+(allow init self (cap_userns (dac_override dac_read_search)))
+(allow init self (capability (sys_time)))
+(allow init self (cap_userns (sys_time)))
+(allow init self (capability (sys_rawio mknod)))
+(allow init self (cap_userns (sys_rawio mknod)))
+(allow init dev_type (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allowx init dev_type (ioctl blk_file (0x125d)))
+(allowx init system_data_root_file (ioctl dir (0x587d)))
+(allow init base_typeattr_752 (filesystem (mount remount unmount getattr relabelfrom associate quotamod quotaget watch)))
+(allow init debugfs_tracing_debug (filesystem (mount)))
+(allow init unlabeled (filesystem (mount remount unmount getattr relabelfrom associate quotamod quotaget watch)))
+(allow init contextmount_type (filesystem (relabelto)))
+(allow init contextmount_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init contextmount_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init contextmount_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init contextmount_type (sock_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init contextmount_type (fifo_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init rootfs (file (relabelfrom)))
+(allow init rootfs (dir (relabelfrom)))
+(allow init self (capability (chown fowner fsetid)))
+(allow init self (cap_userns (chown fowner fsetid)))
+(allow init base_typeattr_753 (dir (ioctl read create getattr setattr open search)))
+(allow init base_typeattr_754 (dir (write relabelfrom add_name remove_name rmdir)))
+(allow init base_typeattr_755 (file (read write create getattr setattr relabelfrom map unlink open)))
+(allow init tracefs_type (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow init apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init base_typeattr_756 (sock_file (read create getattr setattr relabelfrom unlink open)))
+(allow init base_typeattr_756 (fifo_file (read create getattr setattr relabelfrom unlink open)))
+(allow init base_typeattr_757 (lnk_file (create getattr setattr relabelfrom unlink)))
+(allow init cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init base_typeattr_758 (file (relabelto)))
+(allow init base_typeattr_758 (dir (relabelto)))
+(allow init base_typeattr_758 (lnk_file (relabelto)))
+(allow init base_typeattr_758 (chr_file (relabelto)))
+(allow init base_typeattr_758 (blk_file (relabelto)))
+(allow init base_typeattr_758 (sock_file (relabelto)))
+(allow init base_typeattr_758 (fifo_file (relabelto)))
+(allow init sysfs (file (getattr relabelfrom)))
+(allow init sysfs (dir (getattr relabelfrom)))
+(allow init sysfs (lnk_file (getattr relabelfrom)))
+(allow init debugfs_tracing (file (getattr relabelfrom)))
+(allow init debugfs_tracing (dir (getattr relabelfrom)))
+(allow init debugfs_tracing (lnk_file (getattr relabelfrom)))
+(allow init debugfs_tracing_debug (file (getattr relabelfrom)))
+(allow init debugfs_tracing_debug (dir (getattr relabelfrom)))
+(allow init debugfs_tracing_debug (lnk_file (getattr relabelfrom)))
+(allow init sysfs_type (file (getattr relabelto)))
+(allow init sysfs_type (dir (getattr relabelto)))
+(allow init sysfs_type (lnk_file (getattr relabelto)))
+(allow init tracefs_type (file (getattr relabelto)))
+(allow init tracefs_type (dir (getattr relabelto)))
+(allow init tracefs_type (lnk_file (getattr relabelto)))
+(allow init dev_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init dev_type (lnk_file (create)))
+(allow init debugfs_tracing (file (write lock append map open)))
+(allow init debugfs_tracing_instances (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init debugfs_tracing_instances (file (write lock append map open)))
+(allow init debugfs_wifi_tracing (file (write lock append map open)))
+(allow init debugfs_wifi_tracing (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init base_typeattr_759 (file (read setattr open)))
+(allow init base_typeattr_760 (dir (read setattr open search)))
+(allow init binder_device (chr_file (read open)))
+(allow init hwbinder_device (chr_file (read open)))
+(allow init dm_device (chr_file (read open)))
+(allow init pmsg_device (chr_file (read open)))
+(allow init console_device (chr_file (read open)))
+(allow init input_device (chr_file (read open)))
+(allow init ptmx_device (chr_file (read open)))
+(allow init kmsg_device (chr_file (read open)))
+(allow init null_device (chr_file (read open)))
+(allow init random_device (chr_file (read open)))
+(allow init owntty_device (chr_file (read open)))
+(allow init tty_device (chr_file (read open)))
+(allow init zero_device (chr_file (read open)))
+(allow init devpts (chr_file (read open)))
+(allow init unlabeled (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init unlabeled (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow init unlabeled (lnk_file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow init unlabeled (sock_file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow init unlabeled (fifo_file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow init kernel (system (syslog_mod)))
+(allow init self (capability2 (syslog)))
+(allow init self (cap2_userns (syslog)))
+(allow init proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_diskstats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_kmsg (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_uptime (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_allocinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init proc_net_type (file (write lock append map open)))
+(allow init proc_overcommit_memory (file (write lock append map open)))
+(allow init proc_min_free_order_shift (file (write lock append map open)))
+(allow init proc_watermark_boost_factor (file (write lock append map open)))
+(allow init proc_abi (file (write lock append map open)))
+(allow init proc_cpu_alignment (file (write lock append map open)))
+(allow init proc_dirty (file (write lock append map open)))
+(allow init proc_extra_free_kbytes (file (write lock append map open)))
+(allow init proc_hostname (file (write lock append map open)))
+(allow init proc_hung_task (file (write lock append map open)))
+(allow init proc_max_map_count (file (write lock append map open)))
+(allow init proc_page_cluster (file (write lock append map open)))
+(allow init proc_panic (file (write lock append map open)))
+(allow init proc_perf (file (write lock append map open)))
+(allow init proc_sched (file (write lock append map open)))
+(allow init proc_sysrq (file (write lock append map open)))
+(allow init proc_security (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init proc_qtaguid_ctrl (file (setattr)))
+(allow init proc_qtaguid_stat (file (setattr)))
+(allow init proc_bootconfig (file (setattr)))
+(allow init proc_cmdline (file (setattr)))
+(allow init proc_kmsg (file (setattr)))
+(allow init proc_net (file (setattr)))
+(allow init proc_pagetypeinfo (file (setattr)))
+(allow init proc_slabinfo (file (setattr)))
+(allow init proc_sysrq (file (setattr)))
+(allow init proc_vmallocinfo (file (setattr)))
+(allow init proc_allocinfo (file (setattr)))
+(allow init sysfs_android_usb (file (write lock append map open)))
+(allow init sysfs_dm (file (write lock append map open)))
+(allow init sysfs_dm_verity (file (write lock append map open)))
+(allow init sysfs_leds (file (write lock append map open)))
+(allow init sysfs_power (file (write lock append map open)))
+(allow init sysfs_lru_gen_enabled (file (write lock append map open)))
+(allow init sysfs_fs_f2fs (file (write lock append map open)))
+(allow init sysfs_pgsize_migration (file (write lock append map open)))
+(allow init sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init sysfs_fs_ext4_features (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init sysfs_zram (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx init loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c03 0x4c04) (range 0x4c08 0x4c09) 0x4c82)))
+(allow init sysfs_vibrator (file (write lock append map open)))
+(allow init sysfs_android_usb (file (setattr)))
+(allow init sysfs_ipv4 (file (setattr)))
+(allow init sysfs_leds (file (setattr)))
+(allow init sysfs_wake_lock (file (setattr)))
+(allow init sysfs_power (file (setattr)))
+(allow init sysfs_devices_system_cpu (file (setattr)))
+(allow init sysfs_lowmemorykiller (file (setattr)))
+(allow init sysfs_vibrator (file (setattr)))
+(allow init sysfs_zram (file (setattr)))
+(allow init sysfs_firmware_acpi_tables (file (setattr)))
+(allow init usermodehelper (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init sysfs_usermodehelper (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init self (capability (net_admin)))
+(allow init self (cap_userns (net_admin)))
+(allow init self (capability (sys_boot)))
+(allow init self (cap_userns (sys_boot)))
+(allow init misc_logd_file (dir (read write create getattr setattr open add_name search)))
+(allow init misc_logd_file (file (write create getattr setattr open)))
+(allow init self (capability (kill)))
+(allow init self (cap_userns (kill)))
+(allow init domain (process (sigkill signal getpgid)))
+(allow init credstore_data_file (dir (read create getattr setattr open search)))
+(allow init credstore_data_file (file (getattr)))
+(allow init keystore_data_file (dir (read create getattr setattr open search)))
+(allow init keystore_data_file (file (getattr)))
+(allow init vold_data_file (dir (read create getattr setattr open search)))
+(allow init vold_data_file (file (getattr)))
+(allow init shell_data_file (dir (read create getattr setattr open search)))
+(allow init shell_data_file (file (getattr)))
+(allow init self (capability (setgid setuid setpcap)))
+(allow init self (cap_userns (setgid setuid setpcap)))
+(allow init domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init self (process (setexec setfscreate setsockcreate)))
+(allow init file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init sepolicy_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init selinuxfs (file (write lock append map open)))
+(allow init kernel (security (compute_av)))
+(allow init self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow init kernel (security (compute_create)))
+(allow init domain (unix_stream_socket (create bind setopt)))
+(allow init domain (unix_dgram_socket (create bind setopt)))
+(allow init property_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init property_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init property_type (property_service (set)))
+(allow init self (netlink_audit_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_relay)))
+(allow init self (capability (audit_write)))
+(allow init self (cap_userns (audit_write)))
+(allow init self (udp_socket (ioctl create)))
+(allowx init self (ioctl udp_socket (0x8914)))
+(allow init self (capability (net_raw)))
+(allow init self (cap_userns (net_raw)))
+(allow init kernel (process (getsched setsched)))
+(allow init swap_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init swap_block_device (blk_file (setattr)))
+(allow init device (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init input_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init dm_user_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init metadata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init pstorefs (dir (search)))
+(allow init pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init kernel (system (syslog_read)))
+(allow init init (key (write search setattr)))
+(allow init unencrypted_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allowx init data_file_type (ioctl dir (0x6613 0x6615)))
+(allowx init unlabeled (ioctl dir (0x6613 0x6615)))
+(allow init misc_block_device (blk_file (write lock append map open)))
+(allow init system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init system_dlkm_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init system_dlkm_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init system_dlkm_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init vendor_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init vendor_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init vendor_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init system_data_file (file (read getattr)))
+(allow init system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init vendor_shell_exec (file (execute)))
+(allow init vold_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init vold_metadata_file (file (getattr)))
+(allow init metadata_bootstat_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow init metadata_bootstat_file (file (write lock append map open)))
+(allow init userspace_reboot_metadata_file (file (write lock append map open)))
+(allow init proc_pressure_mem (file (ioctl read write getattr setattr lock append map open watch watch_reads)))
+(allow init system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow init system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow init fuse (dir (getattr search)))
+(allow init userdata_sysdev (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init rootdisk_sysdev (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lmx 816 system/sepolicy/private/init.te
+
+(neverallow domain init (process (dyntransition)))
+;;* lme
+
+;;* lmx 817 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_375 init (process (transition)))
+;;* lme
+
+;;* lmx 818 system/sepolicy/private/init.te
+
+(neverallow init base_typeattr_761 (file (entrypoint)))
+;;* lme
+
+;;* lmx 821 system/sepolicy/private/init.te
+
+(neverallow init shell_data_file (lnk_file (read)))
+;;* lme
+
+;;* lmx 822 system/sepolicy/private/init.te
+
+(neverallow init app_data_file_type (lnk_file (read)))
+;;* lme
+
+;;* lmx 825 system/sepolicy/private/init.te
+
+(neverallow init fs_type (file (execute_no_trans)))
+(neverallow init file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 834 system/sepolicy/private/init.te
+
+(neverallow init base_typeattr_236 (process (noatsecure)))
+;;* lme
+
+;;* lmx 837 system/sepolicy/private/init.te
+
+(neverallow init service_manager_type (service_manager (add find)))
+;;* lme
+
+;;* lmx 839 system/sepolicy/private/init.te
+
+(neverallow init servicemanager (service_manager (list)))
+;;* lme
+
+;;* lmx 842 system/sepolicy/private/init.te
+
+(neverallow init shell_data_file (dir (write add_name remove_name)))
+;;* lme
+
+;;* lmx 845 system/sepolicy/private/init.te
+
+(neverallow init sysfs (file (write open)))
+;;* lme
+
+;;* lmx 848 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_236 init (process (ptrace)))
+;;* lme
+
+;;* lmx 853 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_762 system_data_root_file (dir (write add_name remove_name)))
+;;* lme
+
+;;* lmx 856 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 userspace_reboot_exported_prop (property_service (set)))
+;;* lme
+
+;;* lmx 858 system/sepolicy/private/init.te
+
+(neverallow init self (perf_event (kernel tracepoint read write)))
+;;* lme
+
+(dontaudit init self (perf_event (kernel tracepoint read write)))
+;;* lmx 863 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 init_perf_lsm_hooks_prop (property_service (set)))
+;;* lme
+
+;;* lmx 866 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 vts_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 869 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 bootloader_prop (property_service (set)))
+;;* lme
+
+;;* lmx 872 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 hal_instrumentation_prop (property_service (set)))
+;;* lme
+
+;;* lmx 875 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 property_service_version_prop (property_service (set)))
+;;* lme
+
+;;* lmx 878 system/sepolicy/private/init.te
+
+(neverallow base_typeattr_235 keystore_listen_prop (property_service (set)))
+;;* lme
+
+(allow init inputflinger_exec (file (read getattr map execute open)))
+(allow init inputflinger (process (transition)))
+(allow inputflinger inputflinger_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init inputflinger (process (noatsecure)))
+(allow init inputflinger (process (siginh rlimitinh)))
+(typetransition init inputflinger_exec process inputflinger)
+(allow inputflinger servicemanager (binder (call transfer)))
+(allow servicemanager inputflinger (binder (call transfer)))
+(allow servicemanager inputflinger (dir (search)))
+(allow servicemanager inputflinger (file (read open)))
+(allow servicemanager inputflinger (process (getattr)))
+(allow inputflinger system_server (binder (call transfer)))
+(allow system_server inputflinger (binder (transfer)))
+(allow inputflinger system_server (fd (use)))
+(allow inputflinger sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow inputflinger self (capability2 (block_suspend)))
+(allow inputflinger self (cap2_userns (block_suspend)))
+(allow inputflinger system_suspend_server (binder (call transfer)))
+(allow system_suspend_server inputflinger (binder (transfer)))
+(allow inputflinger system_suspend_server (fd (use)))
+(allow inputflinger system_suspend_hwservice (hwservice_manager (find)))
+(allow inputflinger hwservicemanager (binder (call transfer)))
+(allow hwservicemanager inputflinger (binder (call transfer)))
+(allow hwservicemanager inputflinger (dir (search)))
+(allow hwservicemanager inputflinger (file (read map open)))
+(allow hwservicemanager inputflinger (process (getattr)))
+(allow inputflinger hwservicemanager_prop (file (read getattr map open)))
+(allow inputflinger hidl_manager_hwservice (hwservice_manager (find)))
+(allow inputflinger hal_system_suspend_service (service_manager (find)))
+(allow inputflinger servicemanager (binder (call transfer)))
+(allow servicemanager inputflinger (binder (call transfer)))
+(allow servicemanager inputflinger (dir (search)))
+(allow servicemanager inputflinger (file (read open)))
+(allow servicemanager inputflinger (process (getattr)))
+(allow inputflinger input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow inputflinger input_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow inputflinger cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow inputflinger cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow inputflinger cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow inputflinger cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow inputflinger cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow inputflinger cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init installd_exec (file (read getattr map execute open)))
+(allow init installd (process (transition)))
+(allow installd installd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init installd (process (noatsecure)))
+(allow init installd (process (siginh rlimitinh)))
+(typetransition init installd_exec process installd)
+(allow installd migrate_legacy_obb_data_exec (file (read getattr map execute open)))
+(allow installd migrate_legacy_obb_data (process (transition)))
+(allow migrate_legacy_obb_data migrate_legacy_obb_data_exec (file (read getattr map execute open entrypoint)))
+(allow migrate_legacy_obb_data installd (process (sigchld)))
+(dontaudit installd migrate_legacy_obb_data (process (noatsecure)))
+(allow installd migrate_legacy_obb_data (process (siginh rlimitinh)))
+(typetransition installd migrate_legacy_obb_data_exec process migrate_legacy_obb_data)
+(allow installd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow installd dex2oat_exec (file (read getattr map execute open)))
+(allow installd dex2oat (process (transition)))
+(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
+(allow dex2oat installd (process (sigchld)))
+(dontaudit installd dex2oat (process (noatsecure)))
+(allow installd dex2oat (process (siginh rlimitinh)))
+(typetransition installd dex2oat_exec process dex2oat)
+(allow installd profman_exec (file (read getattr map execute open)))
+(allow installd profman (process (transition)))
+(allow profman profman_exec (file (read getattr map execute open entrypoint)))
+(allow profman installd (process (sigchld)))
+(dontaudit installd profman (process (noatsecure)))
+(allow installd profman (process (siginh rlimitinh)))
+(typetransition installd profman_exec process profman)
+(allow installd idmap_exec (file (read getattr map execute open)))
+(allow installd idmap (process (transition)))
+(allow idmap idmap_exec (file (read getattr map execute open entrypoint)))
+(allow idmap installd (process (sigchld)))
+(dontaudit installd idmap (process (noatsecure)))
+(allow installd idmap (process (siginh rlimitinh)))
+(typetransition installd idmap_exec process idmap)
+(allow installd dumpstate (fd (use)))
+(allow installd dumpstate (fifo_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd app_exec_data_file (file (unlink)))
+(allow installd rollback_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd rollback_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd device_config_runtime_native_prop (file (read getattr map open)))
+(allow installd device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow installd apk_verity_prop (file (read getattr map open)))
+(allow installd odsign_prop (file (read getattr map open)))
+(allow installd staging_data_file (file (unlink)))
+(allow installd staging_data_file (dir (read write getattr rename open add_name remove_name search rmdir)))
+(allow installd sdk_sandbox_system_data_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd untrusted_app_all (fd (use)))
+(allow installd gmscore_app (fd (use)))
+(allow installd priv_app (fd (use)))
+(allowx installd app_data_file_type (ioctl file (0x6685)))
+(allow installd self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_admin)))
+(allow installd self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_admin)))
+(allow installd dalvikcache_data_file (dir (relabelto)))
+(allow installd dalvikcache_data_file (file (relabelto link)))
+(allow installd apk_data_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd apk_data_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink link rename open watch watch_reads)))
+(allow installd apk_data_file (lnk_file (ioctl read create getattr lock map unlink open watch watch_reads)))
+(allow installd asec_apk_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd apk_tmp_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow installd apk_tmp_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd oemfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd oemfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd mnt_expand_file (dir (getattr search)))
+(allow installd selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd selinuxfs (file (write lock append map open)))
+(allow installd kernel (security (check_context)))
+(allow installd rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd vendor_framework_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_framework_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd vendor_apex_metadata_file (dir (getattr search)))
+(allow installd file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd asec_image_file (dir (search)))
+(allow installd asec_image_file (file (getattr)))
+(allow installd system_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd system_data_file (lnk_file (read create getattr setattr unlink)))
+(allow installd mnt_pass_through_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd media_rw_data_file (file (getattr unlink)))
+(allow installd system_data_file (dir (relabelfrom)))
+(allow installd media_rw_data_file (dir (relabelto)))
+(allow installd media_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd storage_file (dir (search)))
+(allow installd sdcard_type (dir (read write getattr open remove_name search rmdir)))
+(allow installd fuse (dir (read write getattr open remove_name search rmdir)))
+(allow installd sdcard_type (file (getattr unlink)))
+(allow installd fuse (file (getattr unlink)))
+(allow installd mirror_data_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd system_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow installd misc_user_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd misc_user_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd keychain_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd keychain_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow installd install_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd install_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow installd dalvikcache_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd dalvikcache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd dalvikcache_data_file (lnk_file (getattr)))
+(allow installd resourcecache_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow installd resourcecache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd unlabeled (dir (ioctl read write getattr lock relabelfrom open watch watch_reads add_name remove_name search rmdir)))
+(allow installd unlabeled (file (getattr setattr relabelfrom unlink rename)))
+(allow installd unlabeled (lnk_file (getattr setattr relabelfrom unlink rename)))
+(allow installd unlabeled (sock_file (getattr setattr relabelfrom unlink rename)))
+(allow installd unlabeled (fifo_file (getattr setattr relabelfrom unlink rename)))
+(allow installd unlabeled (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd system_data_file (file (getattr relabelfrom unlink)))
+(allow installd system_data_file (lnk_file (getattr relabelfrom unlink)))
+(allow installd system_data_file (sock_file (getattr relabelfrom unlink)))
+(allow installd system_data_file (fifo_file (getattr relabelfrom unlink)))
+(allow installd app_data_file_type (dir (ioctl read write create getattr setattr lock relabelfrom relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd app_data_file_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink rename open watch watch_reads)))
+(allow installd app_data_file_type (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink rename open watch watch_reads)))
+(allow installd app_data_file_type (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink rename open watch watch_reads)))
+(allow installd app_data_file_type (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink rename open watch watch_reads)))
+(allowx installd app_data_file_type (ioctl file ((range 0x581f 0x5820))))
+(allowx installd app_data_file_type (ioctl dir ((range 0x581f 0x5820))))
+(allowx installd system_data_file (ioctl file ((range 0x581f 0x5820))))
+(allowx installd system_data_file (ioctl dir ((range 0x581f 0x5820))))
+(allowx installd install_data_file (ioctl file ((range 0x581f 0x5820))))
+(allowx installd install_data_file (ioctl dir ((range 0x581f 0x5820))))
+(allowx installd app_data_file_type (ioctl file ((range 0x6601 0x6602))))
+(allowx installd app_data_file_type (ioctl dir ((range 0x6601 0x6602))))
+(allowx installd system_data_file (ioctl file ((range 0x6601 0x6602))))
+(allowx installd system_data_file (ioctl dir ((range 0x6601 0x6602))))
+(allowx installd install_data_file (ioctl file ((range 0x6601 0x6602))))
+(allowx installd install_data_file (ioctl dir ((range 0x6601 0x6602))))
+(allow installd user_profile_root_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd user_profile_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow installd user_profile_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow installd user_profile_data_file (file (unlink)))
+(allow installd labeledfs (filesystem (unmount)))
+(allow installd profman_dump_data_file (dir (write add_name search)))
+(allow installd profman_dump_data_file (file (write create setattr open)))
+(allow installd devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow installd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow installd servicemanager (binder (call transfer)))
+(allow servicemanager installd (binder (call transfer)))
+(allow servicemanager installd (dir (search)))
+(allow servicemanager installd (file (read open)))
+(allow servicemanager installd (process (getattr)))
+(allow installd installd_service (service_manager (add find)))
+;;* lmx 192 system/sepolicy/private/installd.te
+
+(neverallow base_typeattr_763 installd_service (service_manager (add)))
+;;* lme
+
+(allow installd dumpstate (fifo_file (write getattr)))
+(allow installd system_server (binder (call transfer)))
+(allow system_server installd (binder (transfer)))
+(allow installd system_server (fd (use)))
+(allow installd permission_service (service_manager (find)))
+(allow installd block_device (dir (search)))
+(allow installd labeledfs (filesystem (quotamod quotaget)))
+(allow installd preloads_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow installd preloads_data_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search rmdir)))
+(allow installd preloads_media_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow installd preloads_media_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search rmdir)))
+(allow installd proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow installd storage_config_prop (file (read getattr map open)))
+(allow installd vold (fd (use)))
+(allow installd storage_area_key_file (dir (read write getattr lock open remove_name search rmdir)))
+(allow installd storage_area_key_file (file (unlink)))
+(allow installd virtualizationservice_data_file (file (unlink)))
+;;* lmx 241 system/sepolicy/private/installd.te
+
+(neverallow base_typeattr_764 installd_service (service_manager (find)))
+;;* lme
+
+;;* lmx 242 system/sepolicy/private/installd.te
+
+(neverallow base_typeattr_765 installd (binder (call)))
+;;* lme
+
+;;* lmx 248 system/sepolicy/private/installd.te
+
+(neverallow installd base_typeattr_766 (binder (call)))
+;;* lme
+
+(typetransition isolated_app tmpfs file appdomain_tmpfs)
+(allow isolated_app isolated_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su isolated_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 10 system/sepolicy/private/isolated_app.te
+
+(neverallow base_typeattr_284 isolated_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow isolated_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 10 system/sepolicy/private/isolated_app.te
+
+(neverallow base_typeattr_767 base_typeattr_284 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/isolated_app.te
+
+(neverallow base_typeattr_768 isolated_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/isolated_app.te
+
+(neverallow base_typeattr_769 isolated_app (process (ptrace)))
+;;* lme
+
+(allow isolated_app webviewupdate_service (service_manager (find)))
+(allow isolated_app untrusted_app_all (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app untrusted_app_all (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app ephemeral_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app ephemeral_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app priv_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app priv_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_app sdcard_type (file (read write getattr lock append map)))
+(allow isolated_app fuse (file (read write getattr lock append map)))
+(allow isolated_app media_rw_data_file (file (read write getattr lock append map)))
+(allow isolated_app webview_zygote (fd (use)))
+(allow isolated_app webview_zygote (process (sigchld)))
+(allow isolated_app webview_zygote (unix_dgram_socket (write)))
+(allow isolated_app webview_zygote_tmpfs (file (read)))
+(allow isolated_app_all app_data_file (file (read write getattr lock append map)))
+(allow isolated_app_all privapp_data_file (file (read write getattr lock append map)))
+(allow isolated_app_all sdk_sandbox_data_file (file (read write getattr lock append map)))
+(allow isolated_app_all activity_service (service_manager (find)))
+(allow isolated_app_all display_service (service_manager (find)))
+(allow isolated_app_all self (process (ptrace)))
+(allow isolated_app_all app_zygote (fd (use)))
+(allow isolated_app_all app_zygote (process (sigchld)))
+(allow isolated_app_all app_zygote (unix_dgram_socket (write)))
+(dontaudit isolated_app_all shell_data_file (dir (search)))
+(allow isolated_app_all apk_tmp_file (file (read getattr map)))
+(allow isolated_app_all apk_private_tmp_file (file (read getattr map)))
+;;* lmx 44 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all app_data_file_type (file (open)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 hwbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 base_typeattr_236 (hwservice_manager (add find list)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 base_typeattr_236 (service_manager (add list)))
+;;* lme
+
+;;* lmx 71 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 base_typeattr_771 (service_manager (find)))
+;;* lme
+
+;;* lmx 74 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 gpu_device (chr_file (ioctl read write getattr lock append map execute open watch watch_reads)))
+;;* lme
+
+;;* lmx 77 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 82 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all sdcard_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app_all fuse (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app_all mnt_user_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+(neverallow isolated_app_all storage_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 83 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all mnt_user_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all mnt_user_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all mnt_user_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all mnt_user_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all mnt_user_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all mnt_user_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all storage_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all storage_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all storage_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all storage_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all storage_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all storage_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 84 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all sdcard_type (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all sdcard_type (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all sdcard_type (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all sdcard_type (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all sdcard_type (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all fuse (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all fuse (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all fuse (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all fuse (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow isolated_app_all fuse (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 85 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all sdcard_type (file (ioctl create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all fuse (file (ioctl create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 88 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all usbaccessory_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow isolated_app_all usb_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 91 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all webview_zygote (sock_file (write)))
+;;* lme
+
+;;* lmx 105 system/sepolicy/private/isolated_app_all.te
+
+(neverallow base_typeattr_770 base_typeattr_772 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 126 system/sepolicy/private/isolated_app_all.te
+
+(neverallow isolated_app_all untrusted_app_all (socket (create)))
+(neverallow isolated_app_all untrusted_app_all (tcp_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (udp_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (rawip_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (packet_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (key_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_route_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_tcpdiag_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_nflog_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_xfrm_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_selinux_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_audit_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_dnrt_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_kobject_uevent_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (appletalk_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (tun_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_iscsi_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_fib_lookup_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_connector_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_netfilter_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_generic_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_scsitransport_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_rdma_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netlink_crypto_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (sctp_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (icmp_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (ax25_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (ipx_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (netrom_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (atmpvc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (x25_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (rose_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (decnet_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (atmsvc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (rds_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (irda_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (pppox_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (llc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (can_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (tipc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (bluetooth_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (iucv_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (rxrpc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (isdn_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (phonet_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (ieee802154_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (caif_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (alg_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (nfc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (vsock_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (kcm_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (qipcrtr_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (smc_socket (create)))
+(neverallow isolated_app_all untrusted_app_all (xdp_socket (create)))
+(neverallow isolated_app_all ephemeral_app (socket (create)))
+(neverallow isolated_app_all ephemeral_app (tcp_socket (create)))
+(neverallow isolated_app_all ephemeral_app (udp_socket (create)))
+(neverallow isolated_app_all ephemeral_app (rawip_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_socket (create)))
+(neverallow isolated_app_all ephemeral_app (packet_socket (create)))
+(neverallow isolated_app_all ephemeral_app (key_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_route_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_tcpdiag_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_nflog_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_xfrm_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_selinux_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_audit_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_dnrt_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_kobject_uevent_socket (create)))
+(neverallow isolated_app_all ephemeral_app (appletalk_socket (create)))
+(neverallow isolated_app_all ephemeral_app (tun_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_iscsi_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_fib_lookup_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_connector_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_netfilter_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_generic_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_scsitransport_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_rdma_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netlink_crypto_socket (create)))
+(neverallow isolated_app_all ephemeral_app (sctp_socket (create)))
+(neverallow isolated_app_all ephemeral_app (icmp_socket (create)))
+(neverallow isolated_app_all ephemeral_app (ax25_socket (create)))
+(neverallow isolated_app_all ephemeral_app (ipx_socket (create)))
+(neverallow isolated_app_all ephemeral_app (netrom_socket (create)))
+(neverallow isolated_app_all ephemeral_app (atmpvc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (x25_socket (create)))
+(neverallow isolated_app_all ephemeral_app (rose_socket (create)))
+(neverallow isolated_app_all ephemeral_app (decnet_socket (create)))
+(neverallow isolated_app_all ephemeral_app (atmsvc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (rds_socket (create)))
+(neverallow isolated_app_all ephemeral_app (irda_socket (create)))
+(neverallow isolated_app_all ephemeral_app (pppox_socket (create)))
+(neverallow isolated_app_all ephemeral_app (llc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (can_socket (create)))
+(neverallow isolated_app_all ephemeral_app (tipc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (bluetooth_socket (create)))
+(neverallow isolated_app_all ephemeral_app (iucv_socket (create)))
+(neverallow isolated_app_all ephemeral_app (rxrpc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (isdn_socket (create)))
+(neverallow isolated_app_all ephemeral_app (phonet_socket (create)))
+(neverallow isolated_app_all ephemeral_app (ieee802154_socket (create)))
+(neverallow isolated_app_all ephemeral_app (caif_socket (create)))
+(neverallow isolated_app_all ephemeral_app (alg_socket (create)))
+(neverallow isolated_app_all ephemeral_app (nfc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (vsock_socket (create)))
+(neverallow isolated_app_all ephemeral_app (kcm_socket (create)))
+(neverallow isolated_app_all ephemeral_app (qipcrtr_socket (create)))
+(neverallow isolated_app_all ephemeral_app (smc_socket (create)))
+(neverallow isolated_app_all ephemeral_app (xdp_socket (create)))
+(neverallow isolated_app_all priv_app (socket (create)))
+(neverallow isolated_app_all priv_app (tcp_socket (create)))
+(neverallow isolated_app_all priv_app (udp_socket (create)))
+(neverallow isolated_app_all priv_app (rawip_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_socket (create)))
+(neverallow isolated_app_all priv_app (packet_socket (create)))
+(neverallow isolated_app_all priv_app (key_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_route_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_tcpdiag_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_nflog_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_xfrm_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_selinux_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_audit_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_dnrt_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_kobject_uevent_socket (create)))
+(neverallow isolated_app_all priv_app (appletalk_socket (create)))
+(neverallow isolated_app_all priv_app (tun_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_iscsi_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_fib_lookup_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_connector_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_netfilter_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_generic_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_scsitransport_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_rdma_socket (create)))
+(neverallow isolated_app_all priv_app (netlink_crypto_socket (create)))
+(neverallow isolated_app_all priv_app (sctp_socket (create)))
+(neverallow isolated_app_all priv_app (icmp_socket (create)))
+(neverallow isolated_app_all priv_app (ax25_socket (create)))
+(neverallow isolated_app_all priv_app (ipx_socket (create)))
+(neverallow isolated_app_all priv_app (netrom_socket (create)))
+(neverallow isolated_app_all priv_app (atmpvc_socket (create)))
+(neverallow isolated_app_all priv_app (x25_socket (create)))
+(neverallow isolated_app_all priv_app (rose_socket (create)))
+(neverallow isolated_app_all priv_app (decnet_socket (create)))
+(neverallow isolated_app_all priv_app (atmsvc_socket (create)))
+(neverallow isolated_app_all priv_app (rds_socket (create)))
+(neverallow isolated_app_all priv_app (irda_socket (create)))
+(neverallow isolated_app_all priv_app (pppox_socket (create)))
+(neverallow isolated_app_all priv_app (llc_socket (create)))
+(neverallow isolated_app_all priv_app (can_socket (create)))
+(neverallow isolated_app_all priv_app (tipc_socket (create)))
+(neverallow isolated_app_all priv_app (bluetooth_socket (create)))
+(neverallow isolated_app_all priv_app (iucv_socket (create)))
+(neverallow isolated_app_all priv_app (rxrpc_socket (create)))
+(neverallow isolated_app_all priv_app (isdn_socket (create)))
+(neverallow isolated_app_all priv_app (phonet_socket (create)))
+(neverallow isolated_app_all priv_app (ieee802154_socket (create)))
+(neverallow isolated_app_all priv_app (caif_socket (create)))
+(neverallow isolated_app_all priv_app (alg_socket (create)))
+(neverallow isolated_app_all priv_app (nfc_socket (create)))
+(neverallow isolated_app_all priv_app (vsock_socket (create)))
+(neverallow isolated_app_all priv_app (kcm_socket (create)))
+(neverallow isolated_app_all priv_app (qipcrtr_socket (create)))
+(neverallow isolated_app_all priv_app (smc_socket (create)))
+(neverallow isolated_app_all priv_app (xdp_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (tcp_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (udp_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (rawip_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (packet_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (key_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_route_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_tcpdiag_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_nflog_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_xfrm_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_selinux_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_audit_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_dnrt_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_kobject_uevent_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (appletalk_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (tun_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_iscsi_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_fib_lookup_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_connector_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_netfilter_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_generic_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_scsitransport_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_rdma_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netlink_crypto_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (sctp_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (icmp_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (ax25_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (ipx_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (netrom_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (atmpvc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (x25_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (rose_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (decnet_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (atmsvc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (rds_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (irda_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (pppox_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (llc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (can_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (tipc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (bluetooth_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (iucv_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (rxrpc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (isdn_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (phonet_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (ieee802154_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (caif_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (alg_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (nfc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (vsock_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (kcm_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (qipcrtr_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (smc_socket (create)))
+(neverallow isolated_app_all sdk_sandbox_all (xdp_socket (create)))
+(neverallow isolated_app_all self (socket (create)))
+(neverallow isolated_app_all self (tcp_socket (create)))
+(neverallow isolated_app_all self (udp_socket (create)))
+(neverallow isolated_app_all self (rawip_socket (create)))
+(neverallow isolated_app_all self (netlink_socket (create)))
+(neverallow isolated_app_all self (packet_socket (create)))
+(neverallow isolated_app_all self (key_socket (create)))
+(neverallow isolated_app_all self (netlink_route_socket (create)))
+(neverallow isolated_app_all self (netlink_tcpdiag_socket (create)))
+(neverallow isolated_app_all self (netlink_nflog_socket (create)))
+(neverallow isolated_app_all self (netlink_xfrm_socket (create)))
+(neverallow isolated_app_all self (netlink_selinux_socket (create)))
+(neverallow isolated_app_all self (netlink_audit_socket (create)))
+(neverallow isolated_app_all self (netlink_dnrt_socket (create)))
+(neverallow isolated_app_all self (netlink_kobject_uevent_socket (create)))
+(neverallow isolated_app_all self (appletalk_socket (create)))
+(neverallow isolated_app_all self (tun_socket (create)))
+(neverallow isolated_app_all self (netlink_iscsi_socket (create)))
+(neverallow isolated_app_all self (netlink_fib_lookup_socket (create)))
+(neverallow isolated_app_all self (netlink_connector_socket (create)))
+(neverallow isolated_app_all self (netlink_netfilter_socket (create)))
+(neverallow isolated_app_all self (netlink_generic_socket (create)))
+(neverallow isolated_app_all self (netlink_scsitransport_socket (create)))
+(neverallow isolated_app_all self (netlink_rdma_socket (create)))
+(neverallow isolated_app_all self (netlink_crypto_socket (create)))
+(neverallow isolated_app_all self (sctp_socket (create)))
+(neverallow isolated_app_all self (icmp_socket (create)))
+(neverallow isolated_app_all self (ax25_socket (create)))
+(neverallow isolated_app_all self (ipx_socket (create)))
+(neverallow isolated_app_all self (netrom_socket (create)))
+(neverallow isolated_app_all self (atmpvc_socket (create)))
+(neverallow isolated_app_all self (x25_socket (create)))
+(neverallow isolated_app_all self (rose_socket (create)))
+(neverallow isolated_app_all self (decnet_socket (create)))
+(neverallow isolated_app_all self (atmsvc_socket (create)))
+(neverallow isolated_app_all self (rds_socket (create)))
+(neverallow isolated_app_all self (irda_socket (create)))
+(neverallow isolated_app_all self (pppox_socket (create)))
+(neverallow isolated_app_all self (llc_socket (create)))
+(neverallow isolated_app_all self (can_socket (create)))
+(neverallow isolated_app_all self (tipc_socket (create)))
+(neverallow isolated_app_all self (bluetooth_socket (create)))
+(neverallow isolated_app_all self (iucv_socket (create)))
+(neverallow isolated_app_all self (rxrpc_socket (create)))
+(neverallow isolated_app_all self (isdn_socket (create)))
+(neverallow isolated_app_all self (phonet_socket (create)))
+(neverallow isolated_app_all self (ieee802154_socket (create)))
+(neverallow isolated_app_all self (caif_socket (create)))
+(neverallow isolated_app_all self (alg_socket (create)))
+(neverallow isolated_app_all self (nfc_socket (create)))
+(neverallow isolated_app_all self (vsock_socket (create)))
+(neverallow isolated_app_all self (kcm_socket (create)))
+(neverallow isolated_app_all self (qipcrtr_socket (create)))
+(neverallow isolated_app_all self (smc_socket (create)))
+(neverallow isolated_app_all self (xdp_socket (create)))
+;;* lme
+
+(typetransition isolated_compute_app tmpfs file appdomain_tmpfs)
+(allow isolated_compute_app isolated_compute_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su isolated_compute_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 14 system/sepolicy/private/isolated_compute_app.te
+
+(neverallow base_typeattr_773 isolated_compute_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow isolated_compute_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 14 system/sepolicy/private/isolated_compute_app.te
+
+(neverallow base_typeattr_774 base_typeattr_773 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 14 system/sepolicy/private/isolated_compute_app.te
+
+(neverallow base_typeattr_775 isolated_compute_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 14 system/sepolicy/private/isolated_compute_app.te
+
+(neverallow base_typeattr_776 isolated_compute_app (process (ptrace)))
+;;* lme
+
+(allow isolated_compute_app isolated_compute_allowed_service (service_manager (find)))
+(allow isolated_compute_app isolated_compute_allowed_device (chr_file (ioctl read write map)))
+(allow isolated_compute_app hwservicemanager (binder (call transfer)))
+(allow hwservicemanager isolated_compute_app (binder (call transfer)))
+(allow hwservicemanager isolated_compute_app (dir (search)))
+(allow hwservicemanager isolated_compute_app (file (read map open)))
+(allow hwservicemanager isolated_compute_app (process (getattr)))
+(allow isolated_compute_app dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow isolated_compute_app untrusted_app_all (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app untrusted_app_all (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app ephemeral_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app ephemeral_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app priv_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app priv_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow isolated_compute_app toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow isolated_compute_app gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow isolated_compute_app gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow isolated_compute_app sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init iw_exec (file (read getattr map execute open)))
+(allow init iw (process (transition)))
+(allow iw iw_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init iw (process (noatsecure)))
+(allow init iw (process (siginh rlimitinh)))
+(typetransition init iw_exec process iw)
+(allow init kcmdlinectrl_exec (file (read getattr map execute open)))
+(allow init kcmdlinectrl (process (transition)))
+(allow kcmdlinectrl kcmdlinectrl_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init kcmdlinectrl (process (noatsecure)))
+(allow init kcmdlinectrl (process (siginh rlimitinh)))
+(typetransition init kcmdlinectrl_exec process kcmdlinectrl)
+(allow kcmdlinectrl property_socket (sock_file (write)))
+(allow kcmdlinectrl init (unix_stream_socket (connectto)))
+(allow kcmdlinectrl kcmdline_prop (property_service (set)))
+(allow kcmdlinectrl kcmdline_prop (file (read getattr map open)))
+(allow kcmdlinectrl misc_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow kcmdlinectrl block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow kcmdlinectrl gsi_metadata_file_type (dir (search)))
+(allow kcmdlinectrl metadata_file (dir (search)))
+(allow kcmdlinectrl gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kcmdlinectrl proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kcmdlinectrl proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit kcmdlinectrl sysfs_dt_firmware_android (dir (search)))
+(dontaudit kcmdlinectrl vendor_property_type (file (read)))
+(allow kernel init_exec (file (read getattr map execute open)))
+(allow kernel init (process (transition)))
+(allow init init_exec (file (read getattr map execute open entrypoint)))
+(allow init kernel (process (sigchld)))
+(dontaudit kernel init (process (noatsecure)))
+(allow kernel init (process (siginh rlimitinh)))
+(typetransition kernel init_exec process init)
+(allow kernel snapuserd_exec (file (read getattr map execute open)))
+(allow kernel snapuserd (process (transition)))
+(allow snapuserd snapuserd_exec (file (read getattr map execute open entrypoint)))
+(allow snapuserd kernel (process (sigchld)))
+(dontaudit kernel snapuserd (process (noatsecure)))
+(allow kernel snapuserd (process (siginh rlimitinh)))
+(typetransition kernel snapuserd_exec process snapuserd)
+(allow kernel otapreopt_chroot (fd (use)))
+(allow kernel postinstall_file (file (read)))
+(allow kernel tmpfs (blk_file (getattr relabelfrom)))
+(allow kernel tmpfs (chr_file (getattr relabelfrom)))
+(allow kernel tmpfs (lnk_file (getattr relabelfrom)))
+(allow kernel tmpfs (dir (read relabelfrom open)))
+(allow kernel block_device (blk_file (relabelto)))
+(allow kernel block_device (lnk_file (relabelto)))
+(allow kernel dm_device (chr_file (relabelto)))
+(allow kernel dm_device (blk_file (relabelto)))
+(allow kernel dm_user_device (dir (read relabelto open search)))
+(allow kernel dm_user_device (chr_file (relabelto)))
+(allow kernel kmsg_device (chr_file (relabelto)))
+(allow kernel null_device (chr_file (relabelto)))
+(allow kernel random_device (chr_file (relabelto)))
+(allow kernel snapuserd_exec (file (relabelto)))
+(allow kernel kmsg_device (chr_file (write)))
+(allow kernel gsid (fd (use)))
+(allow kernel self (capability (sys_nice)))
+(allow kernel self (cap_userns (sys_nice)))
+(allow kernel rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow kernel rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow kernel selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow kernel rootfs (file (relabelfrom)))
+(allow kernel init_exec (file (relabelto)))
+(allow kernel init (process (share)))
+(allow kernel unlabeled (dir (search)))
+(allow kernel usbfs (filesystem (mount)))
+(allow kernel usbfs (dir (search)))
+(dontaudit kernel self (security (setenforce)))
+(allow kernel self (capability (sys_resource)))
+(allow kernel self (cap_userns (sys_resource)))
+(allow kernel self (capability (sys_boot)))
+(allow kernel self (cap_userns (sys_boot)))
+(allow kernel proc_sysrq (file (write lock append map open)))
+(allow kernel tmpfs (chr_file (write)))
+(allow kernel selinuxfs (file (write)))
+(allow kernel self (security (setcheckreqprot)))
+(allow kernel sdcard_type (file (read write)))
+(allow kernel fuse (file (read write)))
+(allow kernel mediaprovider (fd (use)))
+(allow kernel vold (fd (use)))
+(allow kernel app_data_file (file (read)))
+(allow kernel privapp_data_file (file (read)))
+(allow kernel asec_image_file (file (read)))
+(allow kernel media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow kernel media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow kernel vold_data_file (file (read write)))
+(allow kernel apexd (fd (use)))
+(allow kernel apex_data_file (file (read)))
+(allow kernel staging_data_file (file (read)))
+(allow kernel vendor_apex_file (file (read)))
+(allow kernel system_file (file (execute)))
+(allow kernel appdomain_tmpfs (file (read write)))
+(dontaudit kernel metadata_file (dir (search)))
+(dontaudit kernel ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(dontaudit kernel sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit kernel sysfs (file (read write open)))
+(dontaudit kernel sysfs (chr_file (read write open)))
+(dontaudit kernel dm_device (chr_file (ioctl)))
+(dontaudit kernel self (capability (setgid sys_admin mknod)))
+(dontaudit kernel dm_user_device (dir (write add_name)))
+(dontaudit kernel dm_user_device (chr_file (create setattr)))
+(dontaudit kernel tmpfs (lnk_file (read)))
+(dontaudit kernel tmpfs (blk_file (read open)))
+;;* lmx 172 system/sepolicy/private/kernel.te
+
+(neverallow base_typeattr_236 kernel (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 182 system/sepolicy/private/kernel.te
+
+(neverallow kernel base_typeattr_236 (file (execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 187 system/sepolicy/private/kernel.te
+
+(neverallow kernel self (capability (dac_override dac_read_search)))
+(neverallow kernel self (cap_userns (dac_override dac_read_search)))
+;;* lme
+
+;;* lmx 190 system/sepolicy/private/kernel.te
+
+(neverallow base_typeattr_236 kernel (process (ptrace)))
+;;* lme
+
+(allow init keystore_exec (file (read getattr map execute open)))
+(allow init keystore (process (transition)))
+(allow keystore keystore_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init keystore (process (noatsecure)))
+(allow init keystore (process (siginh rlimitinh)))
+(typetransition init keystore_exec process keystore)
+(allow keystore platform_app (binder (call)))
+(allow keystore device_logging_prop (file (read getattr map open)))
+(allow keystore remote_prov_prop (file (read getattr map open)))
+(allow keystore remote_prov_cert_prop (file (read getattr map open)))
+(allow keystore device_config_remote_key_provisioning_native_prop (file (read getattr map open)))
+(allow keystore statsdw_socket (sock_file (write)))
+(allow keystore statsd (unix_dgram_socket (sendto)))
+(allow keystore keystore2_key_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore keystore_listen_prop (file (read getattr map open)))
+(allow keystore vold (binder (transfer)))
+(allow keystore property_socket (sock_file (write)))
+(allow keystore init (unix_stream_socket (connectto)))
+(allow keystore keystore_diagnostics_prop (property_service (set)))
+(allow keystore keystore_diagnostics_prop (file (read getattr map open)))
+(allow keystore apexd_prop (file (read getattr map open)))
+(allow keystore apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow keystore apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow keystore vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore servicemanager (binder (call transfer)))
+(allow servicemanager keystore (binder (call transfer)))
+(allow servicemanager keystore (dir (search)))
+(allow servicemanager keystore (file (read open)))
+(allow servicemanager keystore (process (getattr)))
+(allow keystore remote_provisioning_service_server (binder (call transfer)))
+(allow remote_provisioning_service_server keystore (binder (transfer)))
+(allow keystore remote_provisioning_service_server (fd (use)))
+(allow keystore rkp_cert_processor (binder (call transfer)))
+(allow rkp_cert_processor keystore (binder (transfer)))
+(allow keystore rkp_cert_processor (fd (use)))
+(allow keystore system_server (binder (call transfer)))
+(allow system_server keystore (binder (transfer)))
+(allow keystore system_server (fd (use)))
+(allow keystore wificond (binder (call transfer)))
+(allow wificond keystore (binder (transfer)))
+(allow keystore wificond (fd (use)))
+(allow keystore keystore_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow keystore keystore_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow keystore keystore_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow keystore keystore_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow keystore keystore_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow keystore keystore_exec (file (getattr)))
+(allow keystore keystore_service (service_manager (add find)))
+;;* lmx 62 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_service (service_manager (add)))
+;;* lme
+
+(allow keystore sec_key_att_app_id_provider_service (service_manager (find)))
+(allow keystore remote_provisioning_service (service_manager (find)))
+(allow keystore rkp_cert_processor_service (service_manager (find)))
+(allow keystore apex_service (service_manager (find)))
+(allow keystore apexd (binder (call)))
+(allow keystore apc_service (service_manager (add find)))
+;;* lmx 71 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 apc_service (service_manager (add)))
+;;* lme
+
+(allow keystore keystore_compat_hal_service (service_manager (add find)))
+;;* lmx 72 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_compat_hal_service (service_manager (add)))
+;;* lme
+
+(allow keystore authorization_service (service_manager (add find)))
+;;* lmx 73 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 authorization_service (service_manager (add)))
+;;* lme
+
+(allow keystore keystore_maintenance_service (service_manager (add find)))
+;;* lmx 74 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_maintenance_service (service_manager (add)))
+;;* lme
+
+(allow keystore keystore_metrics_service (service_manager (add find)))
+;;* lmx 75 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_metrics_service (service_manager (add)))
+;;* lme
+
+(allow keystore legacykeystore_service (service_manager (add find)))
+;;* lmx 76 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 legacykeystore_service (service_manager (add)))
+;;* lme
+
+(allow keystore selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow keystore selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore selinuxfs (file (write lock append map open)))
+(allow keystore kernel (security (compute_av)))
+(allow keystore self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow keystore cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow keystore cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow keystore cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow keystore vendor_security_patch_level_prop (file (read getattr map open)))
+(allow keystore keystore_config_prop (file (read getattr map open)))
+;;* lmx 97 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_data_file (dir (write lock relabelfrom append map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 98 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_777 keystore_data_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_777 keystore_data_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_777 keystore_data_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_777 keystore_data_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 100 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_778 keystore_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 101 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_778 keystore_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_778 keystore_data_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_778 keystore_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_778 keystore_data_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 103 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_236 keystore (process (ptrace)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/private/keystore.te
+
+(neverallow base_typeattr_778 keystore_diagnostics_prop (property_service (set)))
+;;* lme
+
+(allow init linkerconfig_exec (file (read getattr map execute open)))
+(allow init linkerconfig (process (transition)))
+(allow linkerconfig linkerconfig_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init linkerconfig (process (noatsecure)))
+(allow init linkerconfig (process (siginh rlimitinh)))
+(typetransition init linkerconfig_exec process linkerconfig)
+(allow linkerconfig linkerconfig_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow linkerconfig linkerconfig_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow linkerconfig kmsg_device (chr_file (write lock append map open)))
+(allow linkerconfig devpts (chr_file (ioctl read write getattr)))
+(allow linkerconfig apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow linkerconfig apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow linkerconfig vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow linkerconfig vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow linkerconfig vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow linkerconfig otapreopt_chroot (fd (use)))
+(allow linkerconfig postinstall_apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow linkerconfig postinstall_apex_mnt_dir (file (ioctl read getattr lock map open watch watch_reads)))
+(allow linkerconfig dexopt_chroot_setup (fd (use)))
+;;* lmx 39 system/sepolicy/private/linkerconfig.te
+
+(neverallow base_typeattr_779 linkerconfig_exec (file (execute execute_no_trans)))
+;;* lme
+
+(allow init linux_vm_setup_exec (file (read getattr map execute open)))
+(allow init linux_vm_setup (process (transition)))
+(allow linux_vm_setup linux_vm_setup_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init linux_vm_setup (process (noatsecure)))
+(allow init linux_vm_setup (process (siginh rlimitinh)))
+(typetransition init linux_vm_setup_exec process linux_vm_setup)
+(allow init llkd_exec (file (read getattr map execute open)))
+(allow init llkd (process (transition)))
+(allow llkd llkd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init llkd (process (noatsecure)))
+(allow init llkd (process (siginh rlimitinh)))
+(typetransition init llkd_exec process llkd)
+(allow llkd llkd_prop (file (read getattr map open)))
+(allow llkd self (capability (kill)))
+(allow llkd self (cap_userns (kill)))
+(allow llkd self (capability (ipc_lock)))
+(allow llkd self (cap_userns (ipc_lock)))
+(allow llkd domain (process (sigkill)))
+(allow llkd domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow llkd domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow llkd domain (lnk_file (read)))
+(allow llkd proc_hung_task (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow llkd proc_sysrq (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow llkd kmsg_device (chr_file (write lock append map open)))
+;;* lmx 49 system/sepolicy/private/llkd.te
+
+(neverallow base_typeattr_235 llkd (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/llkd.te
+
+(neverallow domain llkd (process (ptrace)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/private/llkd.te
+
+(neverallow base_typeattr_236 llkd (process (noatsecure)))
+;;* lme
+
+(allow init lmkd_exec (file (read getattr map execute open)))
+(allow init lmkd (process (transition)))
+(allow lmkd lmkd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init lmkd (process (noatsecure)))
+(allow init lmkd (process (siginh rlimitinh)))
+(typetransition init lmkd_exec process lmkd)
+(allow lmkd property_socket (sock_file (write)))
+(allow lmkd init (unix_stream_socket (connectto)))
+(allow lmkd system_lmk_prop (property_service (set)))
+(allow lmkd system_lmk_prop (file (read getattr map open)))
+(allow lmkd property_socket (sock_file (write)))
+(allow lmkd init (unix_stream_socket (connectto)))
+(allow lmkd lmkd_prop (property_service (set)))
+(allow lmkd lmkd_prop (file (read getattr map open)))
+(allow lmkd device_config_lmkd_native_prop (file (read getattr map open)))
+(allow lmkd debugfs_tracing (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd self (perf_event (open cpu kernel write)))
+(allow lmkd fs_bpf (file (read)))
+(allow lmkd bpfloader (bpf (map_read map_write prog_run)))
+(allow lmkd fs_bpf_memevents (file (read write)))
+(allow lmkd fs_bpf_memevents (dir (search)))
+(allow lmkd self (capability (dac_override dac_read_search kill sys_resource)))
+(allow lmkd self (cap_userns (dac_override dac_read_search kill sys_resource)))
+(allow lmkd self (capability (ipc_lock)))
+(allow lmkd self (cap_userns (ipc_lock)))
+(allow lmkd domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lmkd domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd domain (file (write)))
+(allow lmkd sysfs_lowmemorykiller (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lmkd sysfs_lowmemorykiller (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd sysfs_lowmemorykiller (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd sysfs_lowmemorykiller (file (write lock append map open)))
+(allow lmkd domain (process (sigkill setsched)))
+(allow lmkd kernel (process (setsched)))
+(allow lmkd cgroup (dir (remove_name rmdir)))
+(allow lmkd cgroup_v2 (dir (remove_name rmdir)))
+(allow lmkd cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd self (capability (sys_nice)))
+(allow lmkd self (cap_userns (sys_nice)))
+(allow lmkd proc_zoneinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd domain (dir (read open search)))
+(allow lmkd domain (file (read open)))
+(allow lmkd proc_sysrq (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow lmkd proc_lowmemorykiller (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd proc_pressure_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd proc_pressure_io (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lmkd proc_pressure_mem (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow lmkd lmkd_socket (sock_file (write)))
+(allow lmkd statsdw_socket (sock_file (write)))
+(allow lmkd statsd (unix_dgram_socket (sendto)))
+;;* lmx 92 system/sepolicy/private/lmkd.te
+
+(neverallow base_typeattr_236 lmkd (process (noatsecure)))
+;;* lme
+
+;;* lmx 93 system/sepolicy/private/lmkd.te
+
+(neverallow lmkd self (capability (sys_ptrace)))
+(neverallow lmkd self (cap_userns (sys_ptrace)))
+;;* lme
+
+;;* lmx 94 system/sepolicy/private/lmkd.te
+
+(neverallow base_typeattr_780 lmkd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 95 system/sepolicy/private/lmkd.te
+
+(neverallow lmkd self (perf_event (tracepoint read)))
+;;* lme
+
+(allow init logd_exec (file (read getattr map execute open)))
+(allow init logd (process (transition)))
+(allow logd logd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init logd (process (noatsecure)))
+(allow init logd (process (siginh rlimitinh)))
+(typetransition init logd_exec process logd)
+(allow logd device_logging_prop (file (read getattr map open)))
+;;* lmx 17 system/sepolicy/private/logd.te
+
+(neverallow logd base_typeattr_781 (file (write create append)))
+;;* lme
+
+;;* lmx 32 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_782 runtime_event_log_tags_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_783 runtime_event_log_tags_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow logd servicemanager (binder (call transfer)))
+(allow servicemanager logd (binder (call transfer)))
+(allow servicemanager logd (dir (search)))
+(allow servicemanager logd (file (read open)))
+(allow servicemanager logd (process (getattr)))
+(allow logd system_server (binder (call transfer)))
+(allow system_server logd (binder (transfer)))
+(allow logd system_server (fd (use)))
+(allow logd logd_service (service_manager (add find)))
+;;* lmx 50 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_784 logd_service (service_manager (add)))
+;;* lme
+
+(allow logd logcat_service (service_manager (find)))
+(allow logd cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow logd cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow logd cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd proc_kmsg (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow logd proc_kmsg (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd proc_kmsg (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd proc_meminfo (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow logd proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd proc_meminfo (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd self (capability (setgid setuid setpcap sys_nice audit_control)))
+(allow logd self (cap_userns (setgid setuid setpcap sys_nice audit_control)))
+(allow logd self (capability2 (syslog)))
+(allow logd self (cap2_userns (syslog)))
+(allow logd self (netlink_audit_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_write)))
+(allow logd kernel (system (syslog_read)))
+(allow logd kmsg_device (chr_file (write getattr lock append map open)))
+(allow logd system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd pstorefs (dir (search)))
+(allow logd pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd runtime_event_log_tags_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow logd domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow logd domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow logd kernel (system (syslog_mod)))
+(allow logd logd_socket (sock_file (write)))
+(allow logd logd (unix_stream_socket (connectto)))
+(allow logd runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow runtime_event_log_tags_file tmpfs (filesystem (associate)))
+(dontaudit domain runtime_event_log_tags_file (file (read map open)))
+(allow logd property_socket (sock_file (write)))
+(allow logd init (unix_stream_socket (connectto)))
+(allow logd logd_prop (property_service (set)))
+(allow logd logd_prop (file (read getattr map open)))
+;;* lmx 99 system/sepolicy/private/logd.te
+
+(neverallow logd dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 102 system/sepolicy/private/logd.te
+
+(neverallow logd domain (process (ptrace)))
+;;* lme
+
+;;* lmx 105 system/sepolicy/private/logd.te
+
+(neverallow domain logd (process (ptrace)))
+;;* lme
+
+;;* lmx 108 system/sepolicy/private/logd.te
+
+(neverallow logd system_file_type (file (write)))
+(neverallow logd system_file_type (dir (write)))
+(neverallow logd system_file_type (lnk_file (write)))
+(neverallow logd system_file_type (chr_file (write)))
+(neverallow logd system_file_type (blk_file (write)))
+(neverallow logd system_file_type (sock_file (write)))
+(neverallow logd system_file_type (fifo_file (write)))
+;;* lme
+
+;;* lmx 116 system/sepolicy/private/logd.te
+
+(neverallow logd base_typeattr_785 (file (write)))
+(neverallow logd base_typeattr_785 (dir (write)))
+(neverallow logd base_typeattr_785 (lnk_file (write)))
+(neverallow logd base_typeattr_785 (chr_file (write)))
+(neverallow logd base_typeattr_785 (blk_file (write)))
+(neverallow logd base_typeattr_785 (sock_file (write)))
+(neverallow logd base_typeattr_785 (fifo_file (write)))
+;;* lme
+
+;;* lmx 119 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_235 logd (process (transition)))
+;;* lme
+
+;;* lmx 120 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_236 logd (process (dyntransition)))
+;;* lme
+
+;;* lmx 127 system/sepolicy/private/logd.te
+
+(neverallow base_typeattr_786 runtime_event_log_tags_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+(allow logpersist shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow logpersist logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allowx logpersist misc_logd_file (ioctl file (0x6602)))
+(allowx logpersist misc_logd_file (ioctl file (0xf512)))
+;;* lmx 38 system/sepolicy/private/logpersist.te
+
+(neverallow logpersist dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 41 system/sepolicy/private/logpersist.te
+
+(neverallow logpersist domain (process (ptrace)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/logpersist.te
+
+(neverallow logpersist app_data_file_type (file (write)))
+(neverallow logpersist app_data_file_type (dir (write)))
+(neverallow logpersist app_data_file_type (lnk_file (write)))
+(neverallow logpersist app_data_file_type (chr_file (write)))
+(neverallow logpersist app_data_file_type (blk_file (write)))
+(neverallow logpersist app_data_file_type (sock_file (write)))
+(neverallow logpersist app_data_file_type (fifo_file (write)))
+(neverallow logpersist system_data_file (file (write)))
+(neverallow logpersist system_data_file (dir (write)))
+(neverallow logpersist system_data_file (lnk_file (write)))
+(neverallow logpersist system_data_file (chr_file (write)))
+(neverallow logpersist system_data_file (blk_file (write)))
+(neverallow logpersist system_data_file (sock_file (write)))
+(neverallow logpersist system_data_file (fifo_file (write)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/private/logpersist.te
+
+(neverallow base_typeattr_236 logpersist (process (dyntransition)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/logpersist.te
+
+(neverallow logpersist file_type (file (write create append)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/private/logpersist.te
+
+(neverallow base_typeattr_787 misc_logd_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 63 system/sepolicy/private/logpersist.te
+
+(neverallow base_typeattr_235 misc_logd_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/logpersist.te
+
+(neverallow base_typeattr_235 misc_logd_file (dir (write relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+(allow init lpdumpd_exec (file (read getattr map execute open)))
+(allow init lpdumpd (process (transition)))
+(allow lpdumpd lpdumpd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init lpdumpd (process (noatsecure)))
+(allow init lpdumpd (process (siginh rlimitinh)))
+(typetransition init lpdumpd_exec process lpdumpd)
+(allow lpdumpd servicemanager (binder (call transfer)))
+(allow servicemanager lpdumpd (binder (call transfer)))
+(allow servicemanager lpdumpd (dir (search)))
+(allow servicemanager lpdumpd (file (read open)))
+(allow servicemanager lpdumpd (process (getattr)))
+(allow lpdumpd lpdump_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/lpdumpd.te
+
+(neverallow base_typeattr_788 lpdump_service (service_manager (add)))
+;;* lme
+
+(allow lpdumpd block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lpdumpd super_block_device_type (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lpdumpd sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd gsi_metadata_file_type (dir (search)))
+(allow lpdumpd metadata_file (dir (search)))
+(allow lpdumpd gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lpdumpd sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd sysfs_dt_firmware_android (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow lpdumpd virtual_ab_prop (file (read getattr map open)))
+(allow lpdumpd metadata_file (dir (search)))
+(allow lpdumpd ota_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow lpdumpd ota_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 39 system/sepolicy/private/lpdumpd.te
+
+(neverallow base_typeattr_789 lpdump_service (service_manager (find)))
+;;* lme
+
+;;* lmx 47 system/sepolicy/private/lpdumpd.te
+
+(neverallow base_typeattr_790 lpdumpd (binder (call)))
+;;* lme
+
+(allow init mdnsd_exec (file (read getattr map execute open)))
+(allow init mdnsd (process (transition)))
+(allow mdnsd mdnsd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mdnsd (process (noatsecure)))
+(allow init mdnsd (process (siginh rlimitinh)))
+(typetransition init mdnsd_exec process mdnsd)
+(allow mdnsd proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mdnsd proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mdnsd proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init mediadrmserver_exec (file (read getattr map execute open)))
+(allow init mediadrmserver (process (transition)))
+(allow mediadrmserver mediadrmserver_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediadrmserver (process (noatsecure)))
+(allow init mediadrmserver (process (siginh rlimitinh)))
+(typetransition init mediadrmserver_exec process mediadrmserver)
+(auditallow mediadrmserver hal_graphics_allocator_server (binder (call)))
+(allow mediadrmserver servicemanager (binder (call transfer)))
+(allow servicemanager mediadrmserver (binder (call transfer)))
+(allow servicemanager mediadrmserver (dir (search)))
+(allow servicemanager mediadrmserver (file (read open)))
+(allow servicemanager mediadrmserver (process (getattr)))
+(allow mediadrmserver binderservicedomain (binder (call transfer)))
+(allow binderservicedomain mediadrmserver (binder (transfer)))
+(allow mediadrmserver binderservicedomain (fd (use)))
+(allow mediadrmserver appdomain (binder (call transfer)))
+(allow appdomain mediadrmserver (binder (transfer)))
+(allow mediadrmserver appdomain (fd (use)))
+(allow mediadrmserver mediadrmserver_service (service_manager (add find)))
+;;* lmx 18 system/sepolicy/private/mediadrmserver.te
+
+(neverallow base_typeattr_791 mediadrmserver_service (service_manager (add)))
+;;* lme
+
+(allow mediadrmserver mediaserver_service (service_manager (find)))
+(allow mediadrmserver mediametrics_service (service_manager (find)))
+(allow mediadrmserver processinfo_service (service_manager (find)))
+(allow mediadrmserver surfaceflinger_service (service_manager (find)))
+(allow mediadrmserver system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediadrmserver hal_omx_server (binder (call transfer)))
+(allow hal_omx_server mediadrmserver (binder (transfer)))
+(allow mediadrmserver hal_omx_server (fd (use)))
+;;* lmx 34 system/sepolicy/private/mediadrmserver.te
+
+(neverallow mediadrmserver fs_type (file (execute_no_trans)))
+(neverallow mediadrmserver file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/mediadrmserver.te
+
+(neverallowx mediadrmserver domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx mediadrmserver domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx mediadrmserver domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/mediadrmserver.te
+
+(neverallowx mediadrmserver domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediadrmserver domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediadrmserver domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/mediadrmserver.te
+
+(neverallowx mediadrmserver domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediadrmserver domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediadrmserver domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+(allow init mediaextractor_exec (file (read getattr map execute open)))
+(allow init mediaextractor (process (transition)))
+(allow mediaextractor mediaextractor_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediaextractor (process (noatsecure)))
+(allow init mediaextractor (process (siginh rlimitinh)))
+(typetransition init mediaextractor_exec process mediaextractor)
+(typetransition mediaextractor tmpfs file mediaextractor_tmpfs)
+(allow mediaextractor mediaextractor_tmpfs (file (read write getattr map)))
+(allow mediaextractor appdomain_tmpfs (file (read write getattr map)))
+(allow mediaextractor mediaserver_tmpfs (file (read write getattr map)))
+(allow mediaextractor system_server_tmpfs (file (read write getattr map)))
+(allow mediaextractor device_config_media_native_prop (file (read getattr map open)))
+(allow mediaextractor device_config_swcodec_native_prop (file (read getattr map open)))
+(allow mediaextractor servicemanager (binder (call transfer)))
+(allow servicemanager mediaextractor (binder (call transfer)))
+(allow servicemanager mediaextractor (dir (search)))
+(allow servicemanager mediaextractor (file (read open)))
+(allow servicemanager mediaextractor (process (getattr)))
+(allow mediaextractor binderservicedomain (binder (call transfer)))
+(allow binderservicedomain mediaextractor (binder (transfer)))
+(allow mediaextractor binderservicedomain (fd (use)))
+(allow mediaextractor appdomain (binder (call transfer)))
+(allow appdomain mediaextractor (binder (transfer)))
+(allow mediaextractor appdomain (fd (use)))
+(allow mediaextractor mediaextractor_service (service_manager (add find)))
+;;* lmx 19 system/sepolicy/private/mediaextractor.te
+
+(neverallow base_typeattr_792 mediaextractor_service (service_manager (add)))
+;;* lme
+
+(allow mediaextractor mediametrics_service (service_manager (find)))
+(allow mediaextractor hidl_token_hwservice (hwservice_manager (find)))
+(allow mediaextractor system_server (fd (use)))
+(allow mediaextractor cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaextractor cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaextractor cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaextractor cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaextractor cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaextractor cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaextractor proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaextractor anr_data_file (file (append)))
+(allow mediaextractor dumpstate (fd (use)))
+(allow mediaextractor incidentd (fd (use)))
+(allow mediaextractor dumpstate (fifo_file (write append)))
+(allow mediaextractor incidentd (fifo_file (write append)))
+(allow mediaextractor system_server (fifo_file (write append)))
+(allow mediaextractor tombstoned (unix_stream_socket (connectto)))
+(allow mediaextractor tombstoned (fd (use)))
+(allow mediaextractor tombstoned_crash_socket (sock_file (write)))
+(allow mediaextractor tombstone_data_file (file (append)))
+(allow mediaextractor sdcard_type (file (read getattr)))
+(allow mediaextractor fuse (file (read getattr)))
+(allow mediaextractor media_rw_data_file (file (read getattr)))
+(allow mediaextractor app_data_file (file (read getattr)))
+(allow mediaextractor privapp_data_file (file (read getattr)))
+(allow mediaextractor apk_data_file (file (read getattr)))
+(allow mediaextractor asec_apk_file (file (read getattr)))
+(allow mediaextractor ringtone_file (file (read getattr)))
+(allow mediaextractor vendor_overlay_file (file (read map)))
+(allow mediaextractor system_file (dir (read open)))
+;;* lmx 56 system/sepolicy/private/mediaextractor.te
+
+(neverallow mediaextractor fs_type (file (execute_no_trans)))
+(neverallow mediaextractor file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/mediaextractor.te
+
+(neverallow mediaextractor domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow mediaextractor domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/mediaextractor.te
+
+(neverallow mediaextractor domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/private/mediaextractor.te
+
+(neverallow mediaextractor data_file_type (file (open)))
+;;* lme
+
+(allow init mediametrics_exec (file (read getattr map execute open)))
+(allow init mediametrics (process (transition)))
+(allow mediametrics mediametrics_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediametrics (process (noatsecure)))
+(allow init mediametrics (process (siginh rlimitinh)))
+(typetransition init mediametrics_exec process mediametrics)
+(allow mediametrics stats_service (service_manager (find)))
+(allow mediametrics statsmanager_service (service_manager (find)))
+(allow mediametrics statsd (binder (call transfer)))
+(allow statsd mediametrics (binder (transfer)))
+(allow mediametrics statsd (fd (use)))
+(allow mediametrics servicemanager (binder (call transfer)))
+(allow servicemanager mediametrics (binder (call transfer)))
+(allow servicemanager mediametrics (dir (search)))
+(allow servicemanager mediametrics (file (read open)))
+(allow servicemanager mediametrics (process (getattr)))
+(allow mediametrics binderservicedomain (binder (call transfer)))
+(allow binderservicedomain mediametrics (binder (transfer)))
+(allow mediametrics binderservicedomain (fd (use)))
+(allow mediametrics mediametrics_service (service_manager (add find)))
+;;* lmx 14 system/sepolicy/private/mediametrics.te
+
+(neverallow base_typeattr_793 mediametrics_service (service_manager (add)))
+;;* lme
+
+(allow mediametrics system_server (fd (use)))
+(allow mediametrics cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediametrics cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediametrics cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediametrics cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediametrics cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediametrics cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediametrics proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediametrics app_data_file (file (write)))
+(allow mediametrics privapp_data_file (file (write)))
+(allow mediametrics package_native_service (service_manager (find)))
+(allow mediametrics statsdw_socket (sock_file (write)))
+(allow mediametrics statsd (unix_dgram_socket (sendto)))
+;;* lmx 37 system/sepolicy/private/mediametrics.te
+
+(neverallow mediametrics fs_type (file (execute_no_trans)))
+(neverallow mediametrics file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/mediametrics.te
+
+(neverallow mediametrics domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow mediametrics domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/mediametrics.te
+
+(neverallow mediametrics domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(typetransition mediaprovider tmpfs file appdomain_tmpfs)
+(allow mediaprovider mediaprovider_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su mediaprovider_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 7 system/sepolicy/private/mediaprovider.te
+
+(neverallow base_typeattr_794 mediaprovider_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow mediaprovider appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 7 system/sepolicy/private/mediaprovider.te
+
+(neverallow base_typeattr_795 base_typeattr_794 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/mediaprovider.te
+
+(neverallow base_typeattr_796 mediaprovider (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/mediaprovider.te
+
+(neverallow base_typeattr_797 mediaprovider (process (ptrace)))
+;;* lme
+
+(allow mediaprovider cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mediaprovider cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mediaprovider cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit mediaprovider cache_private_backup_file (dir (getattr)))
+(dontaudit mediaprovider cache_recovery_file (dir (getattr)))
+(allow mediaprovider mnt_media_rw_file (dir (search)))
+(allow mediaprovider app_api_service (service_manager (find)))
+(allow mediaprovider audioserver_service (service_manager (find)))
+(allow mediaprovider cameraserver_service (service_manager (find)))
+(allow mediaprovider drmserver_service (service_manager (find)))
+(allow mediaprovider mediaextractor_service (service_manager (find)))
+(allow mediaprovider mediaserver_service (service_manager (find)))
+(allow mediaprovider ringtone_file (file (read write getattr)))
+(allow mediaprovider mtp_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaprovider functionfs (dir (search)))
+(allow mediaprovider functionfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx mediaprovider functionfs (ioctl file (0x6782)))
+(allowx mediaprovider functionfs (ioctl file (0x67e7)))
+(allow mediaprovider ffs_config_prop (file (read getattr map open)))
+(allow mediaprovider property_socket (sock_file (write)))
+(allow mediaprovider init (unix_stream_socket (connectto)))
+(allow mediaprovider ffs_control_prop (property_service (set)))
+(allow mediaprovider ffs_control_prop (file (read getattr map open)))
+(allow mediaprovider drm_service_config_prop (file (read getattr map open)))
+(typetransition mediaprovider_app tmpfs file appdomain_tmpfs)
+(allow mediaprovider_app mediaprovider_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su mediaprovider_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/mediaprovider_app.te
+
+(neverallow base_typeattr_798 mediaprovider_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow mediaprovider_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/mediaprovider_app.te
+
+(neverallow base_typeattr_799 base_typeattr_798 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/mediaprovider_app.te
+
+(neverallow base_typeattr_800 mediaprovider_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/mediaprovider_app.te
+
+(neverallow base_typeattr_801 mediaprovider_app (process (ptrace)))
+;;* lme
+
+(allow mediaprovider_app mnt_pass_through_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaprovider_app mnt_pass_through_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaprovider_app mnt_pass_through_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaprovider_app fuse_device (chr_file (ioctl read write getattr)))
+(allow mediaprovider_app fuseblk (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mediaprovider_app fuseblk (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mediaprovider_app media_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaprovider_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mediaprovider_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mediaprovider_app drmserver_service (service_manager (find)))
+(allow mediaprovider_app mediaserver_service (service_manager (find)))
+(allow mediaprovider_app audioserver_service (service_manager (find)))
+(allow mediaprovider_app mediametrics_service (service_manager (find)))
+(allow mediaprovider_app app_api_service (service_manager (find)))
+(allow mediaprovider_app gpuservice (binder (call transfer)))
+(allow gpuservice mediaprovider_app (binder (transfer)))
+(allow mediaprovider_app gpuservice (fd (use)))
+(allow mediaprovider_app statsmanager_service (service_manager (find)))
+(allow mediaprovider_app statsd (binder (call transfer)))
+(allow statsd mediaprovider_app (binder (transfer)))
+(allow mediaprovider_app statsd (fd (use)))
+(allow mediaprovider_app proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx mediaprovider_app media_rw_data_file (ioctl file ((range 0x581f 0x5820))))
+(allowx mediaprovider_app media_rw_data_file (ioctl dir ((range 0x581f 0x5820))))
+(allowx mediaprovider_app media_rw_data_file (ioctl file ((range 0x6601 0x6602))))
+(allowx mediaprovider_app media_rw_data_file (ioctl dir ((range 0x6601 0x6602))))
+(allow mediaprovider_app mnt_media_rw_file (dir (search)))
+(allow mediaprovider_app proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaprovider_app storage_config_prop (file (read getattr map open)))
+(allow mediaprovider_app drm_service_config_prop (file (read getattr map open)))
+(allow mediaprovider_app gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaprovider_app gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit mediaprovider_app sysfs_vendor_sched (dir (search)))
+(dontaudit mediaprovider_app sysfs_vendor_sched (file (write lock append map open)))
+(allow mediaprovider_app fs_bpf (file (read)))
+(allow mediaprovider_app bpfloader (bpf (map_read map_write prog_run)))
+(allow mediaprovider_app bootanim_oem_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow init mediaserver_exec (file (read getattr map execute open)))
+(allow init mediaserver (process (transition)))
+(allow mediaserver mediaserver_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediaserver (process (noatsecure)))
+(allow init mediaserver (process (siginh rlimitinh)))
+(typetransition init mediaserver_exec process mediaserver)
+(typetransition mediaserver tmpfs file mediaserver_tmpfs)
+(allow mediaserver mediaserver_tmpfs (file (read write getattr map)))
+(allow mediaserver appdomain_tmpfs (file (read write getattr map)))
+(allow mediaserver property_socket (sock_file (write)))
+(allow mediaserver init (unix_stream_socket (connectto)))
+(allow mediaserver audio_prop (property_service (set)))
+(allow mediaserver audio_prop (file (read getattr map open)))
+(allow mediaserver drm_service_config_prop (file (read getattr map open)))
+(allow mediaserver media_config_prop (file (read getattr map open)))
+(allow mediaserver device_config_media_native_prop (file (read getattr map open)))
+(allow mediaserver property_socket (sock_file (write)))
+(allow mediaserver init (unix_stream_socket (connectto)))
+(allow mediaserver ctl_mediatranscoding_prop (property_service (set)))
+(allow mediaserver ctl_mediatranscoding_prop (file (read getattr map open)))
+(allow mediaserver sdk_sandbox_data_file (file (read getattr)))
+(allow mediaserver stats_service (service_manager (find)))
+(allow mediaserver statsmanager_service (service_manager (find)))
+(allow mediaserver statsd (binder (call transfer)))
+(allow statsd mediaserver (binder (transfer)))
+(allow mediaserver statsd (fd (use)))
+(allow mediaserver virtual_camera (binder (call transfer)))
+(allow virtual_camera mediaserver (binder (transfer)))
+(allow mediaserver virtual_camera (fd (use)))
+(allow mediaserver sdcard_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver sdcard_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver sdcard_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver fuse (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver fuse (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver fuse (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver proc (lnk_file (getattr)))
+(allow mediaserver system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver servicemanager (binder (call transfer)))
+(allow servicemanager mediaserver (binder (call transfer)))
+(allow servicemanager mediaserver (dir (search)))
+(allow servicemanager mediaserver (file (read open)))
+(allow servicemanager mediaserver (process (getattr)))
+(allow mediaserver binderservicedomain (binder (call transfer)))
+(allow binderservicedomain mediaserver (binder (transfer)))
+(allow mediaserver binderservicedomain (fd (use)))
+(allow mediaserver appdomain (binder (call transfer)))
+(allow appdomain mediaserver (binder (transfer)))
+(allow mediaserver appdomain (fd (use)))
+(allow mediaserver media_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mediaserver media_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mediaserver app_data_file (file (ioctl read write getattr lock append map)))
+(allow mediaserver privapp_data_file (file (ioctl read write getattr lock append map)))
+(allow mediaserver sdcard_type (file (write)))
+(allow mediaserver fuse (file (write)))
+(allow mediaserver gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaserver gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver video_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver video_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaserver apk_data_file (file (read getattr)))
+(allow mediaserver asec_apk_file (file (read getattr)))
+(allow mediaserver ringtone_file (file (read getattr)))
+(allow mediaserver radio_data_file (file (read getattr)))
+(allow mediaserver appdomain (fifo_file (read write getattr)))
+(allow mediaserver rpmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaserver system_server (fifo_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver media_rw_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediaserver media_rw_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver media_rw_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver app_fuse_file (file (read getattr)))
+(allow mediaserver drmserver_socket (sock_file (write)))
+(allow mediaserver drmserver (unix_stream_socket (connectto)))
+(allow mediaserver bluetooth_socket (sock_file (write)))
+(allow mediaserver bluetooth (unix_stream_socket (connectto)))
+(allow mediaserver statsdw_socket (sock_file (write)))
+(allow mediaserver statsd (unix_dgram_socket (sendto)))
+(allow mediaserver mediaserver_service (service_manager (add find)))
+;;* lmx 103 system/sepolicy/private/mediaserver.te
+
+(neverallow base_typeattr_802 mediaserver_service (service_manager (add)))
+;;* lme
+
+(allow mediaserver activity_service (service_manager (find)))
+(allow mediaserver appops_service (service_manager (find)))
+(allow mediaserver audio_service (service_manager (find)))
+(allow mediaserver audioserver_service (service_manager (find)))
+(allow mediaserver cameraserver_service (service_manager (find)))
+(allow mediaserver batterystats_service (service_manager (find)))
+(allow mediaserver drmserver_service (service_manager (find)))
+(allow mediaserver mediaextractor_service (service_manager (find)))
+(allow mediaserver mediametrics_service (service_manager (find)))
+(allow mediaserver media_session_service (service_manager (find)))
+(allow mediaserver package_native_service (service_manager (find)))
+(allow mediaserver permission_service (service_manager (find)))
+(allow mediaserver permission_checker_service (service_manager (find)))
+(allow mediaserver power_service (service_manager (find)))
+(allow mediaserver processinfo_service (service_manager (find)))
+(allow mediaserver scheduling_policy_service (service_manager (find)))
+(allow mediaserver surfaceflinger_service (service_manager (find)))
+(allow mediaserver mediadrmserver_service (service_manager (find)))
+(allow mediaserver hidl_token_hwservice (hwservice_manager (find)))
+(allow mediaserver oemfs (dir (search)))
+(allow mediaserver oemfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver bootanim_oem_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver vendor_app_file (file (read getattr map)))
+(allow drmserver mediaserver (dir (search)))
+(allow drmserver mediaserver (file (read open)))
+(allow drmserver mediaserver (process (getattr)))
+(allow mediaserver drmserver (drmservice (consumeRights setPlaybackStatus openDecryptSession closeDecryptSession initializeDecryptUnit decrypt finalizeDecryptUnit pread)))
+(allowx mediaserver self (ioctl tcp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx mediaserver self (ioctl udp_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx mediaserver self (ioctl rawip_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx mediaserver self (ioctl tcp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx mediaserver self (ioctl udp_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx mediaserver self (ioctl rawip_socket ((range 0x8906 0x8907) 0x8910 (range 0x8912 0x8913) 0x8915 0x8917 0x8919 0x891b 0x8921 0x8933 0x8938 0x8942)))
+(allowx mediaserver self (ioctl tcp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx mediaserver self (ioctl udp_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allowx mediaserver self (ioctl rawip_socket (0x8b01 0x8b05 0x8b07 0x8b09 0x8b0b 0x8b0d 0x8b0f (range 0x8b11 0x8b13) 0x8b21 0x8b23 0x8b25 0x8b27 0x8b29 0x8b2d)))
+(allow mediaserver media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mediaserver media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mediaserver preloads_media_file (file (ioctl read getattr)))
+(allow mediaserver ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaserver hal_graphics_allocator (fd (use)))
+(allow mediaserver hal_graphics_composer (fd (use)))
+(allow mediaserver hal_camera (fd (use)))
+(allow mediaserver system_server (fd (use)))
+(allow mediaserver vold (fd (use)))
+(allow mediaserver vendor_overlay_file (file (read getattr map)))
+;;* lmx 186 system/sepolicy/private/mediaserver.te
+
+(neverallow mediaserver fs_type (file (execute_no_trans)))
+(neverallow mediaserver file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 189 system/sepolicy/private/mediaserver.te
+
+(neverallowx mediaserver domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx mediaserver domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx mediaserver domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 189 system/sepolicy/private/mediaserver.te
+
+(neverallowx mediaserver domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaserver domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediaserver domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 189 system/sepolicy/private/mediaserver.te
+
+(neverallowx mediaserver domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaserver domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediaserver domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+(allow init mediaswcodec_exec (file (read getattr map execute open)))
+(allow init mediaswcodec (process (transition)))
+(allow mediaswcodec mediaswcodec_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediaswcodec (process (noatsecure)))
+(allow init mediaswcodec (process (siginh rlimitinh)))
+(typetransition init mediaswcodec_exec process mediaswcodec)
+(allow mediaswcodec device_config_media_native_prop (file (read getattr map open)))
+(allow mediaswcodec device_config_swcodec_native_prop (file (read getattr map open)))
+(allow mediaswcodec aac_drc_prop (file (read getattr map open)))
+(allow mediaswcodec anr_data_file (file (append)))
+(allow mediaswcodec dumpstate (fd (use)))
+(allow mediaswcodec incidentd (fd (use)))
+(allow mediaswcodec dumpstate (fifo_file (write append)))
+(allow mediaswcodec incidentd (fifo_file (write append)))
+(allow mediaswcodec system_server (fifo_file (write append)))
+(allow mediaswcodec tombstoned (unix_stream_socket (connectto)))
+(allow mediaswcodec tombstoned (fd (use)))
+(allow mediaswcodec tombstoned_crash_socket (sock_file (write)))
+(allow mediaswcodec tombstone_data_file (file (append)))
+(allow mediaswcodec dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaswcodec dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediaswcodec gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediaswcodec gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+;;* lmx 34 system/sepolicy/private/mediaswcodec.te
+
+(neverallow mediaswcodec fs_type (file (execute_no_trans)))
+(neverallow mediaswcodec file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 40 system/sepolicy/private/mediaswcodec.te
+
+(neverallow mediaswcodec domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow mediaswcodec domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 41 system/sepolicy/private/mediaswcodec.te
+
+(neverallow mediaswcodec domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(allow init mediatranscoding_exec (file (read getattr map execute open)))
+(allow init mediatranscoding (process (transition)))
+(allow mediatranscoding mediatranscoding_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediatranscoding (process (noatsecure)))
+(allow init mediatranscoding (process (siginh rlimitinh)))
+(typetransition init mediatranscoding_exec process mediatranscoding)
+(typetransition mediatranscoding tmpfs file mediatranscoding_tmpfs)
+(allow mediatranscoding mediatranscoding_tmpfs (file (read write getattr map)))
+(allow mediatranscoding appdomain_tmpfs (file (read write getattr map)))
+(allow mediatranscoding servicemanager (binder (call transfer)))
+(allow servicemanager mediatranscoding (binder (call transfer)))
+(allow servicemanager mediatranscoding (dir (search)))
+(allow servicemanager mediatranscoding (file (read open)))
+(allow servicemanager mediatranscoding (process (getattr)))
+(allow mediatranscoding binderservicedomain (binder (call transfer)))
+(allow binderservicedomain mediatranscoding (binder (transfer)))
+(allow mediatranscoding binderservicedomain (fd (use)))
+(allow mediatranscoding appdomain (binder (call transfer)))
+(allow appdomain mediatranscoding (binder (transfer)))
+(allow mediatranscoding appdomain (fd (use)))
+(allow mediatranscoding mediatranscoding_service (service_manager (add find)))
+;;* lmx 15 system/sepolicy/private/mediatranscoding.te
+
+(neverallow base_typeattr_803 mediatranscoding_service (service_manager (add)))
+;;* lme
+
+(allow mediatranscoding mediaserver_service (service_manager (find)))
+(allow mediatranscoding mediametrics_service (service_manager (find)))
+(allow mediatranscoding mediaextractor_service (service_manager (find)))
+(allow mediatranscoding package_native_service (service_manager (find)))
+(allow mediatranscoding thermal_service (service_manager (find)))
+(allow mediatranscoding system_server (fd (use)))
+(allow mediatranscoding activity_service (service_manager (find)))
+(allow mediatranscoding sdcardfs (file (read write getattr)))
+(allow mediatranscoding media_rw_data_file (file (read write getattr)))
+(allow mediatranscoding apk_data_file (file (read getattr)))
+(allow mediatranscoding app_data_file (file (read write getattr)))
+(allow mediatranscoding shell_data_file (file (read write getattr)))
+(allow mediatranscoding statsdw_socket (sock_file (write)))
+(allow mediatranscoding statsd (unix_dgram_socket (sendto)))
+(allow mediatranscoding dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow mediatranscoding gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mediatranscoding gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mediatranscoding media_config_prop (file (read getattr map open)))
+;;* lmx 53 system/sepolicy/private/mediatranscoding.te
+
+(neverallow mediatranscoding fs_type (file (execute_no_trans)))
+(neverallow mediatranscoding file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 65 system/sepolicy/private/mediatranscoding.te
+
+(neverallow mediatranscoding domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow mediatranscoding domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/mediatranscoding.te
+
+(neverallow mediatranscoding domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+;;* lme
+
+(allow init mediatuner_exec (file (read getattr map execute open)))
+(allow init mediatuner (process (transition)))
+(allow mediatuner mediatuner_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mediatuner (process (noatsecure)))
+(allow init mediatuner (process (siginh rlimitinh)))
+(typetransition init mediatuner_exec process mediatuner)
+(allow mediatuner servicemanager (binder (call transfer)))
+(allow servicemanager mediatuner (binder (call transfer)))
+(allow servicemanager mediatuner (dir (search)))
+(allow servicemanager mediatuner (file (read open)))
+(allow servicemanager mediatuner (process (getattr)))
+(allow mediatuner appdomain (binder (call transfer)))
+(allow appdomain mediatuner (binder (transfer)))
+(allow mediatuner appdomain (fd (use)))
+(allow mediatuner mediatuner_service (service_manager (add find)))
+;;* lmx 14 system/sepolicy/private/mediatuner.te
+
+(neverallow base_typeattr_804 mediatuner_service (service_manager (add)))
+;;* lme
+
+(allow mediatuner system_server (fd (use)))
+(allow mediatuner tv_tuner_resource_mgr_service (service_manager (find)))
+(allow mediatuner package_native_service (service_manager (find)))
+(allow mediatuner system_server (binder (call transfer)))
+(allow system_server mediatuner (binder (transfer)))
+(allow mediatuner system_server (fd (use)))
+(allow mediatuner tuner_config_prop (file (read getattr map open)))
+(allow mediatuner tuner_server_ctl_prop (file (read getattr map open)))
+;;* lmx 32 system/sepolicy/private/mediatuner.te
+
+(neverallow mediatuner fs_type (file (execute_no_trans)))
+(neverallow mediatuner file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 35 system/sepolicy/private/mediatuner.te
+
+(neverallowx mediatuner domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx mediatuner domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx mediatuner domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 35 system/sepolicy/private/mediatuner.te
+
+(neverallowx mediatuner domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediatuner domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx mediatuner domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 35 system/sepolicy/private/mediatuner.te
+
+(neverallowx mediatuner domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediatuner domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx mediatuner domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+(allow init memcgv2_activation_depth_exec (file (read getattr map execute open)))
+(allow init memcgv2_activation_depth (process (transition)))
+(allow memcgv2_activation_depth memcgv2_activation_depth_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init memcgv2_activation_depth (process (noatsecure)))
+(allow init memcgv2_activation_depth (process (siginh rlimitinh)))
+(typetransition init memcgv2_activation_depth_exec process memcgv2_activation_depth)
+(allow memcgv2_activation_depth shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow memcgv2_activation_depth system_file (file (getattr map execute execute_no_trans)))
+(allow memcgv2_activation_depth toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow memcgv2_activation_depth cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow memcgv2_activation_depth libprocessgroup_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow memcgv2_activation_depth libprocessgroup_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow memcgv2_activation_depth cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow memcgv2_activation_depth cgroup_v2 (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow memcgv2_activation_depth property_socket (sock_file (write)))
+(allow memcgv2_activation_depth init (unix_stream_socket (connectto)))
+(allow memcgv2_activation_depth powerctl_prop (property_service (set)))
+(allow memcgv2_activation_depth powerctl_prop (file (read getattr map open)))
+(allow init microfuchsiad_exec (file (read getattr map execute open)))
+(allow init microfuchsiad (process (transition)))
+(allow microfuchsiad microfuchsiad_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init microfuchsiad (process (noatsecure)))
+(allow init microfuchsiad (process (siginh rlimitinh)))
+(typetransition init microfuchsiad_exec process microfuchsiad)
+(allow microfuchsiad servicemanager (binder (call transfer)))
+(allow servicemanager microfuchsiad (binder (call transfer)))
+(allow servicemanager microfuchsiad (dir (search)))
+(allow servicemanager microfuchsiad (file (read open)))
+(allow servicemanager microfuchsiad (process (getattr)))
+(allow microfuchsiad microfuchsia_service (service_manager (add find)))
+;;* lmx 1 system/sepolicy/private/microfuchsiad.te
+
+(neverallow base_typeattr_805 microfuchsia_service (service_manager (add)))
+;;* lme
+
+(allow microfuchsiad system_server (binder (call transfer)))
+(allow system_server microfuchsiad (binder (transfer)))
+(allow microfuchsiad system_server (fd (use)))
+(allow microfuchsiad virtualizationmanager_exec (file (read getattr map execute open)))
+(allow microfuchsiad virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager microfuchsiad (process (sigchld)))
+(dontaudit microfuchsiad virtualizationmanager (process (noatsecure)))
+(allow microfuchsiad virtualizationmanager (process (siginh rlimitinh)))
+(typetransition microfuchsiad virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm microfuchsiad (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager microfuchsiad (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm microfuchsiad (fd (use)))
+(allow virtualizationmanager microfuchsiad (fd (use)))
+(allow microfuchsiad virtualizationmanager (fd (use)))
+(allow crosvm microfuchsiad (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager microfuchsiad (fifo_file (ioctl read write getattr)))
+(allow microfuchsiad virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow microfuchsiad hypervisor_prop (file (read getattr map open)))
+(allow microfuchsiad virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager microfuchsiad (dir (search)))
+(allow virtualizationmanager microfuchsiad (file (read)))
+(allow virtualizationmanager microfuchsiad (lnk_file (read)))
+(allow microfuchsiad devpts (chr_file (ioctl read write getattr open)))
+(allow migrate_legacy_obb_data media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow migrate_legacy_obb_data media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow migrate_legacy_obb_data shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow migrate_legacy_obb_data toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow migrate_legacy_obb_data self (capability (chown dac_override dac_read_search fowner fsetid)))
+(allow migrate_legacy_obb_data mnt_user_file (dir (search)))
+(allow migrate_legacy_obb_data mnt_user_file (lnk_file (read)))
+(allow migrate_legacy_obb_data storage_file (dir (search)))
+(allow migrate_legacy_obb_data storage_file (lnk_file (read)))
+(allow migrate_legacy_obb_data sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow migrate_legacy_obb_data sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow migrate_legacy_obb_data installd (fd (use)))
+(allow migrate_legacy_obb_data installd (file (read)))
+(allow init misctrl_exec (file (read getattr map execute open)))
+(allow init misctrl (process (transition)))
+(allow misctrl misctrl_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init misctrl (process (noatsecure)))
+(allow init misctrl (process (siginh rlimitinh)))
+(typetransition init misctrl_exec process misctrl)
+(allow misctrl misc_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow misctrl block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow misctrl gsi_metadata_file_type (dir (search)))
+(allow misctrl metadata_file (dir (search)))
+(allow misctrl gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow misctrl proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow misctrl proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow misctrl property_socket (sock_file (write)))
+(allow misctrl init (unix_stream_socket (connectto)))
+(allow misctrl misctrl_prop (property_service (set)))
+(allow misctrl misctrl_prop (file (read getattr map open)))
+(dontaudit misctrl sysfs_dt_firmware_android (dir (search)))
+(dontaudit misctrl vendor_property_type (file (read)))
+;;* lmx 16 system/sepolicy/private/mlstrustedsubject.te
+
+(neverallow base_typeattr_806 app_data_file (file (create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_806 privapp_data_file (file (create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_806 storage_area_content_file (file (create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 26 system/sepolicy/private/mlstrustedsubject.te
+
+(neverallow base_typeattr_806 app_data_file (dir (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_806 privapp_data_file (dir (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_806 storage_area_content_file (dir (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 27 system/sepolicy/private/mlstrustedsubject.te
+
+(neverallow base_typeattr_807 storage_area_app_dir (dir (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+(neverallow base_typeattr_807 storage_area_dir (dir (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/mlstrustedsubject.te
+
+(neverallow base_typeattr_808 app_data_file (dir (read getattr search)))
+(neverallow base_typeattr_808 privapp_data_file (dir (read getattr search)))
+(neverallow base_typeattr_808 storage_area_content_file (dir (read getattr search)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/mlstrustedsubject.te
+
+(neverallow base_typeattr_809 storage_area_app_dir (dir (read getattr search)))
+(neverallow base_typeattr_809 storage_area_dir (dir (read getattr search)))
+;;* lme
+
+(allow init mm_events_exec (file (read getattr map execute open)))
+(allow init mm_events (process (transition)))
+(allow mm_events mm_events_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mm_events (process (noatsecure)))
+(allow init mm_events (process (siginh rlimitinh)))
+(typetransition init mm_events_exec process mm_events)
+(allow mm_events shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow mm_events toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow mm_events perfetto_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow mm_events perfetto_exec (file (read getattr map execute open)))
+(allow mm_events perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(allow perfetto mm_events (process (sigchld)))
+(dontaudit mm_events perfetto (process (noatsecure)))
+(allow mm_events perfetto (process (siginh rlimitinh)))
+(typetransition mm_events perfetto_exec process perfetto)
+(allow init mmd_exec (file (read getattr map execute open)))
+(allow init mmd (process (transition)))
+(allow mmd mmd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mmd (process (noatsecure)))
+(allow init mmd (process (siginh rlimitinh)))
+(typetransition init mmd_exec process mmd)
+(allow mmd property_socket (sock_file (write)))
+(allow mmd init (unix_stream_socket (connectto)))
+(allow mmd mmd_prop (property_service (set)))
+(allow mmd mmd_prop (file (read getattr map open)))
+(allow mmd device_config_mmd_native_prop (file (read getattr map open)))
+(allow mmd mmd_service (service_manager (add find)))
+;;* lmx 13 system/sepolicy/private/mmd.te
+
+(neverallow base_typeattr_810 mmd_service (service_manager (add)))
+;;* lme
+
+(allow mmd servicemanager (binder (call transfer)))
+(allow servicemanager mmd (binder (call transfer)))
+(allow servicemanager mmd (dir (search)))
+(allow servicemanager mmd (file (read open)))
+(allow servicemanager mmd (process (getattr)))
+(allow mmd proc_swaps (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mmd sysfs_zram (dir (search)))
+(allow mmd sysfs_zram (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mmd proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mmd block_device (dir (search)))
+(allow mmd swap_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mmd self (capability (sys_admin)))
+(allow modprobe proc_modules (file (ioctl read getattr lock map open watch watch_reads)))
+(allow modprobe proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow modprobe self (capability (sys_module)))
+(allow modprobe self (cap_userns (sys_module)))
+(allow modprobe kernel (key (search)))
+(allow modprobe system_dlkm_file (dir (search)))
+(allow modprobe system_dlkm_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow modprobe system_dlkm_file (system (module_load)))
+(allow init mtectrl_exec (file (read getattr map execute open)))
+(allow init mtectrl (process (transition)))
+(allow mtectrl mtectrl_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init mtectrl (process (noatsecure)))
+(allow init mtectrl (process (siginh rlimitinh)))
+(typetransition init mtectrl_exec process mtectrl)
+(allow mtectrl property_socket (sock_file (write)))
+(allow mtectrl init (unix_stream_socket (connectto)))
+(allow mtectrl arm64_memtag_prop (property_service (set)))
+(allow mtectrl arm64_memtag_prop (file (read getattr map open)))
+(allow mtectrl misc_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow mtectrl block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow mtectrl gsi_metadata_file_type (dir (search)))
+(allow mtectrl metadata_file (dir (search)))
+(allow mtectrl gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mtectrl proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow mtectrl proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit mtectrl sysfs_dt_firmware_android (dir (search)))
+(dontaudit mtectrl vendor_property_type (file (read)))
+(allow base_typeattr_811 node_type (tcp_socket (node_bind)))
+(allow base_typeattr_811 node_type (udp_socket (node_bind)))
+(allow base_typeattr_811 node_type (rawip_socket (node_bind)))
+(allow base_typeattr_811 node_type (icmp_socket (node_bind)))
+(allow base_typeattr_811 port_type (udp_socket (name_bind)))
+(allow base_typeattr_811 port_type (tcp_socket (name_bind)))
+(allow base_typeattr_812 self (netlink_route_socket (bind nlmsg_readpriv nlmsg_getneigh)))
+(allow netdomain self (tcp_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+(allow netdomain self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netdomain self (rawip_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netdomain self (icmp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netdomain port_type (tcp_socket (name_connect)))
+(allow netdomain self (netlink_route_socket (read write create getattr setattr lock append connect getopt setopt shutdown nlmsg_read)))
+(allow netdomain dnsproxyd_socket (sock_file (write)))
+(allow netdomain netd (unix_stream_socket (connectto)))
+(allow netdomain fwmarkd_socket (sock_file (write)))
+(allow netdomain netd (unix_stream_socket (connectto)))
+(allow init netd_exec (file (read getattr map execute open)))
+(allow init netd (process (transition)))
+(allow netd netd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init netd (process (noatsecure)))
+(allow init netd (process (siginh rlimitinh)))
+(typetransition init netd_exec process netd)
+(allow netd dnsmasq_exec (file (read getattr map execute open)))
+(allow netd dnsmasq (process (transition)))
+(allow dnsmasq dnsmasq_exec (file (read getattr map execute open entrypoint)))
+(allow dnsmasq netd (process (sigchld)))
+(dontaudit netd dnsmasq (process (noatsecure)))
+(allow netd dnsmasq (process (siginh rlimitinh)))
+(typetransition netd dnsmasq_exec process dnsmasq)
+(allow netd fs_bpf (dir (search)))
+(allow netd fs_bpf_vendor (dir (search)))
+(allow netd fs_bpf_netd_readonly (dir (search)))
+(allow netd fs_bpf_netd_shared (dir (search)))
+(allow netd fs_bpf (file (read getattr)))
+(allow netd fs_bpf_vendor (file (read getattr)))
+(allow netd fs_bpf_netd_readonly (file (read getattr)))
+(allow netd fs_bpf_netd_shared (file (read getattr)))
+(allow netd fs_bpf (file (write)))
+(allow netd fs_bpf_netd_shared (file (write)))
+(allow netd bpfloader (bpf (prog_run)))
+(allow netd self (bpf (map_create)))
+(allow netd bpfloader (bpf (map_read map_write)))
+(allow netd netd (bpf (map_read map_write)))
+(allow netd network_stack (bpf (map_read map_write)))
+(allow netd system_server (bpf (map_read map_write)))
+(allow netd self (key_socket (create)))
+(allow netd property_socket (sock_file (write)))
+(allow netd init (unix_stream_socket (connectto)))
+(allow netd ctl_mdnsd_prop (property_service (set)))
+(allow netd ctl_mdnsd_prop (file (read getattr map open)))
+(allow netd property_socket (sock_file (write)))
+(allow netd init (unix_stream_socket (connectto)))
+(allow netd netd_stable_secret_prop (property_service (set)))
+(allow netd netd_stable_secret_prop (file (read getattr map open)))
+(allow netd adbd_config_prop (file (read getattr map open)))
+(allow netd hwservicemanager_prop (file (read getattr map open)))
+(allow netd device_config_netd_native_prop (file (read getattr map open)))
+(allow netd statsdw_socket (sock_file (write)))
+(allow netd statsd (unix_dgram_socket (sendto)))
+(allow netd network_stack (binder (call transfer)))
+(allow network_stack netd (binder (transfer)))
+(allow netd network_stack (fd (use)))
+(allow netd dumpstate (fd (use)))
+(allow netd dumpstate (fifo_file (write getattr)))
+(allow netd mdnsd_socket (sock_file (write)))
+(allow netd mdnsd (unix_stream_socket (connectto)))
+(allowx netd self (ioctl udp_socket (0x6900 0x6902)))
+(allowx netd self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx netd self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow netd cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netd cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd system_server (fd (use)))
+(allow netd self (capability (kill net_bind_service net_admin net_raw)))
+(allow netd self (cap_userns (kill net_bind_service net_admin net_raw)))
+(dontaudit netd self (capability (fsetid)))
+(dontaudit netd self (cap_userns (fsetid)))
+(allow netd tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx netd tun_device (ioctl chr_file (0x54ca 0x54d2)))
+(allow netd self (tun_socket (create)))
+(allow netd self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netd self (netlink_route_socket (nlmsg_write)))
+(allow netd self (netlink_nflog_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netd self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netd self (netlink_tcpdiag_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow netd self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netd self (netlink_netfilter_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow netd system_file (file (getattr map execute execute_no_trans)))
+(allow netd devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow netd system_file (file (lock)))
+(dontaudit netd system_file (dir (write)))
+(allow netd proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netd proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd proc_net_type (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow netd sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netd sysfs_net (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netd sysfs_net (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd sysfs_net (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd sysfs_net (file (write lock append map open)))
+(allow netd sysfs_usb (file (write)))
+(allow netd cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netd cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow netd self (capability (chown dac_override dac_read_search)))
+(allow netd self (cap_userns (chown dac_override dac_read_search)))
+(allow netd net_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow netd net_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow netd self (capability (fowner)))
+(allow netd self (cap_userns (fowner)))
+(allow netd system_file (file (lock)))
+(allow netd dnsmasq (process (sigkill signal)))
+(allow netd servicemanager (binder (call transfer)))
+(allow servicemanager netd (binder (call transfer)))
+(allow servicemanager netd (dir (search)))
+(allow servicemanager netd (file (read open)))
+(allow servicemanager netd (process (getattr)))
+(allow netd netd_service (service_manager (add find)))
+;;* lmx 116 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_813 netd_service (service_manager (add)))
+;;* lme
+
+(allow netd dnsresolver_service (service_manager (add find)))
+;;* lmx 117 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_813 dnsresolver_service (service_manager (add)))
+;;* lme
+
+(allow netd mdns_service (service_manager (add find)))
+;;* lmx 118 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_813 mdns_service (service_manager (add)))
+;;* lme
+
+(allow netd dumpstate (fifo_file (write getattr)))
+(allow netd system_server (binder (call)))
+(allow netd permission_service (service_manager (find)))
+(allow netd netd_listener_service (service_manager (find)))
+(allow netd netdomain (tcp_socket (read write getattr setattr getopt setopt)))
+(allow netd netdomain (udp_socket (read write getattr setattr getopt setopt)))
+(allow netd netdomain (rawip_socket (read write getattr setattr getopt setopt)))
+(allow netd netdomain (tun_socket (read write getattr setattr getopt setopt)))
+(allow netd netdomain (icmp_socket (read write getattr setattr getopt setopt)))
+(allow netd netdomain (fd (use)))
+(allow netd self (netlink_xfrm_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow netd system_net_netd_hwservice (hwservice_manager (add find)))
+(allow netd hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 142 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_813 system_net_netd_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow netd hwservicemanager (binder (call transfer)))
+(allow hwservicemanager netd (binder (call transfer)))
+(allow hwservicemanager netd (dir (search)))
+(allow hwservicemanager netd (file (read map open)))
+(allow hwservicemanager netd (process (getattr)))
+(allow system_net_netd_service servicemanager (binder (call transfer)))
+(allow servicemanager system_net_netd_service (binder (transfer)))
+(allow system_net_netd_service servicemanager (fd (use)))
+(allow netd system_net_netd_service (service_manager (add find)))
+;;* lmx 147 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_813 system_net_netd_service (service_manager (add)))
+;;* lme
+
+;;* lmx 155 system/sepolicy/private/netd.te
+
+(neverallow netd dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 158 system/sepolicy/private/netd.te
+
+(neverallow netd domain (process (ptrace)))
+;;* lme
+
+;;* lmx 161 system/sepolicy/private/netd.te
+
+(neverallow netd system_file_type (file (write)))
+(neverallow netd system_file_type (dir (write)))
+(neverallow netd system_file_type (lnk_file (write)))
+(neverallow netd system_file_type (chr_file (write)))
+(neverallow netd system_file_type (blk_file (write)))
+(neverallow netd system_file_type (sock_file (write)))
+(neverallow netd system_file_type (fifo_file (write)))
+;;* lme
+
+;;* lmx 164 system/sepolicy/private/netd.te
+
+(neverallow netd app_data_file_type (file (write)))
+(neverallow netd app_data_file_type (dir (write)))
+(neverallow netd app_data_file_type (lnk_file (write)))
+(neverallow netd app_data_file_type (chr_file (write)))
+(neverallow netd app_data_file_type (blk_file (write)))
+(neverallow netd app_data_file_type (sock_file (write)))
+(neverallow netd app_data_file_type (fifo_file (write)))
+(neverallow netd system_data_file (file (write)))
+(neverallow netd system_data_file (dir (write)))
+(neverallow netd system_data_file (lnk_file (write)))
+(neverallow netd system_data_file (chr_file (write)))
+(neverallow netd system_data_file (blk_file (write)))
+(neverallow netd system_data_file (sock_file (write)))
+(neverallow netd system_data_file (fifo_file (write)))
+;;* lme
+
+;;* lmx 174 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_814 netd_service (service_manager (find)))
+;;* lme
+
+;;* lmx 184 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_814 dnsresolver_service (service_manager (find)))
+;;* lme
+
+;;* lmx 194 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_814 mdns_service (service_manager (find)))
+;;* lme
+
+;;* lmx 197 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_258 netd (binder (call)))
+;;* lme
+
+;;* lmx 198 system/sepolicy/private/netd.te
+
+(neverallow netd base_typeattr_258 (binder (call)))
+;;* lme
+
+;;* lmx 203 system/sepolicy/private/netd.te
+
+(neverallow netd proc_net (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+(dontaudit netd proc_net (dir (write)))
+;;* lmx 206 system/sepolicy/private/netd.te
+
+(neverallow netd sysfs_net (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+(dontaudit netd sysfs_net (dir (write)))
+;;* lmx 210 system/sepolicy/private/netd.te
+
+(neverallow netd self (capability (sys_admin)))
+;;* lme
+
+(dontaudit netd self (capability (sys_admin)))
+(dontaudit netd self (capability (sys_module)))
+(dontaudit netd appdomain (unix_stream_socket (read write)))
+;;* lmx 221 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_815 netd_stable_secret_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 225 system/sepolicy/private/netd.te
+
+(neverallow base_typeattr_816 netd_stable_secret_prop (property_service (set)))
+;;* lme
+
+(allow netutils_wrapper system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netutils_wrapper system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netutils_wrapper system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow netutils_wrapper self (capability (net_raw)))
+(allow netutils_wrapper self (cap_userns (net_raw)))
+(allow netutils_wrapper system_file (file (execute execute_no_trans)))
+(allow netutils_wrapper proc_net_type (file (read getattr open)))
+(allow netutils_wrapper self (rawip_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netutils_wrapper self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow netutils_wrapper self (capability (net_admin)))
+(allow netutils_wrapper self (cap_userns (net_admin)))
+(allow netutils_wrapper self (netlink_route_socket (read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh)))
+(allow netutils_wrapper self (netlink_xfrm_socket (read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(allow netutils_wrapper netd_service (service_manager (find)))
+(allow netutils_wrapper dnsresolver_service (service_manager (find)))
+(allow netutils_wrapper mdns_service (service_manager (find)))
+(allow netutils_wrapper servicemanager (binder (call transfer)))
+(allow servicemanager netutils_wrapper (binder (call transfer)))
+(allow servicemanager netutils_wrapper (dir (search)))
+(allow servicemanager netutils_wrapper (file (read open)))
+(allow servicemanager netutils_wrapper (process (getattr)))
+(allow netutils_wrapper netd (binder (call transfer)))
+(allow netd netutils_wrapper (binder (transfer)))
+(allow netutils_wrapper netd (fd (use)))
+(allow netutils_wrapper fs_bpf (dir (search)))
+(allow netutils_wrapper fs_bpf_vendor (dir (search)))
+(allow netutils_wrapper fs_bpf_netd_shared (dir (search)))
+(allow netutils_wrapper fs_bpf (file (read getattr)))
+(allow netutils_wrapper fs_bpf_vendor (file (read getattr)))
+(allow netutils_wrapper fs_bpf_netd_shared (file (read getattr)))
+(allow netutils_wrapper fs_bpf (file (write)))
+(allow netutils_wrapper bpfloader (bpf (prog_run)))
+(allow netutils_wrapper net_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow netutils_wrapper net_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow netutils_wrapper net_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow base_typeattr_369 netutils_wrapper_exec (file (read getattr map execute open)))
+(allow base_typeattr_369 netutils_wrapper (process (transition)))
+(allow netutils_wrapper netutils_wrapper_exec (file (read getattr map execute open entrypoint)))
+(allow netutils_wrapper base_typeattr_369 (process (sigchld)))
+(dontaudit base_typeattr_369 netutils_wrapper (process (noatsecure)))
+(allow base_typeattr_369 netutils_wrapper (process (siginh rlimitinh)))
+(typetransition base_typeattr_369 netutils_wrapper_exec process netutils_wrapper)
+(dontaudit netutils_wrapper self (capability (sys_resource)))
+(dontaudit netutils_wrapper self (cap_userns (sys_resource)))
+(dontaudit netutils_wrapper sysfs_type (file (read)))
+;;* lmx 51 system/sepolicy/private/netutils_wrapper.te
+
+(neverallow netutils_wrapper self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow netutils_wrapper self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/private/netutils_wrapper.te
+
+(neverallow domain netutils_wrapper_exec (file (execute_no_trans)))
+;;* lme
+
+(typetransition network_stack tmpfs file appdomain_tmpfs)
+(allow network_stack network_stack_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su network_stack_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_817 network_stack_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow network_stack appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_818 base_typeattr_817 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_819 network_stack (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_820 network_stack (process (ptrace)))
+;;* lme
+
+(allow network_stack self (capability (net_bind_service net_broadcast net_admin net_raw)))
+(allow network_stack self (cap_userns (net_bind_service net_broadcast net_admin net_raw)))
+(allow network_stack self (capability2 (wake_alarm)))
+(allow network_stack self (cap2_userns (wake_alarm)))
+(allowx network_stack self (ioctl udp_socket (0x6900 0x6902)))
+(allowx network_stack self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx network_stack self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow network_stack self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack self (netlink_route_socket (nlmsg_write)))
+(allow network_stack self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack self (netlink_nflog_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack app_api_service (service_manager (find)))
+(allow network_stack dnsresolver_service (service_manager (find)))
+(allow network_stack mdns_service (service_manager (find)))
+(allow network_stack netd_service (service_manager (find)))
+(allow network_stack network_watchlist_service (service_manager (find)))
+(allow network_stack radio_service (service_manager (find)))
+(allow network_stack system_config_service (service_manager (find)))
+(allow network_stack radio_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow network_stack radio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow network_stack netd (binder (call transfer)))
+(allow netd network_stack (binder (transfer)))
+(allow network_stack netd (fd (use)))
+(allow network_stack self (key_socket (create)))
+(dontaudit network_stack self (key_socket (getopt)))
+(allow network_stack device_config_connectivity_prop (file (read getattr map open)))
+(allow network_stack self (netlink_tcpdiag_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow network_stack self (netlink_netfilter_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow network_stack network_stack_service (service_manager (find)))
+(allow network_stack fs_bpf_tethering (dir (search)))
+(allow network_stack fs_bpf_net_private (dir (search)))
+(allow network_stack fs_bpf_net_shared (dir (search)))
+(allow network_stack fs_bpf_netd_readonly (dir (search)))
+(allow network_stack fs_bpf_netd_shared (dir (search)))
+(allow network_stack fs_bpf_tethering (file (read write getattr)))
+(allow network_stack fs_bpf_net_private (file (read write getattr)))
+(allow network_stack fs_bpf_net_shared (file (read write getattr)))
+(allow network_stack fs_bpf_netd_readonly (file (read write getattr)))
+(allow network_stack fs_bpf_netd_shared (file (read write getattr)))
+(allow network_stack bpfloader (bpf (prog_run)))
+(allow network_stack self (bpf (map_create)))
+(allow network_stack bpfloader (bpf (map_read map_write)))
+(allow network_stack netd (bpf (map_read map_write)))
+(allow network_stack network_stack (bpf (map_read map_write)))
+(allow network_stack system_server (bpf (map_read map_write)))
+(allow network_stack device_config_tethering_u_or_later_native_prop (file (read getattr map open)))
+(allow network_stack self (netlink_xfrm_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow network_stack tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx network_stack tun_device (ioctl chr_file (0x54ca 0x54cd 0x54d2 0x54e2)))
+;;* lmx 87 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_312 fs_bpf_net_private (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 88 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_312 fs_bpf_net_private (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 91 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_313 fs_bpf_net_shared (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 92 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_313 fs_bpf_net_shared (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 96 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_314 fs_bpf_netd_readonly (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 97 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_314 fs_bpf_netd_readonly (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 98 system/sepolicy/private/network_stack.te
+
+(neverallow netd fs_bpf_netd_readonly (file (write)))
+;;* lme
+
+;;* lmx 102 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_315 fs_bpf_netd_shared (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 103 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_315 fs_bpf_netd_shared (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 104 system/sepolicy/private/network_stack.te
+
+(neverallow netutils_wrapper fs_bpf_netd_shared (file (write)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_312 fs_bpf_tethering (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 108 system/sepolicy/private/network_stack.te
+
+(neverallow base_typeattr_312 fs_bpf_tethering (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(typetransition nfc tmpfs file appdomain_tmpfs)
+(allow nfc nfc_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su nfc_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 3 system/sepolicy/private/nfc.te
+
+(neverallow base_typeattr_821 nfc_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow nfc appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 3 system/sepolicy/private/nfc.te
+
+(neverallow base_typeattr_822 base_typeattr_821 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/nfc.te
+
+(neverallow base_typeattr_823 nfc (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/nfc.te
+
+(neverallow base_typeattr_824 nfc (process (ptrace)))
+;;* lme
+
+(allow nfc nfc_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/nfc.te
+
+(neverallow base_typeattr_821 nfc_service (service_manager (add)))
+;;* lme
+
+(allow nfc nfc_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow nfc nfc_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow nfc nfc_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow nfc nfc_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow nfc nfc_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow nfc nfc_logs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow nfc nfc_logs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow nfc audioserver_service (service_manager (find)))
+(allow nfc drmserver_service (service_manager (find)))
+(allow nfc mediametrics_service (service_manager (find)))
+(allow nfc mediaextractor_service (service_manager (find)))
+(allow nfc mediaserver_service (service_manager (find)))
+(allow nfc radio_service (service_manager (find)))
+(allow nfc app_api_service (service_manager (find)))
+(allow nfc system_api_service (service_manager (find)))
+(allow nfc vr_manager_service (service_manager (find)))
+(allow nfc secure_element_service (service_manager (find)))
+(allow nfc property_socket (sock_file (write)))
+(allow nfc init (unix_stream_socket (connectto)))
+(allow nfc nfc_prop (property_service (set)))
+(allow nfc nfc_prop (file (read getattr map open)))
+(allow nfc shell_data_file (file (read)))
+(allow nfc device_logging_prop (file (read getattr map open)))
+(allow odrefresh apex_module_data_file (dir (getattr search)))
+(allow odrefresh apex_art_data_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow odrefresh apex_art_data_file (file (ioctl read write create getattr setattr lock relabelto append map unlink rename open watch watch_reads)))
+(allow odrefresh odrefresh_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow odrefresh odrefresh_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow odrefresh odrefresh_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su odrefresh_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 14 system/sepolicy/private/odrefresh.te
+
+(neverallow base_typeattr_825 odrefresh_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow odrefresh apex_art_staging_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow odrefresh apex_art_staging_data_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow odrefresh dex2oat_exec (file (read getattr map execute open)))
+(allow odrefresh dex2oat (process (transition)))
+(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
+(allow dex2oat odrefresh (process (sigchld)))
+(dontaudit odrefresh dex2oat (process (noatsecure)))
+(allow odrefresh dex2oat (process (siginh rlimitinh)))
+(typetransition odrefresh dex2oat_exec process dex2oat)
+(allow odrefresh dex2oat (process (sigkill)))
+(allow odrefresh odsign_devpts (chr_file (read write)))
+(allow odrefresh odsign (fd (use)))
+(allow odrefresh apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh property_socket (sock_file (write)))
+(allow odrefresh init (unix_stream_socket (connectto)))
+(allow odrefresh bootanim_system_prop (property_service (set)))
+(allow odrefresh bootanim_system_prop (file (read getattr map open)))
+(allow odrefresh device_config_runtime_native_prop (file (read getattr map open)))
+(allow odrefresh device_config_runtime_native_boot_prop (file (read getattr map open)))
+(dontaudit odrefresh adbd (fd (use)))
+(dontaudit odrefresh shell (fd (use)))
+(dontaudit odrefresh devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit odrefresh adbd (unix_stream_socket (read write getattr)))
+(allow odrefresh file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow odrefresh selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh selinuxfs (file (write lock append map open)))
+(allow odrefresh kernel (security (check_context)))
+(dontaudit odrefresh property_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow odrefresh artd (fd (use)))
+;;* lmx 65 system/sepolicy/private/odrefresh.te
+
+(neverallow base_typeattr_826 apex_art_staging_data_file (file (open)))
+;;* lme
+
+;;* lmx 71 system/sepolicy/private/odrefresh.te
+
+(neverallow base_typeattr_827 odrefresh_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/odrefresh.te
+
+(neverallow base_typeattr_828 odrefresh_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow init odsign_exec (file (read getattr map execute open)))
+(allow init odsign (process (transition)))
+(allow odsign odsign_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init odsign (process (noatsecure)))
+(allow init odsign (process (siginh rlimitinh)))
+(typetransition init odsign_exec process odsign)
+(allow odsign odsign_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow odsign odsign_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow odsign odsign_metrics_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow odsign odsign_metrics_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(typetransition odsign devpts chr_file odsign_devpts)
+(allow odsign odsign_devpts (chr_file (ioctl read write getattr open)))
+(allowx odsign odsign_devpts (ioctl chr_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+;;* lmx 21 system/sepolicy/private/odsign.te
+
+(neverallowx base_typeattr_236 odsign_devpts (ioctl chr_file (0x5412)))
+;;* lme
+
+(allowx odsign apex_art_data_file (ioctl file (0x6601 (range 0x6685 0x6686))))
+(allow odsign servicemanager (binder (call transfer)))
+(allow servicemanager odsign (binder (call transfer)))
+(allow servicemanager odsign (dir (search)))
+(allow servicemanager odsign (file (read open)))
+(allow servicemanager odsign (process (getattr)))
+(allow keystore odsign (dir (search)))
+(allow keystore odsign (file (read open)))
+(allow keystore odsign (process (getattr)))
+(allow odsign apc_service (service_manager (find)))
+(allow odsign keystore_service (service_manager (find)))
+(allow odsign legacykeystore_service (service_manager (find)))
+(allow odsign keystore (binder (call transfer)))
+(allow keystore odsign (binder (transfer)))
+(allow odsign keystore (fd (use)))
+(allow keystore odsign (binder (call transfer)))
+(allow odsign keystore (binder (transfer)))
+(allow keystore odsign (fd (use)))
+(allow odsign odsign_key (keystore2_key (delete get_info rebind use)))
+(allow odsign apex_module_data_file (dir (getattr search)))
+(allow odsign apex_art_data_file (dir (ioctl read write getattr lock rename open watch watch_reads add_name remove_name search rmdir)))
+(allow odsign apex_art_data_file (file (ioctl read write getattr lock append map unlink open watch watch_reads)))
+(allow odsign odrefresh_exec (file (read getattr map execute open)))
+(allow odsign odrefresh (process (transition)))
+(allow odrefresh odrefresh_exec (file (read getattr map execute open entrypoint)))
+(allow odrefresh odsign (process (sigchld)))
+(dontaudit odsign odrefresh (process (noatsecure)))
+(allow odsign odrefresh (process (siginh rlimitinh)))
+(typetransition odsign odrefresh_exec process odrefresh)
+(allow odsign compos_verify_exec (file (read getattr map execute open)))
+(allow odsign compos_verify (process (transition)))
+(allow compos_verify compos_verify_exec (file (read getattr map execute open entrypoint)))
+(allow compos_verify odsign (process (sigchld)))
+(dontaudit odsign compos_verify (process (noatsecure)))
+(allow odsign compos_verify (process (siginh rlimitinh)))
+(typetransition odsign compos_verify_exec process compos_verify)
+(allow odsign property_socket (sock_file (write)))
+(allow odsign init (unix_stream_socket (connectto)))
+(allow odsign odsign_prop (property_service (set)))
+(allow odsign odsign_prop (file (read getattr map open)))
+;;* lmx 59 system/sepolicy/private/odsign.te
+
+(neverallow base_typeattr_829 odsign_prop (property_service (set)))
+;;* lme
+
+(allow odsign property_socket (sock_file (write)))
+(allow odsign init (unix_stream_socket (connectto)))
+(allow odsign ctl_odsign_prop (property_service (set)))
+(allow odsign ctl_odsign_prop (file (read getattr map open)))
+;;* lmx 65 system/sepolicy/private/odsign.te
+
+(neverallow base_typeattr_829 odsign_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/odsign.te
+
+(neverallow base_typeattr_829 odsign_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow init ot_daemon_exec (file (read getattr map execute open)))
+(allow init ot_daemon (process (transition)))
+(allow ot_daemon ot_daemon_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init ot_daemon (process (noatsecure)))
+(allow init ot_daemon (process (siginh rlimitinh)))
+(typetransition init ot_daemon_exec process ot_daemon)
+(allow ot_daemon apex_module_data_file (dir (search)))
+(allow ot_daemon apex_tethering_data_file (dir (ioctl read write create getattr lock open watch watch_reads add_name remove_name search)))
+(allow ot_daemon apex_tethering_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow ot_daemon tun_device (chr_file (read write)))
+(allow ot_daemon system_server (rawip_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow ot_daemon system_server (udp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow ot_daemon servicemanager (binder (call transfer)))
+(allow servicemanager ot_daemon (binder (call transfer)))
+(allow servicemanager ot_daemon (dir (search)))
+(allow servicemanager ot_daemon (file (read open)))
+(allow servicemanager ot_daemon (process (getattr)))
+(allow ot_daemon ot_daemon_service (service_manager (add find)))
+;;* lmx 36 system/sepolicy/private/ot_daemon.te
+
+(neverallow base_typeattr_830 ot_daemon_service (service_manager (add)))
+;;* lme
+
+(allow ot_daemon system_server (binder (call transfer)))
+(allow system_server ot_daemon (binder (transfer)))
+(allow ot_daemon system_server (fd (use)))
+(allow ot_daemon statsdw_socket (sock_file (write)))
+(allow ot_daemon statsd (unix_dgram_socket (sendto)))
+(allow ot_daemon dumpstate (fd (use)))
+(allow ot_daemon dumpstate (fifo_file (write)))
+;;* lmx 53 system/sepolicy/private/ot_daemon.te
+
+(neverallow base_typeattr_831 ot_daemon_socket (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow otapreopt_chroot postinstall_file (dir (mounton search)))
+(allow otapreopt_chroot apex_mnt_dir (dir (mounton)))
+(allow otapreopt_chroot device (dir (mounton)))
+(allow otapreopt_chroot linkerconfig_file (dir (mounton)))
+(allow otapreopt_chroot rootfs (dir (mounton)))
+(allow otapreopt_chroot sysfs (dir (mounton)))
+(allow otapreopt_chroot system_data_root_file (dir (mounton)))
+(allow otapreopt_chroot system_file (dir (mounton)))
+(allow otapreopt_chroot vendor_file (dir (mounton)))
+(allow otapreopt_chroot self (capability (sys_chroot sys_admin)))
+(allow otapreopt_chroot self (cap_userns (sys_chroot sys_admin)))
+(allow otapreopt_chroot block_device (dir (search)))
+(allow otapreopt_chroot labeledfs (filesystem (mount unmount)))
+(allow otapreopt_chroot dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow otapreopt_chroot postinstall_file (filesystem (unmount)))
+(dontaudit otapreopt_chroot kernel (process (setsched)))
+(allow otapreopt_chroot file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow otapreopt_chroot postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow otapreopt_chroot apexd_prop (file (read getattr map open)))
+(allow otapreopt_chroot postinstall (fd (use)))
+(allow otapreopt_chroot postinstall (fifo_file (read write getattr)))
+(allow otapreopt_chroot update_engine (fd (use)))
+(allow otapreopt_chroot update_engine (fifo_file (write)))
+(allow otapreopt_chroot postinstall_dexopt_exec (file (read getattr map execute open)))
+(allow otapreopt_chroot postinstall_dexopt (process (transition)))
+(allow postinstall_dexopt postinstall_dexopt_exec (file (read getattr map execute open entrypoint)))
+(allow postinstall_dexopt otapreopt_chroot (process (sigchld)))
+(dontaudit otapreopt_chroot postinstall_dexopt (process (noatsecure)))
+(allow otapreopt_chroot postinstall_dexopt (process (siginh rlimitinh)))
+(typetransition otapreopt_chroot postinstall_dexopt_exec process postinstall_dexopt)
+(allow otapreopt_chroot linkerconfig_exec (file (read getattr map execute open)))
+(allow otapreopt_chroot linkerconfig (process (transition)))
+(allow linkerconfig linkerconfig_exec (file (read getattr map execute open entrypoint)))
+(allow linkerconfig otapreopt_chroot (process (sigchld)))
+(dontaudit otapreopt_chroot linkerconfig (process (noatsecure)))
+(allow otapreopt_chroot linkerconfig (process (siginh rlimitinh)))
+(typetransition otapreopt_chroot linkerconfig_exec process linkerconfig)
+(allow otapreopt_chroot apexd_exec (file (read getattr map execute open)))
+(allow otapreopt_chroot apexd (process (transition)))
+(allow apexd apexd_exec (file (read getattr map execute open entrypoint)))
+(allow apexd otapreopt_chroot (process (sigchld)))
+(dontaudit otapreopt_chroot apexd (process (noatsecure)))
+(allow otapreopt_chroot apexd (process (siginh rlimitinh)))
+(typetransition otapreopt_chroot apexd_exec process apexd)
+(allow otapreopt_chroot linkerconfig_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow otapreopt_chroot linkerconfig_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow otapreopt_chroot loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow otapreopt_chroot loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx otapreopt_chroot loop_device (ioctl blk_file (0x1261)))
+(allowx otapreopt_chroot loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) (range 0x4c08 0x4c0a))))
+(allow otapreopt_chroot sysfs_loop (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow otapreopt_chroot sysfs_loop (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow otapreopt_chroot tmpfs (filesystem (mount)))
+(allow otapreopt_chroot tmpfs (dir (relabelfrom)))
+(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (relabelto)))
+(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow otapreopt_chroot postinstall_apex_mnt_dir (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (mounton)))
+(allow otapreopt_chroot block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow otapreopt_chroot postinstall_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow otapreopt_chroot cold_boot_done_prop (file (read getattr map open)))
+(allow otapreopt_chroot linkerconfig_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow init otapreopt_slot_exec (file (read getattr map execute open)))
+(allow init otapreopt_slot (process (transition)))
+(allow otapreopt_slot otapreopt_slot_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init otapreopt_slot (process (noatsecure)))
+(allow init otapreopt_slot (process (siginh rlimitinh)))
+(typetransition init otapreopt_slot_exec process otapreopt_slot)
+(allow otapreopt_slot ota_data_file (dir (ioctl read write getattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow otapreopt_slot ota_data_file (file (getattr)))
+(allow otapreopt_slot ota_data_file (lnk_file (getattr)))
+(allow otapreopt_slot ota_data_file (lnk_file (read)))
+(allow otapreopt_slot dalvikcache_data_file (dir (read write getattr open add_name remove_name search rmdir)))
+(allow otapreopt_slot dalvikcache_data_file (file (getattr unlink)))
+(allow otapreopt_slot dalvikcache_data_file (lnk_file (read getattr unlink)))
+(allow otapreopt_slot shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow otapreopt_slot toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(typetransition perfetto tmpfs file perfetto_tmpfs)
+(allow perfetto perfetto_tmpfs (file (read write getattr map)))
+(allow init perfetto_exec (file (read getattr map execute open)))
+(allow init perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init perfetto (process (noatsecure)))
+(allow init perfetto (process (siginh rlimitinh)))
+(typetransition init perfetto_exec process perfetto)
+(allow perfetto traced_consumer_socket (sock_file (write)))
+(allow perfetto traced (unix_stream_socket (connectto)))
+(allow perfetto traced (fd (use)))
+(allow perfetto traced_tmpfs (file (read write getattr map)))
+(allow perfetto traced_producer_socket (sock_file (write)))
+(allow perfetto traced (unix_stream_socket (connectto)))
+(allow traced perfetto (fd (use)))
+(allow perfetto perfetto_traces_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow perfetto perfetto_traces_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow perfetto perfetto_traces_bugreport_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow perfetto perfetto_traces_bugreport_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow perfetto perfetto_traces_profiling_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow perfetto perfetto_traces_profiling_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow perfetto tracingproxy_service (service_manager (find)))
+(allow perfetto servicemanager (binder (call transfer)))
+(allow servicemanager perfetto (binder (call transfer)))
+(allow servicemanager perfetto (dir (search)))
+(allow servicemanager perfetto (file (read open)))
+(allow servicemanager perfetto (process (getattr)))
+(allow perfetto system_server (binder (call transfer)))
+(allow system_server perfetto (binder (transfer)))
+(allow perfetto system_server (fd (use)))
+(allow perfetto perfetto_configs_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow perfetto perfetto_configs_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow perfetto system_perfetto_config_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow perfetto system_perfetto_config_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow perfetto shell (fd (use)))
+(allow perfetto statsd (fd (use)))
+(allow perfetto su (fd (use)))
+(allow perfetto mm_events (fd (use)))
+(allow perfetto shell (fifo_file (ioctl read write getattr)))
+(allow perfetto statsd (fifo_file (ioctl read write getattr)))
+(allow perfetto su (fifo_file (ioctl read write getattr)))
+(allow perfetto system_server (fifo_file (ioctl read write getattr)))
+(allow perfetto mm_events (fifo_file (ioctl read write getattr)))
+(allow perfetto adbd (fd (use)))
+(allow perfetto adbd (unix_stream_socket (read write)))
+(allow perfetto adbd (process (sigchld)))
+(allow perfetto statsdw_socket (sock_file (write)))
+(allow perfetto statsd (unix_dgram_socket (sendto)))
+(allow perfetto devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow perfetto incident_service (service_manager (find)))
+(allow perfetto incidentd (binder (call transfer)))
+(allow incidentd perfetto (binder (transfer)))
+(allow perfetto incidentd (fd (use)))
+(dontaudit perfetto adbd (unix_stream_socket (getattr)))
+(dontauditx perfetto adbd (ioctl unix_stream_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(dontauditx perfetto su (ioctl unix_stream_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(dontauditx perfetto shell (ioctl fifo_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+;;* lmx 99 system/sepolicy/private/perfetto.te
+
+(neverallow base_typeattr_832 perfetto_traces_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 109 system/sepolicy/private/perfetto.te
+
+(neverallow base_typeattr_833 perfetto_traces_data_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 115 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto self (process (execmem)))
+;;* lme
+
+;;* lmx 118 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 121 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto domain (process (ptrace)))
+;;* lme
+
+;;* lmx 139 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto base_typeattr_834 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 144 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto base_typeattr_835 (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 152 system/sepolicy/private/perfetto.te
+
+(neverallow perfetto base_typeattr_836 (file (ioctl read create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow init performanced_exec (file (read getattr map execute open)))
+(allow init performanced (process (transition)))
+(allow performanced performanced_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init performanced (process (noatsecure)))
+(allow init performanced (process (siginh rlimitinh)))
+(typetransition init performanced_exec process performanced)
+(allow performanced servicemanager (binder (call transfer)))
+(allow servicemanager performanced (binder (call transfer)))
+(allow servicemanager performanced (dir (search)))
+(allow servicemanager performanced (file (read open)))
+(allow servicemanager performanced (process (getattr)))
+(allow performanced system_server (binder (call transfer)))
+(allow system_server performanced (binder (transfer)))
+(allow performanced system_server (fd (use)))
+(allow performanced permission_service (service_manager (find)))
+(allow init pdx_performance_client_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow performanced pdx_performance_client_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow performanced self (process (setsockcreate)))
+(allow performanced pdx_performance_client_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 10 system/sepolicy/private/performanced.te
+
+(neverallow base_typeattr_837 pdx_performance_client_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow performanced self (capability (setgid setuid sys_nice)))
+(allow performanced self (cap_userns (setgid setuid sys_nice)))
+(allow performanced appdomain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced bufferhubd (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced kernel (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced surfaceflinger (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced appdomain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced appdomain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced bufferhubd (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced bufferhubd (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced kernel (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced kernel (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced surfaceflinger (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced surfaceflinger (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit performanced domain (dir (read)))
+(allow performanced appdomain (process (setsched)))
+(allow performanced bufferhubd (process (setsched)))
+(allow performanced kernel (process (setsched)))
+(allow performanced surfaceflinger (process (setsched)))
+(allow performanced cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow performanced cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow performanced cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(typetransition permissioncontroller_app tmpfs file appdomain_tmpfs)
+(allow permissioncontroller_app permissioncontroller_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su permissioncontroller_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te
+
+(neverallow base_typeattr_838 permissioncontroller_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow permissioncontroller_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te
+
+(neverallow base_typeattr_839 base_typeattr_838 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te
+
+(neverallow base_typeattr_840 permissioncontroller_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te
+
+(neverallow base_typeattr_841 permissioncontroller_app (process (ptrace)))
+;;* lme
+
+(allow permissioncontroller_app app_api_service (service_manager (find)))
+(allow permissioncontroller_app system_api_service (service_manager (find)))
+(allow permissioncontroller_app gpuservice (binder (call transfer)))
+(allow gpuservice permissioncontroller_app (binder (transfer)))
+(allow permissioncontroller_app gpuservice (fd (use)))
+(allow permissioncontroller_app radio_service (service_manager (find)))
+(allow permissioncontroller_app incident_service (service_manager (find)))
+(allow permissioncontroller_app incidentd (binder (call transfer)))
+(allow incidentd permissioncontroller_app (binder (transfer)))
+(allow permissioncontroller_app incidentd (fd (use)))
+(allow permissioncontroller_app incidentd (fifo_file (read write)))
+(allow permissioncontroller_app gpu_device (dir (search)))
+(typetransition platform_app tmpfs file appdomain_tmpfs)
+(allow platform_app platform_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su platform_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 7 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_842 platform_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow platform_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 7 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_843 base_typeattr_842 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_844 platform_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_845 platform_app (process (ptrace)))
+;;* lme
+
+(allow platform_app shell_data_file (dir (search)))
+(allow platform_app shell_data_file (file (read getattr open)))
+(allow platform_app icon_file (file (read getattr open)))
+(allow platform_app apk_tmp_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow platform_app apk_private_tmp_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow platform_app apk_tmp_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow platform_app apk_private_tmp_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow platform_app apk_private_data_file (dir (search)))
+(allow platform_app asec_apk_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow platform_app asec_apk_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow platform_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow platform_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow platform_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow platform_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow platform_app mnt_media_rw_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow platform_app sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow platform_app sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow platform_app rootfs (dir (getattr)))
+(allow platform_app radio_cdma_ecm_prop (file (read getattr map open)))
+;;* lmx 46 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_846 persist_wm_debug_prop (property_service (set)))
+;;* lme
+
+(allow platform_app property_socket (sock_file (write)))
+(allow platform_app init (unix_stream_socket (connectto)))
+(allow platform_app debug_tracing_desktop_mode_visible_tasks_prop (property_service (set)))
+(allow platform_app debug_tracing_desktop_mode_visible_tasks_prop (file (read getattr map open)))
+(allow platform_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow platform_app proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app audioserver_service (service_manager (find)))
+(allow platform_app cameraserver_service (service_manager (find)))
+(allow platform_app drmserver_service (service_manager (find)))
+(allow platform_app mediaserver_service (service_manager (find)))
+(allow platform_app mediametrics_service (service_manager (find)))
+(allow platform_app mediaextractor_service (service_manager (find)))
+(allow platform_app mediadrmserver_service (service_manager (find)))
+(allow platform_app persistent_data_block_service (service_manager (find)))
+(allow platform_app radio_service (service_manager (find)))
+(allow platform_app thermal_service (service_manager (find)))
+(allow platform_app app_api_service (service_manager (find)))
+(allow platform_app system_api_service (service_manager (find)))
+(allow platform_app vr_manager_service (service_manager (find)))
+(allow platform_app stats_service (service_manager (find)))
+(allow platform_app tradeinmode_service (service_manager (find)))
+(allow platform_app statsd (binder (call transfer)))
+(allow statsd platform_app (binder (transfer)))
+(allow platform_app statsd (fd (use)))
+(allow platform_app preloads_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app preloads_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow platform_app preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow platform_app runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow platform_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow platform_app property_socket (sock_file (write)))
+(allow platform_app init (unix_stream_socket (connectto)))
+(allow platform_app test_boot_reason_prop (property_service (set)))
+(allow platform_app test_boot_reason_prop (file (read getattr map open)))
+(allow platform_app keyguard_config_prop (file (read getattr map open)))
+(allow platform_app qemu_hw_prop (file (read getattr map open)))
+(allow platform_app last_boot_reason_prop (file (read getattr map open)))
+(allow platform_app app_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(dontaudit platform_app debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow platform_app virtualizationmanager_exec (file (read getattr map execute open)))
+(allow platform_app virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager platform_app (process (sigchld)))
+(dontaudit platform_app virtualizationmanager (process (noatsecure)))
+(allow platform_app virtualizationmanager (process (siginh rlimitinh)))
+(typetransition platform_app virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm platform_app (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager platform_app (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm platform_app (fd (use)))
+(allow virtualizationmanager platform_app (fd (use)))
+(allow platform_app virtualizationmanager (fd (use)))
+(allow crosvm platform_app (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager platform_app (fifo_file (ioctl read write getattr)))
+(allow platform_app virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow platform_app hypervisor_prop (file (read getattr map open)))
+(allow platform_app virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager platform_app (dir (search)))
+(allow virtualizationmanager platform_app (file (read)))
+(allow virtualizationmanager platform_app (lnk_file (read)))
+;;* lmx 151 system/sepolicy/private/platform_app.te
+
+(neverallow base_typeattr_235 persist_sysui_builder_extras_prop (property_service (set)))
+;;* lme
+
+;;* lmx 154 system/sepolicy/private/platform_app.te
+
+(neverallow platform_app fuse_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+(allow postinstall otapreopt_chroot_exec (file (read getattr map execute open)))
+(allow postinstall otapreopt_chroot (process (transition)))
+(allow otapreopt_chroot otapreopt_chroot_exec (file (read getattr map execute open entrypoint)))
+(allow otapreopt_chroot postinstall (process (sigchld)))
+(dontaudit postinstall otapreopt_chroot (process (noatsecure)))
+(allow postinstall otapreopt_chroot (process (siginh rlimitinh)))
+(typetransition postinstall otapreopt_chroot_exec process otapreopt_chroot)
+(allow postinstall rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall package_service (service_manager (find)))
+(allow postinstall update_engine_common (fd (use)))
+(allow postinstall update_engine_common (fifo_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow postinstall postinstall_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow postinstall postinstall_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow postinstall system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow postinstall toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow postinstall servicemanager (binder (call transfer)))
+(allow servicemanager postinstall (binder (call transfer)))
+(allow servicemanager postinstall (dir (search)))
+(allow servicemanager postinstall (file (read open)))
+(allow servicemanager postinstall (process (getattr)))
+(allow postinstall system_server (binder (call transfer)))
+(allow system_server postinstall (binder (transfer)))
+(allow postinstall system_server (fd (use)))
+(allow postinstall otadexopt_service (service_manager (find)))
+(allow postinstall sysfs_fs_f2fs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow postinstall sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
+;;* lmx 53 system/sepolicy/private/postinstall.te
+
+(neverallow base_typeattr_847 postinstall (process (transition dyntransition)))
+;;* lme
+
+(allow postinstall_dexopt dex2oat_exec (file (read getattr map execute open)))
+(allow postinstall_dexopt dex2oat (process (transition)))
+(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
+(allow dex2oat postinstall_dexopt (process (sigchld)))
+(dontaudit postinstall_dexopt dex2oat (process (noatsecure)))
+(allow postinstall_dexopt dex2oat (process (siginh rlimitinh)))
+(typetransition postinstall_dexopt dex2oat_exec process dex2oat)
+(allow postinstall_dexopt postinstall_file (file (read getattr map execute open)))
+(allow postinstall_dexopt dex2oat (process (transition)))
+(allow dex2oat postinstall_file (file (read getattr map execute open entrypoint)))
+(allow dex2oat postinstall_dexopt (process (sigchld)))
+(dontaudit postinstall_dexopt dex2oat (process (noatsecure)))
+(allow postinstall_dexopt dex2oat (process (siginh rlimitinh)))
+(typetransition postinstall_dexopt postinstall_file process dex2oat)
+(allow postinstall_dexopt derive_classpath_exec (file (read getattr map execute open)))
+(allow postinstall_dexopt derive_classpath (process (transition)))
+(allow derive_classpath derive_classpath_exec (file (read getattr map execute open entrypoint)))
+(allow derive_classpath postinstall_dexopt (process (sigchld)))
+(dontaudit postinstall_dexopt derive_classpath (process (noatsecure)))
+(allow postinstall_dexopt derive_classpath (process (siginh rlimitinh)))
+(typetransition postinstall_dexopt derive_classpath_exec process derive_classpath)
+(typetransition postinstall_dexopt tmpfs file postinstall_dexopt_tmpfs)
+(allow postinstall_dexopt postinstall_dexopt_tmpfs (file (read write getattr map)))
+(allow postinstall_dexopt postinstall_dexopt_tmpfs (file (open)))
+(allow postinstall_dexopt self (capability (chown dac_override dac_read_search fowner fsetid setgid setuid)))
+(allow postinstall_dexopt self (cap_userns (chown dac_override dac_read_search fowner fsetid setgid setuid)))
+(allow postinstall_dexopt postinstall_file (filesystem (getattr)))
+(allow postinstall_dexopt postinstall_file (dir (read getattr search)))
+(allow postinstall_dexopt postinstall_file (lnk_file (read getattr)))
+(allow postinstall_dexopt proc_filesystems (file (read getattr open)))
+(allow postinstall_dexopt rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt tmpfs (file (read)))
+(allow postinstall_dexopt odsign_prop (file (read getattr map open)))
+(allow postinstall_dexopt postinstall_apex_mnt_dir (dir (getattr search)))
+(allow postinstall_dexopt apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt vendor_apex_metadata_file (dir (getattr search)))
+(allow postinstall_dexopt dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt user_profile_root_file (dir (getattr search)))
+(allow postinstall_dexopt user_profile_data_file (dir (getattr search)))
+(allow postinstall_dexopt user_profile_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit postinstall_dexopt user_profile_data_file (file (write)))
+(allow postinstall_dexopt ota_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow postinstall_dexopt ota_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow postinstall_dexopt ota_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow postinstall_dexopt dalvikcache_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow postinstall_dexopt dalvikcache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow postinstall_dexopt dalvikcache_data_file (dir (relabelto)))
+(allow postinstall_dexopt dalvikcache_data_file (file (relabelto link)))
+(allow postinstall_dexopt selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt selinuxfs (file (write lock append map open)))
+(allow postinstall_dexopt kernel (security (check_context)))
+(allow postinstall_dexopt selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow postinstall_dexopt selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow postinstall_dexopt selinuxfs (file (write lock append map open)))
+(allow postinstall_dexopt kernel (security (compute_av)))
+(allow postinstall_dexopt self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow postinstall_dexopt postinstall (process (sigchld)))
+(allow postinstall_dexopt otapreopt_chroot (fd (use)))
+(allow postinstall_dexopt device_config_runtime_native_prop (file (read getattr map open)))
+(allow postinstall_dexopt device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow init prefetch_exec (file (read getattr map execute open)))
+(allow init prefetch (process (transition)))
+(allow prefetch prefetch_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init prefetch (process (noatsecure)))
+(allow init prefetch (process (siginh rlimitinh)))
+(typetransition init prefetch_exec process prefetch)
+(allow prefetch debugfs_tracing_instances (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow prefetch debugfs_tracing_instances (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow prefetch metadata_file (dir (search)))
+(allow prefetch prefetch_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow prefetch prefetch_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow prefetch prefetch_boot_prop (file (read getattr map open)))
+(allow prefetch property_socket (sock_file (write)))
+(allow prefetch init (unix_stream_socket (connectto)))
+(allow prefetch prefetch_service_prop (property_service (set)))
+(allow prefetch prefetch_service_prop (file (read getattr map open)))
+;;* lmx 24 system/sepolicy/private/prefetch.te
+
+(neverallow base_typeattr_848 ctl_prefetch_prop (property_service (set)))
+;;* lme
+
+(allow init preloads_copy_exec (file (read getattr map execute open)))
+(allow init preloads_copy (process (transition)))
+(allow preloads_copy preloads_copy_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init preloads_copy (process (noatsecure)))
+(allow init preloads_copy (process (siginh rlimitinh)))
+(typetransition init preloads_copy_exec process preloads_copy)
+(allow preloads_copy shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow preloads_copy toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow preloads_copy preloads_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow preloads_copy preloads_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow preloads_copy preloads_media_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow preloads_copy preloads_media_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow preloads_copy system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit preloads_copy postinstall_mnt_dir (dir (search)))
+(allow preopt2cachename cppreopts (fd (use)))
+(allow preopt2cachename cppreopts (fifo_file (read write getattr)))
+(allow preopt2cachename proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(typetransition priv_app tmpfs file appdomain_tmpfs)
+(allow priv_app priv_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su priv_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/priv_app.te
+
+(neverallow base_typeattr_849 priv_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow priv_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/priv_app.te
+
+(neverallow base_typeattr_850 base_typeattr_849 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/priv_app.te
+
+(neverallow base_typeattr_851 priv_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/priv_app.te
+
+(neverallow base_typeattr_852 priv_app (process (ptrace)))
+;;* lme
+
+(typetransition priv_app devpts chr_file priv_app_devpts)
+(allow priv_app priv_app_devpts (chr_file (ioctl read write getattr open)))
+(allowx priv_app priv_app_devpts (ioctl chr_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+;;* lmx 15 system/sepolicy/private/priv_app.te
+
+(neverallowx base_typeattr_236 priv_app_devpts (ioctl chr_file (0x5412)))
+;;* lme
+
+(allow priv_app privapp_data_file (file (execute)))
+(allow priv_app system_linker_exec (file (execute_no_trans)))
+(allow priv_app privapp_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow priv_app app_api_service (service_manager (find)))
+(allow priv_app system_api_service (service_manager (find)))
+(allow priv_app audioserver_service (service_manager (find)))
+(allow priv_app cameraserver_service (service_manager (find)))
+(allow priv_app drmserver_service (service_manager (find)))
+(allow priv_app mediadrmserver_service (service_manager (find)))
+(allow priv_app mediaextractor_service (service_manager (find)))
+(allow priv_app mediametrics_service (service_manager (find)))
+(allow priv_app mediaserver_service (service_manager (find)))
+(allow priv_app music_recognition_service (service_manager (find)))
+(allow priv_app network_watchlist_service (service_manager (find)))
+(allow priv_app nfc_service (service_manager (find)))
+(allow priv_app oem_lock_service (service_manager (find)))
+(allow priv_app persistent_data_block_service (service_manager (find)))
+(allow priv_app radio_service (service_manager (find)))
+(allow priv_app recovery_service (service_manager (find)))
+(allow priv_app stats_service (service_manager (find)))
+(allow priv_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow priv_app cache_recovery_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow priv_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow priv_app cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow priv_app cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow priv_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow priv_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app trace_data_file (file (read getattr)))
+(allow priv_app wm_trace_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app wm_trace_data_file (file (getattr)))
+(allow priv_app perfetto_traces_bugreport_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app perfetto_traces_bugreport_data_file (file (getattr)))
+(allow priv_app perfetto_traces_data_file (dir (search)))
+(allow priv_app perfetto (fd (use)))
+(allow priv_app perfetto_traces_data_file (file (read getattr)))
+(allow priv_app apk_tmp_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app apk_private_tmp_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app apk_private_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx priv_app apk_tmp_file (ioctl file (0x6686)))
+(allowx priv_app apk_private_tmp_file (ioctl file (0x6686)))
+(allow priv_app vold (fd (use)))
+(allow priv_app fuse_device (chr_file (read write)))
+(allow priv_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app sysfs_type (dir (search)))
+(allow priv_app sysfs_zram (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app sysfs_zram (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app sysfs_zram (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app statsd (binder (call transfer)))
+(allow statsd priv_app (binder (transfer)))
+(allow priv_app statsd (fd (use)))
+(allow priv_app ringtone_file (file (read write getattr)))
+(allow priv_app preloads_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app preloads_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app incident_service (service_manager (find)))
+(allow priv_app incidentd (binder (call transfer)))
+(allow incidentd priv_app (binder (transfer)))
+(allow priv_app incidentd (fd (use)))
+(allow priv_app incidentd (fifo_file (read write)))
+(allow priv_app dynamic_system_prop (file (read getattr map open)))
+(allow priv_app adbd_tradeinmode_prop (file (read getattr map open)))
+(dontaudit priv_app exec_type (file (getattr)))
+(dontaudit priv_app device (dir (read)))
+(dontaudit priv_app fs_bpf (dir (search)))
+(dontaudit priv_app net_dns_prop (file (read)))
+(dontaudit priv_app proc (file (read)))
+(dontaudit priv_app proc_interrupts (file (read)))
+(dontaudit priv_app proc_modules (file (read)))
+(dontaudit priv_app proc_net (file (read)))
+(dontaudit priv_app proc_stat (file (read)))
+(dontaudit priv_app proc_version (file (read)))
+(dontaudit priv_app sysfs (dir (read)))
+(dontaudit priv_app sysfs (file (read)))
+(dontaudit priv_app sysfs_android_usb (file (read)))
+(dontaudit priv_app sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit priv_app wifi_config_prop (file (read)))
+(dontaudit priv_app wifi_hal_prop (file (read)))
+(dontaudit priv_app wifi_prop (file (read)))
+(allow priv_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allowx priv_app apk_data_file (ioctl file ((range 0x671f 0x6720) 0x6722 0x6724)))
+(allow priv_app incremental_control_file (file (ioctl read getattr)))
+(allowx priv_app incremental_control_file (ioctl file (0x6721)))
+(allow priv_app incremental_prop (file (read getattr map open)))
+(allow priv_app device_config_aconfig_flags_prop (file (read getattr map open)))
+(allow priv_app system_boot_reason_prop (file (read getattr map open)))
+(allow priv_app apex_data_file (dir (search)))
+(allow priv_app staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app staging_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app vendor_apex_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow priv_app vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow priv_app system_app_data_file (file (read getattr)))
+(allow priv_app rs_exec (file (read getattr map execute open)))
+(allow priv_app rs (process (transition)))
+(allow rs rs_exec (file (read getattr map execute open entrypoint)))
+(allow rs priv_app (process (sigchld)))
+(dontaudit priv_app rs (process (noatsecure)))
+(allow priv_app rs (process (siginh rlimitinh)))
+(typetransition priv_app rs_exec process rs)
+(allow priv_app app_exec_data_file (file (ioctl read getattr lock map unlink execute open watch watch_reads)))
+(allow priv_app virtualizationmanager_exec (file (read getattr map execute open)))
+(allow priv_app virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager priv_app (process (sigchld)))
+(dontaudit priv_app virtualizationmanager (process (noatsecure)))
+(allow priv_app virtualizationmanager (process (siginh rlimitinh)))
+(typetransition priv_app virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm priv_app (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager priv_app (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm priv_app (fd (use)))
+(allow virtualizationmanager priv_app (fd (use)))
+(allow priv_app virtualizationmanager (fd (use)))
+(allow crosvm priv_app (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager priv_app (fifo_file (ioctl read write getattr)))
+(allow priv_app virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow priv_app hypervisor_prop (file (read getattr map open)))
+(allow priv_app virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager priv_app (dir (search)))
+(allow virtualizationmanager priv_app (file (read)))
+(allow virtualizationmanager priv_app (lnk_file (read)))
+;;* lmx 221 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 224 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 227 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app kmsg_device (chr_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 231 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app debugfs_type (file (read)))
+;;* lme
+
+;;* lmx 236 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app service_manager_type (service_manager (add)))
+;;* lme
+
+;;* lmx 240 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app property_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 241 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app init (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 242 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app property_type (property_service (set)))
+;;* lme
+
+;;* lmx 252 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app mlstrustedsubject (process (fork)))
+;;* lme
+
+;;* lmx 260 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app file_type (file (link)))
+;;* lme
+
+;;* lmx 264 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app trace_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 265 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app trace_data_file (file (write create setattr relabelfrom append unlink link rename open)))
+;;* lme
+
+;;* lmx 268 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 269 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app cgroup_v2 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 275 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app base_typeattr_853 (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 278 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app base_typeattr_853 (lnk_file (read getattr open)))
+;;* lme
+
+;;* lmx 281 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app sysfs_net (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 285 system/sepolicy/private/priv_app.te
+
+(neverallowx priv_app domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx priv_app domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx priv_app domain (ioctl rawip_socket (0x6900 0x6902)))
+(neverallowx priv_app domain (ioctl icmp_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 285 system/sepolicy/private/priv_app.te
+
+(neverallowx priv_app domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx priv_app domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx priv_app domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx priv_app domain (ioctl icmp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 285 system/sepolicy/private/priv_app.te
+
+(neverallowx priv_app domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx priv_app domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx priv_app domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx priv_app domain (ioctl icmp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app base_typeattr_236 (netlink_route_socket (ioctl)))
+(neverallow priv_app base_typeattr_236 (netlink_selinux_socket (ioctl)))
+;;* lme
+
+;;* lmx 299 system/sepolicy/private/priv_app.te
+
+(neverallow priv_app base_typeattr_236 (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow priv_app base_typeattr_236 (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow priv_app base_typeattr_236 (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow priv_app base_typeattr_236 (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow priv_app base_typeattr_236 (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow priv_app base_typeattr_236 (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow priv_app base_typeattr_236 (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+(allow init prng_seeder_exec (file (read getattr map execute open)))
+(allow init prng_seeder (process (transition)))
+(allow prng_seeder prng_seeder_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init prng_seeder (process (noatsecure)))
+(allow init prng_seeder (process (siginh rlimitinh)))
+(typetransition init prng_seeder_exec process prng_seeder)
+(allow prng_seeder prng_seeder (unix_stream_socket (read write getattr accept)))
+(allow prng_seeder hw_random_device (chr_file (read open)))
+(allow prng_seeder kmsg_debug_device (chr_file (ioctl write getattr lock append map open)))
+(allow profman system_file (file (read getattr lock map)))
+(allow profman vendor_app_file (file (read getattr lock map)))
+(allow profman apk_data_file (file (read getattr lock map)))
+(allow profman apk_tmp_file (file (read getattr lock map)))
+(allow profman artd (fd (use)))
+(allow profman installd (fd (use)))
+(allow profman artd_tmpfs (file (read getattr lock map)))
+(allow profman user_profile_data_file (file (read write getattr lock map)))
+(allow profman asec_apk_file (file (read map)))
+(allow profman apk_data_file (file (read getattr map)))
+(allow profman apk_data_file (dir (read getattr search)))
+(allow profman apk_tmp_file (dir (read getattr search)))
+(allow profman oemfs (file (read map)))
+(allow profman tmpfs (file (read map)))
+(allow profman profman_dump_data_file (file (write map)))
+(allow profman app_data_file (file (read write getattr lock map)))
+(allow profman privapp_data_file (file (read write getattr lock map)))
+(allow profman app_data_file (dir (read getattr search)))
+(allow profman privapp_data_file (dir (read getattr search)))
+(allow profman device_config_runtime_native_prop (file (read getattr map open)))
+(allow profman device_config_runtime_native_boot_prop (file (read getattr map open)))
+;;* lmx 48 system/sepolicy/private/profman.te
+
+(neverallow profman app_data_file_type (file (open)))
+(neverallow profman app_data_file_type (lnk_file (open)))
+(neverallow profman app_data_file_type (sock_file (open)))
+(neverallow profman app_data_file_type (fifo_file (open)))
+;;* lme
+
+;;* lmx 2 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 adbd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 adbd_tradeinmode_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 apexd_payload_metadata_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_snapuserd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_prefetch_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_uprobestats_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 8 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 crashrecovery_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 debug_tracing_desktop_mode_visible_tasks_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 10 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_core_experiments_team_internal_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 11 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_lmkd_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 12 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_mglru_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_mmd_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 14 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_profcollect_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_remote_key_provisioning_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 16 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_statsd_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 17 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_statsd_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 18 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_storage_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 19 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_sys_traced_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 20 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_window_manager_native_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 21 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_configuration_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 22 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_connectivity_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 23 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_swcodec_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 24 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_tethering_u_or_later_native_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 25 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 dmesgd_start_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 26 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 fastbootd_protocol_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 27 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 gsid_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 28 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 init_perf_lsm_hooks_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 29 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 init_service_status_private_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 30 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 init_storage_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 31 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 init_svc_debug_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 32 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 kcmdline_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 33 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 keystore_diagnostics_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 34 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 keystore_listen_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 35 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 last_boot_reason_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 36 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 localization_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 37 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 logd_auditrate_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 lower_kptr_restrict_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 mmd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 40 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 net_464xlat_fromvendor_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 41 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 net_connectivity_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 netd_stable_secret_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 next_boot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 odsign_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 misctrl_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 46 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 perf_drop_caches_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 47 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 pm_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 prefetch_service_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 profcollectd_node_id_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 50 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 radio_cdma_ecm_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 51 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 remote_prov_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 52 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 remote_prov_cert_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 53 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 rollback_test_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 54 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 setupwizard_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 snapshotctl_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 56 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 snapuserd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 57 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 system_adbd_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 58 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 system_audio_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 59 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 timezone_metadata_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 60 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 traced_perf_enabled_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 61 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 uprobestats_start_with_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 tuner_server_ctl_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 63 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 userspace_reboot_log_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 64 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 userspace_reboot_test_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 65 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 verity_status_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 zygote_wrap_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 67 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_mediatranscoding_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_odsign_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 virtualizationservice_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 70 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_apex_load_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 71 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 sensors_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 hypervisor_pvmfw_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 73 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 hypervisor_virtualizationmanager_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 74 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 game_manager_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 75 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 hidl_memory_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 76 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 suspend_debug_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 77 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 system_service_enable_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 ctl_artd_pre_reboot_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 79 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 trusty_security_vm_sys_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 80 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 hint_manager_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 83 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 bionic_linker_16kb_app_compat_prop (property_service (set)))
+;;* lme
+
+;;* lmx 84 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 device_config_virtualization_framework_native_prop (property_service (set)))
+;;* lme
+
+;;* lmx 85 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 fstype_prop (property_service (set)))
+;;* lme
+
+;;* lmx 86 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 log_file_logger_prop (property_service (set)))
+;;* lme
+
+;;* lmx 87 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 persist_sysui_builder_extras_prop (property_service (set)))
+;;* lme
+
+;;* lmx 88 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 persist_sysui_ranking_update_prop (property_service (set)))
+;;* lme
+
+;;* lmx 89 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 page_size_prop (property_service (set)))
+;;* lme
+
+;;* lmx 90 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 pm_16kb_app_compat_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init avf_virtualizationservice_prop (property_service (set)))
+(allow vendor_init avf_virtualizationservice_prop (file (read getattr map open)))
+;;* lmx 112 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 avf_virtualizationservice_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init high_barometer_quality_prop (property_service (set)))
+(allow vendor_init high_barometer_quality_prop (file (read getattr map open)))
+;;* lmx 113 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 high_barometer_quality_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init prefetch_boot_prop (property_service (set)))
+(allow vendor_init prefetch_boot_prop (file (read getattr map open)))
+;;* lmx 114 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 prefetch_boot_prop (property_service (set)))
+;;* lme
+
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init widevine_sys_vendor_prop (property_service (set)))
+(allow vendor_init widevine_sys_vendor_prop (file (read getattr map open)))
+;;* lmx 115 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 widevine_sys_vendor_prop (property_service (set)))
+;;* lme
+
+(allow property_type tmpfs (filesystem (associate)))
+;;* lmx 159 system/sepolicy/private/property.te
+
+(neverallow domain base_typeattr_854 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 159 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 base_typeattr_855 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 159 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_229 base_typeattr_856 (property_service (set)))
+;;* lme
+
+;;* lmx 159 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_231 base_typeattr_857 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 159 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_337 base_typeattr_858 (property_service (set)))
+;;* lme
+
+;;* lmx 202 system/sepolicy/private/property.te
+
+(neverallow domain property_type (file (ioctl lock)))
+;;* lme
+
+;;* lmx 228 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_236 base_typeattr_859 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 236 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 ctl_sigstop_prop (property_service (set)))
+;;* lme
+
+(dontaudit domain ctl_bootanim_prop (property_service (set)))
+(dontaudit domain ctl_bugreport_prop (property_service (set)))
+(dontaudit domain ctl_console_prop (property_service (set)))
+(dontaudit domain ctl_dumpstate_prop (property_service (set)))
+(dontaudit domain ctl_fuse_prop (property_service (set)))
+(dontaudit domain ctl_mdnsd_prop (property_service (set)))
+(dontaudit domain ctl_rildaemon_prop (property_service (set)))
+(dontaudit domain ctl_default_prop (property_service (set)))
+;;* lmx 255 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_860 init_storage_prop (property_service (set)))
+;;* lme
+
+;;* lmx 260 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 init_svc_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 267 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_846 init_svc_debug_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 278 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_861 misctrl_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 284 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_862 misctrl_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_863 base_typeattr_864 (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_865 nfc_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_866 radio_control_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_867 radio_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_868 bluetooth_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_869 exported_bluetooth_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_870 exported_camera_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_871 wifi_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_872 wifi_hal_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_863 base_typeattr_873 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_874 dalvik_dynamic_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_865 nfc_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_867 radio_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_868 bluetooth_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_871 wifi_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 suspend_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 suspend_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 high_barometer_quality_prop (property_service (set)))
+;;* lme
+
+;;* lmx 286 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_846 suspend_debug_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit system_suspend suspend_debug_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 483 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_875 base_typeattr_876 (property_service (set)))
+;;* lme
+
+;;* lmx 503 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 ffs_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_386 ffs_control_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 511 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_427 userspace_reboot_log_prop (property_service (set)))
+;;* lme
+
+;;* lmx 520 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_427 system_adbd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 532 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_877 adbd_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 542 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_878 adbd_prop (property_service (set)))
+;;* lme
+
+;;* lmx 550 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 apexd_payload_metadata_prop (property_service (set)))
+;;* lme
+
+;;* lmx 560 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_848 userspace_reboot_test_prop (property_service (set)))
+;;* lme
+
+;;* lmx 569 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_385 surfaceflinger_color_prop (property_service (set)))
+;;* lme
+
+;;* lmx 576 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 libc_debug_prop (property_service (set)))
+;;* lme
+
+;;* lmx 591 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_879 arm64_memtag_prop (property_service (set)))
+(neverallow base_typeattr_879 gwp_asan_prop (property_service (set)))
+;;* lme
+
+;;* lmx 600 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_880 kcmdline_prop (property_service (set)))
+;;* lme
+
+;;* lmx 607 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_385 zram_control_prop (property_service (set)))
+;;* lme
+
+;;* lmx 614 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_385 dalvik_runtime_prop (property_service (set)))
+;;* lme
+
+;;* lmx 623 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 usb_config_prop (property_service (set)))
+(neverallow base_typeattr_386 usb_control_prop (property_service (set)))
+;;* lme
+
+;;* lmx 632 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_427 provisioned_prop (property_service (set)))
+(neverallow base_typeattr_427 retaildemo_prop (property_service (set)))
+;;* lme
+
+;;* lmx 641 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 provisioned_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_386 retaildemo_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 649 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 init_service_status_prop (property_service (set)))
+(neverallow base_typeattr_235 init_service_status_private_prop (property_service (set)))
+;;* lme
+
+;;* lmx 658 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_881 telephony_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 666 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 graphics_config_prop (property_service (set)))
+;;* lme
+
+;;* lmx 674 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_882 surfaceflinger_display_prop (property_service (set)))
+;;* lme
+
+;;* lmx 681 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_863 packagemanager_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 687 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 keyguard_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 694 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 localization_prop (property_service (set)))
+;;* lme
+
+;;* lmx 702 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_883 oem_unlock_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 708 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_386 storagemanager_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 716 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_884 sendbug_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 724 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_884 camera_calibration_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 732 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_885 hal_dumpstate_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 743 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 lower_kptr_restrict_prop (property_service (set)))
+;;* lme
+
+;;* lmx 748 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 zygote_wrap_prop (property_service (set)))
+;;* lme
+
+;;* lmx 753 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 verity_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 759 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 setupwizard_mode_prop (property_service (set)))
+;;* lme
+
+;;* lmx 764 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 setupwizard_prop (property_service (set)))
+;;* lme
+
+;;* lmx 773 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_380 build_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 779 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_848 sqlite_log_prop (property_service (set)))
+;;* lme
+
+;;* lmx 785 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_369 sqlite_log_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 790 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 default_prop (property_service (set)))
+;;* lme
+
+;;* lmx 794 system/sepolicy/private/property.te
+
+(neverallow domain system_and_vendor_property_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow domain system_and_vendor_property_type (property_service (set)))
+;;* lme
+
+;;* lmx 803 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_886 remote_prov_prop (property_service (set)))
+;;* lme
+
+;;* lmx 808 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 remote_prov_cert_prop (property_service (set)))
+;;* lme
+
+;;* lmx 815 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_848 rollback_test_prop (property_service (set)))
+;;* lme
+
+;;* lmx 821 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_241 ctl_apex_load_prop (property_service (set)))
+;;* lme
+
+;;* lmx 829 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_887 ctl_apex_load_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 835 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_241 apex_ready_prop (property_service (set)))
+;;* lme
+
+;;* lmx 843 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_888 apex_ready_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 851 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_889 profcollectd_node_id_prop (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 856 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_235 log_file_logger_prop (property_service (set)))
+;;* lme
+
+;;* lmx 862 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 usb_uvc_enabled_prop (property_service (set)))
+;;* lme
+
+;;* lmx 869 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_890 usb_uvc_enabled_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 875 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_230 pm_archiving_enabled_prop (property_service (set)))
+;;* lme
+
+;;* lmx 882 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_848 bionic_linker_16kb_app_compat_prop (property_service (set)))
+;;* lme
+
+;;* lmx 889 system/sepolicy/private/property.te
+
+(neverallow base_typeattr_848 pm_16kb_app_compat_prop (property_service (set)))
+;;* lme
+
+(typetransition radio tmpfs file appdomain_tmpfs)
+(allow radio radio_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su radio_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 3 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_891 radio_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow radio appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 3 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_892 base_typeattr_891 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_893 radio (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_894 radio (process (ptrace)))
+;;* lme
+
+(allow radio runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio radio_control_prop (property_service (set)))
+(allow radio radio_control_prop (file (read getattr map open)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio radio_prop (property_service (set)))
+(allow radio radio_prop (file (read getattr map open)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio net_radio_prop (property_service (set)))
+(allow radio net_radio_prop (file (read getattr map open)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio telephony_status_prop (property_service (set)))
+(allow radio telephony_status_prop (file (read getattr map open)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio radio_cdma_ecm_prop (property_service (set)))
+(allow radio radio_cdma_ecm_prop (file (read getattr map open)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio ctl_rildaemon_prop (property_service (set)))
+(allow radio ctl_rildaemon_prop (file (read getattr map open)))
+(allow radio time_prop (file (read getattr map open)))
+(allow radio platform_compat_service (service_manager (find)))
+(allow radio uce_service (service_manager (find)))
+(allow radio emergency_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow radio emergency_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow radio property_socket (sock_file (write)))
+(allow radio init (unix_stream_socket (connectto)))
+(allow radio binder_cache_telephony_server_prop (property_service (set)))
+(allow radio binder_cache_telephony_server_prop (file (read getattr map open)))
+(allow radio statsd (binder (call transfer)))
+(allow statsd radio (binder (transfer)))
+(allow radio statsd (fd (use)))
+(allow radio radio_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow radio radio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow radio radio_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow radio radio_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow radio radio_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow radio radio_core_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow radio radio_core_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow radio net_data_file (dir (search)))
+(allow radio net_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow radio radio_service (service_manager (add find)))
+;;* lmx 51 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_891 radio_service (service_manager (add)))
+;;* lme
+
+(allow radio audioserver_service (service_manager (find)))
+(allow radio cameraserver_service (service_manager (find)))
+(allow radio drmserver_service (service_manager (find)))
+(allow radio mediaserver_service (service_manager (find)))
+(allow radio nfc_service (service_manager (find)))
+(allow radio app_api_service (service_manager (find)))
+(allow radio system_api_service (service_manager (find)))
+(allow radio timedetector_service (service_manager (find)))
+(allow radio timezonedetector_service (service_manager (find)))
+(allow radio hwservicemanager (binder (call transfer)))
+(allow hwservicemanager radio (binder (call transfer)))
+(allow hwservicemanager radio (dir (search)))
+(allow hwservicemanager radio (file (read map open)))
+(allow hwservicemanager radio (process (getattr)))
+(allow radio proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 74 system/sepolicy/private/radio.te
+
+(neverallow base_typeattr_895 binder_cache_telephony_server_prop (property_service (set)))
+;;* lme
+
+;;* lmx 206 system/sepolicy/private/recovery.te
+
+(neverallow recovery base_typeattr_896 (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
+;;* lme
+
+;;* lmx 212 system/sepolicy/private/recovery.te
+
+(neverallow recovery base_typeattr_896 (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+(allow init recovery_persist_exec (file (read getattr map execute open)))
+(allow init recovery_persist (process (transition)))
+(allow recovery_persist recovery_persist_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init recovery_persist (process (noatsecure)))
+(allow init recovery_persist (process (siginh rlimitinh)))
+(typetransition init recovery_persist_exec process recovery_persist)
+(allow recovery_persist pstorefs (dir (search)))
+(allow recovery_persist pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow recovery_persist recovery_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow recovery_persist recovery_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow recovery_persist cache_file (dir (search)))
+(allow recovery_persist cache_file (lnk_file (read)))
+(allow recovery_persist cache_recovery_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow recovery_persist cache_recovery_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+;;* lmx 22 system/sepolicy/private/recovery_persist.te
+
+(neverallow recovery_persist dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 25 system/sepolicy/private/recovery_persist.te
+
+(neverallow recovery_persist domain (process (ptrace)))
+;;* lme
+
+;;* lmx 28 system/sepolicy/private/recovery_persist.te
+
+(neverallow recovery_persist system_file_type (file (write)))
+(neverallow recovery_persist system_file_type (dir (write)))
+(neverallow recovery_persist system_file_type (lnk_file (write)))
+(neverallow recovery_persist system_file_type (chr_file (write)))
+(neverallow recovery_persist system_file_type (blk_file (write)))
+(neverallow recovery_persist system_file_type (sock_file (write)))
+(neverallow recovery_persist system_file_type (fifo_file (write)))
+;;* lme
+
+;;* lmx 31 system/sepolicy/private/recovery_persist.te
+
+(neverallow recovery_persist app_data_file_type (file (write)))
+(neverallow recovery_persist app_data_file_type (dir (write)))
+(neverallow recovery_persist app_data_file_type (lnk_file (write)))
+(neverallow recovery_persist app_data_file_type (chr_file (write)))
+(neverallow recovery_persist app_data_file_type (blk_file (write)))
+(neverallow recovery_persist app_data_file_type (sock_file (write)))
+(neverallow recovery_persist app_data_file_type (fifo_file (write)))
+(neverallow recovery_persist system_data_file (file (write)))
+(neverallow recovery_persist system_data_file (dir (write)))
+(neverallow recovery_persist system_data_file (lnk_file (write)))
+(neverallow recovery_persist system_data_file (chr_file (write)))
+(neverallow recovery_persist system_data_file (blk_file (write)))
+(neverallow recovery_persist system_data_file (sock_file (write)))
+(neverallow recovery_persist system_data_file (fifo_file (write)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/recovery_persist.te
+
+(neverallow recovery_persist base_typeattr_897 (file (write)))
+;;* lme
+
+(allow init recovery_refresh_exec (file (read getattr map execute open)))
+(allow init recovery_refresh (process (transition)))
+(allow recovery_refresh recovery_refresh_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init recovery_refresh (process (noatsecure)))
+(allow init recovery_refresh (process (siginh rlimitinh)))
+(typetransition init recovery_refresh_exec process recovery_refresh)
+(allow recovery_refresh pstorefs (dir (search)))
+(allow recovery_refresh pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 15 system/sepolicy/private/recovery_refresh.te
+
+(neverallow recovery_refresh dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 18 system/sepolicy/private/recovery_refresh.te
+
+(neverallow recovery_refresh domain (process (ptrace)))
+;;* lme
+
+;;* lmx 21 system/sepolicy/private/recovery_refresh.te
+
+(neverallow recovery_refresh system_file_type (file (write)))
+(neverallow recovery_refresh system_file_type (dir (write)))
+(neverallow recovery_refresh system_file_type (lnk_file (write)))
+(neverallow recovery_refresh system_file_type (chr_file (write)))
+(neverallow recovery_refresh system_file_type (blk_file (write)))
+(neverallow recovery_refresh system_file_type (sock_file (write)))
+(neverallow recovery_refresh system_file_type (fifo_file (write)))
+;;* lme
+
+;;* lmx 24 system/sepolicy/private/recovery_refresh.te
+
+(neverallow recovery_refresh app_data_file_type (file (write)))
+(neverallow recovery_refresh app_data_file_type (dir (write)))
+(neverallow recovery_refresh app_data_file_type (lnk_file (write)))
+(neverallow recovery_refresh app_data_file_type (chr_file (write)))
+(neverallow recovery_refresh app_data_file_type (blk_file (write)))
+(neverallow recovery_refresh app_data_file_type (sock_file (write)))
+(neverallow recovery_refresh app_data_file_type (fifo_file (write)))
+(neverallow recovery_refresh system_data_file (file (write)))
+(neverallow recovery_refresh system_data_file (dir (write)))
+(neverallow recovery_refresh system_data_file (lnk_file (write)))
+(neverallow recovery_refresh system_data_file (chr_file (write)))
+(neverallow recovery_refresh system_data_file (blk_file (write)))
+(neverallow recovery_refresh system_data_file (sock_file (write)))
+(neverallow recovery_refresh system_data_file (fifo_file (write)))
+;;* lme
+
+;;* lmx 31 system/sepolicy/private/recovery_refresh.te
+
+(neverallow recovery_refresh file_type (file (write)))
+;;* lme
+
+(allow remote_provisioning_service_server remote_provisioning_service (service_manager (add find)))
+;;* lmx 3 system/sepolicy/private/remote_provisioning_service_server.te
+
+(neverallow base_typeattr_898 remote_provisioning_service (service_manager (add)))
+;;* lme
+
+(allow remote_provisioning_service_server servicemanager (binder (call transfer)))
+(allow servicemanager remote_provisioning_service_server (binder (call transfer)))
+(allow servicemanager remote_provisioning_service_server (dir (search)))
+(allow servicemanager remote_provisioning_service_server (file (read open)))
+(allow servicemanager remote_provisioning_service_server (process (getattr)))
+(allow init rkp_cert_processor_exec (file (read getattr map execute open)))
+(allow init rkp_cert_processor (process (transition)))
+(allow rkp_cert_processor rkp_cert_processor_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init rkp_cert_processor (process (noatsecure)))
+(allow init rkp_cert_processor (process (siginh rlimitinh)))
+(typetransition init rkp_cert_processor_exec process rkp_cert_processor)
+(allow rkp_cert_processor servicemanager (binder (call transfer)))
+(allow servicemanager rkp_cert_processor (binder (call transfer)))
+(allow servicemanager rkp_cert_processor (dir (search)))
+(allow servicemanager rkp_cert_processor (file (read open)))
+(allow servicemanager rkp_cert_processor (process (getattr)))
+(allow rkp_cert_processor system_server (binder (call transfer)))
+(allow system_server rkp_cert_processor (binder (transfer)))
+(allow rkp_cert_processor system_server (fd (use)))
+(allow rkp_cert_processor rkp_cert_processor_service (service_manager (add find)))
+;;* lmx 11 system/sepolicy/private/rkp_cert_processor.te
+
+(neverallow base_typeattr_899 rkp_cert_processor_service (service_manager (add)))
+;;* lme
+
+(allow rkp_cert_processor system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rkp_cert_processor system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow rkp_cert_processor package_native_service (service_manager (find)))
+(allow rkpd servicemanager (binder (call transfer)))
+(allow servicemanager rkpd (binder (call transfer)))
+(allow servicemanager rkpd (dir (search)))
+(allow servicemanager rkpd (file (read open)))
+(allow servicemanager rkpd (process (getattr)))
+(allow init rkpd_exec (file (read getattr map execute open)))
+(allow init rkpd (process (transition)))
+(allow rkpd rkpd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init rkpd (process (noatsecure)))
+(allow init rkpd (process (siginh rlimitinh)))
+(typetransition init rkpd_exec process rkpd)
+(allow rkpd rkpd_registrar_service (service_manager (add find)))
+;;* lmx 12 system/sepolicy/private/rkpd.te
+
+(neverallow base_typeattr_900 rkpd_registrar_service (service_manager (add)))
+;;* lme
+
+(allow rkpd rkpd_refresh_service (service_manager (add find)))
+;;* lmx 13 system/sepolicy/private/rkpd.te
+
+(neverallow base_typeattr_900 rkpd_refresh_service (service_manager (add)))
+;;* lme
+
+(allow rkpd device_config_remote_key_provisioning_native_prop (file (read getattr map open)))
+(typetransition rkpdapp tmpfs file appdomain_tmpfs)
+(allow rkpdapp rkpdapp_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su rkpdapp_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 7 system/sepolicy/private/rkpd_app.te
+
+(neverallow base_typeattr_901 rkpdapp_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow rkpdapp appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 7 system/sepolicy/private/rkpd_app.te
+
+(neverallow base_typeattr_902 base_typeattr_901 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/rkpd_app.te
+
+(neverallow base_typeattr_903 rkpdapp (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 7 system/sepolicy/private/rkpd_app.te
+
+(neverallow base_typeattr_904 rkpdapp (process (ptrace)))
+;;* lme
+
+(allow rkpdapp device_config_remote_key_provisioning_native_prop (file (read getattr map open)))
+(allow rkpdapp property_socket (sock_file (write)))
+(allow rkpdapp init (unix_stream_socket (connectto)))
+(allow rkpdapp remote_prov_prop (property_service (set)))
+(allow rkpdapp remote_prov_prop (file (read getattr map open)))
+(allow rkpdapp app_api_service (service_manager (find)))
+(allow rkpdapp mediametrics_service (service_manager (find)))
+(allow rkpdapp statsmanager_service (service_manager (find)))
+(allow rkpdapp statsd (binder (call transfer)))
+(allow statsd rkpdapp (binder (transfer)))
+(allow rkpdapp statsd (fd (use)))
+(allow rootdisk_sysdev sysfs (filesystem (associate)))
+(allow rs app_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow rs privapp_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow rs app_exec_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(typetransition rs app_data_file file app_exec_data_file)
+(typetransition rs privapp_data_file file app_exec_data_file)
+(allow rs system_data_file (lnk_file (read)))
+(allow rs app_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs privapp_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs app_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs privapp_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs app_data_file (dir (remove_name)))
+(allow rs privapp_data_file (dir (remove_name)))
+(allow rs vendor_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs vendor_apex_metadata_file (dir (getattr search)))
+(allow rs apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow rs apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow rs ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow rs same_process_hal_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow rs untrusted_app_all (fd (use)))
+(allow rs ephemeral_app (fd (use)))
+(allow rs priv_app (fd (use)))
+(dontaudit rs hal_graphics_allocator (fd (use)))
+(dontaudit rs surfaceflinger (fd (use)))
+(dontaudit rs zygote (fd (use)))
+;;* lmx 41 system/sepolicy/private/rs.te
+
+(neverallow rs rs (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow rs rs (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow rs rs (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow rs rs (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/rs.te
+
+(neverallow base_typeattr_260 rs (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/rs.te
+
+(neverallow rs base_typeattr_285 (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/rs.te
+
+(neverallow rs app_data_file_type (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow rs app_data_file_type (lnk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow rs app_data_file_type (chr_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
+(neverallow rs app_data_file_type (blk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow rs app_data_file_type (sock_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+(neverallow rs app_data_file_type (fifo_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
+;;* lme
+
+;;* lmx 46 system/sepolicy/private/rs.te
+
+(neverallow rs base_typeattr_236 (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow rs base_typeattr_236 (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow rs base_typeattr_236 (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow rs base_typeattr_236 (icmp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+(allow init rss_hwm_reset_exec (file (read getattr map execute open)))
+(allow init rss_hwm_reset (process (transition)))
+(allow rss_hwm_reset rss_hwm_reset_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init rss_hwm_reset (process (noatsecure)))
+(allow init rss_hwm_reset (process (siginh rlimitinh)))
+(typetransition init rss_hwm_reset_exec process rss_hwm_reset)
+(allow rss_hwm_reset domain (dir (search)))
+(allow rss_hwm_reset self (capability (dac_override)))
+(allow rss_hwm_reset self (cap_userns (dac_override)))
+(allow rss_hwm_reset domain (file (write lock append map open)))
+(allow shell runas_exec (file (read getattr map execute open)))
+(allow shell runas (process (transition)))
+(allow runas runas_exec (file (read getattr map execute open entrypoint)))
+(allow runas shell (process (sigchld)))
+(dontaudit shell runas (process (noatsecure)))
+(allow shell runas (process (siginh rlimitinh)))
+(typetransition shell runas_exec process runas)
+(allow runas adbd (fd (use)))
+(allow runas adbd (process (sigchld)))
+(allow runas adbd (unix_stream_socket (read write)))
+(allow runas shell (fd (use)))
+(allow runas shell (fifo_file (read write)))
+(allow runas shell (unix_stream_socket (read write)))
+(allow runas devpts (chr_file (ioctl read write)))
+(allow runas shell_data_file (file (read write)))
+(allow runas system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas system_data_file (lnk_file (getattr)))
+(allow runas packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas system_data_file (lnk_file (read)))
+(dontaudit runas self (capability (dac_override dac_read_search)))
+(dontaudit runas self (cap_userns (dac_override dac_read_search)))
+(allow runas app_data_file (dir (getattr search)))
+(allow runas self (capability (setgid setuid)))
+(allow runas self (cap_userns (setgid setuid)))
+(allow runas selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow runas selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas selinuxfs (file (write lock append map open)))
+(allow runas kernel (security (check_context)))
+(allow runas self (process (setcurrent)))
+(allow runas base_typeattr_905 (process (dyntransition)))
+(allow runas seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 44 system/sepolicy/private/runas.te
+
+(neverallow runas self (capability (chown dac_override dac_read_search fowner fsetid kill setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow runas self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/runas.te
+
+(neverallow runas self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow runas self (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+(typetransition runas_app tmpfs file appdomain_tmpfs)
+(allow runas_app runas_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su runas_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 3 system/sepolicy/private/runas_app.te
+
+(neverallow base_typeattr_906 runas_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow runas_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 3 system/sepolicy/private/runas_app.te
+
+(neverallow base_typeattr_907 base_typeattr_906 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/runas_app.te
+
+(neverallow base_typeattr_908 runas_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/runas_app.te
+
+(neverallow base_typeattr_909 runas_app (process (ptrace)))
+;;* lme
+
+(allow runas_app app_data_file (file (execute_no_trans)))
+(allow runas_app untrusted_app_all (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow runas_app untrusted_app_all (file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas_app untrusted_app_all (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow runas_app untrusted_app_all (process (sigkill sigstop signal ptrace)))
+(allow runas_app untrusted_app_all (unix_stream_socket (connectto)))
+(allow runas_app simpleperf_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(dontaudit runas_app domain (dir (search)))
+(allow runas_app self (perf_event (open kernel read write)))
+;;* lmx 32 system/sepolicy/private/runas_app.te
+
+(neverallow runas_app self (perf_event (cpu tracepoint)))
+;;* lme
+
+(dontaudit runas_app shell_test_data_file (dir (search)))
+(allow scheduler_service_server fwk_scheduler_hwservice (hwservice_manager (add find)))
+(allow scheduler_service_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 1 system/sepolicy/private/scheduler_service_server.te
+
+(neverallow base_typeattr_910 fwk_scheduler_hwservice (hwservice_manager (add)))
+;;* lme
+
+(typetransition sdcardd system_data_file dir media_rw_data_file)
+(typetransition sdcardd system_data_file file media_rw_data_file)
+(allow sdcardd cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdcardd cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdcardd fuse_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow sdcardd rootfs (dir (mounton)))
+(allow sdcardd sdcardfs (filesystem (remount)))
+(allow sdcardd tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow sdcardd mnt_media_rw_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow sdcardd storage_file (dir (search)))
+(allow sdcardd storage_stub_file (dir (mounton search)))
+(allow sdcardd sdcard_type (filesystem (mount unmount)))
+(allow sdcardd fuse (filesystem (mount unmount)))
+(allow sdcardd self (capability (dac_override dac_read_search setgid setuid sys_admin sys_resource)))
+(allow sdcardd self (cap_userns (dac_override dac_read_search setgid setuid sys_admin sys_resource)))
+(allow sdcardd sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdcardd fuse (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdcardd sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow sdcardd fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow sdcardd media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdcardd media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow sdcardd system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow sdcardd packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow sdcardd install_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow sdcardd install_data_file (dir (search)))
+(allow sdcardd vold (fd (use)))
+(allow sdcardd vold (fifo_file (read write getattr)))
+(allow sdcardd mnt_expand_file (dir (search)))
+(allow sdcardd proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 47 system/sepolicy/private/sdcardd.te
+
+(neverallow init sdcardd_exec (file (execute)))
+;;* lme
+
+;;* lmx 48 system/sepolicy/private/sdcardd.te
+
+(neverallow init sdcardd (process (transition dyntransition)))
+;;* lme
+
+(typetransition sdk_sandbox_34 tmpfs file appdomain_tmpfs)
+(allow sdk_sandbox_34 sdk_sandbox_34_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su sdk_sandbox_34_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 9 system/sepolicy/private/sdk_sandbox_34.te
+
+(neverallow base_typeattr_911 sdk_sandbox_34_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow sdk_sandbox_34 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 9 system/sepolicy/private/sdk_sandbox_34.te
+
+(neverallow base_typeattr_912 base_typeattr_911 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/sdk_sandbox_34.te
+
+(neverallow base_typeattr_913 sdk_sandbox_34 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/sdk_sandbox_34.te
+
+(neverallow base_typeattr_914 sdk_sandbox_34 (process (ptrace)))
+;;* lme
+
+(allow sdk_sandbox_all system_linker_exec (file (execute_no_trans)))
+(allow sdk_sandbox_all shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow sdk_sandbox_all shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow sdk_sandbox_all system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow sdk_sandbox_all sdk_sandbox_system_data_file (dir (getattr search)))
+(allow sdk_sandbox_all sdk_sandbox_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow sdk_sandbox_all sdk_sandbox_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow sdk_sandbox_all app_data_file (file (read getattr)))
+(allow sdk_sandbox_all privapp_data_file (file (read getattr)))
+;;* lmx 39 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all app_data_file_type (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 42 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 49 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all debugfs_type (file (read)))
+;;* lme
+
+;;* lmx 52 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all gpu_device (chr_file (execute)))
+;;* lme
+
+;;* lmx 55 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all sysfs (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 59 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 62 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all sdcard_type (file (create open)))
+(neverallow sdk_sandbox_all media_rw_data_file (file (create open)))
+;;* lme
+
+;;* lmx 63 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all sdcard_type (dir (search)))
+(neverallow sdk_sandbox_all media_rw_data_file (dir (search)))
+;;* lme
+
+;;* lmx 67 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all proc_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 71 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all base_typeattr_915 (dir (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 72 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all base_typeattr_915 (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 75 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all media_rw_data_file (dir (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 76 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all media_rw_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 78 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all tmpfs (dir (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 80 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all hal_drm_service (service_manager (find)))
+;;* lme
+
+;;* lmx 90 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_916 sdk_sandbox_system_data_file (dir (relabelfrom)))
+;;* lme
+
+;;* lmx 100 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_917 sdk_sandbox_system_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 110 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_916 sdk_sandbox_system_data_file (dir (relabelfrom)))
+;;* lme
+
+;;* lmx 120 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_917 sdk_sandbox_system_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 123 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all sdk_sandbox_system_data_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 126 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_235 sdk_sandbox_system_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 144 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow sdk_sandbox_all base_typeattr_918 (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 149 system/sepolicy/private/sdk_sandbox_all.te
+
+(neverallow base_typeattr_919 sdk_sandbox_all (unix_stream_socket (connectto)))
+;;* lme
+
+(typetransition sdk_sandbox_audit tmpfs file appdomain_tmpfs)
+(allow sdk_sandbox_audit sdk_sandbox_audit_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su sdk_sandbox_audit_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 14 system/sepolicy/private/sdk_sandbox_audit.te
+
+(neverallow base_typeattr_920 sdk_sandbox_audit_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow sdk_sandbox_audit appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 14 system/sepolicy/private/sdk_sandbox_audit.te
+
+(neverallow base_typeattr_921 base_typeattr_920 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 14 system/sepolicy/private/sdk_sandbox_audit.te
+
+(neverallow base_typeattr_922 sdk_sandbox_audit (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 14 system/sepolicy/private/sdk_sandbox_audit.te
+
+(neverallow base_typeattr_923 sdk_sandbox_audit (process (ptrace)))
+;;* lme
+
+(auditallow sdk_sandbox_audit ephemeral_app_api_service (service_manager (find)))
+(auditallow sdk_sandbox_audit cameraserver_service (service_manager (find)))
+(auditallow sdk_sandbox_audit mediadrmserver_service (service_manager (find)))
+(auditallow sdk_sandbox_audit radio_service (service_manager (find)))
+(auditallow sdk_sandbox_audit base_typeattr_924 (file (ioctl read write getattr lock append map open watch watch_reads)))
+(auditallow sdk_sandbox_audit base_typeattr_924 (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow sdk_sandbox_current ephemeral_app_api_service (service_manager (find)))
+(allow sdk_sandbox_current audioserver_service (service_manager (find)))
+(allow sdk_sandbox_current batteryproperties_service (service_manager (find)))
+(allow sdk_sandbox_current cameraserver_service (service_manager (find)))
+(allow sdk_sandbox_current gpu_service (service_manager (find)))
+(allow sdk_sandbox_current mediaserver_service (service_manager (find)))
+(allow sdk_sandbox_current mediametrics_service (service_manager (find)))
+(allow sdk_sandbox_current mediaextractor_service (service_manager (find)))
+(allow sdk_sandbox_current mediadrmserver_service (service_manager (find)))
+(allow sdk_sandbox_current radio_service (service_manager (find)))
+(allow sdk_sandbox_current surfaceflinger_service (service_manager (find)))
+(allow sdk_sandbox_current activity_service (service_manager (find)))
+(allow sdk_sandbox_current activity_task_service (service_manager (find)))
+(allow sdk_sandbox_current appops_service (service_manager (find)))
+(allow sdk_sandbox_current audio_service (service_manager (find)))
+(allow sdk_sandbox_current batterystats_service (service_manager (find)))
+(allow sdk_sandbox_current IProxyService_service (service_manager (find)))
+(allow sdk_sandbox_current connectivity_service (service_manager (find)))
+(allow sdk_sandbox_current connmetrics_service (service_manager (find)))
+(allow sdk_sandbox_current deviceidle_service (service_manager (find)))
+(allow sdk_sandbox_current display_service (service_manager (find)))
+(allow sdk_sandbox_current font_service (service_manager (find)))
+(allow sdk_sandbox_current dropbox_service (service_manager (find)))
+(allow sdk_sandbox_current platform_compat_service (service_manager (find)))
+(allow sdk_sandbox_current game_service (service_manager (find)))
+(allow sdk_sandbox_current graphicsstats_service (service_manager (find)))
+(allow sdk_sandbox_current hardware_properties_service (service_manager (find)))
+(allow sdk_sandbox_current hint_service (service_manager (find)))
+(allow sdk_sandbox_current imms_service (service_manager (find)))
+(allow sdk_sandbox_current input_method_service (service_manager (find)))
+(allow sdk_sandbox_current input_service (service_manager (find)))
+(allow sdk_sandbox_current ipsec_service (service_manager (find)))
+(allow sdk_sandbox_current launcherapps_service (service_manager (find)))
+(allow sdk_sandbox_current legacy_permission_service (service_manager (find)))
+(allow sdk_sandbox_current light_service (service_manager (find)))
+(allow sdk_sandbox_current locale_service (service_manager (find)))
+(allow sdk_sandbox_current media_communication_service (service_manager (find)))
+(allow sdk_sandbox_current media_projection_service (service_manager (find)))
+(allow sdk_sandbox_current media_router_service (service_manager (find)))
+(allow sdk_sandbox_current media_session_service (service_manager (find)))
+(allow sdk_sandbox_current memtrackproxy_service (service_manager (find)))
+(allow sdk_sandbox_current midi_service (service_manager (find)))
+(allow sdk_sandbox_current netpolicy_service (service_manager (find)))
+(allow sdk_sandbox_current netstats_service (service_manager (find)))
+(allow sdk_sandbox_current network_management_service (service_manager (find)))
+(allow sdk_sandbox_current notification_service (service_manager (find)))
+(allow sdk_sandbox_current package_service (service_manager (find)))
+(allow sdk_sandbox_current permission_service (service_manager (find)))
+(allow sdk_sandbox_current permissionmgr_service (service_manager (find)))
+(allow sdk_sandbox_current permission_checker_service (service_manager (find)))
+(allow sdk_sandbox_current power_service (service_manager (find)))
+(allow sdk_sandbox_current procstats_service (service_manager (find)))
+(allow sdk_sandbox_current registry_service (service_manager (find)))
+(allow sdk_sandbox_current restrictions_service (service_manager (find)))
+(allow sdk_sandbox_current rttmanager_service (service_manager (find)))
+(allow sdk_sandbox_current search_service (service_manager (find)))
+(allow sdk_sandbox_current selection_toolbar_service (service_manager (find)))
+(allow sdk_sandbox_current sensorservice_service (service_manager (find)))
+(allow sdk_sandbox_current sensor_privacy_service (service_manager (find)))
+(allow sdk_sandbox_current servicediscovery_service (service_manager (find)))
+(allow sdk_sandbox_current settings_service (service_manager (find)))
+(allow sdk_sandbox_current statusbar_service (service_manager (find)))
+(allow sdk_sandbox_current storagestats_service (service_manager (find)))
+(allow sdk_sandbox_current speech_recognition_service (service_manager (find)))
+(allow sdk_sandbox_current textclassification_service (service_manager (find)))
+(allow sdk_sandbox_current textservices_service (service_manager (find)))
+(allow sdk_sandbox_current texttospeech_service (service_manager (find)))
+(allow sdk_sandbox_current telecom_service (service_manager (find)))
+(allow sdk_sandbox_current thermal_service (service_manager (find)))
+(allow sdk_sandbox_current translation_service (service_manager (find)))
+(allow sdk_sandbox_current tv_iapp_service (service_manager (find)))
+(allow sdk_sandbox_current tv_input_service (service_manager (find)))
+(allow sdk_sandbox_current uimode_service (service_manager (find)))
+(allow sdk_sandbox_current vcn_management_service (service_manager (find)))
+(allow sdk_sandbox_current webviewupdate_service (service_manager (find)))
+(allow sdk_sandbox_current tethering_service (service_manager (find)))
+(typetransition sdk_sandbox_next tmpfs file appdomain_tmpfs)
+(allow sdk_sandbox_next sdk_sandbox_next_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su sdk_sandbox_next_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 11 system/sepolicy/private/sdk_sandbox_next.te
+
+(neverallow base_typeattr_925 sdk_sandbox_next_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow sdk_sandbox_next appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 11 system/sepolicy/private/sdk_sandbox_next.te
+
+(neverallow base_typeattr_926 base_typeattr_925 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 11 system/sepolicy/private/sdk_sandbox_next.te
+
+(neverallow base_typeattr_927 sdk_sandbox_next (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 11 system/sepolicy/private/sdk_sandbox_next.te
+
+(neverallow base_typeattr_928 sdk_sandbox_next (process (ptrace)))
+;;* lme
+
+(allow sdk_sandbox_next audioserver_service (service_manager (find)))
+(allow sdk_sandbox_next batteryproperties_service (service_manager (find)))
+(allow sdk_sandbox_next gpu_service (service_manager (find)))
+(allow sdk_sandbox_next mediaserver_service (service_manager (find)))
+(allow sdk_sandbox_next mediametrics_service (service_manager (find)))
+(allow sdk_sandbox_next mediaextractor_service (service_manager (find)))
+(allow sdk_sandbox_next surfaceflinger_service (service_manager (find)))
+(allow sdk_sandbox_next activity_service (service_manager (find)))
+(allow sdk_sandbox_next activity_task_service (service_manager (find)))
+(allow sdk_sandbox_next appops_service (service_manager (find)))
+(allow sdk_sandbox_next audio_service (service_manager (find)))
+(allow sdk_sandbox_next batterystats_service (service_manager (find)))
+(allow sdk_sandbox_next IProxyService_service (service_manager (find)))
+(allow sdk_sandbox_next connectivity_service (service_manager (find)))
+(allow sdk_sandbox_next connmetrics_service (service_manager (find)))
+(allow sdk_sandbox_next deviceidle_service (service_manager (find)))
+(allow sdk_sandbox_next display_service (service_manager (find)))
+(allow sdk_sandbox_next font_service (service_manager (find)))
+(allow sdk_sandbox_next dropbox_service (service_manager (find)))
+(allow sdk_sandbox_next platform_compat_service (service_manager (find)))
+(allow sdk_sandbox_next game_service (service_manager (find)))
+(allow sdk_sandbox_next graphicsstats_service (service_manager (find)))
+(allow sdk_sandbox_next hardware_properties_service (service_manager (find)))
+(allow sdk_sandbox_next hint_service (service_manager (find)))
+(allow sdk_sandbox_next imms_service (service_manager (find)))
+(allow sdk_sandbox_next input_method_service (service_manager (find)))
+(allow sdk_sandbox_next input_service (service_manager (find)))
+(allow sdk_sandbox_next ipsec_service (service_manager (find)))
+(allow sdk_sandbox_next launcherapps_service (service_manager (find)))
+(allow sdk_sandbox_next legacy_permission_service (service_manager (find)))
+(allow sdk_sandbox_next light_service (service_manager (find)))
+(allow sdk_sandbox_next locale_service (service_manager (find)))
+(allow sdk_sandbox_next media_communication_service (service_manager (find)))
+(allow sdk_sandbox_next media_projection_service (service_manager (find)))
+(allow sdk_sandbox_next media_router_service (service_manager (find)))
+(allow sdk_sandbox_next media_session_service (service_manager (find)))
+(allow sdk_sandbox_next memtrackproxy_service (service_manager (find)))
+(allow sdk_sandbox_next midi_service (service_manager (find)))
+(allow sdk_sandbox_next netpolicy_service (service_manager (find)))
+(allow sdk_sandbox_next netstats_service (service_manager (find)))
+(allow sdk_sandbox_next network_management_service (service_manager (find)))
+(allow sdk_sandbox_next notification_service (service_manager (find)))
+(allow sdk_sandbox_next package_service (service_manager (find)))
+(allow sdk_sandbox_next permission_service (service_manager (find)))
+(allow sdk_sandbox_next permissionmgr_service (service_manager (find)))
+(allow sdk_sandbox_next permission_checker_service (service_manager (find)))
+(allow sdk_sandbox_next power_service (service_manager (find)))
+(allow sdk_sandbox_next procstats_service (service_manager (find)))
+(allow sdk_sandbox_next registry_service (service_manager (find)))
+(allow sdk_sandbox_next restrictions_service (service_manager (find)))
+(allow sdk_sandbox_next rttmanager_service (service_manager (find)))
+(allow sdk_sandbox_next search_service (service_manager (find)))
+(allow sdk_sandbox_next selection_toolbar_service (service_manager (find)))
+(allow sdk_sandbox_next sensorservice_service (service_manager (find)))
+(allow sdk_sandbox_next sensor_privacy_service (service_manager (find)))
+(allow sdk_sandbox_next servicediscovery_service (service_manager (find)))
+(allow sdk_sandbox_next settings_service (service_manager (find)))
+(allow sdk_sandbox_next statusbar_service (service_manager (find)))
+(allow sdk_sandbox_next storagestats_service (service_manager (find)))
+(allow sdk_sandbox_next speech_recognition_service (service_manager (find)))
+(allow sdk_sandbox_next textclassification_service (service_manager (find)))
+(allow sdk_sandbox_next textservices_service (service_manager (find)))
+(allow sdk_sandbox_next texttospeech_service (service_manager (find)))
+(allow sdk_sandbox_next telecom_service (service_manager (find)))
+(allow sdk_sandbox_next thermal_service (service_manager (find)))
+(allow sdk_sandbox_next translation_service (service_manager (find)))
+(allow sdk_sandbox_next tv_iapp_service (service_manager (find)))
+(allow sdk_sandbox_next tv_input_service (service_manager (find)))
+(allow sdk_sandbox_next uimode_service (service_manager (find)))
+(allow sdk_sandbox_next vcn_management_service (service_manager (find)))
+(allow sdk_sandbox_next webviewupdate_service (service_manager (find)))
+(allow sdk_sandbox_next tethering_service (service_manager (find)))
+(typetransition secure_element tmpfs file appdomain_tmpfs)
+(allow secure_element secure_element_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su secure_element_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 3 system/sepolicy/private/secure_element.te
+
+(neverallow base_typeattr_929 secure_element_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow secure_element appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 3 system/sepolicy/private/secure_element.te
+
+(neverallow base_typeattr_930 base_typeattr_929 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/secure_element.te
+
+(neverallow base_typeattr_931 secure_element (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/secure_element.te
+
+(neverallow base_typeattr_932 secure_element (process (ptrace)))
+;;* lme
+
+(allow secure_element secure_element_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/secure_element.te
+
+(neverallow base_typeattr_929 secure_element_service (service_manager (add)))
+;;* lme
+
+(allow secure_element app_api_service (service_manager (find)))
+(allow secure_element shell_data_file (file (read)))
+(allow secure_element vendor_uuid_mapping_config_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow sensor_service_server fwk_sensor_hwservice (hwservice_manager (add find)))
+(allow sensor_service_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 1 system/sepolicy/private/sensor_service_server.te
+
+(neverallow base_typeattr_933 fwk_sensor_hwservice (hwservice_manager (add)))
+;;* lme
+
+;;* lmx 84 system/sepolicy/private/service.te
+
+(neverallow domain base_typeattr_934 (service_manager (add find)))
+;;* lme
+
+(allow init servicemanager_exec (file (read getattr map execute open)))
+(allow init servicemanager (process (transition)))
+(allow servicemanager servicemanager_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init servicemanager (process (noatsecure)))
+(allow init servicemanager (process (siginh rlimitinh)))
+(typetransition init servicemanager_exec process servicemanager)
+(allow servicemanager runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager property_socket (sock_file (write)))
+(allow servicemanager init (unix_stream_socket (connectto)))
+(allow servicemanager ctl_interface_start_prop (property_service (set)))
+(allow servicemanager ctl_interface_start_prop (file (read getattr map open)))
+(allow servicemanager property_socket (sock_file (write)))
+(allow servicemanager init (unix_stream_socket (connectto)))
+(allow servicemanager servicemanager_prop (property_service (set)))
+(allow servicemanager servicemanager_prop (file (read getattr map open)))
+(allow servicemanager system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow servicemanager system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow servicemanager apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow servicemanager apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow servicemanager vendor_apex_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager vendor_apex_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager self (binder (set_context_mgr)))
+(allow servicemanager base_typeattr_935 (binder (transfer)))
+(allow servicemanager service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager vendor_service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager service_manager_service (service_manager (add find)))
+;;* lmx 38 system/sepolicy/private/servicemanager.te
+
+(neverallow base_typeattr_936 service_manager_service (service_manager (add)))
+;;* lme
+
+(allow servicemanager dumpstate (fd (use)))
+(allow servicemanager dumpstate (fifo_file (write)))
+(allow servicemanager selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow servicemanager selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow servicemanager selinuxfs (file (write lock append map open)))
+(allow servicemanager kernel (security (compute_av)))
+(allow servicemanager self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow servicemanager kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow servicemanager traced (fd (use)))
+(allow servicemanager traced_tmpfs (file (read write getattr map)))
+(allow servicemanager traced_producer_socket (sock_file (write)))
+(allow servicemanager traced (unix_stream_socket (connectto)))
+(allow traced servicemanager (fd (use)))
+(allow sgdisk block_device (dir (search)))
+(allow sgdisk vold_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx sgdisk vold_device (ioctl blk_file (0x301)))
+(allowx sgdisk vold_device (ioctl blk_file (0x1260)))
+(allowx sgdisk vold_device (ioctl blk_file (0x125f)))
+(allowx sgdisk vold_device (ioctl blk_file (0x127b)))
+(allow sgdisk devpts (chr_file (ioctl read write getattr)))
+(allow sgdisk vold (fd (use)))
+(allow sgdisk vold (fifo_file (read write getattr)))
+(allow sgdisk self (capability (sys_admin)))
+(allow sgdisk self (cap_userns (sys_admin)))
+;;* lmx 37 system/sepolicy/private/sgdisk.te
+
+(neverallow base_typeattr_296 sgdisk (process (transition)))
+;;* lme
+
+;;* lmx 38 system/sepolicy/private/sgdisk.te
+
+(neverallow base_typeattr_236 sgdisk (process (dyntransition)))
+;;* lme
+
+;;* lmx 39 system/sepolicy/private/sgdisk.te
+
+(neverallow sgdisk base_typeattr_937 (file (entrypoint)))
+;;* lme
+
+(typetransition shared_relro tmpfs file appdomain_tmpfs)
+(allow shared_relro shared_relro_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su shared_relro_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 5 system/sepolicy/private/shared_relro.te
+
+(neverallow base_typeattr_938 shared_relro_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow shared_relro appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 5 system/sepolicy/private/shared_relro.te
+
+(neverallow base_typeattr_939 base_typeattr_938 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/shared_relro.te
+
+(neverallow base_typeattr_940 shared_relro (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 5 system/sepolicy/private/shared_relro.te
+
+(neverallow base_typeattr_941 shared_relro (process (ptrace)))
+;;* lme
+
+(allow shared_relro shared_relro_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow shared_relro shared_relro_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shared_relro activity_service (service_manager (find)))
+(allow shared_relro webviewupdate_service (service_manager (find)))
+(allow shared_relro package_service (service_manager (find)))
+(dontaudit shared_relro network_management_service (service_manager (find)))
+(allow shell uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell debugfs_tracing_debug (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell debugfs_trace_marker (file (getattr)))
+(allow shell atrace_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell config_gz (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell tombstone_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell tombstone_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(typetransition shell tmpfs file appdomain_tmpfs)
+(allow shell shell_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su shell_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 26 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_942 shell_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow shell appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 26 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_943 base_typeattr_942 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 26 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_908 shell (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 26 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_944 shell (process (ptrace)))
+;;* lme
+
+(allow shell storaged (binder (call transfer)))
+(allow storaged shell (binder (transfer)))
+(allow shell storaged (fd (use)))
+(allow shell selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell selinuxfs (file (write lock append map open)))
+(allow shell kernel (security (compute_av)))
+(allow shell self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow shell selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell selinuxfs (file (write lock append map open)))
+(allow shell kernel (security (check_context)))
+(allow shell traced_consumer_socket (sock_file (write)))
+(allow shell traced (unix_stream_socket (connectto)))
+(allow shell traced (fd (use)))
+(allow shell traced_tmpfs (file (read write getattr map)))
+(allow shell traced_producer_socket (sock_file (write)))
+(allow shell traced (unix_stream_socket (connectto)))
+(allow traced shell (fd (use)))
+(allow shell vendor_shell_exec (file (read getattr map execute open)))
+(allow shell vendor_shell (process (transition)))
+(allow vendor_shell vendor_shell_exec (file (read getattr map execute open entrypoint)))
+(allow vendor_shell shell (process (sigchld)))
+(dontaudit shell vendor_shell (process (noatsecure)))
+(allow shell vendor_shell (process (siginh rlimitinh)))
+(typetransition shell vendor_shell_exec process vendor_shell)
+(allow shell tradeinmode_exec (file (read getattr map execute open)))
+(allow shell tradeinmode (process (transition)))
+(allow tradeinmode tradeinmode_exec (file (read getattr map execute open entrypoint)))
+(allow tradeinmode shell (process (sigchld)))
+(dontaudit shell tradeinmode (process (noatsecure)))
+(allow shell tradeinmode (process (siginh rlimitinh)))
+(typetransition shell tradeinmode_exec process tradeinmode)
+(allow shell perfetto_exec (file (read getattr map execute open)))
+(allow shell perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(allow perfetto shell (process (sigchld)))
+(dontaudit shell perfetto (process (noatsecure)))
+(allow shell perfetto (process (siginh rlimitinh)))
+(typetransition shell perfetto_exec process perfetto)
+(allow shell perfetto (process (signal)))
+(allow shell statsd (binder (call transfer)))
+(allow statsd shell (binder (transfer)))
+(allow shell statsd (fd (use)))
+(allow shell perfetto_traces_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow shell perfetto_traces_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow shell perfetto_traces_bugreport_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow shell perfetto_traces_bugreport_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow shell perfetto_configs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow shell perfetto_configs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell gpuservice (binder (call transfer)))
+(allow gpuservice shell (binder (transfer)))
+(allow shell gpuservice (fd (use)))
+(allow shell proc_net_tcp_udp (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell system_linker_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell rs_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell dex2oat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell dex2oat_exec (lnk_file (read)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell lpdumpd_prop (property_service (set)))
+(allow shell lpdumpd_prop (file (read getattr map open)))
+(allow shell lpdumpd (binder (call transfer)))
+(allow lpdumpd shell (binder (transfer)))
+(allow shell lpdumpd (fd (use)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell userspace_reboot_test_prop (property_service (set)))
+(allow shell userspace_reboot_test_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell power_debug_prop (property_service (set)))
+(allow shell power_debug_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell rollback_test_prop (property_service (set)))
+(allow shell rollback_test_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell remote_prov_prop (property_service (set)))
+(allow shell remote_prov_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell bionic_linker_16kb_app_compat_prop (property_service (set)))
+(allow shell bionic_linker_16kb_app_compat_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell pm_16kb_app_compat_prop (property_service (set)))
+(allow shell pm_16kb_app_compat_prop (file (read getattr map open)))
+(allowx shell shell_data_file (ioctl dir ((range 0x6615 0x6616))))
+(allow shell simpleperf_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell remount_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell self (perf_event (open kernel read write)))
+(allow shell vendor_microdroid_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell vendor_microdroid_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell vendor_microdroid_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell vendor_apex_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell vendor_apex_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell apex_data_file (dir (search)))
+(allow shell staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell shell_prop (property_service (set)))
+(allow shell shell_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell ctl_bugreport_prop (property_service (set)))
+(allow shell ctl_bugreport_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell ctl_dumpstate_prop (property_service (set)))
+(allow shell ctl_dumpstate_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell dumpstate_prop (property_service (set)))
+(allow shell dumpstate_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell exported_dumpstate_prop (property_service (set)))
+(allow shell exported_dumpstate_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell debug_prop (property_service (set)))
+(allow shell debug_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell perf_drop_caches_prop (property_service (set)))
+(allow shell perf_drop_caches_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell powerctl_prop (property_service (set)))
+(allow shell powerctl_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell log_tag_prop (property_service (set)))
+(allow shell log_tag_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell wifi_log_prop (property_service (set)))
+(allow shell wifi_log_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell traced_enabled_prop (property_service (set)))
+(allow shell traced_enabled_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell logd_auditrate_prop (property_service (set)))
+(allow shell logd_auditrate_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell heapprofd_enabled_prop (property_service (set)))
+(allow shell heapprofd_enabled_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell traced_perf_enabled_prop (property_service (set)))
+(allow shell traced_perf_enabled_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell ctl_gsid_prop (property_service (set)))
+(allow shell ctl_gsid_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell ctl_snapuserd_prop (property_service (set)))
+(allow shell ctl_snapuserd_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell ctl_prefetch_prop (property_service (set)))
+(allow shell ctl_prefetch_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell dynamic_system_prop (property_service (set)))
+(allow shell dynamic_system_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell mock_ota_prop (property_service (set)))
+(allow shell mock_ota_prop (file (read getattr map open)))
+(allow shell serialno_prop (file (read getattr map open)))
+(allow shell vendor_security_patch_level_prop (file (read getattr map open)))
+(allow shell device_logging_prop (file (read getattr map open)))
+(allow shell bootloader_boot_reason_prop (file (read getattr map open)))
+(allow shell last_boot_reason_prop (file (read getattr map open)))
+(allow shell system_boot_reason_prop (file (read getattr map open)))
+(allow shell hal_keymint (binder (call transfer)))
+(allow hal_keymint shell (binder (transfer)))
+(allow shell hal_keymint (fd (use)))
+(allow shell virtualizationservice (binder (call transfer)))
+(allow virtualizationservice shell (binder (transfer)))
+(allow shell virtualizationservice (fd (use)))
+(allow shell avf_virtualizationservice_prop (file (read getattr map open)))
+(allow shell init_perf_lsm_hooks_prop (file (read getattr map open)))
+(allow shell build_bootimage_prop (file (read getattr map open)))
+(allow shell odsign_prop (file (read getattr map open)))
+(allow shell keystore2_key_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell shell_key (keystore2_key (delete get_info rebind update use)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell sqlite_log_prop (property_service (set)))
+(allow shell sqlite_log_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell arm64_memtag_prop (property_service (set)))
+(allow shell arm64_memtag_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell permissive_mte_prop (property_service (set)))
+(allow shell permissive_mte_prop (file (read getattr map open)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell kcmdline_prop (property_service (set)))
+(allow shell kcmdline_prop (file (read getattr map open)))
+(allow shell verity_status_prop (file (read getattr map open)))
+(allow shell virtual_ab_prop (file (read getattr map open)))
+(allow shell gsi_metadata_file_type (dir (search)))
+(allow shell metadata_file (dir (search)))
+(allow shell gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell virtualizationmanager_exec (file (read getattr map execute open)))
+(allow shell virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager shell (process (sigchld)))
+(dontaudit shell virtualizationmanager (process (noatsecure)))
+(allow shell virtualizationmanager (process (siginh rlimitinh)))
+(typetransition shell virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm shell (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager shell (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm shell (fd (use)))
+(allow virtualizationmanager shell (fd (use)))
+(allow shell virtualizationmanager (fd (use)))
+(allow crosvm shell (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager shell (fifo_file (ioctl read write getattr)))
+(allow shell virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow shell hypervisor_prop (file (read getattr map open)))
+(allow shell virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager shell (dir (search)))
+(allow virtualizationmanager shell (file (read)))
+(allow virtualizationmanager shell (lnk_file (read)))
+(allow shell property_socket (sock_file (write)))
+(allow shell init (unix_stream_socket (connectto)))
+(allow shell gwp_asan_prop (property_service (set)))
+(allow shell gwp_asan_prop (file (read getattr map open)))
+(allow shell build_attestation_prop (file (read getattr map open)))
+(allow shell oatdump_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell logdr_socket (sock_file (write)))
+(allow shell logd (unix_stream_socket (connectto)))
+(allow shell logd_socket (sock_file (write)))
+(allow shell logd (unix_stream_socket (connectto)))
+(allow shell logd_prop (file (read getattr map open)))
+(allow shell pstorefs (dir (search)))
+(allow shell pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell anr_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell anr_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell shell_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow shell shell_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell shell_data_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell shell_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell shell_test_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow shell shell_test_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell shell_test_data_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell shell_test_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell shell_test_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell trace_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow shell trace_data_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search)))
+(allow shell profman_dump_data_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search)))
+(allow shell profman_dump_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow shell dumpstate_socket (sock_file (write)))
+(allow shell dumpstate (unix_stream_socket (connectto)))
+(allow shell devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell console_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell input_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell system_file (file (getattr map execute execute_no_trans)))
+(allow shell toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell servicemanager (service_manager (list)))
+(allow shell base_typeattr_945 (service_manager (find)))
+(allow shell dumpstate (binder (call)))
+(allow shell hwservicemanager (binder (call transfer)))
+(allow hwservicemanager shell (binder (call transfer)))
+(allow hwservicemanager shell (dir (search)))
+(allow hwservicemanager shell (file (read map open)))
+(allow hwservicemanager shell (process (getattr)))
+(allow shell hwservicemanager (hwservice_manager (list)))
+(allow shell proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_asound (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_cgroups (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_loadavg (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_modules (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_pid_max (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_slabinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_timer (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_uptime (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell proc_zoneinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell sysfs_net (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell vendor_cgroup_desc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell domain (dir (read getattr open search)))
+(allow shell domain (file (read getattr open)))
+(allow shell domain (lnk_file (read getattr open)))
+(allow shell labeledfs (filesystem (getattr)))
+(allow shell proc (filesystem (getattr)))
+(allow shell device (dir (getattr)))
+(allow shell domain (process (getattr)))
+(allow shell selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell bootchart_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow shell bootchart_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow shell self (process (ptrace)))
+(allow shell sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell sysfs_batteryinfo (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell sysfs_batteryinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell sysfs_lru_gen_enabled (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell sysfs_mem_sleep (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell sysfs_dt_avf (dir (search)))
+(allow shell proc_dt_avf (dir (search)))
+(allow shell ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow shell dev_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow shell dev_type (chr_file (getattr)))
+(allow shell proc (lnk_file (getattr)))
+(allow shell dev_type (blk_file (getattr)))
+(allow shell file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell property_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell sepolicy_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell vendor_shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow shell linux_vm_setup_exec (file (ioctl read getattr lock map open watch watch_reads entrypoint)))
+(allow shell tee_service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow shell test_pkvm_tee_service (tee_service (use)))
+;;* lmx 512 system/sepolicy/private/shell.te
+
+(neverallow shell virtualization_service (service_manager (find)))
+(neverallow shell hal_keymint_service (service_manager (find)))
+(neverallow shell hal_secureclock_service (service_manager (find)))
+(neverallow shell hal_sharedsecret_service (service_manager (find)))
+;;* lme
+
+;;* lmx 520 system/sepolicy/private/shell.te
+
+(neverallow shell file_type (file (link)))
+;;* lme
+
+;;* lmx 523 system/sepolicy/private/shell.te
+
+(neverallowx shell domain (ioctl tcp_socket (0x6900 0x6902)))
+(neverallowx shell domain (ioctl udp_socket (0x6900 0x6902)))
+(neverallowx shell domain (ioctl rawip_socket (0x6900 0x6902)))
+;;* lme
+
+;;* lmx 523 system/sepolicy/private/shell.te
+
+(neverallowx shell domain (ioctl tcp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx shell domain (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(neverallowx shell domain (ioctl rawip_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+;;* lme
+
+;;* lmx 523 system/sepolicy/private/shell.te
+
+(neverallowx shell domain (ioctl tcp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx shell domain (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(neverallowx shell domain (ioctl rawip_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+;;* lme
+
+;;* lmx 531 system/sepolicy/private/shell.te
+
+(neverallow shell hw_random_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow shell port_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow shell fuse_device (chr_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 534 system/sepolicy/private/shell.te
+
+(neverallow shell dev_type (blk_file (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 543 system/sepolicy/private/shell.te
+
+(neverallow shell input_device (chr_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 545 system/sepolicy/private/shell.te
+
+(neverallow shell self (perf_event (cpu tracepoint)))
+;;* lme
+
+;;* lmx 548 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_848 perf_drop_caches_prop (property_service (set)))
+;;* lme
+
+;;* lmx 549 system/sepolicy/private/shell.te
+
+(neverallow base_typeattr_946 perf_drop_caches_prop (file (read)))
+;;* lme
+
+(allow base_typeattr_947 simpleperf_exec (file (read getattr map execute open)))
+(allow base_typeattr_947 simpleperf (process (transition)))
+(allow simpleperf simpleperf_exec (file (read getattr map execute open entrypoint)))
+(allow simpleperf base_typeattr_947 (process (sigchld)))
+(dontaudit base_typeattr_947 simpleperf (process (noatsecure)))
+(allow base_typeattr_947 simpleperf (process (siginh rlimitinh)))
+(typetransition base_typeattr_947 simpleperf_exec process simpleperf)
+(typetransition simpleperf tmpfs file appdomain_tmpfs)
+(allow simpleperf simpleperf_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su simpleperf_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 23 system/sepolicy/private/simpleperf.te
+
+(neverallow base_typeattr_948 simpleperf_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow simpleperf appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 23 system/sepolicy/private/simpleperf.te
+
+(neverallow base_typeattr_949 base_typeattr_948 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 23 system/sepolicy/private/simpleperf.te
+
+(neverallow base_typeattr_908 simpleperf (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 23 system/sepolicy/private/simpleperf.te
+
+(neverallow base_typeattr_909 simpleperf (process (ptrace)))
+;;* lme
+
+(allow simpleperf untrusted_app_all (process (ptrace)))
+(allow simpleperf ephemeral_app (process (ptrace)))
+(allow simpleperf isolated_app (process (ptrace)))
+(allow simpleperf platform_app (process (ptrace)))
+(allow simpleperf priv_app (process (ptrace)))
+(allow simpleperf self (perf_event (open kernel read write)))
+(allow simpleperf untrusted_app_all (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf ephemeral_app (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf isolated_app (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf platform_app (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf priv_app (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf untrusted_app_all (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf untrusted_app_all (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf ephemeral_app (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf ephemeral_app (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf isolated_app (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf isolated_app (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf platform_app (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf platform_app (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf priv_app (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf priv_app (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all simpleperf (process (signal)))
+(allow ephemeral_app simpleperf (process (signal)))
+(allow isolated_app simpleperf (process (signal)))
+(allow platform_app simpleperf (process (signal)))
+(allow priv_app simpleperf (process (signal)))
+(dontaudit simpleperf domain (dir (search)))
+;;* lmx 51 system/sepolicy/private/simpleperf.te
+
+(neverallow simpleperf self (perf_event (cpu tracepoint)))
+;;* lme
+
+(allow shell simpleperf_app_runner_exec (file (read getattr map execute open)))
+(allow shell simpleperf_app_runner (process (transition)))
+(allow simpleperf_app_runner simpleperf_app_runner_exec (file (read getattr map execute open entrypoint)))
+(allow simpleperf_app_runner shell (process (sigchld)))
+(dontaudit shell simpleperf_app_runner (process (noatsecure)))
+(allow shell simpleperf_app_runner (process (siginh rlimitinh)))
+(typetransition shell simpleperf_app_runner_exec process simpleperf_app_runner)
+(allow simpleperf_app_runner adbd (fd (use)))
+(allow simpleperf_app_runner shell (fd (use)))
+(allow simpleperf_app_runner devpts (chr_file (ioctl read write)))
+(allow simpleperf_app_runner system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf_app_runner system_data_file (lnk_file (getattr)))
+(allow simpleperf_app_runner packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf_app_runner system_data_file (lnk_file (read)))
+(allow simpleperf_app_runner self (capability (setgid setuid)))
+(allow simpleperf_app_runner self (cap_userns (setgid setuid)))
+(allow simpleperf_app_runner selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow simpleperf_app_runner selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf_app_runner selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf_app_runner selinuxfs (file (write lock append map open)))
+(allow simpleperf_app_runner kernel (security (check_context)))
+(allow simpleperf_app_runner self (process (setcurrent)))
+(allow simpleperf_app_runner untrusted_app_all (process (dyntransition)))
+(allow simpleperf_app_runner ephemeral_app (process (dyntransition)))
+(allow simpleperf_app_runner isolated_app (process (dyntransition)))
+(allow simpleperf_app_runner platform_app (process (dyntransition)))
+(allow simpleperf_app_runner priv_app (process (dyntransition)))
+(allow simpleperf_app_runner seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow simpleperf_app_runner shell (fifo_file (read write)))
+(allow simpleperf_app_runner shell_data_file (dir (getattr search)))
+(allow simpleperf_app_runner shell_data_file (file (write getattr)))
+;;* lmx 44 system/sepolicy/private/simpleperf_app_runner.te
+
+(neverallow simpleperf_app_runner self (capability (chown dac_override dac_read_search fowner fsetid kill setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow simpleperf_app_runner self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+;;* lme
+
+;;* lmx 45 system/sepolicy/private/simpleperf_app_runner.te
+
+(neverallow simpleperf_app_runner self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow simpleperf_app_runner self (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+(allow slideshow kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow slideshow sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow slideshow self (capability2 (block_suspend)))
+(allow slideshow self (cap2_userns (block_suspend)))
+(allow slideshow system_suspend_server (binder (call transfer)))
+(allow system_suspend_server slideshow (binder (transfer)))
+(allow slideshow system_suspend_server (fd (use)))
+(allow slideshow system_suspend_hwservice (hwservice_manager (find)))
+(allow slideshow hwservicemanager (binder (call transfer)))
+(allow hwservicemanager slideshow (binder (call transfer)))
+(allow hwservicemanager slideshow (dir (search)))
+(allow hwservicemanager slideshow (file (read map open)))
+(allow hwservicemanager slideshow (process (getattr)))
+(allow slideshow hwservicemanager_prop (file (read getattr map open)))
+(allow slideshow hidl_manager_hwservice (hwservice_manager (find)))
+(allow slideshow hal_system_suspend_service (service_manager (find)))
+(allow slideshow servicemanager (binder (call transfer)))
+(allow servicemanager slideshow (binder (call transfer)))
+(allow servicemanager slideshow (dir (search)))
+(allow servicemanager slideshow (file (read open)))
+(allow servicemanager slideshow (process (getattr)))
+(allow slideshow device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow slideshow self (capability (sys_tty_config)))
+(allow slideshow self (cap_userns (sys_tty_config)))
+(allow slideshow graphics_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow slideshow graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow slideshow input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow slideshow input_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow slideshow tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init snapshotctl_exec (file (read getattr map execute open)))
+(allow init snapshotctl (process (transition)))
+(allow snapshotctl snapshotctl_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init snapshotctl (process (noatsecure)))
+(allow init snapshotctl (process (siginh rlimitinh)))
+(typetransition init snapshotctl_exec process snapshotctl)
+(allow snapshotctl property_socket (sock_file (write)))
+(allow snapshotctl init (unix_stream_socket (connectto)))
+(allow snapshotctl ctl_gsid_prop (property_service (set)))
+(allow snapshotctl ctl_gsid_prop (file (read getattr map open)))
+(allow snapshotctl servicemanager (binder (call transfer)))
+(allow servicemanager snapshotctl (binder (call transfer)))
+(allow servicemanager snapshotctl (dir (search)))
+(allow servicemanager snapshotctl (file (read open)))
+(allow servicemanager snapshotctl (process (getattr)))
+(allow snapshotctl gsi_service (service_manager (find)))
+(allow snapshotctl gsid (binder (call transfer)))
+(allow gsid snapshotctl (binder (transfer)))
+(allow snapshotctl gsid (fd (use)))
+(allow snapshotctl metadata_file (dir (search)))
+(allow snapshotctl ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow snapshotctl ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow snapshotctl sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow snapshotctl sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl sysfs_dt_firmware_android (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow snapshotctl super_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow snapshotctl self (capability (sys_admin)))
+(allow snapshotctl self (cap_userns (sys_admin)))
+(allow snapshotctl hwservicemanager (binder (call transfer)))
+(allow hwservicemanager snapshotctl (binder (call transfer)))
+(allow hwservicemanager snapshotctl (dir (search)))
+(allow hwservicemanager snapshotctl (file (read map open)))
+(allow hwservicemanager snapshotctl (process (getattr)))
+(allow snapshotctl statsdw_socket (sock_file (write)))
+(allow snapshotctl statsd (unix_dgram_socket (sendto)))
+(allow snapshotctl proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl property_socket (sock_file (write)))
+(allow snapshotctl init (unix_stream_socket (connectto)))
+(allow snapshotctl ctl_snapuserd_prop (property_service (set)))
+(allow snapshotctl ctl_snapuserd_prop (file (read getattr map open)))
+(allow snapshotctl snapuserd_prop (file (read getattr map open)))
+(allow snapshotctl snapuserd_socket (sock_file (write)))
+(allow snapshotctl snapuserd (unix_stream_socket (connectto)))
+(allow snapshotctl dm_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapshotctl dm_user_device (dir (search)))
+(allow init snapuserd_exec (file (read getattr map execute open)))
+(allow init snapuserd (process (transition)))
+(allow snapuserd snapuserd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init snapuserd (process (noatsecure)))
+(allow init snapuserd (process (siginh rlimitinh)))
+(typetransition init snapuserd_exec process snapuserd)
+(allow snapuserd kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow snapuserd block_device (dir (search)))
+(allow snapuserd sysfs (dir (read open)))
+(allow snapuserd sysfs_dm (dir (read open search)))
+(allow snapuserd sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapuserd block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow snapuserd dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow snapuserd dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow snapuserd dm_user_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow snapuserd dm_user_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow snapuserd snapuserd_socket (unix_stream_socket (read write getattr listen accept)))
+(allow snapuserd snapuserd_proxy_socket (sock_file (write)))
+(allow snapuserd self (capability (setgid)))
+(allow snapuserd self (cap_userns (setgid)))
+(allow snapuserd kernel (fd (use)))
+(allow snapuserd property_socket (sock_file (write)))
+(allow snapuserd init (unix_stream_socket (connectto)))
+(allow snapuserd snapuserd_prop (property_service (set)))
+(allow snapuserd snapuserd_prop (file (read getattr map open)))
+(allow snapuserd virtual_ab_prop (file (read getattr map open)))
+(allow snapuserd tmpfs (dir (read watch)))
+;;* lmx 56 system/sepolicy/private/snapuserd.te
+
+(neverallow base_typeattr_950 snapuserd_prop (property_service (set)))
+;;* lme
+
+(allow snapuserd metadata_file (dir (search)))
+(allow snapuserd ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow snapuserd ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow snapuserd snapuserd_log_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow snapuserd snapuserd_log_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow snapuserd proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow snapuserd self (capability (ipc_lock)))
+(allow snapuserd snapuserd_iouring (anon_inode (read write create map)))
+(allow snapuserd self (io_uring (sqpoll)))
+;;* lmx 73 system/sepolicy/private/snapuserd.te
+
+(neverallow base_typeattr_951 snapuserd_iouring (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit snapuserd self (capability (ipc_lock)))
+(dontaudit snapuserd self (cap_userns (ipc_lock)))
+;;* lmx 84 system/sepolicy/private/snapuserd.te
+
+(neverallow base_typeattr_952 ctl_snapuserd_prop (property_service (set)))
+;;* lme
+
+(allow shell stats_exec (file (read getattr map execute open)))
+(allow shell stats (process (transition)))
+(allow stats stats_exec (file (read getattr map execute open entrypoint)))
+(allow stats shell (process (sigchld)))
+(dontaudit shell stats (process (noatsecure)))
+(allow shell stats (process (siginh rlimitinh)))
+(typetransition shell stats_exec process stats)
+(allow stats shell (fd (use)))
+(allow stats adbd (fd (use)))
+(allow stats adbd (unix_stream_socket (read write)))
+(allow stats adbd (process (sigchld)))
+(allow stats servicemanager (binder (call transfer)))
+(allow servicemanager stats (binder (call transfer)))
+(allow servicemanager stats (dir (search)))
+(allow servicemanager stats (file (read open)))
+(allow servicemanager stats (process (getattr)))
+(allow stats stats_service (service_manager (find)))
+(allow stats statsd (binder (call transfer)))
+(allow statsd stats (binder (transfer)))
+(allow stats statsd (fd (use)))
+(allow stats statsd (fifo_file (write)))
+(allow statsd stats_service (service_manager (add find)))
+;;* lmx 27 system/sepolicy/private/stats.te
+
+(neverallow base_typeattr_953 stats_service (service_manager (add)))
+;;* lme
+
+(allow statsd stats (fd (use)))
+(allow statsd stats (fifo_file (write)))
+(allow statsd stats (binder (call transfer)))
+(allow stats statsd (binder (transfer)))
+(allow statsd stats (fd (use)))
+(allow stats_service_server fwk_stats_hwservice (hwservice_manager (add find)))
+(allow stats_service_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 1 system/sepolicy/private/stats_service_server.te
+
+(neverallow base_typeattr_954 fwk_stats_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow stats_service_server fwk_stats_service (service_manager (add find)))
+;;* lmx 2 system/sepolicy/private/stats_service_server.te
+
+(neverallow base_typeattr_954 fwk_stats_service (service_manager (add)))
+;;* lme
+
+(allow stats_service_server servicemanager (binder (call transfer)))
+(allow servicemanager stats_service_server (binder (call transfer)))
+(allow servicemanager stats_service_server (dir (search)))
+(allow servicemanager stats_service_server (file (read open)))
+(allow servicemanager stats_service_server (process (getattr)))
+(allow init statsd_exec (file (read getattr map execute open)))
+(allow init statsd (process (transition)))
+(allow statsd statsd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init statsd (process (noatsecure)))
+(allow init statsd (process (siginh rlimitinh)))
+(typetransition init statsd_exec process statsd)
+(allow statsd perfetto_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow statsd perfetto_exec (file (read getattr map execute open)))
+(allow statsd perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(allow perfetto statsd (process (sigchld)))
+(dontaudit statsd perfetto (process (noatsecure)))
+(allow statsd perfetto (process (siginh rlimitinh)))
+(typetransition statsd perfetto_exec process perfetto)
+(allow statsd statscompanion_service (service_manager (find)))
+(allow statsd incidentd (fifo_file (write)))
+(allow statsd system_server (fifo_file (read write getattr)))
+(allow statsd appdomain (fifo_file (read write getattr)))
+(allow statsd surfaceflinger (binder (call transfer)))
+(allow surfaceflinger statsd (binder (transfer)))
+(allow statsd surfaceflinger (fd (use)))
+(allow statsd device_config_statsd_native_prop (file (read getattr map open)))
+(allow statsd device_config_statsd_native_boot_prop (file (read getattr map open)))
+(allow statsd misctrl_prop (file (read getattr map open)))
+(allow statsd uprobestats_configs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow statsd uprobestats_configs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow statsd property_socket (sock_file (write)))
+(allow statsd init (unix_stream_socket (connectto)))
+(allow statsd uprobestats_start_with_config_prop (property_service (set)))
+(allow statsd uprobestats_start_with_config_prop (file (read getattr map open)))
+(allow statsd statsd_iouring (anon_inode (read write create map)))
+(allow statsd self (io_uring (sqpoll)))
+;;* lmx 46 system/sepolicy/private/statsd.te
+
+(neverallow base_typeattr_953 statsd_iouring (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit statsd self (capability (ipc_lock)))
+(dontaudit statsd self (cap_userns (ipc_lock)))
+(allow statsd property_socket (sock_file (write)))
+(allow statsd init (unix_stream_socket (connectto)))
+(allow statsd ctl_uprobestats_prop (property_service (set)))
+(allow statsd ctl_uprobestats_prop (file (read getattr map open)))
+(allow statsd servicemanager (binder (call transfer)))
+(allow servicemanager statsd (binder (call transfer)))
+(allow servicemanager statsd (dir (search)))
+(allow servicemanager statsd (file (read open)))
+(allow servicemanager statsd (process (getattr)))
+(allow statsd domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow statsd domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow statsd domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow statsd devpts (chr_file (ioctl read write getattr)))
+(allow statsd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow statsd system_file (file (execute_no_trans)))
+(allow statsd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow statsd stats_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow statsd stats_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow statsd stats_config_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow statsd stats_config_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow statsd appdomain (binder (call transfer)))
+(allow appdomain statsd (binder (transfer)))
+(allow statsd appdomain (fd (use)))
+(allow statsd incidentd (binder (call transfer)))
+(allow incidentd statsd (binder (transfer)))
+(allow statsd incidentd (fd (use)))
+(allow statsd system_server (binder (call transfer)))
+(allow system_server statsd (binder (transfer)))
+(allow statsd system_server (fd (use)))
+(allow statsd traced_probes (binder (call transfer)))
+(allow traced_probes statsd (binder (transfer)))
+(allow statsd traced_probes (fd (use)))
+(allow statsd gpu_service (service_manager (find)))
+(allow statsd gpuservice (binder (call transfer)))
+(allow gpuservice statsd (binder (transfer)))
+(allow statsd gpuservice (fd (use)))
+(allow statsd keystore_service (service_manager (find)))
+(allow statsd keystore (binder (call transfer)))
+(allow keystore statsd (binder (transfer)))
+(allow statsd keystore (fd (use)))
+(allow statsd mediametrics_service (service_manager (find)))
+(allow statsd mediametrics (binder (call transfer)))
+(allow mediametrics statsd (binder (transfer)))
+(allow statsd mediametrics (fd (use)))
+(allow statsd mediaserver_service (service_manager (find)))
+(allow statsd mediaserver (binder (call transfer)))
+(allow mediaserver statsd (binder (transfer)))
+(allow statsd mediaserver (fd (use)))
+(allow statsd logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow statsd logdr_socket (sock_file (write)))
+(allow statsd logd (unix_stream_socket (connectto)))
+(allow statsd logd_socket (sock_file (write)))
+(allow statsd logd (unix_stream_socket (connectto)))
+(allow statsd app_api_service (service_manager (find)))
+(allow statsd system_api_service (service_manager (find)))
+(allow statsd incident_service (service_manager (find)))
+(allow statsd hal_health_hwservice (hwservice_manager (find)))
+(allow statsd dumpstate (fd (use)))
+(allow statsd dumpstate (fifo_file (write getattr)))
+(allow statsd proc_uid_cputime_showstat (file (read getattr open)))
+(allow statsd adbd (fd (use)))
+(allow statsd adbd (unix_stream_socket (read write getattr)))
+(allow statsd shell (fifo_file (read write getattr)))
+(allow statsd statsdw_socket (sock_file (write)))
+(allow statsd statsd (unix_dgram_socket (sendto)))
+;;* lmx 140 system/sepolicy/private/statsd.te
+
+(neverallow base_typeattr_955 stats_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 141 system/sepolicy/private/statsd.te
+
+(neverallow base_typeattr_956 stats_config_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 145 system/sepolicy/private/statsd.te
+
+(neverallow base_typeattr_955 stats_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 146 system/sepolicy/private/statsd.te
+
+(neverallow base_typeattr_956 stats_config_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+(allow init storaged_exec (file (read getattr map execute open)))
+(allow init storaged (process (transition)))
+(allow storaged storaged_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init storaged (process (noatsecure)))
+(allow init storaged (process (siginh rlimitinh)))
+(typetransition init storaged_exec process storaged)
+(allow storaged domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow storaged domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow storaged domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow storaged proc_uid_io_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow storaged system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow storaged packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow storaged storaged_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow storaged storaged_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow storaged shell (fd (use)))
+(allow storaged shell (fifo_file (write)))
+(allow storaged priv_app (fd (use)))
+(allow storaged gmscore_app (fd (use)))
+(allow storaged app_data_file (file (write)))
+(allow storaged privapp_data_file (file (write)))
+(allow storaged permission_service (service_manager (find)))
+(allow storaged storaged_service (service_manager (add find)))
+;;* lmx 45 system/sepolicy/private/storaged.te
+
+(neverallow base_typeattr_957 storaged_service (service_manager (add)))
+;;* lme
+
+(allow storaged servicemanager (binder (call transfer)))
+(allow servicemanager storaged (binder (call transfer)))
+(allow servicemanager storaged (dir (search)))
+(allow servicemanager storaged (file (read open)))
+(allow servicemanager storaged (process (getattr)))
+(allow storaged system_server (binder (call transfer)))
+(allow system_server storaged (binder (transfer)))
+(allow storaged system_server (fd (use)))
+(allow storaged dumpstate (fd (use)))
+(allow storaged package_native_service (service_manager (find)))
+(dontaudit storaged self (capability (dac_override dac_read_search)))
+(dontaudit storaged self (cap_userns (dac_override dac_read_search)))
+(allow storaged dumpstate (fifo_file (write)))
+;;* lmx 68 system/sepolicy/private/storaged.te
+
+(neverallow storaged domain (process (ptrace)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/storaged.te
+
+(neverallow storaged self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow storaged self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+(neverallow storaged self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
+(neverallow storaged self (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon checkpoint_restore bpf)))
+;;* lme
+
+(allow init surfaceflinger_exec (file (read getattr map execute open)))
+(allow init surfaceflinger (process (transition)))
+(allow surfaceflinger surfaceflinger_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init surfaceflinger (process (noatsecure)))
+(allow init surfaceflinger (process (siginh rlimitinh)))
+(typetransition init surfaceflinger_exec process surfaceflinger)
+(typetransition surfaceflinger tmpfs file surfaceflinger_tmpfs)
+(allow surfaceflinger surfaceflinger_tmpfs (file (read write getattr map)))
+(allow surfaceflinger runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger hidl_token_hwservice (hwservice_manager (find)))
+(allow surfaceflinger servicemanager (binder (call transfer)))
+(allow servicemanager surfaceflinger (binder (call transfer)))
+(allow servicemanager surfaceflinger (dir (search)))
+(allow servicemanager surfaceflinger (file (read open)))
+(allow servicemanager surfaceflinger (process (getattr)))
+(allow surfaceflinger binderservicedomain (binder (call transfer)))
+(allow binderservicedomain surfaceflinger (binder (transfer)))
+(allow surfaceflinger binderservicedomain (fd (use)))
+(allow surfaceflinger appdomain (binder (call transfer)))
+(allow appdomain surfaceflinger (binder (transfer)))
+(allow surfaceflinger appdomain (fd (use)))
+(allow surfaceflinger bootanim (binder (call transfer)))
+(allow bootanim surfaceflinger (binder (transfer)))
+(allow surfaceflinger bootanim (fd (use)))
+(allow surfaceflinger system_server (binder (call transfer)))
+(allow system_server surfaceflinger (binder (transfer)))
+(allow surfaceflinger system_server (fd (use)))
+(allow surfaceflinger adbd (binder (call transfer)))
+(allow adbd surfaceflinger (binder (transfer)))
+(allow surfaceflinger adbd (fd (use)))
+(allow surfaceflinger binderservicedomain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger binderservicedomain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger binderservicedomain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger appdomain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger appdomain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger appdomain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow surfaceflinger gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger graphics_device (dir (search)))
+(allow surfaceflinger graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow surfaceflinger video_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger video_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow surfaceflinger dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger system_prop (property_service (set)))
+(allow surfaceflinger system_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger bootanim_system_prop (property_service (set)))
+(allow surfaceflinger bootanim_system_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger exported_system_prop (property_service (set)))
+(allow surfaceflinger exported_system_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger exported3_system_prop (property_service (set)))
+(allow surfaceflinger exported3_system_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger ctl_bootanim_prop (property_service (set)))
+(allow surfaceflinger ctl_bootanim_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger locale_prop (property_service (set)))
+(allow surfaceflinger locale_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger surfaceflinger_display_prop (property_service (set)))
+(allow surfaceflinger surfaceflinger_display_prop (file (read getattr map open)))
+(allow surfaceflinger property_socket (sock_file (write)))
+(allow surfaceflinger init (unix_stream_socket (connectto)))
+(allow surfaceflinger timezone_prop (property_service (set)))
+(allow surfaceflinger timezone_prop (file (read getattr map open)))
+(allow surfaceflinger qemu_sf_lcd_density_prop (file (read getattr map open)))
+(allow surfaceflinger device_config_surface_flinger_native_boot_prop (file (read getattr map open)))
+(allow surfaceflinger appdomain (fd (use)))
+(allow surfaceflinger app_data_file (file (read write)))
+(allow surfaceflinger privapp_data_file (file (read write)))
+(allow surfaceflinger traced (fd (use)))
+(allow surfaceflinger traced_tmpfs (file (read write getattr map)))
+(allow surfaceflinger traced_producer_socket (sock_file (write)))
+(allow surfaceflinger traced (unix_stream_socket (connectto)))
+(allow traced surfaceflinger (fd (use)))
+(allow surfaceflinger adbd (unix_stream_socket (read write getattr)))
+(allow surfaceflinger base_typeattr_251 (unix_stream_socket (read write)))
+(allow surfaceflinger bootanim (unix_stream_socket (read write)))
+(allow surfaceflinger automotive_display_service (unix_stream_socket (read write)))
+(allow surfaceflinger dumpstate (binder (call transfer)))
+(allow dumpstate surfaceflinger (binder (transfer)))
+(allow surfaceflinger dumpstate (fd (use)))
+(allow surfaceflinger shell (binder (call transfer)))
+(allow shell surfaceflinger (binder (transfer)))
+(allow surfaceflinger shell (fd (use)))
+(allow surfaceflinger dumpstate (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger dumpstate (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger dumpstate (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger surfaceflinger_service (service_manager (add find)))
+(allow surfaceflinger mediaserver_service (service_manager (find)))
+(allow surfaceflinger permission_service (service_manager (find)))
+(allow surfaceflinger power_service (service_manager (find)))
+(allow surfaceflinger vr_manager_service (service_manager (find)))
+(allow surfaceflinger window_service (service_manager (find)))
+(allow surfaceflinger inputflinger_service (service_manager (find)))
+(allow surfaceflinger self (capability (sys_nice)))
+(allow surfaceflinger self (cap_userns (sys_nice)))
+(allow surfaceflinger proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger system_server (fd (use)))
+(allow surfaceflinger system_server (unix_stream_socket (read write)))
+(allow surfaceflinger ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow surfaceflinger dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init pdx_display_client_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow surfaceflinger pdx_display_client_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow surfaceflinger self (process (setsockcreate)))
+(allow surfaceflinger pdx_display_client_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 130 system/sepolicy/private/surfaceflinger.te
+
+(neverallow base_typeattr_958 pdx_display_client_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow init pdx_display_manager_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow surfaceflinger pdx_display_manager_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow surfaceflinger self (process (setsockcreate)))
+(allow surfaceflinger pdx_display_manager_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 131 system/sepolicy/private/surfaceflinger.te
+
+(neverallow base_typeattr_958 pdx_display_manager_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow init pdx_display_screenshot_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow surfaceflinger pdx_display_screenshot_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow surfaceflinger self (process (setsockcreate)))
+(allow surfaceflinger pdx_display_screenshot_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 132 system/sepolicy/private/surfaceflinger.te
+
+(neverallow base_typeattr_958 pdx_display_screenshot_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow init pdx_display_vsync_endpoint_socket_type (unix_stream_socket (create bind)))
+(allow surfaceflinger pdx_display_vsync_endpoint_socket_type (unix_stream_socket (read write getattr setattr lock append listen accept getopt setopt shutdown)))
+(allow surfaceflinger self (process (setsockcreate)))
+(allow surfaceflinger pdx_display_vsync_channel_socket_type (unix_stream_socket (ioctl read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 133 system/sepolicy/private/surfaceflinger.te
+
+(neverallow base_typeattr_958 pdx_display_vsync_endpoint_socket_type (unix_stream_socket (listen accept)))
+;;* lme
+
+(allow surfaceflinger pdx_bufferhub_client_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger pdx_bufferhub_client_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow surfaceflinger pdx_bufferhub_client_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow surfaceflinger pdx_bufferhub_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow surfaceflinger pdx_bufferhub_client_server_type (fd (use)))
+(allow pdx_bufferhub_client_server_type surfaceflinger (fd (use)))
+(allow surfaceflinger pdx_performance_client_endpoint_dir_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow surfaceflinger pdx_performance_client_endpoint_socket_type (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow surfaceflinger pdx_performance_client_endpoint_socket_type (unix_stream_socket (read write shutdown connectto)))
+(allow surfaceflinger pdx_performance_client_channel_socket_type (unix_stream_socket (read write getattr setattr lock append getopt setopt shutdown)))
+(allow surfaceflinger pdx_performance_client_server_type (fd (use)))
+(allow pdx_performance_client_server_type surfaceflinger (fd (use)))
+(allow surfaceflinger stats_service (service_manager (find)))
+(allow surfaceflinger statsmanager_service (service_manager (find)))
+(allow surfaceflinger statsd (binder (call transfer)))
+(allow statsd surfaceflinger (binder (transfer)))
+(allow surfaceflinger statsd (fd (use)))
+(allow surfaceflinger statsbootstrap_service (service_manager (find)))
+(allow surfaceflinger hal_evs (fd (use)))
+(allow surfaceflinger hal_camera (fd (use)))
+(dontaudit surfaceflinger vendor_default_prop (file (read)))
+;;* lmx 163 system/sepolicy/private/surfaceflinger.te
+
+(neverallow surfaceflinger sdcard_type (file (ioctl read write getattr lock append map open watch watch_reads)))
+(neverallow surfaceflinger fuse (file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lme
+
+(dontaudit surfaceflinger unlabeled (dir (search)))
+(typetransition system_app tmpfs file appdomain_tmpfs)
+(allow system_app system_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su system_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 9 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_959 system_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow system_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 9 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_960 base_typeattr_959 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_961 system_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 9 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_962 system_app (process (ptrace)))
+;;* lme
+
+(allow system_app rootfs (dir (getattr)))
+(allow system_app system_app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_app system_app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_app system_app_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_app misc_user_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_app misc_user_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_app apex_data_file (dir (search)))
+(allow system_app staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app wallpaper_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app icon_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app adaptive_haptics_prop (property_service (set)))
+(allow system_app adaptive_haptics_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app arm64_memtag_prop (property_service (set)))
+(allow system_app arm64_memtag_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app bluetooth_a2dp_offload_prop (property_service (set)))
+(allow system_app bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app bluetooth_audio_hal_prop (property_service (set)))
+(allow system_app bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app bluetooth_prop (property_service (set)))
+(allow system_app bluetooth_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app debug_prop (property_service (set)))
+(allow system_app debug_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app system_prop (property_service (set)))
+(allow system_app system_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app exported_bluetooth_prop (property_service (set)))
+(allow system_app exported_bluetooth_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app exported_system_prop (property_service (set)))
+(allow system_app exported_system_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app exported3_system_prop (property_service (set)))
+(allow system_app exported3_system_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app gesture_prop (property_service (set)))
+(allow system_app gesture_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app locale_prop (property_service (set)))
+(allow system_app locale_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app logd_prop (property_service (set)))
+(allow system_app logd_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app net_radio_prop (property_service (set)))
+(allow system_app net_radio_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app timezone_prop (property_service (set)))
+(allow system_app timezone_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app usb_control_prop (property_service (set)))
+(allow system_app usb_control_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app usb_prop (property_service (set)))
+(allow system_app usb_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app log_tag_prop (property_service (set)))
+(allow system_app log_tag_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app drm_forcel3_prop (property_service (set)))
+(allow system_app drm_forcel3_prop (file (read getattr map open)))
+(auditallow system_app net_radio_prop (property_service (set)))
+(auditallow system_app usb_control_prop (property_service (set)))
+(auditallow system_app usb_prop (property_service (set)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app dynamic_system_prop (property_service (set)))
+(allow system_app dynamic_system_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app ctl_default_prop (property_service (set)))
+(allow system_app ctl_default_prop (file (read getattr map open)))
+(allow system_app property_socket (sock_file (write)))
+(allow system_app init (unix_stream_socket (connectto)))
+(allow system_app ctl_bugreport_prop (property_service (set)))
+(allow system_app ctl_bugreport_prop (file (read getattr map open)))
+(allow system_app gsid_prop (file (read getattr map open)))
+(allow system_app enable_16k_pages_prop (file (read getattr map open)))
+(allow system_app hypervisor_prop (file (read getattr map open)))
+(allow system_app anr_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
+(allow system_app anr_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_app asec_apk_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app statsd (binder (call transfer)))
+(allow statsd system_app (binder (transfer)))
+(allow system_app statsd (fd (use)))
+(allow system_app incidentd (binder (call transfer)))
+(allow incidentd system_app (binder (transfer)))
+(allow system_app incidentd (fd (use)))
+(allow system_app servicemanager (binder (call transfer)))
+(allow servicemanager system_app (binder (call transfer)))
+(allow servicemanager system_app (dir (search)))
+(allow servicemanager system_app (file (read open)))
+(allow servicemanager system_app (process (getattr)))
+(allow system_app update_engine_stable_service (service_manager (find)))
+(allow system_app update_engine (binder (call transfer)))
+(allow update_engine system_app (binder (transfer)))
+(allow system_app update_engine (fd (use)))
+(allow system_app servicemanager (service_manager (list)))
+(allow system_app base_typeattr_963 (service_manager (find)))
+(dontaudit system_app dnsresolver_service (service_manager (find)))
+(dontaudit system_app dumpstate_service (service_manager (find)))
+(dontaudit system_app installd_service (service_manager (find)))
+(dontaudit system_app mdns_service (service_manager (find)))
+(dontaudit system_app netd_service (service_manager (find)))
+(dontaudit system_app virtual_touchpad_service (service_manager (find)))
+(dontaudit system_app vold_service (service_manager (find)))
+(dontaudit system_app debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit system_app proc_pagetypeinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit system_app sysfs_zram (dir (search)))
+(allow system_app keystore (keystore2_key (delete get_info grant rebind update use)))
+(allow system_app wifi_key (keystore2_key (delete get_info rebind update use)))
+(allow system_app proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app cgroup (file (write lock append map open)))
+(allow system_app cgroup_v2 (file (write lock append map open)))
+(allow system_app cgroup_v2 (dir (write lock open add_name remove_name search)))
+(allow system_app logd_socket (sock_file (write)))
+(allow system_app logd (unix_stream_socket (connectto)))
+(allow system_app runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app device_logging_prop (file (read getattr map open)))
+(allow system_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow system_app game_manager_config_prop (file (read getattr map open)))
+(allow system_app oem_unlock_prop (file (read getattr map open)))
+(allow system_app usb_uvc_enabled_prop (file (read getattr map open)))
+(allow system_app connectivityblob_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_app connectivityblob_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lmx 189 system/sepolicy/private/system_app.te
+
+(neverallow system_app fuse_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 195 system/sepolicy/private/system_app.te
+
+(neverallow system_app shell_data_file (dir (read write create setattr relabelfrom link rename open add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 196 system/sepolicy/private/system_app.te
+
+(neverallow system_app shell_data_file (file (ioctl read lock open)))
+;;* lme
+
+;;* lmx 199 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_964 adaptive_haptics_prop (property_service (set)))
+;;* lme
+
+;;* lmx 201 system/sepolicy/private/system_app.te
+
+(neverallow base_typeattr_964 drm_forcel3_prop (property_service (set)))
+;;* lme
+
+(allow system_app vendor_boot_ota_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_app vendor_boot_ota_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_app system_dlkm_file (dir (search)))
+(allow system_app system_dlkm_file (file (read getattr open)))
+(typetransition system_server tmpfs file system_server_tmpfs)
+(allow system_server system_server_tmpfs (file (read write getattr map)))
+(allow system_server system_server_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su system_server_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 17 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_424 system_server_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow system_server zygote_tmpfs (file (read map)))
+(allow system_server appdomain_tmpfs (file (read write getattr map)))
+(allow system_server proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server incremental_control_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx system_server incremental_control_file (ioctl file (0x671e 0x6721 0x6723 (range 0x6725 0x6727))))
+(allowx system_server apk_data_file (ioctl file ((range 0x6601 0x6602))))
+(allowx system_server apk_data_file (ioctl file ((range 0x671f 0x6720) 0x6722 0x6724)))
+(allowx system_server apk_data_file (ioctl file (0xf50c (range 0xf511 0xf513) (range 0xf517 0xf518))))
+(allowx system_server apk_tmp_file (ioctl file (0x6601)))
+(allowx system_server apk_tmp_file (ioctl file (0xf512)))
+(allow system_server sysfs_fs_incfs_metrics (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_fs_f2fs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sdk_sandbox_system_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit system_server apex_art_data_file (file (execute)))
+(allowx system_server dalvikcache_data_file (ioctl file (0x6601)))
+(allowx system_server dalvikcache_data_file (ioctl file (0xf512)))
+(allow system_server resourcecache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server resourcecache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server self (process (ptrace)))
+(allow system_server zygote (fd (use)))
+(allow system_server zygote (process (sigchld)))
+(allow system_server app_zygote (process (sigkill signull getpgid)))
+(allow system_server crash_dump (process (sigkill signull getpgid)))
+(allow system_server crosvm (process (sigkill signull getpgid)))
+(allow system_server virtualizationmanager (process (sigkill signull getpgid)))
+(allow system_server webview_zygote (process (sigkill signull getpgid)))
+(allow system_server zygote (process (sigkill signull getpgid)))
+(allow system_server zygote_exec (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server zygote (unix_stream_socket (getattr getopt)))
+(allowx system_server self (ioctl udp_socket (0x6900 0x6902)))
+(allowx system_server self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx system_server self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow system_server appdomain (tcp_socket (ioctl)))
+(allow system_server self (capability (kill net_bind_service net_broadcast net_admin net_raw ipc_lock sys_ptrace sys_boot sys_nice sys_time sys_tty_config)))
+(allow system_server self (cap_userns (kill net_bind_service net_broadcast net_admin net_raw ipc_lock sys_ptrace sys_boot sys_nice sys_time sys_tty_config)))
+(allow system_server self (capability2 (wake_alarm)))
+(allow system_server self (cap2_userns (wake_alarm)))
+(allow system_server self (netlink_netfilter_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (netlink_tcpdiag_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow system_server self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (netlink_nflog_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server config_gz (file (read open)))
+(allow system_server self (socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (netlink_route_socket (nlmsg_write)))
+(allow system_server self (netlink_xfrm_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
+(allow system_server appdomain (process (sigkill signal getpgid)))
+(allow system_server appdomain (process (signull)))
+(allow system_server appdomain (process (getsched setsched)))
+(allow system_server audioserver (process (getsched setsched)))
+(allow system_server hal_audio (process (getsched setsched)))
+(allow system_server hal_bluetooth (process (getsched setsched)))
+(allow system_server hal_codec2_server (process (getsched setsched)))
+(allow system_server hal_omx_server (process (getsched setsched)))
+(allow system_server mediaswcodec (process (getsched setsched)))
+(allow system_server cameraserver (process (getsched setsched)))
+(allow system_server hal_camera (process (getsched setsched)))
+(allow system_server mediaserver (process (getsched setsched)))
+(allow system_server bootanim (process (getsched setsched)))
+(allow system_server crosvm (process (getsched setsched)))
+(allow system_server virtualizationmanager (process (getsched setsched)))
+(allow system_server kernel (process (getsched setsched)))
+(allow system_server domain (file (write lock append map open)))
+(allow system_server domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_cputime_removeuid (file (write getattr lock append map open)))
+(allow system_server proc_uid_procstat_set (file (write getattr lock append map open)))
+(allow system_server proc_sysrq (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server stats_config_data_file (dir (read write open remove_name search)))
+(allow system_server stats_config_data_file (file (unlink)))
+(allow system_server odsign_data_file (dir (search)))
+(allow system_server odsign_metrics_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search)))
+(allow system_server odsign_metrics_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow system_server sysfs_ion (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_dma_heap (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_cma (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_dmabuf_stats (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_dmabuf_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server dmabuf_heap_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server self (tun_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server lmkd_socket (sock_file (write)))
+(allow system_server lmkd (unix_stream_socket (connectto)))
+(allow system_server zygote_socket (sock_file (write)))
+(allow system_server zygote (unix_stream_socket (connectto)))
+(allow system_server uncrypt_socket (sock_file (write)))
+(allow system_server uncrypt (unix_stream_socket (connectto)))
+(allow system_server statsdw_socket (sock_file (write)))
+(allow system_server statsd (unix_dgram_socket (sendto)))
+(allow system_server surfaceflinger (unix_stream_socket (read write setopt)))
+(allow system_server gpuservice (unix_stream_socket (read write setopt)))
+(allow system_server webview_zygote (unix_stream_socket (read write setopt connectto)))
+(allow system_server app_zygote (unix_stream_socket (read write setopt connectto)))
+(allow system_server servicemanager (binder (call transfer)))
+(allow servicemanager system_server (binder (call transfer)))
+(allow servicemanager system_server (dir (search)))
+(allow servicemanager system_server (file (read open)))
+(allow servicemanager system_server (process (getattr)))
+(allow system_server appdomain (binder (call transfer)))
+(allow appdomain system_server (binder (transfer)))
+(allow system_server appdomain (fd (use)))
+(allow system_server artd (binder (call transfer)))
+(allow artd system_server (binder (transfer)))
+(allow system_server artd (fd (use)))
+(allow system_server binderservicedomain (binder (call transfer)))
+(allow binderservicedomain system_server (binder (transfer)))
+(allow system_server binderservicedomain (fd (use)))
+(allow system_server composd (binder (call transfer)))
+(allow composd system_server (binder (transfer)))
+(allow system_server composd (fd (use)))
+(allow system_server dexopt_chroot_setup (binder (call transfer)))
+(allow dexopt_chroot_setup system_server (binder (transfer)))
+(allow system_server dexopt_chroot_setup (fd (use)))
+(allow system_server dumpstate (binder (call transfer)))
+(allow dumpstate system_server (binder (transfer)))
+(allow system_server dumpstate (fd (use)))
+(allow system_server fingerprintd (binder (call transfer)))
+(allow fingerprintd system_server (binder (transfer)))
+(allow system_server fingerprintd (fd (use)))
+(allow system_server gatekeeperd (binder (call transfer)))
+(allow gatekeeperd system_server (binder (transfer)))
+(allow system_server gatekeeperd (fd (use)))
+(allow system_server gpuservice (binder (call transfer)))
+(allow gpuservice system_server (binder (transfer)))
+(allow system_server gpuservice (fd (use)))
+(allow system_server idmap (binder (call transfer)))
+(allow idmap system_server (binder (transfer)))
+(allow system_server idmap (fd (use)))
+(allow system_server installd (binder (call transfer)))
+(allow installd system_server (binder (transfer)))
+(allow system_server installd (fd (use)))
+(allow system_server incidentd (binder (call transfer)))
+(allow incidentd system_server (binder (transfer)))
+(allow system_server incidentd (fd (use)))
+(allow system_server mmd (binder (call transfer)))
+(allow mmd system_server (binder (transfer)))
+(allow system_server mmd (fd (use)))
+(allow system_server netd (binder (call transfer)))
+(allow netd system_server (binder (transfer)))
+(allow system_server netd (fd (use)))
+(allow system_server ot_daemon (binder (call transfer)))
+(allow ot_daemon system_server (binder (transfer)))
+(allow system_server ot_daemon (fd (use)))
+(allow system_server statsd (binder (call transfer)))
+(allow statsd system_server (binder (transfer)))
+(allow system_server statsd (fd (use)))
+(allow system_server storaged (binder (call transfer)))
+(allow storaged system_server (binder (transfer)))
+(allow system_server storaged (fd (use)))
+(allow system_server update_engine (binder (call transfer)))
+(allow update_engine system_server (binder (transfer)))
+(allow system_server update_engine (fd (use)))
+(allow system_server virtual_camera (binder (call transfer)))
+(allow virtual_camera system_server (binder (transfer)))
+(allow system_server virtual_camera (fd (use)))
+(allow system_server vold (binder (call transfer)))
+(allow vold system_server (binder (transfer)))
+(allow system_server vold (fd (use)))
+(allow system_server logd (binder (call transfer)))
+(allow logd system_server (binder (transfer)))
+(allow system_server logd (fd (use)))
+(allow system_server wificond (binder (call transfer)))
+(allow wificond system_server (binder (transfer)))
+(allow system_server wificond (fd (use)))
+(allow system_server uprobestats (binder (call transfer)))
+(allow uprobestats system_server (binder (transfer)))
+(allow system_server uprobestats (fd (use)))
+(allow system_server wifi_mainline_supplicant (binder (call transfer)))
+(allow wifi_mainline_supplicant system_server (binder (transfer)))
+(allow system_server wifi_mainline_supplicant (fd (use)))
+(allow system_server hal_graphics_composer (fd (use)))
+(allow system_server hal_renderscript_hwservice (hwservice_manager (find)))
+(allow system_server same_process_hal_file (file (read getattr map execute open)))
+(allow system_server tombstoned_intercept_socket (sock_file (write)))
+(allow system_server tombstoned (unix_stream_socket (connectto)))
+(allow system_server hwservicemanager (hwservice_manager (list)))
+(allow system_server servicemanager (service_manager (list)))
+(allow system_server hal_audio_server (process (signal)))
+(allow system_server hal_bluetooth_server (process (signal)))
+(allow system_server hal_camera_server (process (signal)))
+(allow system_server hal_codec2_server (process (signal)))
+(allow system_server hal_drm_server (process (signal)))
+(allow system_server hal_face_server (process (signal)))
+(allow system_server hal_fingerprint_server (process (signal)))
+(allow system_server hal_gnss_server (process (signal)))
+(allow system_server hal_graphics_allocator_server (process (signal)))
+(allow system_server hal_graphics_composer_server (process (signal)))
+(allow system_server hal_health_server (process (signal)))
+(allow system_server hal_input_processor_server (process (signal)))
+(allow system_server hal_light_server (process (signal)))
+(allow system_server hal_neuralnetworks_server (process (signal)))
+(allow system_server hal_omx_server (process (signal)))
+(allow system_server hal_power_server (process (signal)))
+(allow system_server hal_power_stats_server (process (signal)))
+(allow system_server hal_sensors_server (process (signal)))
+(allow system_server hal_vibrator_server (process (signal)))
+(allow system_server hal_vr_server (process (signal)))
+(allow system_server system_suspend_server (process (signal)))
+(allow system_server artd (process (signal)))
+(allow system_server audioserver (process (signal)))
+(allow system_server cameraserver (process (signal)))
+(allow system_server drmserver (process (signal)))
+(allow system_server gpuservice (process (signal)))
+(allow system_server inputflinger (process (signal)))
+(allow system_server keystore (process (signal)))
+(allow system_server mediadrmserver (process (signal)))
+(allow system_server mediaextractor (process (signal)))
+(allow system_server mediametrics (process (signal)))
+(allow system_server mediaserver (process (signal)))
+(allow system_server mediaswcodec (process (signal)))
+(allow system_server mediatranscoding (process (signal)))
+(allow system_server netd (process (signal)))
+(allow system_server sdcardd (process (signal)))
+(allow system_server servicemanager (process (signal)))
+(allow system_server statsd (process (signal)))
+(allow system_server surfaceflinger (process (signal)))
+(allow system_server vold (process (signal)))
+(allow system_server mediatuner (process (signal)))
+(allow system_server mmd (process (signal)))
+(allow system_server audioserver (tcp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server audioserver (udp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server mediaserver (tcp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server mediaserver (udp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server mediadrmserver (tcp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server mediadrmserver (udp_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow system_server traced (fd (use)))
+(allow system_server traced_tmpfs (file (read write getattr map)))
+(allow system_server traced_producer_socket (sock_file (write)))
+(allow system_server traced (unix_stream_socket (connectto)))
+(allow traced system_server (fd (use)))
+(allow system_server file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server mac_perms_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server selinuxfs (file (write lock append map open)))
+(allow system_server kernel (security (compute_av)))
+(allow system_server self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow system_server sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_android_usb (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_android_usb (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_android_usb (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_android_usb (file (write lock append map open)))
+(allow system_server sysfs_extcon (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_extcon (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_extcon (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_ipv4 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_ipv4 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_ipv4 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_ipv4 (file (write lock append map open)))
+(allow system_server sysfs_rtc (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_rtc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_rtc (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_switch (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_switch (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_switch (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_nfc_power_writable (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server sysfs_power (dir (search)))
+(allow system_server sysfs_power (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server sysfs_thermal (dir (search)))
+(allow system_server sysfs_thermal (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_uhid (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_uhid (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server sysfs_vibrator (file (write append)))
+(allow system_server sysfs_usb (file (write lock append map open)))
+(allow system_server device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server mdns_socket (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server input_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server usbaccessory_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server video_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server video_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server adbd_socket (sock_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server rtc_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server audio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server hidraw_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server hidraw_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server audio_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx system_server tun_device (ioctl chr_file (0x54ca 0x54cd 0x54d2 0x54e2)))
+(allow system_server ota_package_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server ota_package_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server system_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server packages_list_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server game_mode_intervention_list_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server keychain_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server keychain_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server keychain_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_userdir_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server apk_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apk_data_file (file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow system_server apk_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow system_server apk_tmp_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apk_tmp_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apk_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apk_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server vendor_keylayout_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_keylayout_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_keylayout_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_keychars_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_keychars_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_keychars_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_idc_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_idc_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_idc_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server input_device_config_prop (file (read getattr map open)))
+(allow system_server vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_framework_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_framework_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_framework_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server apk_private_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apk_private_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apk_private_tmp_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apk_private_tmp_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server asec_apk_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server asec_apk_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server asec_public_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server anr_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server anr_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server tombstoned_java_trace_socket (sock_file (write)))
+(allow system_server tombstoned (unix_stream_socket (connectto)))
+(allow system_server tombstoned (fd (use)))
+(allow system_server dumpstate (fifo_file (append)))
+(allow system_server incidentd (fifo_file (append)))
+(allow system_server incidentd (fifo_file (read)))
+(allow system_server incident_data_file (file (read)))
+(allow system_server prereboot_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server prereboot_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server perfetto_traces_data_file (file (read getattr)))
+(allow system_server perfetto (fd (use)))
+(allow system_server perfetto_exec (file (read getattr map execute open)))
+(allow system_server perfetto (process (transition)))
+(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
+(allow perfetto system_server (process (sigchld)))
+(dontaudit system_server perfetto (process (noatsecure)))
+(allow system_server perfetto (process (siginh rlimitinh)))
+(typetransition system_server perfetto_exec process perfetto)
+(allow system_server perfetto (fifo_file (read write)))
+(allow system_server perfetto_traces_profiling_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server perfetto_traces_profiling_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server perfetto_traces_data_file (dir (search)))
+(allow system_server trace_redactor_exec (file (read getattr map execute open)))
+(allow system_server trace_redactor (process (transition)))
+(allow trace_redactor trace_redactor_exec (file (read getattr map execute open entrypoint)))
+(allow trace_redactor system_server (process (sigchld)))
+(dontaudit system_server trace_redactor (process (noatsecure)))
+(allow system_server trace_redactor (process (siginh rlimitinh)))
+(typetransition system_server trace_redactor_exec process trace_redactor)
+(allow system_server trace_redactor (process (signal)))
+(allow system_server perfetto (process (signal)))
+(allow system_server backup_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server backup_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server dropbox_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server dropbox_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server heapdump_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server heapdump_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server adb_keys_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server adb_keys_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server appcompat_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server appcompat_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server connectivityblob_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server connectivityblob_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server emergency_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server emergency_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server network_watchlist_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server network_watchlist_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server radio_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server radio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server systemkeys_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server systemkeys_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server textclassifier_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server textclassifier_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server tombstone_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server tombstone_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server vpn_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server vpn_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server wifi_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server wifi_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server staging_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server staging_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server staging_data_file (file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow system_server staging_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow system_server app_data_file_type (dir (read getattr search)))
+(allow system_server unlabeled (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server unlabeled (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server system_app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server system_app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server app_data_file_type (file (read write getattr append map)))
+(allow system_server media_rw_data_file (dir (read getattr open search)))
+(allow system_server media_rw_data_file (file (read write getattr append)))
+(allow system_server system_server (process (setfscreate)))
+(allow system_server apk_tmp_file (file (relabelfrom relabelto)))
+(allow system_server apk_tmp_file (dir (relabelfrom relabelto)))
+(allow system_server apk_private_tmp_file (file (relabelfrom relabelto)))
+(allow system_server apk_private_tmp_file (dir (relabelfrom relabelto)))
+(allow system_server apk_data_file (file (relabelfrom relabelto)))
+(allow system_server apk_data_file (dir (relabelfrom relabelto)))
+(allow system_server apk_private_data_file (file (relabelfrom relabelto)))
+(allow system_server apk_private_data_file (dir (relabelfrom relabelto)))
+(allow system_server staging_data_file (file (relabelfrom relabelto)))
+(allow system_server staging_data_file (dir (relabelfrom relabelto)))
+(allow system_server system_data_file (file (relabelfrom)))
+(allow system_server wallpaper_file (file (relabelto)))
+(allow system_server wallpaper_file (file (ioctl read write getattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_data_file (file (link)))
+(allow system_server wallpaper_file (file (link)))
+(allow system_server system_data_file (dir (relabelfrom)))
+(allow system_server shortcut_manager_icons (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server shortcut_manager_icons (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server ringtone_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server ringtone_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server icon_file (file (relabelto)))
+(allow system_server icon_file (file (ioctl read write getattr lock append map unlink open watch watch_reads)))
+(allow system_server system_data_file (dir (relabelfrom)))
+(allow system_server server_configurable_flags_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server server_configurable_flags_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server system_prop (property_service (set)))
+(allow system_server system_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server bootanim_system_prop (property_service (set)))
+(allow system_server bootanim_system_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server bluetooth_prop (property_service (set)))
+(allow system_server bluetooth_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server exported_system_prop (property_service (set)))
+(allow system_server exported_system_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server exported3_system_prop (property_service (set)))
+(allow system_server exported3_system_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server safemode_prop (property_service (set)))
+(allow system_server safemode_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server theme_prop (property_service (set)))
+(allow system_server theme_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server dhcp_prop (property_service (set)))
+(allow system_server dhcp_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server net_connectivity_prop (property_service (set)))
+(allow system_server net_connectivity_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server net_radio_prop (property_service (set)))
+(allow system_server net_radio_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server net_dns_prop (property_service (set)))
+(allow system_server net_dns_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server usb_control_prop (property_service (set)))
+(allow system_server usb_control_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server usb_prop (property_service (set)))
+(allow system_server usb_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server debug_prop (property_service (set)))
+(allow system_server debug_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server powerctl_prop (property_service (set)))
+(allow system_server powerctl_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server fingerprint_prop (property_service (set)))
+(allow system_server fingerprint_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_logging_prop (property_service (set)))
+(allow system_server device_logging_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server dumpstate_options_prop (property_service (set)))
+(allow system_server dumpstate_options_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server overlay_prop (property_service (set)))
+(allow system_server overlay_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server exported_overlay_prop (property_service (set)))
+(allow system_server exported_overlay_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server pm_prop (property_service (set)))
+(allow system_server pm_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server exported_pm_prop (property_service (set)))
+(allow system_server exported_pm_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server socket_hook_prop (property_service (set)))
+(allow system_server socket_hook_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server audio_prop (property_service (set)))
+(allow system_server audio_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server boot_status_prop (property_service (set)))
+(allow system_server boot_status_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server surfaceflinger_color_prop (property_service (set)))
+(allow system_server surfaceflinger_color_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server provisioned_prop (property_service (set)))
+(allow system_server provisioned_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server retaildemo_prop (property_service (set)))
+(allow system_server retaildemo_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server dmesgd_start_prop (property_service (set)))
+(allow system_server dmesgd_start_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server locale_prop (property_service (set)))
+(allow system_server locale_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server timezone_metadata_prop (property_service (set)))
+(allow system_server timezone_metadata_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server timezone_prop (property_service (set)))
+(allow system_server timezone_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server crashrecovery_prop (property_service (set)))
+(allow system_server crashrecovery_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server ctl_default_prop (property_service (set)))
+(allow system_server ctl_default_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server ctl_bugreport_prop (property_service (set)))
+(allow system_server ctl_bugreport_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server ctl_gsid_prop (property_service (set)))
+(allow system_server ctl_gsid_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server ctl_artd_pre_reboot_prop (property_service (set)))
+(allow system_server ctl_artd_pre_reboot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server cppreopt_prop (property_service (set)))
+(allow system_server cppreopt_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_core_experiments_team_internal_prop (property_service (set)))
+(allow system_server device_config_core_experiments_team_internal_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_edgetpu_native_prop (property_service (set)))
+(allow system_server device_config_edgetpu_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_input_native_boot_prop (property_service (set)))
+(allow system_server device_config_input_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_netd_native_prop (property_service (set)))
+(allow system_server device_config_netd_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_nnapi_native_prop (property_service (set)))
+(allow system_server device_config_nnapi_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_activity_manager_native_boot_prop (property_service (set)))
+(allow system_server device_config_activity_manager_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_runtime_native_boot_prop (property_service (set)))
+(allow system_server device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_runtime_native_prop (property_service (set)))
+(allow system_server device_config_runtime_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_lmkd_native_prop (property_service (set)))
+(allow system_server device_config_lmkd_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_media_native_prop (property_service (set)))
+(allow system_server device_config_media_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_camera_native_prop (property_service (set)))
+(allow system_server device_config_camera_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_mglru_native_prop (property_service (set)))
+(allow system_server device_config_mglru_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_profcollect_native_boot_prop (property_service (set)))
+(allow system_server device_config_profcollect_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_statsd_native_prop (property_service (set)))
+(allow system_server device_config_statsd_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_statsd_native_boot_prop (property_service (set)))
+(allow system_server device_config_statsd_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_storage_native_boot_prop (property_service (set)))
+(allow system_server device_config_storage_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_swcodec_native_prop (property_service (set)))
+(allow system_server device_config_swcodec_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_sys_traced_prop (property_service (set)))
+(allow system_server device_config_sys_traced_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_window_manager_native_boot_prop (property_service (set)))
+(allow system_server device_config_window_manager_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_configuration_prop (property_service (set)))
+(allow system_server device_config_configuration_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_connectivity_prop (property_service (set)))
+(allow system_server device_config_connectivity_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_surface_flinger_native_boot_prop (property_service (set)))
+(allow system_server device_config_surface_flinger_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_aconfig_flags_prop (property_service (set)))
+(allow system_server device_config_aconfig_flags_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_vendor_system_native_prop (property_service (set)))
+(allow system_server device_config_vendor_system_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_vendor_system_native_boot_prop (property_service (set)))
+(allow system_server device_config_vendor_system_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_virtualization_framework_native_prop (property_service (set)))
+(allow system_server device_config_virtualization_framework_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_memory_safety_native_boot_prop (property_service (set)))
+(allow system_server device_config_memory_safety_native_boot_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_memory_safety_native_prop (property_service (set)))
+(allow system_server device_config_memory_safety_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_remote_key_provisioning_native_prop (property_service (set)))
+(allow system_server device_config_remote_key_provisioning_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_tethering_u_or_later_native_prop (property_service (set)))
+(allow system_server device_config_tethering_u_or_later_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server device_config_mmd_native_prop (property_service (set)))
+(allow system_server device_config_mmd_native_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server smart_idle_maint_enabled_prop (property_service (set)))
+(allow system_server smart_idle_maint_enabled_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server arm64_memtag_prop (property_service (set)))
+(allow system_server arm64_memtag_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server next_boot_prop (property_service (set)))
+(allow system_server next_boot_prop (file (read getattr map open)))
+(allow system_server pm_16kb_app_compat_prop (file (read getattr map open)))
+(allow system_server device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow system_server device_config_runtime_native_prop (file (read getattr map open)))
+(allow system_server bootloader_boot_reason_prop (file (read getattr map open)))
+(allow system_server system_boot_reason_prop (file (read getattr map open)))
+(allow system_server boottime_prop (file (read getattr map open)))
+(allow system_server serialno_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server firstboot_prop (property_service (set)))
+(allow system_server firstboot_prop (file (read getattr map open)))
+(allow system_server audio_config_prop (file (read getattr map open)))
+(allow system_server media_config_prop (file (read getattr map open)))
+(allow system_server device_config_reset_performed_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server test_harness_prop (property_service (set)))
+(allow system_server test_harness_prop (file (read getattr map open)))
+(allow system_server gsid_prop (file (read getattr map open)))
+(allow system_server mock_ota_prop (file (read getattr map open)))
+(allow system_server apk_verity_prop (file (read getattr map open)))
+(allow system_server wifi_prop (file (read getattr map open)))
+(allow system_server incremental_prop (file (read getattr map open)))
+(allow system_server zram_config_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server zram_control_prop (property_service (set)))
+(allow system_server zram_control_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server dalvik_runtime_prop (property_service (set)))
+(allow system_server dalvik_runtime_prop (file (read getattr map open)))
+(allow system_server packagemanager_config_prop (file (read getattr map open)))
+(allow system_server net_464xlat_fromvendor_prop (file (read getattr map open)))
+(allow system_server hypervisor_prop (file (read getattr map open)))
+(allow system_server persist_wm_debug_prop (file (read getattr map open)))
+(allow system_server persist_sysui_builder_extras_prop (file (read getattr map open)))
+(allow system_server persist_sysui_ranking_update_prop (file (read getattr map open)))
+(allow system_server tuner_config_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server tuner_server_ctl_prop (property_service (set)))
+(allow system_server tuner_server_ctl_prop (file (read getattr map open)))
+(allow system_server traced_oome_heap_session_count_prop (file (read getattr map open)))
+(allow system_server sensors_config_prop (file (read getattr map open)))
+(allow system_server system_service_enable_prop (file (read getattr map open)))
+(allow system_server system_ndebug_socket (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_unsolzygote_socket (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server cache_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server cache_recovery_file (dir (ioctl read write create getattr setattr lock relabelfrom rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server cache_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow system_server cache_recovery_file (file (ioctl read write create getattr setattr lock relabelfrom append map unlink rename open watch watch_reads)))
+(allow system_server cache_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server cache_recovery_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server system_file (file (lock)))
+(allow system_server gps_control (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server appdomain (tcp_socket (read write getattr getopt setopt shutdown)))
+(allow system_server appdomain (udp_socket (read write getattr getopt setopt shutdown)))
+(allow system_server appdomain (fifo_file (read write getattr)))
+(allow system_server appdomain (unix_stream_socket (read write getattr)))
+(allow system_server cache_backup_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server cache_backup_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server cache_private_backup_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server cache_private_backup_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server usb_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server usb_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server fscklogs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server fscklogs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server fscklogs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server fscklogs (dir (write add_name remove_name)))
+(allow system_server fscklogs (file (rename)))
+(allow system_server zygote (unix_dgram_socket (write)))
+(allow system_server logcat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow system_server logdr_socket (sock_file (write)))
+(allow system_server logd (unix_stream_socket (connectto)))
+(allow system_server runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_lowmemorykiller (file (write getattr lock append map open)))
+(allow system_server pstorefs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server pstorefs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_zram (dir (search)))
+(allow system_server sysfs_zram (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server kernel (security (read_policy)))
+(allow system_server system_server_service (service_manager (add find)))
+;;* lmx 990 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_424 system_server_service (service_manager (add)))
+;;* lme
+
+(allow system_server artd_service (service_manager (find)))
+(allow system_server artd_pre_reboot_service (service_manager (find)))
+(allow system_server audioserver_service (service_manager (find)))
+(allow system_server authorization_service (service_manager (find)))
+(allow system_server batteryproperties_service (service_manager (find)))
+(allow system_server cameraserver_service (service_manager (find)))
+(allow system_server compos_service (service_manager (find)))
+(allow system_server dataloader_manager_service (service_manager (find)))
+(allow system_server dexopt_chroot_setup_service (service_manager (find)))
+(allow system_server dnsresolver_service (service_manager (find)))
+(allow system_server drmserver_service (service_manager (find)))
+(allow system_server dumpstate_service (service_manager (find)))
+(allow system_server fingerprintd_service (service_manager (find)))
+(allow system_server gatekeeper_service (service_manager (find)))
+(allow system_server gpu_service (service_manager (find)))
+(allow system_server gsi_service (service_manager (find)))
+(allow system_server idmap_service (service_manager (find)))
+(allow system_server incident_service (service_manager (find)))
+(allow system_server incremental_service (service_manager (find)))
+(allow system_server installd_service (service_manager (find)))
+(allow system_server keystore_maintenance_service (service_manager (find)))
+(allow system_server keystore_metrics_service (service_manager (find)))
+(allow system_server keystore_service (service_manager (find)))
+(allow system_server mdns_service (service_manager (find)))
+(allow system_server mediaserver_service (service_manager (find)))
+(allow system_server mediametrics_service (service_manager (find)))
+(allow system_server mediaextractor_service (service_manager (find)))
+(allow system_server mediadrmserver_service (service_manager (find)))
+(allow system_server mediatuner_service (service_manager (find)))
+(allow system_server mmd_service (service_manager (find)))
+(allow system_server netd_service (service_manager (find)))
+(allow system_server nfc_service (service_manager (find)))
+(allow system_server ot_daemon_service (service_manager (find)))
+(allow system_server radio_service (service_manager (find)))
+(allow system_server stats_service (service_manager (find)))
+(allow system_server storaged_service (service_manager (find)))
+(allow system_server surfaceflinger_service (service_manager (find)))
+(allow system_server update_engine_service (service_manager (find)))
+(allow system_server virtual_camera_service (service_manager (find)))
+(allow system_server virtualization_maintenance_service (service_manager (find)))
+(allow system_server vold_service (service_manager (find)))
+(allow system_server wifinl80211_service (service_manager (find)))
+(allow system_server logd_service (service_manager (find)))
+(allow system_server wifi_mainline_supplicant_service (service_manager (find)))
+(allow system_server batteryproperties_service (service_manager (add find)))
+;;* lmx 1041 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_424 batteryproperties_service (service_manager (add)))
+;;* lme
+
+(allow system_server keystore (keystore2 (add_auth change_password change_user clear_ns clear_uid delete_all_keys get_last_auth_time lock pull_metrics reset unlock)))
+(allow system_server keystore (keystore2_key (delete get_info grant rebind update use use_dev_id)))
+(allow system_server wifi_key (keystore2_key (delete get_info rebind update use)))
+(allow system_server resume_on_reboot_key (keystore2_key (delete get_info rebind update use)))
+(allow system_server locksettings_key (keystore2_key (delete get_info rebind update use)))
+(allow system_server block_device (dir (search)))
+(allow system_server frp_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx system_server frp_block_device (ioctl blk_file (0x1277 0x127d)))
+(allow system_server cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server cgroup (file (setattr)))
+(allow system_server cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server cgroup_v2 (file (ioctl read getattr setattr lock map open watch watch_reads)))
+(allow system_server oemfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server oemfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server oemfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server mnt_user_file (dir (getattr search)))
+(allow system_server storage_file (dir (getattr search)))
+(allow system_server mnt_user_file (lnk_file (read getattr)))
+(allow system_server storage_file (lnk_file (read getattr)))
+(allow system_server sdcard_type (dir (getattr search)))
+(allow system_server fuse (dir (getattr search)))
+(allow system_server mnt_expand_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server fingerprintd_data_file (dir (ioctl read write getattr lock relabelto open watch watch_reads remove_name search rmdir)))
+(allow system_server fingerprintd_data_file (file (getattr unlink)))
+(allow system_server vold (fd (use)))
+(allow system_server fuse_device (chr_file (ioctl read write getattr)))
+(allow system_server app_fuse_file (file (read write getattr)))
+(allow system_server configfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server configfs (file (write create getattr unlink open)))
+(allow system_server adbd_common (unix_stream_socket (connectto)))
+(allow system_server adbd_common (fd (use)))
+(allow system_server adbd_common (unix_stream_socket (ioctl read write getattr getopt shutdown)))
+(allow system_server adbd_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server system_adbd_prop (property_service (set)))
+(allow system_server system_adbd_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server adbd_tradeinmode_prop (property_service (set)))
+(allow system_server adbd_tradeinmode_prop (file (read getattr map open)))
+(allow system_server toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allowx system_server system_data_file (ioctl file (0x6685)))
+(allowx system_server apk_data_file (ioctl file (0x6685)))
+(allowx system_server apk_tmp_file (ioctl file (0x6685)))
+(allowx system_server apex_system_server_data_file (ioctl file (0x6685)))
+(allowx system_server apk_data_file (ioctl file (0x6686)))
+(allowx system_server apk_tmp_file (ioctl file (0x6686)))
+(allowx system_server apk_tmp_file (ioctl file (0x6602)))
+(allow system_server postinstall (binder (call transfer)))
+(allow postinstall system_server (binder (transfer)))
+(allow system_server postinstall (fd (use)))
+(allow system_server postinstall (fifo_file (write)))
+(allow system_server update_engine (fd (use)))
+(allow system_server update_engine (fifo_file (write)))
+(allow system_server preloads_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow system_server preloads_data_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search rmdir)))
+(allow system_server preloads_media_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow system_server preloads_media_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search rmdir)))
+(allow system_server cgroup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server cgroup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server cgroup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server cgroup_v2 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server cgroup_v2 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server dmabuf_system_secure_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_asound (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server proc_asound (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_asound (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_qtaguid_stat (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server proc_qtaguid_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_qtaguid_stat (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_loadavg (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_locks (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_pagetypeinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_cputime_showstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_io_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_time_in_state (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_concurrent_active_time (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_concurrent_policy_time (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_version (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_vmallocinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_uid_time_in_state (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server proc_uid_cpupower (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server debugfs_tracing_instances (dir (search)))
+(allow system_server debugfs_wifi_tracing (dir (search)))
+(allow system_server debugfs_wifi_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server debugfs_bootreceiver_tracing (dir (search)))
+(allow system_server debugfs_bootreceiver_tracing (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server debugfs_tracing (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server fs_bpf (dir (search)))
+(allow system_server fs_bpf_net_shared (dir (search)))
+(allow system_server fs_bpf_netd_readonly (dir (search)))
+(allow system_server fs_bpf_netd_shared (dir (search)))
+(allow system_server fs_bpf (file (read write getattr)))
+(allow system_server fs_bpf_net_shared (file (read write getattr)))
+(allow system_server fs_bpf_netd_readonly (file (read write getattr)))
+(allow system_server fs_bpf_netd_shared (file (read write getattr)))
+(allow system_server bpfloader (bpf (prog_run)))
+(allow system_server self (bpf (map_create)))
+(allow system_server bpfloader (bpf (map_read map_write)))
+(allow system_server netd (bpf (map_read map_write)))
+(allow system_server network_stack (bpf (map_read map_write)))
+(allow system_server system_server (bpf (map_read map_write)))
+(allow system_server self (key_socket (create)))
+(dontaudit system_server self (key_socket (getopt)))
+(allow system_server fs_bpf_memevents (dir (search)))
+(allow system_server fs_bpf_memevents (file (read write)))
+(allow system_server clatd_exec (file (read getattr map execute open)))
+(allow system_server clatd (process (transition)))
+(allow clatd clatd_exec (file (read getattr map execute open entrypoint)))
+(allow clatd system_server (process (sigchld)))
+(dontaudit system_server clatd (process (noatsecure)))
+(allow system_server clatd (process (siginh rlimitinh)))
+(typetransition system_server clatd_exec process clatd)
+(allow system_server clatd (process (sigkill signal)))
+(allow system_server user_profile_root_file (dir (getattr search)))
+(allow system_server user_profile_data_file (dir (getattr search)))
+(allow system_server user_profile_data_file (file (read getattr open)))
+(allow system_server profman_dump_data_file (file (write create getattr setattr lock append map open)))
+(allow system_server profman_dump_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server system_jvmti_agent_prop (file (read getattr map open)))
+(allow system_server functionfs (dir (search)))
+(allow system_server functionfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server sysfs_type (dir (search)))
+(allow system_server sysfs_udc (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server sysfs_udc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server sysfs_udc (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server time_prop (file (read getattr map open)))
+(allow system_server system_lmk_prop (file (read getattr map open)))
+(allow system_server wifi_config_prop (file (read getattr map open)))
+(allowx system_server binder_device (ioctl chr_file ((range 0x620e 0x620f))))
+(allow system_server framework_watchdog_config_prop (file (read getattr map open)))
+(allow system_server font_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server font_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allowx system_server font_data_file (ioctl file ((range 0x6685 0x6686))))
+(allow system_server qemu_hw_prop (file (read getattr map open)))
+(allow system_server power_debug_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server power_debug_prop (property_service (set)))
+(allow system_server power_debug_prop (file (read getattr map open)))
+;;* lmx 1341 system/sepolicy/private/system_server.te
+
+(neverallow system_server sdcard_type (dir (read write open)))
+(neverallow system_server fuse (dir (read write open)))
+;;* lme
+
+;;* lmx 1342 system/sepolicy/private/system_server.te
+
+(neverallow system_server sdcard_type (file (ioctl read write getattr lock append map open watch watch_reads)))
+(neverallow system_server fuse (file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lme
+
+;;* lmx 1352 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_965 (file (create unlink link open)))
+;;* lme
+
+;;* lmx 1363 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_966 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 1368 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_967 (process (transition)))
+;;* lme
+
+;;* lmx 1369 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_236 (process (dyntransition)))
+;;* lme
+
+;;* lmx 1372 system/sepolicy/private/system_server.te
+
+(neverallow system_server perfetto_traces_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 1375 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_968 system_ndebug_socket (sock_file (write open)))
+;;* lme
+
+;;* lmx 1385 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_969 system_unsolzygote_socket (sock_file (write open)))
+;;* lme
+
+;;* lmx 1416 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_970 device_config_activity_manager_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_input_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_netd_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_aconfig_flags_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_edgetpu_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_media_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_nnapi_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_runtime_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_runtime_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_surface_flinger_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_core_experiments_team_internal_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_lmkd_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_mglru_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_mmd_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_remote_key_provisioning_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_storage_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_sys_traced_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_window_manager_native_boot_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_connectivity_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_swcodec_native_prop (property_service (set)))
+(neverallow base_typeattr_970 device_config_tethering_u_or_later_native_prop (property_service (set)))
+(neverallow base_typeattr_970 next_boot_prop (property_service (set)))
+;;* lme
+
+;;* lmx 1423 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 tuner_server_ctl_prop (property_service (set)))
+;;* lme
+
+;;* lmx 1429 system/sepolicy/private/system_server.te
+
+(neverallow system_server dex2oat_exec (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1434 system/sepolicy/private/system_server.te
+
+(neverallow system_server data_file_type (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 1441 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_971 (blk_file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1442 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_972 (blk_file (ioctl read getattr lock map open watch watch_reads)))
+;;* lme
+
+;;* lmx 1450 system/sepolicy/private/system_server.te
+
+(neverallow system_server self (process (execmem)))
+;;* lme
+
+;;* lmx 1453 system/sepolicy/private/system_server.te
+
+(neverallow system_server ashmem_device (chr_file (execute)))
+(neverallow system_server ashmem_libcutils_device (chr_file (execute)))
+;;* lme
+
+;;* lmx 1456 system/sepolicy/private/system_server.te
+
+(neverallow system_server system_server_tmpfs (file (execute)))
+;;* lme
+
+(allow system_server system_server_startup (fd (use)))
+(allow system_server system_server_startup_tmpfs (file (read write map)))
+(allow system_server system_server_startup (unix_dgram_socket (write)))
+(allow system_server apex_service (service_manager (find)))
+(allow system_server apexd (binder (call)))
+(allow system_server apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server tradeinmode (binder (call transfer)))
+(allow tradeinmode system_server (binder (transfer)))
+(allow system_server tradeinmode (fd (use)))
+(allow system_server system_suspend_control_internal_service (service_manager (find)))
+(allow system_server system_suspend_control_service (service_manager (find)))
+(allow system_server system_suspend (binder (call transfer)))
+(allow system_suspend system_server (binder (transfer)))
+(allow system_server system_suspend (fd (use)))
+(allow system_suspend system_server (binder (call transfer)))
+(allow system_server system_suspend (binder (transfer)))
+(allow system_suspend system_server (fd (use)))
+(allow system_server sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server self (capability2 (block_suspend)))
+(allow system_server self (cap2_userns (block_suspend)))
+(allow system_server system_suspend_server (binder (call transfer)))
+(allow system_suspend_server system_server (binder (transfer)))
+(allow system_server system_suspend_server (fd (use)))
+(allow system_server system_suspend_hwservice (hwservice_manager (find)))
+(allow system_server hwservicemanager (binder (call transfer)))
+(allow hwservicemanager system_server (binder (call transfer)))
+(allow hwservicemanager system_server (dir (search)))
+(allow hwservicemanager system_server (file (read map open)))
+(allow hwservicemanager system_server (process (getattr)))
+(allow system_server hwservicemanager_prop (file (read getattr map open)))
+(allow system_server hidl_manager_hwservice (hwservice_manager (find)))
+(allow system_server hal_system_suspend_service (service_manager (find)))
+(allow system_server servicemanager (binder (call transfer)))
+(allow servicemanager system_server (binder (call transfer)))
+(allow servicemanager system_server (dir (search)))
+(allow servicemanager system_server (file (read open)))
+(allow servicemanager system_server (process (getattr)))
+(allow system_server apex_data_file (dir (getattr search)))
+(allow system_server apex_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server vendor_apex_file (dir (getattr search)))
+(allow system_server vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server apex_module_data_file (dir (getattr search)))
+(allow system_server apex_system_server_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_system_server_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_tethering_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_tethering_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_uwb_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_uwb_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_appsearch_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_permission_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_scheduling_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_wifi_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server apex_appsearch_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_permission_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_scheduling_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server apex_wifi_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server metadata_file (dir (search)))
+(allow system_server password_slot_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server password_slot_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server tradeinmode_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server tradeinmode_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server userspace_reboot_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server userspace_reboot_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server staged_install_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server staged_install_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server watchdog_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server watchdog_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server aconfigd_socket (sock_file (write)))
+(allow system_server aconfigd (unix_stream_socket (connectto)))
+(allow system_server aconfigd_mainline_socket (sock_file (write)))
+(allow system_server aconfigd_mainline (unix_stream_socket (connectto)))
+(allow system_server repair_mode_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server repair_mode_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server gsi_persistent_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server gsi_persistent_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow system_server odrefresh_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow system_server odrefresh_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow system_server surfaceflinger_exec (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server userspace_reboot_log_prop (property_service (set)))
+(allow system_server userspace_reboot_log_prop (file (read getattr map open)))
+;;* lmx 1572 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_371 system_jvmti_agent_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow system_server proc_pressure_mem (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_server proc_pressure_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server proc_pressure_io (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 1580 system/sepolicy/private/system_server.te
+
+(neverallow system_server base_typeattr_424 (process (ptrace)))
+;;* lme
+
+;;* lmx 1584 system/sepolicy/private/system_server.te
+
+(neverallow system_server system_server (capability (sys_resource)))
+(neverallow system_server system_server (cap_userns (sys_resource)))
+;;* lme
+
+;;* lmx 1587 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 password_slot_metadata_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 1592 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 password_slot_metadata_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_427 password_slot_metadata_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_427 password_slot_metadata_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_427 password_slot_metadata_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1593 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 password_slot_metadata_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_427 password_slot_metadata_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_427 password_slot_metadata_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_427 password_slot_metadata_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server binder_cache_system_server_prop (property_service (set)))
+(allow system_server binder_cache_system_server_prop (file (read getattr map open)))
+;;* lmx 1598 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 binder_cache_system_server_prop (property_service (set)))
+;;* lme
+
+(allow system_server self (perf_event (open cpu kernel write)))
+;;* lmx 1603 system/sepolicy/private/system_server.te
+
+(neverallow system_server self (perf_event (tracepoint read)))
+;;* lme
+
+(allow system_server shutdown_checkpoints_system_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow system_server shutdown_checkpoints_system_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lmx 1610 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 socket_hook_prop (property_service (set)))
+;;* lme
+
+;;* lmx 1612 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 boot_status_prop (property_service (set)))
+;;* lme
+
+;;* lmx 1620 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_371 wifi_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1629 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_973 sysfs_uhid (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1635 system/sepolicy/private/system_server.te
+
+(neverallowx base_typeattr_424 binder_device (ioctl chr_file ((range 0x620e 0x620f))))
+;;* lme
+
+;;* lmx 1638 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 font_data_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+;;* lmx 1639 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 font_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+(allow system_server system_font_fallback_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server dalvik_dynamic_config_prop (property_service (set)))
+(allow system_server dalvik_dynamic_config_prop (file (read getattr map open)))
+(allow system_server binderfs_logs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server binderfs_logs_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server game_manager_config_prop (property_service (set)))
+(allow system_server game_manager_config_prop (file (read getattr map open)))
+(allow system_server property_socket (sock_file (write)))
+(allow system_server init (unix_stream_socket (connectto)))
+(allow system_server hint_manager_config_prop (property_service (set)))
+(allow system_server hint_manager_config_prop (file (read getattr map open)))
+;;* lmx 1667 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_385 hint_manager_config_prop (property_service (set)))
+;;* lme
+
+(allow system_server threadnetwork_config_prop (file (read getattr map open)))
+;;* lmx 1679 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_371 threadnetwork_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow system_server pre_reboot_dexopt_file (dir (getattr search)))
+(allow system_server system_server_tmpfs (file (open)))
+(allow system_server postinstall (fifo_file (read)))
+(allow system_server artd (process (sigkill)))
+(allow system_server profman (process (sigkill)))
+(allow system_server derive_classpath (process (sigkill)))
+(allow system_server dex2oat (process (sigkill)))
+(allow system_server odrefresh (process (sigkill)))
+;;* lmx 1705 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 crashrecovery_prop (property_service (set)))
+;;* lme
+
+;;* lmx 1706 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_477 crashrecovery_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1709 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_427 tradeinmode_metadata_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 1717 system/sepolicy/private/system_server.te
+
+(neverallow base_typeattr_974 power_debug_prop (property_service (set)))
+;;* lme
+
+(typetransition system_server_startup tmpfs file system_server_startup_tmpfs)
+(allow system_server_startup system_server_startup_tmpfs (file (read write getattr map)))
+(allow system_server_startup self (process (execmem)))
+(allow system_server_startup system_server_startup_tmpfs (file (read write map execute open)))
+(allow system_server_startup apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_server_startup apex_art_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow system_server_startup self (process (setcurrent)))
+(allow system_server_startup system_server (process (dyntransition)))
+(allow system_server_startup zygote (process (sigchld)))
+(allow system_server_startup device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow system_server_startup device_config_runtime_native_prop (file (read getattr map open)))
+(allow init system_suspend_exec (file (read getattr map execute open)))
+(allow init system_suspend (process (transition)))
+(allow system_suspend system_suspend_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init system_suspend (process (noatsecure)))
+(allow init system_suspend (process (siginh rlimitinh)))
+(typetransition init system_suspend_exec process system_suspend)
+(allow system_suspend servicemanager (binder (call transfer)))
+(allow servicemanager system_suspend (binder (call transfer)))
+(allow servicemanager system_suspend (dir (search)))
+(allow servicemanager system_suspend (file (read open)))
+(allow servicemanager system_suspend (process (getattr)))
+(allow system_suspend system_suspend_control_service (service_manager (add find)))
+;;* lmx 8 system/sepolicy/private/system_suspend.te
+
+(neverallow base_typeattr_975 system_suspend_control_service (service_manager (add)))
+;;* lme
+
+(allow system_suspend hal_system_suspend_service (service_manager (add find)))
+;;* lmx 10 system/sepolicy/private/system_suspend.te
+
+(neverallow base_typeattr_975 hal_system_suspend_service (service_manager (add)))
+;;* lme
+
+(allow system_suspend sysfs_power (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_suspend sysfs_suspend_stats (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_suspend sysfs_suspend_stats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_suspend_stats (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_wakeup (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_suspend sysfs_wakeup (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_wakeup (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_wakeup_reasons (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow system_suspend sysfs_wakeup_reasons (file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_wakeup_reasons (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow system_suspend sysfs_type (dir (search)))
+(allow system_suspend suspend_prop (file (read getattr map open)))
+(allow system_suspend bluetooth (binder (call)))
+(allow system_suspend dumpstate (fd (use)))
+(allow system_suspend dumpstate (fifo_file (write)))
+(allow init sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init self (capability2 (block_suspend)))
+(allow init self (cap2_userns (block_suspend)))
+(allow system_suspend sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow system_suspend self (capability2 (block_suspend)))
+(allow system_suspend self (cap2_userns (block_suspend)))
+(allow init sysfs_sync_on_suspend (file (write lock append map open)))
+;;* lmx 56 system/sepolicy/private/system_suspend.te
+
+(neverallow base_typeattr_976 system_suspend_control_service (service_manager (find)))
+;;* lme
+
+(allow system_suspend_internal_server system_suspend_control_internal_service (service_manager (add find)))
+;;* lmx 2 system/sepolicy/private/system_suspend_internal_server.te
+
+(neverallow base_typeattr_977 system_suspend_control_internal_service (service_manager (add)))
+;;* lme
+
+;;* lmx 12 system/sepolicy/private/system_suspend_internal_server.te
+
+(neverallow base_typeattr_978 system_suspend_control_internal_service (service_manager (find)))
+;;* lme
+
+(allow system_suspend_server hwservicemanager (binder (call transfer)))
+(allow hwservicemanager system_suspend_server (binder (call transfer)))
+(allow hwservicemanager system_suspend_server (dir (search)))
+(allow hwservicemanager system_suspend_server (file (read map open)))
+(allow hwservicemanager system_suspend_server (process (getattr)))
+(allow system_suspend_server hwservicemanager_prop (file (read getattr map open)))
+(allow system_suspend_server system_suspend_hwservice (hwservice_manager (add find)))
+(allow system_suspend_server hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 6 system/sepolicy/private/system_suspend_server.te
+
+(neverallow base_typeattr_979 system_suspend_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow tee fingerprint_vendor_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow tee fingerprint_vendor_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init tombstoned_exec (file (read getattr map execute open)))
+(allow init tombstoned (process (transition)))
+(allow tombstoned tombstoned_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init tombstoned (process (noatsecure)))
+(allow init tombstoned (process (siginh rlimitinh)))
+(typetransition init tombstoned_exec process tombstoned)
+(allow tombstoned tombstone_config_prop (file (read getattr map open)))
+(allow tombstoned domain (fd (use)))
+(allow tombstoned domain (fifo_file (write)))
+(allow tombstoned domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow tombstoned domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow tombstoned tombstone_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow tombstoned tombstone_data_file (file (ioctl read write create getattr setattr lock append map unlink link rename open watch watch_reads)))
+(allow tombstoned anr_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow tombstoned anr_data_file (file (create getattr append unlink link open)))
+;;* lmx 31 system/sepolicy/private/tombstoned.te
+
+(neverallow base_typeattr_980 tombstone_config_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow init toolbox_exec (file (read getattr map execute open)))
+(allow init toolbox (process (transition)))
+(allow toolbox toolbox_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init toolbox (process (noatsecure)))
+(allow init toolbox (process (siginh rlimitinh)))
+(typetransition init toolbox_exec process toolbox)
+(allow toolbox virtualizationservice_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search rmdir)))
+(allow toolbox virtualizationservice_data_file (file (getattr unlink)))
+(dontaudit toolbox virtualizationservice_data_file (dir (setattr)))
+(allow toolbox tmpfs (chr_file (ioctl read write)))
+(allow toolbox devpts (chr_file (ioctl read write getattr)))
+(allow toolbox block_device (dir (search)))
+(allow toolbox swap_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow toolbox system_data_root_file (dir (write remove_name)))
+(allow toolbox system_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search rmdir)))
+(allow toolbox system_data_file (file (getattr unlink)))
+(allow toolbox media_userdir_file (dir (ioctl read getattr setattr lock open watch watch_reads search)))
+(allowx toolbox media_userdir_file (ioctl dir ((range 0x6601 0x6602))))
+;;* lmx 42 system/sepolicy/private/toolbox.te
+
+(neverallow base_typeattr_235 toolbox (process (transition)))
+;;* lme
+
+;;* lmx 43 system/sepolicy/private/toolbox.te
+
+(neverallow base_typeattr_236 toolbox (process (dyntransition)))
+;;* lme
+
+;;* lmx 44 system/sepolicy/private/toolbox.te
+
+(neverallow toolbox base_typeattr_981 (file (entrypoint)))
+;;* lme
+
+(allow trace_redactor system_server (fd (use)))
+(allow trace_redactor system_server (fifo_file (ioctl read write getattr)))
+(allow trace_redactor perfetto_traces_profiling_data_file (dir (search)))
+(allow trace_redactor perfetto_traces_data_file (dir (search)))
+(allow trace_redactor perfetto_traces_data_file (file (ioctl read getattr)))
+(allow trace_redactor perfetto_traces_profiling_data_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow init traced_exec (file (read getattr map execute open)))
+(allow init traced (process (transition)))
+(allow traced traced_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init traced (process (noatsecure)))
+(allow init traced (process (siginh rlimitinh)))
+(typetransition init traced_exec process traced)
+(typetransition traced tmpfs file traced_tmpfs)
+(allow traced traced_tmpfs (file (read write getattr map)))
+(allow traced self (capability (sys_nice)))
+(allow traced self (cap_userns (sys_nice)))
+(allow traced perfetto (fd (use)))
+(allow traced shell (fd (use)))
+(allow traced shell (fifo_file (read write)))
+(allow traced perfetto_traces_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow traced perfetto_traces_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow traced traceur_app (fd (use)))
+(allow traced platform_app (fd (use)))
+(allow traced trace_data_file (file (read write)))
+(allow traced tracingproxy_service (service_manager (find)))
+(allow traced servicemanager (binder (call transfer)))
+(allow servicemanager traced (binder (call transfer)))
+(allow servicemanager traced (dir (search)))
+(allow servicemanager traced (file (read open)))
+(allow servicemanager traced (process (getattr)))
+(allow traced system_server (binder (call transfer)))
+(allow system_server traced (binder (transfer)))
+(allow traced system_server (fd (use)))
+(allow traced appdomain_tmpfs (file (read write getattr map)))
+(allow traced surfaceflinger_tmpfs (file (read write getattr map)))
+(allow traced heapprofd_tmpfs (file (read write getattr map)))
+(allow traced traced_probes_tmpfs (file (read write getattr map)))
+(allow traced cgroup_v2 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced property_socket (sock_file (write)))
+(allow traced init (unix_stream_socket (connectto)))
+(allow traced debug_prop (property_service (set)))
+(allow traced debug_prop (file (read getattr map open)))
+(allow traced property_socket (sock_file (write)))
+(allow traced init (unix_stream_socket (connectto)))
+(allow traced system_trace_prop (property_service (set)))
+(allow traced system_trace_prop (file (read getattr map open)))
+(allow traced property_socket (sock_file (write)))
+(allow traced init (unix_stream_socket (connectto)))
+(allow traced traced_lazy_prop (property_service (set)))
+(allow traced traced_lazy_prop (file (read getattr map open)))
+(allow traced property_socket (sock_file (write)))
+(allow traced init (unix_stream_socket (connectto)))
+(allow traced traced_oome_heap_session_count_prop (property_service (set)))
+(allow traced traced_oome_heap_session_count_prop (file (read getattr map open)))
+(allow traced statsdw_socket (sock_file (write)))
+(allow traced statsd (unix_dgram_socket (sendto)))
+;;* lmx 85 system/sepolicy/private/traced.te
+
+(neverallow traced self (process (execmem)))
+;;* lme
+
+;;* lmx 88 system/sepolicy/private/traced.te
+
+(neverallow traced dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 91 system/sepolicy/private/traced.te
+
+(neverallow traced domain (process (ptrace)))
+;;* lme
+
+;;* lmx 107 system/sepolicy/private/traced.te
+
+(neverallow traced base_typeattr_982 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 108 system/sepolicy/private/traced.te
+
+(neverallow traced system_data_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 114 system/sepolicy/private/traced.te
+
+(neverallow traced base_typeattr_983 (file (ioctl read create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 117 system/sepolicy/private/traced.te
+
+(neverallow base_typeattr_235 traced (process (transition)))
+;;* lme
+
+;;* lmx 118 system/sepolicy/private/traced.te
+
+(neverallow base_typeattr_236 traced (process (dyntransition)))
+;;* lme
+
+;;* lmx 130 system/sepolicy/private/traced.te
+
+(neverallow base_typeattr_984 tracingproxy_service (service_manager (find)))
+;;* lme
+
+(allow init traced_perf_exec (file (read getattr map execute open)))
+(allow init traced_perf (process (transition)))
+(allow traced_perf traced_perf_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init traced_perf (process (noatsecure)))
+(allow init traced_perf (process (siginh rlimitinh)))
+(typetransition init traced_perf_exec process traced_perf)
+(allow traced_perf traced (fd (use)))
+(allow traced_perf traced_tmpfs (file (read write getattr map)))
+(allow traced_perf traced_producer_socket (sock_file (write)))
+(allow traced_perf traced (unix_stream_socket (connectto)))
+(allow traced traced_perf (fd (use)))
+(allow traced_perf self (perf_event (open cpu kernel tracepoint read write)))
+(allow traced_perf self (capability (dac_read_search kill)))
+(allow traced_perf packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf nativetest_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf nativetest_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf nativetest_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf system_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf system_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf system_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf vendor_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf vendor_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf vendor_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf apex_art_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf apex_art_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_perf apex_module_data_file (dir (getattr search)))
+(allow traced_perf proc_kallsyms (file (read lock open)))
+(allow traced_perf debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_perf debugfs_tracing (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit traced_perf domain (dir (getattr open search)))
+(dontaudit traced_perf domain (process (signal)))
+;;* lmx 64 system/sepolicy/private/traced_perf.te
+
+(neverallow traced_perf app_data_file_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/traced_perf.te
+
+(neverallow traced_perf hal_configstore_server (file (read)))
+(neverallow traced_perf apexd (file (read)))
+(neverallow traced_perf app_zygote (file (read)))
+(neverallow traced_perf bpfloader (file (read)))
+(neverallow traced_perf init (file (read)))
+(neverallow traced_perf kernel (file (read)))
+(neverallow traced_perf keystore (file (read)))
+(neverallow traced_perf llkd (file (read)))
+(neverallow traced_perf logd (file (read)))
+(neverallow traced_perf ueventd (file (read)))
+(neverallow traced_perf vendor_init (file (read)))
+(neverallow traced_perf vold (file (read)))
+(neverallow traced_perf webview_zygote (file (read)))
+(neverallow traced_perf zygote (file (read)))
+;;* lme
+
+;;* lmx 68 system/sepolicy/private/traced_perf.te
+
+(neverallow traced_perf hal_configstore_server (process (signal)))
+(neverallow traced_perf apexd (process (signal)))
+(neverallow traced_perf app_zygote (process (signal)))
+(neverallow traced_perf bpfloader (process (signal)))
+(neverallow traced_perf init (process (signal)))
+(neverallow traced_perf kernel (process (signal)))
+(neverallow traced_perf keystore (process (signal)))
+(neverallow traced_perf llkd (process (signal)))
+(neverallow traced_perf logd (process (signal)))
+(neverallow traced_perf ueventd (process (signal)))
+(neverallow traced_perf vendor_init (process (signal)))
+(neverallow traced_perf vold (process (signal)))
+(neverallow traced_perf webview_zygote (process (signal)))
+(neverallow traced_perf zygote (process (signal)))
+;;* lme
+
+(allow init traced_probes_exec (file (read getattr map execute open)))
+(allow init traced_probes (process (transition)))
+(allow traced_probes traced_probes_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init traced_probes (process (noatsecure)))
+(allow init traced_probes (process (siginh rlimitinh)))
+(typetransition init traced_probes_exec process traced_probes)
+(typetransition traced_probes tmpfs file traced_probes_tmpfs)
+(allow traced_probes traced_probes_tmpfs (file (read write getattr map)))
+(allow traced_probes traced (fd (use)))
+(allow traced_probes traced_tmpfs (file (read write getattr map)))
+(allow traced_probes traced_producer_socket (sock_file (write)))
+(allow traced_probes traced (unix_stream_socket (connectto)))
+(allow traced traced_probes (fd (use)))
+(allow traced_probes debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_probes debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow traced_probes debugfs_trace_marker (file (getattr)))
+(allow traced_probes debugfs_tracing_printk_formats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes debugfs_tracing_instances (dir (search)))
+(allow traced_probes debugfs_mm_events_tracing (dir (search)))
+(allow traced_probes debugfs_mm_events_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow traced_probes self (capability (sys_nice)))
+(allow traced_probes self (cap_userns (sys_nice)))
+(allow traced_probes domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_probes domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_kallsyms (file (read lock open)))
+(allow traced_probes packages_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes game_mode_intervention_list_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes kmsg_device (chr_file (write)))
+(allow traced_probes system_file (dir (read open)))
+(allow traced_probes self (capability (dac_read_search)))
+(allow traced_probes self (cap_userns (dac_read_search)))
+(allow traced_probes apk_data_file (dir (read getattr open search)))
+(allow traced_probes apex_module_data_file (dir (read getattr open search)))
+(allow traced_probes apex_art_data_file (dir (read getattr open search)))
+(allow traced_probes dalvikcache_data_file (dir (read getattr open search)))
+(allow traced_probes system_app_data_file (dir (read getattr open search)))
+(allow traced_probes backup_data_file (dir (read getattr open search)))
+(allow traced_probes bootstat_data_file (dir (read getattr open search)))
+(allow traced_probes update_engine_data_file (dir (read getattr open search)))
+(allow traced_probes update_engine_log_data_file (dir (read getattr open search)))
+(allow traced_probes user_profile_root_file (dir (read getattr open search)))
+(allow traced_probes user_profile_data_file (dir (read getattr open search)))
+(allow traced_probes atrace_exec (file (read getattr map execute open)))
+(allow traced_probes atrace (process (transition)))
+(allow atrace atrace_exec (file (read getattr map execute open entrypoint)))
+(allow atrace traced_probes (process (sigchld)))
+(dontaudit traced_probes atrace (process (noatsecure)))
+(allow traced_probes atrace (process (siginh rlimitinh)))
+(typetransition traced_probes atrace_exec process atrace)
+(allow traced_probes atrace (process (sigkill)))
+(allow traced_probes proc_buddyinfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_pressure_cpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_pressure_io (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_pressure_mem (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes sysfs_devfreq_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traced_probes sysfs_devfreq_cur (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes proc_diskstats (file (ioctl read getattr lock map open watch watch_reads)))
+(allow traced_probes statsdw_socket (sock_file (write)))
+(allow traced_probes statsd (unix_dgram_socket (sendto)))
+(allow traced_probes statsd (binder (call transfer)))
+(allow statsd traced_probes (binder (transfer)))
+(allow traced_probes statsd (fd (use)))
+(allow traced_probes stats_service (service_manager (find)))
+(allow traced_probes system_suspend_control_internal_service (service_manager (find)))
+(allow traced_probes system_suspend (binder (call)))
+(allow traced_probes debug_tracing_desktop_mode_visible_tasks_prop (file (read getattr map open)))
+;;* lmx 132 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes self (process (execmem)))
+;;* lme
+
+;;* lmx 135 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes dev_type (blk_file (read write)))
+;;* lme
+
+;;* lmx 138 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes domain (process (ptrace)))
+;;* lme
+
+;;* lmx 163 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes base_typeattr_985 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 164 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes system_data_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 170 system/sepolicy/private/traced_probes.te
+
+(neverallow traced_probes base_typeattr_986 (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 173 system/sepolicy/private/traced_probes.te
+
+(neverallow base_typeattr_235 traced_probes (process (transition)))
+;;* lme
+
+;;* lmx 174 system/sepolicy/private/traced_probes.te
+
+(neverallow base_typeattr_236 traced_probes (process (dyntransition)))
+;;* lme
+
+(typetransition traceur_app tmpfs file appdomain_tmpfs)
+(allow traceur_app traceur_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su traceur_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 3 system/sepolicy/private/traceur_app.te
+
+(neverallow base_typeattr_987 traceur_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow traceur_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 3 system/sepolicy/private/traceur_app.te
+
+(neverallow base_typeattr_988 base_typeattr_987 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/traceur_app.te
+
+(neverallow base_typeattr_989 traceur_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 3 system/sepolicy/private/traceur_app.te
+
+(neverallow base_typeattr_990 traceur_app (process (ptrace)))
+;;* lme
+
+(allow traceur_app debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow traceur_app debugfs_tracing_debug (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow traceur_app trace_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow traceur_app trace_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow traceur_app wm_trace_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow traceur_app wm_trace_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow traceur_app atrace_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow traceur_app perfetto_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow traceur_app traced_consumer_socket (sock_file (write)))
+(allow traceur_app traced (unix_stream_socket (connectto)))
+(dontaudit traceur_app debugfs_tracing_debug (file (audit_access)))
+(allow traceur_app property_socket (sock_file (write)))
+(allow traceur_app init (unix_stream_socket (connectto)))
+(allow traceur_app debug_prop (property_service (set)))
+(allow traceur_app debug_prop (file (read getattr map open)))
+(allow traceur_app servicemanager (service_manager (list)))
+(allow traceur_app hwservicemanager (hwservice_manager (list)))
+(allow traceur_app base_typeattr_991 (service_manager (find)))
+(dontaudit traceur_app service_manager_type (service_manager (find)))
+(dontaudit traceur_app hwservice_manager_type (hwservice_manager (find)))
+(dontaudit traceur_app domain (binder (call)))
+(allow tradeinmode adbd_tradeinmode (fd (use)))
+(allow tradeinmode adbd_tradeinmode (unix_stream_socket (ioctl read write)))
+(allow tradeinmode property_socket (sock_file (write)))
+(allow tradeinmode init (unix_stream_socket (connectto)))
+(allow tradeinmode adbd_tradeinmode_prop (property_service (set)))
+(allow tradeinmode adbd_tradeinmode_prop (file (read getattr map open)))
+(allow tradeinmode adbd (fd (use)))
+(allow tradeinmode shell (fd (use)))
+(allow tradeinmode adbd (unix_stream_socket (ioctl read write)))
+(allow tradeinmode devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow tradeinmode system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow tradeinmode zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow tradeinmode apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow tradeinmode activity_service (service_manager (find)))
+(allow tradeinmode odsign_prop (file (read getattr map open)))
+(allow tradeinmode build_attestation_prop (file (read getattr map open)))
+(allow tradeinmode adbd_tradeinmode_prop (file (read getattr map open)))
+(allow tradeinmode property_socket (sock_file (write)))
+(allow tradeinmode init (unix_stream_socket (connectto)))
+(allow tradeinmode powerctl_prop (property_service (set)))
+(allow tradeinmode powerctl_prop (file (read getattr map open)))
+(allow tradeinmode system_server (binder (call transfer)))
+(allow system_server tradeinmode (binder (transfer)))
+(allow tradeinmode system_server (fd (use)))
+(allow tradeinmode servicemanager (binder (call transfer)))
+(allow servicemanager tradeinmode (binder (transfer)))
+(allow tradeinmode servicemanager (fd (use)))
+(allow tradeinmode platform_app (binder (call transfer)))
+(allow platform_app tradeinmode (binder (transfer)))
+(allow tradeinmode platform_app (fd (use)))
+(typetransition ueventd tmpfs file ueventd_tmpfs)
+(allow ueventd ueventd_tmpfs (file (read write getattr map)))
+(allow ueventd property_socket (sock_file (write)))
+(allow ueventd init (unix_stream_socket (connectto)))
+(allow ueventd cold_boot_done_prop (property_service (set)))
+(allow ueventd cold_boot_done_prop (file (read getattr map open)))
+(allow ueventd kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow ueventd self (capability (chown dac_override dac_read_search fowner fsetid setgid setuid net_admin sys_rawio mknod)))
+(allow ueventd self (cap_userns (chown dac_override dac_read_search fowner fsetid setgid setuid net_admin sys_rawio mknod)))
+(allow ueventd device (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow ueventd rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd sysfs_type (file (write lock append map open)))
+(allow ueventd sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd sysfs_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd sysfs_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd sysfs_type (file (setattr relabelfrom relabelto)))
+(allow ueventd sysfs_type (lnk_file (setattr relabelfrom relabelto)))
+(allow ueventd sysfs_type (dir (setattr relabelfrom relabelto)))
+(allow ueventd tmpfs (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow ueventd dev_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow ueventd dev_type (lnk_file (create unlink)))
+(allow ueventd dev_type (chr_file (create getattr setattr unlink)))
+(allow ueventd dev_type (blk_file (create getattr setattr relabelfrom relabelto unlink)))
+(allow ueventd self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow ueventd efs_file (dir (search)))
+(allow ueventd efs_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd base_typeattr_992 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd base_typeattr_992 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd base_typeattr_992 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd self (process (setfscreate)))
+(allow ueventd proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow ueventd proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit ueventd postinstall_mnt_dir (dir (getattr)))
+(allow ueventd self (capability (sys_module)))
+(allow ueventd self (cap_userns (sys_module)))
+(allow ueventd vendor_file (system (module_load)))
+(allow ueventd kernel (key (search)))
+(allow ueventd system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow ueventd system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow ueventd vendor_shell_exec (file (execute)))
+(allow ueventd dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow ueventd self (capability (sys_admin)))
+(allow ueventd apexd_prop (file (read getattr map open)))
+;;* lmx 83 system/sepolicy/private/ueventd.te
+
+(neverallow ueventd dev_type (blk_file (ioctl read write lock append map link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 86 system/sepolicy/private/ueventd.te
+
+(neverallow ueventd port_device (chr_file (ioctl read write lock relabelfrom append map link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 89 system/sepolicy/private/ueventd.te
+
+(neverallow base_typeattr_236 ueventd (process (ptrace)))
+;;* lme
+
+;;* lmx 92 system/sepolicy/private/ueventd.te
+
+(neverallow ueventd fs_type (file (execute_no_trans)))
+(neverallow ueventd file_type (file (execute_no_trans)))
+;;* lme
+
+(allow init uncrypt_exec (file (read getattr map execute open)))
+(allow init uncrypt (process (transition)))
+(allow uncrypt uncrypt_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init uncrypt (process (noatsecure)))
+(allow init uncrypt (process (siginh rlimitinh)))
+(typetransition init uncrypt_exec process uncrypt)
+(allow uncrypt property_socket (sock_file (write)))
+(allow uncrypt init (unix_stream_socket (connectto)))
+(allow uncrypt powerctl_prop (property_service (set)))
+(allow uncrypt powerctl_prop (file (read getattr map open)))
+(allow uncrypt self (capability (dac_override dac_read_search)))
+(allow uncrypt self (cap_userns (dac_override dac_read_search)))
+(allow uncrypt cache_file (dir (search)))
+(allow uncrypt cache_recovery_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow uncrypt cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow uncrypt ota_package_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow uncrypt ota_package_file (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow uncrypt uncrypt_socket (sock_file (write)))
+(allow uncrypt uncrypt (unix_stream_socket (connectto)))
+(allow uncrypt self (capability (sys_rawio)))
+(allow uncrypt self (cap_userns (sys_rawio)))
+(allow uncrypt misc_block_device (blk_file (write lock append map open)))
+(allow uncrypt block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow uncrypt userdata_block_device (blk_file (write lock append map open)))
+(allow uncrypt rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow uncrypt rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow uncrypt sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt sysfs_dt_firmware_android (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt gsi_metadata_file_type (dir (search)))
+(allow uncrypt metadata_file (dir (search)))
+(allow uncrypt gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uncrypt proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(typetransition untrusted_app tmpfs file appdomain_tmpfs)
+(allow untrusted_app untrusted_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/untrusted_app.te
+
+(neverallow base_typeattr_993 untrusted_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 13 system/sepolicy/private/untrusted_app.te
+
+(neverallow base_typeattr_994 base_typeattr_993 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app.te
+
+(neverallow base_typeattr_995 untrusted_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app.te
+
+(neverallow base_typeattr_996 untrusted_app (process (ptrace)))
+;;* lme
+
+(allow untrusted_app sdk_sandbox_data_file (fd (use)))
+(allow untrusted_app sdk_sandbox_data_file (file (write)))
+;;* lmx 23 system/sepolicy/private/untrusted_app.te
+
+(neverallow untrusted_app sdk_sandbox_data_file (file (create open)))
+;;* lme
+
+(typetransition untrusted_app_25 tmpfs file appdomain_tmpfs)
+(allow untrusted_app_25 untrusted_app_25_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_25_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_25.te
+
+(neverallow base_typeattr_997 untrusted_app_25_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_25 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_25.te
+
+(neverallow base_typeattr_998 base_typeattr_997 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_25.te
+
+(neverallow base_typeattr_999 untrusted_app_25 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_25.te
+
+(neverallow base_typeattr_1000 untrusted_app_25 (process (ptrace)))
+;;* lme
+
+(allow untrusted_app_25 proc_misc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_25 proc_tty_drivers (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_25 apk_data_file (file (execmod)))
+(allow untrusted_app_25 app_data_file (file (execmod)))
+(allow untrusted_app_25 asec_public_file (file (execmod)))
+(allow untrusted_app_25 app_data_file (file (execute_no_trans)))
+(auditallow untrusted_app_25 app_data_file (file (execute execute_no_trans)))
+(allow untrusted_app_25 dex2oat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow untrusted_app_25 ashmem_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(auditallow untrusted_app_25 ashmem_device (chr_file (open)))
+(allow untrusted_app_25 mnt_sdcard_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_25 self (netlink_route_socket (nlmsg_getneigh)))
+(auditallow untrusted_app_25 self (netlink_route_socket (nlmsg_getneigh)))
+(allow untrusted_app_25 mdnsd_socket (sock_file (write)))
+(allow untrusted_app_25 mdnsd (unix_stream_socket (connectto)))
+(allow untrusted_app_25 apk_data_file (dir (watch watch_reads)))
+(allow untrusted_app_25 apk_data_file (file (watch watch_reads)))
+(typetransition untrusted_app_27 tmpfs file appdomain_tmpfs)
+(allow untrusted_app_27 untrusted_app_27_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_27_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_27.te
+
+(neverallow base_typeattr_1001 untrusted_app_27_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_27 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_27.te
+
+(neverallow base_typeattr_1002 base_typeattr_1001 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_27.te
+
+(neverallow base_typeattr_1003 untrusted_app_27 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_27.te
+
+(neverallow base_typeattr_1004 untrusted_app_27 (process (ptrace)))
+;;* lme
+
+(allow untrusted_app_27 apk_data_file (file (execmod)))
+(allow untrusted_app_27 app_data_file (file (execmod)))
+(allow untrusted_app_27 asec_public_file (file (execmod)))
+(allow untrusted_app_27 app_data_file (file (execute_no_trans)))
+(auditallow untrusted_app_27 app_data_file (file (execute execute_no_trans)))
+(allow untrusted_app_27 dex2oat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow untrusted_app_27 ashmem_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(auditallow untrusted_app_27 ashmem_device (chr_file (open)))
+(allow untrusted_app_27 mnt_sdcard_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_27 self (netlink_route_socket (nlmsg_getneigh)))
+(auditallow untrusted_app_27 self (netlink_route_socket (nlmsg_getneigh)))
+(allow untrusted_app_27 mdnsd_socket (sock_file (write)))
+(allow untrusted_app_27 mdnsd (unix_stream_socket (connectto)))
+(allow untrusted_app_27 apk_data_file (dir (watch watch_reads)))
+(allow untrusted_app_27 apk_data_file (file (watch watch_reads)))
+(typetransition untrusted_app_29 tmpfs file appdomain_tmpfs)
+(allow untrusted_app_29 untrusted_app_29_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_29_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_29.te
+
+(neverallow base_typeattr_1005 untrusted_app_29_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_29 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_29.te
+
+(neverallow base_typeattr_1006 base_typeattr_1005 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_29.te
+
+(neverallow base_typeattr_1007 untrusted_app_29 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_29.te
+
+(neverallow base_typeattr_1008 untrusted_app_29 (process (ptrace)))
+;;* lme
+
+(allow untrusted_app_29 self (netlink_route_socket (nlmsg_getneigh)))
+(auditallow untrusted_app_29 self (netlink_route_socket (nlmsg_getneigh)))
+(allow untrusted_app_29 mdnsd_socket (sock_file (write)))
+(allow untrusted_app_29 mdnsd (unix_stream_socket (connectto)))
+(allow untrusted_app_29 apk_data_file (dir (watch watch_reads)))
+(allow untrusted_app_29 apk_data_file (file (watch watch_reads)))
+(typetransition untrusted_app_30 tmpfs file appdomain_tmpfs)
+(allow untrusted_app_30 untrusted_app_30_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_30_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 15 system/sepolicy/private/untrusted_app_30.te
+
+(neverallow base_typeattr_1009 untrusted_app_30_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_30 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 15 system/sepolicy/private/untrusted_app_30.te
+
+(neverallow base_typeattr_1010 base_typeattr_1009 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/private/untrusted_app_30.te
+
+(neverallow base_typeattr_1011 untrusted_app_30 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 15 system/sepolicy/private/untrusted_app_30.te
+
+(neverallow base_typeattr_1012 untrusted_app_30 (process (ptrace)))
+;;* lme
+
+(allow untrusted_app_30 self (netlink_route_socket (nlmsg_getneigh)))
+(auditallow untrusted_app_30 self (netlink_route_socket (nlmsg_getneigh)))
+(allow untrusted_app_30 mdnsd_socket (sock_file (write)))
+(allow untrusted_app_30 mdnsd (unix_stream_socket (connectto)))
+(allow untrusted_app_30 apk_data_file (dir (watch watch_reads)))
+(allow untrusted_app_30 apk_data_file (file (watch watch_reads)))
+(typetransition untrusted_app_32 tmpfs file appdomain_tmpfs)
+(allow untrusted_app_32 untrusted_app_32_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su untrusted_app_32_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_32.te
+
+(neverallow base_typeattr_1013 untrusted_app_32_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_32 appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 13 system/sepolicy/private/untrusted_app_32.te
+
+(neverallow base_typeattr_1014 base_typeattr_1013 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_32.te
+
+(neverallow base_typeattr_1015 untrusted_app_32 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 13 system/sepolicy/private/untrusted_app_32.te
+
+(neverallow base_typeattr_1016 untrusted_app_32 (process (ptrace)))
+;;* lme
+
+(allow untrusted_app_32 sdk_sandbox_data_file (fd (use)))
+(allow untrusted_app_32 sdk_sandbox_data_file (file (write)))
+;;* lmx 23 system/sepolicy/private/untrusted_app_32.te
+
+(neverallow untrusted_app_32 sdk_sandbox_data_file (file (create open)))
+;;* lme
+
+(allow untrusted_app_32 mdnsd_socket (sock_file (write)))
+(allow untrusted_app_32 mdnsd (unix_stream_socket (connectto)))
+(allow untrusted_app_32 apk_data_file (dir (watch watch_reads)))
+(allow untrusted_app_32 apk_data_file (file (watch watch_reads)))
+(allow untrusted_app_all privapp_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow untrusted_app_all app_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(auditallow untrusted_app_all app_data_file (file (execute)))
+(allow untrusted_app_all system_linker_exec (file (execute_no_trans)))
+(allow untrusted_app_all privapp_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all app_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow untrusted_app_all app_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow untrusted_app_all app_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow untrusted_app_all app_exec_data_file (file (ioctl read getattr lock map unlink execute open watch watch_reads)))
+(allow untrusted_app_all asec_apk_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all asec_apk_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow untrusted_app_all asec_public_file (file (execute)))
+(allow untrusted_app_all shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow untrusted_app_all trace_data_file (file (read getattr)))
+;;* lmx 65 system/sepolicy/private/untrusted_app_all.te
+
+(neverallow untrusted_app_all trace_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 66 system/sepolicy/private/untrusted_app_all.te
+
+(neverallow untrusted_app_all trace_data_file (file (write create setattr relabelfrom append unlink link rename open)))
+;;* lme
+
+;;* lmx 69 system/sepolicy/private/untrusted_app_all.te
+
+(neverallow untrusted_app_all debugfs_tracing (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow untrusted_app_all apk_tmp_file (file (read getattr)))
+(allow untrusted_app_all apk_private_tmp_file (file (read getattr)))
+(allow untrusted_app_all system_app_data_file (file (read write getattr)))
+(allow untrusted_app_all media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow untrusted_app_all media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow untrusted_app_all servicemanager (service_manager (list)))
+(allow untrusted_app_all audioserver_service (service_manager (find)))
+(allow untrusted_app_all cameraserver_service (service_manager (find)))
+(allow untrusted_app_all drmserver_service (service_manager (find)))
+(allow untrusted_app_all mediaserver_service (service_manager (find)))
+(allow untrusted_app_all mediaextractor_service (service_manager (find)))
+(allow untrusted_app_all mediametrics_service (service_manager (find)))
+(allow untrusted_app_all mediadrmserver_service (service_manager (find)))
+(allow untrusted_app_all nfc_service (service_manager (find)))
+(allow untrusted_app_all radio_service (service_manager (find)))
+(allow untrusted_app_all app_api_service (service_manager (find)))
+(allow untrusted_app_all vr_manager_service (service_manager (find)))
+(allow untrusted_app_all self (process (ptrace)))
+(allow untrusted_app_all runas_app (unix_stream_socket (connectto)))
+(allow untrusted_app_all runas_app (process (sigchld)))
+(allow untrusted_app_all sysfs_hwrandom (dir (search)))
+(allow untrusted_app_all sysfs_hwrandom (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow untrusted_app_all preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow untrusted_app_all preloads_data_file (dir (search)))
+(allow untrusted_app_all vendor_app_file (dir (read getattr open search)))
+(allow untrusted_app_all vendor_app_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow untrusted_app_all vendor_app_file (lnk_file (read getattr open)))
+(allow untrusted_app_all system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
+(allow untrusted_app_all rs_exec (file (read getattr map execute open)))
+(allow untrusted_app_all rs (process (transition)))
+(allow rs rs_exec (file (read getattr map execute open entrypoint)))
+(allow rs untrusted_app_all (process (sigchld)))
+(dontaudit untrusted_app_all rs (process (noatsecure)))
+(allow untrusted_app_all rs (process (siginh rlimitinh)))
+(typetransition untrusted_app_all rs_exec process rs)
+(dontaudit untrusted_app_all debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit untrusted_app_all net_dns_prop (file (read)))
+(dontaudit untrusted_app_all proc_stat (file (read)))
+(dontaudit untrusted_app_all proc_uptime (file (read)))
+(dontaudit untrusted_app_all proc_vmstat (file (read)))
+(dontaudit untrusted_app_all proc_zoneinfo (file (read)))
+(typetransition untrusted_app_all devpts chr_file untrusted_app_all_devpts)
+(allow untrusted_app_all untrusted_app_all_devpts (chr_file (ioctl read write getattr open)))
+(allowx untrusted_app_all untrusted_app_all_devpts (ioctl chr_file ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+;;* lmx 157 system/sepolicy/private/untrusted_app_all.te
+
+(neverallowx base_typeattr_236 untrusted_app_all_devpts (ioctl chr_file (0x5412)))
+;;* lme
+
+(allow untrusted_app_all virtualizationmanager_exec (file (read getattr map execute open)))
+(allow untrusted_app_all virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager untrusted_app_all (process (sigchld)))
+(dontaudit untrusted_app_all virtualizationmanager (process (noatsecure)))
+(allow untrusted_app_all virtualizationmanager (process (siginh rlimitinh)))
+(typetransition untrusted_app_all virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm untrusted_app_all (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager untrusted_app_all (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm untrusted_app_all (fd (use)))
+(allow virtualizationmanager untrusted_app_all (fd (use)))
+(allow untrusted_app_all virtualizationmanager (fd (use)))
+(allow crosvm untrusted_app_all (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager untrusted_app_all (fifo_file (ioctl read write getattr)))
+(allow untrusted_app_all virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow untrusted_app_all hypervisor_prop (file (read getattr map open)))
+(allow untrusted_app_all virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager untrusted_app_all (dir (search)))
+(allow virtualizationmanager untrusted_app_all (file (read)))
+(allow virtualizationmanager untrusted_app_all (lnk_file (read)))
+(allow init update_engine_exec (file (read getattr map execute open)))
+(allow init update_engine (process (transition)))
+(allow update_engine update_engine_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init update_engine (process (noatsecure)))
+(allow init update_engine (process (siginh rlimitinh)))
+(typetransition init update_engine_exec process update_engine)
+(allow update_engine gsi_service (service_manager (find)))
+(allow update_engine gsid (binder (call transfer)))
+(allow gsid update_engine (binder (transfer)))
+(allow update_engine gsid (fd (use)))
+(allow update_engine property_socket (sock_file (write)))
+(allow update_engine init (unix_stream_socket (connectto)))
+(allow update_engine ctl_gsid_prop (property_service (set)))
+(allow update_engine ctl_gsid_prop (file (read getattr map open)))
+(allow update_engine property_socket (sock_file (write)))
+(allow update_engine init (unix_stream_socket (connectto)))
+(allow update_engine ctl_snapuserd_prop (property_service (set)))
+(allow update_engine ctl_snapuserd_prop (file (read getattr map open)))
+(allow update_engine property_socket (sock_file (write)))
+(allow update_engine init (unix_stream_socket (connectto)))
+(allow update_engine ota_prop (property_service (set)))
+(allow update_engine ota_prop (file (read getattr map open)))
+(allow update_engine ota_build_prop (file (read getattr map open)))
+(allow update_engine gsid_prop (file (read getattr map open)))
+(allow update_engine gki_apex_prepostinstall (binder (call transfer)))
+(allow gki_apex_prepostinstall update_engine (binder (transfer)))
+(allow update_engine gki_apex_prepostinstall (fd (use)))
+(allow update_engine system_app (binder (call transfer)))
+(allow system_app update_engine (binder (transfer)))
+(allow update_engine system_app (fd (use)))
+(allow update_engine snapuserd (unix_stream_socket (connectto)))
+(allow update_engine snapuserd_socket (sock_file (write)))
+(allow update_engine snapuserd_prop (file (read getattr map open)))
+(allow update_engine apex_service (service_manager (find)))
+(allow update_engine apexd (binder (call transfer)))
+(allow apexd update_engine (binder (transfer)))
+(allow update_engine apexd (fd (use)))
+(allow update_engine servicemanager (binder (call transfer)))
+(allow servicemanager update_engine (binder (call transfer)))
+(allow servicemanager update_engine (dir (search)))
+(allow servicemanager update_engine (file (read open)))
+(allow servicemanager update_engine (process (getattr)))
+(allow update_engine self (process (setsched)))
+(allow update_engine self (capability (fowner sys_admin)))
+(allow update_engine self (cap_userns (fowner sys_admin)))
+(dontaudit update_engine self (capability (fsetid)))
+(dontaudit update_engine self (cap_userns (fsetid)))
+(allow update_engine kmsg_device (chr_file (write getattr lock append map open)))
+(allow update_engine update_engine_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow update_engine sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow update_engine self (capability2 (block_suspend)))
+(allow update_engine self (cap2_userns (block_suspend)))
+(allow update_engine system_suspend_server (binder (call transfer)))
+(allow system_suspend_server update_engine (binder (transfer)))
+(allow update_engine system_suspend_server (fd (use)))
+(allow update_engine system_suspend_hwservice (hwservice_manager (find)))
+(allow update_engine hwservicemanager (binder (call transfer)))
+(allow hwservicemanager update_engine (binder (call transfer)))
+(allow hwservicemanager update_engine (dir (search)))
+(allow hwservicemanager update_engine (file (read map open)))
+(allow hwservicemanager update_engine (process (getattr)))
+(allow update_engine hwservicemanager_prop (file (read getattr map open)))
+(allow update_engine hidl_manager_hwservice (hwservice_manager (find)))
+(allow update_engine hal_system_suspend_service (service_manager (find)))
+(allow update_engine servicemanager (binder (call transfer)))
+(allow servicemanager update_engine (binder (call transfer)))
+(allow servicemanager update_engine (dir (search)))
+(allow servicemanager update_engine (file (read open)))
+(allow servicemanager update_engine (process (getattr)))
+(dontaudit update_engine kernel (process (setsched)))
+(dontaudit update_engine self (capability (sys_rawio)))
+(dontaudit update_engine self (cap_userns (sys_rawio)))
+(allow update_engine update_engine_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow update_engine update_engine_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow update_engine update_engine_log_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow update_engine update_engine_log_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow update_engine servicemanager (binder (call transfer)))
+(allow servicemanager update_engine (binder (call transfer)))
+(allow servicemanager update_engine (dir (search)))
+(allow servicemanager update_engine (file (read open)))
+(allow servicemanager update_engine (process (getattr)))
+(allow update_engine update_engine_service (service_manager (add find)))
+;;* lmx 72 system/sepolicy/private/update_engine.te
+
+(neverallow base_typeattr_1017 update_engine_service (service_manager (add)))
+;;* lme
+
+(allow update_engine update_engine_stable_service (service_manager (add find)))
+;;* lmx 73 system/sepolicy/private/update_engine.te
+
+(neverallow base_typeattr_1017 update_engine_stable_service (service_manager (add)))
+;;* lme
+
+(allow update_engine priv_app (binder (call transfer)))
+(allow priv_app update_engine (binder (transfer)))
+(allow update_engine priv_app (fd (use)))
+(allow update_engine gmscore_app (binder (call transfer)))
+(allow gmscore_app update_engine (binder (transfer)))
+(allow update_engine gmscore_app (fd (use)))
+(allow update_engine system_server (binder (call transfer)))
+(allow system_server update_engine (binder (transfer)))
+(allow update_engine system_server (fd (use)))
+(allow update_engine ota_package_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine ota_package_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine proc_misc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine gsi_metadata_file_type (dir (search)))
+(allow update_engine metadata_file (dir (search)))
+(allow update_engine gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine vendor_boot_ota_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine vendor_boot_ota_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common postinstall_exec (file (read getattr map execute open)))
+(allow update_engine_common postinstall (process (transition)))
+(allow postinstall postinstall_exec (file (read getattr map execute open entrypoint)))
+(allow postinstall update_engine_common (process (sigchld)))
+(dontaudit update_engine_common postinstall (process (noatsecure)))
+(allow update_engine_common postinstall (process (siginh rlimitinh)))
+(typetransition update_engine_common postinstall_exec process postinstall)
+(allow update_engine_common postinstall_file (file (read getattr map execute open)))
+(allow update_engine_common postinstall (process (transition)))
+(allow postinstall postinstall_file (file (read getattr map execute open entrypoint)))
+(allow postinstall update_engine_common (process (sigchld)))
+(dontaudit update_engine_common postinstall (process (noatsecure)))
+(allow update_engine_common postinstall (process (siginh rlimitinh)))
+(typetransition update_engine_common postinstall_file process postinstall)
+(allow update_engine_common block_device (dir (search)))
+(allow update_engine_common boot_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow update_engine_common system_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx update_engine_common dev_type (ioctl blk_file ((range 0x125d 0x125e) 0x1277 (range 0x127c 0x127d) 0x127f)))
+(allow update_engine_common misc_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow update_engine_common rootfs (dir (getattr)))
+(allow update_engine_common rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common postinstall_mnt_dir (dir (getattr mounton search)))
+(allow update_engine_common postinstall_file (filesystem (mount unmount relabelfrom relabelto)))
+(allow update_engine_common labeledfs (filesystem (mount unmount relabelfrom)))
+(allow update_engine_common postinstall_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow update_engine_common postinstall_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common cache_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common cache_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow update_engine_common postinstall (process (sigkill sigstop signal)))
+(allow update_engine_common proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common sysfs_dt_firmware_android (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common sysfs_dm (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow update_engine_common dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow update_engine dm_user_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine dm_user_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_engine_common super_block_device_type (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx update_engine_common super_block_device_type (ioctl blk_file (0x1278 0x127a)))
+(allow update_engine_common block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_engine_common statsdw_socket (sock_file (write)))
+(allow update_engine_common statsd (unix_dgram_socket (sendto)))
+(allow update_engine_common virtual_ab_prop (file (read getattr map open)))
+(allow update_engine_common ab_update_gki_prop (file (read getattr map open)))
+(allow update_engine_common build_bootimage_prop (file (read getattr map open)))
+(allow update_engine_common metadata_file (dir (search)))
+(allow update_engine_common ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search rmdir)))
+(allow update_engine_common ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow init update_verifier_exec (file (read getattr map execute open)))
+(allow init update_verifier (process (transition)))
+(allow update_verifier update_verifier_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init update_verifier (process (noatsecure)))
+(allow init update_verifier (process (siginh rlimitinh)))
+(typetransition init update_verifier_exec process update_verifier)
+(allow update_verifier property_socket (sock_file (write)))
+(allow update_verifier init (unix_stream_socket (connectto)))
+(allow update_verifier powerctl_prop (property_service (set)))
+(allow update_verifier powerctl_prop (file (read getattr map open)))
+(allow update_verifier property_socket (sock_file (write)))
+(allow update_verifier init (unix_stream_socket (connectto)))
+(allow update_verifier ota_prop (property_service (set)))
+(allow update_verifier ota_prop (file (read getattr map open)))
+(allow update_verifier snapuserd_socket (sock_file (write)))
+(allow update_verifier snapuserd (unix_stream_socket (connectto)))
+(allow update_verifier virtual_ab_prop (file (read getattr map open)))
+(allow update_verifier block_device (dir (search)))
+(allow update_verifier ota_package_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_verifier ota_package_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_verifier sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_verifier sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow update_verifier sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_verifier dm_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow update_verifier kmsg_device (chr_file (write getattr lock append map open)))
+(allow update_verifier vold_service (service_manager (find)))
+(allow update_verifier servicemanager (binder (call transfer)))
+(allow servicemanager update_verifier (binder (transfer)))
+(allow update_verifier servicemanager (fd (use)))
+(allow update_verifier vold (binder (call transfer)))
+(allow vold update_verifier (binder (transfer)))
+(allow update_verifier vold (fd (use)))
+(allow init uprobestats_exec (file (read getattr map execute open)))
+(allow init uprobestats (process (transition)))
+(allow uprobestats uprobestats_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init uprobestats (process (noatsecure)))
+(allow init uprobestats (process (siginh rlimitinh)))
+(typetransition init uprobestats_exec process uprobestats)
+(allow uprobestats fs_bpf_uprobestats (file (read write)))
+(allow uprobestats fs_bpf_uprobestats (dir (search)))
+(allow uprobestats bpfloader (bpf (map_read map_write prog_run)))
+(allow uprobestats self (capability2 (perfmon)))
+(allow uprobestats self (perf_event (open cpu write)))
+(allow uprobestats sysfs_uprobe (file (read open)))
+(allow uprobestats sysfs_uprobe (dir (search)))
+(allow uprobestats system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow uprobestats statsdw_socket (sock_file (write)))
+(allow uprobestats statsd (unix_dgram_socket (sendto)))
+(allow uprobestats servicemanager (binder (call transfer)))
+(allow servicemanager uprobestats (binder (call transfer)))
+(allow servicemanager uprobestats (dir (search)))
+(allow servicemanager uprobestats (file (read open)))
+(allow servicemanager uprobestats (process (getattr)))
+(allow uprobestats activity_service (service_manager (find)))
+(allow uprobestats dynamic_instrumentation_service (service_manager (find)))
+(allow uprobestats system_server (binder (call transfer)))
+(allow system_server uprobestats (binder (transfer)))
+(allow uprobestats system_server (fd (use)))
+(allow uprobestats package_native_service (service_manager (find)))
+(allow uprobestats base_typeattr_260 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow uprobestats base_typeattr_260 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow uprobestats base_typeattr_260 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow uprobestats uprobestats_configs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow uprobestats uprobestats_configs_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
+(allow init usbd_exec (file (read getattr map execute open)))
+(allow init usbd (process (transition)))
+(allow usbd usbd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init usbd (process (noatsecure)))
+(allow init usbd (process (siginh rlimitinh)))
+(typetransition init usbd_exec process usbd)
+(allow usbd system_prop (file (read getattr map open)))
+(allow usbd property_socket (sock_file (write)))
+(allow usbd init (unix_stream_socket (connectto)))
+(allow usbd ctl_default_prop (property_service (set)))
+(allow usbd ctl_default_prop (file (read getattr map open)))
+(allow usbd property_socket (sock_file (write)))
+(allow usbd init (unix_stream_socket (connectto)))
+(allow usbd ctl_adbd_prop (property_service (set)))
+(allow usbd ctl_adbd_prop (file (read getattr map open)))
+(allow usbd servicemanager (binder (call transfer)))
+(allow servicemanager usbd (binder (transfer)))
+(allow usbd servicemanager (fd (use)))
+(allow userdata_sysdev sysfs (filesystem (associate)))
+(allow init vdc_exec (file (read getattr map execute open)))
+(allow init vdc (process (transition)))
+(allow vdc vdc_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vdc (process (noatsecure)))
+(allow init vdc (process (siginh rlimitinh)))
+(typetransition init vdc_exec process vdc)
+(allow vdc vehicle_binding_util (fd (use)))
+(allow vdc devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vdc kmsg_device (chr_file (write getattr lock append map open)))
+(allow vdc servicemanager (binder (call transfer)))
+(allow servicemanager vdc (binder (call transfer)))
+(allow servicemanager vdc (dir (search)))
+(allow servicemanager vdc (file (read open)))
+(allow servicemanager vdc (process (getattr)))
+(allow vdc vold (binder (call transfer)))
+(allow vold vdc (binder (transfer)))
+(allow vdc vold (fd (use)))
+(allow vdc vold_service (service_manager (find)))
+(allow init vehicle_binding_util_exec (file (read getattr map execute open)))
+(allow init vehicle_binding_util (process (transition)))
+(allow vehicle_binding_util vehicle_binding_util_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vehicle_binding_util (process (noatsecure)))
+(allow init vehicle_binding_util (process (siginh rlimitinh)))
+(typetransition init vehicle_binding_util_exec process vehicle_binding_util)
+(allow vehicle_binding_util kmsg_device (chr_file (write getattr lock append map open)))
+(allow vehicle_binding_util hwservicemanager (binder (call transfer)))
+(allow hwservicemanager vehicle_binding_util (binder (call transfer)))
+(allow hwservicemanager vehicle_binding_util (dir (search)))
+(allow hwservicemanager vehicle_binding_util (file (read map open)))
+(allow hwservicemanager vehicle_binding_util (process (getattr)))
+(allow vehicle_binding_util servicemanager (binder (call transfer)))
+(allow servicemanager vehicle_binding_util (binder (call transfer)))
+(allow servicemanager vehicle_binding_util (dir (search)))
+(allow servicemanager vehicle_binding_util (file (read open)))
+(allow servicemanager vehicle_binding_util (process (getattr)))
+(allow vehicle_binding_util vdc_exec (file (read getattr map execute open)))
+(allow vehicle_binding_util vdc (process (transition)))
+(allow vdc vdc_exec (file (read getattr map execute open entrypoint)))
+(allow vdc vehicle_binding_util (process (sigchld)))
+(dontaudit vehicle_binding_util vdc (process (noatsecure)))
+(allow vehicle_binding_util vdc (process (siginh rlimitinh)))
+(typetransition vehicle_binding_util vdc_exec process vdc)
+(allow vehicle_binding_util devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(dontaudit vendor_init sysfs (dir (write)))
+(allow vendor_init system_data_root_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init adbd_config_prop (property_service (set)))
+(allow vendor_init adbd_config_prop (file (read getattr map open)))
+(allow vendor_init device_config_virtualization_framework_native_prop (file (read getattr map open)))
+(allow vendor_init apex_ready_prop (file (read getattr map open)))
+(allow vendor_init fstype_prop (file (read getattr map open)))
+(allow vendor_init base_typeattr_1018 (chr_file (setattr)))
+(allow vendor_init init (unix_stream_socket (read write)))
+(allow vendor_init kmsg_device (chr_file (write getattr open)))
+(allow vendor_init device (dir (mounton)))
+(allow vendor_init rootfs (lnk_file (create unlink)))
+(allow vendor_init cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vendor_init cgroup (file (write lock append map open)))
+(allow vendor_init cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vendor_init cgroup_v2 (file (write lock append map open)))
+(allow vendor_init configfs (dir (mounton)))
+(allow vendor_init configfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vendor_init configfs (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vendor_init configfs (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vendor_init self (capability (dac_override dac_read_search)))
+(allow vendor_init self (cap_userns (dac_override dac_read_search)))
+(allow vendor_init self (capability (chown fowner fsetid)))
+(allow vendor_init self (cap_userns (chown fowner fsetid)))
+(allow vendor_init unencrypted_data_file (dir (search)))
+(allow vendor_init unencrypted_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allowx vendor_init data_file_type (ioctl dir (0x6613 0x6615)))
+(allow vendor_init system_data_file (dir (getattr)))
+(allow vendor_init base_typeattr_1019 (dir (ioctl read write create getattr setattr relabelfrom open add_name remove_name search rmdir)))
+(allow vendor_init unlabeled (file (getattr relabelfrom)))
+(allow vendor_init unlabeled (dir (getattr relabelfrom)))
+(allow vendor_init unlabeled (lnk_file (getattr relabelfrom)))
+(allow vendor_init unlabeled (sock_file (getattr relabelfrom)))
+(allow vendor_init unlabeled (fifo_file (getattr relabelfrom)))
+(allow vendor_init base_typeattr_1020 (file (read write create getattr setattr relabelfrom map unlink open)))
+(allow vendor_init base_typeattr_1021 (sock_file (read create getattr setattr relabelfrom unlink open)))
+(allow vendor_init base_typeattr_1021 (fifo_file (read create getattr setattr relabelfrom unlink open)))
+(allow vendor_init base_typeattr_1022 (lnk_file (create getattr setattr relabelfrom unlink)))
+(allow vendor_init base_typeattr_1023 (file (relabelto)))
+(allow vendor_init base_typeattr_1023 (dir (relabelto)))
+(allow vendor_init base_typeattr_1023 (lnk_file (relabelto)))
+(allow vendor_init base_typeattr_1023 (chr_file (relabelto)))
+(allow vendor_init base_typeattr_1023 (blk_file (relabelto)))
+(allow vendor_init base_typeattr_1023 (sock_file (relabelto)))
+(allow vendor_init base_typeattr_1023 (fifo_file (relabelto)))
+(allow vendor_init dev_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vendor_init dev_type (lnk_file (create)))
+(allow vendor_init debugfs_tracing (file (write lock append map open)))
+(allow vendor_init base_typeattr_1024 (file (read setattr map open)))
+(allow vendor_init tracefs_type (file (read setattr map open)))
+(allow vendor_init base_typeattr_1025 (dir (read setattr open search)))
+(allow vendor_init dev_type (blk_file (getattr)))
+(allow vendor_init proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vendor_init proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_init proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_init proc_net_type (file (write lock append map open)))
+(allow vendor_init self (capability (net_admin)))
+(allow vendor_init self (cap_userns (net_admin)))
+(allow vendor_init proc_page_cluster (file (write lock append map open)))
+(allow vendor_init sysfs_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vendor_init sysfs_type (lnk_file (read)))
+(allow vendor_init base_typeattr_1026 (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vendor_init self (process (setfscreate)))
+(allow vendor_init vendor_file_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vendor_init vendor_file_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_init vendor_file_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_init serialno_prop (file (read getattr map open)))
+(allow vendor_init self (capability (sys_admin)))
+(allow vendor_init self (cap_userns (sys_admin)))
+(allow vendor_init misc_block_device (blk_file (write lock append map open)))
+(allow vendor_init system_bootstrap_lib_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vendor_init system_bootstrap_lib_file (file (read getattr map execute open)))
+(allow vendor_init userdata_sysdev (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vendor_init file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_init self (capability (sys_nice)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init apk_verity_prop (property_service (set)))
+(allow vendor_init apk_verity_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init bluetooth_a2dp_offload_prop (property_service (set)))
+(allow vendor_init bluetooth_a2dp_offload_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init bluetooth_audio_hal_prop (property_service (set)))
+(allow vendor_init bluetooth_audio_hal_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init bluetooth_config_prop (property_service (set)))
+(allow vendor_init bluetooth_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camera2_extensions_prop (property_service (set)))
+(allow vendor_init camera2_extensions_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init camerax_extensions_prop (property_service (set)))
+(allow vendor_init camerax_extensions_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init cpu_variant_prop (property_service (set)))
+(allow vendor_init cpu_variant_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init dalvik_config_prop (property_service (set)))
+(allow vendor_init dalvik_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init dalvik_dynamic_config_prop (property_service (set)))
+(allow vendor_init dalvik_dynamic_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init dalvik_runtime_prop (property_service (set)))
+(allow vendor_init dalvik_runtime_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init debug_prop (property_service (set)))
+(allow vendor_init debug_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_bluetooth_prop (property_service (set)))
+(allow vendor_init exported_bluetooth_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_camera_prop (property_service (set)))
+(allow vendor_init exported_camera_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_config_prop (property_service (set)))
+(allow vendor_init exported_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_default_prop (property_service (set)))
+(allow vendor_init exported_default_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_overlay_prop (property_service (set)))
+(allow vendor_init exported_overlay_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init exported_pm_prop (property_service (set)))
+(allow vendor_init exported_pm_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init ffs_control_prop (property_service (set)))
+(allow vendor_init ffs_control_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init hw_timeout_multiplier_prop (property_service (set)))
+(allow vendor_init hw_timeout_multiplier_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init incremental_prop (property_service (set)))
+(allow vendor_init incremental_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init lmkd_prop (property_service (set)))
+(allow vendor_init lmkd_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init logd_prop (property_service (set)))
+(allow vendor_init logd_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init log_tag_prop (property_service (set)))
+(allow vendor_init log_tag_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init log_prop (property_service (set)))
+(allow vendor_init log_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init graphics_config_writable_prop (property_service (set)))
+(allow vendor_init graphics_config_writable_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init prefetch_boot_prop (property_service (set)))
+(allow vendor_init prefetch_boot_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init qemu_hw_prop (property_service (set)))
+(allow vendor_init qemu_hw_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init radio_control_prop (property_service (set)))
+(allow vendor_init radio_control_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init rebootescrow_hal_prop (property_service (set)))
+(allow vendor_init rebootescrow_hal_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init serialno_prop (property_service (set)))
+(allow vendor_init serialno_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init soc_prop (property_service (set)))
+(allow vendor_init soc_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init surfaceflinger_color_prop (property_service (set)))
+(allow vendor_init surfaceflinger_color_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init usb_control_prop (property_service (set)))
+(allow vendor_init usb_control_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init userspace_reboot_config_prop (property_service (set)))
+(allow vendor_init userspace_reboot_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vehicle_hal_prop (property_service (set)))
+(allow vendor_init vehicle_hal_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vendor_default_prop (property_service (set)))
+(allow vendor_init vendor_default_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init keystore_config_prop (property_service (set)))
+(allow vendor_init keystore_config_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vendor_security_patch_level_prop (property_service (set)))
+(allow vendor_init vendor_security_patch_level_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vndk_prop (property_service (set)))
+(allow vendor_init vndk_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init virtual_ab_prop (property_service (set)))
+(allow vendor_init virtual_ab_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init vold_post_fs_data_prop (property_service (set)))
+(allow vendor_init vold_post_fs_data_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init wifi_hal_prop (property_service (set)))
+(allow vendor_init wifi_hal_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init wifi_log_prop (property_service (set)))
+(allow vendor_init wifi_log_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init zram_control_prop (property_service (set)))
+(allow vendor_init zram_control_prop (file (read getattr map open)))
+(allow vendor_init boot_status_prop (file (read getattr map open)))
+(allow vendor_init exported3_system_prop (file (read getattr map open)))
+(allow vendor_init ota_prop (file (read getattr map open)))
+(allow vendor_init power_debug_prop (file (read getattr map open)))
+(allow vendor_init provisioned_prop (file (read getattr map open)))
+(allow vendor_init retaildemo_prop (file (read getattr map open)))
+(allow vendor_init surfaceflinger_display_prop (file (read getattr map open)))
+(allow vendor_init test_harness_prop (file (read getattr map open)))
+(allow vendor_init theme_prop (file (read getattr map open)))
+(allow vendor_init property_socket (sock_file (write)))
+(allow vendor_init init (unix_stream_socket (connectto)))
+(allow vendor_init dck_prop (property_service (set)))
+(allow vendor_init dck_prop (file (read getattr map open)))
+(allow vendor_init device_config_vendor_system_native_prop (file (read getattr map open)))
+(allow vendor_init device_config_vendor_system_native_boot_prop (file (read getattr map open)))
+;;* lmx 341 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init base_typeattr_1027 (socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (tcp_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (udp_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (rawip_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (packet_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (key_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (unix_stream_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (unix_dgram_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_route_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_tcpdiag_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_nflog_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_xfrm_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_selinux_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_audit_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_dnrt_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_kobject_uevent_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (appletalk_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (tun_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_iscsi_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_fib_lookup_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_connector_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_netfilter_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_generic_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_scsitransport_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_rdma_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netlink_crypto_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (sctp_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (icmp_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (ax25_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (ipx_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (netrom_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (atmpvc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (x25_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (rose_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (decnet_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (atmsvc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (rds_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (irda_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (pppox_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (llc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (can_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (tipc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (bluetooth_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (iucv_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (rxrpc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (isdn_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (phonet_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (ieee802154_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (caif_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (alg_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (nfc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (vsock_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (kcm_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (qipcrtr_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (smc_socket (connect sendto)))
+(neverallow vendor_init base_typeattr_1027 (xdp_socket (connect sendto)))
+;;* lme
+
+;;* lmx 341 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init base_typeattr_1027 (unix_stream_socket (connectto)))
+;;* lme
+
+;;* lmx 346 system/sepolicy/private/vendor_init.te
+
+(neverallow domain vendor_init (process (dyntransition)))
+;;* lme
+
+;;* lmx 347 system/sepolicy/private/vendor_init.te
+
+(neverallow base_typeattr_235 vendor_init (process (transition)))
+;;* lme
+
+;;* lmx 348 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init base_typeattr_761 (file (entrypoint)))
+;;* lme
+
+;;* lmx 351 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init app_data_file_type (lnk_file (read)))
+;;* lme
+
+;;* lmx 352 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init shell_data_file (lnk_file (read)))
+;;* lme
+
+;;* lmx 354 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init shell_data_file (dir (write add_name remove_name)))
+;;* lme
+
+;;* lmx 357 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init fs_type (file (execute_no_trans)))
+(neverallow vendor_init file_type (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 360 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init service_manager_type (service_manager (add find)))
+;;* lme
+
+;;* lmx 361 system/sepolicy/private/vendor_init.te
+
+(neverallow vendor_init servicemanager (service_manager (list)))
+;;* lme
+
+;;* lmx 364 system/sepolicy/private/vendor_init.te
+
+(neverallow base_typeattr_236 vendor_init (process (ptrace)))
+;;* lme
+
+(allow vendor_misc_writer misc_block_device (blk_file (write lock append map open)))
+(allow vendor_misc_writer block_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit vendor_misc_writer proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit vendor_misc_writer sysfs_dt_firmware_android (dir (search)))
+(dontaudit vendor_misc_writer proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_misc_writer gsi_metadata_file_type (dir (search)))
+(allow vendor_misc_writer metadata_file (dir (search)))
+(allow vendor_misc_writer gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_misc_writer proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_misc_writer proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vendor_shell vendor_shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vendor_shell vendor_toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vendor_shell shell (fd (use)))
+(allow vendor_shell adbd (fd (use)))
+(allow vendor_shell adbd (process (sigchld)))
+(allow vendor_shell adbd (unix_stream_socket (ioctl read write getattr)))
+(allow vendor_shell devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vendor_shell tty_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vendor_shell console_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vendor_shell input_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vendor_shell input_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+;;* lmx 3 system/sepolicy/private/vendor_toolbox.te
+
+(neverallow base_typeattr_1028 vendor_toolbox_exec (file (execute execute_no_trans entrypoint)))
+;;* lme
+
+(allow init vfio_handler_exec (file (read getattr map execute open)))
+(allow init vfio_handler (process (transition)))
+(allow vfio_handler vfio_handler_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vfio_handler (process (noatsecure)))
+(allow init vfio_handler (process (siginh rlimitinh)))
+(typetransition init vfio_handler_exec process vfio_handler)
+(allow vfio_handler vfio_handler_service (service_manager (add find)))
+;;* lmx 1 system/sepolicy/private/vfio_handler.te
+
+(neverallow base_typeattr_1029 vfio_handler_service (service_manager (add)))
+;;* lme
+
+(allow vfio_handler servicemanager (binder (call transfer)))
+(allow servicemanager vfio_handler (binder (call transfer)))
+(allow servicemanager vfio_handler (dir (search)))
+(allow servicemanager vfio_handler (file (read open)))
+(allow servicemanager vfio_handler (process (getattr)))
+(allow vfio_handler vfio_device (chr_file (getattr)))
+(allow vfio_handler vfio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vfio_handler sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vfio_handler sysfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vfio_handler virtualizationservice (fd (use)))
+(allow vfio_handler virtualizationservice_data_file (file (write)))
+;;* lmx 1 system/sepolicy/private/vfio_handler.te
+
+(neverallow vfio_handler virtualizationservice_data_file (file (create open)))
+;;* lme
+
+(allow vfio_handler block_device (dir (search)))
+(allow vfio_handler dtbo_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow init virtual_camera_exec (file (read getattr map execute open)))
+(allow init virtual_camera (process (transition)))
+(allow virtual_camera virtual_camera_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init virtual_camera (process (noatsecure)))
+(allow init virtual_camera (process (siginh rlimitinh)))
+(typetransition init virtual_camera_exec process virtual_camera)
+(allow virtual_camera servicemanager (binder (call transfer)))
+(allow servicemanager virtual_camera (binder (call transfer)))
+(allow servicemanager virtual_camera (dir (search)))
+(allow servicemanager virtual_camera (file (read open)))
+(allow servicemanager virtual_camera (process (getattr)))
+(allow virtual_camera cameraserver (binder (call transfer)))
+(allow cameraserver virtual_camera (binder (transfer)))
+(allow virtual_camera cameraserver (fd (use)))
+(allow virtual_camera system_server (binder (call transfer)))
+(allow system_server virtual_camera (binder (transfer)))
+(allow virtual_camera system_server (fd (use)))
+(allow virtual_camera mediaserver (binder (call transfer)))
+(allow mediaserver virtual_camera (binder (transfer)))
+(allow virtual_camera mediaserver (fd (use)))
+(allow virtual_camera appdomain (binder (call transfer)))
+(allow appdomain virtual_camera (binder (transfer)))
+(allow virtual_camera appdomain (fd (use)))
+(allow virtual_camera base_typeattr_560 (fd (use)))
+(allow virtual_camera surfaceflinger (binder (call transfer)))
+(allow surfaceflinger virtual_camera (binder (transfer)))
+(allow virtual_camera surfaceflinger (fd (use)))
+(allow virtual_camera virtual_camera_service (service_manager (add find)))
+;;* lmx 37 system/sepolicy/private/virtual_camera.te
+
+(neverallow base_typeattr_1030 virtual_camera_service (service_manager (add)))
+;;* lme
+
+(allow virtual_camera gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow virtual_camera gpu_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtual_camera sysfs_gpu (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtual_camera sysfs_gpu (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtual_camera sysfs_gpu (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow cameraserver ion_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow cameraserver dmabuf_system_heap_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtual_camera hal_graphics_composer (fd (use)))
+(allow virtual_camera dumpstate (fd (use)))
+(allow virtual_camera dumpstate (fifo_file (write)))
+(allow virtual_camera permission_service (service_manager (find)))
+(allow virtual_camera adbd (fd (use)))
+(allow virtual_camera adbd (unix_stream_socket (read write getattr)))
+(allow virtual_camera shell (fifo_file (read write getattr)))
+(allow virtual_camera dmabuf_system_heap_device (chr_file (read open)))
+(allow init virtual_face_exec (file (read getattr map execute open)))
+(allow init virtual_face (process (transition)))
+(allow virtual_face virtual_face_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init virtual_face (process (noatsecure)))
+(allow init virtual_face (process (siginh rlimitinh)))
+(typetransition init virtual_face_exec process virtual_face)
+(allow virtual_face property_socket (sock_file (write)))
+(allow virtual_face init (unix_stream_socket (connectto)))
+(allow virtual_face virtual_face_prop (property_service (set)))
+(allow virtual_face virtual_face_prop (file (read getattr map open)))
+(allow init virtual_fingerprint_exec (file (read getattr map execute open)))
+(allow init virtual_fingerprint (process (transition)))
+(allow virtual_fingerprint virtual_fingerprint_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init virtual_fingerprint (process (noatsecure)))
+(allow init virtual_fingerprint (process (siginh rlimitinh)))
+(typetransition init virtual_fingerprint_exec process virtual_fingerprint)
+(allow virtual_fingerprint property_socket (sock_file (write)))
+(allow virtual_fingerprint init (unix_stream_socket (connectto)))
+(allow virtual_fingerprint virtual_fingerprint_prop (property_service (set)))
+(allow virtual_fingerprint virtual_fingerprint_prop (file (read getattr map open)))
+(allow init virtual_touchpad_exec (file (read getattr map execute open)))
+(allow init virtual_touchpad (process (transition)))
+(allow virtual_touchpad virtual_touchpad_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init virtual_touchpad (process (noatsecure)))
+(allow init virtual_touchpad (process (siginh rlimitinh)))
+(typetransition init virtual_touchpad_exec process virtual_touchpad)
+(allow virtual_touchpad servicemanager (binder (call transfer)))
+(allow servicemanager virtual_touchpad (binder (call transfer)))
+(allow servicemanager virtual_touchpad (dir (search)))
+(allow servicemanager virtual_touchpad (file (read open)))
+(allow servicemanager virtual_touchpad (process (getattr)))
+(allow virtual_touchpad virtual_touchpad_service (service_manager (add find)))
+;;* lmx 7 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow base_typeattr_1031 virtual_touchpad_service (service_manager (add)))
+;;* lme
+
+(allow virtual_touchpad system_server (binder (call transfer)))
+(allow system_server virtual_touchpad (binder (transfer)))
+(allow virtual_touchpad system_server (fd (use)))
+(allow virtual_touchpad uhid_device (chr_file (ioctl write lock append map open)))
+(allow virtual_touchpad permission_service (service_manager (find)))
+(allow virtualizationmanager adbd (fd (use)))
+(allow virtualizationmanager adbd (unix_stream_socket (read write getattr)))
+(allow virtualizationmanager devpts (chr_file (ioctl read write getattr)))
+(allow virtualizationmanager servicemanager (binder (call transfer)))
+(allow servicemanager virtualizationmanager (binder (call transfer)))
+(allow servicemanager virtualizationmanager (dir (search)))
+(allow servicemanager virtualizationmanager (file (read open)))
+(allow servicemanager virtualizationmanager (process (getattr)))
+(allow virtualizationmanager virtualization_service (service_manager (find)))
+(allow virtualizationmanager virtualizationservice (binder (call transfer)))
+(allow virtualizationservice virtualizationmanager (binder (transfer)))
+(allow virtualizationmanager virtualizationservice (fd (use)))
+(allow virtualizationmanager system_server (binder (call transfer)))
+(allow system_server virtualizationmanager (binder (transfer)))
+(allow virtualizationmanager system_server (fd (use)))
+(allow virtualizationmanager package_native_service (service_manager (find)))
+(allow virtualizationmanager permission_service (service_manager (find)))
+(allow virtualizationmanager crosvm_exec (file (read getattr map execute open)))
+(allow virtualizationmanager crosvm (process (transition)))
+(allow crosvm crosvm_exec (file (read getattr map execute open entrypoint)))
+(allow crosvm virtualizationmanager (process (sigchld)))
+(dontaudit virtualizationmanager crosvm (process (noatsecure)))
+(allow virtualizationmanager crosvm (process (siginh rlimitinh)))
+(typetransition virtualizationmanager crosvm_exec process crosvm)
+(allow virtualizationmanager crosvm (process (sigkill)))
+(allow virtualizationmanager virtualizationservice_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow virtualizationmanager virtualizationservice_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow virtualizationmanager virtualizationservice_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow virtualizationmanager apk_data_file (file (read getattr)))
+(allow virtualizationmanager app_data_file (file (read write getattr)))
+(allow virtualizationmanager privapp_data_file (file (read write getattr)))
+(allow virtualizationmanager apex_compos_data_file (file (read write getattr)))
+(allow virtualizationmanager apex_virt_data_file (file (read write getattr)))
+(allow virtualizationmanager shell_data_file (file (read write getattr)))
+(allow virtualizationmanager apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager apex_data_file (dir (search)))
+(allow virtualizationmanager staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager staging_data_file (dir (search)))
+(allow virtualizationmanager derive_classpath_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow virtualizationmanager apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
+(dontaudit virtualizationmanager self (dir (write)))
+(allow virtualizationmanager self (vsock_socket (read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+;;* lmx 64 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow base_typeattr_1032 virtualizationmanager (vsock_socket (create bind connect listen accept)))
+;;* lme
+
+(allow virtualizationmanager hypervisor_prop (file (read getattr map open)))
+(allow virtualizationmanager hypervisor_restricted_prop (file (read getattr map open)))
+(dontaudit virtualizationmanager hypervisor_pvmfw_prop (file (read)))
+;;* lmx 79 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow base_typeattr_1033 hypervisor_pvmfw_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop (file (read)))
+;;* lmx 90 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow base_typeattr_1033 hypervisor_virtualizationmanager_prop (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow virtualizationmanager tombstoned_crash_socket (sock_file (write)))
+(allow virtualizationmanager tombstoned (unix_stream_socket (connectto)))
+(allow virtualizationmanager tombstone_data_file (file (getattr append)))
+(allow virtualizationmanager tombstoned (fd (use)))
+(allow virtualizationmanager proc_dt_avf (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationmanager proc_dt_avf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager proc_dt_avf (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager sysfs_dt_avf (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationmanager sysfs_dt_avf (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager sysfs_dt_avf (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager vendor_microdroid_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationmanager vendor_microdroid_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager vendor_microdroid_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 118 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow domain vendor_microdroid_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 119 system/sepolicy/private/virtual_touchpad.te
+
+(neverallow domain vendor_microdroid_file (file (write create setattr relabelfrom append unlink link rename)))
+;;* lme
+
+(allow virtualizationmanager crosvm (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationmanager crosvm (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager crosvm (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit virtualizationmanager apex_module_data_file (dir (search)))
+(allow virtualizationmanager vfio_handler (binder (call transfer)))
+(allow vfio_handler virtualizationmanager (binder (transfer)))
+(allow virtualizationmanager vfio_handler (fd (use)))
+(allow virtualizationmanager tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow virtualizationmanager vmnic (fd (use)))
+(allow virtualizationmanager tee_service_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationmanager selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationmanager selinuxfs (file (write lock append map open)))
+(allow virtualizationmanager kernel (security (compute_av)))
+(allow virtualizationmanager self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow init virtualizationservice_exec (file (read getattr map execute open)))
+(allow init virtualizationservice (process (transition)))
+(allow virtualizationservice virtualizationservice_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init virtualizationservice (process (noatsecure)))
+(allow init virtualizationservice (process (siginh rlimitinh)))
+(typetransition init virtualizationservice_exec process virtualizationservice)
+(allow virtualizationservice servicemanager (binder (call transfer)))
+(allow servicemanager virtualizationservice (binder (call transfer)))
+(allow servicemanager virtualizationservice (dir (search)))
+(allow servicemanager virtualizationservice (file (read open)))
+(allow servicemanager virtualizationservice (process (getattr)))
+(allow virtualizationservice virtualization_service (service_manager (add find)))
+;;* lmx 16 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1034 virtualization_service (service_manager (add)))
+;;* lme
+
+(allow virtualizationservice virtualization_maintenance_service (service_manager (add find)))
+;;* lmx 17 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1034 virtualization_maintenance_service (service_manager (add)))
+;;* lme
+
+(allow virtualizationservice vfio_handler_service (service_manager (find)))
+(allow virtualizationservice vfio_handler (binder (call transfer)))
+(allow vfio_handler virtualizationservice (binder (transfer)))
+(allow virtualizationservice vfio_handler (fd (use)))
+(allow virtualizationservice vmnic_service (service_manager (find)))
+(allow virtualizationservice vmnic (binder (call transfer)))
+(allow vmnic virtualizationservice (binder (transfer)))
+(allow virtualizationservice vmnic (fd (use)))
+(allow virtualizationservice vm_tethering_service (service_manager (find)))
+(allow virtualizationservice avf_virtualizationservice_prop (file (read getattr map open)))
+(allow virtualizationservice system_server (binder (call transfer)))
+(allow system_server virtualizationservice (binder (transfer)))
+(allow virtualizationservice system_server (fd (use)))
+(allow virtualizationservice permission_service (service_manager (find)))
+(allow virtualizationservice remote_provisioning_service_server (binder (call transfer)))
+(allow remote_provisioning_service_server virtualizationservice (binder (transfer)))
+(allow virtualizationservice remote_provisioning_service_server (fd (use)))
+(allow virtualizationservice remote_provisioning_service (service_manager (find)))
+(allow virtualizationservice self (capability (sys_resource)))
+(allow virtualizationservice virtualizationmanager (process (setrlimit)))
+(allow virtualizationservice vmlauncher_app (binder (transfer)))
+(allow virtualizationservice self (capability (chown)))
+(allow virtualizationservice virtualizationservice_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow virtualizationservice virtualizationservice_data_file (sock_file (unlink)))
+(allow virtualizationservice virtualizationservice_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow virtualizationservice adbd (fd (use)))
+(allow virtualizationservice adbd (unix_stream_socket (read write)))
+(allow virtualizationservice virtualizationmanager_exec (file (read getattr map execute open)))
+(allow virtualizationservice virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager virtualizationservice (process (sigchld)))
+(dontaudit virtualizationservice virtualizationmanager (process (noatsecure)))
+(allow virtualizationservice virtualizationmanager (process (siginh rlimitinh)))
+(typetransition virtualizationservice virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm virtualizationservice (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager virtualizationservice (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm virtualizationservice (fd (use)))
+(allow virtualizationmanager virtualizationservice (fd (use)))
+(allow virtualizationservice virtualizationmanager (fd (use)))
+(allow crosvm virtualizationservice (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager virtualizationservice (fifo_file (ioctl read write getattr)))
+(allow virtualizationservice virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow virtualizationservice hypervisor_prop (file (read getattr map open)))
+(allow virtualizationservice virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager virtualizationservice (dir (search)))
+(allow virtualizationmanager virtualizationservice (file (read)))
+(allow virtualizationmanager virtualizationservice (lnk_file (read)))
+(allow virtualizationservice apex_module_data_file (dir (getattr search)))
+(allow virtualizationservice apex_virt_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow virtualizationservice apex_virt_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow virtualizationservice self (vsock_socket (read write create getattr setattr lock append map bind listen accept getopt setopt shutdown)))
+;;* lmx 91 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1035 virtualizationservice (vsock_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+(allow virtualizationservice property_socket (sock_file (write)))
+(allow virtualizationservice init (unix_stream_socket (connectto)))
+(allow virtualizationservice virtualizationservice_prop (property_service (set)))
+(allow virtualizationservice virtualizationservice_prop (file (read getattr map open)))
+(allow virtualizationservice statsdw_socket (sock_file (write)))
+(allow virtualizationservice statsd (unix_dgram_socket (sendto)))
+(allow virtualizationservice tombstoned_crash_socket (sock_file (write)))
+(allow virtualizationservice tombstoned (unix_stream_socket (connectto)))
+(allow virtualizationservice tombstone_data_file (file (getattr append)))
+(allow virtualizationservice tombstoned (fd (use)))
+(allow virtualizationservice vfio_device (chr_file (getattr)))
+(allow virtualizationservice vfio_device (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationservice virtualizationmanager (fd (use)))
+(allow virtualizationservice vendor_configs_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow virtualizationservice vendor_configs_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow virtualizationservice vendor_configs_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 120 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1036 virtualizationservice_prop (property_service (set)))
+;;* lme
+
+;;* lmx 127 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1037 virtualizationservice_data_file (file (create open)))
+;;* lme
+
+;;* lmx 135 system/sepolicy/private/virtualizationservice.te
+
+(neverallow virtualizationservice base_typeattr_1038 (process (setrlimit)))
+;;* lme
+
+(allow virtualizationservice tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow virtualizationservice vmnic (fd (use)))
+;;* lmx 143 system/sepolicy/private/virtualizationservice.te
+
+(neverallow base_typeattr_1039 vfio_handler (binder (call)))
+;;* lme
+
+(typetransition vmlauncher_app tmpfs file appdomain_tmpfs)
+(allow vmlauncher_app vmlauncher_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su vmlauncher_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 4 system/sepolicy/private/vmlauncher_app.te
+
+(neverallow base_typeattr_1040 vmlauncher_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow vmlauncher_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 4 system/sepolicy/private/vmlauncher_app.te
+
+(neverallow base_typeattr_1041 base_typeattr_1040 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/vmlauncher_app.te
+
+(neverallow base_typeattr_1042 vmlauncher_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 4 system/sepolicy/private/vmlauncher_app.te
+
+(neverallow base_typeattr_1043 vmlauncher_app (process (ptrace)))
+;;* lme
+
+(allow vmlauncher_app app_api_service (service_manager (find)))
+(allow vmlauncher_app system_api_service (service_manager (find)))
+(allow vmlauncher_app shell_data_file (dir (search)))
+(allow vmlauncher_app shell_data_file (file (read write open)))
+(allow vmlauncher_app virtualizationmanager_exec (file (read getattr map execute open)))
+(allow vmlauncher_app virtualizationmanager (process (transition)))
+(allow virtualizationmanager virtualizationmanager_exec (file (read getattr map execute open entrypoint)))
+(allow virtualizationmanager vmlauncher_app (process (sigchld)))
+(dontaudit vmlauncher_app virtualizationmanager (process (noatsecure)))
+(allow vmlauncher_app virtualizationmanager (process (siginh rlimitinh)))
+(typetransition vmlauncher_app virtualizationmanager_exec process virtualizationmanager)
+(allow crosvm vmlauncher_app (unix_stream_socket (ioctl read write getattr)))
+(allow virtualizationmanager vmlauncher_app (unix_stream_socket (ioctl read write getattr)))
+(allow crosvm vmlauncher_app (fd (use)))
+(allow virtualizationmanager vmlauncher_app (fd (use)))
+(allow vmlauncher_app virtualizationmanager (fd (use)))
+(allow crosvm vmlauncher_app (fifo_file (ioctl read write getattr)))
+(allow virtualizationmanager vmlauncher_app (fifo_file (ioctl read write getattr)))
+(allow vmlauncher_app virtualizationmanager (vsock_socket (read write getattr getopt)))
+(allow vmlauncher_app hypervisor_prop (file (read getattr map open)))
+(allow vmlauncher_app virtualizationservice_data_file (file (read getattr)))
+(allow virtualizationmanager vmlauncher_app (dir (search)))
+(allow virtualizationmanager vmlauncher_app (file (read)))
+(allow virtualizationmanager vmlauncher_app (lnk_file (read)))
+(allow vmlauncher_app fsck_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vmlauncher_app crosvm (fd (use)))
+(allow vmlauncher_app crosvm_tmpfs (file (read write map)))
+(allow vmlauncher_app crosvm_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vmlauncher_app privapp_data_file (sock_file (write create getattr unlink)))
+(allow vmlauncher_app virtualization_service (service_manager (find)))
+(allow vmlauncher_app virtualizationservice (binder (call)))
+(allow vmlauncher_app crosvm (binder (call transfer)))
+(allow vmlauncher_app self (vsock_socket (read write create getattr setattr lock append map bind connect listen accept getopt setopt shutdown)))
+(allow vmlauncher_app property_socket (sock_file (write)))
+(allow vmlauncher_app init (unix_stream_socket (connectto)))
+(allow vmlauncher_app debug_prop (property_service (set)))
+(allow vmlauncher_app debug_prop (file (read getattr map open)))
+(allow init vmnic_exec (file (read getattr map execute open)))
+(allow init vmnic (process (transition)))
+(allow vmnic vmnic_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vmnic (process (noatsecure)))
+(allow init vmnic (process (siginh rlimitinh)))
+(typetransition init vmnic_exec process vmnic)
+(allow vmnic vmnic_service (service_manager (add find)))
+;;* lmx 1 system/sepolicy/private/vmnic.te
+
+(neverallow base_typeattr_1044 vmnic_service (service_manager (add)))
+;;* lme
+
+(allow vmnic servicemanager (binder (call transfer)))
+(allow servicemanager vmnic (binder (call transfer)))
+(allow servicemanager vmnic (dir (search)))
+(allow servicemanager vmnic (file (read open)))
+(allow servicemanager vmnic (process (getattr)))
+(allow vmnic self (capability (net_admin)))
+(allow vmnic self (cap_userns (net_admin)))
+(allow vmnic self (tun_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow vmnic tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx vmnic tun_device (ioctl chr_file (0x54ca 0x54d2)))
+(allow vmnic self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx vmnic self (ioctl udp_socket (0x8914)))
+;;* lmx 1 system/sepolicy/private/vmnic.te
+
+(neverallow base_typeattr_1045 vmnic (binder (call)))
+;;* lme
+
+(allow init vold_exec (file (read getattr map execute open)))
+(allow init vold (process (transition)))
+(allow vold vold_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init vold (process (noatsecure)))
+(allow init vold (process (siginh rlimitinh)))
+(typetransition init vold_exec process vold)
+(allow vold sgdisk_exec (file (read getattr map execute open)))
+(allow vold sgdisk (process (transition)))
+(allow sgdisk sgdisk_exec (file (read getattr map execute open entrypoint)))
+(allow sgdisk vold (process (sigchld)))
+(dontaudit vold sgdisk (process (noatsecure)))
+(allow vold sgdisk (process (siginh rlimitinh)))
+(typetransition vold sgdisk_exec process sgdisk)
+(allow vold sdcardd_exec (file (read getattr map execute open)))
+(allow vold sdcardd (process (transition)))
+(allow sdcardd sdcardd_exec (file (read getattr map execute open entrypoint)))
+(allow sdcardd vold (process (sigchld)))
+(dontaudit vold sdcardd (process (noatsecure)))
+(allow vold sdcardd (process (siginh rlimitinh)))
+(typetransition vold sdcardd_exec process sdcardd)
+(allow vold fuseblkd_untrusted_exec (file (read getattr map execute open)))
+(allow vold fuseblkd_untrusted (process (transition)))
+(allow fuseblkd_untrusted fuseblkd_untrusted_exec (file (read getattr map execute open entrypoint)))
+(allow fuseblkd_untrusted vold (process (sigchld)))
+(dontaudit vold fuseblkd_untrusted (process (noatsecure)))
+(allow vold fuseblkd_untrusted (process (siginh rlimitinh)))
+(typetransition vold fuseblkd_untrusted_exec process fuseblkd_untrusted)
+(allow vold e2fs_exec (file (read getattr map execute open)))
+(allow vold e2fs (process (transition)))
+(allow e2fs e2fs_exec (file (read getattr map execute open entrypoint)))
+(allow e2fs vold (process (sigchld)))
+(dontaudit vold e2fs (process (noatsecure)))
+(allow vold e2fs (process (siginh rlimitinh)))
+(typetransition vold e2fs_exec process e2fs)
+(allow vold blkid_exec (file (read getattr map execute open)))
+(allow vold blkid (process (transition)))
+(allow blkid blkid_exec (file (read getattr map execute open entrypoint)))
+(allow blkid vold (process (sigchld)))
+(dontaudit vold blkid (process (noatsecure)))
+(allow vold blkid (process (siginh rlimitinh)))
+(allow vold blkid_exec (file (read getattr map execute open)))
+(allow vold blkid_untrusted (process (transition)))
+(allow blkid_untrusted blkid_exec (file (read getattr map execute open entrypoint)))
+(allow blkid_untrusted vold (process (sigchld)))
+(dontaudit vold blkid_untrusted (process (noatsecure)))
+(allow vold blkid_untrusted (process (siginh rlimitinh)))
+(allow vold fsck_exec (file (read getattr map execute open)))
+(allow vold fsck (process (transition)))
+(allow fsck fsck_exec (file (read getattr map execute open entrypoint)))
+(allow fsck vold (process (sigchld)))
+(dontaudit vold fsck (process (noatsecure)))
+(allow vold fsck (process (siginh rlimitinh)))
+(allow vold fsck_exec (file (read getattr map execute open)))
+(allow vold fsck_untrusted (process (transition)))
+(allow fsck_untrusted fsck_exec (file (read getattr map execute open entrypoint)))
+(allow fsck_untrusted vold (process (sigchld)))
+(dontaudit vold fsck_untrusted (process (noatsecure)))
+(allow vold fsck_untrusted (process (siginh rlimitinh)))
+(typetransition vold storage_file dir storage_stub_file)
+(typetransition vold mnt_media_rw_file dir mnt_media_rw_stub_file)
+(allow vold vold_config_prop (file (read getattr map open)))
+(allow vold storage_config_prop (file (read getattr map open)))
+(allow vold incremental_prop (file (read getattr map open)))
+(allow vold gsid_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold vold_prop (property_service (set)))
+(allow vold vold_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold vold_status_prop (property_service (set)))
+(allow vold vold_status_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold powerctl_prop (property_service (set)))
+(allow vold powerctl_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold ctl_fuse_prop (property_service (set)))
+(allow vold ctl_fuse_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold restorecon_prop (property_service (set)))
+(allow vold restorecon_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold ota_prop (property_service (set)))
+(allow vold ota_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold boottime_prop (property_service (set)))
+(allow vold boottime_prop (file (read getattr map open)))
+(allow vold property_socket (sock_file (write)))
+(allow vold init (unix_stream_socket (connectto)))
+(allow vold boottime_public_prop (property_service (set)))
+(allow vold boottime_public_prop (file (read getattr map open)))
+(allow vold vold_key (keystore2_key (convert_storage_key_to_ephemeral delete get_info manage_blob rebind req_forced_op update use)))
+(allow vold keystore (binder (call)))
+(allow vold keystore_service (service_manager (find)))
+(allow vold keystore_maintenance_service (service_manager (find)))
+(allow vold keystore (keystore2 (early_boot_ended)))
+(allow vold keystore (keystore2 (delete_all_keys)))
+(allow vold storage_area_app_dir (dir (search)))
+(allow vold storage_area_dir (dir (ioctl read getattr open)))
+(allow vold storage_area_key_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold storage_area_key_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold system_userdir_file (dir (write add_name remove_name)))
+(allow vold vendor_userdir_file (dir (write add_name remove_name)))
+(allow vold media_userdir_file (dir (write add_name remove_name)))
+(allow vold cache_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold cache_file (file (read getattr)))
+(allow vold cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold base_typeattr_1046 (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold base_typeattr_1046 (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold base_typeattr_1046 (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold sysfs (file (write lock append map open)))
+(allow vold sysfs_devices_block (file (write lock append map open)))
+(allow vold sysfs_dm (file (write lock append map open)))
+(allow vold sysfs_loop (file (write lock append map open)))
+(allow vold sysfs_usb (file (write lock append map open)))
+(allow vold sysfs_fs_f2fs (file (write lock append map open)))
+(allow vold sysfs_zram_uevent (file (write lock append map open)))
+(allow vold rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_drop_caches (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_meminfo (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_mounts (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold self (process (setexec)))
+(allow vold e2fs_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allowx vold fs_type (ioctl dir (0x5879)))
+(allowx vold file_type (ioctl dir (0x5879)))
+(allowx vold data_file_type (ioctl dir (0x6613 (range 0x6615 0x6618) 0x661a)))
+(allowx vold vold_metadata_file (ioctl file (0x660b)))
+(allowx vold vold_data_file (ioctl file (0x660b)))
+(allowx vold storage_area_key_file (ioctl file (0x660b)))
+(allowx vold vold_metadata_file (ioctl file (0xf514)))
+(allowx vold vold_data_file (ioctl file (0xf514)))
+(allowx vold storage_area_key_file (ioctl file (0xf514)))
+(allow vold self (process (setfscreate)))
+(allow vold system_file (file (getattr map execute execute_no_trans)))
+(allow vold block_device (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold device (dir (write)))
+(allow vold devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold rootfs (dir (mounton)))
+(allow vold sdcard_type (dir (mounton)))
+(allow vold fuse (dir (mounton)))
+(allow vold sdcard_type (filesystem (mount remount unmount)))
+(allow vold fuse (filesystem (mount remount unmount)))
+(allow vold sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold fuse (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold mnt_media_rw_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold storage_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold mnt_media_rw_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold storage_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold media_rw_data_file (dir (mounton)))
+(allowx vold media_rw_data_file (ioctl file ((range 0x581f 0x5820))))
+(allowx vold media_rw_data_file (ioctl dir ((range 0x581f 0x5820))))
+(allowx vold media_rw_data_file (ioctl file ((range 0x6601 0x6602))))
+(allowx vold media_rw_data_file (ioctl dir ((range 0x6601 0x6602))))
+(allow vold mnt_media_rw_stub_file (dir (create getattr setattr mounton rmdir)))
+(allow vold storage_stub_file (dir (create getattr setattr mounton rmdir)))
+(allow vold mnt_user_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold mnt_user_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold mnt_user_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold mnt_pass_through_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold mnt_pass_through_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold mnt_expand_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold apk_data_file (dir (create getattr setattr)))
+(allow vold shell_data_file (dir (create getattr setattr)))
+(allow vold system_userdir_file (dir (create getattr setattr)))
+(allow vold media_userdir_file (dir (ioctl read create getattr setattr open)))
+(allowx vold media_userdir_file (ioctl dir ((range 0x6601 0x6602))))
+(allow vold apk_data_file (dir (ioctl read write getattr lock mounton open watch watch_reads add_name remove_name search)))
+(allow vold apk_data_file (file (ioctl read write getattr lock append map unlink open watch watch_reads)))
+(allow vold apk_tmp_file (dir (ioctl read getattr lock mounton open watch watch_reads search)))
+(allow vold incremental_control_file (file (ioctl read getattr lock relabelto map open watch watch_reads)))
+(allow vold tmpfs (filesystem (mount unmount)))
+(allow vold tmpfs (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold tmpfs (dir (mounton)))
+(allow vold self (capability (chown dac_override dac_read_search fowner fsetid net_admin sys_admin mknod)))
+(allow vold self (cap_userns (chown dac_override dac_read_search fowner fsetid net_admin sys_admin mknod)))
+(allow vold self (netlink_kobject_uevent_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow vold loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold loop_device (blk_file (ioctl read write create getattr setattr lock append map unlink open watch watch_reads)))
+(allowx vold loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) 0x4c82)))
+(allow vold vold_device (blk_file (ioctl read write create getattr setattr lock append map unlink open watch watch_reads)))
+(allowx vold vold_device (ioctl blk_file (0x1260 0x1277)))
+(allow vold dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx vold dm_device (ioctl blk_file ((range 0x125d 0x125e) 0x1277 0x127d (range 0x1282 0x1283))))
+(allow vold domain (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold domain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold domain (process (sigkill signal)))
+(allow vold self (capability (kill sys_ptrace)))
+(allow vold self (cap_userns (kill sys_ptrace)))
+(allow vold kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold fsck_exec (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow vold fscklogs (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow vold fscklogs (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold labeledfs (filesystem (mount remount unmount)))
+(allow vold system_data_root_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold system_data_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold system_data_file (lnk_file (getattr)))
+(allow vold vendor_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold system_data_file (file (read)))
+(allow vold kernel (process (setsched)))
+(allow vold asec_image_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold asec_image_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow vold asec_apk_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold asec_public_file (dir (setattr relabelto)))
+(allow vold asec_apk_file (file (ioctl read getattr setattr lock relabelfrom relabelto map open watch watch_reads)))
+(allow vold asec_public_file (file (setattr relabelto)))
+(allow vold unlabeled (dir (ioctl read getattr setattr lock relabelfrom open watch watch_reads search)))
+(allow vold unlabeled (file (ioctl read getattr setattr lock relabelfrom map open watch watch_reads)))
+(allow vold fusectlfs (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold fusectlfs (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow vold sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold self (capability2 (block_suspend)))
+(allow vold self (cap2_userns (block_suspend)))
+(allow vold system_suspend_server (binder (call transfer)))
+(allow system_suspend_server vold (binder (transfer)))
+(allow vold system_suspend_server (fd (use)))
+(allow vold system_suspend_hwservice (hwservice_manager (find)))
+(allow vold hwservicemanager (binder (call transfer)))
+(allow hwservicemanager vold (binder (call transfer)))
+(allow hwservicemanager vold (dir (search)))
+(allow hwservicemanager vold (file (read map open)))
+(allow hwservicemanager vold (process (getattr)))
+(allow vold hwservicemanager_prop (file (read getattr map open)))
+(allow vold hidl_manager_hwservice (hwservice_manager (find)))
+(allow vold hal_system_suspend_service (service_manager (find)))
+(allow vold servicemanager (binder (call transfer)))
+(allow servicemanager vold (binder (call transfer)))
+(allow servicemanager vold (dir (search)))
+(allow servicemanager vold (file (read open)))
+(allow servicemanager vold (process (getattr)))
+(allow vold servicemanager (binder (call transfer)))
+(allow servicemanager vold (binder (call transfer)))
+(allow servicemanager vold (dir (search)))
+(allow servicemanager vold (file (read open)))
+(allow servicemanager vold (process (getattr)))
+(allow vold vold_service (service_manager (add find)))
+;;* lmx 296 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_296 vold_service (service_manager (add)))
+;;* lme
+
+(allow vold fwk_vold_service (service_manager (add find)))
+;;* lmx 297 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_296 fwk_vold_service (service_manager (add)))
+;;* lme
+
+(allow vold system_server (binder (call transfer)))
+(allow system_server vold (binder (transfer)))
+(allow vold system_server (fd (use)))
+(allow vold permission_service (service_manager (find)))
+(allow vold userdata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx vold userdata_block_device (ioctl blk_file (0x127d)))
+(allow vold zoned_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold metadata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allowx vold metadata_block_device (ioctl blk_file (0x127d)))
+(allow vold unencrypted_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold unencrypted_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold proc_drop_caches (file (write lock append map open)))
+(allow vold vold_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold vold_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold vold_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold vold_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow vold init (key (write search setattr)))
+(allow vold vold (key (write search setattr)))
+(allow vold self (capability (sys_nice)))
+(allow vold self (cap_userns (sys_nice)))
+(allow vold self (capability (sys_chroot)))
+(allow vold self (cap_userns (sys_chroot)))
+(allow vold storage_file (dir (mounton)))
+(allow vold fuse_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold fuse (filesystem (relabelfrom)))
+(allow vold app_fusefs (filesystem (relabelfrom relabelto)))
+(allow vold app_fusefs (filesystem (mount unmount)))
+(allow vold app_fuse_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow vold app_fuse_file (file (read write getattr append open)))
+(allow vold toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vold user_profile_root_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold user_profile_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold misc_block_device (blk_file (write lock append map open)))
+(allow vold mnt_vendor_file (dir (search)))
+(dontaudit vold self (capability (sys_resource)))
+(dontaudit vold self (cap_userns (sys_resource)))
+(dontaudit vold self (capability (sys_rawio)))
+(allow vold gsi_metadata_file_type (dir (search)))
+(allow vold metadata_file (dir (search)))
+(allow vold gsi_public_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_bootconfig (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold vendor_apex_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 388 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1047 vold_service (service_manager (find)))
+;;* lme
+
+;;* lmx 405 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_296 system_userdir_file (dir (write add_name remove_name)))
+(neverallow base_typeattr_296 vendor_userdir_file (dir (write add_name remove_name)))
+(neverallow base_typeattr_296 media_userdir_file (dir (write add_name remove_name)))
+;;* lme
+
+;;* lmx 414 system/sepolicy/private/vold.te
+
+(neverallowx base_typeattr_1048 data_file_type (ioctl dir (0x6613)))
+;;* lme
+
+;;* lmx 420 system/sepolicy/private/vold.te
+
+(neverallowx base_typeattr_296 data_file_type (ioctl dir ((range 0x6617 0x6618) 0x661a)))
+;;* lme
+
+;;* lmx 426 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1049 vold_data_file (dir (write lock append map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 433 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1050 vold_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 439 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_514 vold_metadata_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+;;* lmx 446 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1051 vold_data_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_1051 vold_data_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1051 vold_data_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1051 vold_data_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 453 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1050 vold_metadata_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_1050 vold_metadata_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1050 vold_metadata_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1050 vold_metadata_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 461 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_1052 vold_metadata_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_1052 vold_metadata_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1052 vold_metadata_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1052 vold_metadata_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1052 vold_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+(neverallow base_typeattr_1052 vold_data_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1052 vold_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+(neverallow base_typeattr_1052 vold_data_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 463 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_514 restorecon_prop (property_service (set)))
+;;* lme
+
+;;* lmx 476 system/sepolicy/private/vold.te
+
+(neverallow vold base_typeattr_1053 (binder (call)))
+;;* lme
+
+;;* lmx 478 system/sepolicy/private/vold.te
+
+(neverallow vold fsck_exec (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 479 system/sepolicy/private/vold.te
+
+(neverallow base_typeattr_235 vold (process (transition dyntransition)))
+;;* lme
+
+;;* lmx 480 system/sepolicy/private/vold.te
+
+(neverallow vold base_typeattr_236 (process (ptrace)))
+;;* lme
+
+;;* lmx 481 system/sepolicy/private/vold.te
+
+(neverallow vold base_typeattr_236 (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+;;* lme
+
+(allow vold vold_prepare_subdirs_exec (file (read getattr map execute open)))
+(allow vold vold_prepare_subdirs (process (transition)))
+(allow vold_prepare_subdirs vold_prepare_subdirs_exec (file (read getattr map execute open entrypoint)))
+(allow vold_prepare_subdirs vold (process (sigchld)))
+(dontaudit vold vold_prepare_subdirs (process (noatsecure)))
+(allow vold vold_prepare_subdirs (process (siginh rlimitinh)))
+(typetransition vold vold_prepare_subdirs_exec process vold_prepare_subdirs)
+(allow vold_prepare_subdirs system_file (file (execute_no_trans)))
+(allow vold_prepare_subdirs shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vold_prepare_subdirs toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow vold_prepare_subdirs devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow vold_prepare_subdirs vold (fd (use)))
+(allow vold_prepare_subdirs vold (fifo_file (read write)))
+(allow vold_prepare_subdirs file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold_prepare_subdirs seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold_prepare_subdirs self (capability (chown dac_override dac_read_search fowner)))
+(allow vold_prepare_subdirs self (cap_userns (chown dac_override dac_read_search fowner)))
+(allow vold_prepare_subdirs self (process (setfscreate)))
+(allow vold_prepare_subdirs system_data_file (dir (read write relabelfrom open add_name remove_name rmdir)))
+(allow vold_prepare_subdirs vendor_data_file (dir (read write relabelfrom open add_name remove_name rmdir)))
+(allow vold_prepare_subdirs sdk_sandbox_system_data_file (dir (read write relabelfrom open add_name remove_name rmdir)))
+(allow vold_prepare_subdirs apex_data_file_type (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs system_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs apex_module_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs apex_rollback_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs vold_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs backup_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs fingerprint_vendor_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs face_vendor_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs iris_vendor_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs storaged_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs sdk_sandbox_system_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs sdk_sandbox_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs rollback_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs checkin_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs storage_area_key_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow vold_prepare_subdirs apex_data_file_type (file (getattr unlink)))
+(allow vold_prepare_subdirs system_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs apex_module_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs apex_rollback_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs vold_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs backup_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs fingerprint_vendor_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs face_vendor_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs iris_vendor_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs storaged_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs sdk_sandbox_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs rollback_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs checkin_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs apex_art_staging_data_file (file (getattr unlink)))
+(allow vold_prepare_subdirs apex_mnt_dir (dir (read open)))
+(allow vold_prepare_subdirs mnt_expand_file (dir (search)))
+(allow vold_prepare_subdirs user_profile_data_file (dir (getattr relabelfrom search)))
+(allow vold_prepare_subdirs user_profile_root_file (dir (getattr relabelfrom relabelto search)))
+(allow vold_prepare_subdirs storage_area_app_dir (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink open watch watch_reads add_name remove_name search rmdir)))
+(allow vold_prepare_subdirs storage_area_dir (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink open watch watch_reads add_name remove_name search rmdir)))
+(typetransition vold_prepare_subdirs storage_area_app_dir dir storage_area_dir)
+(allow vold_prepare_subdirs selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow vold_prepare_subdirs selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold_prepare_subdirs selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow vold_prepare_subdirs selinuxfs (file (write lock append map open)))
+(allow vold_prepare_subdirs kernel (security (check_context)))
+(allowx vold_prepare_subdirs storage_area_dir (ioctl dir (0x6613)))
+;;* lmx 82 system/sepolicy/private/vold_prepare_subdirs.te
+
+(neverallowx vold_prepare_subdirs base_typeattr_1054 (ioctl dir (0x6613)))
+;;* lme
+
+(allow vold_prepare_subdirs apex_tethering_data_file (dir (relabelfrom)))
+(allow vold_prepare_subdirs apex_appsearch_data_file (dir (relabelfrom)))
+(allow vold_prepare_subdirs apex_permission_data_file (dir (relabelfrom)))
+(allow vold_prepare_subdirs apex_scheduling_data_file (dir (relabelfrom)))
+(allow vold_prepare_subdirs apex_wifi_data_file (dir (relabelfrom)))
+(allow vold_prepare_subdirs unlabeled (dir (search)))
+(dontaudit vold_prepare_subdirs proc (file (ioctl read getattr lock map open watch watch_reads)))
+(dontaudit vold_prepare_subdirs unlabeled (file (ioctl read getattr lock map open watch watch_reads)))
+(typetransition vzwomatrigger_app tmpfs file appdomain_tmpfs)
+(allow vzwomatrigger_app vzwomatrigger_app_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su vzwomatrigger_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 6 system/sepolicy/private/vzwomatrigger_app.te
+
+(neverallow base_typeattr_1055 vzwomatrigger_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow vzwomatrigger_app appdomain_tmpfs (file (read write getattr map execute)))
+;;* lmx 6 system/sepolicy/private/vzwomatrigger_app.te
+
+(neverallow base_typeattr_1056 base_typeattr_1055 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/vzwomatrigger_app.te
+
+(neverallow base_typeattr_1057 vzwomatrigger_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+;;* lmx 6 system/sepolicy/private/vzwomatrigger_app.te
+
+(neverallow base_typeattr_1058 vzwomatrigger_app (process (ptrace)))
+;;* lme
+
+(allow init watchdogd_exec (file (read getattr map execute open)))
+(allow init watchdogd (process (transition)))
+(allow watchdogd watchdogd_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init watchdogd (process (noatsecure)))
+(allow init watchdogd (process (siginh rlimitinh)))
+(typetransition init watchdogd_exec process watchdogd)
+(allow watchdogd watchdog_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow watchdogd kmsg_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
+(typetransition webview_zygote tmpfs file webview_zygote_tmpfs)
+(allow webview_zygote webview_zygote_tmpfs (file (read write getattr map)))
+(allow webview_zygote webview_zygote_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su webview_zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 13 system/sepolicy/private/webview_zygote.te
+
+(neverallow base_typeattr_1059 webview_zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow webview_zygote apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote apk_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow webview_zygote shared_relro_file (dir (search)))
+(allow webview_zygote shared_relro_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote self (capability (setgid setuid)))
+(allow webview_zygote self (cap_userns (setgid setuid)))
+(allow webview_zygote self (capability (setpcap)))
+(allow webview_zygote self (cap_userns (setpcap)))
+(allow webview_zygote self (process (setcurrent)))
+(allow webview_zygote isolated_app (process (dyntransition)))
+(allow webview_zygote dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote apex_art_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote dalvikcache_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow webview_zygote apex_art_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow webview_zygote apex_module_data_file (dir (search)))
+(allow webview_zygote vendor_apex_metadata_file (dir (search)))
+(allow webview_zygote self (process (execmem)))
+(allow webview_zygote debugfs_trace_marker (file (getattr)))
+(allow webview_zygote system_server (process (getpgid)))
+(allow webview_zygote isolated_app (process (setpgid)))
+(dontaudit webview_zygote mnt_expand_file (dir (getattr)))
+(dontaudit webview_zygote dex2oat_exec (file (execute)))
+(allow webview_zygote seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote selinuxfs (file (write lock append map open)))
+(allow webview_zygote kernel (security (check_context)))
+(allow webview_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote selinuxfs (file (write lock append map open)))
+(allow webview_zygote kernel (security (compute_av)))
+(allow webview_zygote self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow webview_zygote system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote zygote_tmpfs (file (read getattr)))
+(allow webview_zygote zygote (fd (use)))
+(allow webview_zygote zygote (process (sigchld)))
+(allow webview_zygote vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow webview_zygote vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote same_process_hal_file (file (read getattr map execute open)))
+(allow webview_zygote system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote system_unsolzygote_socket (sock_file (write)))
+(allow webview_zygote system_server (unix_dgram_socket (sendto)))
+(allow webview_zygote device_config_runtime_native_prop (file (read getattr map open)))
+(allow webview_zygote device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow zygote odsign_prop (file (read getattr map open)))
+(allow webview_zygote resourcecache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow webview_zygote resourcecache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+;;* lmx 105 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote base_typeattr_284 (process (dyntransition)))
+;;* lme
+
+;;* lmx 108 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote base_typeattr_285 (process (transition)))
+;;* lme
+
+;;* lmx 112 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote base_typeattr_236 (file (execute_no_trans)))
+;;* lme
+
+;;* lmx 116 system/sepolicy/private/webview_zygote.te
+
+(neverallow base_typeattr_286 webview_zygote (process (dyntransition)))
+;;* lme
+
+;;* lmx 119 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote property_socket (sock_file (write)))
+;;* lme
+
+;;* lmx 120 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote property_type (property_service (set)))
+;;* lme
+
+;;* lmx 123 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote app_data_file_type (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 129 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote base_typeattr_287 (service_manager (find)))
+;;* lme
+
+;;* lmx 132 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote gpu_device (chr_file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
+;;* lme
+
+;;* lmx 135 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
+;;* lme
+
+;;* lmx 136 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
+;;* lme
+
+;;* lmx 153 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote domain (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
+(neverallow webview_zygote domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow webview_zygote domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow webview_zygote domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_route_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv nlmsg_getneigh)))
+(neverallow webview_zygote domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow webview_zygote domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
+(neverallow webview_zygote domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
+(neverallow webview_zygote domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
+(neverallow webview_zygote domain (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
+(neverallow webview_zygote domain (icmp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
+(neverallow webview_zygote domain (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (vsock_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(neverallow webview_zygote domain (xdp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+;;* lme
+
+;;* lmx 162 system/sepolicy/private/webview_zygote.te
+
+(neverallow webview_zygote bluetooth_a2dp_offload_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow webview_zygote bluetooth_audio_hal_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow webview_zygote bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow webview_zygote exported_bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lme
+
+(allow wifi_mainline_supplicant servicemanager (binder (call transfer)))
+(allow servicemanager wifi_mainline_supplicant (binder (call transfer)))
+(allow servicemanager wifi_mainline_supplicant (dir (search)))
+(allow servicemanager wifi_mainline_supplicant (file (read open)))
+(allow servicemanager wifi_mainline_supplicant (process (getattr)))
+(allow init wifi_mainline_supplicant_exec (file (read getattr map execute open)))
+(allow init wifi_mainline_supplicant (process (transition)))
+(allow wifi_mainline_supplicant wifi_mainline_supplicant_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init wifi_mainline_supplicant (process (noatsecure)))
+(allow init wifi_mainline_supplicant (process (siginh rlimitinh)))
+(typetransition init wifi_mainline_supplicant_exec process wifi_mainline_supplicant)
+(allow wifi_mainline_supplicant wifi_mainline_supplicant_service (service_manager (add find)))
+;;* lmx 6 system/sepolicy/private/wifi_mainline_supplicant.te
+
+(neverallow base_typeattr_1060 wifi_mainline_supplicant_service (service_manager (add)))
+;;* lme
+
+(allow wifi_mainline_supplicant self (capability (setgid setuid net_admin net_raw)))
+(allow wifi_mainline_supplicant self (cap_userns (setgid setuid net_admin net_raw)))
+(allow wifi_mainline_supplicant proc_net (file (ioctl read write getattr lock append map open watch watch_reads)))
+(allow wifi_mainline_supplicant sysfs_net (dir (search)))
+(allow wifi_mainline_supplicant wifi_data_file (dir (getattr search)))
+(allow wifi_mainline_supplicant mainline_supplicant_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow wifi_mainline_supplicant mainline_supplicant_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow wifi_mainline_supplicant mainline_supplicant_data_file (sock_file (write create setattr unlink)))
+(allow wifi_mainline_supplicant self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx wifi_mainline_supplicant self (ioctl udp_socket (0x6900 0x6902)))
+(allowx wifi_mainline_supplicant self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx wifi_mainline_supplicant self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow wifi_mainline_supplicant self (packet_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx wifi_mainline_supplicant self (ioctl packet_socket ((range 0x5401 0x5404) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
+(allowx wifi_mainline_supplicant self (ioctl packet_socket (0x6900 0x6902)))
+(allowx wifi_mainline_supplicant self (ioctl packet_socket ((range 0x8906 0x8907) (range 0x890b 0x890d) (range 0x8910 0x8927) 0x8929 (range 0x8930 0x8939) (range 0x8940 0x8943) (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
+(allowx wifi_mainline_supplicant self (ioctl packet_socket ((range 0x8b00 0x8b02) (range 0x8b04 0x8b1d) (range 0x8b20 0x8b2d) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
+(allow wifi_mainline_supplicant self (netlink_route_socket (read write create bind nlmsg_write nlmsg_readpriv)))
+(allow wifi_mainline_supplicant self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow wifi_mainline_supplicant self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow wificond property_socket (sock_file (write)))
+(allow wificond init (unix_stream_socket (connectto)))
+(allow wificond wifi_hal_prop (property_service (set)))
+(allow wificond wifi_hal_prop (file (read getattr map open)))
+(allow wificond property_socket (sock_file (write)))
+(allow wificond init (unix_stream_socket (connectto)))
+(allow wificond wifi_prop (property_service (set)))
+(allow wificond wifi_prop (file (read getattr map open)))
+(allow wificond property_socket (sock_file (write)))
+(allow wificond init (unix_stream_socket (connectto)))
+(allow wificond ctl_default_prop (property_service (set)))
+(allow wificond ctl_default_prop (file (read getattr map open)))
+(allow wificond hwservicemanager_prop (file (read getattr map open)))
+(allow wificond legacykeystore_service (service_manager (find)))
+(allow init wificond_exec (file (read getattr map execute open)))
+(allow init wificond (process (transition)))
+(allow wificond wificond_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init wificond (process (noatsecure)))
+(allow init wificond (process (siginh rlimitinh)))
+(typetransition init wificond_exec process wificond)
+(allow wificond servicemanager (binder (call transfer)))
+(allow servicemanager wificond (binder (call transfer)))
+(allow servicemanager wificond (dir (search)))
+(allow servicemanager wificond (file (read open)))
+(allow servicemanager wificond (process (getattr)))
+(allow wificond system_server (binder (call transfer)))
+(allow system_server wificond (binder (transfer)))
+(allow wificond system_server (fd (use)))
+(allow wificond keystore (binder (call transfer)))
+(allow keystore wificond (binder (transfer)))
+(allow wificond keystore (fd (use)))
+(allow wificond wifinl80211_service (service_manager (add find)))
+;;* lmx 17 system/sepolicy/private/wificond.te
+
+(neverallow base_typeattr_1061 wifinl80211_service (service_manager (add)))
+;;* lme
+
+(allow wificond self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allowx wificond self (ioctl udp_socket (0x8914 0x8924)))
+(allow wificond self (capability (net_admin net_raw)))
+(allow wificond self (cap_userns (net_admin net_raw)))
+(allow wificond self (netlink_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow wificond self (netlink_generic_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
+(allow wificond proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow wificond proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
+(allow wificond proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow wificond permission_service (service_manager (find)))
+(allow wificond dumpstate (fd (use)))
+(allow wificond dumpstate (fifo_file (write)))
+(allow wificond hwservicemanager (binder (call transfer)))
+(allow hwservicemanager wificond (binder (call transfer)))
+(allow hwservicemanager wificond (dir (search)))
+(allow hwservicemanager wificond (file (read map open)))
+(allow hwservicemanager wificond (process (getattr)))
+(allow wificond system_wifi_keystore_hwservice (hwservice_manager (add find)))
+(allow wificond hidl_base_hwservice (hwservice_manager (add)))
+;;* lmx 42 system/sepolicy/private/wificond.te
+
+(neverallow base_typeattr_1061 system_wifi_keystore_hwservice (hwservice_manager (add)))
+;;* lme
+
+(allow wificond keystore_service (service_manager (find)))
+(allow wificond wifi_key (keystore2_key (get_info use)))
+(allow init zygote_exec (file (read getattr map execute open)))
+(allow init zygote (process (transition)))
+(allow zygote zygote_exec (file (read getattr map execute open entrypoint)))
+(dontaudit init zygote (process (noatsecure)))
+(allow init zygote (process (siginh rlimitinh)))
+(typetransition init zygote_exec process zygote)
+(typetransition zygote tmpfs file zygote_tmpfs)
+(allow zygote zygote_tmpfs (file (read write getattr map)))
+(allow zygote runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote self (capability (chown dac_override dac_read_search fowner setgid setuid)))
+(allow zygote self (cap_userns (chown dac_override dac_read_search fowner setgid setuid)))
+(allow zygote self (capability (setpcap)))
+(allow zygote self (cap_userns (setpcap)))
+(allow zygote self (process (setcurrent)))
+(allow zygote system_server_startup (process (dyntransition)))
+(allow zygote appdomain (process (dyntransition)))
+(allow zygote webview_zygote (process (dyntransition)))
+(allow zygote app_zygote (process (dyntransition)))
+(allow zygote appdomain (dir (getattr search)))
+(allow zygote appdomain (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote zygote_userfaultfd (anon_inode (ioctl read create)))
+(dontaudit su zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lmx 27 system/sepolicy/private/zygote.te
+
+(neverallow base_typeattr_286 zygote_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
+;;* lme
+
+(allow zygote system_server (process (getpgid setpgid)))
+(allow zygote appdomain (process (getpgid setpgid)))
+(allow zygote webview_zygote (process (getpgid setpgid)))
+(allow zygote app_zygote (process (getpgid setpgid)))
+(allow zygote system_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote system_data_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote mnt_expand_file (dir (getattr)))
+(allow zygote dalvikcache_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote dalvikcache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote dalvikcache_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote resourcecache_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
+(allow zygote resourcecache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote dalvikcache_data_file (file (execute)))
+(allow zygote apex_module_data_file (dir (search)))
+(allow zygote apex_art_data_file (dir (getattr search)))
+(allow zygote apex_art_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
+(allow zygote properties_device (dir (mounton search)))
+(allow zygote system_data_file (dir (mounton search)))
+(allow zygote system_userdir_file (dir (mounton search)))
+(allow zygote user_profile_root_file (dir (mounton search)))
+(allow zygote user_profile_data_file (dir (mounton search)))
+(allow zygote media_rw_data_file (dir (mounton search)))
+(allow zygote mirror_data_file (dir (search)))
+(allow zygote mnt_expand_file (dir (read open search)))
+(allow zygote app_data_file_type (dir (getattr)))
+(allow zygote tmpfs (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote tmpfs (lnk_file (create)))
+(allow zygote tmpfs (dir (relabelfrom)))
+(allow zygote tmpfs (lnk_file (relabelfrom)))
+(allow zygote system_userdir_file (dir (relabelto)))
+(allow zygote system_data_file (dir (relabelto)))
+(allow zygote system_data_file (lnk_file (relabelto)))
+(allow zygote sdk_sandbox_system_data_file (dir (getattr relabelto search)))
+(allow zygote proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote self (process (execmem)))
+(allow zygote zygote_tmpfs (file (execute)))
+(allow zygote ashmem_libcutils_device (chr_file (execute)))
+(allow zygote idmap_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow zygote dex2oat_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow zygote vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote cgroup (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote cgroup (file (ioctl read getattr setattr lock map open watch watch_reads)))
+(allow zygote cgroup (lnk_file (ioctl read getattr setattr lock map open watch watch_reads)))
+(allow zygote cgroup_v2 (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote cgroup_v2 (file (ioctl read getattr setattr lock map open watch watch_reads)))
+(allow zygote cgroup_v2 (lnk_file (ioctl read getattr setattr lock map open watch watch_reads)))
+(allow zygote self (capability (sys_admin)))
+(allow zygote self (cap_userns (sys_admin)))
+(allow zygote pmsg_device (chr_file (getattr)))
+(allow zygote debugfs_trace_marker (file (getattr)))
+(allow zygote seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote selinuxfs (file (write lock append map open)))
+(allow zygote kernel (security (check_context)))
+(allow zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote selinuxfs (file (write lock append map open)))
+(allow zygote kernel (security (compute_av)))
+(allow zygote self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
+(allow zygote proc_cpuinfo (file (mounton)))
+(allow zygote rootfs (dir (mounton)))
+(allow zygote tmpfs (filesystem (mount unmount)))
+(allow zygote fuse (filesystem (unmount)))
+(allow zygote sdcardfs (filesystem (unmount)))
+(allow zygote labeledfs (filesystem (unmount)))
+(allow zygote mnt_user_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote mnt_user_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote mnt_user_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote mnt_pass_through_file (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote storage_file (dir (mounton search)))
+(allow zygote sdcard_type (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote fuse (dir (ioctl read write create getattr setattr lock rename mounton open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow zygote sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote fuse (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow zygote zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
+(allow zygote statsdw_socket (sock_file (write)))
+(allow zygote statsd (unix_dgram_socket (sendto)))
+(allow zygote rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote rootfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote system_file (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote system_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote oemfs (dir (search)))
+(allow zygote ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote tmpfs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote same_process_hal_file (file (read getattr map execute open)))
+(allow zygote build_attestation_prop (file (read getattr map open)))
+(allow zygote storage_config_prop (file (read getattr map open)))
+(allow zygote overlay_prop (file (read getattr map open)))
+(allow zygote exported_overlay_prop (file (read getattr map open)))
+(allow zygote device_config_runtime_native_prop (file (read getattr map open)))
+(allow zygote device_config_runtime_native_boot_prop (file (read getattr map open)))
+(allow zygote device_config_window_manager_native_boot_prop (file (read getattr map open)))
+(dontaudit zygote self (capability (fsetid sys_resource)))
+(dontaudit zygote self (cap_userns (fsetid sys_resource)))
+(dontaudit zygote media_rw_data_file (dir (read setattr open)))
+(allow zygote system_server (fd (use)))
+(allow zygote system_unsolzygote_socket (sock_file (write)))
+(allow zygote system_server (unix_dgram_socket (sendto)))
+(allow zygote media_variant_prop (file (read getattr map open)))
+(allow zygote odsign_prop (file (read getattr map open)))
+(allow zygote packagemanager_config_prop (file (read getattr map open)))
+(allow zygote qemu_sf_lcd_density_prop (file (read getattr map open)))
+(allow zygote persist_wm_debug_prop (file (read getattr map open)))
+(allow zygote persist_sysui_builder_extras_prop (file (read getattr map open)))
+(allow zygote persist_sysui_ranking_update_prop (file (read getattr map open)))
+(allow zygote apex_info_file (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote vendor_apex_file (dir (getattr search)))
+(allow zygote vendor_apex_file (file (getattr)))
+(allow zygote vendor_apex_metadata_file (dir (search)))
+(allow zygote sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
+(allow zygote sysfs_fs_f2fs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote sysfs_fs_f2fs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
+(allow zygote system_font_fallback_file (file (ioctl read getattr lock map open watch watch_reads)))
+;;* lmx 289 system/sepolicy/private/zygote.te
+
+(neverallow zygote base_typeattr_1062 (process (dyntransition)))
+;;* lme
+
+;;* lmx 298 system/sepolicy/private/zygote.te
+
+(neverallow zygote base_typeattr_1063 (file (execute execute_no_trans)))
+;;* lme
+
+;;* lmx 306 system/sepolicy/private/zygote.te
+
+(neverallow zygote bluetooth_a2dp_offload_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow zygote bluetooth_audio_hal_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow zygote bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(neverallow zygote exported_bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+;;* lme
+
+;;* lmx 309 system/sepolicy/private/zygote.te
+
+(neverallow zygote app_data_file_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
+;;* lme
+
+(typetransition zygote zygote anon_inode "[userfaultfd]" zygote_userfaultfd)
+(typetransition webview_zygote webview_zygote anon_inode "[userfaultfd]" webview_zygote_userfaultfd)
+(typetransition vzwomatrigger_app vzwomatrigger_app anon_inode "[userfaultfd]" vzwomatrigger_app_userfaultfd)
+(typetransition vmlauncher_app vmlauncher_app anon_inode "[userfaultfd]" vmlauncher_app_userfaultfd)
+(typetransition untrusted_app_32 untrusted_app_32 anon_inode "[userfaultfd]" untrusted_app_32_userfaultfd)
+(typetransition untrusted_app_30 untrusted_app_30 anon_inode "[userfaultfd]" untrusted_app_30_userfaultfd)
+(typetransition untrusted_app_29 untrusted_app_29 anon_inode "[userfaultfd]" untrusted_app_29_userfaultfd)
+(typetransition untrusted_app_27 untrusted_app_27 anon_inode "[userfaultfd]" untrusted_app_27_userfaultfd)
+(typetransition untrusted_app_25 untrusted_app_25 anon_inode "[userfaultfd]" untrusted_app_25_userfaultfd)
+(typetransition untrusted_app untrusted_app anon_inode "[userfaultfd]" untrusted_app_userfaultfd)
+(typetransition traceur_app traceur_app anon_inode "[userfaultfd]" traceur_app_userfaultfd)
+(typetransition system_server system_data_file sock_file "unsolzygotesocket" system_unsolzygote_socket)
+(typetransition system_server system_data_file sock_file "ndebugsocket" system_ndebug_socket)
+(typetransition system_server system_server anon_inode "[userfaultfd]" system_server_userfaultfd)
+(typetransition system_app system_app anon_inode "[userfaultfd]" system_app_userfaultfd)
+(typetransition statsd statsd anon_inode "[io_uring]" statsd_iouring)
+(typetransition snapuserd snapuserd anon_inode "[io_uring]" snapuserd_iouring)
+(typetransition simpleperf simpleperf anon_inode "[userfaultfd]" simpleperf_userfaultfd)
+(typetransition shell shell anon_inode "[userfaultfd]" shell_userfaultfd)
+(typetransition shared_relro shared_relro anon_inode "[userfaultfd]" shared_relro_userfaultfd)
+(typetransition secure_element secure_element anon_inode "[userfaultfd]" secure_element_userfaultfd)
+(typetransition sdk_sandbox_next sdk_sandbox_next anon_inode "[userfaultfd]" sdk_sandbox_next_userfaultfd)
+(typetransition sdk_sandbox_audit sdk_sandbox_audit anon_inode "[userfaultfd]" sdk_sandbox_audit_userfaultfd)
+(typetransition sdk_sandbox_34 sdk_sandbox_34 anon_inode "[userfaultfd]" sdk_sandbox_34_userfaultfd)
+(typetransition runas_app runas_app anon_inode "[userfaultfd]" runas_app_userfaultfd)
+(typetransition rkpdapp rkpdapp anon_inode "[userfaultfd]" rkpdapp_userfaultfd)
+(typetransition radio radio anon_inode "[userfaultfd]" radio_userfaultfd)
+(typetransition priv_app priv_app anon_inode "[userfaultfd]" priv_app_userfaultfd)
+(typetransition platform_app platform_app anon_inode "[userfaultfd]" platform_app_userfaultfd)
+(typetransition permissioncontroller_app permissioncontroller_app anon_inode "[userfaultfd]" permissioncontroller_app_userfaultfd)
+(typetransition odrefresh odrefresh anon_inode "[userfaultfd]" odrefresh_userfaultfd)
+(typetransition nfc nfc anon_inode "[userfaultfd]" nfc_userfaultfd)
+(typetransition network_stack network_stack anon_inode "[userfaultfd]" network_stack_userfaultfd)
+(typetransition mediaprovider_app mediaprovider_app anon_inode "[userfaultfd]" mediaprovider_app_userfaultfd)
+(typetransition mediaprovider mediaprovider anon_inode "[userfaultfd]" mediaprovider_userfaultfd)
+(typetransition isolated_compute_app isolated_compute_app anon_inode "[userfaultfd]" isolated_compute_app_userfaultfd)
+(typetransition isolated_app isolated_app anon_inode "[userfaultfd]" isolated_app_userfaultfd)
+(typetransition gmscore_app gmscore_app anon_inode "[userfaultfd]" gmscore_app_userfaultfd)
+(typetransition fastbootd fastbootd anon_inode "[io_uring]" fastbootd_iouring)
+(typetransition ephemeral_app ephemeral_app anon_inode "[userfaultfd]" ephemeral_app_userfaultfd)
+(typetransition dexopt_chroot_setup dexopt_chroot_setup anon_inode "[userfaultfd]" dexopt_chroot_setup_userfaultfd)
+(typetransition dex2oat dex2oat anon_inode "[userfaultfd]" dex2oat_userfaultfd)
+(typetransition device_as_webcam device_as_webcam anon_inode "[userfaultfd]" device_as_webcam_userfaultfd)
+(typetransition bluetooth bluetooth anon_inode "[userfaultfd]" bluetooth_userfaultfd)
+(typetransition artd artd anon_inode "[userfaultfd]" artd_userfaultfd)
+(typetransition app_zygote app_zygote anon_inode "[userfaultfd]" app_zygote_userfaultfd)
+(typeattribute base_typeattr_1063)
+(typeattributeset base_typeattr_1063 (and (data_file_type ) (not (dalvikcache_data_file apex_art_data_file ))))
+(typeattribute base_typeattr_1062)
+(typeattributeset base_typeattr_1062 (not (appdomain app_zygote webview_zygote system_server_startup ) ))
+(typeattribute base_typeattr_1061)
+(typeattributeset base_typeattr_1061 (and (domain ) (not (wificond ))))
+(typeattribute base_typeattr_1060)
+(typeattributeset base_typeattr_1060 (and (domain ) (not (wifi_mainline_supplicant ))))
+(typeattribute base_typeattr_1059)
+(typeattributeset base_typeattr_1059 (and (domain ) (not (webview_zygote ))))
+(typeattribute base_typeattr_1058)
+(typeattributeset base_typeattr_1058 (and (domain ) (not (crash_dump runas_app simpleperf vzwomatrigger_app ))))
+(typeattribute base_typeattr_1057)
+(typeattributeset base_typeattr_1057 (and (appdomain ) (not (runas_app shell simpleperf vzwomatrigger_app ))))
+(typeattribute base_typeattr_1056)
+(typeattributeset base_typeattr_1056 (and (vzwomatrigger_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1055)
+(typeattributeset base_typeattr_1055 (and (domain ) (not (vzwomatrigger_app ))))
+(typeattribute base_typeattr_1054)
+(typeattributeset base_typeattr_1054 (and (data_file_type ) (not (storage_area_dir ))))
+(typeattribute base_typeattr_1053)
+(typeattributeset base_typeattr_1053 (and (domain ) (not (hal_bootctl_server hal_health_storage_server hal_keymaster_server system_suspend_server hwservicemanager keystore servicemanager system_server ))))
+(typeattribute base_typeattr_1052)
+(typeattributeset base_typeattr_1052 (and (domain ) (not (init kernel vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_1051)
+(typeattributeset base_typeattr_1051 (and (domain ) (not (kernel vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_1050)
+(typeattributeset base_typeattr_1050 (and (domain ) (not (init vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_1049)
+(typeattributeset base_typeattr_1049 (and (domain ) (not (vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_1048)
+(typeattributeset base_typeattr_1048 (and (domain ) (not (init vendor_init vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_1047)
+(typeattributeset base_typeattr_1047 (and (domain ) (not (apexd system_server update_verifier vdc vold gsid ))))
+(typeattribute base_typeattr_1046)
+(typeattributeset base_typeattr_1046 (and (sysfs_type ) (not (sysfs_batteryinfo ))))
+(typeattribute base_typeattr_1045)
+(typeattributeset base_typeattr_1045 (and (domain ) (not (servicemanager virtualizationservice ))))
+(typeattribute base_typeattr_1044)
+(typeattributeset base_typeattr_1044 (and (domain ) (not (vmnic ))))
+(typeattribute base_typeattr_1043)
+(typeattributeset base_typeattr_1043 (and (domain ) (not (crash_dump runas_app simpleperf vmlauncher_app ))))
+(typeattribute base_typeattr_1042)
+(typeattributeset base_typeattr_1042 (and (appdomain ) (not (runas_app shell simpleperf vmlauncher_app ))))
+(typeattribute base_typeattr_1041)
+(typeattributeset base_typeattr_1041 (and (vmlauncher_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1040)
+(typeattributeset base_typeattr_1040 (and (domain ) (not (vmlauncher_app ))))
+(typeattribute base_typeattr_1039)
+(typeattributeset base_typeattr_1039 (and (domain ) (not (servicemanager virtualizationmanager virtualizationservice ))))
+(typeattribute base_typeattr_1038)
+(typeattributeset base_typeattr_1038 (and (domain ) (not (crosvm virtualizationmanager virtualizationservice ))))
+(typeattribute base_typeattr_1037)
+(typeattributeset base_typeattr_1037 (and (domain ) (not (init virtualizationmanager virtualizationservice ))))
+(typeattribute base_typeattr_1036)
+(typeattributeset base_typeattr_1036 (and (domain ) (not (init virtualizationservice ))))
+(typeattribute base_typeattr_1035)
+(typeattributeset base_typeattr_1035 (and (domain ) (not (dumpstate virtualizationservice ))))
+(typeattribute base_typeattr_1034)
+(typeattributeset base_typeattr_1034 (and (domain ) (not (virtualizationservice ))))
+(typeattribute base_typeattr_1033)
+(typeattributeset base_typeattr_1033 (and (domain ) (not (dumpstate early_virtmgr init ))))
+(typeattribute base_typeattr_1032)
+(typeattributeset base_typeattr_1032 (and (domain ) (not (virtualizationmanager ))))
+(typeattribute base_typeattr_1031)
+(typeattributeset base_typeattr_1031 (and (domain ) (not (virtual_touchpad ))))
+(typeattribute base_typeattr_1030)
+(typeattributeset base_typeattr_1030 (and (domain ) (not (virtual_camera ))))
+(typeattribute base_typeattr_1029)
+(typeattributeset base_typeattr_1029 (and (domain ) (not (vfio_handler ))))
+(typeattribute base_typeattr_1028)
+(typeattributeset base_typeattr_1028 (and (coredomain ) (not (init modprobe ))))
+(typeattribute base_typeattr_1027)
+(typeattributeset base_typeattr_1027 (and (domain ) (not (init logd prng_seeder su vendor_init ))))
+(typeattribute base_typeattr_1026)
+(typeattributeset base_typeattr_1026 (and (sysfs_type ) (not (sysfs_usermodehelper ))))
+(typeattribute base_typeattr_1025)
+(typeattributeset base_typeattr_1025 (and (fs_type ) (not (bpffs_type contextmount_type fusefs_type sdcard_type rootfs proc_uid_time_in_state proc_uid_concurrent_active_time proc_uid_concurrent_policy_time ))))
+(typeattribute base_typeattr_1024)
+(typeattributeset base_typeattr_1024 (and (fs_type ) (not (bpffs_type contextmount_type fusefs_type debugfs_type sdcard_type keychord_device rootfs proc_kallsyms proc_uid_time_in_state proc_uid_concurrent_active_time proc_uid_concurrent_policy_time ))))
+(typeattribute base_typeattr_1023)
+(typeattributeset base_typeattr_1023 (and (file_type ) (not (bpffs_type exec_type core_data_file_type system_file_type system_dlkm_file_type vendor_file_type gsi_metadata_file_type vold_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file userspace_reboot_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file mnt_product_file ))))
+(typeattribute base_typeattr_1022)
+(typeattributeset base_typeattr_1022 (and (file_type ) (not (bpffs_type exec_type core_data_file_type system_file_type system_dlkm_file_type vendor_file_type gsi_metadata_file_type unlabeled vold_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file userspace_reboot_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file apex_mnt_dir ))))
+(typeattribute base_typeattr_1021)
+(typeattributeset base_typeattr_1021 (and (file_type ) (not (bpffs_type exec_type core_data_file_type system_file_type system_dlkm_file_type vendor_file_type gsi_metadata_file_type unlabeled vold_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file userspace_reboot_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file ))))
+(typeattribute base_typeattr_1020)
+(typeattributeset base_typeattr_1020 (and (file_type ) (not (bpffs_type exec_type core_data_file_type system_file_type system_dlkm_file_type vendor_file_type debugfs_type gsi_metadata_file_type proc_kallsyms unlabeled vold_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file userspace_reboot_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file runtime_event_log_tags_file apex_info_file tradeinmode_metadata_file ))))
+(typeattribute base_typeattr_1019)
+(typeattributeset base_typeattr_1019 (and (file_type ) (not (bpffs_type exec_type core_data_file_type system_file_type system_dlkm_file_type vendor_file_type gsi_metadata_file_type unlabeled vold_metadata_file password_slot_metadata_file apex_metadata_file ota_metadata_file userspace_reboot_metadata_file aconfig_storage_metadata_file aconfig_storage_flags_metadata_file mnt_product_file ))))
+(typeattribute base_typeattr_1018)
+(typeattributeset base_typeattr_1018 (and (dev_type ) (not (vm_manager_device_type keychord_device hw_random_device port_device lowpan_device ))))
+(typeattribute base_typeattr_1017)
+(typeattributeset base_typeattr_1017 (and (domain ) (not (update_engine ))))
+(typeattribute base_typeattr_1016)
+(typeattributeset base_typeattr_1016 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app_32 ))))
+(typeattribute base_typeattr_1015)
+(typeattributeset base_typeattr_1015 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app_32 ))))
+(typeattribute base_typeattr_1014)
+(typeattributeset base_typeattr_1014 (and (untrusted_app_32 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1013)
+(typeattributeset base_typeattr_1013 (and (domain ) (not (untrusted_app_32 ))))
+(typeattribute base_typeattr_1012)
+(typeattributeset base_typeattr_1012 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app_30 ))))
+(typeattribute base_typeattr_1011)
+(typeattributeset base_typeattr_1011 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app_30 ))))
+(typeattribute base_typeattr_1010)
+(typeattributeset base_typeattr_1010 (and (untrusted_app_30 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1009)
+(typeattributeset base_typeattr_1009 (and (domain ) (not (untrusted_app_30 ))))
+(typeattribute base_typeattr_1008)
+(typeattributeset base_typeattr_1008 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app_29 ))))
+(typeattribute base_typeattr_1007)
+(typeattributeset base_typeattr_1007 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app_29 ))))
+(typeattribute base_typeattr_1006)
+(typeattributeset base_typeattr_1006 (and (untrusted_app_29 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1005)
+(typeattributeset base_typeattr_1005 (and (domain ) (not (untrusted_app_29 ))))
+(typeattribute base_typeattr_1004)
+(typeattributeset base_typeattr_1004 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app_27 ))))
+(typeattribute base_typeattr_1003)
+(typeattributeset base_typeattr_1003 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app_27 ))))
+(typeattribute base_typeattr_1002)
+(typeattributeset base_typeattr_1002 (and (untrusted_app_27 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_1001)
+(typeattributeset base_typeattr_1001 (and (domain ) (not (untrusted_app_27 ))))
+(typeattribute base_typeattr_1000)
+(typeattributeset base_typeattr_1000 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app_25 ))))
+(typeattribute base_typeattr_999)
+(typeattributeset base_typeattr_999 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app_25 ))))
+(typeattribute base_typeattr_998)
+(typeattributeset base_typeattr_998 (and (untrusted_app_25 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_997)
+(typeattributeset base_typeattr_997 (and (domain ) (not (untrusted_app_25 ))))
+(typeattribute base_typeattr_996)
+(typeattributeset base_typeattr_996 (and (domain ) (not (crash_dump runas_app simpleperf untrusted_app ))))
+(typeattribute base_typeattr_995)
+(typeattributeset base_typeattr_995 (and (appdomain ) (not (runas_app shell simpleperf untrusted_app ))))
+(typeattribute base_typeattr_994)
+(typeattributeset base_typeattr_994 (and (untrusted_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_993)
+(typeattributeset base_typeattr_993 (and (domain ) (not (untrusted_app ))))
+(typeattribute base_typeattr_992)
+(typeattributeset base_typeattr_992 (and (vendor_file_type ) (not (vendor_app_file vendor_overlay_file ))))
+(typeattribute base_typeattr_991)
+(typeattributeset base_typeattr_991 (and (service_manager_type ) (not (apex_service default_android_service dnsresolver_service gatekeeper_service incident_service installd_service lpdump_service mdns_service netd_service virtual_touchpad_service vold_service ))))
+(typeattribute base_typeattr_990)
+(typeattributeset base_typeattr_990 (and (domain ) (not (crash_dump runas_app simpleperf traceur_app ))))
+(typeattribute base_typeattr_989)
+(typeattributeset base_typeattr_989 (and (appdomain ) (not (runas_app shell simpleperf traceur_app ))))
+(typeattribute base_typeattr_988)
+(typeattributeset base_typeattr_988 (and (traceur_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_987)
+(typeattributeset base_typeattr_987 (and (domain ) (not (traceur_app ))))
+(typeattribute base_typeattr_986)
+(typeattributeset base_typeattr_986 (and (data_file_type ) (not (packages_list_file game_mode_intervention_list_file ))))
+(typeattribute base_typeattr_985)
+(typeattributeset base_typeattr_985 (and (data_file_type ) (not (system_data_root_file system_data_file system_userdir_file vendor_data_file vendor_userdir_file apk_data_file dalvikcache_data_file user_profile_root_file user_profile_data_file apex_module_data_file bootstat_data_file media_userdir_file update_engine_data_file update_engine_log_data_file system_app_data_file backup_data_file apex_art_data_file ))))
+(typeattribute base_typeattr_984)
+(typeattributeset base_typeattr_984 (and (domain ) (not (dumpstate perfetto platform_app shell system_server traced traceur_app ))))
+(typeattribute base_typeattr_983)
+(typeattributeset base_typeattr_983 (and (data_file_type ) (not (trace_data_file perfetto_traces_data_file ))))
+(typeattribute base_typeattr_982)
+(typeattributeset base_typeattr_982 (and (data_file_type ) (not (system_data_root_file system_data_file system_userdir_file vendor_data_file vendor_userdir_file media_userdir_file perfetto_traces_data_file ))))
+(typeattribute base_typeattr_981)
+(typeattributeset base_typeattr_981 (and (fs_type file_type ) (not (toolbox_exec ))))
+(typeattribute base_typeattr_980)
+(typeattributeset base_typeattr_980 (and (domain ) (not (dumpstate init tombstoned vendor_init ))))
+(typeattribute base_typeattr_979)
+(typeattributeset base_typeattr_979 (and (domain ) (not (system_suspend_server ))))
+(typeattribute base_typeattr_978)
+(typeattributeset base_typeattr_978 (and (domain ) (not (system_suspend_internal_server atrace dumpstate system_server traced_probes traceur_app ))))
+(typeattribute base_typeattr_977)
+(typeattributeset base_typeattr_977 (and (domain ) (not (system_suspend_internal_server ))))
+(typeattribute base_typeattr_976)
+(typeattributeset base_typeattr_976 (and (domain ) (not (atrace bluetooth dumpstate system_server traceur_app system_suspend ))))
+(typeattribute base_typeattr_975)
+(typeattributeset base_typeattr_975 (and (domain ) (not (system_suspend ))))
+(typeattribute base_typeattr_974)
+(typeattributeset base_typeattr_974 (and (domain ) (not (init shell system_server vendor_init ))))
+(typeattribute base_typeattr_973)
+(typeattributeset base_typeattr_973 (and (domain ) (not (init system_server ueventd vendor_init ))))
+(typeattribute base_typeattr_972)
+(typeattributeset base_typeattr_972 (and (dev_type ) (not (vd_device frp_block_device ))))
+(typeattribute base_typeattr_971)
+(typeattributeset base_typeattr_971 (and (dev_type ) (not (frp_block_device ))))
+(typeattribute base_typeattr_970)
+(typeattributeset base_typeattr_970 (and (domain ) (not (flags_health_check init system_server ))))
+(typeattribute base_typeattr_969)
+(typeattributeset base_typeattr_969 (and (domain ) (not (app_zygote init system_server webview_zygote zygote ))))
+(typeattribute base_typeattr_968)
+(typeattributeset base_typeattr_968 (and (domain ) (not (crash_dump init system_server ))))
+(typeattribute base_typeattr_967)
+(typeattributeset base_typeattr_967 (and (domain ) (not (crash_dump perfetto clatd trace_redactor ))))
+(typeattribute base_typeattr_966)
+(typeattributeset base_typeattr_966 (and (file_type ) (not (logcat_exec toolbox_exec ))))
+(typeattribute base_typeattr_965)
+(typeattributeset base_typeattr_965 (and (app_data_file_type ) (not (radio_data_file system_app_data_file ))))
+(typeattribute base_typeattr_964)
+(typeattributeset base_typeattr_964 (and (domain ) (not (init system_app ))))
+(typeattribute base_typeattr_963)
+(typeattributeset base_typeattr_963 (and (service_manager_type ) (not (apex_service default_android_service dnsresolver_service dumpstate_service installd_service lpdump_service mdns_service netd_service system_suspend_control_internal_service system_suspend_control_service virtual_touchpad_service vold_service tracingproxy_service ))))
+(typeattribute base_typeattr_962)
+(typeattributeset base_typeattr_962 (and (domain ) (not (crash_dump runas_app simpleperf system_app ))))
+(typeattribute base_typeattr_961)
+(typeattributeset base_typeattr_961 (and (appdomain ) (not (runas_app shell simpleperf system_app ))))
+(typeattribute base_typeattr_960)
+(typeattributeset base_typeattr_960 (and (system_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_959)
+(typeattributeset base_typeattr_959 (and (domain ) (not (system_app ))))
+(typeattribute base_typeattr_958)
+(typeattributeset base_typeattr_958 (and (domain ) (not (surfaceflinger ))))
+(typeattribute base_typeattr_957)
+(typeattributeset base_typeattr_957 (and (domain ) (not (storaged ))))
+(typeattribute base_typeattr_956)
+(typeattributeset base_typeattr_956 (and (domain ) (not (init statsd system_server vold ))))
+(typeattribute base_typeattr_955)
+(typeattributeset base_typeattr_955 (and (domain ) (not (init statsd vold ))))
+(typeattribute base_typeattr_954)
+(typeattributeset base_typeattr_954 (and (domain ) (not (stats_service_server ))))
+(typeattribute base_typeattr_953)
+(typeattributeset base_typeattr_953 (and (domain ) (not (statsd ))))
+(typeattribute base_typeattr_952)
+(typeattributeset base_typeattr_952 (and (domain ) (not (fastbootd init recovery shell update_engine snapshotctl ))))
+(typeattribute base_typeattr_951)
+(typeattributeset base_typeattr_951 (and (domain ) (not (snapuserd ))))
+(typeattribute base_typeattr_950)
+(typeattributeset base_typeattr_950 (and (domain ) (not (init snapuserd ))))
+(typeattribute base_typeattr_949)
+(typeattributeset base_typeattr_949 (and (simpleperf ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_948)
+(typeattributeset base_typeattr_948 (and (domain ) (not (simpleperf ))))
+(typeattribute base_typeattr_947)
+(typeattributeset base_typeattr_947 (and (untrusted_app_all ephemeral_app isolated_app platform_app priv_app ) (not (runas_app ))))
+(typeattribute base_typeattr_946)
+(typeattributeset base_typeattr_946 (and (domain ) (not (dumpstate init shell ))))
+(typeattribute base_typeattr_945)
+(typeattributeset base_typeattr_945 (and (service_manager_type ) (not (apex_service default_android_service dnsresolver_service gatekeeper_service incident_service installd_service mdns_service netd_service system_suspend_control_internal_service system_suspend_control_service virtualization_service virtual_touchpad_service vold_service hal_keymint_service hal_secureclock_service hal_sharedsecret_service ))))
+(typeattribute base_typeattr_944)
+(typeattributeset base_typeattr_944 (and (domain ) (not (crash_dump runas_app shell simpleperf ))))
+(typeattribute base_typeattr_943)
+(typeattributeset base_typeattr_943 (and (shell ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_942)
+(typeattributeset base_typeattr_942 (and (domain ) (not (shell ))))
+(typeattribute base_typeattr_941)
+(typeattributeset base_typeattr_941 (and (domain ) (not (crash_dump runas_app shared_relro simpleperf ))))
+(typeattribute base_typeattr_940)
+(typeattributeset base_typeattr_940 (and (appdomain ) (not (runas_app shared_relro shell simpleperf ))))
+(typeattribute base_typeattr_939)
+(typeattributeset base_typeattr_939 (and (shared_relro ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_938)
+(typeattributeset base_typeattr_938 (and (domain ) (not (shared_relro ))))
+(typeattribute base_typeattr_937)
+(typeattributeset base_typeattr_937 (and (fs_type file_type ) (not (sgdisk_exec ))))
+(typeattribute base_typeattr_936)
+(typeattributeset base_typeattr_936 (and (domain ) (not (servicemanager ))))
+(typeattribute base_typeattr_935)
+(typeattributeset base_typeattr_935 (and (domain ) (not (hwservicemanager init vendor_init vndservicemanager ))))
+(typeattribute base_typeattr_934)
+(typeattributeset base_typeattr_934 (not (service_manager_type vndservice_manager_type ) ))
+(typeattribute base_typeattr_933)
+(typeattributeset base_typeattr_933 (and (domain ) (not (sensor_service_server ))))
+(typeattribute base_typeattr_932)
+(typeattributeset base_typeattr_932 (and (domain ) (not (crash_dump runas_app secure_element simpleperf ))))
+(typeattribute base_typeattr_931)
+(typeattributeset base_typeattr_931 (and (appdomain ) (not (runas_app secure_element shell simpleperf ))))
+(typeattribute base_typeattr_930)
+(typeattributeset base_typeattr_930 (and (secure_element ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_929)
+(typeattributeset base_typeattr_929 (and (domain ) (not (secure_element ))))
+(typeattribute base_typeattr_928)
+(typeattributeset base_typeattr_928 (and (domain ) (not (crash_dump runas_app simpleperf sdk_sandbox_next ))))
+(typeattribute base_typeattr_927)
+(typeattributeset base_typeattr_927 (and (appdomain ) (not (runas_app shell simpleperf sdk_sandbox_next ))))
+(typeattribute base_typeattr_926)
+(typeattributeset base_typeattr_926 (and (sdk_sandbox_next ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_925)
+(typeattributeset base_typeattr_925 (and (domain ) (not (sdk_sandbox_next ))))
+(typeattribute base_typeattr_924)
+(typeattributeset base_typeattr_924 (and (property_type ) (not (system_property_type ))))
+(typeattribute base_typeattr_923)
+(typeattributeset base_typeattr_923 (and (domain ) (not (crash_dump runas_app simpleperf sdk_sandbox_audit ))))
+(typeattribute base_typeattr_922)
+(typeattributeset base_typeattr_922 (and (appdomain ) (not (runas_app shell simpleperf sdk_sandbox_audit ))))
+(typeattribute base_typeattr_921)
+(typeattributeset base_typeattr_921 (and (sdk_sandbox_audit ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_920)
+(typeattributeset base_typeattr_920 (and (domain ) (not (sdk_sandbox_audit ))))
+(typeattribute base_typeattr_919)
+(typeattributeset base_typeattr_919 (and (domain ) (not (adbd sdk_sandbox_all ))))
+(typeattribute base_typeattr_918)
+(typeattributeset base_typeattr_918 (and (domain ) (not (adbd heapprofd logd netd prng_seeder tombstoned traced traced_perf sdk_sandbox_all ))))
+(typeattribute base_typeattr_917)
+(typeattributeset base_typeattr_917 (and (domain ) (not (init installd system_server vold_prepare_subdirs zygote sdk_sandbox_all ))))
+(typeattribute base_typeattr_916)
+(typeattributeset base_typeattr_916 (and (domain ) (not (init installd system_server vold_prepare_subdirs ))))
+(typeattribute base_typeattr_915)
+(typeattributeset base_typeattr_915 (and (app_data_file_type ) (not (shell_data_file radio_data_file sdk_sandbox_data_file ))))
+(typeattribute base_typeattr_914)
+(typeattributeset base_typeattr_914 (and (domain ) (not (crash_dump runas_app simpleperf sdk_sandbox_34 ))))
+(typeattribute base_typeattr_913)
+(typeattributeset base_typeattr_913 (and (appdomain ) (not (runas_app shell simpleperf sdk_sandbox_34 ))))
+(typeattribute base_typeattr_912)
+(typeattributeset base_typeattr_912 (and (sdk_sandbox_34 ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_911)
+(typeattributeset base_typeattr_911 (and (domain ) (not (sdk_sandbox_34 ))))
+(typeattribute base_typeattr_910)
+(typeattributeset base_typeattr_910 (and (domain ) (not (scheduler_service_server ))))
+(typeattribute base_typeattr_909)
+(typeattributeset base_typeattr_909 (and (domain ) (not (crash_dump runas_app simpleperf ))))
+(typeattribute base_typeattr_908)
+(typeattributeset base_typeattr_908 (and (appdomain ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_907)
+(typeattributeset base_typeattr_907 (and (runas_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_906)
+(typeattributeset base_typeattr_906 (and (domain ) (not (runas_app ))))
+(typeattribute base_typeattr_905)
+(typeattributeset base_typeattr_905 (and (appdomain ) (not (system_app ))))
+(typeattribute base_typeattr_904)
+(typeattributeset base_typeattr_904 (and (domain ) (not (crash_dump rkpdapp runas_app simpleperf ))))
+(typeattribute base_typeattr_903)
+(typeattributeset base_typeattr_903 (and (appdomain ) (not (rkpdapp runas_app shell simpleperf ))))
+(typeattribute base_typeattr_902)
+(typeattributeset base_typeattr_902 (and (rkpdapp ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_901)
+(typeattributeset base_typeattr_901 (and (domain ) (not (rkpdapp ))))
+(typeattribute base_typeattr_900)
+(typeattributeset base_typeattr_900 (and (domain ) (not (rkpd ))))
+(typeattribute base_typeattr_899)
+(typeattributeset base_typeattr_899 (and (domain ) (not (rkp_cert_processor ))))
+(typeattribute base_typeattr_898)
+(typeattributeset base_typeattr_898 (and (domain ) (not (remote_provisioning_service_server ))))
+(typeattribute base_typeattr_897)
+(typeattributeset base_typeattr_897 (and (file_type ) (not (recovery_data_file ))))
+(typeattribute base_typeattr_896)
+(typeattributeset base_typeattr_896 (and (data_file_type ) (not (cache_file cache_recovery_file ))))
+(typeattribute base_typeattr_895)
+(typeattributeset base_typeattr_895 (and (domain ) (not (init radio ))))
+(typeattribute base_typeattr_894)
+(typeattributeset base_typeattr_894 (and (domain ) (not (crash_dump radio runas_app simpleperf ))))
+(typeattribute base_typeattr_893)
+(typeattributeset base_typeattr_893 (and (appdomain ) (not (radio runas_app shell simpleperf ))))
+(typeattribute base_typeattr_892)
+(typeattributeset base_typeattr_892 (and (radio ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_891)
+(typeattributeset base_typeattr_891 (and (domain ) (not (radio ))))
+(typeattribute base_typeattr_890)
+(typeattributeset base_typeattr_890 (and (appdomain ) (not (system_app device_as_webcam ))))
+(typeattribute base_typeattr_889)
+(typeattributeset base_typeattr_889 (and (domain ) (not (dumpstate init profcollectd ))))
+(typeattribute base_typeattr_888)
+(typeattributeset base_typeattr_888 (and (domain ) (not (coredomain apexd dumpstate vendor_init ))))
+(typeattribute base_typeattr_887)
+(typeattributeset base_typeattr_887 (and (domain ) (not (coredomain apexd dumpstate init ))))
+(typeattribute base_typeattr_886)
+(typeattributeset base_typeattr_886 (and (domain ) (not (init keystore rkpdapp shell system_server ))))
+(typeattribute base_typeattr_885)
+(typeattributeset base_typeattr_885 (and (domain ) (not (hal_dumpstate_server dumpstate init ))))
+(typeattribute base_typeattr_884)
+(typeattributeset base_typeattr_884 (and (domain ) (not (appdomain dumpstate init vendor_init ))))
+(typeattribute base_typeattr_883)
+(typeattributeset base_typeattr_883 (and (domain ) (not (dumpstate init system_app vendor_init ))))
+(typeattribute base_typeattr_882)
+(typeattributeset base_typeattr_882 (and (domain ) (not (init surfaceflinger ))))
+(typeattribute base_typeattr_881)
+(typeattributeset base_typeattr_881 (and (domain ) (not (appdomain hal_telephony_server init radio ))))
+(typeattribute base_typeattr_880)
+(typeattributeset base_typeattr_880 (and (domain ) (not (init shell kcmdlinectrl ))))
+(typeattribute base_typeattr_879)
+(typeattributeset base_typeattr_879 (and (domain ) (not (init shell system_app system_server mtectrl ))))
+(typeattribute base_typeattr_878)
+(typeattributeset base_typeattr_878 (and (domain ) (not (adbd init adbd_tradeinmode ))))
+(typeattribute base_typeattr_877)
+(typeattributeset base_typeattr_877 (and (domain ) (not (adbd init system_server vendor_init adbd_tradeinmode ))))
+(typeattribute base_typeattr_876)
+(typeattributeset base_typeattr_876 (and (property_type ) (not (extended_core_property_type system_property_type ))))
+(typeattribute base_typeattr_875)
+(typeattributeset base_typeattr_875 (and (coredomain ) (not (system_writes_vendor_properties_violators init ))))
+(typeattribute base_typeattr_874)
+(typeattributeset base_typeattr_874 (and (domain ) (not (appdomain coredomain hal_power_server vendor_init ))))
+(typeattribute base_typeattr_873)
+(typeattributeset base_typeattr_873 (and (core_property_type extended_core_property_type dalvik_config_prop_type exported3_system_prop systemsound_config_prop ) (not (dalvik_dynamic_config_prop debug_prop logd_prop nfc_prop powerctl_prop radio_prop ))))
+(typeattribute base_typeattr_872)
+(typeattributeset base_typeattr_872 (and (domain ) (not (hal_wifi_server dumpstate init vendor_init wificond ))))
+(typeattribute base_typeattr_871)
+(typeattributeset base_typeattr_871 (and (domain ) (not (coredomain hal_wifi_server wificond ))))
+(typeattribute base_typeattr_870)
+(typeattributeset base_typeattr_870 (and (domain ) (not (coredomain hal_camera_server cameraserver vendor_init ))))
+(typeattribute base_typeattr_869)
+(typeattributeset base_typeattr_869 (and (domain ) (not (coredomain hal_bluetooth_server bluetooth vendor_init ))))
+(typeattribute base_typeattr_868)
+(typeattributeset base_typeattr_868 (and (domain ) (not (coredomain hal_bluetooth_server bluetooth ))))
+(typeattribute base_typeattr_867)
+(typeattributeset base_typeattr_867 (and (domain ) (not (appdomain coredomain hal_telephony_server ))))
+(typeattribute base_typeattr_866)
+(typeattributeset base_typeattr_866 (and (domain ) (not (appdomain coredomain hal_telephony_server vendor_init ))))
+(typeattribute base_typeattr_865)
+(typeattributeset base_typeattr_865 (and (domain ) (not (appdomain coredomain hal_nfc_server ))))
+(typeattribute base_typeattr_864)
+(typeattributeset base_typeattr_864 (and (core_property_type extended_core_property_type exported3_system_prop exported_dumpstate_prop exported_config_prop exported_default_prop exported_system_prop usb_control_prop ) (not (nfc_prop powerctl_prop radio_prop ))))
+(typeattribute base_typeattr_863)
+(typeattributeset base_typeattr_863 (and (domain ) (not (appdomain coredomain vendor_init ))))
+(typeattribute base_typeattr_862)
+(typeattributeset base_typeattr_862 (and (domain ) (not (init misctrl ))))
+(typeattribute base_typeattr_861)
+(typeattributeset base_typeattr_861 (and (domain ) (not (crash_dump dumpstate init statsd misctrl ))))
+(typeattribute base_typeattr_860)
+(typeattributeset base_typeattr_860 (and (domain ) (not (extra_free_kbytes init ))))
+(typeattribute base_typeattr_859)
+(typeattributeset base_typeattr_859 (and (core_property_type ) (not (fingerprint_prop restorecon_prop usb_prop config_prop cppreopt_prop dalvik_prop debuggerd_prop dhcp_prop dumpstate_prop net_radio_prop pan_result_prop persist_debug_prop shell_prop vold_prop audio_prop debug_prop logd_prop nfc_prop ota_prop powerctl_prop radio_prop system_prop ))))
+(typeattribute base_typeattr_858)
+(typeattributeset base_typeattr_858 (and (vendor_property_type ) (not (vendor_public_property_type ))))
+(typeattribute base_typeattr_857)
+(typeattributeset base_typeattr_857 (and (vendor_property_type vendor_internal_property_type ) (not (vendor_restricted_property_type vendor_public_property_type ))))
+(typeattribute base_typeattr_856)
+(typeattributeset base_typeattr_856 (and (system_property_type ) (not (system_public_property_type ))))
+(typeattribute base_typeattr_855)
+(typeattributeset base_typeattr_855 (and (system_property_type system_internal_property_type ) (not (system_restricted_property_type system_public_property_type ))))
+(typeattribute base_typeattr_854)
+(typeattributeset base_typeattr_854 (and (property_type ) (not (system_property_type vendor_property_type ))))
+(typeattribute base_typeattr_853)
+(typeattributeset base_typeattr_853 (and (app_data_file_type ) (not (privapp_data_file ))))
+(typeattribute base_typeattr_852)
+(typeattributeset base_typeattr_852 (and (domain ) (not (crash_dump priv_app runas_app simpleperf ))))
+(typeattribute base_typeattr_851)
+(typeattributeset base_typeattr_851 (and (appdomain ) (not (priv_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_850)
+(typeattributeset base_typeattr_850 (and (priv_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_849)
+(typeattributeset base_typeattr_849 (and (domain ) (not (priv_app ))))
+(typeattribute base_typeattr_848)
+(typeattributeset base_typeattr_848 (and (domain ) (not (init shell ))))
+(typeattribute base_typeattr_847)
+(typeattributeset base_typeattr_847 (and (domain ) (not (recovery update_engine ))))
+(typeattribute base_typeattr_846)
+(typeattributeset base_typeattr_846 (and (domain ) (not (dumpstate init ))))
+(typeattribute base_typeattr_845)
+(typeattributeset base_typeattr_845 (and (domain ) (not (crash_dump platform_app runas_app simpleperf ))))
+(typeattribute base_typeattr_844)
+(typeattributeset base_typeattr_844 (and (appdomain ) (not (platform_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_843)
+(typeattributeset base_typeattr_843 (and (platform_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_842)
+(typeattributeset base_typeattr_842 (and (domain ) (not (platform_app ))))
+(typeattribute base_typeattr_841)
+(typeattributeset base_typeattr_841 (and (domain ) (not (crash_dump runas_app simpleperf permissioncontroller_app ))))
+(typeattribute base_typeattr_840)
+(typeattributeset base_typeattr_840 (and (appdomain ) (not (runas_app shell simpleperf permissioncontroller_app ))))
+(typeattribute base_typeattr_839)
+(typeattributeset base_typeattr_839 (and (permissioncontroller_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_838)
+(typeattributeset base_typeattr_838 (and (domain ) (not (permissioncontroller_app ))))
+(typeattribute base_typeattr_837)
+(typeattributeset base_typeattr_837 (and (domain ) (not (performanced ))))
+(typeattribute base_typeattr_836)
+(typeattributeset base_typeattr_836 (and (data_file_type ) (not (perfetto_traces_data_file perfetto_traces_bugreport_data_file perfetto_traces_profiling_data_file perfetto_configs_data_file ))))
+(typeattribute base_typeattr_835)
+(typeattributeset base_typeattr_835 (and (system_data_file ) (not (perfetto_traces_data_file perfetto_traces_profiling_data_file ))))
+(typeattribute base_typeattr_834)
+(typeattributeset base_typeattr_834 (and (data_file_type ) (not (system_data_root_file system_data_file system_userdir_file vendor_data_file vendor_userdir_file media_userdir_file perfetto_traces_data_file perfetto_traces_bugreport_data_file perfetto_traces_profiling_data_file perfetto_configs_data_file ))))
+(typeattribute base_typeattr_833)
+(typeattributeset base_typeattr_833 (and (domain ) (not (adbd incidentd init perfetto shell traced trace_redactor ))))
+(typeattribute base_typeattr_832)
+(typeattributeset base_typeattr_832 (and (domain ) (not (adbd dumpstate incidentd init perfetto priv_app shell system_server traced trace_redactor ))))
+(typeattribute base_typeattr_831)
+(typeattributeset base_typeattr_831 (and (domain ) (not (init vendor_init ot_daemon ))))
+(typeattribute base_typeattr_830)
+(typeattributeset base_typeattr_830 (and (domain ) (not (ot_daemon ))))
+(typeattribute base_typeattr_829)
+(typeattributeset base_typeattr_829 (and (domain ) (not (init odsign ))))
+(typeattribute base_typeattr_828)
+(typeattributeset base_typeattr_828 (and (domain ) (not (init system_server odrefresh ))))
+(typeattribute base_typeattr_827)
+(typeattributeset base_typeattr_827 (and (domain ) (not (artd init system_server odrefresh ))))
+(typeattribute base_typeattr_826)
+(typeattributeset base_typeattr_826 (and (domain ) (not (init compos_fd_server odrefresh ))))
+(typeattribute base_typeattr_825)
+(typeattributeset base_typeattr_825 (and (domain ) (not (odrefresh ))))
+(typeattribute base_typeattr_824)
+(typeattributeset base_typeattr_824 (and (domain ) (not (crash_dump nfc runas_app simpleperf ))))
+(typeattribute base_typeattr_823)
+(typeattributeset base_typeattr_823 (and (appdomain ) (not (nfc runas_app shell simpleperf ))))
+(typeattribute base_typeattr_822)
+(typeattributeset base_typeattr_822 (and (nfc ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_821)
+(typeattributeset base_typeattr_821 (and (domain ) (not (nfc ))))
+(typeattribute base_typeattr_820)
+(typeattributeset base_typeattr_820 (and (domain ) (not (crash_dump network_stack runas_app simpleperf ))))
+(typeattribute base_typeattr_819)
+(typeattributeset base_typeattr_819 (and (appdomain ) (not (network_stack runas_app shell simpleperf ))))
+(typeattribute base_typeattr_818)
+(typeattributeset base_typeattr_818 (and (network_stack ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_817)
+(typeattributeset base_typeattr_817 (and (domain ) (not (network_stack ))))
+(typeattribute base_typeattr_816)
+(typeattributeset base_typeattr_816 (and (domain ) (not (init netd ))))
+(typeattribute base_typeattr_815)
+(typeattributeset base_typeattr_815 (and (domain ) (not (dumpstate init netd ))))
+(typeattribute base_typeattr_814)
+(typeattributeset base_typeattr_814 (and (domain ) (not (dumpstate netd netutils_wrapper network_stack system_server ))))
+(typeattribute base_typeattr_813)
+(typeattributeset base_typeattr_813 (and (domain ) (not (netd ))))
+(typeattribute base_typeattr_812)
+(typeattributeset base_typeattr_812 (and (netdomain ) (not (untrusted_app_all ephemeral_app mediaprovider priv_app sdk_sandbox_all ))))
+(typeattribute base_typeattr_811)
+(typeattributeset base_typeattr_811 (and (netdomain ) (not (ephemeral_app sdk_sandbox_all ))))
+(typeattribute base_typeattr_810)
+(typeattributeset base_typeattr_810 (and (domain ) (not (mmd ))))
+(typeattribute base_typeattr_809)
+(typeattributeset base_typeattr_809 (and (mlstrustedsubject ) (not (adbd artd installd runas system_server vold vold_prepare_subdirs zygote ))))
+(typeattribute base_typeattr_808)
+(typeattributeset base_typeattr_808 (and (mlstrustedsubject ) (not (adbd artd installd runas system_server zygote ))))
+(typeattribute base_typeattr_807)
+(typeattributeset base_typeattr_807 (and (mlstrustedsubject ) (not (artd installd vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_806)
+(typeattributeset base_typeattr_806 (and (mlstrustedsubject ) (not (artd installd ))))
+(typeattribute base_typeattr_805)
+(typeattributeset base_typeattr_805 (and (domain ) (not (microfuchsiad ))))
+(typeattribute base_typeattr_804)
+(typeattributeset base_typeattr_804 (and (domain ) (not (mediatuner ))))
+(typeattribute base_typeattr_803)
+(typeattributeset base_typeattr_803 (and (domain ) (not (mediatranscoding ))))
+(typeattribute base_typeattr_802)
+(typeattributeset base_typeattr_802 (and (domain ) (not (mediaserver ))))
+(typeattribute base_typeattr_801)
+(typeattributeset base_typeattr_801 (and (domain ) (not (crash_dump runas_app simpleperf mediaprovider_app ))))
+(typeattribute base_typeattr_800)
+(typeattributeset base_typeattr_800 (and (appdomain ) (not (runas_app shell simpleperf mediaprovider_app ))))
+(typeattribute base_typeattr_799)
+(typeattributeset base_typeattr_799 (and (mediaprovider_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_798)
+(typeattributeset base_typeattr_798 (and (domain ) (not (mediaprovider_app ))))
+(typeattribute base_typeattr_797)
+(typeattributeset base_typeattr_797 (and (domain ) (not (crash_dump mediaprovider runas_app simpleperf ))))
+(typeattribute base_typeattr_796)
+(typeattributeset base_typeattr_796 (and (appdomain ) (not (mediaprovider runas_app shell simpleperf ))))
+(typeattribute base_typeattr_795)
+(typeattributeset base_typeattr_795 (and (mediaprovider ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_794)
+(typeattributeset base_typeattr_794 (and (domain ) (not (mediaprovider ))))
+(typeattribute base_typeattr_793)
+(typeattributeset base_typeattr_793 (and (domain ) (not (mediametrics ))))
+(typeattribute base_typeattr_792)
+(typeattributeset base_typeattr_792 (and (domain ) (not (mediaextractor ))))
+(typeattribute base_typeattr_791)
+(typeattributeset base_typeattr_791 (and (domain ) (not (mediadrmserver ))))
+(typeattribute base_typeattr_790)
+(typeattributeset base_typeattr_790 (and (domain ) (not (dumpstate servicemanager shell lpdumpd ))))
+(typeattribute base_typeattr_789)
+(typeattributeset base_typeattr_789 (and (domain ) (not (dumpstate shell lpdumpd ))))
+(typeattribute base_typeattr_788)
+(typeattributeset base_typeattr_788 (and (domain ) (not (lpdumpd ))))
+(typeattribute base_typeattr_787)
+(typeattributeset base_typeattr_787 (and (domain ) (not (dumpstate incidentd init ))))
+(typeattribute base_typeattr_786)
+(typeattributeset base_typeattr_786 (and (domain ) (not (init logd ))))
+(typeattribute base_typeattr_785)
+(typeattributeset base_typeattr_785 (and (app_data_file_type system_data_file packages_list_file ) (not (shell_data_file ))))
+(typeattribute base_typeattr_784)
+(typeattributeset base_typeattr_784 (and (domain ) (not (logd ))))
+(typeattribute base_typeattr_783)
+(typeattributeset base_typeattr_783 (and (appdomain ) (not (bluetooth platform_app priv_app radio shell system_app ))))
+(typeattribute base_typeattr_782)
+(typeattributeset base_typeattr_782 (and (domain ) (not (appdomain bootstat dumpstate init logd servicemanager surfaceflinger system_server zygote ))))
+(typeattribute base_typeattr_781)
+(typeattributeset base_typeattr_781 (and (file_type ) (not (runtime_event_log_tags_file shell_data_file ))))
+(typeattribute base_typeattr_780)
+(typeattributeset base_typeattr_780 (and (domain ) (not (init lmkd vendor_init ))))
+(typeattribute base_typeattr_779)
+(typeattributeset base_typeattr_779 (and (domain ) (not (init dexopt_chroot_setup linkerconfig otapreopt_chroot ))))
+(typeattribute base_typeattr_778)
+(typeattributeset base_typeattr_778 (and (domain ) (not (init keystore ))))
+(typeattribute base_typeattr_777)
+(typeattributeset base_typeattr_777 (and (domain ) (not (keystore ))))
+(typeattribute base_typeattr_776)
+(typeattributeset base_typeattr_776 (and (domain ) (not (crash_dump isolated_compute_app runas_app simpleperf ))))
+(typeattribute base_typeattr_775)
+(typeattributeset base_typeattr_775 (and (appdomain ) (not (isolated_compute_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_774)
+(typeattributeset base_typeattr_774 (and (isolated_compute_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_773)
+(typeattributeset base_typeattr_773 (and (domain ) (not (isolated_compute_app ))))
+(typeattribute base_typeattr_772)
+(typeattributeset base_typeattr_772 (and (sysfs_type ) (not (sysfs_transparent_hugepage sysfs_usb sysfs_fs_fuse_features sysfs_fs_incfs_features sysfs_devices_system_cpu sysfs_pgsize_migration ))))
+(typeattribute base_typeattr_771)
+(typeattributeset base_typeattr_771 (and (service_manager_type ) (not (activity_service display_service webviewupdate_service ))))
+(typeattribute base_typeattr_770)
+(typeattributeset base_typeattr_770 (and (isolated_app_all ) (not (isolated_compute_app ))))
+(typeattribute base_typeattr_769)
+(typeattributeset base_typeattr_769 (and (domain ) (not (crash_dump isolated_app runas_app simpleperf ))))
+(typeattribute base_typeattr_768)
+(typeattributeset base_typeattr_768 (and (appdomain ) (not (isolated_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_767)
+(typeattributeset base_typeattr_767 (and (isolated_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_766)
+(typeattributeset base_typeattr_766 (and (domain ) (not (servicemanager system_server ))))
+(typeattribute base_typeattr_765)
+(typeattributeset base_typeattr_765 (and (domain ) (not (dumpstate servicemanager system_server ))))
+(typeattribute base_typeattr_764)
+(typeattributeset base_typeattr_764 (and (domain ) (not (dumpstate installd system_server ))))
+(typeattribute base_typeattr_763)
+(typeattributeset base_typeattr_763 (and (domain ) (not (installd ))))
+(typeattribute base_typeattr_762)
+(typeattributeset base_typeattr_762 (and (domain ) (not (init toolbox vendor_init vold ))))
+(typeattribute base_typeattr_761)
+(typeattributeset base_typeattr_761 (and (fs_type file_type ) (not (init_exec ))))
+(typeattribute base_typeattr_760)
+(typeattributeset base_typeattr_760 (and (fs_type ) (not (bpffs_type contextmount_type fusefs_type sdcard_type rootfs ))))
+(typeattribute base_typeattr_759)
+(typeattributeset base_typeattr_759 (and (fs_type ) (not (bpffs_type contextmount_type fusefs_type proc_type sysfs_type debugfs_type sdcard_type keychord_device rootfs ))))
+(typeattribute base_typeattr_758)
+(typeattributeset base_typeattr_758 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type app_data_file privapp_data_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_757)
+(typeattributeset base_typeattr_757 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type shell_data_file nativetest_data_file apex_mnt_dir credstore_data_file keystore_data_file vold_data_file gsi_data_file app_data_file privapp_data_file system_app_data_file misc_logd_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_756)
+(typeattributeset base_typeattr_756 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type shell_data_file nativetest_data_file credstore_data_file keystore_data_file vold_data_file gsi_data_file app_data_file privapp_data_file system_app_data_file misc_logd_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_755)
+(typeattributeset base_typeattr_755 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type debugfs_type runtime_event_log_tags_file shell_data_file nativetest_data_file apex_info_file credstore_data_file keystore_data_file vold_data_file gsi_data_file app_data_file privapp_data_file system_app_data_file misc_logd_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_754)
+(typeattributeset base_typeattr_754 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type system_userdir_file vendor_userdir_file shell_data_file nativetest_data_file credstore_data_file keystore_data_file media_userdir_file vold_data_file app_data_file privapp_data_file system_app_data_file misc_logd_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_753)
+(typeattributeset base_typeattr_753 (and (file_type ) (not (bpffs_type exec_type system_file_type system_dlkm_file_type vendor_file_type nativetest_data_file app_data_file privapp_data_file system_app_data_file misc_logd_file vm_data_file storage_area_app_dir storage_area_dir storage_area_content_file ))))
+(typeattribute base_typeattr_752)
+(typeattributeset base_typeattr_752 (and (fs_type ) (not (debugfs_type ))))
+(typeattribute base_typeattr_751)
+(typeattributeset base_typeattr_751 (and (dev_type ) (not (vm_manager_device_type keychord_device hw_random_device port_device ))))
+(typeattribute base_typeattr_750)
+(typeattributeset base_typeattr_750 (and (domain ) (not (incidentd init system_server vold ))))
+(typeattribute base_typeattr_749)
+(typeattributeset base_typeattr_749 (and (domain ) (not (incidentd init vold ))))
+(typeattribute base_typeattr_748)
+(typeattributeset base_typeattr_748 (and (domain ) (not (incidentd ))))
+(typeattribute base_typeattr_747)
+(typeattributeset base_typeattr_747 (and (system_server_service app_api_service system_api_service ) (not (tracingproxy_service ))))
+(typeattribute base_typeattr_746)
+(typeattributeset base_typeattr_746 (and (domain ) (not (incident_helper incidentd shell ))))
+(typeattribute base_typeattr_745)
+(typeattributeset base_typeattr_745 (and (domain ) (not (dumpstate incident shell su ))))
+(typeattribute base_typeattr_744)
+(typeattributeset base_typeattr_744 (and (domain ) (not (idmap ))))
+(typeattribute base_typeattr_743)
+(typeattributeset base_typeattr_743 (and (domain ) (not (hwservicemanager ))))
+(typeattribute base_typeattr_742)
+(typeattributeset base_typeattr_742 (not (hwservice_manager_type ) ))
+(typeattribute base_typeattr_741)
+(typeattributeset base_typeattr_741 (and (vendor_file_type ) (not (vndk_sp_file ))))
+(typeattribute base_typeattr_740)
+(typeattributeset base_typeattr_740 (and (domain ) (not (hal_wifi_supplicant_client hal_wifi_supplicant_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_739)
+(typeattributeset base_typeattr_739 (and (domain ) (not (hal_wifi_supplicant_client hal_wifi_supplicant_server ))))
+(typeattribute base_typeattr_738)
+(typeattributeset base_typeattr_738 (and (domain ) (not (hal_wifi_supplicant_server ))))
+(typeattribute base_typeattr_737)
+(typeattributeset base_typeattr_737 (and (domain ) (not (hal_wifi_hostapd_client hal_wifi_hostapd_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_736)
+(typeattributeset base_typeattr_736 (and (domain ) (not (hal_wifi_hostapd_client hal_wifi_hostapd_server ))))
+(typeattribute base_typeattr_735)
+(typeattributeset base_typeattr_735 (and (domain ) (not (hal_wifi_hostapd_server ))))
+(typeattribute base_typeattr_734)
+(typeattributeset base_typeattr_734 (and (domain ) (not (hal_wifi_client hal_wifi_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_733)
+(typeattributeset base_typeattr_733 (and (domain ) (not (hal_wifi_client hal_wifi_server ))))
+(typeattribute base_typeattr_732)
+(typeattributeset base_typeattr_732 (and (domain ) (not (hal_wifi_server ))))
+(typeattribute base_typeattr_731)
+(typeattributeset base_typeattr_731 (and (domain ) (not (hal_weaver_client hal_weaver_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_730)
+(typeattributeset base_typeattr_730 (and (domain ) (not (hal_weaver_client hal_weaver_server ))))
+(typeattribute base_typeattr_729)
+(typeattributeset base_typeattr_729 (and (domain ) (not (hal_weaver_server ))))
+(typeattribute base_typeattr_728)
+(typeattributeset base_typeattr_728 (and (domain ) (not (hal_vr_client hal_vr_server ))))
+(typeattribute base_typeattr_727)
+(typeattributeset base_typeattr_727 (and (domain ) (not (hal_vr_server ))))
+(typeattribute base_typeattr_726)
+(typeattributeset base_typeattr_726 (and (domain ) (not (hal_vm_capabilities_client hal_vm_capabilities_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_725)
+(typeattributeset base_typeattr_725 (and (domain ) (not (hal_vm_capabilities_server ))))
+(typeattribute base_typeattr_724)
+(typeattributeset base_typeattr_724 (and (domain ) (not (hal_vibrator_client hal_vibrator_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_723)
+(typeattributeset base_typeattr_723 (and (domain ) (not (hal_vibrator_client hal_vibrator_server ))))
+(typeattribute base_typeattr_722)
+(typeattributeset base_typeattr_722 (and (domain ) (not (hal_vibrator_server ))))
+(typeattribute base_typeattr_721)
+(typeattributeset base_typeattr_721 (and (domain ) (not (hal_vehicle_client hal_vehicle_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_720)
+(typeattributeset base_typeattr_720 (and (domain ) (not (hal_vehicle_client hal_vehicle_server ))))
+(typeattribute base_typeattr_719)
+(typeattributeset base_typeattr_719 (and (domain ) (not (hal_vehicle_server ))))
+(typeattribute base_typeattr_718)
+(typeattributeset base_typeattr_718 (and (domain ) (not (hal_uwb_client hal_uwb_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_717)
+(typeattributeset base_typeattr_717 (and (domain ) (not (hal_uwb_server ))))
+(typeattribute base_typeattr_716)
+(typeattributeset base_typeattr_716 (and (domain ) (not (hal_usb_gadget_client hal_usb_gadget_server ))))
+(typeattribute base_typeattr_715)
+(typeattributeset base_typeattr_715 (and (domain ) (not (hal_usb_gadget_client hal_usb_gadget_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_714)
+(typeattributeset base_typeattr_714 (and (domain ) (not (hal_usb_gadget_server ))))
+(typeattribute base_typeattr_713)
+(typeattributeset base_typeattr_713 (and (domain ) (not (hal_usb_client hal_usb_server ))))
+(typeattribute base_typeattr_712)
+(typeattributeset base_typeattr_712 (and (domain ) (not (hal_usb_client hal_usb_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_711)
+(typeattributeset base_typeattr_711 (and (domain ) (not (hal_usb_server ))))
+(typeattribute base_typeattr_710)
+(typeattributeset base_typeattr_710 (and (domain ) (not (hal_tv_tuner_client hal_tv_tuner_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_709)
+(typeattributeset base_typeattr_709 (and (domain ) (not (hal_tv_tuner_client hal_tv_tuner_server ))))
+(typeattribute base_typeattr_708)
+(typeattributeset base_typeattr_708 (and (domain ) (not (hal_tv_tuner_server ))))
+(typeattribute base_typeattr_707)
+(typeattributeset base_typeattr_707 (and (domain ) (not (hal_tv_input_client hal_tv_input_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_706)
+(typeattributeset base_typeattr_706 (and (domain ) (not (hal_tv_input_client hal_tv_input_server ))))
+(typeattribute base_typeattr_705)
+(typeattributeset base_typeattr_705 (and (domain ) (not (hal_tv_input_server ))))
+(typeattribute base_typeattr_704)
+(typeattributeset base_typeattr_704 (and (domain ) (not (hal_tv_hdmi_earc_client hal_tv_hdmi_earc_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_703)
+(typeattributeset base_typeattr_703 (and (domain ) (not (hal_tv_hdmi_earc_server ))))
+(typeattribute base_typeattr_702)
+(typeattributeset base_typeattr_702 (and (domain ) (not (hal_tv_hdmi_connection_client hal_tv_hdmi_connection_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_701)
+(typeattributeset base_typeattr_701 (and (domain ) (not (hal_tv_hdmi_connection_server ))))
+(typeattribute base_typeattr_700)
+(typeattributeset base_typeattr_700 (and (domain ) (not (hal_tv_hdmi_cec_client hal_tv_hdmi_cec_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_699)
+(typeattributeset base_typeattr_699 (and (domain ) (not (hal_tv_hdmi_cec_server ))))
+(typeattribute base_typeattr_698)
+(typeattributeset base_typeattr_698 (and (domain ) (not (hal_tv_cec_client hal_tv_cec_server ))))
+(typeattribute base_typeattr_697)
+(typeattributeset base_typeattr_697 (and (domain ) (not (hal_tv_cec_server ))))
+(typeattribute base_typeattr_696)
+(typeattributeset base_typeattr_696 (and (domain ) (not (hal_threadnetwork_client hal_threadnetwork_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_695)
+(typeattributeset base_typeattr_695 (and (domain ) (not (hal_threadnetwork_server ))))
+(typeattribute base_typeattr_694)
+(typeattributeset base_typeattr_694 (and (domain ) (not (hal_thermal_client hal_thermal_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_693)
+(typeattributeset base_typeattr_693 (and (domain ) (not (hal_thermal_client hal_thermal_server ))))
+(typeattribute base_typeattr_692)
+(typeattributeset base_typeattr_692 (and (domain ) (not (hal_thermal_server ))))
+(typeattribute base_typeattr_691)
+(typeattributeset base_typeattr_691 (and (domain ) (not (hal_tetheroffload_client hal_tetheroffload_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_690)
+(typeattributeset base_typeattr_690 (and (domain ) (not (hal_tetheroffload_client hal_tetheroffload_server ))))
+(typeattribute base_typeattr_689)
+(typeattributeset base_typeattr_689 (and (domain ) (not (hal_tetheroffload_server ))))
+(typeattribute base_typeattr_688)
+(typeattributeset base_typeattr_688 (and (domain ) (not (hal_telephony_client hal_telephony_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_687)
+(typeattributeset base_typeattr_687 (and (domain ) (not (hal_telephony_client hal_telephony_server ))))
+(typeattribute base_typeattr_686)
+(typeattributeset base_typeattr_686 (and (domain ) (not (hal_telephony_server ))))
+(typeattribute base_typeattr_685)
+(typeattributeset base_typeattr_685 (and (domain ) (not (hal_sensors_client hal_sensors_server ))))
+(typeattribute base_typeattr_684)
+(typeattributeset base_typeattr_684 (and (domain ) (not (hal_sensors_server ))))
+(typeattribute base_typeattr_683)
+(typeattributeset base_typeattr_683 (and (domain ) (not (hal_secure_element_client hal_secure_element_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_682)
+(typeattributeset base_typeattr_682 (and (domain ) (not (hal_secure_element_client hal_secure_element_server ))))
+(typeattribute base_typeattr_681)
+(typeattributeset base_typeattr_681 (and (domain ) (not (hal_secure_element_server ))))
+(typeattribute base_typeattr_680)
+(typeattributeset base_typeattr_680 (and (domain ) (not (hal_secretkeeper_client hal_secretkeeper_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_679)
+(typeattributeset base_typeattr_679 (and (domain ) (not (hal_secretkeeper_server ))))
+(typeattribute base_typeattr_678)
+(typeattributeset base_typeattr_678 (and (domain ) (not (hal_remotelyprovisionedcomponent_avf_client hal_remotelyprovisionedcomponent_avf_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_677)
+(typeattributeset base_typeattr_677 (and (domain ) (not (hal_remotelyprovisionedcomponent_avf_server ))))
+(typeattribute base_typeattr_676)
+(typeattributeset base_typeattr_676 (and (domain ) (not (hal_remoteaccess_client hal_remoteaccess_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_675)
+(typeattributeset base_typeattr_675 (and (domain ) (not (hal_remoteaccess_server ))))
+(typeattribute base_typeattr_674)
+(typeattributeset base_typeattr_674 (and (domain ) (not (hal_rebootescrow_client hal_rebootescrow_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_673)
+(typeattributeset base_typeattr_673 (and (domain ) (not (hal_rebootescrow_server ))))
+(typeattribute base_typeattr_672)
+(typeattributeset base_typeattr_672 (and (domain ) (not (hal_power_stats_client hal_power_stats_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_671)
+(typeattributeset base_typeattr_671 (and (domain ) (not (hal_power_stats_client hal_power_stats_server ))))
+(typeattribute base_typeattr_670)
+(typeattributeset base_typeattr_670 (and (domain ) (not (hal_power_stats_server ))))
+(typeattribute base_typeattr_669)
+(typeattributeset base_typeattr_669 (and (domain ) (not (hal_power_client hal_power_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_668)
+(typeattributeset base_typeattr_668 (and (domain ) (not (hal_power_client hal_power_server ))))
+(typeattribute base_typeattr_667)
+(typeattributeset base_typeattr_667 (and (domain ) (not (hal_power_server ))))
+(typeattribute base_typeattr_666)
+(typeattributeset base_typeattr_666 (and (domain ) (not (hal_omx_client hal_omx_server ))))
+(typeattribute base_typeattr_665)
+(typeattributeset base_typeattr_665 (and (domain ) (not (hal_omx_server ))))
+(typeattribute base_typeattr_664)
+(typeattributeset base_typeattr_664 (and (domain ) (not (hal_oemlock_client hal_oemlock_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_663)
+(typeattributeset base_typeattr_663 (and (domain ) (not (hal_oemlock_client hal_oemlock_server ))))
+(typeattribute base_typeattr_662)
+(typeattributeset base_typeattr_662 (and (domain ) (not (hal_oemlock_server ))))
+(typeattribute base_typeattr_661)
+(typeattributeset base_typeattr_661 (and (domain ) (not (hal_nlinterceptor_client hal_nlinterceptor_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_660)
+(typeattributeset base_typeattr_660 (and (domain ) (not (hal_nlinterceptor_server ))))
+(typeattribute base_typeattr_659)
+(typeattributeset base_typeattr_659 (and (domain ) (not (hal_nfc_client hal_nfc_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_658)
+(typeattributeset base_typeattr_658 (and (domain ) (not (hal_nfc_client hal_nfc_server ))))
+(typeattribute base_typeattr_657)
+(typeattributeset base_typeattr_657 (and (domain ) (not (hal_nfc_server ))))
+(typeattribute base_typeattr_656)
+(typeattributeset base_typeattr_656 (and (fs_type file_type ) (not (shell_exec toolbox_exec ))))
+(typeattribute base_typeattr_655)
+(typeattributeset base_typeattr_655 (and (halserverdomain ) (not (hal_dumpstate_server hal_telephony_server ))))
+(typeattribute base_typeattr_654)
+(typeattributeset base_typeattr_654 (and (halserverdomain ) (not (hal_automotive_socket_exemption hal_bluetooth_server hal_can_controller_server hal_nlinterceptor_server hal_telephony_server hal_tetheroffload_server hal_tv_tuner_server hal_wifi_server hal_wifi_hostapd_server hal_wifi_supplicant_server ))))
+(typeattribute base_typeattr_653)
+(typeattributeset base_typeattr_653 (and (halserverdomain ) (not (hal_automotive_socket_exemption hal_bluetooth_server hal_can_controller_server hal_nlinterceptor_server hal_telephony_server hal_tetheroffload_server hal_tv_tuner_server hal_uwb_server hal_uwb_vendor_server hal_wifi_server hal_wifi_hostapd_server hal_wifi_supplicant_server ))))
+(typeattribute base_typeattr_652)
+(typeattributeset base_typeattr_652 (and (halserverdomain ) (not (hal_bluetooth_server hal_can_controller_server hal_nlinterceptor_server hal_telephony_server hal_tv_tuner_server hal_uwb_server hal_uwb_vendor_server hal_wifi_server hal_wifi_hostapd_server hal_wifi_supplicant_server ))))
+(typeattribute base_typeattr_651)
+(typeattributeset base_typeattr_651 (and (domain ) (not (hal_neuralnetworks_client hal_neuralnetworks_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_650)
+(typeattributeset base_typeattr_650 (and (domain ) (not (hal_neuralnetworks_client hal_neuralnetworks_server ))))
+(typeattribute base_typeattr_649)
+(typeattributeset base_typeattr_649 (and (domain ) (not (hal_neuralnetworks_server ))))
+(typeattribute base_typeattr_648)
+(typeattributeset base_typeattr_648 (and (domain ) (not (hal_memtrack_client hal_memtrack_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_647)
+(typeattributeset base_typeattr_647 (and (domain ) (not (hal_memtrack_client hal_memtrack_server ))))
+(typeattribute base_typeattr_646)
+(typeattributeset base_typeattr_646 (and (domain ) (not (hal_memtrack_server ))))
+(typeattribute base_typeattr_645)
+(typeattributeset base_typeattr_645 (and (domain ) (not (hal_mediaquality_client hal_mediaquality_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_644)
+(typeattributeset base_typeattr_644 (and (domain ) (not (hal_mediaquality_server ))))
+(typeattribute base_typeattr_643)
+(typeattributeset base_typeattr_643 (and (domain ) (not (hal_macsec_client hal_macsec_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_642)
+(typeattributeset base_typeattr_642 (and (domain ) (not (hal_macsec_server ))))
+(typeattribute base_typeattr_641)
+(typeattributeset base_typeattr_641 (and (domain ) (not (hal_lowpan_server init ueventd ))))
+(typeattribute base_typeattr_640)
+(typeattributeset base_typeattr_640 (and (domain ) (not (hal_lowpan_client hal_lowpan_server ))))
+(typeattribute base_typeattr_639)
+(typeattributeset base_typeattr_639 (and (domain ) (not (hal_lowpan_server ))))
+(typeattribute base_typeattr_638)
+(typeattributeset base_typeattr_638 (and (domain ) (not (hal_light_client hal_light_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_637)
+(typeattributeset base_typeattr_637 (and (domain ) (not (hal_light_client hal_light_server ))))
+(typeattribute base_typeattr_636)
+(typeattributeset base_typeattr_636 (and (domain ) (not (hal_light_server ))))
+(typeattribute base_typeattr_635)
+(typeattributeset base_typeattr_635 (and (hal_keymint_server ) (not (coredomain ))))
+(typeattribute base_typeattr_634)
+(typeattributeset base_typeattr_634 (and (domain ) (not (hal_keymint_client hal_keymint_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_633)
+(typeattributeset base_typeattr_633 (and (domain ) (not (hal_keymint_server ))))
+(typeattribute base_typeattr_632)
+(typeattributeset base_typeattr_632 (and (domain ) (not (hal_keymaster_client hal_keymaster_server ))))
+(typeattribute base_typeattr_631)
+(typeattributeset base_typeattr_631 (and (domain ) (not (hal_keymaster_server ))))
+(typeattribute base_typeattr_630)
+(typeattributeset base_typeattr_630 (and (domain ) (not (hal_ivn_client hal_ivn_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_629)
+(typeattributeset base_typeattr_629 (and (domain ) (not (hal_ivn_server ))))
+(typeattribute base_typeattr_628)
+(typeattributeset base_typeattr_628 (and (domain ) (not (hal_ir_client hal_ir_server ))))
+(typeattribute base_typeattr_627)
+(typeattributeset base_typeattr_627 (and (domain ) (not (hal_ir_client hal_ir_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_626)
+(typeattributeset base_typeattr_626 (and (domain ) (not (hal_ir_server ))))
+(typeattribute base_typeattr_625)
+(typeattributeset base_typeattr_625 (and (domain ) (not (hal_input_processor_client hal_input_processor_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_624)
+(typeattributeset base_typeattr_624 (and (domain ) (not (hal_input_processor_server ))))
+(typeattribute base_typeattr_623)
+(typeattributeset base_typeattr_623 (and (domain ) (not (hal_input_classifier_client hal_input_classifier_server ))))
+(typeattribute base_typeattr_622)
+(typeattributeset base_typeattr_622 (and (domain ) (not (hal_input_classifier_server ))))
+(typeattribute base_typeattr_621)
+(typeattributeset base_typeattr_621 (and (domain ) (not (hal_identity_client hal_identity_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_620)
+(typeattributeset base_typeattr_620 (and (domain ) (not (hal_identity_server ))))
+(typeattribute base_typeattr_619)
+(typeattributeset base_typeattr_619 (and (domain ) (not (hal_health_storage_client hal_health_storage_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_618)
+(typeattributeset base_typeattr_618 (and (domain ) (not (hal_health_storage_client hal_health_storage_server ))))
+(typeattribute base_typeattr_617)
+(typeattributeset base_typeattr_617 (and (domain ) (not (hal_health_storage_server ))))
+(typeattribute base_typeattr_616)
+(typeattributeset base_typeattr_616 (and (domain ) (not (hal_health_client hal_health_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_615)
+(typeattributeset base_typeattr_615 (and (domain ) (not (hal_health_client hal_health_server ))))
+(typeattribute base_typeattr_614)
+(typeattributeset base_typeattr_614 (and (domain ) (not (hal_health_server ))))
+(typeattribute base_typeattr_613)
+(typeattributeset base_typeattr_613 (and (domain ) (not (hal_graphics_composer_client hal_graphics_composer_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_612)
+(typeattributeset base_typeattr_612 (and (domain ) (not (hal_graphics_composer_client hal_graphics_composer_server ))))
+(typeattribute base_typeattr_611)
+(typeattributeset base_typeattr_611 (and (domain ) (not (hal_graphics_composer_server ))))
+(typeattribute base_typeattr_610)
+(typeattributeset base_typeattr_610 (and (domain ) (not (hal_graphics_allocator_client hal_graphics_allocator_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_609)
+(typeattributeset base_typeattr_609 (and (domain ) (not (hal_graphics_allocator_client hal_graphics_allocator_server ))))
+(typeattribute base_typeattr_608)
+(typeattributeset base_typeattr_608 (and (domain ) (not (hal_graphics_allocator_server ))))
+(typeattribute base_typeattr_607)
+(typeattributeset base_typeattr_607 (and (domain ) (not (hal_gnss_client hal_gnss_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_606)
+(typeattributeset base_typeattr_606 (and (domain ) (not (hal_gnss_client hal_gnss_server ))))
+(typeattribute base_typeattr_605)
+(typeattributeset base_typeattr_605 (and (domain ) (not (hal_gnss_server ))))
+(typeattribute base_typeattr_604)
+(typeattributeset base_typeattr_604 (and (domain ) (not (hal_gatekeeper_client hal_gatekeeper_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_603)
+(typeattributeset base_typeattr_603 (and (domain ) (not (hal_gatekeeper_client hal_gatekeeper_server ))))
+(typeattribute base_typeattr_602)
+(typeattributeset base_typeattr_602 (and (domain ) (not (hal_gatekeeper_server ))))
+(typeattribute base_typeattr_601)
+(typeattributeset base_typeattr_601 (and (hal_fingerprint ) (not (coredomain ))))
+(typeattribute base_typeattr_600)
+(typeattributeset base_typeattr_600 (and (domain ) (not (hal_fingerprint_client hal_fingerprint_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_599)
+(typeattributeset base_typeattr_599 (and (domain ) (not (hal_fingerprint_client hal_fingerprint_server ))))
+(typeattribute base_typeattr_598)
+(typeattributeset base_typeattr_598 (and (domain ) (not (hal_fingerprint_server ))))
+(typeattribute base_typeattr_597)
+(typeattributeset base_typeattr_597 (and (domain ) (not (hal_fastboot_client hal_fastboot_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_596)
+(typeattributeset base_typeattr_596 (and (domain ) (not (hal_fastboot_server ))))
+(typeattribute base_typeattr_595)
+(typeattributeset base_typeattr_595 (and (hal_face ) (not (coredomain ))))
+(typeattribute base_typeattr_594)
+(typeattributeset base_typeattr_594 (and (domain ) (not (hal_face_client hal_face_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_593)
+(typeattributeset base_typeattr_593 (and (domain ) (not (hal_face_client hal_face_server ))))
+(typeattribute base_typeattr_592)
+(typeattributeset base_typeattr_592 (and (domain ) (not (hal_face_server ))))
+(typeattribute base_typeattr_591)
+(typeattributeset base_typeattr_591 (and (domain ) (not (hal_evs_client hal_evs_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_590)
+(typeattributeset base_typeattr_590 (and (domain ) (not (hal_evs_server ))))
+(typeattribute base_typeattr_589)
+(typeattributeset base_typeattr_589 (and (domain ) (not (hal_evs_server evsmanagerd ))))
+(typeattribute base_typeattr_588)
+(typeattributeset base_typeattr_588 (and (domain ) (not (hal_dumpstate_client hal_dumpstate_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_587)
+(typeattributeset base_typeattr_587 (and (domain ) (not (hal_dumpstate_client hal_dumpstate_server ))))
+(typeattribute base_typeattr_586)
+(typeattributeset base_typeattr_586 (and (domain ) (not (hal_dumpstate_server ))))
+(typeattribute base_typeattr_585)
+(typeattributeset base_typeattr_585 (and (domain ) (not (hal_drm_client hal_drm_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_584)
+(typeattributeset base_typeattr_584 (and (domain ) (not (hal_drm_client hal_drm_server ))))
+(typeattribute base_typeattr_583)
+(typeattributeset base_typeattr_583 (and (domain ) (not (hal_drm_server ))))
+(typeattribute base_typeattr_582)
+(typeattributeset base_typeattr_582 (and (domain ) (not (hal_contexthub_client hal_contexthub_server ))))
+(typeattribute base_typeattr_581)
+(typeattributeset base_typeattr_581 (and (domain ) (not (hal_contexthub_server ))))
+(typeattribute base_typeattr_580)
+(typeattributeset base_typeattr_580 (and (domain ) (not (hal_confirmationui_client hal_confirmationui_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_579)
+(typeattributeset base_typeattr_579 (and (domain ) (not (hal_confirmationui_client hal_confirmationui_server ))))
+(typeattribute base_typeattr_578)
+(typeattributeset base_typeattr_578 (and (domain ) (not (hal_confirmationui_server ))))
+(typeattribute base_typeattr_577)
+(typeattributeset base_typeattr_577 (and (data_file_type ) (not (anr_data_file tombstone_data_file ))))
+(typeattribute base_typeattr_576)
+(typeattributeset base_typeattr_576 (and (domain ) (not (hal_configstore_server logd prng_seeder tombstoned ))))
+(typeattribute base_typeattr_575)
+(typeattributeset base_typeattr_575 (and (domain ) (not (hal_configstore_client hal_configstore_server ))))
+(typeattribute base_typeattr_574)
+(typeattributeset base_typeattr_574 (and (domain ) (not (hal_configstore_server ))))
+(typeattribute base_typeattr_573)
+(typeattributeset base_typeattr_573 (and (hal_codec2_client ) (not (isolated_app_all ))))
+(typeattribute base_typeattr_572)
+(typeattributeset base_typeattr_572 (and (domain ) (not (hal_codec2_client hal_codec2_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_571)
+(typeattributeset base_typeattr_571 (and (domain ) (not (hal_codec2_client hal_codec2_server ))))
+(typeattribute base_typeattr_570)
+(typeattributeset base_typeattr_570 (and (domain ) (not (hal_codec2_server ))))
+(typeattribute base_typeattr_569)
+(typeattributeset base_typeattr_569 (and (domain ) (not (hal_cas_client hal_cas_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_568)
+(typeattributeset base_typeattr_568 (and (domain ) (not (hal_cas_client hal_cas_server ))))
+(typeattribute base_typeattr_567)
+(typeattributeset base_typeattr_567 (and (domain ) (not (hal_cas_server ))))
+(typeattribute base_typeattr_566)
+(typeattributeset base_typeattr_566 (and (domain ) (not (hal_can_controller_client hal_can_controller_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_565)
+(typeattributeset base_typeattr_565 (and (domain ) (not (hal_can_bus_client hal_can_bus_server ))))
+(typeattribute base_typeattr_564)
+(typeattributeset base_typeattr_564 (and (domain ) (not (hal_can_bus_server ))))
+(typeattribute base_typeattr_563)
+(typeattributeset base_typeattr_563 (and (domain ) (not (hal_can_controller_client hal_can_controller_server ))))
+(typeattribute base_typeattr_562)
+(typeattributeset base_typeattr_562 (and (domain ) (not (hal_can_controller_server ))))
+(typeattribute base_typeattr_561)
+(typeattributeset base_typeattr_561 (and (halserverdomain ) (not (hal_camera_server ))))
+(typeattribute base_typeattr_560)
+(typeattributeset base_typeattr_560 (and (appdomain ) (not (isolated_app ))))
+(typeattribute base_typeattr_559)
+(typeattributeset base_typeattr_559 (and (domain ) (not (hal_camera_client hal_camera_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_558)
+(typeattributeset base_typeattr_558 (and (domain ) (not (hal_camera_client hal_camera_server ))))
+(typeattribute base_typeattr_557)
+(typeattributeset base_typeattr_557 (and (domain ) (not (hal_camera_server ))))
+(typeattribute base_typeattr_556)
+(typeattributeset base_typeattr_556 (and (domain ) (not (hal_broadcastradio_client hal_broadcastradio_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_555)
+(typeattributeset base_typeattr_555 (and (domain ) (not (hal_broadcastradio_client hal_broadcastradio_server ))))
+(typeattribute base_typeattr_554)
+(typeattributeset base_typeattr_554 (and (domain ) (not (hal_broadcastradio_server ))))
+(typeattribute base_typeattr_553)
+(typeattributeset base_typeattr_553 (and (domain ) (not (hal_bootctl_client hal_bootctl_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_552)
+(typeattributeset base_typeattr_552 (and (domain ) (not (hal_bootctl_client hal_bootctl_server ))))
+(typeattribute base_typeattr_551)
+(typeattributeset base_typeattr_551 (and (domain ) (not (hal_bootctl_server ))))
+(typeattribute base_typeattr_550)
+(typeattributeset base_typeattr_550 (and (domain ) (not (hal_bluetooth_client hal_bluetooth_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_549)
+(typeattributeset base_typeattr_549 (and (domain ) (not (hal_bluetooth_client hal_bluetooth_server ))))
+(typeattribute base_typeattr_548)
+(typeattributeset base_typeattr_548 (and (domain ) (not (hal_bluetooth_server ))))
+(typeattribute base_typeattr_547)
+(typeattributeset base_typeattr_547 (and (domain ) (not (hal_authsecret_client hal_authsecret_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_546)
+(typeattributeset base_typeattr_546 (and (domain ) (not (hal_authsecret_client hal_authsecret_server ))))
+(typeattribute base_typeattr_545)
+(typeattributeset base_typeattr_545 (and (domain ) (not (hal_authsecret_server ))))
+(typeattribute base_typeattr_544)
+(typeattributeset base_typeattr_544 (and (domain ) (not (hal_authgraph_client hal_authgraph_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_543)
+(typeattributeset base_typeattr_543 (and (domain ) (not (hal_authgraph_server ))))
+(typeattribute base_typeattr_542)
+(typeattributeset base_typeattr_542 (and (domain ) (not (hal_audiocontrol_client hal_audiocontrol_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_541)
+(typeattributeset base_typeattr_541 (and (domain ) (not (hal_audiocontrol_client hal_audiocontrol_server ))))
+(typeattribute base_typeattr_540)
+(typeattributeset base_typeattr_540 (and (domain ) (not (hal_audiocontrol_server ))))
+(typeattribute base_typeattr_539)
+(typeattributeset base_typeattr_539 (and (halserverdomain ) (not (hal_audio_server hal_omx_server ))))
+(typeattribute base_typeattr_538)
+(typeattributeset base_typeattr_538 (and (domain ) (not (hal_audio_client hal_audio_server atrace shell system_app traceur_app ))))
+(typeattribute base_typeattr_537)
+(typeattributeset base_typeattr_537 (and (domain ) (not (hal_audio_client hal_audio_server ))))
+(typeattribute base_typeattr_536)
+(typeattributeset base_typeattr_536 (and (domain ) (not (hal_audio_server ))))
+(typeattribute base_typeattr_535)
+(typeattributeset base_typeattr_535 (and (domain ) (not (hal_atrace_client hal_atrace_server ))))
+(typeattribute base_typeattr_534)
+(typeattributeset base_typeattr_534 (and (domain ) (not (hal_atrace_server ))))
+(typeattribute base_typeattr_533)
+(typeattributeset base_typeattr_533 (and (domain ) (not (hal_allocator_client hal_allocator_server ))))
+(typeattribute base_typeattr_532)
+(typeattributeset base_typeattr_532 (and (domain ) (not (hal_allocator_server ))))
+(typeattribute base_typeattr_531)
+(typeattributeset base_typeattr_531 (and (domain ) (not (init gsid ))))
+(typeattribute base_typeattr_530)
+(typeattributeset base_typeattr_530 (and (gsi_metadata_file_type ) (not (gsi_public_metadata_file ))))
+(typeattribute base_typeattr_529)
+(typeattributeset base_typeattr_529 (and (domain ) (not (fastbootd init gsid ))))
+(typeattribute base_typeattr_528)
+(typeattributeset base_typeattr_528 (and (domain ) (not (update_engine_common fastbootd init recovery gsid ))))
+(typeattribute base_typeattr_527)
+(typeattributeset base_typeattr_527 (and (domain ) (not (gsid ))))
+(typeattribute base_typeattr_526)
+(typeattributeset base_typeattr_526 (and (domain ) (not (gpuservice init vendor_init ))))
+(typeattribute base_typeattr_525)
+(typeattributeset base_typeattr_525 (and (domain ) (not (gpuservice ))))
+(typeattribute base_typeattr_524)
+(typeattributeset base_typeattr_524 (and (domain ) (not (dumpstate gmscore_app init vendor_init ))))
+(typeattribute base_typeattr_523)
+(typeattributeset base_typeattr_523 (and (domain ) (not (crash_dump gmscore_app runas_app simpleperf ))))
+(typeattribute base_typeattr_522)
+(typeattributeset base_typeattr_522 (and (appdomain ) (not (gmscore_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_521)
+(typeattributeset base_typeattr_521 (and (gmscore_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_520)
+(typeattributeset base_typeattr_520 (and (domain ) (not (gmscore_app ))))
+(typeattribute base_typeattr_519)
+(typeattributeset base_typeattr_519 (and (domain ) (not (gatekeeperd ))))
+(typeattribute base_typeattr_518)
+(typeattributeset base_typeattr_518 (and (fs_type file_type ) (not (fuseblkd_untrusted_exec ))))
+(typeattribute base_typeattr_517)
+(typeattributeset base_typeattr_517 (and (fs_type file_type ) (not (fuseblkd_exec ))))
+(typeattribute base_typeattr_516)
+(typeattributeset base_typeattr_516 (and (domain ) (not (fuseblkd_untrusted ))))
+(typeattribute base_typeattr_515)
+(typeattributeset base_typeattr_515 (and (fs_type file_type ) (not (fsck_exec ))))
+(typeattribute base_typeattr_514)
+(typeattributeset base_typeattr_514 (and (domain ) (not (init vold ))))
+(typeattribute base_typeattr_513)
+(typeattributeset base_typeattr_513 (and (domain ) (not (flags_health_check init ))))
+(typeattribute base_typeattr_512)
+(typeattributeset base_typeattr_512 (and (domain ) (not (fingerprintd ))))
+(typeattribute base_typeattr_511)
+(typeattributeset base_typeattr_511 (and (domain ) (not (fastbootd ))))
+(typeattribute base_typeattr_510)
+(typeattributeset base_typeattr_510 (and (domain ) (not (evsmanagerd ))))
+(typeattribute base_typeattr_509)
+(typeattributeset base_typeattr_509 (and (domain ) (not (crash_dump ephemeral_app runas_app simpleperf ))))
+(typeattribute base_typeattr_508)
+(typeattributeset base_typeattr_508 (and (appdomain ) (not (ephemeral_app runas_app shell simpleperf ))))
+(typeattribute base_typeattr_507)
+(typeattributeset base_typeattr_507 (and (ephemeral_app ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_506)
+(typeattributeset base_typeattr_506 (and (domain ) (not (ephemeral_app ))))
+(typeattribute base_typeattr_505)
+(typeattributeset base_typeattr_505 (and (domain ) (not (early_virtmgr ))))
+(typeattribute base_typeattr_504)
+(typeattributeset base_typeattr_504 (and (domain ) (not (crosvm early_virtmgr ))))
+(typeattribute base_typeattr_503)
+(typeattributeset base_typeattr_503 (and (domain ) (not (crosvm early_virtmgr init ))))
+(typeattribute base_typeattr_502)
+(typeattributeset base_typeattr_502 (and (domain ) (not (apexd dumpstate init system_server vold_prepare_subdirs ))))
+(typeattribute base_typeattr_501)
+(typeattributeset base_typeattr_501 (and (domain ) (not (dumpstate shell system_server traceur_app ))))
+(typeattribute base_typeattr_500)
+(typeattributeset base_typeattr_500 (and (domain ) (not (dumpstate ))))
+(typeattribute base_typeattr_499)
+(typeattributeset base_typeattr_499 (and (service_manager_type ) (not (hal_service_type apex_service default_android_service dumpstate_service gatekeeper_service virtual_touchpad_service vold_service fwk_vold_service ))))
+(typeattribute base_typeattr_498)
+(typeattributeset base_typeattr_498 (and (domain ) (not (drmserver ))))
+(typeattribute base_typeattr_497)
+(typeattributeset base_typeattr_497 (and (domain ) (not (init ueventd vendor_init ))))
+(typeattribute base_typeattr_496)
+(typeattributeset base_typeattr_496 (and (domain ) (not (init zygote dexopt_chroot_setup ))))
+(typeattribute base_typeattr_495)
+(typeattributeset base_typeattr_495 (and (domain ) (not (init dexopt_chroot_setup ))))
+(typeattribute base_typeattr_494)
+(typeattributeset base_typeattr_494 (and (domain ) (not (gmscore_app init vold_prepare_subdirs ))))
+(typeattribute base_typeattr_493)
+(typeattributeset base_typeattr_493 (and (domain ) (not (appdomain artd installd system_server traced_probes ))))
+(typeattribute base_typeattr_492)
+(typeattributeset base_typeattr_492 (and (domain ) (not (appdomain adbd artd dumpstate init installd simpleperf_app_runner system_server ))))
+(typeattribute base_typeattr_491)
+(typeattributeset base_typeattr_491 (and (domain ) (not (adbd artd dumpstate init installd shell vold ))))
+(typeattribute base_typeattr_490)
+(typeattributeset base_typeattr_490 (and (domain ) (not (appdomain adbd artd dumpstate installd ))))
+(typeattribute base_typeattr_489)
+(typeattributeset base_typeattr_489 (and (domain ) (not (init kernel vendor_modprobe uprobestats ))))
+(typeattribute base_typeattr_488)
+(typeattributeset base_typeattr_488 (and (domain ) (not (ueventd vendor_init ))))
+(typeattribute base_typeattr_487)
+(typeattributeset base_typeattr_487 (and (debugfs_type ) (not (tracefs_type ))))
+(typeattribute base_typeattr_486)
+(typeattributeset base_typeattr_486 (and (domain ) (not (vendor_modprobe ))))
+(typeattribute base_typeattr_485)
+(typeattributeset base_typeattr_485 (and (domain ) (not (init traced_perf traced_probes ))))
+(typeattribute base_typeattr_484)
+(typeattributeset base_typeattr_484 (and (domain ) (not (init dexopt_chroot_setup otapreopt_chroot ))))
+(typeattribute base_typeattr_483)
+(typeattributeset base_typeattr_483 (and (vendor_file_type ) (not (vendor_cgroup_desc_file vendor_task_profiles_file vendor_app_file vendor_configs_file same_process_hal_file vndk_sp_file vendor_framework_file vendor_overlay_file vendor_public_lib_file vendor_public_framework_file vendor_microdroid_file vendor_boot_ota_file vendor_keylayout_file vendor_keychars_file vendor_idc_file vendor_uuid_mapping_config_file vendor_apex_file vendor_apex_metadata_file vendor_service_contexts_file vendor_aconfig_storage_file ))))
+(typeattribute base_typeattr_482)
+(typeattributeset base_typeattr_482 (and (coredomain ) (not (system_executes_vendor_violators crash_dump crosvm heapprofd init kernel shell traced_perf ueventd vold ))))
+(typeattribute base_typeattr_481)
+(typeattributeset base_typeattr_481 (and (coredomain ) (not (heapprofd init logd mdnsd netd prng_seeder tombstoned traced traced_perf ))))
+(typeattribute base_typeattr_480)
+(typeattributeset base_typeattr_480 (and (domain ) (not (appdomain coredomain socket_between_core_and_vendor_violators ))))
+(typeattribute base_typeattr_479)
+(typeattributeset base_typeattr_479 (and (coredomain ) (not (appdomain bootanim crash_dump heapprofd init kernel traced_perf ueventd ))))
+(typeattribute base_typeattr_478)
+(typeattributeset base_typeattr_478 (and (domain ) (not (init vendor_init art_boot ))))
+(typeattribute base_typeattr_477)
+(typeattributeset base_typeattr_477 (and (domain ) (not (dumpstate init system_server ))))
+(typeattribute base_typeattr_476)
+(typeattributeset base_typeattr_476 (and (domain ) (not (fsck init installd zygote ))))
+(typeattribute base_typeattr_475)
+(typeattributeset base_typeattr_475 (and (domain ) (not (hal_bootctl_server fastbootd init kernel recovery tee ueventd uncrypt gsid ))))
+(typeattribute base_typeattr_474)
+(typeattributeset base_typeattr_474 (and (debugfs_type ) (not (debugfs_tracing_debug ))))
+(typeattribute base_typeattr_473)
+(typeattributeset base_typeattr_473 (and (fs_type ) (not (fusefs_type sdcard_type ))))
+(typeattribute base_typeattr_472)
+(typeattributeset base_typeattr_472 (and (domain ) (not (apexd init kernel recovery update_engine vold zygote dexopt_chroot_setup otapreopt_chroot ))))
+(typeattribute base_typeattr_471)
+(typeattributeset base_typeattr_471 (not (apexd artd dnsmasq dumpstate heapprofd init installd lmkd netd recovery rss_hwm_reset sdcardd tee traced_perf traced_probes ueventd uncrypt vendor_init vold vold_prepare_subdirs zygote migrate_legacy_obb_data postinstall_dexopt ) ))
+(typeattribute base_typeattr_470)
+(typeattributeset base_typeattr_470 (not (apexd artd dnsmasq dumpstate init installd lmkd netd recovery rss_hwm_reset sdcardd tee ueventd uncrypt vendor_init vold vold_prepare_subdirs zygote migrate_legacy_obb_data postinstall_dexopt ) ))
+(typeattribute base_typeattr_469)
+(typeattributeset base_typeattr_469 (and (domain ) (not (apexd init vold_prepare_subdirs compos_fd_server composd odrefresh odsign ))))
+(typeattribute base_typeattr_468)
+(typeattributeset base_typeattr_468 (and (domain ) (not (artd init installd zygote cppreopts dex2oat otapreopt_slot postinstall_dexopt ))))
+(typeattribute base_typeattr_467)
+(typeattributeset base_typeattr_467 (and (file_type ) (not (exec_type system_file_type vendor_file_type system_lib_file system_bootstrap_lib_file system_linker_exec postinstall_file ))))
+(typeattribute base_typeattr_466)
+(typeattributeset base_typeattr_466 (and (domain ) (not (appdomain app_zygote shell webview_zygote zygote system_server_startup ))))
+(typeattribute base_typeattr_465)
+(typeattributeset base_typeattr_465 (and (fs_type ) (not (rootfs ))))
+(typeattribute base_typeattr_464)
+(typeattributeset base_typeattr_464 (and (domain ) (not (appdomain bootanim recovery ))))
+(typeattribute base_typeattr_463)
+(typeattributeset base_typeattr_463 (and (domain ) (not (apexd init installd system_server update_provider ))))
+(typeattribute base_typeattr_462)
+(typeattributeset base_typeattr_462 (and (domain ) (not (init installd system_server update_provider ))))
+(typeattribute base_typeattr_461)
+(typeattributeset base_typeattr_461 (and (domain ) (not (adbd apexd crosvm init installd kernel priv_app shell system_app system_server virtualizationmanager update_provider ))))
+(typeattribute base_typeattr_460)
+(typeattributeset base_typeattr_460 (and (domain ) (not (apexd init installd priv_app system_server virtualizationmanager update_provider ))))
+(typeattribute base_typeattr_459)
+(typeattributeset base_typeattr_459 (and (domain ) (not (artd installd ))))
+(typeattribute base_typeattr_458)
+(typeattributeset base_typeattr_458 (and (domain ) (not (appdomain app_zygote artd installd rs ))))
+(typeattribute base_typeattr_457)
+(typeattributeset base_typeattr_457 (and (domain ) (not (appdomain artd installd rs vold_prepare_subdirs ))))
+(typeattribute base_typeattr_456)
+(typeattributeset base_typeattr_456 (and (domain ) (not (appdomain artd installd rs ))))
+(typeattribute base_typeattr_455)
+(typeattributeset base_typeattr_455 (and (domain ) (not (init installd vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_454)
+(typeattributeset base_typeattr_454 (and (domain ) (not (appdomain app_zygote artd installd rs system_server vold vold_prepare_subdirs zygote ))))
+(typeattribute base_typeattr_453)
+(typeattributeset base_typeattr_453 (and (domain ) (not (appdomain adbd app_zygote artd installd profman rs runas system_server zygote ))))
+(typeattribute base_typeattr_452)
+(typeattributeset base_typeattr_452 (and (domain ) (not (artd installd vold_prepare_subdirs ))))
+(typeattribute base_typeattr_451)
+(typeattributeset base_typeattr_451 (and (domain ) (not (gmscore_app priv_app ))))
+(typeattribute base_typeattr_450)
+(typeattributeset base_typeattr_450 (and (domain ) (not (dumpstate system_server vold storaged ))))
+(typeattribute base_typeattr_449)
+(typeattributeset base_typeattr_449 (and (domain ) (not (hal_bootctl_server fastbootd init recovery ueventd uncrypt update_engine vendor_init vendor_misc_writer vold kcmdlinectrl misctrl mtectrl ))))
+(typeattribute base_typeattr_448)
+(typeattributeset base_typeattr_448 (and (domain ) (not (init traced_probes vendor_init ))))
+(typeattribute base_typeattr_447)
+(typeattributeset base_typeattr_447 (and (domain ) (not (ephemeral_app untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_446)
+(typeattributeset base_typeattr_446 (and (domain ) (not (hal_codec2_server hal_omx_server ))))
+(typeattribute base_typeattr_445)
+(typeattributeset base_typeattr_445 (and (coredomain ) (not (apexd charger incidentd init recovery shell ueventd ))))
+(typeattribute base_typeattr_444)
+(typeattributeset base_typeattr_444 (and (coredomain ) (not (appdomain ))))
+(typeattribute base_typeattr_443)
+(typeattributeset base_typeattr_443 (and (coredomain ) (not (system_writes_mnt_vendor_violators init ueventd vold ))))
+(typeattribute base_typeattr_442)
+(typeattributeset base_typeattr_442 (not (coredomain ) ))
+(typeattribute base_typeattr_441)
+(typeattributeset base_typeattr_441 (not (system_file_type system_dlkm_file_type vendor_file_type rootfs ) ))
+(typeattribute base_typeattr_440)
+(typeattributeset base_typeattr_440 (and (domain ) (not (artd installd profman ))))
+(typeattribute base_typeattr_439)
+(typeattributeset base_typeattr_439 (and (domain ) (not (init vendor_init vold ))))
+(typeattribute base_typeattr_438)
+(typeattributeset base_typeattr_438 (not (hwservicemanager ) ))
+(typeattribute base_typeattr_437)
+(typeattributeset base_typeattr_437 (not (servicemanager vndservicemanager ) ))
+(typeattribute base_typeattr_436)
+(typeattributeset base_typeattr_436 (and (domain ) (not (installd shell ))))
+(typeattribute base_typeattr_435)
+(typeattributeset base_typeattr_435 (and (domain ) (not (appdomain artd installd ))))
+(typeattribute base_typeattr_434)
+(typeattributeset base_typeattr_434 (and (appdomain ) (not (shell simpleperf tradeinmode ))))
+(typeattribute base_typeattr_433)
+(typeattributeset base_typeattr_433 (and (domain ) (not (app_zygote runas simpleperf_app_runner webview_zygote zygote ))))
+(typeattribute base_typeattr_432)
+(typeattributeset base_typeattr_432 (and (domain ) (not (adbd init runas zygote ))))
+(typeattribute base_typeattr_431)
+(typeattributeset base_typeattr_431 (and (domain ) (not (init installd system_app system_server toolbox vold_prepare_subdirs ))))
+(typeattribute base_typeattr_430)
+(typeattributeset base_typeattr_430 (not (domain ) ))
+(typeattribute base_typeattr_429)
+(typeattributeset base_typeattr_429 (and (domain ) (not (untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_428)
+(typeattributeset base_typeattr_428 (and (file_type ) (not (apk_data_file app_data_file asec_public_file ))))
+(typeattribute base_typeattr_427)
+(typeattributeset base_typeattr_427 (and (domain ) (not (init system_server ))))
+(typeattribute base_typeattr_426)
+(typeattributeset base_typeattr_426 (and (domain ) (not (dumpstate incidentd system_server ))))
+(typeattribute base_typeattr_425)
+(typeattributeset base_typeattr_425 (and (domain ) (not (app_zygote system_server webview_zygote ))))
+(typeattribute base_typeattr_424)
+(typeattributeset base_typeattr_424 (and (domain ) (not (system_server ))))
+(typeattribute base_typeattr_423)
+(typeattributeset base_typeattr_423 (and (domain ) (not (system_server zygote ))))
+(typeattribute base_typeattr_422)
+(typeattributeset base_typeattr_422 (and (system_file_type ) (not (crash_dump_exec early_virtmgr_exec system_event_log_tags_file system_lib_file system_bootstrap_lib_file system_group_file system_linker_exec system_linker_config_file system_passwd_file system_seccomp_policy_file system_security_cacerts_file system_zoneinfo_file cgroup_desc_file task_profiles_file file_contexts_file property_contexts_file netutils_wrapper_exec shell_exec toolbox_exec virtualizationmanager_exec ))))
+(typeattribute base_typeattr_421)
+(typeattributeset base_typeattr_421 (and (vendor_file_type ) (not (same_process_hal_file ))))
+(typeattribute base_typeattr_420)
+(typeattributeset base_typeattr_420 (and (coredomain ) (not (system_executes_vendor_violators shell ))))
+(typeattribute base_typeattr_419)
+(typeattributeset base_typeattr_419 (and (vendor_file_type ) (not (vendor_app_file same_process_hal_file vndk_sp_file vendor_public_lib_file vendor_public_framework_file ))))
+(typeattribute base_typeattr_418)
+(typeattributeset base_typeattr_418 (and (coredomain ) (not (system_executes_vendor_violators init shell ueventd ))))
+(typeattribute base_typeattr_417)
+(typeattributeset base_typeattr_417 (and (file_type ) (not (vendor_file_type init_exec ))))
+(typeattribute base_typeattr_416)
+(typeattributeset base_typeattr_416 (and (file_type ) (not (system_file_type postinstall_file ))))
+(typeattribute base_typeattr_415)
+(typeattributeset base_typeattr_415 (and (system_file_type ) (not (crash_dump_exec early_virtmgr_exec system_lib_file system_bootstrap_lib_file system_linker_exec netutils_wrapper_exec shell_exec toolbox_exec virtualizationmanager_exec ))))
+(typeattribute base_typeattr_414)
+(typeattributeset base_typeattr_414 (and (domain ) (not (appdomain coredomain vendor_executes_system_violators vendor_init ))))
+(typeattribute base_typeattr_413)
+(typeattributeset base_typeattr_413 (and (coredomain ) (not (init shell ueventd ))))
+(typeattribute base_typeattr_412)
+(typeattributeset base_typeattr_412 (and (coredomain ) (not (data_between_core_and_vendor_violators init ))))
+(typeattribute base_typeattr_411)
+(typeattributeset base_typeattr_411 (and (coredomain ) (not (data_between_core_and_vendor_violators init vold vold_prepare_subdirs ))))
+(typeattribute base_typeattr_410)
+(typeattributeset base_typeattr_410 (and (domain ) (not (appdomain coredomain data_between_core_and_vendor_violators ))))
+(typeattribute base_typeattr_409)
+(typeattributeset base_typeattr_409 (and (core_data_file_type ) (not (system_data_root_file system_data_file vendor_data_file vendor_userdir_file unencrypted_data_file ))))
+(typeattribute base_typeattr_408)
+(typeattributeset base_typeattr_408 (and (core_data_file_type ) (not (system_data_root_file system_data_file vendor_data_file vendor_userdir_file ))))
+(typeattribute base_typeattr_407)
+(typeattributeset base_typeattr_407 (and (core_data_file_type ) (not (unencrypted_data_file ))))
+(typeattribute base_typeattr_406)
+(typeattributeset base_typeattr_406 (and (vendor_init ) (not (data_between_core_and_vendor_violators ))))
+(typeattribute base_typeattr_405)
+(typeattributeset base_typeattr_405 (and (domain ) (not (appdomain coredomain data_between_core_and_vendor_violators vendor_init ))))
+(typeattribute base_typeattr_404)
+(typeattributeset base_typeattr_404 (and (data_file_type ) (not (core_data_file_type app_data_file_type vendor_data_file ))))
+(typeattribute base_typeattr_403)
+(typeattributeset base_typeattr_403 (and (data_file_type ) (not (core_data_file_type app_data_file_type ))))
+(typeattribute base_typeattr_402)
+(typeattributeset base_typeattr_402 (and (coredomain ) (not (appdomain data_between_core_and_vendor_violators init vold_prepare_subdirs ))))
+(typeattribute base_typeattr_401)
+(typeattributeset base_typeattr_401 (and (dev_type file_type ) (not (core_data_file_type app_data_file_type coredomain_socket unlabeled ))))
+(typeattribute base_typeattr_400)
+(typeattributeset base_typeattr_400 (and (coredomain ) (not (socket_between_core_and_vendor_violators init ueventd ))))
+(typeattribute base_typeattr_399)
+(typeattributeset base_typeattr_399 (and (core_data_file_type coredomain_socket unlabeled ) (not (pdx_endpoint_socket_type pdx_channel_socket_type app_data_file privapp_data_file ))))
+(typeattribute base_typeattr_398)
+(typeattributeset base_typeattr_398 (and (domain ) (not (appdomain coredomain socket_between_core_and_vendor_violators data_between_core_and_vendor_violators vendor_init ))))
+(typeattribute base_typeattr_397)
+(typeattributeset base_typeattr_397 (and (domain ) (not (coredomain socket_between_core_and_vendor_violators ))))
+(typeattribute base_typeattr_396)
+(typeattributeset base_typeattr_396 (and (coredomain ) (not (adbd init ))))
+(typeattribute base_typeattr_395)
+(typeattributeset base_typeattr_395 (and (coredomain ) (not (shell ))))
+(typeattribute base_typeattr_394)
+(typeattributeset base_typeattr_394 (and (coredomain ) (not (shell ueventd ))))
+(typeattribute base_typeattr_393)
+(typeattributeset base_typeattr_393 (and (service_manager_type ) (not (app_api_service ephemeral_app_api_service hal_service_type apc_service audioserver_service cameraserver_service drmserver_service credstore_service keystore_maintenance_service keystore_service legacykeystore_service mediaserver_service mediametrics_service mediaextractor_service mediadrmserver_service nfc_service radio_service virtual_touchpad_service vr_manager_service ))))
+(typeattribute base_typeattr_392)
+(typeattributeset base_typeattr_392 (and (appdomain ) (not (coredomain ))))
+(typeattribute base_typeattr_391)
+(typeattributeset base_typeattr_391 (and (domain ) (not (hwservicemanager servicemanager vndservicemanager ))))
+(typeattribute base_typeattr_390)
+(typeattributeset base_typeattr_390 (and (domain ) (not (fastbootd recovery update_engine ))))
+(typeattribute base_typeattr_389)
+(typeattributeset base_typeattr_389 (and (domain ) (not (hal_fastboot_server e2fs fastbootd fsck init recovery vold ))))
+(typeattribute base_typeattr_388)
+(typeattributeset base_typeattr_388 (and (domain ) (not (init recovery system_server ueventd ))))
+(typeattribute base_typeattr_387)
+(typeattributeset base_typeattr_387 (and (domain ) (not (hal_camera_server hal_cas_server hal_drm_server hal_keymint_server adbd dumpstate fastbootd init mediadrmserver mediaserver recovery shell system_server vendor_init adbd_tradeinmode ))))
+(typeattribute base_typeattr_386)
+(typeattributeset base_typeattr_386 (and (domain ) (not (coredomain vendor_init ))))
+(typeattribute base_typeattr_385)
+(typeattributeset base_typeattr_385 (and (domain ) (not (init system_server vendor_init ))))
+(typeattribute base_typeattr_384)
+(typeattributeset base_typeattr_384 (and (fs_type ) (not (contextmount_type ))))
+(typeattribute base_typeattr_383)
+(typeattributeset base_typeattr_383 (and (domain ) (not (adbd crash_dump heapprofd init shell ))))
+(typeattribute base_typeattr_382)
+(typeattributeset base_typeattr_382 (and (domain ) (not (adbd init shell ))))
+(typeattribute base_typeattr_381)
+(typeattributeset base_typeattr_381 (and (domain ) (not (init kernel recovery ))))
+(typeattribute base_typeattr_380)
+(typeattributeset base_typeattr_380 (and (domain ) (not (dumpstate init vendor_init ))))
+(typeattribute base_typeattr_379)
+(typeattributeset base_typeattr_379 (and (domain ) (not (init ueventd ))))
+(typeattribute base_typeattr_378)
+(typeattributeset base_typeattr_378 (and (file_type ) (not (exec_type postinstall_file ))))
+(typeattribute base_typeattr_377)
+(typeattributeset base_typeattr_377 (and (domain ) (not (shell ueventd ))))
+(typeattribute base_typeattr_376)
+(typeattributeset base_typeattr_376 (and (domain ) (not (prng_seeder shell ueventd ))))
+(typeattribute base_typeattr_375)
+(typeattributeset base_typeattr_375 (and (domain ) (not (kernel ))))
+(typeattribute base_typeattr_374)
+(typeattributeset base_typeattr_374 (and (domain ) (not (init kernel ueventd vold ))))
+(typeattribute base_typeattr_373)
+(typeattributeset base_typeattr_373 (and (domain ) (not (init recovery ))))
+(typeattribute base_typeattr_372)
+(typeattributeset base_typeattr_372 (and (domain ) (not (hal_audio_server hal_camera_server hal_cas_server hal_codec2_server hal_configstore_server hal_drm_server hal_omx_server app_zygote artd audioserver cameraserver init kernel mediadrmserver mediaextractor mediametrics mediaserver mediatranscoding system_server ueventd vendor_init webview_zygote dexopt_chroot_setup mediatuner ))))
+(typeattribute base_typeattr_371)
+(typeattributeset base_typeattr_371 (and (domain ) (not (dumpstate init system_server vendor_init ))))
+(typeattribute base_typeattr_370)
+(typeattributeset base_typeattr_370 (and (domain ) (not (untrusted_app_all isolated_app_all app_zygote ephemeral_app ))))
+(typeattribute base_typeattr_369)
+(typeattributeset base_typeattr_369 (and (domain ) (not (appdomain coredomain ))))
+(typeattribute base_typeattr_368)
+(typeattributeset base_typeattr_368 (and (domain ) (not (appdomain rs ))))
+(typeattribute base_typeattr_367)
+(typeattributeset base_typeattr_367 (and (domain ) (not (hal_configstore_server apexd app_zygote bpfloader crash_dump crosvm init kernel keystore llkd logd ueventd vendor_init vold webview_zygote zygote ))))
+(typeattribute base_typeattr_366)
+(typeattributeset base_typeattr_366 (and (domain ) (not (hal_configstore_server apexd app_zygote bpfloader crash_dump crosvm init kernel keystore llkd logd logpersist recovery recovery_persist recovery_refresh ueventd vendor_init vold webview_zygote zygote ))))
+(typeattribute base_typeattr_365)
+(typeattributeset base_typeattr_365 (and (domain ) (not (domain ))))
+(typeattribute base_typeattr_364)
+(typeattributeset base_typeattr_364 (and (domain ) (not (isolated_app servicemanager vndservicemanager ))))
+(typeattribute base_typeattr_363)
+(typeattributeset base_typeattr_363 (and (domain ) (not (hwservicemanager vndservicemanager ))))
+(typeattribute base_typeattr_362)
+(typeattributeset base_typeattr_362 (and (domain ) (not (artd_subprocess_type ))))
+(typeattribute base_typeattr_361)
+(typeattributeset base_typeattr_361 (and (domain ) (not (display_service_server ))))
+(typeattribute base_typeattr_360)
+(typeattributeset base_typeattr_360 (and (domain ) (not (artd init system_server vendor_init art_exec dexopt_chroot_setup ))))
+(typeattribute base_typeattr_359)
+(typeattributeset base_typeattr_359 (and (domain ) (not (dexopt_chroot_setup ))))
+(typeattribute base_typeattr_358)
+(typeattributeset base_typeattr_358 (and (domain ) (not (dex2oat ))))
+(typeattribute base_typeattr_357)
+(typeattributeset base_typeattr_357 (and (domain ) (not (crash_dump runas_app simpleperf device_as_webcam ))))
+(typeattribute base_typeattr_356)
+(typeattributeset base_typeattr_356 (and (appdomain ) (not (runas_app shell simpleperf device_as_webcam ))))
+(typeattribute base_typeattr_355)
+(typeattributeset base_typeattr_355 (and (device_as_webcam ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_354)
+(typeattributeset base_typeattr_354 (and (domain ) (not (device_as_webcam ))))
+(typeattribute base_typeattr_353)
+(typeattributeset base_typeattr_353 (and (domain ) (not (init derive_sdk ))))
+(typeattribute base_typeattr_352)
+(typeattributeset base_typeattr_352 (and (domain ) (not (crosvm early_virtmgr virtualizationmanager vmlauncher_app ))))
+(typeattribute base_typeattr_351)
+(typeattributeset base_typeattr_351 (and (app_data_file_type ) (not (shell_data_file app_data_file privapp_data_file ))))
+(typeattribute base_typeattr_350)
+(typeattributeset base_typeattr_350 (and (vendor_file_type ) (not (vendor_cgroup_desc_file vendor_task_profiles_file vendor_configs_file same_process_hal_file vndk_sp_file vendor_microdroid_file vendor_vm_file vendor_vm_data_file ))))
+(typeattribute base_typeattr_349)
+(typeattributeset base_typeattr_349 (and (appdomain coredomain ) (not (crosvm ueventd ))))
+(typeattribute base_typeattr_348)
+(typeattributeset base_typeattr_348 (and (appdomain coredomain ) (not (crosvm shell ueventd ))))
+(typeattribute base_typeattr_347)
+(typeattributeset base_typeattr_347 (and (domain ) (not (crosvm ))))
+(typeattribute base_typeattr_346)
+(typeattributeset base_typeattr_346 (and (domain ) (not (crosvm ueventd ))))
+(typeattribute base_typeattr_345)
+(typeattributeset base_typeattr_345 (and (domain ) (not (crosvm shell ueventd ))))
+(typeattribute base_typeattr_344)
+(typeattributeset base_typeattr_344 (and (domain ) (not (credstore ))))
+(typeattribute base_typeattr_343)
+(typeattributeset base_typeattr_343 (and (domain ) (not (apexd bpfloader crash_dump init kernel keystore llkd logd ueventd vendor_init vold ))))
+(typeattribute base_typeattr_342)
+(typeattributeset base_typeattr_342 (and (dmabuf_heap_device_type ) (not (dmabuf_system_heap_device dmabuf_system_secure_heap_device ))))
+(typeattribute base_typeattr_341)
+(typeattributeset base_typeattr_341 (and (coredomain ) (not (init ueventd ))))
+(typeattribute base_typeattr_340)
+(typeattributeset base_typeattr_340 (and (coredomain ) (not (adbd init mediaprovider system_server adbd_tradeinmode ))))
+(typeattribute base_typeattr_339)
+(typeattributeset base_typeattr_339 (and (coredomain ) (not (init system_server ))))
+(typeattribute base_typeattr_338)
+(typeattributeset base_typeattr_338 (and (coredomain ) (not (bootstat charger dumpstate init logd logpersist recovery_persist recovery_refresh shell system_server ))))
+(typeattribute base_typeattr_337)
+(typeattributeset base_typeattr_337 (and (coredomain ) (not (init ))))
+(typeattribute base_typeattr_336)
+(typeattributeset base_typeattr_336 (and (coredomain ) (not (atrace dumpstate gpuservice init lmkd shell system_server traced_perf traced_probes traceur_app prefetch ))))
+(typeattribute base_typeattr_335)
+(typeattributeset base_typeattr_335 (and (coredomain ) (not (apexd fsck init ueventd ))))
+(typeattribute base_typeattr_334)
+(typeattributeset base_typeattr_334 (and (coredomain ) (not (apexd init ueventd vold vfio_handler ))))
+(typeattribute base_typeattr_333)
+(typeattributeset base_typeattr_333 (and (coredomain ) (not (init vold ))))
+(typeattribute base_typeattr_332)
+(typeattributeset base_typeattr_332 (and (coredomain ) (not (appdomain app_zygote artd heapprofd idmap init installd rs system_server traced_perf webview_zygote zygote dex2oat postinstall_dexopt ))))
+(typeattribute base_typeattr_331)
+(typeattributeset base_typeattr_331 (and (coredomain ) (not (appdomain artd heapprofd idmap init installd mediaserver profman rs system_server traced_perf dex2oat postinstall_dexopt ))))
+(typeattribute base_typeattr_330)
+(typeattributeset base_typeattr_330 (and (coredomain ) (not (appdomain artd heapprofd idmap init installd rs system_server traced_perf dex2oat postinstall_dexopt ))))
+(typeattribute base_typeattr_329)
+(typeattributeset base_typeattr_329 (and (coredomain ) (not (apexd init ueventd vold ))))
+(typeattribute base_typeattr_328)
+(typeattributeset base_typeattr_328 (and (domain ) (not (odsign ))))
+(typeattribute base_typeattr_327)
+(typeattributeset base_typeattr_327 (and (domain ) (not (composd ))))
+(typeattribute base_typeattr_326)
+(typeattributeset base_typeattr_326 (and (domain ) (not (charger charger_vendor dumpstate init vendor_init ))))
+(typeattribute base_typeattr_325)
+(typeattributeset base_typeattr_325 (and (domain ) (not (charger charger_vendor init vendor_init ))))
+(typeattribute base_typeattr_324)
+(typeattributeset base_typeattr_324 (and (domain ) (not (charger dumpstate init ))))
+(typeattribute base_typeattr_323)
+(typeattributeset base_typeattr_323 (and (domain ) (not (cameraserver ))))
+(typeattribute base_typeattr_322)
+(typeattributeset base_typeattr_322 (and (domain ) (not (camera_service_server ))))
+(typeattribute base_typeattr_321)
+(typeattributeset base_typeattr_321 (and (domain ) (not (bufferhubd ))))
+(typeattribute base_typeattr_320)
+(typeattributeset base_typeattr_320 (and (coredomain ) (not (bpfloader netd netutils_wrapper ))))
+(typeattribute base_typeattr_319)
+(typeattributeset base_typeattr_319 (and (domain ) (not (bpfloader init ))))
+(typeattribute base_typeattr_318)
+(typeattributeset base_typeattr_318 (and (bpffs_type ) (not (fs_bpf_vendor ))))
+(typeattribute base_typeattr_317)
+(typeattributeset base_typeattr_317 (and (domain ) (not (bpfloader gpuservice lmkd netd netutils_wrapper network_stack system_server uprobestats ))))
+(typeattribute base_typeattr_316)
+(typeattributeset base_typeattr_316 (and (domain ) (not (bpfloader uprobestats ))))
+(typeattribute base_typeattr_315)
+(typeattributeset base_typeattr_315 (and (domain ) (not (bpfloader netd netutils_wrapper network_stack system_server ))))
+(typeattribute base_typeattr_314)
+(typeattributeset base_typeattr_314 (and (domain ) (not (bpfloader netd network_stack system_server ))))
+(typeattribute base_typeattr_313)
+(typeattributeset base_typeattr_313 (and (domain ) (not (bpfloader network_stack system_server ))))
+(typeattribute base_typeattr_312)
+(typeattributeset base_typeattr_312 (and (domain ) (not (bpfloader network_stack ))))
+(typeattribute base_typeattr_311)
+(typeattributeset base_typeattr_311 (and (domain ) (not (bpfloader gpuservice lmkd netd netutils_wrapper system_server mediaprovider_app ))))
+(typeattribute base_typeattr_310)
+(typeattributeset base_typeattr_310 (and (domain ) (not (bpfloader ))))
+(typeattribute base_typeattr_309)
+(typeattributeset base_typeattr_309 (and (bpffs_type ) (not (fs_bpf ))))
+(typeattribute base_typeattr_308)
+(typeattributeset base_typeattr_308 (and (domain ) (not (bpfdomain ))))
+(typeattribute base_typeattr_307)
+(typeattributeset base_typeattr_307 (and (bpfdomain ) (not (bpfloader netd netutils_wrapper network_stack system_server ))))
+(typeattribute base_typeattr_306)
+(typeattributeset base_typeattr_306 (and (domain ) (not (init vendor_init boringssl_self_test vendor_boringssl_self_test ))))
+(typeattribute base_typeattr_305)
+(typeattributeset base_typeattr_305 (and (domain ) (not (bootstat init system_server ))))
+(typeattribute base_typeattr_304)
+(typeattributeset base_typeattr_304 (and (domain ) (not (bootanim bootstat dumpstate init platform_app recovery shell system_server ))))
+(typeattribute base_typeattr_303)
+(typeattributeset base_typeattr_303 (and (domain ) (not (bootstat init ))))
+(typeattribute base_typeattr_302)
+(typeattributeset base_typeattr_302 (and (domain ) (not (bluetooth init ))))
+(typeattribute base_typeattr_301)
+(typeattributeset base_typeattr_301 (and (domain ) (not (bluetooth crash_dump runas_app simpleperf ))))
+(typeattribute base_typeattr_300)
+(typeattributeset base_typeattr_300 (and (appdomain ) (not (bluetooth runas_app shell simpleperf ))))
+(typeattribute base_typeattr_299)
+(typeattributeset base_typeattr_299 (and (bluetooth ) (not (runas_app shell simpleperf ))))
+(typeattribute base_typeattr_298)
+(typeattributeset base_typeattr_298 (and (domain ) (not (bluetooth ))))
+(typeattribute base_typeattr_297)
+(typeattributeset base_typeattr_297 (and (fs_type file_type ) (not (shell_exec blkid_exec ))))
+(typeattribute base_typeattr_296)
+(typeattributeset base_typeattr_296 (and (domain ) (not (vold ))))
+(typeattribute base_typeattr_295)
+(typeattributeset base_typeattr_295 (and (domain ) (not (automotive_display_service ))))
+(typeattribute base_typeattr_294)
+(typeattributeset base_typeattr_294 (and (domain ) (not (audioserver ))))
+(typeattribute base_typeattr_293)
+(typeattributeset base_typeattr_293 (and (service_manager_type ) (not (apex_service default_android_service dnsresolver_service dumpstate_service incident_service installd_service lpdump_service mdns_service netd_service vold_service stats_service tracingproxy_service ))))
+(typeattribute base_typeattr_292)
+(typeattributeset base_typeattr_292 (not (crash_dump artd_subprocess_type ) ))
+(typeattribute base_typeattr_291)
+(typeattributeset base_typeattr_291 (not (art_exec_exec ) ))
+(typeattribute base_typeattr_290)
+(typeattributeset base_typeattr_290 (and (domain ) (not (artd ))))
+(typeattribute base_typeattr_289)
+(typeattributeset base_typeattr_289 (and (domain ) (not (app_zygote prng_seeder ))))
+(typeattribute base_typeattr_288)
+(typeattributeset base_typeattr_288 (and (domain ) (not (app_zygote logd system_server ))))
+(typeattribute base_typeattr_287)
+(typeattributeset base_typeattr_287 (and (service_manager_type ) (not (activity_service webviewupdate_service ))))
+(typeattribute base_typeattr_286)
+(typeattributeset base_typeattr_286 (and (domain ) (not (zygote ))))
+(typeattribute base_typeattr_285)
+(typeattributeset base_typeattr_285 (and (domain ) (not (crash_dump ))))
+(typeattribute base_typeattr_284)
+(typeattributeset base_typeattr_284 (and (domain ) (not (isolated_app ))))
+(typeattribute base_typeattr_283)
+(typeattributeset base_typeattr_283 (and (domain ) (not (app_zygote ))))
+(typeattribute base_typeattr_282)
+(typeattributeset base_typeattr_282 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_281)
+(typeattributeset base_typeattr_281 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (mediaprovider mediaprovider_app ))))
+(typeattribute base_typeattr_280)
+(typeattributeset base_typeattr_280 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (untrusted_app_25 ))))
+(typeattribute base_typeattr_279)
+(typeattributeset base_typeattr_279 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (mediaprovider_app ))))
+(typeattribute base_typeattr_278)
+(typeattributeset base_typeattr_278 (and (fs_type file_type ) (not (sdcard_type fuse user_profile_data_file media_rw_data_file app_data_file privapp_data_file app_exec_data_file storage_area_content_file ))))
+(typeattribute base_typeattr_277)
+(typeattributeset base_typeattr_277 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_276)
+(typeattributeset base_typeattr_276 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_275)
+(typeattributeset base_typeattr_275 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (runas_app untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_274)
+(typeattributeset base_typeattr_274 (and (untrusted_app_all isolated_app_all ephemeral_app isolated_app isolated_compute_app mediaprovider untrusted_app untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 mediaprovider_app ) (not (mediaprovider ))))
+(typeattribute base_typeattr_273)
+(typeattributeset base_typeattr_273 (and (debugfs_type ) (not (debugfs_kcov ))))
+(typeattribute base_typeattr_272)
+(typeattributeset base_typeattr_272 (and (appdomain ) (not (mediaprovider_app ))))
+(typeattribute base_typeattr_271)
+(typeattributeset base_typeattr_271 (and (domain ) (not (appdomain crash_dump rs virtualizationmanager ))))
+(typeattribute base_typeattr_270)
+(typeattributeset base_typeattr_270 (and (appdomain ) (not (untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 ))))
+(typeattribute base_typeattr_269)
+(typeattributeset base_typeattr_269 (and (appdomain ) (not (device_as_webcam ))))
+(typeattribute base_typeattr_268)
+(typeattributeset base_typeattr_268 (and (data_file_type ) (not (system_data_file apk_data_file dalvikcache_data_file apex_art_data_file ))))
+(typeattribute base_typeattr_267)
+(typeattributeset base_typeattr_267 (and (appdomain ) (not (bluetooth system_app ))))
+(typeattribute base_typeattr_266)
+(typeattributeset base_typeattr_266 (and (appdomain ) (not (bluetooth nfc ))))
+(typeattribute base_typeattr_265)
+(typeattributeset base_typeattr_265 (and (domain ) (not (credstore init ))))
+(typeattribute base_typeattr_264)
+(typeattributeset base_typeattr_264 (and (appdomain ) (not (platform_app ))))
+(typeattribute base_typeattr_263)
+(typeattributeset base_typeattr_263 (and (domain ) (not (appdomain perfetto ))))
+(typeattribute base_typeattr_262)
+(typeattributeset base_typeattr_262 (and (appdomain ) (not (shell ))))
+(typeattribute base_typeattr_261)
+(typeattributeset base_typeattr_261 (and (domain ) (not (appdomain crash_dump ))))
+(typeattribute base_typeattr_260)
+(typeattributeset base_typeattr_260 (and (domain ) (not (appdomain ))))
+(typeattribute base_typeattr_259)
+(typeattributeset base_typeattr_259 (and (appdomain ) (not (radio ))))
+(typeattribute base_typeattr_258)
+(typeattributeset base_typeattr_258 (and (appdomain ) (not (network_stack ))))
+(typeattribute base_typeattr_257)
+(typeattributeset base_typeattr_257 (and (appdomain ) (not (nfc ))))
+(typeattribute base_typeattr_256)
+(typeattributeset base_typeattr_256 (and (appdomain ) (not (bluetooth network_stack ))))
+(typeattribute base_typeattr_255)
+(typeattributeset base_typeattr_255 (and (appdomain ) (not (bluetooth ))))
+(typeattribute base_typeattr_254)
+(typeattributeset base_typeattr_254 (and (appdomain ) (not (isolated_app_all ))))
+(typeattribute base_typeattr_253)
+(typeattributeset base_typeattr_253 (and (appdomain ) (not (mlstrustedsubject isolated_app_all sdk_sandbox_all ))))
+(typeattribute base_typeattr_252)
+(typeattributeset base_typeattr_252 (and (appdomain ) (not (isolated_app_all sdk_sandbox_all ))))
+(typeattribute base_typeattr_251)
+(typeattributeset base_typeattr_251 (and (appdomain ) (not (isolated_app_all ephemeral_app sdk_sandbox_all ))))
+(typeattribute base_typeattr_250)
+(typeattributeset base_typeattr_250 (and (appdomain ) (not (ephemeral_app sdk_sandbox_all ))))
+(typeattribute base_typeattr_249)
+(typeattributeset base_typeattr_249 (and (appdomain ) (not (sdk_sandbox_all ))))
+(typeattribute base_typeattr_248)
+(typeattributeset base_typeattr_248 (and (appdomain ) (not (untrusted_app_all isolated_app_all ephemeral_app platform_app priv_app shell system_app sdk_sandbox_all ))))
+(typeattribute base_typeattr_247)
+(typeattributeset base_typeattr_247 (and (domain ) (not (apexd init keystore servicemanager system_server update_engine update_provider ))))
+(typeattribute base_typeattr_246)
+(typeattributeset base_typeattr_246 (and (domain ) (not (apexd init keystore system_server update_engine update_provider ))))
+(typeattribute base_typeattr_245)
+(typeattributeset base_typeattr_245 (and (domain ) (not (apexd init dexopt_chroot_setup otapreopt_chroot ))))
+(typeattribute base_typeattr_244)
+(typeattributeset base_typeattr_244 (and (domain ) (not (apexd init otapreopt_chroot ))))
+(typeattribute base_typeattr_243)
+(typeattributeset base_typeattr_243 (and (domain ) (not (apexd init vold_prepare_subdirs ))))
+(typeattribute base_typeattr_242)
+(typeattributeset base_typeattr_242 (and (domain ) (not (apexd init kernel ))))
+(typeattribute base_typeattr_241)
+(typeattributeset base_typeattr_241 (and (domain ) (not (apexd init ))))
+(typeattribute base_typeattr_240)
+(typeattributeset base_typeattr_240 (and (domain ) (not (apexd ))))
+(typeattribute base_typeattr_239)
+(typeattributeset base_typeattr_239 (and (domain ) (not (adbd_tradeinmode ))))
+(typeattribute base_typeattr_238)
+(typeattributeset base_typeattr_238 (and (domain ) (not (crash_dump shell adbd_tradeinmode ))))
+(typeattribute base_typeattr_237)
+(typeattributeset base_typeattr_237 (and (domain ) (not (init aconfigd aconfigd_mainline ))))
+(typeattribute base_typeattr_236)
+(typeattributeset base_typeattr_236 (all))
+(typeattribute base_typeattr_235)
+(typeattributeset base_typeattr_235 (and (domain ) (not (init ))))
+(typeattribute base_typeattr_234)
+(typeattributeset base_typeattr_234 (and (hal_lazy_test_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_233)
+(typeattributeset base_typeattr_233 (and (hal_lazy_test_server ) (not (hal_lazy_test ))))
+(typeattribute base_typeattr_232)
+(typeattributeset base_typeattr_232 (and (hal_lazy_test_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_231)
+(typeattributeset base_typeattr_231 (and (coredomain ) (not (dumpstate init ))))
+(typeattribute base_typeattr_230)
+(typeattributeset base_typeattr_230 (and (domain ) (not (init vendor_init ))))
+(typeattribute base_typeattr_229)
+(typeattributeset base_typeattr_229 (and (domain ) (not (coredomain ))))
+(typeattribute base_typeattr_228)
+(typeattributeset base_typeattr_228 (and (hal_vm_capabilities_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_227)
+(typeattributeset base_typeattr_227 (and (hal_vm_capabilities_server ) (not (hal_vm_capabilities ))))
+(typeattribute base_typeattr_226)
+(typeattributeset base_typeattr_226 (and (hal_vm_capabilities_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_225)
+(typeattributeset base_typeattr_225 (and (hal_wifi_supplicant_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_224)
+(typeattributeset base_typeattr_224 (and (hal_wifi_supplicant_server ) (not (hal_wifi_supplicant ))))
+(typeattribute base_typeattr_223)
+(typeattributeset base_typeattr_223 (and (hal_wifi_supplicant_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_222)
+(typeattributeset base_typeattr_222 (and (hal_wifi_hostapd_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_221)
+(typeattributeset base_typeattr_221 (and (hal_wifi_hostapd_server ) (not (hal_wifi_hostapd ))))
+(typeattribute base_typeattr_220)
+(typeattributeset base_typeattr_220 (and (hal_wifi_hostapd_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_219)
+(typeattributeset base_typeattr_219 (and (hal_wifi_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_218)
+(typeattributeset base_typeattr_218 (and (hal_wifi_server ) (not (hal_wifi ))))
+(typeattribute base_typeattr_217)
+(typeattributeset base_typeattr_217 (and (hal_wifi_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_216)
+(typeattributeset base_typeattr_216 (and (hal_weaver_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_215)
+(typeattributeset base_typeattr_215 (and (hal_weaver_server ) (not (hal_weaver ))))
+(typeattribute base_typeattr_214)
+(typeattributeset base_typeattr_214 (and (hal_weaver_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_213)
+(typeattributeset base_typeattr_213 (and (hal_vr_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_212)
+(typeattributeset base_typeattr_212 (and (hal_vr_server ) (not (hal_vr ))))
+(typeattribute base_typeattr_211)
+(typeattributeset base_typeattr_211 (and (hal_vr_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_210)
+(typeattributeset base_typeattr_210 (and (hal_vibrator_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_209)
+(typeattributeset base_typeattr_209 (and (hal_vibrator_server ) (not (hal_vibrator ))))
+(typeattribute base_typeattr_208)
+(typeattributeset base_typeattr_208 (and (hal_vibrator_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_207)
+(typeattributeset base_typeattr_207 (and (hal_vehicle_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_206)
+(typeattributeset base_typeattr_206 (and (hal_vehicle_server ) (not (hal_vehicle ))))
+(typeattribute base_typeattr_205)
+(typeattributeset base_typeattr_205 (and (hal_vehicle_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_204)
+(typeattributeset base_typeattr_204 (and (hal_uwb_vendor_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_203)
+(typeattributeset base_typeattr_203 (and (hal_uwb_vendor_server ) (not (hal_uwb_vendor ))))
+(typeattribute base_typeattr_202)
+(typeattributeset base_typeattr_202 (and (hal_uwb_vendor_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_201)
+(typeattributeset base_typeattr_201 (and (hal_uwb_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_200)
+(typeattributeset base_typeattr_200 (and (hal_uwb_server ) (not (hal_uwb ))))
+(typeattribute base_typeattr_199)
+(typeattributeset base_typeattr_199 (and (hal_uwb_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_198)
+(typeattributeset base_typeattr_198 (and (hal_usb_gadget_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_197)
+(typeattributeset base_typeattr_197 (and (hal_usb_gadget_server ) (not (hal_usb_gadget ))))
+(typeattribute base_typeattr_196)
+(typeattributeset base_typeattr_196 (and (hal_usb_gadget_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_195)
+(typeattributeset base_typeattr_195 (and (hal_usb_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_194)
+(typeattributeset base_typeattr_194 (and (hal_usb_server ) (not (hal_usb ))))
+(typeattribute base_typeattr_193)
+(typeattributeset base_typeattr_193 (and (hal_usb_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_192)
+(typeattributeset base_typeattr_192 (and (hal_tv_tuner_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_191)
+(typeattributeset base_typeattr_191 (and (hal_tv_tuner_server ) (not (hal_tv_tuner ))))
+(typeattribute base_typeattr_190)
+(typeattributeset base_typeattr_190 (and (hal_tv_tuner_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_189)
+(typeattributeset base_typeattr_189 (and (hal_tv_input_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_188)
+(typeattributeset base_typeattr_188 (and (hal_tv_input_server ) (not (hal_tv_input ))))
+(typeattribute base_typeattr_187)
+(typeattributeset base_typeattr_187 (and (hal_tv_input_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_186)
+(typeattributeset base_typeattr_186 (and (hal_tv_hdmi_earc_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_185)
+(typeattributeset base_typeattr_185 (and (hal_tv_hdmi_earc_server ) (not (hal_tv_hdmi_earc ))))
+(typeattribute base_typeattr_184)
+(typeattributeset base_typeattr_184 (and (hal_tv_hdmi_earc_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_183)
+(typeattributeset base_typeattr_183 (and (hal_tv_hdmi_connection_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_182)
+(typeattributeset base_typeattr_182 (and (hal_tv_hdmi_connection_server ) (not (hal_tv_hdmi_connection ))))
+(typeattribute base_typeattr_181)
+(typeattributeset base_typeattr_181 (and (hal_tv_hdmi_connection_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_180)
+(typeattributeset base_typeattr_180 (and (hal_tv_hdmi_cec_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_179)
+(typeattributeset base_typeattr_179 (and (hal_tv_hdmi_cec_server ) (not (hal_tv_hdmi_cec ))))
+(typeattribute base_typeattr_178)
+(typeattributeset base_typeattr_178 (and (hal_tv_hdmi_cec_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_177)
+(typeattributeset base_typeattr_177 (and (hal_tv_cec_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_176)
+(typeattributeset base_typeattr_176 (and (hal_tv_cec_server ) (not (hal_tv_cec ))))
+(typeattribute base_typeattr_175)
+(typeattributeset base_typeattr_175 (and (hal_tv_cec_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_174)
+(typeattributeset base_typeattr_174 (and (hal_threadnetwork_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_173)
+(typeattributeset base_typeattr_173 (and (hal_threadnetwork_server ) (not (hal_threadnetwork ))))
+(typeattribute base_typeattr_172)
+(typeattributeset base_typeattr_172 (and (hal_threadnetwork_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_171)
+(typeattributeset base_typeattr_171 (and (hal_thermal_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_170)
+(typeattributeset base_typeattr_170 (and (hal_thermal_server ) (not (hal_thermal ))))
+(typeattribute base_typeattr_169)
+(typeattributeset base_typeattr_169 (and (hal_thermal_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_168)
+(typeattributeset base_typeattr_168 (and (hal_tetheroffload_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_167)
+(typeattributeset base_typeattr_167 (and (hal_tetheroffload_server ) (not (hal_tetheroffload ))))
+(typeattribute base_typeattr_166)
+(typeattributeset base_typeattr_166 (and (hal_tetheroffload_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_165)
+(typeattributeset base_typeattr_165 (and (hal_telephony_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_164)
+(typeattributeset base_typeattr_164 (and (hal_telephony_server ) (not (hal_telephony ))))
+(typeattribute base_typeattr_163)
+(typeattributeset base_typeattr_163 (and (hal_telephony_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_162)
+(typeattributeset base_typeattr_162 (and (hal_sensors_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_161)
+(typeattributeset base_typeattr_161 (and (hal_sensors_server ) (not (hal_sensors ))))
+(typeattribute base_typeattr_160)
+(typeattributeset base_typeattr_160 (and (hal_sensors_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_159)
+(typeattributeset base_typeattr_159 (and (hal_secure_element_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_158)
+(typeattributeset base_typeattr_158 (and (hal_secure_element_server ) (not (hal_secure_element ))))
+(typeattribute base_typeattr_157)
+(typeattributeset base_typeattr_157 (and (hal_secure_element_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_156)
+(typeattributeset base_typeattr_156 (and (hal_remotelyprovisionedcomponent_avf_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_155)
+(typeattributeset base_typeattr_155 (and (hal_remotelyprovisionedcomponent_avf_server ) (not (hal_remotelyprovisionedcomponent_avf ))))
+(typeattribute base_typeattr_154)
+(typeattributeset base_typeattr_154 (and (hal_remotelyprovisionedcomponent_avf_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_153)
+(typeattributeset base_typeattr_153 (and (hal_secretkeeper_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_152)
+(typeattributeset base_typeattr_152 (and (hal_secretkeeper_server ) (not (hal_secretkeeper ))))
+(typeattribute base_typeattr_151)
+(typeattributeset base_typeattr_151 (and (hal_secretkeeper_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_150)
+(typeattributeset base_typeattr_150 (and (hal_remoteaccess_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_149)
+(typeattributeset base_typeattr_149 (and (hal_remoteaccess_server ) (not (hal_remoteaccess ))))
+(typeattribute base_typeattr_148)
+(typeattributeset base_typeattr_148 (and (hal_remoteaccess_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_147)
+(typeattributeset base_typeattr_147 (and (hal_rebootescrow_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_146)
+(typeattributeset base_typeattr_146 (and (hal_rebootescrow_server ) (not (hal_rebootescrow ))))
+(typeattribute base_typeattr_145)
+(typeattributeset base_typeattr_145 (and (hal_rebootescrow_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_144)
+(typeattributeset base_typeattr_144 (and (hal_power_stats_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_143)
+(typeattributeset base_typeattr_143 (and (hal_power_stats_server ) (not (hal_power_stats ))))
+(typeattribute base_typeattr_142)
+(typeattributeset base_typeattr_142 (and (hal_power_stats_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_141)
+(typeattributeset base_typeattr_141 (and (hal_power_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_140)
+(typeattributeset base_typeattr_140 (and (hal_power_server ) (not (hal_power ))))
+(typeattribute base_typeattr_139)
+(typeattributeset base_typeattr_139 (and (hal_power_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_138)
+(typeattributeset base_typeattr_138 (and (hal_omx_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_137)
+(typeattributeset base_typeattr_137 (and (hal_omx_server ) (not (hal_omx ))))
+(typeattribute base_typeattr_136)
+(typeattributeset base_typeattr_136 (and (hal_omx_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_135)
+(typeattributeset base_typeattr_135 (and (hal_oemlock_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_134)
+(typeattributeset base_typeattr_134 (and (hal_oemlock_server ) (not (hal_oemlock ))))
+(typeattribute base_typeattr_133)
+(typeattributeset base_typeattr_133 (and (hal_oemlock_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_132)
+(typeattributeset base_typeattr_132 (and (hal_nlinterceptor_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_131)
+(typeattributeset base_typeattr_131 (and (hal_nlinterceptor_server ) (not (hal_nlinterceptor ))))
+(typeattribute base_typeattr_130)
+(typeattributeset base_typeattr_130 (and (hal_nlinterceptor_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_129)
+(typeattributeset base_typeattr_129 (and (hal_nfc_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_128)
+(typeattributeset base_typeattr_128 (and (hal_nfc_server ) (not (hal_nfc ))))
+(typeattribute base_typeattr_127)
+(typeattributeset base_typeattr_127 (and (hal_nfc_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_126)
+(typeattributeset base_typeattr_126 (and (hal_neuralnetworks_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_125)
+(typeattributeset base_typeattr_125 (and (hal_neuralnetworks_server ) (not (hal_neuralnetworks ))))
+(typeattribute base_typeattr_124)
+(typeattributeset base_typeattr_124 (and (hal_neuralnetworks_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_123)
+(typeattributeset base_typeattr_123 (and (hal_memtrack_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_122)
+(typeattributeset base_typeattr_122 (and (hal_memtrack_server ) (not (hal_memtrack ))))
+(typeattribute base_typeattr_121)
+(typeattributeset base_typeattr_121 (and (hal_memtrack_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_120)
+(typeattributeset base_typeattr_120 (and (hal_mediaquality_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_119)
+(typeattributeset base_typeattr_119 (and (hal_mediaquality_server ) (not (hal_mediaquality ))))
+(typeattribute base_typeattr_118)
+(typeattributeset base_typeattr_118 (and (hal_mediaquality_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_117)
+(typeattributeset base_typeattr_117 (and (hal_macsec_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_116)
+(typeattributeset base_typeattr_116 (and (hal_macsec_server ) (not (hal_macsec ))))
+(typeattribute base_typeattr_115)
+(typeattributeset base_typeattr_115 (and (hal_macsec_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_114)
+(typeattributeset base_typeattr_114 (and (hal_lowpan_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_113)
+(typeattributeset base_typeattr_113 (and (hal_lowpan_server ) (not (hal_lowpan ))))
+(typeattribute base_typeattr_112)
+(typeattributeset base_typeattr_112 (and (hal_lowpan_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_111)
+(typeattributeset base_typeattr_111 (and (hal_light_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_110)
+(typeattributeset base_typeattr_110 (and (hal_light_server ) (not (hal_light ))))
+(typeattribute base_typeattr_109)
+(typeattributeset base_typeattr_109 (and (hal_light_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_108)
+(typeattributeset base_typeattr_108 (and (hal_keymint_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_107)
+(typeattributeset base_typeattr_107 (and (hal_keymint_server ) (not (hal_keymint ))))
+(typeattribute base_typeattr_106)
+(typeattributeset base_typeattr_106 (and (hal_keymint_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_105)
+(typeattributeset base_typeattr_105 (and (hal_keymaster_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_104)
+(typeattributeset base_typeattr_104 (and (hal_keymaster_server ) (not (hal_keymaster ))))
+(typeattribute base_typeattr_103)
+(typeattributeset base_typeattr_103 (and (hal_keymaster_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_102)
+(typeattributeset base_typeattr_102 (and (hal_ivn_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_101)
+(typeattributeset base_typeattr_101 (and (hal_ivn_server ) (not (hal_ivn ))))
+(typeattribute base_typeattr_100)
+(typeattributeset base_typeattr_100 (and (hal_ivn_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_99)
+(typeattributeset base_typeattr_99 (and (hal_ir_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_98)
+(typeattributeset base_typeattr_98 (and (hal_ir_server ) (not (hal_ir ))))
+(typeattribute base_typeattr_97)
+(typeattributeset base_typeattr_97 (and (hal_ir_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_96)
+(typeattributeset base_typeattr_96 (and (hal_input_processor_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_95)
+(typeattributeset base_typeattr_95 (and (hal_input_processor_server ) (not (hal_input_processor ))))
+(typeattribute base_typeattr_94)
+(typeattributeset base_typeattr_94 (and (hal_input_processor_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_93)
+(typeattributeset base_typeattr_93 (and (hal_input_classifier_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_92)
+(typeattributeset base_typeattr_92 (and (hal_input_classifier_server ) (not (hal_input_classifier ))))
+(typeattribute base_typeattr_91)
+(typeattributeset base_typeattr_91 (and (hal_input_classifier_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_90)
+(typeattributeset base_typeattr_90 (and (hal_identity_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_89)
+(typeattributeset base_typeattr_89 (and (hal_identity_server ) (not (hal_identity ))))
+(typeattribute base_typeattr_88)
+(typeattributeset base_typeattr_88 (and (hal_identity_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_87)
+(typeattributeset base_typeattr_87 (and (hal_health_storage_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_86)
+(typeattributeset base_typeattr_86 (and (hal_health_storage_server ) (not (hal_health_storage ))))
+(typeattribute base_typeattr_85)
+(typeattributeset base_typeattr_85 (and (hal_health_storage_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_84)
+(typeattributeset base_typeattr_84 (and (hal_health_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_83)
+(typeattributeset base_typeattr_83 (and (hal_health_server ) (not (hal_health ))))
+(typeattribute base_typeattr_82)
+(typeattributeset base_typeattr_82 (and (hal_health_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_81)
+(typeattributeset base_typeattr_81 (and (hal_graphics_composer_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_80)
+(typeattributeset base_typeattr_80 (and (hal_graphics_composer_server ) (not (hal_graphics_composer ))))
+(typeattribute base_typeattr_79)
+(typeattributeset base_typeattr_79 (and (hal_graphics_composer_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_78)
+(typeattributeset base_typeattr_78 (and (hal_graphics_allocator_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_77)
+(typeattributeset base_typeattr_77 (and (hal_graphics_allocator_server ) (not (hal_graphics_allocator ))))
+(typeattribute base_typeattr_76)
+(typeattributeset base_typeattr_76 (and (hal_graphics_allocator_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_75)
+(typeattributeset base_typeattr_75 (and (hal_gnss_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_74)
+(typeattributeset base_typeattr_74 (and (hal_gnss_server ) (not (hal_gnss ))))
+(typeattribute base_typeattr_73)
+(typeattributeset base_typeattr_73 (and (hal_gnss_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_72)
+(typeattributeset base_typeattr_72 (and (hal_gatekeeper_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_71)
+(typeattributeset base_typeattr_71 (and (hal_gatekeeper_server ) (not (hal_gatekeeper ))))
+(typeattribute base_typeattr_70)
+(typeattributeset base_typeattr_70 (and (hal_gatekeeper_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_69)
+(typeattributeset base_typeattr_69 (and (hal_fingerprint_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_68)
+(typeattributeset base_typeattr_68 (and (hal_fingerprint_server ) (not (hal_fingerprint ))))
+(typeattribute base_typeattr_67)
+(typeattributeset base_typeattr_67 (and (hal_fingerprint_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_66)
+(typeattributeset base_typeattr_66 (and (hal_fastboot_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_65)
+(typeattributeset base_typeattr_65 (and (hal_fastboot_server ) (not (hal_fastboot ))))
+(typeattribute base_typeattr_64)
+(typeattributeset base_typeattr_64 (and (hal_fastboot_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_63)
+(typeattributeset base_typeattr_63 (and (hal_face_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_62)
+(typeattributeset base_typeattr_62 (and (hal_face_server ) (not (hal_face ))))
+(typeattribute base_typeattr_61)
+(typeattributeset base_typeattr_61 (and (hal_face_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_60)
+(typeattributeset base_typeattr_60 (and (hal_evs_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_59)
+(typeattributeset base_typeattr_59 (and (hal_evs_server ) (not (hal_evs ))))
+(typeattribute base_typeattr_58)
+(typeattributeset base_typeattr_58 (and (hal_evs_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_57)
+(typeattributeset base_typeattr_57 (and (hal_dumpstate_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_56)
+(typeattributeset base_typeattr_56 (and (hal_dumpstate_server ) (not (hal_dumpstate ))))
+(typeattribute base_typeattr_55)
+(typeattributeset base_typeattr_55 (and (hal_dumpstate_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_54)
+(typeattributeset base_typeattr_54 (and (hal_drm_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_53)
+(typeattributeset base_typeattr_53 (and (hal_drm_server ) (not (hal_drm ))))
+(typeattribute base_typeattr_52)
+(typeattributeset base_typeattr_52 (and (hal_drm_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_51)
+(typeattributeset base_typeattr_51 (and (hal_contexthub_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_50)
+(typeattributeset base_typeattr_50 (and (hal_contexthub_server ) (not (hal_contexthub ))))
+(typeattribute base_typeattr_49)
+(typeattributeset base_typeattr_49 (and (hal_contexthub_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_48)
+(typeattributeset base_typeattr_48 (and (hal_confirmationui_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_47)
+(typeattributeset base_typeattr_47 (and (hal_confirmationui_server ) (not (hal_confirmationui ))))
+(typeattribute base_typeattr_46)
+(typeattributeset base_typeattr_46 (and (hal_confirmationui_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_45)
+(typeattributeset base_typeattr_45 (and (hal_configstore_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_44)
+(typeattributeset base_typeattr_44 (and (hal_configstore_server ) (not (hal_configstore ))))
+(typeattribute base_typeattr_43)
+(typeattributeset base_typeattr_43 (and (hal_configstore_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_42)
+(typeattributeset base_typeattr_42 (and (hal_codec2_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_41)
+(typeattributeset base_typeattr_41 (and (hal_codec2_server ) (not (hal_codec2 ))))
+(typeattribute base_typeattr_40)
+(typeattributeset base_typeattr_40 (and (hal_codec2_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_39)
+(typeattributeset base_typeattr_39 (and (hal_cas_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_38)
+(typeattributeset base_typeattr_38 (and (hal_cas_server ) (not (hal_cas ))))
+(typeattribute base_typeattr_37)
+(typeattributeset base_typeattr_37 (and (hal_cas_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_36)
+(typeattributeset base_typeattr_36 (and (hal_can_controller_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_35)
+(typeattributeset base_typeattr_35 (and (hal_can_controller_server ) (not (hal_can_controller ))))
+(typeattribute base_typeattr_34)
+(typeattributeset base_typeattr_34 (and (hal_can_controller_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_33)
+(typeattributeset base_typeattr_33 (and (hal_can_bus_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_32)
+(typeattributeset base_typeattr_32 (and (hal_can_bus_server ) (not (hal_can_bus ))))
+(typeattribute base_typeattr_31)
+(typeattributeset base_typeattr_31 (and (hal_can_bus_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_30)
+(typeattributeset base_typeattr_30 (and (hal_camera_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_29)
+(typeattributeset base_typeattr_29 (and (hal_camera_server ) (not (hal_camera ))))
+(typeattribute base_typeattr_28)
+(typeattributeset base_typeattr_28 (and (hal_camera_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_27)
+(typeattributeset base_typeattr_27 (and (hal_broadcastradio_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_26)
+(typeattributeset base_typeattr_26 (and (hal_broadcastradio_server ) (not (hal_broadcastradio ))))
+(typeattribute base_typeattr_25)
+(typeattributeset base_typeattr_25 (and (hal_broadcastradio_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_24)
+(typeattributeset base_typeattr_24 (and (hal_bootctl_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_23)
+(typeattributeset base_typeattr_23 (and (hal_bootctl_server ) (not (hal_bootctl ))))
+(typeattribute base_typeattr_22)
+(typeattributeset base_typeattr_22 (and (hal_bootctl_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_21)
+(typeattributeset base_typeattr_21 (and (hal_bluetooth_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_20)
+(typeattributeset base_typeattr_20 (and (hal_bluetooth_server ) (not (hal_bluetooth ))))
+(typeattribute base_typeattr_19)
+(typeattributeset base_typeattr_19 (and (hal_bluetooth_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_18)
+(typeattributeset base_typeattr_18 (and (hal_authsecret_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_17)
+(typeattributeset base_typeattr_17 (and (hal_authsecret_server ) (not (hal_authsecret ))))
+(typeattribute base_typeattr_16)
+(typeattributeset base_typeattr_16 (and (hal_authsecret_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_15)
+(typeattributeset base_typeattr_15 (and (hal_authgraph_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_14)
+(typeattributeset base_typeattr_14 (and (hal_authgraph_server ) (not (hal_authgraph ))))
+(typeattribute base_typeattr_13)
+(typeattributeset base_typeattr_13 (and (hal_authgraph_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_12)
+(typeattributeset base_typeattr_12 (and (hal_audiocontrol_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_11)
+(typeattributeset base_typeattr_11 (and (hal_audiocontrol_server ) (not (hal_audiocontrol ))))
+(typeattribute base_typeattr_10)
+(typeattributeset base_typeattr_10 (and (hal_audiocontrol_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_9)
+(typeattributeset base_typeattr_9 (and (hal_audio_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_8)
+(typeattributeset base_typeattr_8 (and (hal_audio_server ) (not (hal_audio ))))
+(typeattribute base_typeattr_7)
+(typeattributeset base_typeattr_7 (and (hal_audio_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_6)
+(typeattributeset base_typeattr_6 (and (hal_atrace_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_5)
+(typeattributeset base_typeattr_5 (and (hal_atrace_server ) (not (hal_atrace ))))
+(typeattribute base_typeattr_4)
+(typeattributeset base_typeattr_4 (and (hal_atrace_server ) (not (halserverdomain ))))
+(typeattribute base_typeattr_3)
+(typeattributeset base_typeattr_3 (and (hal_allocator_client ) (not (halclientdomain ))))
+(typeattribute base_typeattr_2)
+(typeattributeset base_typeattr_2 (and (hal_allocator_server ) (not (hal_allocator ))))
+(typeattribute base_typeattr_1)
+(typeattributeset base_typeattr_1 (and (hal_allocator_server ) (not (halserverdomain ))))
+; THIS IS A WORKAROUND for the current limitations of the module policy language
+; This should be used sparingly until we figure out a saner way to achieve the
+; stuff below, for example, by improving typeattribute statement of module
+; language.
+;
+; NOTE: This file has no effect on recovery policy.
+
+; Apps, except isolated apps, are clients of Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_allocator_client;
+; typeattribute hal_allocator_client halclientdomain;
+(typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app_all))))))
+(typeattributeset halclientdomain (hal_allocator_client))
+
+; Apps, except isolated apps, are clients of OMX-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps, are clients of Codec2-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps and SDK sandboxes, are clients of Drm-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_drm_client ((and (appdomain) ((not (or (isolated_app_all) (sdk_sandbox_all)))))))
+
+; Apps, except isolated apps, are clients of Configstore HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_configstore_client;
+(typeattributeset hal_configstore_client ((and (appdomain) ((not (isolated_app_all))))))
+
+; Apps, except isolated apps, are clients of Graphics Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app } hal_graphics_allocator_client;
+(typeattributeset hal_graphics_allocator_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps, are clients of Cas HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_cas_client;
+(typeattributeset hal_cas_client ((and (appdomain) ((not (isolated_app_all))))))
+
+; Domains hosting Camera HAL implementations are clients of Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute hal_camera hal_allocator_client;
+(typeattributeset hal_allocator_client (hal_camera))
+
+; Apps, except isolated apps, are clients of Neuralnetworks HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_neuralnetworks_client;
+(typeattributeset hal_neuralnetworks_client ((and (appdomain) ((not (isolated_app))))))
+
+; TODO(b/112056006): move these to mapping files when/if we implement 'versioned' attributes.
+; Rename untrusted_app_visible_* to untrusted_app_visible_*_violators.
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute untrusted_app_visible_hwservice untrusted_app_visible_hwservice_violators;
+; typeattribute untrusted_app_visible_halserver untrusted_app_visible_halserver_violators;
+(typeattribute untrusted_app_visible_hwservice)
+(typeattributeset untrusted_app_visible_hwservice_violators (untrusted_app_visible_hwservice))
+(typeattribute untrusted_app_visible_halserver)
+(typeattributeset untrusted_app_visible_halserver_violators (untrusted_app_visible_halserver))
+
+; Properties having both system_property_type and vendor_property_type are illegal
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { system_property_type && vendor_property_type } system_and_vendor_property_type;
+(typeattribute system_and_vendor_property_type)
+(typeattributeset system_and_vendor_property_type ((and (system_property_type) (vendor_property_type))))
diff --git a/prebuilts/api/202504/Android.bp b/prebuilts/api/202504/Android.bp
new file mode 100644
index 0000000..7deda43
--- /dev/null
+++ b/prebuilts/api/202504/Android.bp
@@ -0,0 +1,106 @@
+// Automatically generated file, do not edit!
+se_policy_conf {
+ name: "202504_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "202504",
+}
+
+se_policy_cil {
+ name: "202504_reqd_policy_mask.cil",
+ src: ":202504_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "202504_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: [
+ ":se_build_files{.plat_public_202504}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+ board_api_level: "202504",
+}
+
+se_policy_cil {
+ name: "202504_plat_pub_policy.cil",
+ src: ":202504_plat_pub_policy.conf",
+ filter_out: [":202504_reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "202504_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: [
+ ":se_build_files{.plat_public_202504}",
+ ":se_build_files{.system_ext_public_202504}",
+ ":se_build_files{.product_public_202504}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+ board_api_level: "202504",
+}
+
+se_policy_cil {
+ name: "202504_product_pub_policy.cil",
+ src: ":202504_product_pub_policy.conf",
+ filter_out: [":202504_reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_versioned_policy {
+ name: "202504_plat_pub_versioned.cil",
+ base: ":202504_product_pub_policy.cil",
+ target_policy: ":202504_product_pub_policy.cil",
+ version: "202504",
+ installable: false,
+}
+
+se_policy_conf {
+ name: "202504_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: [
+ ":se_build_files{.plat_public_202504}",
+ ":se_build_files{.plat_private_202504}",
+ ":se_build_files{.system_ext_public_202504}",
+ ":se_build_files{.system_ext_private_202504}",
+ ":se_build_files{.product_public_202504}",
+ ":se_build_files{.product_private_202504}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "202504_plat_policy.cil",
+ src: ":202504_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_202504}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "202504_plat_policy",
+ srcs: [":202504_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
+
+filegroup {
+ name: "202504_sepolicy_cts_data",
+ srcs: [
+ "202504_general_sepolicy.conf",
+ "202504_plat_sepolicy.cil",
+ "202504_mapping.cil",
+ ],
+}
diff --git a/prebuilts/api/202504/private/access_vectors b/prebuilts/api/202504/private/access_vectors
new file mode 100644
index 0000000..f91c1a4
--- /dev/null
+++ b/prebuilts/api/202504/private/access_vectors
@@ -0,0 +1,814 @@
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+ ioctl
+ read
+ write
+ create
+ getattr
+ setattr
+ lock
+ relabelfrom
+ relabelto
+ append
+ map
+ unlink
+ link
+ rename
+ execute
+ quotaon
+ mounton
+ audit_access
+ open
+ execmod
+ watch
+ watch_mount
+ watch_sb
+ watch_with_perm
+ watch_reads
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+ ioctl
+ read
+ write
+ create
+ getattr
+ setattr
+ lock
+ relabelfrom
+ relabelto
+ append
+ map
+# socket-specific
+ bind
+ connect
+ listen
+ accept
+ getopt
+ setopt
+ shutdown
+ recvfrom
+ sendto
+ name_bind
+}
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+ create
+ destroy
+ getattr
+ setattr
+ read
+ write
+ associate
+ unix_read
+ unix_write
+}
+
+#
+# Define a common for capability access vectors.
+#
+common cap
+{
+ # The capabilities are defined in include/linux/capability.h
+ # Capabilities >= 32 are defined in the cap2 common.
+ # Care should be taken to ensure that these are consistent with
+ # those definitions. (Order matters)
+
+ chown
+ dac_override
+ dac_read_search
+ fowner
+ fsetid
+ kill
+ setgid
+ setuid
+ setpcap
+ linux_immutable
+ net_bind_service
+ net_broadcast
+ net_admin
+ net_raw
+ ipc_lock
+ ipc_owner
+ sys_module
+ sys_rawio
+ sys_chroot
+ sys_ptrace
+ sys_pacct
+ sys_admin
+ sys_boot
+ sys_nice
+ sys_resource
+ sys_time
+ sys_tty_config
+ mknod
+ lease
+ audit_write
+ audit_control
+ setfcap
+}
+
+common cap2
+{
+ mac_override # unused by SELinux
+ mac_admin
+ syslog
+ wake_alarm
+ block_suspend
+ audit_read
+ perfmon
+ starting_at_board_api(202504, `checkpoint_restore')
+ starting_at_board_api(202504, `bpf')
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+ mount
+ remount
+ unmount
+ getattr
+ relabelfrom
+ relabelto
+ associate
+ quotamod
+ quotaget
+ watch
+}
+
+class dir
+inherits file
+{
+ add_name
+ remove_name
+ reparent
+ search
+ rmdir
+}
+
+class file
+inherits file
+{
+ execute_no_trans
+ entrypoint
+}
+
+class anon_inode
+inherits file
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+{
+ execute_no_trans
+ entrypoint
+}
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+ use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+}
+
+class udp_socket
+inherits socket
+{
+ node_bind
+}
+
+class rawip_socket
+inherits socket
+{
+ node_bind
+}
+
+class node
+{
+ recvfrom
+ sendto
+}
+
+class netif
+{
+ ingress
+ egress
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+ connectto
+}
+
+class unix_dgram_socket
+inherits socket
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+ fork
+ transition
+ sigchld # commonly granted from child to parent
+ sigkill # cannot be caught or ignored
+ sigstop # cannot be caught or ignored
+ signull # for kill(pid, 0)
+ signal # all other signals
+ ptrace
+ getsched
+ setsched
+ getsession
+ getpgid
+ setpgid
+ getcap
+ setcap
+ share
+ getattr
+ setexec
+ setfscreate
+ noatsecure
+ siginh
+ setrlimit
+ rlimitinh
+ dyntransition
+ setcurrent
+ execmem
+ execstack
+ execheap
+ setkeycreate
+ setsockcreate
+ getrlimit
+}
+
+class process2
+{
+ nnp_transition
+ nosuid_transition
+}
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+ enqueue
+}
+
+class msg
+{
+ send
+ receive
+}
+
+class shm
+inherits ipc
+{
+ lock
+}
+
+
+#
+# Define the access vector interpretation for the security server.
+#
+
+class security
+{
+ compute_av
+ compute_create
+ compute_member
+ check_context
+ load_policy
+ compute_relabel
+ compute_user
+ setenforce # was avc_toggle in system class
+ setbool
+ setsecparam
+ setcheckreqprot
+ read_policy
+ validate_trans
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+ ipc_info
+ syslog_read
+ syslog_mod
+ syslog_console
+ module_request
+ module_load
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+inherits cap
+
+class capability2
+inherits cap2
+
+#
+# Extended Netlink classes
+#
+class netlink_route_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+ nlmsg_readpriv
+ nlmsg_getneigh
+}
+
+class netlink_tcpdiag_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+}
+
+class netlink_nflog_socket
+inherits socket
+
+class netlink_xfrm_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+}
+
+class netlink_selinux_socket
+inherits socket
+
+class netlink_audit_socket
+inherits socket
+{
+ nlmsg_read
+ nlmsg_write
+ nlmsg_relay
+ nlmsg_readpriv
+ nlmsg_tty_audit
+}
+
+class netlink_dnrt_socket
+inherits socket
+
+# Define the access vector interpretation for controlling
+# access to IPSec network data by association
+#
+class association
+{
+ sendto
+ recvfrom
+ setcontext
+ polmatch
+}
+
+# Updated Netlink class for KOBJECT_UEVENT family.
+class netlink_kobject_uevent_socket
+inherits socket
+
+class appletalk_socket
+inherits socket
+
+class packet
+{
+ send
+ recv
+ relabelto
+ forward_in
+ forward_out
+}
+
+class key
+{
+ view
+ read
+ write
+ search
+ link
+ setattr
+ create
+}
+
+class dccp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+}
+
+class memprotect
+{
+ mmap_zero
+}
+
+# network peer labels
+class peer
+{
+ recv
+}
+
+class kernel_service
+{
+ use_as_override
+ create_files_as
+}
+
+class tun_socket
+inherits socket
+{
+ attach_queue
+}
+
+class binder
+{
+ impersonate
+ call
+ set_context_mgr
+ transfer
+}
+
+class netlink_iscsi_socket
+inherits socket
+
+class netlink_fib_lookup_socket
+inherits socket
+
+class netlink_connector_socket
+inherits socket
+
+class netlink_netfilter_socket
+inherits socket
+
+class netlink_generic_socket
+inherits socket
+
+class netlink_scsitransport_socket
+inherits socket
+
+class netlink_rdma_socket
+inherits socket
+
+class netlink_crypto_socket
+inherits socket
+
+class infiniband_pkey
+{
+ access
+}
+
+class infiniband_endport
+{
+ manage_subnet
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+# in user namespaces
+#
+
+class cap_userns
+inherits cap
+
+class cap2_userns
+inherits cap2
+
+
+#
+# Define the access vector interpretation for the new socket classes
+# enabled by the extended_socket_class policy capability.
+#
+
+#
+# The next two classes were previously mapped to rawip_socket and therefore
+# have the same definition as rawip_socket (until further permissions
+# are defined).
+#
+class sctp_socket
+inherits socket
+{
+ node_bind
+ name_connect
+ association
+}
+
+class icmp_socket
+inherits socket
+{
+ node_bind
+}
+
+#
+# The remaining network socket classes were previously
+# mapped to the socket class and therefore have the
+# same definition as socket.
+#
+
+class ax25_socket
+inherits socket
+
+class ipx_socket
+inherits socket
+
+class netrom_socket
+inherits socket
+
+class atmpvc_socket
+inherits socket
+
+class x25_socket
+inherits socket
+
+class rose_socket
+inherits socket
+
+class decnet_socket
+inherits socket
+
+class atmsvc_socket
+inherits socket
+
+class rds_socket
+inherits socket
+
+class irda_socket
+inherits socket
+
+class pppox_socket
+inherits socket
+
+class llc_socket
+inherits socket
+
+class can_socket
+inherits socket
+
+class tipc_socket
+inherits socket
+
+class bluetooth_socket
+inherits socket
+
+class iucv_socket
+inherits socket
+
+class rxrpc_socket
+inherits socket
+
+class isdn_socket
+inherits socket
+
+class phonet_socket
+inherits socket
+
+class ieee802154_socket
+inherits socket
+
+class caif_socket
+inherits socket
+
+class alg_socket
+inherits socket
+
+class nfc_socket
+inherits socket
+
+class vsock_socket
+inherits socket
+
+class kcm_socket
+inherits socket
+
+class qipcrtr_socket
+inherits socket
+
+class smc_socket
+inherits socket
+
+class xdp_socket
+inherits socket
+
+class mctp_socket
+inherits socket
+
+class bpf
+{
+ map_create
+ map_read
+ map_write
+ prog_load
+ prog_run
+}
+
+class property_service
+{
+ set
+}
+
+class service_manager
+{
+ add
+ find
+ list
+}
+
+class hwservice_manager
+{
+ add
+ find
+ list
+}
+
+class keystore_key # No longer used
+{
+ get_state
+ get
+ insert
+ delete
+ exist
+ list
+ reset
+ password
+ lock
+ unlock
+ is_empty
+ sign
+ verify
+ grant
+ duplicate
+ clear_uid
+ add_auth
+ user_changed
+ gen_unique_id
+}
+
+class keystore2
+{
+ add_auth
+ change_password
+ change_user
+ clear_ns
+ clear_uid
+ delete_all_keys
+ early_boot_ended
+ get_attestation_key
+ get_auth_token
+ get_last_auth_time
+ get_state # No longer used
+ list
+ lock
+ pull_metrics
+ report_off_body # No longer used
+ reset
+ unlock
+}
+
+class keystore2_key
+{
+ convert_storage_key_to_ephemeral
+ delete
+ gen_unique_id
+ get_info
+ grant
+ manage_blob
+ rebind
+ req_forced_op
+ update
+ use
+ use_dev_id
+}
+
+class diced
+{
+ demote
+ demote_self
+ derive
+ get_attestation_chain
+ use_seal
+ use_sign
+}
+
+class drmservice {
+ consumeRights
+ setPlaybackStatus
+ openDecryptSession
+ closeDecryptSession
+ initializeDecryptUnit
+ decrypt
+ finalizeDecryptUnit
+ pread
+}
+
+class perf_event
+{
+ open
+ cpu
+ kernel
+ tracepoint
+ read
+ write
+}
+
+class lockdown
+{
+ integrity
+ confidentiality
+}
+
+class io_uring
+{
+ override_creds
+ sqpoll
+ cmd
+}
+
+class user_namespace
+{
+ create
+}
+
+class tee_service
+{
+ use
+}
diff --git a/prebuilts/api/202504/private/aconfigd.te b/prebuilts/api/202504/private/aconfigd.te
new file mode 100644
index 0000000..211405b
--- /dev/null
+++ b/prebuilts/api/202504/private/aconfigd.te
@@ -0,0 +1,70 @@
+# aconfigd -- manager for aconfig flags
+type aconfigd, domain, coredomain, mlstrustedsubject;
+type aconfigd_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(aconfigd)
+
+allow aconfigd metadata_file:dir search;
+
+allow aconfigd {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:dir create_dir_perms;
+
+allow aconfigd {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:file create_file_perms;
+
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
+
+# allow aconfigd to read vendor partition storage files
+allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
+allow aconfigd vendor_aconfig_storage_file:dir r_dir_perms;
+
+# allow aconfigd to read /apex dir
+allow aconfigd apex_mnt_dir:dir r_dir_perms;
+allow aconfigd apex_mnt_dir:file r_file_perms;
+dontaudit aconfigd apex_info_file:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
+
+# Do not allow write access to boot/map storage files except, aconfigd and aconfigd_mainline.
+# These files are meant to serve flag reads for all processes. They are created by aconfigd (for
+# platform storage files) and aconfigd_mainline (mainline storage files) processes.
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_metadata_file:dir no_w_dir_perms;
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_metadata_file:file no_w_file_perms;
+
+# Only aconfigd and aconfigd_mainline can access persist storage files
+# These files are meant to serve as persist flag value storage, only aconfigd and
+# aconfigd_mainline process should manage them. Other processes should have zero access.
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_flags_metadata_file:dir *;
+neverallow {
+ domain
+ -init
+ -aconfigd
+ -aconfigd_mainline
+} aconfig_storage_flags_metadata_file:file no_rw_file_perms;
diff --git a/prebuilts/api/202504/private/aconfigd_mainline.te b/prebuilts/api/202504/private/aconfigd_mainline.te
new file mode 100644
index 0000000..cd98d4b
--- /dev/null
+++ b/prebuilts/api/202504/private/aconfigd_mainline.te
@@ -0,0 +1,38 @@
+# aconfigd_mainline -- manager for mainline aconfig flags
+type aconfigd_mainline, domain, coredomain, mlstrustedsubject;
+type aconfigd_mainline_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(aconfigd_mainline)
+
+# allow aconfigd_mainline to search /metadata dir as it needs to access files under
+# /metadata/aconfig dir
+allow aconfigd_mainline metadata_file:dir search;
+
+# aconfigd_mainline should be able to create storage files under /metadata/aconfig dir
+allow aconfigd_mainline {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:dir create_dir_perms;
+
+allow aconfigd_mainline {
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+}:file create_file_perms;
+
+# allow aconfigd_mainline to log to the kernel.
+allow aconfigd_mainline kmsg_device:chr_file write;
+
+# allow aconfigd_mainline to read /apex dir, aconfigd_mainline need to loop thru all
+# dirs under /apex to find all currently mounted mainline modules and get their
+# storage files
+allow aconfigd_mainline apex_mnt_dir:dir r_dir_perms;
+allow aconfigd_mainline apex_mnt_dir:file r_file_perms;
+dontaudit aconfigd_mainline apex_info_file:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd_mainline domain
+neverallow { domain -init } aconfigd_mainline:process transition;
+neverallow * aconfigd_mainline:process dyntransition;
diff --git a/prebuilts/api/202504/private/adbd.te b/prebuilts/api/202504/private/adbd.te
new file mode 100644
index 0000000..b87b319
--- /dev/null
+++ b/prebuilts/api/202504/private/adbd.te
@@ -0,0 +1,230 @@
+### ADB daemon
+
+typeattribute adbd coredomain;
+typeattribute adbd mlstrustedsubject;
+typeattribute adbd adbd_common;
+
+init_daemon_domain(adbd)
+
+domain_auto_trans(adbd, shell_exec, shell)
+
+# Allow adb to setcon() to tradeinmode.
+allow adbd self:process setcurrent;
+allow adbd adbd_tradeinmode:process dyntransition;
+
+userdebug_or_eng(`
+ allow adbd su:process dyntransition;
+')
+
+# When 'adb shell' is executed in recovery mode, adbd explicitly
+# switches into shell domain using setcon() because the shell executable
+# is not labeled as shell but as rootfs.
+recovery_only(`
+ domain_trans(adbd, rootfs, shell)
+ allow adbd shell:process dyntransition;
+
+ # Allows reboot fastboot to enter fastboot directly
+ unix_socket_connect(adbd, recovery, recovery)
+')
+
+# Control Perfetto traced and obtain traces from it.
+# Needed to allow port forwarding directly to traced.
+unix_socket_connect(adbd, traced_consumer, traced)
+
+# Do not sanitize the environment or open fds of the shell. Allow signaling
+# created processes.
+allow adbd shell:process { noatsecure signal };
+
+# Set UID and GID to shell. Set supplementary groups.
+allow adbd self:global_capability_class_set { setuid setgid };
+
+# Drop capabilities from bounding set on user builds.
+allow adbd self:global_capability_class_set setpcap;
+
+# ignore spurious denials for adbd when disk space is low.
+dontaudit adbd self:global_capability_class_set sys_resource;
+
+# Create and use network sockets.
+net_domain(adbd)
+# Access /dev/usb-ffs/adb/ep0
+allow adbd functionfs:dir search;
+allow adbd functionfs:file rw_file_perms;
+allowxperm adbd functionfs:file ioctl {
+ FUNCTIONFS_ENDPOINT_DESC
+ FUNCTIONFS_CLEAR_HALT
+};
+
+# adb pull /data/local/traces/*
+allow adbd trace_data_file:dir r_dir_perms;
+allow adbd trace_data_file:file r_file_perms;
+
+# adb pull /data/misc/profman.
+allow adbd profman_dump_data_file:dir r_dir_perms;
+allow adbd profman_dump_data_file:file r_file_perms;
+
+# adb push/pull sdcard.
+allow adbd tmpfs:dir search;
+allow adbd rootfs:lnk_file r_file_perms; # /sdcard symlink
+allow adbd tmpfs:lnk_file r_file_perms; # /mnt/sdcard symlink
+allow adbd { sdcard_type fuse }:dir create_dir_perms;
+allow adbd { sdcard_type fuse }:file create_file_perms;
+
+# adb pull /data/anr/traces.txt
+allow adbd anr_data_file:dir r_dir_perms;
+allow adbd anr_data_file:file r_file_perms;
+
+# adb pull /vendor/framework/*
+allow adbd vendor_framework_file:dir r_dir_perms;
+allow adbd vendor_framework_file:file r_file_perms;
+
+# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
+set_prop(adbd, shell_prop)
+set_prop(adbd, powerctl_prop)
+get_prop(adbd, ffs_config_prop)
+set_prop(adbd, ffs_control_prop)
+set_prop(adbd, adbd_tradeinmode_prop)
+
+# Allow adbd start/stop mdnsd via ctl.start
+set_prop(adbd, ctl_mdnsd_prop)
+
+# Read device's overlayfs related properties and files
+userdebug_or_eng(`
+ get_prop(adbd, persistent_properties_ready_prop)
+ r_dir_file(adbd, sysfs_dt_firmware_android)
+')
+
+# Run /system/bin/bu
+allow adbd system_file:file rx_file_perms;
+
+# Perform binder IPC to surfaceflinger (screencap)
+# XXX Run screencap in a separate domain?
+binder_use(adbd)
+binder_call(adbd, surfaceflinger)
+binder_call(adbd, gpuservice)
+# b/13188914
+allow adbd gpu_device:chr_file rw_file_perms;
+allow adbd gpu_device:dir r_dir_perms;
+allow adbd ion_device:chr_file rw_file_perms;
+r_dir_file(adbd, system_file)
+
+# Needed for various screenshots
+hal_client_domain(adbd, hal_graphics_allocator)
+
+# Read /data/misc/adb/adb_keys.
+allow adbd adb_keys_file:dir search;
+allow adbd adb_keys_file:file r_file_perms;
+
+userdebug_or_eng(`
+ # Write debugging information to /data/adb
+ # when persist.adb.trace_mask is set
+ # https://code.google.com/p/android/issues/detail?id=72895
+ allow adbd adb_data_file:dir rw_dir_perms;
+ allow adbd adb_data_file:file create_file_perms;
+')
+
+# ndk-gdb invokes adb forward to forward the gdbserver socket.
+allow adbd app_data_file:dir search;
+allow adbd app_data_file:sock_file write;
+allow adbd appdomain:unix_stream_socket connectto;
+
+# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
+allow adbd zygote_exec:file r_file_perms;
+allow adbd system_file:file r_file_perms;
+
+# Allow pulling the SELinux policy for CTS purposes
+allow adbd selinuxfs:dir r_dir_perms;
+allow adbd selinuxfs:file r_file_perms;
+allow adbd kernel:security read_policy;
+allow adbd service_contexts_file:file r_file_perms;
+allow adbd file_contexts_file:file r_file_perms;
+allow adbd seapp_contexts_file:file r_file_perms;
+allow adbd property_contexts_file:file r_file_perms;
+allow adbd sepolicy_file:file r_file_perms;
+
+# Allow pulling config.gz for CTS purposes
+allow adbd config_gz:file r_file_perms;
+
+# For CTS listening ports test.
+allow adbd proc_net_tcp_udp:file r_file_perms;
+
+allow adbd gpu_service:service_manager find;
+allow adbd surfaceflinger_service:service_manager find;
+allow adbd bootchart_data_file:dir search;
+allow adbd bootchart_data_file:file r_file_perms;
+
+# Allow access to external storage; we have several visible mount points under /storage
+# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
+allow adbd storage_file:dir r_dir_perms;
+allow adbd storage_file:lnk_file r_file_perms;
+allow adbd mnt_user_file:dir r_dir_perms;
+allow adbd mnt_user_file:lnk_file r_file_perms;
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow adbd media_rw_data_file:dir create_dir_perms;
+allow adbd media_rw_data_file:file create_file_perms;
+
+r_dir_file(adbd, apk_data_file)
+
+allow adbd rootfs:dir r_dir_perms;
+
+# Allow killing child "perfetto" binary processes, which auto-transition to
+# their own domain. Allows propagating termination of "adb shell perfetto ..."
+# invocations.
+allow adbd perfetto:process signal;
+
+# Allow to pull Perfetto traces.
+allow adbd perfetto_traces_data_file:file r_file_perms;
+allow adbd perfetto_traces_data_file:dir r_dir_perms;
+
+# Allow to push and manage configs in /data/misc/perfetto-configs.
+allow adbd perfetto_configs_data_file:dir rw_dir_perms;
+allow adbd perfetto_configs_data_file:file create_file_perms;
+
+# Connect to shell and use a socket transferred from it.
+# Used for e.g. abb.
+allow adbd shell:unix_stream_socket { read write shutdown };
+allow adbd shell:fd use;
+
+# adb push/pull /data/local/tmp.
+allow adbd shell_data_file:dir create_dir_perms;
+allow adbd shell_data_file:file create_file_perms;
+
+# Allow pull /vendor/apex files for CTS tests
+r_dir_file(adbd, vendor_apex_file)
+
+# Allow adb pull of updated apex files in /data/apex/active.
+allow adbd apex_data_file:dir search;
+allow adbd staging_data_file:file r_file_perms;
+
+# Allow adbd to pull /apex/apex-info-list.xml for CTS tests.
+allow adbd apex_info_file:file r_file_perms;
+
+# allow reading tombstones. users can already use bugreports to get those.
+allow adbd tombstone_data_file:dir r_dir_perms;
+allow adbd tombstone_data_file:file r_file_perms;
+
+# Access /data/local/tests.
+allow adbd shell_test_data_file:dir create_dir_perms;
+allow adbd shell_test_data_file:file create_file_perms;
+allow adbd shell_test_data_file:lnk_file create_file_perms;
+
+###
+### Neverallow rules
+###
+
+# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
+# transitions to the shell or tradeinmode domain (except when it crashes). In
+# particular, we never want to see a transition from adbd to su (aka "adb root")
+neverallow adbd { domain -crash_dump -shell -adbd_tradeinmode }:process transition;
+neverallow adbd {
+ domain
+ userdebug_or_eng(`-su')
+ recovery_only(`-shell')
+ -adbd_tradeinmode
+}:process dyntransition;
+
+# Only init is allowed to enter the adbd domain via exec()
+neverallow { domain -init } adbd:process transition;
+neverallow * adbd:process dyntransition;
diff --git a/prebuilts/api/202504/private/adbd_common.te b/prebuilts/api/202504/private/adbd_common.te
new file mode 100644
index 0000000..c24b029
--- /dev/null
+++ b/prebuilts/api/202504/private/adbd_common.te
@@ -0,0 +1,31 @@
+### ADB daemon common rules.
+### Put things here that are needed for both adbd proper and adbd in trade-in mode.
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(adbd_common, mdnsd, mdnsd)
+
+# adbd probes for vsock support. Do not generate denials when
+# this occurs. (b/123569840)
+dontaudit adbd_common self:{ socket vsock_socket } create;
+
+# Allow adbd inside vm to forward vm's vsock.
+allow adbd_common self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+
+# Access device logging gating property
+get_prop(adbd_common, device_logging_prop)
+
+# Use a pseudo tty.
+allow adbd_common devpts:chr_file rw_file_perms;
+
+# Read persist.adb.tls_server.enable property
+get_prop(adbd_common, system_adbd_prop)
+
+# Read whether or not Test Harness Mode is enabled
+get_prop(adbd_common, test_harness_prop)
+
+# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
+set_prop(adbd_common, adbd_prop)
+set_prop(adbd_common, adbd_config_prop)
+
+# Read device's serial number from system properties
+get_prop(adbd_common, serialno_prop)
diff --git a/prebuilts/api/202504/private/adbd_tradeinmode.te b/prebuilts/api/202504/private/adbd_tradeinmode.te
new file mode 100644
index 0000000..42fdec4
--- /dev/null
+++ b/prebuilts/api/202504/private/adbd_tradeinmode.te
@@ -0,0 +1,26 @@
+### ADB in trade-in mode
+type adbd_tradeinmode, domain, coredomain, adbd_common;
+
+# Create and use network sockets.
+net_domain(adbd_tradeinmode)
+
+# Run /system/bin/tradeinmode
+domain_auto_trans(adbd_tradeinmode, tradeinmode_exec, tradeinmode)
+
+# Baseline rules to make adbd work after setcon().
+allow adbd_tradeinmode adbd:unix_stream_socket {
+ rw_socket_perms_no_ioctl
+ listen
+ accept
+};
+allow adbd_tradeinmode adbd:fd use;
+allow adbd_tradeinmode adbd:unix_dgram_socket { connect write };
+allow adbd_tradeinmode functionfs:dir r_dir_perms;
+allow adbd_tradeinmode functionfs:file rw_file_perms;
+allow adbd_tradeinmode proc_uptime:file r_file_perms;
+allow adbd_tradeinmode rootfs:dir r_dir_perms;
+
+set_prop(adbd_tradeinmode, ffs_control_prop)
+
+# Allow changing persist.adb.tradeinmode when testing.
+userdebug_or_eng(`set_prop(adbd_tradeinmode, shell_prop)')
diff --git a/prebuilts/api/202504/private/aidl_lazy_test_server.te b/prebuilts/api/202504/private/aidl_lazy_test_server.te
new file mode 100644
index 0000000..98ab218
--- /dev/null
+++ b/prebuilts/api/202504/private/aidl_lazy_test_server.te
@@ -0,0 +1,10 @@
+userdebug_or_eng(`
+ typeattribute aidl_lazy_test_server coredomain;
+
+ init_daemon_domain(aidl_lazy_test_server)
+
+ binder_use(aidl_lazy_test_server)
+ binder_call(aidl_lazy_test_server, binderservicedomain)
+
+ add_service(aidl_lazy_test_server, aidl_lazy_test_service)
+')
diff --git a/prebuilts/api/202504/private/apex_test_prepostinstall.te b/prebuilts/api/202504/private/apex_test_prepostinstall.te
new file mode 100644
index 0000000..f1bc214
--- /dev/null
+++ b/prebuilts/api/202504/private/apex_test_prepostinstall.te
@@ -0,0 +1,20 @@
+# APEX pre- & post-install test.
+#
+# Allow to run pre- and post-install hooks for APEX test modules
+# in debuggable builds.
+
+type apex_test_prepostinstall, domain, coredomain;
+type apex_test_prepostinstall_exec, system_file_type, exec_type, file_type;
+
+userdebug_or_eng(`
+ # /dev/zero
+ allow apex_test_prepostinstall apexd:fd use;
+ # Logwrapper.
+ create_pty(apex_test_prepostinstall)
+ # Logwrapper executing sh.
+ allow apex_test_prepostinstall shell_exec:file rx_file_perms;
+ # Logwrapper exec.
+ allow apex_test_prepostinstall system_file:file execute_no_trans;
+ # Ls.
+ allow apex_test_prepostinstall toolbox_exec:file rx_file_perms;
+')
diff --git a/prebuilts/api/202504/private/apexd.te b/prebuilts/api/202504/private/apexd.te
new file mode 100644
index 0000000..3205b02
--- /dev/null
+++ b/prebuilts/api/202504/private/apexd.te
@@ -0,0 +1,236 @@
+typeattribute apexd coredomain;
+
+init_daemon_domain(apexd)
+
+binder_use(apexd)
+add_service(apexd, apex_service)
+
+# Allow creating, reading and writing of APEX files/dirs in the APEX data dir
+allow apexd apex_data_file:dir create_dir_perms;
+allow apexd apex_data_file:file create_file_perms;
+# Allow relabeling file created in /data/apex/decompressed
+allow apexd apex_data_file:file relabelfrom;
+
+# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir
+allow apexd metadata_file:dir search;
+allow apexd apex_metadata_file:dir create_dir_perms;
+allow apexd apex_metadata_file:file create_file_perms;
+
+# Allow reserving space on /data/apex/ota_reserved for apex decompression
+allow apexd apex_ota_reserved_file:dir create_dir_perms;
+allow apexd apex_ota_reserved_file:file create_file_perms;
+
+# Allow apexd to create files and directories for snapshots of apex data
+allow apexd apex_data_file_type:dir { create_dir_perms relabelto };
+allow apexd apex_data_file_type:file { create_file_perms relabelto };
+allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom };
+allow apexd apex_module_data_file:file { create_file_perms relabelfrom };
+allow apexd apex_rollback_data_file:dir create_dir_perms;
+allow apexd apex_rollback_data_file:file create_file_perms;
+
+# Allow apexd to read /data/misc_de and the directories under it, in order to
+# snapshot and restore apex data for all users.
+allow apexd {
+ system_userdir_file
+ system_data_file
+}:dir r_dir_perms;
+
+# allow apexd to create loop devices with /dev/loop-control
+allow apexd loop_control_device:chr_file rw_file_perms;
+# allow apexd to access loop devices
+allow apexd loop_device:blk_file rw_file_perms;
+allowxperm apexd loop_device:blk_file ioctl {
+ LOOP_GET_STATUS64
+ LOOP_SET_STATUS64
+ LOOP_SET_FD
+ LOOP_SET_BLOCK_SIZE
+ LOOP_SET_DIRECT_IO
+ LOOP_CLR_FD
+ BLKFLSBUF
+ LOOP_CONFIGURE
+};
+# Allow apexd to access /dev/block
+allow apexd dev_type:dir r_dir_perms;
+allow apexd dev_type:blk_file getattr;
+
+#allow apexd to access virtual disks
+allow apexd vd_device:blk_file r_file_perms;
+
+# allow apexd to access /dev/block/dm-* (device-mapper entries)
+allow apexd dm_device:chr_file rw_file_perms;
+allow apexd dm_device:blk_file rw_file_perms;
+
+# sys_admin is required to access the device-mapper and mount
+# dac_override, chown, and fowner are needed for snapshot and restore
+allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner };
+
+# Note: fsetid is deliberately not included above. fsetid checks are
+# triggered by chmod on a directory or file owned by a group other
+# than one of the groups assigned to the current process to see if
+# the setgid bit should be cleared, regardless of whether the setgid
+# bit was even set. We do not appear to truly need this capability
+# for apexd to operate.
+dontaudit apexd self:global_capability_class_set fsetid;
+
+# allow apexd to create a mount point in /apex
+allow apexd apex_mnt_dir:dir create_dir_perms;
+# allow apexd to mount in /apex
+allow apexd apex_mnt_dir:filesystem { mount unmount };
+allow apexd apex_mnt_dir:dir mounton;
+# allow apexd to create symlinks in /apex
+allow apexd apex_mnt_dir:lnk_file create_file_perms;
+# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file
+allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton };
+allow apexd apex_info_file:file relabelto;
+# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update.
+allow apexd apex_info_file:file rw_file_perms;
+
+# allow apexd to unlink apex files in /data/apex/active
+# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX,
+# because it doesn't have write permission for staging_data_file object.
+allow apexd staging_data_file:file unlink;
+
+# allow apexd to read files from /data/app-staging and hardlink them to /data/apex.
+allow apexd staging_data_file:dir r_dir_perms;
+allow apexd staging_data_file:file { r_file_perms link };
+# # Allow relabeling file created in /data/apex/decompressed
+allow apexd staging_data_file:file relabelto;
+# Allow renaming files in /data/apex/decompressed (from .ota.apex to .decompressed.apex)
+allow apexd staging_data_file:file rename;
+
+# allow apexd to read files from /vendor/apex
+r_dir_file(apexd, vendor_apex_file)
+r_dir_file(apexd, vendor_apex_metadata_file)
+
+# Unmount and mount filesystems
+allow apexd labeledfs:filesystem { mount unmount };
+
+# /sys directory tree traversal
+allow apexd sysfs_type:dir search;
+# Access to /sys/class/block
+allow apexd sysfs_type:dir r_dir_perms;
+allow apexd sysfs_type:file r_file_perms;
+# Configure read-ahead of dm-verity and loop devices
+# for dm-X
+allow apexd sysfs_dm:dir r_dir_perms;
+allow apexd sysfs_dm:file rw_file_perms;
+# for loopX
+allow apexd sysfs_loop:dir r_dir_perms;
+allow apexd sysfs_loop:file rw_file_perms;
+
+# Allow apexd to log to the kernel.
+allow apexd kmsg_device:chr_file w_file_perms;
+
+# Allow apexd to reboot device. Required for rollbacks of apexes that are
+# not covered by rollback manager.
+set_prop(apexd, powerctl_prop)
+
+# Allow apexd to stop itself
+set_prop(apexd, ctl_apexd_prop)
+
+# Allow apexd to send control messages to load/unload apex from init
+set_prop(apexd, ctl_apex_load_prop)
+
+# Find the vold service, and call into vold to manage FS checkpoints
+allow apexd vold_service:service_manager find;
+binder_call(apexd, vold)
+
+# apexd is using bootstrap bionic
+use_bootstrap_libs(apexd)
+
+# Allow apexd to be invoked with logwrapper from init during userspace reboot.
+allow apexd devpts:chr_file { read write };
+
+# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to
+# other processes
+create_pty(apexd)
+
+# Allow apexd to read file contexts when performing restorecon of snapshots.
+allow apexd file_contexts_file:file r_file_perms;
+
+# Allow apexd to execute toybox for snapshot & restore
+allow apexd toolbox_exec:file rx_file_perms;
+
+# Allow apexd to release compressed blocks in case /data is f2fs-compressed fs.
+allowxperm apexd staging_data_file:file ioctl {
+ FS_IOC_GETFLAGS
+ F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+};
+
+# Allow apexd to read ro.cold_boot_done prop.
+# apexd uses it to decide whether it needs to keep retrying polling for loop device.
+get_prop(apexd, cold_boot_done_prop)
+
+# Allow apexd to read per-device configuration properties.
+get_prop(apexd, apexd_config_prop)
+
+# Allow apexd to read apex selection properties.
+# These are used to choose between multi-installed APEXes at activation time.
+get_prop(apexd, apexd_select_prop)
+#
+# Allow apexd to read apexd_payload_metadata_prop
+get_prop(apexd, apexd_payload_metadata_prop)
+
+set_prop(apexd, apexd_prop)
+
+# Allow for use in postinstall
+allow apexd otapreopt_chroot:fd use;
+allow apexd postinstall_apex_mnt_dir:dir { create_dir_perms mounton };
+allow apexd postinstall_apex_mnt_dir:file { create_file_perms relabelfrom };
+allow apexd postinstall_apex_mnt_dir:lnk_file create;
+allow apexd proc_filesystems:file r_file_perms;
+
+# Allow for use in Pre-reboot Dexopt.
+allow apexd dexopt_chroot_setup:fd use;
+
+# Allow calling derive_classpath to gather BCP information for staged sessions
+domain_auto_trans(apexd, derive_classpath_exec, apexd_derive_classpath);
+
+# Allow set apex ready property
+set_prop(apexd, apex_ready_prop)
+
+# Allow apexd to write to statsd.
+unix_socket_send(apexd, statsdw, statsd)
+# Allow apexd to call
+allow apexd statsbootstrap_service:service_manager find;
+binder_call(apexd, system_server) # system_server serves statsbootstrap_service
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
+neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
+neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
+
+# only apexd can set apexd sysprop
+neverallow { domain -apexd -init } apexd_prop:property_service set;
+
+# only apexd can write apex-info-list.xml
+neverallow { domain -apexd } apex_info_file:file no_w_file_perms;
+
+# Only apexd and init should be allowed to manage /apex mounts
+# A note on otapreopt_chroot. It used to mount APEXes during postainstall stage of A/B OTAs,
+# but starting from S it just calls into apexd to prepare /apex for otapreoprt. Once the sepolicies
+# around otapreopt_chroot are cleaned up we should be able to remove it from the lists below.
+# dexopt_chroot_setup calls apexd to prepare /apex for Pre-reboot Dexopt, but it
+# needs to mount a tmpfs on /apex for apexd to work on.
+neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:filesystem { mount unmount };
+neverallow { domain -apexd -dexopt_chroot_setup -init -otapreopt_chroot } apex_mnt_dir:dir mounton;
+
+# The update_provider performs APEX updates. To do this, it needs to be able to find apex_service
+# and make binder calls to apexd.
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -apexd -keystore -system_server -update_engine -update_provider } apex_service:service_manager find;
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -apexd -keystore -system_server -servicemanager -update_engine -update_provider } apexd:binder call;
+
+neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;
diff --git a/prebuilts/api/202504/private/apexd_derive_classpath.te b/prebuilts/api/202504/private/apexd_derive_classpath.te
new file mode 100644
index 0000000..d4c5496
--- /dev/null
+++ b/prebuilts/api/202504/private/apexd_derive_classpath.te
@@ -0,0 +1,9 @@
+# Exclusive domain for apexd calling into derive_classpath binary
+type apexd_derive_classpath, domain, coredomain;
+
+# Allow the binary to write into output file at location /apex/derive_classpath_temp
+allow apexd_derive_classpath apexd:fd use;
+allow apexd_derive_classpath apex_mnt_dir:file { write open };
+# Allow the binary to log using logwrap
+allow apexd_derive_classpath apexd_devpts:chr_file { read write };
+
diff --git a/prebuilts/api/202504/private/app.te b/prebuilts/api/202504/private/app.te
new file mode 100644
index 0000000..b9a6d85
--- /dev/null
+++ b/prebuilts/api/202504/private/app.te
@@ -0,0 +1,812 @@
+# /proc/net access.
+# TODO(b/9496886) Audit access for removal.
+# proc_net access for the negated domains below is granted (or not) in their
+# individual .te files.
+r_dir_file({
+ appdomain
+ -ephemeral_app
+ -isolated_app_all
+ -platform_app
+ -priv_app
+ -shell
+ -sdk_sandbox_all
+ -system_app
+ -untrusted_app_all
+}, proc_net_type)
+# audit access for all these non-core app domains.
+userdebug_or_eng(`
+ auditallow {
+ appdomain
+ -ephemeral_app
+ -isolated_app_all
+ -platform_app
+ -priv_app
+ -shell
+ -su
+ -sdk_sandbox_all
+ -system_app
+ -untrusted_app_all
+ } proc_net_type:{ dir file lnk_file } { getattr open read };
+')
+
+# Allow apps to read the Test Harness Mode property. This property is used in
+# the implementation of ActivityManager.isDeviceInTestHarnessMode()
+get_prop(appdomain, test_harness_prop)
+
+get_prop(appdomain, boot_status_prop)
+get_prop(appdomain, dalvik_config_prop_type)
+get_prop(appdomain, media_config_prop)
+get_prop(appdomain, packagemanager_config_prop)
+get_prop(appdomain, radio_control_prop)
+get_prop(appdomain, surfaceflinger_color_prop)
+get_prop(appdomain, systemsound_config_prop)
+get_prop(appdomain, telephony_config_prop)
+get_prop(appdomain, userspace_reboot_config_prop)
+get_prop(appdomain, vold_config_prop)
+get_prop(appdomain, adbd_config_prop)
+get_prop(appdomain, dck_prop)
+get_prop(appdomain, persist_wm_debug_prop)
+get_prop(appdomain, persist_sysui_builder_extras_prop)
+get_prop(appdomain, persist_sysui_ranking_update_prop)
+
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(appdomain, traced_oome_heap_session_count_prop)
+
+# Allow to read ro.vendor.camera.extensions.enabled
+get_prop(appdomain, camera2_extensions_prop)
+
+# Allow to ro.camerax.extensions.enabled
+get_prop(appdomain, camerax_extensions_prop)
+
+# Prevent apps from causing presubmit failures.
+# Apps can cause selinux denials by accessing CE storage
+# and/or external storage. In either case, the selinux denial is
+# not the cause of the failure, but just a symptom that
+# storage isn't ready. Many apps handle the failure appropriately.
+#
+# Apps cannot access external storage before it becomes available.
+dontaudit appdomain storage_stub_file:dir getattr;
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
+# allowed to write to CE storage before it's available.
+# Attempting to do so will be blocked by both selinux and unix
+# permissions.
+dontaudit appdomain system_data_file:dir write;
+# Apps should not be reading vendor-defined properties.
+dontaudit appdomain vendor_default_prop:file read;
+
+# Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
+allow { appdomain -sdk_sandbox_all } mnt_media_rw_file:dir search;
+
+# allow apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow appdomain system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# Allow to read sendbug.preferred.domain
+get_prop(appdomain, sendbug_config_prop)
+
+# Allow to read graphics related properties.
+get_prop(appdomain, graphics_config_prop)
+
+# Allow to read persist.config.calibration_fac
+get_prop(appdomain, camera_calibration_prop)
+
+# Allow to read db.log.detailed, db.log.slow_query_threshold*
+get_prop(appdomain, sqlite_log_prop)
+
+# Allow to read system_user_mode_emulation_prop, which is used by UserManager.java
+userdebug_or_eng(`get_prop(appdomain, system_user_mode_emulation_prop)')
+
+# Allow font file read by apps.
+allow appdomain font_data_file:file r_file_perms;
+allow appdomain font_data_file:dir r_dir_perms;
+
+# Enter /data/misc/apexdata/
+allow appdomain apex_module_data_file:dir search;
+# Read /data/misc/apexdata/com.android.art, execute signed AOT artifacts.
+allow appdomain apex_art_data_file:dir r_dir_perms;
+allow appdomain apex_art_data_file:file rx_file_perms;
+
+# Allow access to tombstones if an fd to one is given to you.
+# An app cannot open the tombstone itself because it lacks `open`.
+allow appdomain tombstone_data_file:file { getattr read };
+
+# Execute the shell or other system executables.
+allow { appdomain -ephemeral_app -sdk_sandbox_all } shell_exec:file rx_file_perms;
+allow { appdomain -ephemeral_app -sdk_sandbox_all } toolbox_exec:file rx_file_perms;
+not_full_treble(`allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_file:file x_file_perms;')
+
+# Allow apps access to /vendor/app except for privileged
+# apps which cannot be in /vendor.
+r_dir_file({ appdomain -ephemeral_app -sdk_sandbox_all }, vendor_app_file)
+allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:file execute;
+
+# Allow apps to read microdroid related files in vendor partition for CTS purpose.
+r_dir_file({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, vendor_microdroid_file)
+
+# Perform binder IPC to sdk sandbox.
+binder_call(appdomain, sdk_sandbox_all)
+
+# Allow apps to communicate via binder with virtual camera service.
+binder_call(appdomain, virtual_camera)
+
+# Allow access to external storage; we have several visible mount points under /storage
+# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } storage_file:dir r_dir_perms;
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } storage_file:lnk_file r_file_perms;
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } mnt_user_file:dir r_dir_perms;
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } mnt_user_file:lnk_file r_file_perms;
+
+# Read/write visible storage
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } { sdcard_type fuse }:dir create_dir_perms;
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } { sdcard_type fuse }:file create_file_perms;
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } media_rw_data_file:dir create_dir_perms;
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } media_rw_data_file:file create_file_perms;
+
+# Allow apps to use the USB Accessory interface.
+# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
+#
+# USB devices are first opened by the system server (USBDeviceManagerService)
+# and the file descriptor is passed to the right Activity via binder.
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } usb_device:chr_file { read write getattr ioctl };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } usbaccessory_device:chr_file { read write getattr };
+
+#logd access
+control_logd({ appdomain -ephemeral_app -sdk_sandbox_all })
+
+# application inherit logd write socket (urge is to deprecate this long term)
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info grant rebind update };
+
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;
+
+use_keystore({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
+
+use_credstore({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
+
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } persistent_data_block_service:service_manager find;
+
+# For app fuse.
+pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, display_client)
+pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, display_manager)
+pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, display_vsync)
+pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, performance_client)
+# Apps do not directly open the IPC socket for bufferhubd.
+pdx_use({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, bufferhub_client)
+
+# Apps receive an open tun fd from the framework for
+# device traffic. Do not allow untrusted app to directly open tun_device
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } tun_device:chr_file { read write getattr append ioctl };
+allowxperm { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } tun_device:chr_file ioctl TUNGETIFF;
+
+
+# WebView and other application-specific JIT compilers
+allow appdomain self:process execmem;
+
+allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute;
+
+# Receive and use open file descriptors inherited from zygote.
+allow appdomain zygote:fd use;
+
+# Receive and use open file descriptors inherited from app zygote.
+allow appdomain app_zygote:fd use;
+
+# gdbserver for ndk-gdb reads the zygote.
+# valgrind needs mmap exec for zygote
+allow appdomain zygote_exec:file rx_file_perms;
+
+# Notify zygote of death;
+allow appdomain zygote:process sigchld;
+
+# Read /data/dalvik-cache.
+allow appdomain dalvikcache_data_file:dir { search getattr };
+allow appdomain dalvikcache_data_file:file r_file_perms;
+
+# Read the /sdcard and /mnt/sdcard symlinks
+allow { appdomain -isolated_app_all -sdk_sandbox_all } rootfs:lnk_file r_file_perms;
+allow { appdomain -isolated_app_all -sdk_sandbox_all } tmpfs:lnk_file r_file_perms;
+
+# Search /storage/emulated tmpfs mount.
+allow { appdomain -sdk_sandbox_all } tmpfs:dir r_dir_perms;
+
+# Notify zygote of the wrapped process PID when using --invoke-with.
+allow appdomain zygote:fifo_file write;
+
+userdebug_or_eng(`
+ # Allow apps to create and write method traces in /data/misc/trace.
+ allow appdomain method_trace_data_file:dir w_dir_perms;
+ allow appdomain method_trace_data_file:file { create w_file_perms };
+')
+
+# Notify shell and adbd of death when spawned via runas for ndk-gdb.
+allow appdomain shell:process sigchld;
+allow appdomain adbd:process sigchld;
+
+# child shell or gdbserver pty access for runas.
+allow appdomain devpts:chr_file { getattr read write ioctl };
+
+# Use pipes and sockets provided by system_server via binder or local socket.
+allow appdomain system_server:fd use;
+allow appdomain system_server:fifo_file rw_file_perms;
+allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
+allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
+
+# For AppFuse.
+allow appdomain vold:fd use;
+
+# Communication with other apps via fifos
+allow appdomain appdomain:fifo_file rw_file_perms;
+
+# Communicate with surfaceflinger.
+allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
+
+# App sandbox file accesses.
+allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir create_dir_perms;
+allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:file create_file_perms;
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ # an app can read but cannot write to its own directory of storage areas
+ allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } storage_area_app_dir:dir r_dir_perms;
+ # an app can write to its storage areas
+ allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } storage_area_dir:dir rw_dir_perms;
+')
+
+allowxperm { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:file ioctl FS_IOC_MEASURE_VERITY;
+
+# Access via already open fds is ok even for mlstrustedsubject.
+allow { appdomain -isolated_app_all -sdk_sandbox_all } {
+ app_data_file
+ privapp_data_file
+ system_app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:file { getattr map read write };
+
+# Access open fds from SDK sandbox
+allow appdomain sdk_sandbox_data_file:file { getattr read };
+
+# Traverse into expanded storage
+allow appdomain mnt_expand_file:dir r_dir_perms;
+
+# Keychain and user-trusted credentials
+r_dir_file(appdomain, keychain_data_file)
+allow appdomain misc_user_data_file:dir r_dir_perms;
+allow appdomain misc_user_data_file:file r_file_perms;
+
+# TextClassifier
+r_dir_file({ appdomain -isolated_app_all }, textclassifier_data_file)
+
+# Access to OEM provided data and apps
+allow appdomain oemfs:dir r_dir_perms;
+allow appdomain oemfs:file rx_file_perms;
+
+allow appdomain system_file:file x_file_perms;
+
+# Renderscript needs the ability to read directories on /system
+allow appdomain system_file:dir r_dir_perms;
+allow appdomain system_file:lnk_file { getattr open read };
+# Renderscript specific permissions to open /system/vendor/lib64.
+not_full_treble(`
+ allow appdomain vendor_file_type:dir r_dir_perms;
+ allow appdomain vendor_file_type:lnk_file { getattr open read };
+')
+
+full_treble_only(`
+ # For looking up Renderscript vendor drivers
+ allow { appdomain -isolated_app_all } vendor_file:dir { open read };
+')
+
+# Allow apps access to /vendor/overlay
+r_dir_file(appdomain, vendor_overlay_file)
+
+# Allow apps access to /vendor/framework
+# for vendor provided libraries.
+r_dir_file(appdomain, vendor_framework_file)
+
+# Allow apps read / execute access to vendor public libraries.
+allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms;
+allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map };
+
+# Read/write wallpaper file (opened by system).
+allow appdomain wallpaper_file:file { getattr read write map };
+
+# Read/write cached ringtones (opened by system).
+allow appdomain ringtone_file:file { getattr read write map };
+
+# Read ShortcutManager icon files (opened by system).
+allow appdomain shortcut_manager_icons:file { getattr read map };
+
+# Read icon file (opened by system).
+allow appdomain icon_file:file { getattr read map };
+
+# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt).
+#
+# TODO: All of these permissions except for anr_data_file:file append can be
+# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548
+# and the rules below.
+allow appdomain anr_data_file:dir search;
+allow appdomain anr_data_file:file { open append };
+
+# New stack dumping scheme : request an output FD from tombstoned via a unix
+# domain socket.
+#
+# Allow apps to connect and write to the tombstoned java trace socket in
+# order to dump their traces. Also allow them to append traces to pipes
+# created by dumptrace. (Also see the rules below where they are given
+# additional permissions to dumpstate pipes for other aspects of bug report
+# creation).
+unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned)
+allow appdomain tombstoned:fd use;
+allow appdomain dumpstate:fifo_file append;
+allow appdomain incidentd:fifo_file append;
+
+# Allow apps to send dump information to dumpstate
+allow appdomain dumpstate:fd use;
+allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
+allow appdomain dumpstate:fifo_file { write getattr };
+allow appdomain shell_data_file:file { write getattr };
+
+# Allow apps to send dump information to incidentd
+allow appdomain incidentd:fd use;
+allow appdomain incidentd:fifo_file { write getattr };
+
+# Allow apps to send information to statsd socket.
+unix_socket_send(appdomain, statsdw, statsd)
+
+# Write profiles /data/misc/profiles
+allow appdomain user_profile_root_file:dir search;
+allow appdomain user_profile_data_file:dir w_dir_perms;
+allow appdomain user_profile_data_file:file create_file_perms;
+
+# Allow writing performance tracing data into the perfetto traced daemon.
+# Needed for java heap graph ART plugin (perfetto_hprof).
+# The perfetto profiling daemon will check for the specific application's
+# opt-in/opt-out.
+perfetto_producer(appdomain)
+
+# Send heap dumps to system_server via an already open file descriptor
+# % adb shell am set-watch-heap com.android.systemui 1048576
+# % adb shell dumpsys procstats --start-testing
+# debuggable builds only.
+userdebug_or_eng(`
+ allow appdomain heapdump_data_file:file append;
+')
+
+# Grant GPU access to all processes started by Zygote.
+# They need that to render the standard UI.
+allow { appdomain -isolated_app_all } gpu_device:chr_file rw_file_perms;
+allow { appdomain -isolated_app_all } gpu_device:dir r_dir_perms;
+allow { appdomain -isolated_app_all } sysfs_gpu:file r_file_perms;
+
+
+# Use the Binder.
+binder_use(appdomain)
+# Perform binder IPC to binder services.
+binder_call(appdomain, binderservicedomain)
+# Perform binder IPC to other apps.
+binder_call(appdomain, appdomain)
+# Perform binder IPC to ephemeral apps.
+binder_call(appdomain, ephemeral_app)
+# Perform binder IPC to gpuservice.
+binder_call({ appdomain -isolated_app_all }, gpuservice)
+
+# Talk with graphics composer fences
+allow appdomain hal_graphics_composer:fd use;
+
+# Already connected, unnamed sockets being passed over some other IPC
+# hence no sock_file or connectto permission. This appears to be how
+# Chrome works, may need to be updated as more apps using isolated services
+# are examined.
+allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
+
+# Backup ability for every app. BMS opens and passes the fd
+# to any app that has backup ability. Hence, no open permissions here.
+allow appdomain backup_data_file:file { read write getattr map };
+allow appdomain cache_backup_file:file { read write getattr map };
+allow appdomain cache_backup_file:dir getattr;
+# Backup ability using 'adb backup'
+allow appdomain system_data_file:lnk_file r_file_perms;
+allow appdomain system_data_file:file { getattr read map };
+
+# Allow read/stat of /data/media files passed by Binder or local socket IPC.
+allow { appdomain -isolated_app_all -sdk_sandbox_all } media_rw_data_file:file { read getattr };
+
+# Read and write /data/data/com.android.providers.telephony files passed over Binder.
+allow { appdomain -isolated_app_all } radio_data_file:file { read write getattr };
+
+# For art.
+allow appdomain dalvikcache_data_file:file execute;
+allow appdomain dalvikcache_data_file:lnk_file r_file_perms;
+
+# Allow any app to read shared RELRO files.
+allow appdomain shared_relro_file:dir search;
+allow appdomain shared_relro_file:file r_file_perms;
+
+# Allow apps to read/execute installed binaries
+allow appdomain apk_data_file:dir { open getattr read search ioctl lock };
+allow appdomain apk_data_file:file { getattr open read ioctl lock map x_file_perms };
+
+# /data/resource-cache
+allow appdomain resourcecache_data_file:file r_file_perms;
+allow appdomain resourcecache_data_file:dir r_dir_perms;
+
+# logd access
+read_logd(appdomain)
+
+allow appdomain zygote:unix_dgram_socket write;
+
+allow appdomain console_device:chr_file { read write };
+
+# only allow unprivileged socket ioctl commands
+allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket }
+ ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
+
+allow { appdomain -isolated_app_all } ion_device:chr_file r_file_perms;
+allow { appdomain -isolated_app_all } dmabuf_system_heap_device:chr_file r_file_perms;
+allow { appdomain -isolated_app_all } dmabuf_system_secure_heap_device:chr_file r_file_perms;
+
+# Allow AAudio apps to use shared memory file descriptors from the HAL
+allow { appdomain -isolated_app_all } hal_audio:fd use;
+
+# Allow app to access shared memory created by camera HAL1
+allow { appdomain -isolated_app_all } hal_camera:fd use;
+
+# Allow apps to access shared memory file descriptor from the tuner HAL
+allow {appdomain -isolated_app_all} hal_tv_tuner_server:fd use;
+
+# Allow app to access shared memory created by PowerHAL for FMQ use
+allow { appdomain -isolated_app_all } hal_power_server:fd use;
+
+# RenderScript always-passthrough HAL
+allow { appdomain -isolated_app_all } hal_renderscript_hwservice:hwservice_manager find;
+allow appdomain same_process_hal_file:file { execute read open getattr map };
+
+# TODO: switch to meminfo service
+allow appdomain proc_meminfo:file r_file_perms;
+
+# For app fuse.
+allow appdomain app_fuse_file:file { getattr read append write map };
+
+###
+### CTS-specific rules
+###
+
+# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
+# testRunAsHasCorrectCapabilities
+allow appdomain runas_exec:file getattr;
+# Others are either allowed elsewhere or not desired.
+
+get_prop(appdomain, high_barometer_quality_prop)
+
+# Connect to adbd and use a socket transferred from it.
+# This is used for e.g. adb backup/restore.
+allow appdomain adbd:unix_stream_socket connectto;
+allow appdomain adbd:fd use;
+allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
+
+allow appdomain cache_file:dir getattr;
+
+# Allow apps to run with asanwrapper.
+with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;')
+
+# Read access to FDs from the DropboxManagerService.
+allow appdomain dropbox_data_file:file { getattr read };
+
+# Read tmpfs types from these processes.
+allow appdomain audioserver_tmpfs:file { getattr map read write };
+allow appdomain system_server_tmpfs:file { getattr map read write };
+allow appdomain zygote_tmpfs:file { map read };
+
+###
+### Neverallow rules
+###
+### These are things that Android apps should NEVER be able to do
+###
+
+# Superuser capabilities.
+# bluetooth requires net_admin and wake_alarm. network stack app requires net_admin.
+neverallow { appdomain -bluetooth -network_stack } self:capability_class_set *;
+
+# Block device access.
+neverallow appdomain dev_type:blk_file { read write };
+
+# Note: Try expanding list of app domains in the future.
+neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write };
+
+neverallow { appdomain -nfc } nfc_device:chr_file
+ { read write };
+neverallow { appdomain -bluetooth } hci_attach_dev:chr_file
+ { read write };
+neverallow appdomain tee_device:chr_file { read write };
+
+# Privileged netlink socket interfaces.
+neverallow { appdomain -network_stack }
+ domain:{
+ netlink_tcpdiag_socket
+ netlink_nflog_socket
+ netlink_xfrm_socket
+ netlink_audit_socket
+ netlink_dnrt_socket
+ } *;
+
+# These messages are broadcast messages from the kernel to userspace.
+# Do not allow the writing of netlink messages, which has been a source
+# of rooting vulns in the past.
+neverallow { appdomain -network_stack }
+ domain:netlink_kobject_uevent_socket { write append };
+
+# Sockets under /dev/socket that are not specifically typed.
+neverallow appdomain socket_device:sock_file write;
+
+# Unix domain sockets.
+neverallow appdomain adbd_socket:sock_file write;
+neverallow { appdomain -radio } rild_socket:sock_file write;
+
+# ptrace access to non-app domains.
+neverallow appdomain { domain -appdomain }:process ptrace;
+
+# The Android security model guarantees the confidentiality and integrity
+# of application data and execution state. Ptrace bypasses those
+# confidentiality guarantees. Disallow ptrace access from system components
+# to apps. Crash_dump is excluded, as it needs ptrace access to
+# produce stack traces. llkd is excluded, as it needs ptrace access to
+# inspect stack traces for live lock conditions.
+
+neverallow {
+ domain
+ -appdomain
+ -crash_dump
+ userdebug_or_eng(`-llkd')
+} appdomain:process ptrace;
+
+# Read or write access to /proc/pid entries for any non-app domain.
+# A different form of hidepid=2 like protections
+neverallow appdomain { domain -appdomain }:file no_w_file_perms;
+neverallow { appdomain -shell } { domain -appdomain }:file no_rw_file_perms;
+
+# signal access to non-app domains.
+# sigchld allowed for parent death notification.
+# signull allowed for kill(pid, 0) existence test.
+# All others prohibited.
+# -perfetto is to allow shell (which is an appdomain) to kill perfetto
+# (see private/shell.te).
+neverallow appdomain { domain -appdomain -perfetto }:process
+ { sigkill sigstop signal };
+
+# Write to rootfs.
+neverallow appdomain rootfs:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to /system.
+neverallow appdomain system_file_type:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to entrypoint executables.
+neverallow appdomain exec_type:file
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to system-owned parts of /data.
+# This is the default type for anything under /data not otherwise
+# specified in file_contexts. Define a different type for portions
+# that should be writable by apps.
+neverallow appdomain system_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Write to various other parts of /data.
+neverallow appdomain drm_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_private_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -platform_app }
+ apk_private_tmp_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -shell }
+ shell_data_file:dir_file_class_set
+ { create setattr relabelfrom relabelto append unlink link rename };
+neverallow { appdomain -bluetooth }
+ bluetooth_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { domain -credstore -init } credstore_data_file:dir_file_class_set *;
+neverallow appdomain
+ keystore_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ systemkeys_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ wifi_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow appdomain
+ dhcp_data_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# access tmp apk files
+neverallow { appdomain -platform_app }
+ apk_tmp_file:dir_file_class_set
+ { create write setattr relabelfrom relabelto append unlink link rename };
+
+# Access to factory files.
+neverallow appdomain efs_file:dir_file_class_set write;
+neverallow { appdomain -shell } efs_file:dir_file_class_set read;
+
+# Write to various pseudo file systems.
+neverallow { appdomain -bluetooth -nfc }
+ sysfs:dir_file_class_set write;
+neverallow appdomain
+ proc:dir_file_class_set write;
+
+# Access to syslog(2) or /proc/kmsg.
+neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console };
+
+# SELinux is not an API for apps to use
+neverallow { appdomain -shell } *:security { compute_av check_context };
+neverallow { appdomain -shell } *:netlink_selinux_socket *;
+
+# Ability to perform any filesystem operation other than statfs(2).
+# i.e. no mount(2), unmount(2), etc.
+neverallow appdomain fs_type:filesystem ~getattr;
+
+# prevent creation/manipulation of globally readable symlinks
+neverallow appdomain {
+ apk_data_file
+ cache_file
+ cache_recovery_file
+ dev_type
+ rootfs
+ system_file
+ tmpfs
+}:lnk_file no_w_file_perms;
+
+# Applications should use the activity model for receiving events
+neverallow {
+ appdomain
+ -shell # bugreport
+} input_device:chr_file ~getattr;
+
+# Do not allow access to Bluetooth-related system properties except for a few allowed domains.
+# neverallow rules for access to Bluetooth-related data files are above.
+neverallow {
+ appdomain
+ -bluetooth
+ -system_app
+} { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms;
+
+# allow system_app to access Nfc-related system properties.
+set_prop(system_app, nfc_prop)
+
+# allow system_app to access radio_config system properties.
+set_prop(system_app, radio_control_prop)
+
+# Apps cannot access proc_uid_time_in_state
+neverallow appdomain proc_uid_time_in_state:file *;
+
+# Apps cannot access proc_uid_concurrent_active_time
+neverallow appdomain proc_uid_concurrent_active_time:file *;
+
+# Apps cannot access proc_uid_concurrent_policy_time
+neverallow appdomain proc_uid_concurrent_policy_time:file *;
+
+# Apps cannot access proc_uid_cpupower
+neverallow appdomain proc_uid_cpupower:file *;
+
+# Apps may not read /proc/net/{tcp,tcp6,udp,udp6}. These files leak information across the
+# application boundary. VPN apps may use the ConnectivityManager.getConnectionOwnerUid() API to
+# perform UID lookups.
+neverallow { appdomain -shell } proc_net_tcp_udp:file *;
+
+# Apps cannot access bootstrap files. The bootstrap files are only for
+# extremely early processes (like init, etc.) which are started before
+# the runtime APEX is activated and Bionic libs are provided from there.
+# If app process accesses (or even load/execute) the bootstrap files,
+# it might cause problems such as ODR violation, etc.
+neverallow appdomain system_bootstrap_lib_file:file
+ { open read write append execute execute_no_trans map };
+neverallow appdomain system_bootstrap_lib_file:dir
+ { open read getattr search };
+
+# Sensitive app domains are not allowed to execute from /data
+# to prevent persistence attacks and ensure all code is executed
+# from read-only locations.
+neverallow {
+ bluetooth
+ isolated_app_all
+ nfc
+ radio
+ shared_relro
+ sdk_sandbox_all
+ system_app
+} {
+ data_file_type
+ -apex_art_data_file
+ -dalvikcache_data_file
+ -system_data_file # shared libs in apks
+ -apk_data_file
+}:file no_x_file_perms;
+
+# Don't allow apps access to any of the following character devices.
+neverallow appdomain {
+ audio_device
+ camera_device
+ dm_device
+ radio_device
+ rpmsg_device
+}:chr_file { read write };
+
+# Block video device access for all apps except the DeviceAsWebcam Service which
+# needs access to /dev/video* for interfacing with the host
+neverallow {
+ appdomain
+ -device_as_webcam
+} video_device:chr_file { read write };
+
+# Prevent calling inotify on APKs. This can be used as a side channel
+# to observer app launches, so it must be disallowed. b/231587164
+# Gate by targetSdkVersion to avoid breaking existing apps.
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:dir { watch watch_reads };
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:file { watch watch_reads };
+
+neverallow appdomain system_server:udp_socket {
+ accept append bind create ioctl listen lock name_bind
+ relabelfrom relabelto setattr shutdown };
+
+# Transition to a non-app domain.
+# Exception for the shell and su domains, can transition to runas, etc.
+# Exception for crash_dump to allow for app crash reporting.
+# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
+# to allow renderscript to create privileged executable files.
+# Exception for virtualizationmanager to allow running VMs as child processes.
+neverallow { appdomain -shell userdebug_or_eng(`-su') }
+ { domain -appdomain -crash_dump -rs -virtualizationmanager }:process { transition };
+neverallow { appdomain -shell userdebug_or_eng(`-su') }
+ { domain -appdomain }:process { dyntransition };
+
+# Don't allow regular apps access to storage configuration properties.
+neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
+
+# Don't allow apps reading /system/etc/font_fallback.xml
+dontaudit appdomain system_font_fallback_file:file no_rw_file_perms;
+neverallow appdomain system_font_fallback_file:file no_rw_file_perms;
+
+neverallow { appdomain -shell } tombstone_data_file:file ~{ getattr read };
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ # Files and directories that apps write to their storage areas
+ # should have type storage_area_content_file
+ type_transition {
+ appdomain
+ -isolated_app_all
+ -ephemeral_app
+ -sdk_sandbox_all
+ } storage_area_dir:{ notdevfile_class_set dir } storage_area_content_file;
+')
diff --git a/prebuilts/api/202504/private/app_neverallows.te b/prebuilts/api/202504/private/app_neverallows.te
new file mode 100644
index 0000000..434fb13
--- /dev/null
+++ b/prebuilts/api/202504/private/app_neverallows.te
@@ -0,0 +1,324 @@
+###
+### neverallow rules for untrusted app domains
+###
+
+define(`all_untrusted_apps',`{
+ ephemeral_app
+ isolated_app
+ isolated_app_all
+ isolated_compute_app
+ mediaprovider
+ mediaprovider_app
+ untrusted_app
+ untrusted_app_25
+ untrusted_app_27
+ untrusted_app_29
+ untrusted_app_30
+ untrusted_app_all
+}')
+# Receive or send uevent messages.
+neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow all_untrusted_apps domain:netlink_socket *;
+
+# Read or write kernel printk buffer
+neverallow all_untrusted_apps kmsg_device:chr_file no_rw_file_perms;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read;
+neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read;
+
+# Do not allow untrusted apps to register services.
+# Only trusted components of Android should be registering
+# services.
+neverallow all_untrusted_apps service_manager_type:service_manager add;
+
+# Do not allow untrusted apps to use VendorBinder
+neverallow all_untrusted_apps vndbinder_device:chr_file *;
+neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
+
+# Do not allow untrusted apps to connect to the property service
+# or set properties. b/10243159
+neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
+neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
+neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
+
+# Do not allow untrusted apps to modify temporarily staged APKs.
+neverallow all_untrusted_apps { apk_tmp_file apk_private_tmp_file }:{ devfile_class_set dir fifo_file lnk_file sock_file } *;
+neverallow all_untrusted_apps { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read map };
+
+# net.dns properties are not a public API. Disallow untrusted apps from reading this property.
+neverallow { all_untrusted_apps } net_dns_prop:file read;
+
+# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property.
+neverallow { all_untrusted_apps } radio_cdma_ecm_prop:file read;
+
+# Shared libraries created by trusted components within an app home
+# directory can be dlopen()ed. To maintain the W^X property, these files
+# must never be writable to the app.
+neverallow all_untrusted_apps app_exec_data_file:file
+ { append create link relabelfrom relabelto rename setattr write };
+
+# Block calling execve() on files in an apps home directory.
+# This is a W^X violation (loading executable code from a writable
+# home directory). For compatibility, allow for targetApi <= 28.
+# b/112357170
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+ -runas_app
+} { app_data_file privapp_data_file }:file execute_no_trans;
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ # block apps from executing files in their storage areas
+ # this is a stronger and more desirable guarantee than blocking execute_no_trans, but
+ # execute cannot be blocked on all of app_data_file without causing
+ # backwards compatibility issues (see b/237289679)
+ neverallow appdomain storage_area_content_file:file execute;
+')
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ # dont allow apps to modify their own directories of storage areas
+ neverallow appdomain storage_area_app_dir:dir_file_class_set {
+ create write setattr relabelfrom relabelto append unlink link rename
+ };
+')
+
+# Do not allow untrusted apps to invoke dex2oat. This was historically required
+# by ART for compiling secondary dex files but has been removed in Q.
+# Exempt legacy apps (targetApi<=28) for compatibility.
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+} dex2oat_exec:file no_x_file_perms;
+
+# Do not allow untrusted apps to be assigned mlstrustedsubject.
+# This would undermine the per-user isolation model being
+# enforced via levelFrom=user in seapp_contexts and the mls
+# constraints. As there is no direct way to specify a neverallow
+# on attribute assignment, this relies on the fact that fork
+# permission only makes sense within a domain (hence should
+# never be granted to any other domain within mlstrustedsubject)
+# and an untrusted app is allowed fork permission to itself.
+neverallow all_untrusted_apps mlstrustedsubject:process fork;
+
+# Do not allow untrusted apps to hard link to any files.
+# In particular, if an untrusted app links to other app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure untrusted apps never have this
+# capability.
+neverallow all_untrusted_apps file_type:file link;
+
+# Do not allow untrusted apps to access network MAC address file
+neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms;
+
+# Do not allow any write access to files in /sys
+neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
+
+# Apps may never access the default sysfs label.
+neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow all_untrusted_apps *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
+
+# Apps can read/write an already open vsock (e.g. created by
+# virtualizationservice) but nothing more than that (e.g. creating a
+# new vsock, etc.)
+neverallow all_untrusted_apps *:vsock_socket ~{ getattr getopt read write };
+
+# Disallow sending RTM_GETLINK messages on netlink sockets.
+neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv };
+neverallow priv_app domain:netlink_route_socket { bind nlmsg_readpriv };
+
+# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets.
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+} domain:netlink_route_socket nlmsg_getneigh;
+
+# Do not allow untrusted apps access to /cache
+neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
+neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
+
+# Do not allow untrusted apps to create/unlink files outside of its sandbox,
+# internal storage or sdcard.
+# World accessible data locations allow application to fill the device
+# with unaccounted for data. This data will not get removed during
+# application un-installation.
+neverallow { all_untrusted_apps -mediaprovider } {
+ fs_type
+ -sdcard_type
+ -fuse
+ file_type
+ -app_data_file # The apps sandbox itself
+ -privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `-storage_area_content_file')
+ -app_exec_data_file # stored within the app sandbox directory
+ -media_rw_data_file # Internal storage. Known that apps can
+ # leave artfacts here after uninstall.
+ -user_profile_data_file # Access to profile files
+ userdebug_or_eng(`
+ -method_trace_data_file # only on ro.debuggable=1
+ -coredump_file # userdebug/eng only
+ ')
+}:dir_file_class_set { create unlink };
+
+# No untrusted component except mediaprovider_app should be touching /dev/fuse
+neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *;
+
+# Do not allow untrusted apps to directly open the tun_device
+neverallow all_untrusted_apps tun_device:chr_file open;
+# The tun_device ioctls below are not allowed, to prove equivalence
+# to the kernel patch at
+# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21
+neverallowxperm all_untrusted_apps tun_device:chr_file ioctl ~{ FIOCLEX FIONCLEX TUNGETIFF };
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+neverallow all_untrusted_apps anr_data_file:file ~{ open append };
+neverallow all_untrusted_apps anr_data_file:dir ~search;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow all_untrusted_apps {
+ proc
+ proc_allocinfo
+ proc_asound
+ proc_kmsg
+ proc_loadavg
+ proc_mounts
+ proc_pagetypeinfo
+ proc_slabinfo
+ proc_stat
+ proc_swaps
+ proc_uptime
+ proc_version
+ proc_vmallocinfo
+ proc_vmstat
+}:file { no_rw_file_perms no_x_file_perms };
+
+# /proc/filesystems is accessible to mediaprovider_app only since it handles
+# external storage
+neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms };
+
+# Avoid all access to kernel configuration
+neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
+
+# Do not allow untrusted apps access to preloads data files
+neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
+
+# Locking of files on /system could lead to denial of service attacks
+# against privileged system components
+neverallow all_untrusted_apps system_file:file lock;
+
+# Do not permit untrusted apps to perform actions on HwBinder service_manager
+# other than find actions for services listed below
+neverallow all_untrusted_apps *:hwservice_manager ~find;
+
+# Do not permit access from apps which host arbitrary code to the protected services
+# The two main reasons for this are:
+# 1. Protected HwBinder servers do not perform client authentication because
+# vendor code does not have a way to understand apps or their relation to
+# caller UID information and, even if it did, those services either operate
+# at a level below that of apps (e.g., HALs) or must not rely on app identity
+# for authorization. Thus, to be safe, the default assumption for all added
+# vendor services is that they treat all their clients as equally authorized
+# to perform operations offered by the service.
+# 2. HAL servers contain code with higher incidence rate of security issues
+# than system/core components and have access to lower layes of the stack
+# (all the way down to hardware) thus increasing opportunities for bypassing
+# the Android security model.
+neverallow all_untrusted_apps protected_hwservice:hwservice_manager find;
+neverallow all_untrusted_apps protected_service:service_manager find;
+
+# SELinux is not an API for untrusted apps to use
+neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
+
+# Access to /proc/tty/drivers, to allow apps to determine if they
+# are running in an emulated environment.
+# b/33214085 b/33814662 b/33791054 b/33211769
+# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
+# This will go away in a future Android release
+neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
+neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;
+
+# Untrusted apps are not allowed to use cgroups.
+neverallow all_untrusted_apps cgroup:file *;
+neverallow all_untrusted_apps cgroup_v2:file *;
+
+# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps
+# must not use it.
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+} mnt_sdcard_file:lnk_file *;
+
+# Only privileged apps may find the incident service
+neverallow all_untrusted_apps incident_service:service_manager find;
+
+# Only privileged apps may find stats service
+neverallow all_untrusted_apps stats_service:service_manager find;
+
+# Do not allow untrusted app to read hidden system proprerties.
+# We do not include in the exclusions other normally untrusted applications such as mediaprovider
+# due to the specific logging use cases.
+# Context: b/193912100
+neverallow {
+ all_untrusted_apps
+ -mediaprovider
+ -mediaprovider_app
+} { userdebug_or_eng_prop }:file read;
+
+# Do not allow untrusted app to access /dev/socket/mdnsd since U. The socket is
+# used to communicate to the mdnsd responder. The mdnsd responder will be
+# replaced by a java implementation which is integrated into the system server.
+# For untrusted apps running with API level 33-, they still have access to
+# /dev/socket/mdnsd for backward compatibility.
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} mdnsd_socket:sock_file write;
+neverallow {
+ all_untrusted_apps
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} mdnsd:unix_stream_socket connectto;
+
+# Do not allow untrusted apps to use anonymous inodes. At the moment,
+# type transitions are the only way to distinguish between different
+# anon_inode usages like userfaultfd and io_uring. This prevents us from
+# creating a more fine-grained neverallow policy for each anon_inode usage.
+neverallow all_untrusted_apps domain:anon_inode *;
+
+# Do not allow untrusted app access to hidraw devices.
+neverallow all_untrusted_apps hidraw_device:chr_file *;
diff --git a/prebuilts/api/202504/private/app_zygote.te b/prebuilts/api/202504/private/app_zygote.te
new file mode 100644
index 0000000..b51f633
--- /dev/null
+++ b/prebuilts/api/202504/private/app_zygote.te
@@ -0,0 +1,182 @@
+typeattribute app_zygote coredomain;
+
+######
+###### Policy below is different from regular zygote-spawned apps
+######
+
+# Allow access to temporary files, which is normally permitted through
+# a domain macro.
+tmpfs_domain(app_zygote);
+
+# Set the UID/GID of the process.
+# This will be further limited to a range of isolated UIDs with seccomp.
+allow app_zygote self:global_capability_class_set { setgid setuid };
+# Drop capabilities from bounding set.
+allow app_zygote self:global_capability_class_set setpcap;
+# Switch SELinux context to isolated app domain.
+allow app_zygote self:process setcurrent;
+allow app_zygote isolated_app:process dyntransition;
+
+# For JIT
+allow app_zygote self:process execmem;
+
+# Allow exec mapping from tmpfs (memfds) for binary translation
+allow app_zygote app_zygote_tmpfs:file execute;
+
+# Allow app_zygote to stat the files that it opens. It must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow app_zygote debugfs_trace_marker:file getattr;
+
+# get system_server process group
+allow app_zygote system_server:process getpgid;
+
+# Interaction between the app_zygote and its children.
+allow app_zygote isolated_app:process setpgid;
+
+# TODO (b/63631799) fix this access
+dontaudit app_zygote mnt_expand_file:dir getattr;
+
+# Get seapp_contexts
+allow app_zygote seapp_contexts_file:file r_file_perms;
+# Check validity of SELinux context before use.
+selinux_check_context(app_zygote)
+# Check SELinux permissions.
+selinux_check_access(app_zygote)
+
+# Read and inspect temporary files managed by zygote.
+allow app_zygote zygote_tmpfs:file { read getattr };
+
+######
+###### Policy below is shared with regular zygote-spawned apps
+######
+
+# Child of zygote.
+allow app_zygote zygote:fd use;
+allow app_zygote zygote:process sigchld;
+
+# For ART (read /data/dalvik-cache).
+r_dir_file(app_zygote, dalvikcache_data_file);
+allow app_zygote dalvikcache_data_file:file execute;
+
+# For ART (allow userfaultfd and related ioctls)
+userfaultfd_use(app_zygote)
+
+# Read /data/misc/apexdata/ to (get to com.android.art/dalvik-cache).
+allow app_zygote apex_module_data_file:dir search;
+# For ART APEX (read /data/misc/apexdata/com.android.art/dalvik-cache).
+r_dir_file(app_zygote, apex_art_data_file)
+
+# Allow reading/executing installed binaries to enable preloading
+# application data
+allow app_zygote apk_data_file:dir r_dir_perms;
+allow app_zygote apk_data_file:file { r_file_perms execute };
+
+# /oem accesses.
+allow app_zygote oemfs:dir search;
+
+# Allow app_zygote access to /vendor/overlay
+r_dir_file(app_zygote, vendor_overlay_file)
+# Allow app_zygote to read vendor_overlay_file from vendor apex as well
+allow app_zygote vendor_apex_metadata_file:dir { getattr search };
+
+allow app_zygote system_data_file:lnk_file r_file_perms;
+allow app_zygote system_data_file:file { getattr read map };
+
+# Send unsolicited message to system_server
+unix_socket_send(app_zygote, system_unsolzygote, system_server)
+
+# Allow the app_zygote to access the runtime feature flag properties.
+get_prop(app_zygote, device_config_runtime_native_prop)
+get_prop(app_zygote, device_config_runtime_native_boot_prop)
+
+# Allow app_zygote to access odsign verification status
+get_prop(app_zygote, odsign_prop)
+
+# /data/resource-cache
+allow app_zygote resourcecache_data_file:file r_file_perms;
+allow app_zygote resourcecache_data_file:dir r_dir_perms;
+
+#####
+##### Neverallow
+#####
+
+# Only permit transition to isolated_app.
+neverallow app_zygote { domain -isolated_app }:process dyntransition;
+
+# Only setcon() transitions, no exec() based transitions, except for crash_dump.
+neverallow app_zygote { domain -crash_dump }:process transition;
+
+# Must not exec() a program without changing domains.
+# Having said that, exec() above is not allowed.
+neverallow app_zygote *:file execute_no_trans;
+
+# The only way to enter this domain is for the zygote to fork a new
+# app_zygote child.
+neverallow { domain -zygote } app_zygote:process dyntransition;
+
+# Disallow write access to properties.
+neverallow app_zygote property_socket:sock_file write;
+neverallow app_zygote property_type:property_service set;
+
+# Should not have any access to data files.
+neverallow app_zygote app_data_file_type:file { rwx_file_perms };
+
+neverallow app_zygote {
+ service_manager_type
+ -activity_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps should not be able to access the driver directly.
+neverallow app_zygote gpu_device:chr_file { rwx_file_perms };
+
+# Do not allow app_zygote access to /cache.
+neverallow app_zygote cache_file:dir ~{ r_dir_perms };
+neverallow app_zygote cache_file:file ~{ read getattr };
+
+# Do not allow most socket access. This is socket_class_set, excluding unix_dgram_socket,
+# unix_stream_socket, and netlink_selinux_socket.
+neverallow app_zygote domain:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket
+ appletalk_socket netlink_route_socket netlink_tcpdiag_socket
+ netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
+ sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket
+ x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket
+ pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket
+ rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
+} *;
+
+# Only allow app_zygote to talk to the logd socket, and su on eng/userdebug.
+# This is because cap_setuid/cap_setgid allow to forge uid/gid in
+# SCM_CREDENTIALS. Think twice before changing.
+neverallow app_zygote {
+ domain
+ -app_zygote
+ -logd
+ -system_server
+ userdebug_or_eng(`-su')
+}:unix_dgram_socket *;
+
+neverallow app_zygote {
+ domain
+ -app_zygote
+ -prng_seeder
+ userdebug_or_eng(`-su')
+}:unix_stream_socket *;
+
+# Never allow ptrace
+neverallow app_zygote *:process ptrace;
+
+# Do not allow access to Bluetooth-related system properties.
+# neverallow rules for Bluetooth-related data files are listed above.
+neverallow app_zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file create_file_perms;
diff --git a/prebuilts/api/202504/private/art_boot.te b/prebuilts/api/202504/private/art_boot.te
new file mode 100644
index 0000000..0922931
--- /dev/null
+++ b/prebuilts/api/202504/private/art_boot.te
@@ -0,0 +1,13 @@
+# ART boot oneshot service
+type art_boot, domain, coredomain;
+type art_boot_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(art_boot)
+
+# Allow query of device config properties, typically experiment flags.
+get_prop(art_boot, device_config_runtime_native_boot_prop)
+get_prop(art_boot, device_config_runtime_native_prop)
+
+# Allow ART to set its config properties at boot, mainly to be able to propagate
+# experiment flags to properties that only may change at boot.
+set_prop(art_boot, dalvik_config_prop_type)
diff --git a/prebuilts/api/202504/private/art_exec.te b/prebuilts/api/202504/private/art_exec.te
new file mode 100644
index 0000000..7f944f6
--- /dev/null
+++ b/prebuilts/api/202504/private/art_exec.te
@@ -0,0 +1,22 @@
+# A wrapper program that configures the process and executes a command.
+type art_exec, domain, coredomain;
+type art_exec_exec, system_file_type, exec_type, file_type;
+
+# Usually, this program is executed in the caller's domain. For example, it is
+# executed in the `artd` domain when artd calls it. Domain transition will take
+# place as soon as it executes other programs.
+# The only exception is when called by init. In this case, it's executed in its
+# own domain because init should never execute a program without changing to
+# another domain.
+init_daemon_domain(art_exec)
+
+# init calls this program to execute artd in a chroot environment for Pre-reboot
+# Dexopt.
+domain_auto_trans(art_exec, artd_exec, artd)
+
+# "sys_chroot" is for chroot'ing into the chroot environment, created by
+# dexopt_chroot_setup.
+allow art_exec self:global_capability_class_set sys_chroot;
+
+# Allow finding artd in the chroot dir for Pre-reboot Dexopt.
+allow art_exec pre_reboot_dexopt_file:dir search;
diff --git a/prebuilts/api/202504/private/artd.te b/prebuilts/api/202504/private/artd.te
new file mode 100644
index 0000000..15d7969
--- /dev/null
+++ b/prebuilts/api/202504/private/artd.te
@@ -0,0 +1,201 @@
+# ART service daemon.
+typeattribute artd coredomain;
+typeattribute artd mlstrustedsubject;
+type artd_exec, system_file_type, exec_type, file_type;
+type artd_tmpfs, file_type;
+
+# All types of artd subprocesses, which artd can kill.
+attribute artd_subprocess_type;
+
+# Allow artd to publish a binder service and make binder calls.
+binder_use(artd)
+add_service(artd, artd_service)
+add_service(artd, artd_pre_reboot_service)
+allow artd dumpstate:fifo_file { getattr write };
+allow artd dumpstate:fd use;
+
+init_daemon_domain(artd)
+
+# Allow query ART device config properties
+get_prop(artd, device_config_runtime_native_prop)
+get_prop(artd, device_config_runtime_native_boot_prop)
+
+# Access to "odsign.verification.success" for deciding whether to deny files in
+# the ART APEX data directory.
+get_prop(artd, odsign_prop)
+
+# Reading an APK opens a ZipArchive, which unpack to tmpfs.
+# Use tmpfs_domain() which will give tmpfs files created by artd their
+# own label, which differs from other labels created by other processes.
+# This allows to distinguish in policy files created by artd vs other
+# processes.
+tmpfs_domain(artd)
+
+# Allow testing userfaultfd support.
+userfaultfd_use(artd)
+
+# Read access to primary dex'es on writable partitions
+# ({/data,/mnt/expand/<volume-uuid>}/app/...).
+# Also allow creating the "oat" directory before restorecon.
+allow artd mnt_expand_file:dir { getattr search };
+allow artd apk_data_file:dir { rw_dir_perms create setattr relabelfrom };
+allow artd apk_data_file:file r_file_perms;
+allow artd apk_tmp_file:dir { rw_dir_perms create setattr relabelfrom };
+allow artd apk_tmp_file:file r_file_perms;
+
+# Read access to vendor APKs ({/vendor,/odm}/{app,priv-app}/...).
+r_dir_file(artd, vendor_app_file)
+
+# Read access to vendor overlay APKs ({/vendor,/odm,/oem,/apex/*}/overlay/...).
+allow artd oemfs:dir { getattr search };
+r_dir_file(artd, vendor_overlay_file)
+# Vendor overlay can be found in vendor apex
+allow artd vendor_apex_metadata_file:dir { getattr search };
+
+# Read access to vendor shared libraries ({/vendor,/odm}/framework/...).
+r_dir_file(artd, vendor_framework_file)
+
+# Read/write access to all compilation artifacts generated on device for apps'
+# primary dex'es. (/data/dalvik-cache/..., /data/app/.../oat/..., etc.)
+allow artd dalvikcache_data_file:dir { create_dir_perms relabelto };
+allow artd dalvikcache_data_file:file { create_file_perms relabelto };
+
+# Read access to the ART APEX data directory.
+# Needed for reading the boot image generated on device.
+allow artd apex_module_data_file:dir { getattr search };
+r_dir_file(artd, apex_art_data_file)
+
+# Read access to /apex/apex-info-list.xml
+# Needed for getting APEX versions.
+allow artd apex_info_file:file r_file_perms;
+
+# Allow getting root capabilities to bypass permission checks.
+# - "dac_override" and "dac_read_search" are for
+# - reading secondary dex'es in app data directories (reading primary dex'es
+# doesn't need root capabilities)
+# - managing (CRUD) compilation artifacts in both APK directories for primary
+# dex'es and in app data directories for secondary dex'es
+# - managing (CRUD) profile files for both primary dex'es and secondary dex'es
+# - "fowner" is for adjusting the file permissions of compilation artifacts and
+# profile files based on whether they include user data or not.
+# - "chown" is for transferring the ownership of compilation artifacts and
+# profile files to the system or apps.
+allow artd self:global_capability_class_set { dac_override dac_read_search fowner chown };
+
+# Read/write access to profiles (/data/misc/profiles/{ref,cur}/...). Also allow
+# scanning /data/misc/profiles/cur, for cleaning up obsolete managed files.
+allow artd user_profile_root_file:dir r_dir_perms;
+allow artd user_profile_data_file:dir rw_dir_perms;
+allow artd user_profile_data_file:file create_file_perms;
+
+# Read/write access to secondary dex files, their profiles, and their
+# compilation artifacts
+# ({/data,/mnt/expand/<volume-uuid>}/{user,user_de}/<user-id>/<package-name>/...).
+allow artd app_data_file_type:dir { create_dir_perms relabelfrom relabelto };
+allow artd app_data_file_type:file { create_file_perms relabelfrom relabelto };
+
+# Allow symlinks for secondary dex files. This has be to restricted because
+# symlinks can cause various security issues. We allow "privapp_data_file" just
+# for GMS because so far we only see GMS using symlinks.
+allow artd privapp_data_file:lnk_file { getattr read };
+
+# Read access to SELinux context files, for restorecon.
+allow artd file_contexts_file:file r_file_perms;
+allow artd seapp_contexts_file:file r_file_perms;
+
+# Check validity of SELinux context, for restorecon.
+selinux_check_context(artd)
+
+# Allow scanning /, for cleaning up obsolete managed files.
+allow artd rootfs:dir r_dir_perms;
+
+# Allow scanning /data, for cleaning up obsolete managed files.
+allow artd system_data_root_file:dir r_dir_perms;
+
+# Allow scanning /mnt, for cleaning up obsolete managed files.
+allow artd tmpfs:dir r_dir_perms;
+
+# Allow scanning /mnt/expand, for cleaning up obsolete managed files.
+allow artd mnt_expand_file:dir r_dir_perms;
+
+# Allow scanning {/data,/mnt/expand/<volume-uuid>}/{user,user_de}, for cleaning
+# up obsolete managed files.
+allow artd system_userdir_file:dir r_dir_perms;
+
+# Allow scanning {/data,/mnt/expand/<volume-uuid>}/{user,user_de}/<user-id> and
+# /mnt/expand/<volume-uuid>, for cleaning up obsolete managed files.
+allow artd system_data_file:dir r_dir_perms;
+
+# Allow art_exec_exec to use the artd domain because it is a thin wrapper that
+# executes other binaries on behalf of artd. Domain transition will take place
+# as soon as art_exec_exec executes other binaries.
+allow artd art_exec_exec:file rx_file_perms;
+
+# Allow running other binaries in their own domains.
+domain_auto_trans(artd, profman_exec, profman)
+domain_auto_trans(artd, dex2oat_exec, dex2oat)
+
+# Allow sending sigkill to subprocesses.
+allow artd artd_subprocess_type:process sigkill;
+
+# Allow reading process info (/proc/<pid>/...).
+# This is needed for getting CPU time and wall time spent on subprocesses.
+r_dir_file(artd, profman);
+r_dir_file(artd, dex2oat);
+
+# Allow artd to reopen its own memfd.
+# artd needs to reopen a memfd with readonly in order to pass it to subprocesses
+# that don't have write permissions on memfds.
+allow artd artd_tmpfs:file open;
+
+# For Pre-reboot Dexopt.
+
+# Allow init to execute artd through art_exec.
+allow artd art_exec:fd use;
+
+# During Pre-reboot Dexopt, artd needs one more capability:
+# - "sys_admin" is for bind-mounting temp dirs at
+# /data/misc/apexdata/com.android.art and /data/misc/odrefresh, to run
+# odrefresh innocuously (in a way that doesn't affect the real boot images,
+# metrics, etc.).
+allow artd self:global_capability_class_set sys_admin;
+
+# Allow running other binaries in their own domains.
+domain_auto_trans(artd, derive_classpath_exec, derive_classpath)
+domain_auto_trans(artd, odrefresh_exec, odrefresh)
+
+# Allow accessing Pre-reboot Dexopt files.
+allow artd pre_reboot_dexopt_file:dir { getattr search };
+
+# Allow reading /init.environ.rc in chroot, to extract env vars from it.
+allow artd rootfs:file { read open getattr };
+
+# Allow managing Pre-reboot Dexopt temp files.
+# The root of the temp dir that artd uses during Pre-reboot Dexopt is labeled
+# pre_reboot_dexopt_artd_file. Inside the temp dir, we create files and dirs and
+# relabel them after creation, so we need relabelfrom.
+allow artd pre_reboot_dexopt_artd_file:dir { create_dir_perms relabelfrom };
+allow artd pre_reboot_dexopt_artd_file:file { create_file_perms relabelfrom };
+
+# Allow bind-mounting at /data/misc/apexdata/com.android.art and
+# /data/misc/odrefresh and restorecon, to run odrefresh innocuously.
+allow artd { apex_art_data_file odrefresh_data_file }:dir relabelto;
+allow artd { apex_art_data_file odrefresh_data_file pre_reboot_dexopt_artd_file }:dir mounton;
+
+# Neverallow rules.
+
+# Never allow running other binaries without a domain transition.
+# The exception for art_exec_exec is explained above.
+neverallow artd ~{art_exec_exec}:file execute_no_trans;
+
+# Make sure artd_subprocess_type is complete, in a sense that it includes all
+# types of artd subprocesses.
+neverallow artd ~{artd_subprocess_type crash_dump}:process transition;
+
+# artd uses process groups to manage subprocesses and kill them. To ensure
+# successful kill, we need to prevent subprocesses from changing their
+# process groups or transitioning to other domains.
+# Transitioning crash_dump is allowed because it is transient and is only used
+# upon crashes.
+neverallow artd_subprocess_type self:process setpgid;
+neverallow artd_subprocess_type ~{artd_subprocess_type crash_dump}:process transition;
diff --git a/prebuilts/api/202504/private/asan_extract.te b/prebuilts/api/202504/private/asan_extract.te
new file mode 100644
index 0000000..8c8980c
--- /dev/null
+++ b/prebuilts/api/202504/private/asan_extract.te
@@ -0,0 +1,35 @@
+# type_transition must be private policy the domain_trans rules could stay
+# public, but conceptually should go with this
+# Technically not a daemon but we do want the transition from init domain to
+# asan_extract to occur.
+with_asan(`
+ typeattribute asan_extract coredomain;
+ init_daemon_domain(asan_extract)
+
+ # We need to signal a reboot when done.
+ set_prop(asan_extract, powerctl_prop)
+
+ # Allow asan_extract to execute itself using #!/system/bin/sh
+ allow asan_extract shell_exec:file rx_file_perms;
+
+ # We execute log, rm, gzip and tar.
+ allow asan_extract toolbox_exec:file rx_file_perms;
+ allow asan_extract system_file:file execute_no_trans;
+
+ # asan_extract deletes old /data/lib.
+ allow asan_extract system_file:dir { open read remove_name rmdir write };
+ allow asan_extract system_file:file unlink;
+
+ # asan_extract untars ASAN libraries into /data.
+ allow asan_extract system_data_file:dir create_dir_perms ;
+ allow asan_extract system_data_file:{ file lnk_file } create_file_perms ;
+
+ # Relabel the libraries with restorecon.
+ allow asan_extract file_contexts_file:file r_file_perms;
+ allow asan_extract system_data_file:{ dir file } relabelfrom;
+ allow asan_extract system_file:dir { relabelto setattr };
+ allow asan_extract system_file:file relabelto;
+
+ # Restorecon will actually already try to run with sanitized libraries (libpackagelistparser).
+ allow asan_extract system_data_file:file execute;
+')
diff --git a/prebuilts/api/202504/private/atrace.te b/prebuilts/api/202504/private/atrace.te
new file mode 100644
index 0000000..1712648
--- /dev/null
+++ b/prebuilts/api/202504/private/atrace.te
@@ -0,0 +1,81 @@
+# Domain for atrace process.
+# It is spawned either by traced_probes or by init for the boottrace service.
+
+type atrace_exec, exec_type, file_type, system_file_type;
+
+# boottrace services uses /data/misc/boottrace/categories
+allow atrace boottrace_data_file:dir search;
+allow atrace boottrace_data_file:file r_file_perms;
+
+# Allow atrace to access tracefs.
+allow atrace debugfs_tracing:dir r_dir_perms;
+allow atrace debugfs_tracing:file rw_file_perms;
+allow atrace debugfs_trace_marker:file getattr;
+
+# Allow atrace to write data when a pipe is used for stdout/stderr.
+# This is used by Perfetto to capture atrace stdout/stderr.
+allow atrace traced_probes:fd use;
+allow atrace traced_probes:fifo_file { getattr write };
+
+# atrace sets debug.atrace.* properties
+set_prop(atrace, debug_prop)
+
+# atrace pokes all the binder-enabled processes at startup with a
+# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
+
+# Allow discovery of binder services.
+allow atrace {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -dumpstate_service
+ -incident_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -stats_service
+ -tracingproxy_service
+ -vold_service
+ -default_android_service
+}:service_manager { find };
+allow atrace servicemanager:service_manager list;
+
+# Allow notifying the processes hosting specific binder services that
+# trace-related system properties have changed.
+binder_use(atrace)
+allow atrace surfaceflinger:binder call;
+allow atrace system_server:binder call;
+allow atrace cameraserver:binder call;
+
+# Similarly, on debug builds, allow specific HALs to be notified that
+# trace-related system properties have changed.
+userdebug_or_eng(`
+ # List HAL interfaces.
+ allow atrace hwservicemanager:hwservice_manager list;
+ # Notify the camera HAL.
+ hal_client_domain(atrace, hal_camera)
+ hal_client_domain(atrace, hal_vibrator)
+')
+
+# Remove logspam from notification attempts to non-allowlisted services.
+dontaudit atrace hwservice_manager_type:hwservice_manager find;
+dontaudit atrace service_manager_type:service_manager find;
+dontaudit atrace domain:binder call;
+
+# atrace can call atrace HAL
+hal_client_domain(atrace, hal_atrace)
+
+get_prop(atrace, hwservicemanager_prop)
+
+userdebug_or_eng(`
+ # atrace is generally invoked as a standalone binary from shell or perf
+ # daemons like Perfetto traced_probes. However, in userdebug builds, there is
+ # a further option to run atrace as an init daemon for boot tracing.
+ init_daemon_domain(atrace)
+
+ allow atrace debugfs_tracing_debug:dir r_dir_perms;
+ allow atrace debugfs_tracing_debug:file rw_file_perms;
+')
+
+dontaudit atrace debugfs_tracing_debug:file audit_access;
diff --git a/prebuilts/api/202504/private/attributes b/prebuilts/api/202504/private/attributes
new file mode 100644
index 0000000..4f59acf
--- /dev/null
+++ b/prebuilts/api/202504/private/attributes
@@ -0,0 +1,42 @@
+hal_attribute(lazy_test);
+
+# This is applied to apps on vendor images with SDK <=30 only,
+# to exempt them from recent mls changes. It must not be applied
+# to any domain on newer system or vendor image.
+attribute mlsvendorcompat;
+
+# Attributes for property types having both system_property_type
+# and vendor_property_type. Such types are ill-formed because
+# property owner attributes must be exclusive.
+attribute system_and_vendor_property_type;
+expandattribute system_and_vendor_property_type false;
+
+# HALs
+until_board_api(202504, `
+ hal_attribute(mediaquality);
+')
+
+until_board_api(202504, `
+attribute unconstrained_vsock_violators;
+expandattribute unconstrained_vsock_violators false;
+')
+
+# All SDK sandbox domains
+attribute sdk_sandbox_all;
+# The SDK sandbox domains for the current SDK level.
+attribute sdk_sandbox_current;
+# Common to adbd and adbd_tradeinmode.
+attribute adbd_common;
+
+# Provides access to platform update services.
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+attribute update_provider;
+expandattribute update_provider false;
+
+until_board_api(202504, `
+ attribute tee_service_type;
+')
+
+until_board_api(202504, `
+ hal_attribute(vm_capabilities);
+')
diff --git a/prebuilts/api/202504/private/audioserver.te b/prebuilts/api/202504/private/audioserver.te
new file mode 100644
index 0000000..5aa8dde
--- /dev/null
+++ b/prebuilts/api/202504/private/audioserver.te
@@ -0,0 +1,115 @@
+# audioserver - audio services daemon
+type audioserver_exec, exec_type, file_type, system_file_type;
+typeattribute audioserver coredomain;
+
+init_daemon_domain(audioserver)
+tmpfs_domain(audioserver)
+
+r_dir_file(audioserver, sdcard_type)
+r_dir_file(audioserver, fuse)
+
+binder_use(audioserver)
+binder_call(audioserver, binderservicedomain)
+binder_call(audioserver, appdomain)
+binder_service(audioserver)
+
+hal_client_domain(audioserver, hal_allocator)
+# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
+r_dir_file(audioserver, system_file)
+
+hal_client_domain(audioserver, hal_audio)
+
+userdebug_or_eng(`
+ # used for TEE sink - pcm capture for debug.
+ allow audioserver media_data_file:dir create_dir_perms;
+ allow audioserver audioserver_data_file:dir create_dir_perms;
+ allow audioserver audioserver_data_file:file create_file_perms;
+
+ # ptrace to processes in the same domain for memory leak detection
+ allow audioserver self:process ptrace;
+')
+
+add_service(audioserver, audioserver_service)
+allow audioserver activity_service:service_manager find;
+allow audioserver appops_service:service_manager find;
+allow audioserver batterystats_service:service_manager find;
+allow audioserver external_vibrator_service:service_manager find;
+allow audioserver package_native_service:service_manager find;
+allow audioserver permission_service:service_manager find;
+allow audioserver permission_checker_service:service_manager find;
+allow audioserver power_service:service_manager find;
+allow audioserver scheduling_policy_service:service_manager find;
+allow audioserver mediametrics_service:service_manager find;
+allow audioserver sensor_privacy_service:service_manager find;
+allow audioserver soundtrigger_middleware_service:service_manager find;
+allow audioserver audio_service:service_manager find;
+allow audioserver virtual_device_native_service:service_manager find;
+
+# Allow read/write access to bluetooth-specific properties
+set_prop(audioserver, bluetooth_a2dp_offload_prop)
+set_prop(audioserver, bluetooth_audio_hal_prop)
+set_prop(audioserver, bluetooth_prop)
+set_prop(audioserver, exported_bluetooth_prop)
+
+# Grant access to audio files to audioserver
+allow audioserver audio_data_file:dir ra_dir_perms;
+allow audioserver audio_data_file:file create_file_perms;
+
+# allow access to ALSA MMAP FDs for AAudio API
+allow audioserver audio_device:chr_file { read write };
+
+not_full_treble(`allow audioserver audio_device:dir r_dir_perms;')
+not_full_treble(`allow audioserver audio_device:chr_file rw_file_perms;')
+
+# For A2DP bridge which is loaded directly into audioserver
+unix_socket_connect(audioserver, bluetooth, bluetooth)
+
+# Allow shell commands from ADB and shell for CTS testing/dumping
+allow audioserver adbd:fd use;
+allow audioserver adbd:unix_stream_socket { read write };
+allow audioserver shell:fifo_file { read write };
+
+# Allow shell commands from ADB for CTS testing/dumping
+userdebug_or_eng(`
+ allow audioserver su:fd use;
+ allow audioserver su:fifo_file { read write };
+ allow audioserver su:unix_stream_socket { read write };
+')
+
+# Allow write access to log tag property
+set_prop(audioserver, log_tag_prop);
+
+# Allow audioserver to signal audio HAL processes and dump their stacks.
+allow audioserver hal_audio_server:process signal;
+
+# Allow audioserver to access sensorservice.
+allow audioserver sensorservice_service:service_manager find;
+allow audioserver system_server:unix_stream_socket { read write };
+
+# Allow using wake locks
+wakelock_use(audioserver)
+
+# Allow reading audio config props, e.g. af.fast_track_multiplier
+get_prop(audioserver, audio_config_prop)
+get_prop(audioserver, system_audio_config_prop)
+
+###
+### neverallow rules
+###
+
+# audioserver should never execute any executable without a
+# domain transition
+neverallow audioserver { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow audioserver domain:{ udp_socket rawip_socket } *;
+neverallow audioserver { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/auditctl.te b/prebuilts/api/202504/private/auditctl.te
new file mode 100644
index 0000000..f634d3d
--- /dev/null
+++ b/prebuilts/api/202504/private/auditctl.te
@@ -0,0 +1,18 @@
+#
+# /system/bin/auditctl executed for logd
+#
+# Performs maintenance of the kernel auditing system, including
+# setting rate limits on SELinux denials.
+#
+
+type auditctl, domain, coredomain;
+type auditctl_exec, file_type, system_file_type, exec_type;
+
+# Uncomment the line below to put this domain into permissive
+# mode. This helps speed SELinux policy development.
+# userdebug_or_eng(`permissive auditctl;')
+
+init_daemon_domain(auditctl)
+
+allow auditctl self:global_capability_class_set audit_control;
+allow auditctl self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write };
diff --git a/prebuilts/api/202504/private/automotive_display_service.te b/prebuilts/api/202504/private/automotive_display_service.te
new file mode 100644
index 0000000..db20696
--- /dev/null
+++ b/prebuilts/api/202504/private/automotive_display_service.te
@@ -0,0 +1,44 @@
+# Display proxy service for Automotive
+type automotive_display_service, domain, coredomain;
+type automotive_display_service_exec, system_file_type, exec_type, file_type;
+
+typeattribute automotive_display_service automotive_display_service_server;
+
+# Allow to add a display service to the hwservicemanager
+add_hwservice(automotive_display_service, fwk_automotive_display_hwservice);
+
+# Allow init to launch automotive display service
+init_daemon_domain(automotive_display_service)
+
+# Allow to use Binder IPC for SurfaceFlinger.
+binder_use(automotive_display_service)
+
+# Allow to use HwBinder IPC for HAL implementations.
+hwbinder_use(automotive_display_service)
+hal_client_domain(automotive_display_service, hal_graphics_composer)
+hal_client_domain(automotive_display_service, hal_graphics_allocator)
+
+# Allow to read the target property.
+get_prop(automotive_display_service, hwservicemanager_prop)
+
+# Allow to find SurfaceFlinger.
+allow automotive_display_service surfaceflinger_service:service_manager find;
+
+# Allow client domain to do binder IPC to serverdomain.
+binder_call(automotive_display_service, surfaceflinger)
+
+# Allow to use a graphics mapper
+allow automotive_display_service hal_graphics_mapper_hwservice:hwservice_manager find;
+
+# Allow to use hidl token service
+allow automotive_display_service hidl_token_hwservice:hwservice_manager find;
+
+# Allow to access EGL files
+allow automotive_display_service gpu_device:chr_file rw_file_perms;
+allow automotive_display_service gpu_device:dir search;
+
+# Allow to add a service to the servicemanager
+add_service(automotive_display_service, fwk_automotive_display_service);
+
+# Allow to communicate with EVS services
+binder_call(automotive_display_service, hal_evs)
diff --git a/prebuilts/api/202504/private/bert_collector.te b/prebuilts/api/202504/private/bert_collector.te
new file mode 100644
index 0000000..b11bd76
--- /dev/null
+++ b/prebuilts/api/202504/private/bert_collector.te
@@ -0,0 +1,12 @@
+type bert_collector, domain, coredomain;
+type bert_collector_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(bert_collector)
+
+r_dir_file(bert_collector, sysfs_firmware_acpi_tables)
+
+binder_use(bert_collector)
+binder_call(bert_collector, system_server)
+
+allow bert_collector dropbox_service:service_manager find;
+allow bert_collector proc_version:file r_file_perms;
diff --git a/prebuilts/api/202504/private/binderservicedomain.te b/prebuilts/api/202504/private/binderservicedomain.te
new file mode 100644
index 0000000..b8ae9f4
--- /dev/null
+++ b/prebuilts/api/202504/private/binderservicedomain.te
@@ -0,0 +1,25 @@
+# Rules common to some specific binder service domains.
+# Deprecated. Consider granting the exact permissions required by your service.
+
+# Allow dumpstate and incidentd to collect information from binder services
+allow binderservicedomain { dumpstate incidentd }:fd use;
+allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
+allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write };
+allow binderservicedomain shell_data_file:file { getattr write };
+
+# Allow dumpsys to work from adb shell or the serial console
+allow binderservicedomain devpts:chr_file rw_file_perms;
+allow binderservicedomain console_device:chr_file rw_file_perms;
+
+# Receive and write to a pipe received over Binder from an app.
+allow binderservicedomain appdomain:fd use;
+allow binderservicedomain appdomain:fifo_file write;
+
+# allow all services to run permission checks
+allow binderservicedomain permission_service:service_manager find;
+
+allow binderservicedomain keystore:keystore2_key { delete get_info rebind use };
+
+use_keystore(binderservicedomain)
+# binderservicedomain is using apex_info via libvintf
+use_apex_info(binderservicedomain)
diff --git a/prebuilts/api/202504/private/blank_screen.te b/prebuilts/api/202504/private/blank_screen.te
new file mode 100644
index 0000000..20d50cc
--- /dev/null
+++ b/prebuilts/api/202504/private/blank_screen.te
@@ -0,0 +1,7 @@
+type blank_screen, domain, coredomain;
+type blank_screen_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(blank_screen)
+
+# hal_light_client has access to hal_light_server
+hal_client_domain(blank_screen, hal_light)
diff --git a/prebuilts/api/202504/private/blkid.te b/prebuilts/api/202504/private/blkid.te
new file mode 100644
index 0000000..4e972ab
--- /dev/null
+++ b/prebuilts/api/202504/private/blkid.te
@@ -0,0 +1,22 @@
+# blkid called from vold
+
+typeattribute blkid coredomain;
+
+type blkid_exec, system_file_type, exec_type, file_type;
+
+# Allowed read-only access to encrypted devices to extract UUID/label
+allow blkid block_device:dir search;
+allow blkid userdata_block_device:blk_file r_file_perms;
+allow blkid dm_device:blk_file r_file_perms;
+
+# Allow stdin/out back to vold
+allow blkid vold:fd use;
+allow blkid vold:fifo_file { read write getattr };
+
+# For blkid launched through popen()
+allow blkid blkid_exec:file rx_file_perms;
+
+# Only allow entry from vold
+neverallow { domain -vold } blkid:process transition;
+neverallow * blkid:process dyntransition;
+neverallow blkid { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
diff --git a/prebuilts/api/202504/private/blkid_untrusted.te b/prebuilts/api/202504/private/blkid_untrusted.te
new file mode 100644
index 0000000..1256771
--- /dev/null
+++ b/prebuilts/api/202504/private/blkid_untrusted.te
@@ -0,0 +1,37 @@
+# blkid for untrusted block devices
+
+typeattribute blkid_untrusted coredomain;
+
+# Allowed read-only access to vold block devices to extract UUID/label
+allow blkid_untrusted block_device:dir search;
+allow blkid_untrusted vold_device:blk_file r_file_perms;
+
+# Allow stdin/out back to vold
+allow blkid_untrusted vold:fd use;
+allow blkid_untrusted vold:fifo_file { read write getattr };
+
+# For blkid launched through popen()
+allow blkid_untrusted blkid_exec:file rx_file_perms;
+
+###
+### neverallow rules
+###
+
+# Untrusted blkid should never be run on block devices holding sensitive data
+neverallow blkid_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file no_rw_file_perms;
+
+# Only allow entry from vold via blkid binary
+neverallow { domain -vold } blkid_untrusted:process transition;
+neverallow * blkid_untrusted:process dyntransition;
+neverallow blkid_untrusted { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
diff --git a/prebuilts/api/202504/private/bluetooth.te b/prebuilts/api/202504/private/bluetooth.te
new file mode 100644
index 0000000..0b001e2
--- /dev/null
+++ b/prebuilts/api/202504/private/bluetooth.te
@@ -0,0 +1,98 @@
+# bluetooth app
+
+typeattribute bluetooth coredomain, mlstrustedsubject;
+
+app_domain(bluetooth)
+net_domain(bluetooth)
+
+# Socket creation under /data/misc/bluedroid.
+type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
+
+# Allow access to net_admin ioctls
+allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
+
+wakelock_use(bluetooth);
+
+# Data file accesses.
+allow bluetooth bluetooth_data_file:dir create_dir_perms;
+allow bluetooth bluetooth_data_file:notdevfile_class_set { create_file_perms link };
+allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
+allow bluetooth bluetooth_logs_data_file:file create_file_perms;
+
+# Socket creation under /data/misc/bluedroid.
+allow bluetooth bluetooth_socket:sock_file create_file_perms;
+
+allow bluetooth self:global_capability_class_set net_admin;
+allow bluetooth self:global_capability2_class_set wake_alarm;
+
+# tethering
+allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
+allow bluetooth self:global_capability_class_set { net_admin net_raw net_bind_service };
+allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
+allow bluetooth tun_device:chr_file rw_file_perms;
+allowxperm bluetooth tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
+allow bluetooth efs_file:dir search;
+
+# allow Bluetooth to access uhid device for HID profile
+allow bluetooth uhid_device:chr_file rw_file_perms;
+
+allow bluetooth gpu_device:chr_file rw_file_perms;
+allow bluetooth gpu_device:dir r_dir_perms;
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;
+
+# For Bluetooth to check what profile are available
+allow bluetooth proc_filesystems:file r_file_perms;
+get_prop(bluetooth, incremental_prop)
+
+# For Bluetooth to check security logging state
+get_prop(bluetooth, device_logging_prop)
+
+# Allow write access to bluetooth specific properties
+set_prop(bluetooth, binder_cache_bluetooth_server_prop);
+neverallow { domain -bluetooth -init }
+ binder_cache_bluetooth_server_prop:property_service set;
+set_prop(bluetooth, bluetooth_a2dp_offload_prop)
+set_prop(bluetooth, bluetooth_audio_hal_prop)
+set_prop(bluetooth, bluetooth_prop)
+set_prop(bluetooth, exported_bluetooth_prop)
+set_prop(bluetooth, pan_result_prop)
+
+allow bluetooth audioserver_service:service_manager find;
+allow bluetooth bluetooth_service:service_manager find;
+allow bluetooth drmserver_service:service_manager find;
+allow bluetooth mediaserver_service:service_manager find;
+allow bluetooth radio_service:service_manager find;
+allow bluetooth app_api_service:service_manager find;
+allow bluetooth system_api_service:service_manager find;
+allow bluetooth network_stack_service:service_manager find;
+allow bluetooth system_suspend_control_service:service_manager find;
+allow bluetooth hal_audio_service:service_manager find;
+
+# already open bugreport file descriptors may be shared with
+# the bluetooth process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow bluetooth shell_data_file:file read;
+
+# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
+allow bluetooth self:global_capability_class_set sys_nice;
+
+hal_client_domain(bluetooth, hal_bluetooth)
+hal_client_domain(bluetooth, hal_telephony)
+
+# Bluetooth A2DP offload requires binding with audio HAL
+hal_client_domain(bluetooth, hal_audio)
+
+read_runtime_log_tags(bluetooth)
+
+###
+### Neverallow rules
+###
+### These are things that the bluetooth app should NEVER be able to do
+###
+
+# Superuser capabilities.
+# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
+neverallow bluetooth self:global_capability_class_set ~{ net_admin net_raw net_bind_service sys_nice};
+neverallow bluetooth self:global_capability2_class_set ~{ wake_alarm block_suspend };
diff --git a/prebuilts/api/202504/private/bluetoothdomain.te b/prebuilts/api/202504/private/bluetoothdomain.te
new file mode 100644
index 0000000..fe4f0e6
--- /dev/null
+++ b/prebuilts/api/202504/private/bluetoothdomain.te
@@ -0,0 +1,2 @@
+# Allow clients to use a socket provided by the bluetooth app.
+allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };
diff --git a/prebuilts/api/202504/private/bootanim.te b/prebuilts/api/202504/private/bootanim.te
new file mode 100644
index 0000000..fd3a09b
--- /dev/null
+++ b/prebuilts/api/202504/private/bootanim.te
@@ -0,0 +1,69 @@
+typeattribute bootanim coredomain;
+
+init_daemon_domain(bootanim)
+
+# b/68864350
+dontaudit bootanim unlabeled:dir search;
+
+# Bootanim should not be reading default vendor-defined properties.
+dontaudit bootanim vendor_default_prop:file read;
+
+# Read ro.boot.bootreason b/30654343
+get_prop(bootanim, bootloader_boot_reason_prop)
+
+get_prop(bootanim, bootanim_config_prop)
+
+# Allow updating boot animation status.
+set_prop(bootanim, bootanim_system_prop)
+
+# Allow accessing /data/misc/bootanim
+r_dir_file(bootanim, bootanim_data_file)
+
+# Allow accessing vendor apex for EGL/GLES
+allow bootanim vendor_apex_metadata_file:dir r_dir_perms;
+
+hal_client_domain(bootanim, hal_configstore)
+hal_client_domain(bootanim, hal_graphics_allocator)
+hal_client_domain(bootanim, hal_graphics_composer)
+
+binder_use(bootanim)
+binder_call(bootanim, surfaceflinger)
+binder_call(bootanim, audioserver)
+
+hwbinder_use(bootanim)
+
+allow bootanim gpu_device:chr_file rw_file_perms;
+allow bootanim gpu_device:dir r_dir_perms;
+allow bootanim sysfs_gpu:file r_file_perms;
+
+# /oem access
+allow bootanim oemfs:dir r_dir_perms;
+# boot animations on oem are stored with specific label
+allow bootanim bootanim_oem_file:file r_file_perms;
+
+allow bootanim audio_device:dir r_dir_perms;
+allow bootanim audio_device:chr_file rw_file_perms;
+
+allow bootanim audioserver_service:service_manager find;
+allow bootanim surfaceflinger_service:service_manager find;
+allow bootanim surfaceflinger:unix_stream_socket { read write };
+
+# Allow access to ion memory allocation device
+allow bootanim ion_device:chr_file rw_file_perms;
+
+# Allow access to DMA-BUF system heap
+allow bootanim dmabuf_system_heap_device:chr_file r_file_perms;
+
+allow bootanim hal_graphics_allocator:fd use;
+
+# Fences
+allow bootanim hal_graphics_composer:fd use;
+
+# Read access to pseudo filesystems.
+allow bootanim proc_meminfo:file r_file_perms;
+
+# System file accesses.
+allow bootanim system_file:dir r_dir_perms;
+
+# Allow bootanim to send information to statsd socket.
+unix_socket_send(bootanim, statsdw, statsd)
\ No newline at end of file
diff --git a/prebuilts/api/202504/private/bootstat.te b/prebuilts/api/202504/private/bootstat.te
new file mode 100644
index 0000000..9835940
--- /dev/null
+++ b/prebuilts/api/202504/private/bootstat.te
@@ -0,0 +1,68 @@
+typeattribute bootstat coredomain;
+
+init_daemon_domain(bootstat)
+
+# Collect metrics on boot time created by init
+get_prop(bootstat, boottime_prop)
+
+# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty)
+set_prop(bootstat, bootloader_boot_reason_prop)
+set_prop(bootstat, system_boot_reason_prop)
+set_prop(bootstat, last_boot_reason_prop)
+
+read_runtime_log_tags(bootstat)
+
+# Allow persistent storage in /data/misc/bootstat.
+allow bootstat bootstat_data_file:dir rw_dir_perms;
+allow bootstat bootstat_data_file:file create_file_perms;
+
+allow bootstat metadata_file:dir search;
+allow bootstat metadata_bootstat_file:dir rw_dir_perms;
+allow bootstat metadata_bootstat_file:file create_file_perms;
+
+# ToDo: TBI move access for the following to a system health HAL
+
+# Allow access to /sys/fs/pstore/ and syslog
+allow bootstat pstorefs:dir search;
+allow bootstat pstorefs:file r_file_perms;
+allow bootstat kernel:system syslog_read;
+
+# Allow access to reading the logs to read aspects of system health
+read_logd(bootstat)
+
+# Allow bootstat write to statsd.
+unix_socket_send(bootstat, statsdw, statsd)
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -bootstat
+ -init
+} system_boot_reason_prop:property_service set;
+
+neverallow {
+ domain
+ -bootanim
+ -bootstat
+ -dumpstate
+ userdebug_or_eng(`-incidentd')
+ -init
+ -platform_app
+ -recovery
+ -shell
+ -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:file r_file_perms;
+# ... and refine, as these components should not set the last boot reason
+neverallow { bootanim recovery } last_boot_reason_prop:file r_file_perms;
+
+neverallow {
+ domain
+ -bootstat
+ -init
+ -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set;
+# ... and refine ... for a ro propertly no less ... keep this _tight_
+neverallow system_server bootloader_boot_reason_prop:property_service set;
diff --git a/prebuilts/api/202504/private/boringssl_self_test.te b/prebuilts/api/202504/private/boringssl_self_test.te
new file mode 100644
index 0000000..50fc1fc
--- /dev/null
+++ b/prebuilts/api/202504/private/boringssl_self_test.te
@@ -0,0 +1,74 @@
+# System and vendor domains for BoringSSL self test binaries.
+#
+# For FIPS compliance, all processes linked against libcrypto perform a startup
+# self test which computes a hash of the BoringSSL Crypto Module (BCM) and, at least once
+# per device boot, also run a series of Known Answer Tests (KAT) to verify functionality.
+#
+# The KATs are expensive, and to ensure they are run as few times as possible, they
+# are skipped if a marker file exists in /dev/boringssl/selftest whose name is
+# the hash of the BCM that was computed earlier. The files are zero length and their contents
+# should never be read or written. To avoid giving arbitrary processes access to /dev/boringssl
+# to create these marker files, there are dedicated self test binaries which this policy
+# gives access to and which are run during early-init.
+#
+# Due to build skew, the version of libcrypto in /vendor may have a different hash than
+# the system one. To cater for this there are vendor variants of the self test binaries
+# which also have permission to write to the same files in /dev/boringssl. In the case where
+# vendor and system libcrypto have the same hash, there will be a race to create the file,
+# but this is harmless.
+#
+# If the self tests fail, then the device should reboot into firmware and for this reason
+# the system boringssl_self_test domain needs to be in coredomain. As vendor domains
+# are not allowed in coredomain, this means that the vendor self tests cannot trigger a
+# reboot. However every binary linked against the vendor libcrypto will abort on startup,
+# so in practice the device will crash anyway in this unlikely scenario.
+
+# System boringssl_self_test domain
+type boringssl_self_test, domain, coredomain;
+type boringssl_self_test_exec, system_file_type, exec_type, file_type;
+
+# Vendor boringssl_self_test domain
+type vendor_boringssl_self_test, domain;
+type vendor_boringssl_self_test_exec, vendor_file_type, exec_type, file_type;
+
+# Switch to boringssl_self_test security domain when running boringssl_self_test_exec
+init_daemon_domain(boringssl_self_test)
+
+# Switch to vendor_boringssl_self_test security domain when running vendor_boringssl_self_test_exec
+init_daemon_domain(vendor_boringssl_self_test)
+
+# Marker files, common to both domains, indicating KAT have been performed on a particular libcrypto
+#
+# The files are zero length so there is no issue if both vendor and system code
+# try to create the same file simultaneously. One will succeed and the other will fail
+# silently, i.e. still indicate success. Similar harmless naming collisions will happen in the
+# system domain e.g. when system and APEX copies of libcrypto are identical.
+type boringssl_self_test_marker, file_type;
+
+# Allow self test binaries to create/check for the existence of boringssl_self_test_marker files
+allow { boringssl_self_test vendor_boringssl_self_test }
+ boringssl_self_test_marker:file create_file_perms;
+allow { boringssl_self_test vendor_boringssl_self_test }
+ boringssl_self_test_marker:dir ra_dir_perms;
+
+# Allow self test binaries to write their stdout/stderr messages to kmsg_debug
+allow { boringssl_self_test vendor_boringssl_self_test }
+ kmsg_debug_device:chr_file { w_file_perms getattr ioctl };
+
+# No other process should be able to create marker files because their existence causes the
+# boringssl KAT to be skipped.
+neverallow {
+ domain
+ -vendor_boringssl_self_test
+ -boringssl_self_test
+ -init
+ -vendor_init
+} boringssl_self_test_marker:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -vendor_boringssl_self_test
+ -boringssl_self_test
+ -init
+ -vendor_init
+} boringssl_self_test_marker:dir write;
diff --git a/prebuilts/api/202504/private/bpfdomain.te b/prebuilts/api/202504/private/bpfdomain.te
new file mode 100644
index 0000000..7c8f5c0
--- /dev/null
+++ b/prebuilts/api/202504/private/bpfdomain.te
@@ -0,0 +1,25 @@
+# platform should have ownership of network attachpoints for BPF
+neverallow {
+ bpfdomain
+ -bpfloader
+ -netd
+ -netutils_wrapper
+ -network_stack
+ -system_server
+} self:global_capability_class_set { net_admin net_raw };
+
+# any domain which uses bpf is a bpfdomain
+neverallow { domain -bpfdomain } *:bpf *;
+
+allow bpfdomain fs_bpf:dir search;
+
+# genfscon doesn't seem to trigger during symlink creation,
+# and thus any created symlinks end up as 'fs_bpf:lnk_type',
+# however this feels like a kernel bug / missing feature,
+# so let's allow all bpffs_type's instead,
+# this will keep things working even if this is fixed.
+allow bpfdomain bpffs_type:lnk_file read;
+
+# Needed for //frameworks/libs/net:
+# common/native/bpf_headers/include/bpf/WaitForProgsLoaded.h
+get_prop(bpfdomain, bpf_progs_loaded_prop)
diff --git a/prebuilts/api/202504/private/bpfloader.te b/prebuilts/api/202504/private/bpfloader.te
new file mode 100644
index 0000000..4fe3843
--- /dev/null
+++ b/prebuilts/api/202504/private/bpfloader.te
@@ -0,0 +1,66 @@
+type bpfloader_exec, system_file_type, exec_type, file_type;
+
+typeattribute bpfloader bpfdomain;
+
+# allow bpfloader to write to the kernel log (starts early)
+allow bpfloader kmsg_device:chr_file w_file_perms;
+
+# These permissions are required to pin ebpf maps & programs.
+allow bpfloader bpffs_type:dir { add_name create open read remove_name search setattr write };
+allow bpfloader bpffs_type:file { create getattr read rename setattr };
+allow bpfloader bpffs_type:lnk_file { create getattr read };
+allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
+
+# Allow bpfloader to create bpf maps and programs.
+allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
+
+allow bpfloader self:capability { chown sys_admin net_admin };
+
+allow bpfloader sysfs_fs_fuse_bpf:file r_file_perms;
+
+allow bpfloader proc_bpf:file rw_file_perms;
+
+set_prop(bpfloader, bpf_progs_loaded_prop)
+
+allow bpfloader bpfloader_exec:file execute_no_trans;
+
+###
+### Neverallow rules
+###
+
+# Note: we don't care about getattr/mounton/search
+neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
+neverallow { domain -bpfloader } bpffs_type:dir { add_name create open read remove_name setattr write };
+
+neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
+neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };
+neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file { getattr read };
+neverallow { domain -bpfloader } fs_bpf_loader:file { getattr read };
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file { getattr read };
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file { getattr read };
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file { getattr read };
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file { getattr read };
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file { getattr read };
+neverallow { domain -bpfloader -uprobestats } fs_bpf_uprobestats:file { getattr read };
+neverallow { domain -bpfloader -gpuservice -lmkd -netd -netutils_wrapper -network_stack -system_server -uprobestats } { bpffs_type -fs_bpf_vendor }:file write;
+
+neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
+neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
+
+neverallow { domain -bpfloader } *:bpf prog_load;
+neverallow { domain -bpfdomain } *:bpf { map_create map_read map_write prog_run };
+
+# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
+neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
+neverallow { domain -bpfloader } fs_bpf_loader:file *;
+
+neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
+
+neverallow { coredomain -bpfloader -netd -netutils_wrapper } fs_bpf_vendor:file *;
+
+neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
+
+# No domain should be allowed to ptrace bpfloader
+neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
+
+neverallow { domain -bpfloader } proc_bpf:file write;
diff --git a/prebuilts/api/202504/private/bufferhubd.te b/prebuilts/api/202504/private/bufferhubd.te
new file mode 100644
index 0000000..143c6b5
--- /dev/null
+++ b/prebuilts/api/202504/private/bufferhubd.te
@@ -0,0 +1,24 @@
+typeattribute bufferhubd coredomain;
+
+init_daemon_domain(bufferhubd)
+
+hal_client_domain(bufferhubd, hal_graphics_allocator)
+
+# TODO(b/112338294): remove these after migrate to Binder
+pdx_server(bufferhubd, bufferhub_client)
+pdx_client(bufferhubd, performance_client)
+
+# Access the GPU.
+allow bufferhubd gpu_device:chr_file rw_file_perms;
+
+# Access /dev/ion
+allow bufferhubd ion_device:chr_file r_file_perms;
+
+# Receive sync fence FDs from hal_omx_server. Note that hal_omx_server never directly
+# connects to bufferhubd via PDX. Instead, a VR app acts as a bridge between
+# those two: it talks to hal_omx_server via Binder and talks to bufferhubd via PDX.
+# Thus, there is no need to use pdx_client macro.
+allow bufferhubd hal_omx_server:fd use;
+
+# Codec2 is similar to OMX
+allow bufferhubd hal_codec2_server:fd use;
diff --git a/prebuilts/api/202504/private/bug_map b/prebuilts/api/202504/private/bug_map
new file mode 100644
index 0000000..a4873a7
--- /dev/null
+++ b/prebuilts/api/202504/private/bug_map
@@ -0,0 +1,35 @@
+crash_dump keystore process b/376065666
+dnsmasq netd fifo_file b/77868789
+dnsmasq netd unix_stream_socket b/77868789
+gmscore_app system_data_file dir b/146166941
+gmscore_app kernel security b/303319090
+init app_data_file file b/77873135
+init cache_file blk_file b/77873135
+init logpersist file b/77873135
+init nativetest_data_file dir b/77873135
+init pstorefs dir b/77873135
+init shell_data_file dir b/77873135
+init shell_data_file file b/77873135
+init shell_data_file lnk_file b/77873135
+init shell_data_file sock_file b/77873135
+init system_data_file chr_file b/77873135
+isolated_app privapp_data_file dir b/119596573
+isolated_app app_data_file dir b/120394782
+mediaextractor app_data_file file b/77923736
+mediaextractor radio_data_file file b/77923736
+mediaprovider cache_file blk_file b/77925342
+mediaprovider mnt_media_rw_file dir b/77925342
+mediaprovider shell_data_file dir b/77925342
+mediaswcodec ashmem_device chr_file b/142679232
+platform_app nfc_data_file dir b/74331887
+platform_app system_data_file dir b/306090533
+shell sysfs_net file b/329380904
+system_server overlayfs_file file b/142390309
+system_server sdcardfs file b/77856826
+system_server system_server capability b/228030183
+system_server zygote process b/77856826
+tombstone_transmit tombstone_transmit capability b/264420112
+untrusted_app untrusted_app netlink_route_socket b/155595000
+vold system_data_file file b/124108085
+zygote untrusted_app_25 process b/77925912
+zygote labeledfs filesystem b/170748799
diff --git a/prebuilts/api/202504/private/camera_service_server.te b/prebuilts/api/202504/private/camera_service_server.te
new file mode 100644
index 0000000..352e1b7
--- /dev/null
+++ b/prebuilts/api/202504/private/camera_service_server.te
@@ -0,0 +1 @@
+add_hwservice(camera_service_server, fwk_camera_hwservice)
diff --git a/prebuilts/api/202504/private/cameraserver.te b/prebuilts/api/202504/private/cameraserver.te
new file mode 100644
index 0000000..16c1f3d
--- /dev/null
+++ b/prebuilts/api/202504/private/cameraserver.te
@@ -0,0 +1,92 @@
+typeattribute cameraserver camera_service_server;
+typeattribute cameraserver coredomain;
+
+init_daemon_domain(cameraserver)
+tmpfs_domain(cameraserver)
+
+allow cameraserver gpu_device:chr_file rw_file_perms;
+allow cameraserver gpu_device:dir r_dir_perms;
+allow cameraserver virtual_camera:binder call;
+
+binder_use(cameraserver)
+binder_call(cameraserver, binderservicedomain)
+binder_call(cameraserver, appdomain)
+binder_service(cameraserver)
+
+hal_client_domain(cameraserver, hal_camera)
+allow cameraserver hal_camera_server:process signal;
+hal_client_domain(cameraserver, hal_graphics_allocator)
+
+allow cameraserver ion_device:chr_file rw_file_perms;
+allow cameraserver dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Talk with graphics composer fences
+allow cameraserver hal_graphics_composer:fd use;
+
+add_service(cameraserver, cameraserver_service)
+add_service(cameraserver, fwk_camera_service)
+add_hwservice(cameraserver, fwk_camera_hwservice)
+
+allow cameraserver activity_service:service_manager find;
+allow cameraserver appops_service:service_manager find;
+allow cameraserver audioserver_service:service_manager find;
+allow cameraserver batterystats_service:service_manager find;
+allow cameraserver cameraproxy_service:service_manager find;
+allow cameraserver mediaserver_service:service_manager find;
+allow cameraserver package_native_service:service_manager find;
+allow cameraserver permission_checker_service:service_manager find;
+allow cameraserver processinfo_service:service_manager find;
+allow cameraserver scheduling_policy_service:service_manager find;
+allow cameraserver sensor_privacy_service:service_manager find;
+allow cameraserver surfaceflinger_service:service_manager find;
+
+allow cameraserver hidl_token_hwservice:hwservice_manager find;
+allow cameraserver hal_camera_service:service_manager find;
+allow cameraserver virtual_camera_service:service_manager find;
+
+# Allow to talk with surfaceflinger through unix stream socket
+allow cameraserver surfaceflinger:unix_stream_socket { read write };
+
+# Allow shell commands from ADB for CTS testing/dumping
+allow cameraserver adbd:fd use;
+allow cameraserver adbd:unix_stream_socket { read write };
+allow cameraserver shell:fd use;
+allow cameraserver shell:unix_stream_socket { read write };
+allow cameraserver shell:fifo_file { read write };
+
+# allow self to set SCHED_FIFO
+allow cameraserver self:global_capability_class_set sys_nice;
+
+# Allow to talk with media codec
+allow cameraserver mediametrics_service:service_manager find;
+hal_client_domain(cameraserver, hal_codec2)
+hal_client_domain(cameraserver, hal_omx)
+hal_client_domain(cameraserver, hal_allocator)
+
+# Allow shell commands from ADB for CTS testing/dumping
+userdebug_or_eng(`
+ allow cameraserver su:fd use;
+ allow cameraserver su:fifo_file { read write };
+ allow cameraserver su:unix_stream_socket { read write };
+')
+
+###
+### neverallow rules
+###
+
+# cameraserver should never execute any executable without a
+# domain transition
+neverallow cameraserver { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow cameraserver domain:{ udp_socket rawip_socket } *;
+neverallow cameraserver { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/canhalconfigurator.te b/prebuilts/api/202504/private/canhalconfigurator.te
new file mode 100644
index 0000000..5673ccd
--- /dev/null
+++ b/prebuilts/api/202504/private/canhalconfigurator.te
@@ -0,0 +1,10 @@
+type canhalconfigurator, domain, coredomain;
+type canhalconfigurator_exec, exec_type, system_file_type, file_type;
+init_daemon_domain(canhalconfigurator)
+
+# This allows the configurator to look up the CAN HAL controller via
+# hwservice_manager and communicate with it.
+hal_client_domain(canhalconfigurator, hal_can_controller)
+
+binder_use(canhalconfigurator)
+binder_call(hal_can_controller, canhalconfigurator)
diff --git a/prebuilts/api/202504/private/charger.te b/prebuilts/api/202504/private/charger.te
new file mode 100644
index 0000000..2d48a60
--- /dev/null
+++ b/prebuilts/api/202504/private/charger.te
@@ -0,0 +1,23 @@
+typeattribute charger coredomain;
+
+# The system charger is a client of HIDL health HAL.
+hal_client_domain(charger, hal_health)
+
+# charger needs to tell init to continue the boot
+# process when running in charger mode.
+# The system charger needs to be allowed to set these properties on legacy devices.
+set_prop(charger, system_prop)
+set_prop(charger, exported_system_prop)
+set_prop(charger, exported3_system_prop)
+
+# The system charger can read ro.charger.*
+get_prop(charger, charger_prop)
+
+compatible_property_only(`
+ neverallow {
+ domain
+ -init
+ -dumpstate
+ -charger
+ } charger_prop:file no_rw_file_perms;
+')
diff --git a/prebuilts/api/202504/private/charger_type.te b/prebuilts/api/202504/private/charger_type.te
new file mode 100644
index 0000000..d920a3d
--- /dev/null
+++ b/prebuilts/api/202504/private/charger_type.te
@@ -0,0 +1,76 @@
+# charger needs to tell init to continue the boot
+# process when running in charger mode.
+set_prop(charger_type, charger_status_prop)
+get_prop(charger_type, charger_config_prop)
+
+# get minui properties
+get_prop(charger_type, recovery_config_prop)
+
+# Write to /dev/kmsg
+allow charger_type kmsg_device:chr_file rw_file_perms;
+
+# Read access to pseudo filesystems.
+r_dir_file(charger_type, rootfs)
+r_dir_file(charger_type, cgroup)
+r_dir_file(charger_type, cgroup_v2)
+
+# Allow to read /sys/class/power_supply directory
+allow charger_type sysfs_type:dir r_dir_perms;
+
+allow charger_type self:global_capability_class_set {
+ sys_boot
+ sys_tty_config
+};
+
+wakelock_use(charger_type)
+
+allow charger_type self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# Read/write to /sys/power/state
+allow charger_type sysfs_power:file rw_file_perms;
+
+r_dir_file(charger_type, sysfs_batteryinfo)
+
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow charger_type pstorefs:dir r_dir_perms;
+allow charger_type pstorefs:file r_file_perms;
+
+allow charger_type graphics_device:dir r_dir_perms;
+allow charger_type graphics_device:chr_file rw_file_perms;
+allow charger_type input_device:dir r_dir_perms;
+allow charger_type input_device:chr_file r_file_perms;
+allow charger_type tty_device:chr_file rw_file_perms;
+allow charger_type proc_sysrq:file rw_file_perms;
+
+### Neverallow rules for charger properties
+
+# charger_config_prop: Only init and vendor_init is allowed to set it
+neverallow {
+ domain
+ -init
+ -vendor_init
+} charger_config_prop:property_service set;
+
+# charger_status_prop: Only init, vendor_init, charger, and charger_vendor
+# are allowed to set it
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -charger
+ -charger_vendor
+} charger_status_prop:property_service set;
+
+# Both charger_config_prop and charger_status_prop:
+# Only init, vendor_init, dumpstate, charger, and charger_vendor
+# are allowed to read it
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -vendor_init
+ -charger
+ -charger_vendor
+} { charger_config_prop charger_status_prop }:file no_rw_file_perms;
diff --git a/prebuilts/api/202504/private/charger_vendor.te b/prebuilts/api/202504/private/charger_vendor.te
new file mode 100644
index 0000000..47bd198
--- /dev/null
+++ b/prebuilts/api/202504/private/charger_vendor.te
@@ -0,0 +1,3 @@
+hal_server_domain(charger_vendor, hal_health)
+
+typeattribute charger_vendor bpfdomain;
diff --git a/prebuilts/api/202504/private/clatd.te b/prebuilts/api/202504/private/clatd.te
new file mode 100644
index 0000000..cd024a7
--- /dev/null
+++ b/prebuilts/api/202504/private/clatd.te
@@ -0,0 +1,12 @@
+# 464xlat daemon
+type clatd, domain, coredomain;
+type clatd_exec, system_file_type, exec_type, file_type;
+
+net_domain(clatd)
+
+# Access objects inherited from system_server.
+allow clatd system_server:fd use;
+allow clatd system_server:packet_socket { read write };
+allow clatd system_server:rawip_socket { read write };
+
+allow clatd tun_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/compat/202404/202404.cil b/prebuilts/api/202504/private/compat/202404/202404.cil
new file mode 100644
index 0000000..e9c97e5
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/202404/202404.cil
@@ -0,0 +1,2794 @@
+;; This type may or may not already exist in vendor policy. Re-define it here (duplicate
+;; definitions in CIL will be ignored) - so we can reference it in 202404.cil.
+(type cgroup_desc_api_file)
+(type otapreopt_chroot)
+(type task_profiles_api_file)
+(type vendor_hidraw_device)
+(type virtual_fingerprint_hal_prop)
+(typeattributeset dev_type (vendor_hidraw_device))
+
+;; mapping information from ToT policy's types to 202404 policy's types.
+(expandtypeattribute (DockObserver_service_202404) true)
+(expandtypeattribute (IProxyService_service_202404) true)
+(expandtypeattribute (aac_drc_prop_202404) true)
+(expandtypeattribute (aaudio_config_prop_202404) true)
+(expandtypeattribute (ab_update_gki_prop_202404) true)
+(expandtypeattribute (accessibility_service_202404) true)
+(expandtypeattribute (account_service_202404) true)
+(expandtypeattribute (aconfig_storage_flags_metadata_file_202404) true)
+(expandtypeattribute (aconfig_storage_metadata_file_202404) true)
+(expandtypeattribute (activity_service_202404) true)
+(expandtypeattribute (activity_task_service_202404) true)
+(expandtypeattribute (adaptive_haptics_prop_202404) true)
+(expandtypeattribute (adb_data_file_202404) true)
+(expandtypeattribute (adb_keys_file_202404) true)
+(expandtypeattribute (adb_service_202404) true)
+(expandtypeattribute (adbd_202404) true)
+(expandtypeattribute (adbd_config_prop_202404) true)
+(expandtypeattribute (adbd_exec_202404) true)
+(expandtypeattribute (adbd_socket_202404) true)
+(expandtypeattribute (adservices_manager_service_202404) true)
+(expandtypeattribute (aidl_lazy_test_server_202404) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_202404) true)
+(expandtypeattribute (aidl_lazy_test_service_202404) true)
+(expandtypeattribute (alarm_service_202404) true)
+(expandtypeattribute (anr_data_file_202404) true)
+(expandtypeattribute (apc_service_202404) true)
+(expandtypeattribute (apex_data_file_202404) true)
+(expandtypeattribute (apex_info_file_202404) true)
+(expandtypeattribute (apex_metadata_file_202404) true)
+(expandtypeattribute (apex_mnt_dir_202404) true)
+(expandtypeattribute (apex_module_data_file_202404) true)
+(expandtypeattribute (apex_ota_reserved_file_202404) true)
+(expandtypeattribute (apex_ready_prop_202404) true)
+(expandtypeattribute (apex_rollback_data_file_202404) true)
+(expandtypeattribute (apex_service_202404) true)
+(expandtypeattribute (apex_system_server_data_file_202404) true)
+(expandtypeattribute (apexd_202404) true)
+(expandtypeattribute (apexd_config_prop_202404) true)
+(expandtypeattribute (apexd_exec_202404) true)
+(expandtypeattribute (apexd_prop_202404) true)
+(expandtypeattribute (apexd_select_prop_202404) true)
+(expandtypeattribute (apk_data_file_202404) true)
+(expandtypeattribute (apk_private_data_file_202404) true)
+(expandtypeattribute (apk_private_tmp_file_202404) true)
+(expandtypeattribute (apk_tmp_file_202404) true)
+(expandtypeattribute (apk_verity_prop_202404) true)
+(expandtypeattribute (app_binding_service_202404) true)
+(expandtypeattribute (app_data_file_202404) true)
+(expandtypeattribute (app_fuse_file_202404) true)
+(expandtypeattribute (app_fusefs_202404) true)
+(expandtypeattribute (app_hibernation_service_202404) true)
+(expandtypeattribute (app_integrity_service_202404) true)
+(expandtypeattribute (app_prediction_service_202404) true)
+(expandtypeattribute (app_search_service_202404) true)
+(expandtypeattribute (app_zygote_202404) true)
+(expandtypeattribute (app_zygote_tmpfs_202404) true)
+(expandtypeattribute (appcompat_data_file_202404) true)
+(expandtypeattribute (appdomain_tmpfs_202404) true)
+(expandtypeattribute (appops_service_202404) true)
+(expandtypeattribute (appwidget_service_202404) true)
+(expandtypeattribute (archive_service_202404) true)
+(expandtypeattribute (arm64_memtag_prop_202404) true)
+(expandtypeattribute (art_apex_dir_202404) true)
+(expandtypeattribute (artd_202404) true)
+(expandtypeattribute (artd_pre_reboot_service_202404) true)
+(expandtypeattribute (artd_service_202404) true)
+(expandtypeattribute (asec_apk_file_202404) true)
+(expandtypeattribute (asec_image_file_202404) true)
+(expandtypeattribute (asec_public_file_202404) true)
+(expandtypeattribute (ashmem_device_202404) true)
+(expandtypeattribute (ashmem_libcutils_device_202404) true)
+(expandtypeattribute (assetatlas_service_202404) true)
+(expandtypeattribute (atrace_202404) true)
+(expandtypeattribute (attestation_verification_service_202404) true)
+(expandtypeattribute (audio_config_prop_202404) true)
+(expandtypeattribute (audio_data_file_202404) true)
+(expandtypeattribute (audio_device_202404) true)
+(expandtypeattribute (audio_prop_202404) true)
+(expandtypeattribute (audio_service_202404) true)
+(expandtypeattribute (audiohal_data_file_202404) true)
+(expandtypeattribute (audioserver_202404) true)
+(expandtypeattribute (audioserver_data_file_202404) true)
+(expandtypeattribute (audioserver_service_202404) true)
+(expandtypeattribute (audioserver_tmpfs_202404) true)
+(expandtypeattribute (auth_service_202404) true)
+(expandtypeattribute (authorization_service_202404) true)
+(expandtypeattribute (autofill_service_202404) true)
+(expandtypeattribute (backup_data_file_202404) true)
+(expandtypeattribute (backup_service_202404) true)
+(expandtypeattribute (battery_service_202404) true)
+(expandtypeattribute (batteryproperties_service_202404) true)
+(expandtypeattribute (batterystats_service_202404) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_202404) true)
+(expandtypeattribute (binder_cache_system_server_prop_202404) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_202404) true)
+(expandtypeattribute (binder_calls_stats_service_202404) true)
+(expandtypeattribute (binder_device_202404) true)
+(expandtypeattribute (binderfs_202404) true)
+(expandtypeattribute (binderfs_features_202404) true)
+(expandtypeattribute (binderfs_logs_202404) true)
+(expandtypeattribute (binderfs_logs_proc_202404) true)
+(expandtypeattribute (binderfs_logs_stats_202404) true)
+(expandtypeattribute (binfmt_miscfs_202404) true)
+(expandtypeattribute (biometric_service_202404) true)
+(expandtypeattribute (blkid_202404) true)
+(expandtypeattribute (blkid_untrusted_202404) true)
+(expandtypeattribute (blob_store_service_202404) true)
+(expandtypeattribute (block_device_202404) true)
+(expandtypeattribute (bluetooth_202404) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_202404) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_202404) true)
+(expandtypeattribute (bluetooth_config_prop_202404) true)
+(expandtypeattribute (bluetooth_data_file_202404) true)
+(expandtypeattribute (bluetooth_efs_file_202404) true)
+(expandtypeattribute (bluetooth_logs_data_file_202404) true)
+(expandtypeattribute (bluetooth_manager_service_202404) true)
+(expandtypeattribute (bluetooth_prop_202404) true)
+(expandtypeattribute (bluetooth_service_202404) true)
+(expandtypeattribute (bluetooth_socket_202404) true)
+(expandtypeattribute (boot_block_device_202404) true)
+(expandtypeattribute (boot_status_prop_202404) true)
+(expandtypeattribute (bootanim_202404) true)
+(expandtypeattribute (bootanim_config_prop_202404) true)
+(expandtypeattribute (bootanim_exec_202404) true)
+(expandtypeattribute (bootanim_oem_file_202404) true)
+(expandtypeattribute (bootanim_system_prop_202404) true)
+(expandtypeattribute (bootchart_data_file_202404) true)
+(expandtypeattribute (bootloader_boot_reason_prop_202404) true)
+(expandtypeattribute (bootloader_prop_202404) true)
+(expandtypeattribute (bootstat_202404) true)
+(expandtypeattribute (bootstat_data_file_202404) true)
+(expandtypeattribute (bootstat_exec_202404) true)
+(expandtypeattribute (boottime_prop_202404) true)
+(expandtypeattribute (boottime_public_prop_202404) true)
+(expandtypeattribute (boottrace_data_file_202404) true)
+(expandtypeattribute (bpf_progs_loaded_prop_202404) true)
+(expandtypeattribute (bpfloader_202404) true)
+(expandtypeattribute (bq_config_prop_202404) true)
+(expandtypeattribute (broadcastradio_service_202404) true)
+(expandtypeattribute (bt_device_202404) true)
+(expandtypeattribute (bufferhubd_202404) true)
+(expandtypeattribute (bufferhubd_exec_202404) true)
+(expandtypeattribute (bugreport_service_202404) true)
+(expandtypeattribute (build_attestation_prop_202404) true)
+(expandtypeattribute (build_bootimage_prop_202404) true)
+(expandtypeattribute (build_config_prop_202404) true)
+(expandtypeattribute (build_odm_prop_202404) true)
+(expandtypeattribute (build_prop_202404) true)
+(expandtypeattribute (build_vendor_prop_202404) true)
+(expandtypeattribute (cache_backup_file_202404) true)
+(expandtypeattribute (cache_block_device_202404) true)
+(expandtypeattribute (cache_file_202404) true)
+(expandtypeattribute (cache_private_backup_file_202404) true)
+(expandtypeattribute (cache_recovery_file_202404) true)
+(expandtypeattribute (cacheinfo_service_202404) true)
+(expandtypeattribute (camera2_extensions_prop_202404) true)
+(expandtypeattribute (camera_calibration_prop_202404) true)
+(expandtypeattribute (camera_config_prop_202404) true)
+(expandtypeattribute (camera_data_file_202404) true)
+(expandtypeattribute (camera_device_202404) true)
+(expandtypeattribute (cameraproxy_service_202404) true)
+(expandtypeattribute (cameraserver_202404) true)
+(expandtypeattribute (cameraserver_exec_202404) true)
+(expandtypeattribute (cameraserver_service_202404) true)
+(expandtypeattribute (cameraserver_tmpfs_202404) true)
+(expandtypeattribute (camerax_extensions_prop_202404) true)
+(expandtypeattribute (cgroup_202404) true)
+(expandtypeattribute (cgroup_desc_api_file_202404) true)
+(expandtypeattribute (cgroup_desc_file_202404) true)
+(expandtypeattribute (cgroup_rc_file_202404) true)
+(expandtypeattribute (cgroup_v2_202404) true)
+(expandtypeattribute (charger_202404) true)
+(expandtypeattribute (charger_config_prop_202404) true)
+(expandtypeattribute (charger_exec_202404) true)
+(expandtypeattribute (charger_prop_202404) true)
+(expandtypeattribute (charger_status_prop_202404) true)
+(expandtypeattribute (charger_vendor_202404) true)
+(expandtypeattribute (clipboard_service_202404) true)
+(expandtypeattribute (cloudsearch_service_202404) true)
+(expandtypeattribute (codec2_config_prop_202404) true)
+(expandtypeattribute (cold_boot_done_prop_202404) true)
+(expandtypeattribute (color_display_service_202404) true)
+(expandtypeattribute (companion_device_service_202404) true)
+(expandtypeattribute (composd_vm_art_prop_202404) true)
+(expandtypeattribute (composd_vm_vendor_prop_202404) true)
+(expandtypeattribute (config_prop_202404) true)
+(expandtypeattribute (configfs_202404) true)
+(expandtypeattribute (connectivity_native_service_202404) true)
+(expandtypeattribute (connectivity_service_202404) true)
+(expandtypeattribute (connmetrics_service_202404) true)
+(expandtypeattribute (console_device_202404) true)
+(expandtypeattribute (consumer_ir_service_202404) true)
+(expandtypeattribute (content_capture_service_202404) true)
+(expandtypeattribute (content_service_202404) true)
+(expandtypeattribute (content_suggestions_service_202404) true)
+(expandtypeattribute (contexthub_service_202404) true)
+(expandtypeattribute (contextual_search_service_202404) true)
+(expandtypeattribute (coredump_file_202404) true)
+(expandtypeattribute (country_detector_service_202404) true)
+(expandtypeattribute (coverage_service_202404) true)
+(expandtypeattribute (cppreopt_prop_202404) true)
+(expandtypeattribute (cpu_monitor_service_202404) true)
+(expandtypeattribute (cpu_variant_prop_202404) true)
+(expandtypeattribute (cpuinfo_service_202404) true)
+(expandtypeattribute (crash_dump_202404) true)
+(expandtypeattribute (crash_dump_exec_202404) true)
+(expandtypeattribute (credential_service_202404) true)
+(expandtypeattribute (credstore_202404) true)
+(expandtypeattribute (credstore_data_file_202404) true)
+(expandtypeattribute (credstore_exec_202404) true)
+(expandtypeattribute (credstore_service_202404) true)
+(expandtypeattribute (crossprofileapps_service_202404) true)
+(expandtypeattribute (ctl_adbd_prop_202404) true)
+(expandtypeattribute (ctl_apexd_prop_202404) true)
+(expandtypeattribute (ctl_bootanim_prop_202404) true)
+(expandtypeattribute (ctl_bugreport_prop_202404) true)
+(expandtypeattribute (ctl_console_prop_202404) true)
+(expandtypeattribute (ctl_default_prop_202404) true)
+(expandtypeattribute (ctl_dumpstate_prop_202404) true)
+(expandtypeattribute (ctl_fuse_prop_202404) true)
+(expandtypeattribute (ctl_gsid_prop_202404) true)
+(expandtypeattribute (ctl_interface_restart_prop_202404) true)
+(expandtypeattribute (ctl_interface_start_prop_202404) true)
+(expandtypeattribute (ctl_interface_stop_prop_202404) true)
+(expandtypeattribute (ctl_mdnsd_prop_202404) true)
+(expandtypeattribute (ctl_restart_prop_202404) true)
+(expandtypeattribute (ctl_rildaemon_prop_202404) true)
+(expandtypeattribute (ctl_sigstop_prop_202404) true)
+(expandtypeattribute (ctl_start_prop_202404) true)
+(expandtypeattribute (ctl_stop_prop_202404) true)
+(expandtypeattribute (dalvik_config_prop_202404) true)
+(expandtypeattribute (dalvik_dynamic_config_prop_202404) true)
+(expandtypeattribute (dalvik_prop_202404) true)
+(expandtypeattribute (dalvik_runtime_prop_202404) true)
+(expandtypeattribute (dalvikcache_data_file_202404) true)
+(expandtypeattribute (dataloader_manager_service_202404) true)
+(expandtypeattribute (dbinfo_service_202404) true)
+(expandtypeattribute (dck_prop_202404) true)
+(expandtypeattribute (debug_prop_202404) true)
+(expandtypeattribute (debugfs_202404) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_202404) true)
+(expandtypeattribute (debugfs_kprobes_202404) true)
+(expandtypeattribute (debugfs_mm_events_tracing_202404) true)
+(expandtypeattribute (debugfs_mmc_202404) true)
+(expandtypeattribute (debugfs_restriction_prop_202404) true)
+(expandtypeattribute (debugfs_trace_marker_202404) true)
+(expandtypeattribute (debugfs_tracing_202404) true)
+(expandtypeattribute (debugfs_tracing_debug_202404) true)
+(expandtypeattribute (debugfs_tracing_instances_202404) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_202404) true)
+(expandtypeattribute (debugfs_wakeup_sources_202404) true)
+(expandtypeattribute (debugfs_wifi_tracing_202404) true)
+(expandtypeattribute (debuggerd_prop_202404) true)
+(expandtypeattribute (default_android_hwservice_202404) true)
+(expandtypeattribute (default_android_service_202404) true)
+(expandtypeattribute (default_android_vndservice_202404) true)
+(expandtypeattribute (default_prop_202404) true)
+(expandtypeattribute (dev_cpu_variant_202404) true)
+(expandtypeattribute (device_202404) true)
+(expandtypeattribute (device_config_aconfig_flags_prop_202404) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_boot_count_prop_202404) true)
+(expandtypeattribute (device_config_camera_native_prop_202404) true)
+(expandtypeattribute (device_config_edgetpu_native_prop_202404) true)
+(expandtypeattribute (device_config_input_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_media_native_prop_202404) true)
+(expandtypeattribute (device_config_memory_safety_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_memory_safety_native_prop_202404) true)
+(expandtypeattribute (device_config_netd_native_prop_202404) true)
+(expandtypeattribute (device_config_nnapi_native_prop_202404) true)
+(expandtypeattribute (device_config_reset_performed_prop_202404) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_runtime_native_prop_202404) true)
+(expandtypeattribute (device_config_service_202404) true)
+(expandtypeattribute (device_config_surface_flinger_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_updatable_service_202404) true)
+(expandtypeattribute (device_config_vendor_system_native_boot_prop_202404) true)
+(expandtypeattribute (device_config_vendor_system_native_prop_202404) true)
+(expandtypeattribute (device_identifiers_service_202404) true)
+(expandtypeattribute (device_logging_prop_202404) true)
+(expandtypeattribute (device_policy_service_202404) true)
+(expandtypeattribute (device_state_service_202404) true)
+(expandtypeattribute (deviceidle_service_202404) true)
+(expandtypeattribute (devicelock_service_202404) true)
+(expandtypeattribute (devicestoragemonitor_service_202404) true)
+(expandtypeattribute (devpts_202404) true)
+(expandtypeattribute (dexopt_chroot_setup_service_202404) true)
+(expandtypeattribute (dhcp_202404) true)
+(expandtypeattribute (dhcp_data_file_202404) true)
+(expandtypeattribute (dhcp_exec_202404) true)
+(expandtypeattribute (dhcp_prop_202404) true)
+(expandtypeattribute (diskstats_service_202404) true)
+(expandtypeattribute (display_service_202404) true)
+(expandtypeattribute (dm_device_202404) true)
+(expandtypeattribute (dm_user_device_202404) true)
+(expandtypeattribute (dmabuf_heap_device_202404) true)
+(expandtypeattribute (dmabuf_system_heap_device_202404) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_202404) true)
+(expandtypeattribute (dnsmasq_202404) true)
+(expandtypeattribute (dnsmasq_exec_202404) true)
+(expandtypeattribute (dnsproxyd_socket_202404) true)
+(expandtypeattribute (dnsresolver_service_202404) true)
+(expandtypeattribute (domain_verification_service_202404) true)
+(expandtypeattribute (dreams_service_202404) true)
+(expandtypeattribute (drm_data_file_202404) true)
+(expandtypeattribute (drm_forcel3_prop_202404) true)
+(expandtypeattribute (drm_service_config_prop_202404) true)
+(expandtypeattribute (drmserver_202404) true)
+(expandtypeattribute (drmserver_exec_202404) true)
+(expandtypeattribute (drmserver_service_202404) true)
+(expandtypeattribute (drmserver_socket_202404) true)
+(expandtypeattribute (dropbox_data_file_202404) true)
+(expandtypeattribute (dropbox_service_202404) true)
+(expandtypeattribute (dtbo_block_device_202404) true)
+(expandtypeattribute (dumpstate_202404) true)
+(expandtypeattribute (dumpstate_exec_202404) true)
+(expandtypeattribute (dumpstate_options_prop_202404) true)
+(expandtypeattribute (dumpstate_prop_202404) true)
+(expandtypeattribute (dumpstate_service_202404) true)
+(expandtypeattribute (dumpstate_socket_202404) true)
+(expandtypeattribute (dynamic_system_prop_202404) true)
+(expandtypeattribute (e2fs_202404) true)
+(expandtypeattribute (e2fs_exec_202404) true)
+(expandtypeattribute (ecm_enhanced_confirmation_service_202404) true)
+(expandtypeattribute (efs_file_202404) true)
+(expandtypeattribute (emergency_affordance_service_202404) true)
+(expandtypeattribute (ephemeral_app_202404) true)
+(expandtypeattribute (ethernet_service_202404) true)
+(expandtypeattribute (evsmanagerd_202404) true)
+(expandtypeattribute (evsmanagerd_service_202404) true)
+(expandtypeattribute (exfat_202404) true)
+(expandtypeattribute (exported3_system_prop_202404) true)
+(expandtypeattribute (exported_bluetooth_prop_202404) true)
+(expandtypeattribute (exported_camera_prop_202404) true)
+(expandtypeattribute (exported_config_prop_202404) true)
+(expandtypeattribute (exported_default_prop_202404) true)
+(expandtypeattribute (exported_dumpstate_prop_202404) true)
+(expandtypeattribute (exported_overlay_prop_202404) true)
+(expandtypeattribute (exported_pm_prop_202404) true)
+(expandtypeattribute (exported_secure_prop_202404) true)
+(expandtypeattribute (exported_system_prop_202404) true)
+(expandtypeattribute (external_vibrator_service_202404) true)
+(expandtypeattribute (extra_free_kbytes_202404) true)
+(expandtypeattribute (extra_free_kbytes_exec_202404) true)
+(expandtypeattribute (face_service_202404) true)
+(expandtypeattribute (face_vendor_data_file_202404) true)
+(expandtypeattribute (fastbootd_202404) true)
+(expandtypeattribute (ffs_config_prop_202404) true)
+(expandtypeattribute (ffs_control_prop_202404) true)
+(expandtypeattribute (file_contexts_file_202404) true)
+(expandtypeattribute (file_integrity_service_202404) true)
+(expandtypeattribute (fingerprint_prop_202404) true)
+(expandtypeattribute (fingerprint_service_202404) true)
+(expandtypeattribute (fingerprint_vendor_data_file_202404) true)
+(expandtypeattribute (fingerprintd_202404) true)
+(expandtypeattribute (fingerprintd_data_file_202404) true)
+(expandtypeattribute (fingerprintd_exec_202404) true)
+(expandtypeattribute (fingerprintd_service_202404) true)
+(expandtypeattribute (firstboot_prop_202404) true)
+(expandtypeattribute (flags_health_check_202404) true)
+(expandtypeattribute (flags_health_check_exec_202404) true)
+(expandtypeattribute (font_service_202404) true)
+(expandtypeattribute (framework_status_prop_202404) true)
+(expandtypeattribute (framework_watchdog_config_prop_202404) true)
+(expandtypeattribute (frp_block_device_202404) true)
+(expandtypeattribute (fs_bpf_202404) true)
+(expandtypeattribute (fs_bpf_tethering_202404) true)
+(expandtypeattribute (fs_bpf_vendor_202404) true)
+(expandtypeattribute (fsck_202404) true)
+(expandtypeattribute (fsck_exec_202404) true)
+(expandtypeattribute (fsck_untrusted_202404) true)
+(expandtypeattribute (fscklogs_202404) true)
+(expandtypeattribute (functionfs_202404) true)
+(expandtypeattribute (fuse_202404) true)
+(expandtypeattribute (fuse_device_202404) true)
+(expandtypeattribute (fuseblk_202404) true)
+(expandtypeattribute (fusectlfs_202404) true)
+(expandtypeattribute (future_pm_prop_202404) true)
+(expandtypeattribute (fwk_altitude_service_202404) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_202404) true)
+(expandtypeattribute (fwk_automotive_display_service_202404) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_202404) true)
+(expandtypeattribute (fwk_camera_hwservice_202404) true)
+(expandtypeattribute (fwk_camera_service_202404) true)
+(expandtypeattribute (fwk_display_hwservice_202404) true)
+(expandtypeattribute (fwk_scheduler_hwservice_202404) true)
+(expandtypeattribute (fwk_sensor_hwservice_202404) true)
+(expandtypeattribute (fwk_sensor_service_202404) true)
+(expandtypeattribute (fwk_stats_hwservice_202404) true)
+(expandtypeattribute (fwk_stats_service_202404) true)
+(expandtypeattribute (fwk_vibrator_control_service_202404) true)
+(expandtypeattribute (fwmarkd_socket_202404) true)
+(expandtypeattribute (game_mode_intervention_list_file_202404) true)
+(expandtypeattribute (game_service_202404) true)
+(expandtypeattribute (gatekeeper_data_file_202404) true)
+(expandtypeattribute (gatekeeper_service_202404) true)
+(expandtypeattribute (gatekeeperd_202404) true)
+(expandtypeattribute (gatekeeperd_exec_202404) true)
+(expandtypeattribute (gesture_prop_202404) true)
+(expandtypeattribute (gfxinfo_service_202404) true)
+(expandtypeattribute (gmscore_app_202404) true)
+(expandtypeattribute (gnss_device_202404) true)
+(expandtypeattribute (gnss_time_update_service_202404) true)
+(expandtypeattribute (gps_control_202404) true)
+(expandtypeattribute (gpu_device_202404) true)
+(expandtypeattribute (gpu_service_202404) true)
+(expandtypeattribute (gpuservice_202404) true)
+(expandtypeattribute (grammatical_inflection_service_202404) true)
+(expandtypeattribute (graphics_config_prop_202404) true)
+(expandtypeattribute (graphics_config_writable_prop_202404) true)
+(expandtypeattribute (graphics_device_202404) true)
+(expandtypeattribute (graphicsstats_service_202404) true)
+(expandtypeattribute (gsi_data_file_202404) true)
+(expandtypeattribute (gsi_metadata_file_202404) true)
+(expandtypeattribute (gsi_public_metadata_file_202404) true)
+(expandtypeattribute (gwp_asan_prop_202404) true)
+(expandtypeattribute (hal_atrace_hwservice_202404) true)
+(expandtypeattribute (hal_audio_hwservice_202404) true)
+(expandtypeattribute (hal_audio_service_202404) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_202404) true)
+(expandtypeattribute (hal_audiocontrol_service_202404) true)
+(expandtypeattribute (hal_authgraph_service_202404) true)
+(expandtypeattribute (hal_authsecret_hwservice_202404) true)
+(expandtypeattribute (hal_authsecret_service_202404) true)
+(expandtypeattribute (hal_bluetooth_hwservice_202404) true)
+(expandtypeattribute (hal_bluetooth_service_202404) true)
+(expandtypeattribute (hal_bootctl_hwservice_202404) true)
+(expandtypeattribute (hal_bootctl_service_202404) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_202404) true)
+(expandtypeattribute (hal_broadcastradio_service_202404) true)
+(expandtypeattribute (hal_camera_hwservice_202404) true)
+(expandtypeattribute (hal_camera_service_202404) true)
+(expandtypeattribute (hal_can_bus_hwservice_202404) true)
+(expandtypeattribute (hal_can_controller_hwservice_202404) true)
+(expandtypeattribute (hal_can_controller_service_202404) true)
+(expandtypeattribute (hal_cas_hwservice_202404) true)
+(expandtypeattribute (hal_cas_service_202404) true)
+(expandtypeattribute (hal_codec2_hwservice_202404) true)
+(expandtypeattribute (hal_codec2_service_202404) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_202404) true)
+(expandtypeattribute (hal_confirmationui_hwservice_202404) true)
+(expandtypeattribute (hal_confirmationui_service_202404) true)
+(expandtypeattribute (hal_contexthub_hwservice_202404) true)
+(expandtypeattribute (hal_contexthub_service_202404) true)
+(expandtypeattribute (hal_drm_hwservice_202404) true)
+(expandtypeattribute (hal_drm_service_202404) true)
+(expandtypeattribute (hal_dumpstate_config_prop_202404) true)
+(expandtypeattribute (hal_dumpstate_hwservice_202404) true)
+(expandtypeattribute (hal_dumpstate_service_202404) true)
+(expandtypeattribute (hal_evs_hwservice_202404) true)
+(expandtypeattribute (hal_evs_service_202404) true)
+(expandtypeattribute (hal_face_hwservice_202404) true)
+(expandtypeattribute (hal_face_service_202404) true)
+(expandtypeattribute (hal_fastboot_service_202404) true)
+(expandtypeattribute (hal_fingerprint_hwservice_202404) true)
+(expandtypeattribute (hal_fingerprint_service_202404) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_202404) true)
+(expandtypeattribute (hal_gatekeeper_service_202404) true)
+(expandtypeattribute (hal_gnss_hwservice_202404) true)
+(expandtypeattribute (hal_gnss_service_202404) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_202404) true)
+(expandtypeattribute (hal_graphics_allocator_service_202404) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_202404) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_202404) true)
+(expandtypeattribute (hal_graphics_composer_service_202404) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_202404) true)
+(expandtypeattribute (hal_graphics_mapper_service_202404) true)
+(expandtypeattribute (hal_health_hwservice_202404) true)
+(expandtypeattribute (hal_health_service_202404) true)
+(expandtypeattribute (hal_health_storage_hwservice_202404) true)
+(expandtypeattribute (hal_health_storage_service_202404) true)
+(expandtypeattribute (hal_identity_service_202404) true)
+(expandtypeattribute (hal_input_classifier_hwservice_202404) true)
+(expandtypeattribute (hal_input_processor_service_202404) true)
+(expandtypeattribute (hal_instrumentation_prop_202404) true)
+(expandtypeattribute (hal_ir_hwservice_202404) true)
+(expandtypeattribute (hal_ir_service_202404) true)
+(expandtypeattribute (hal_ivn_service_202404) true)
+(expandtypeattribute (hal_keymaster_hwservice_202404) true)
+(expandtypeattribute (hal_keymint_service_202404) true)
+(expandtypeattribute (hal_light_hwservice_202404) true)
+(expandtypeattribute (hal_light_service_202404) true)
+(expandtypeattribute (hal_lowpan_hwservice_202404) true)
+(expandtypeattribute (hal_macsec_service_202404) true)
+(expandtypeattribute (hal_memtrack_hwservice_202404) true)
+(expandtypeattribute (hal_memtrack_service_202404) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_202404) true)
+(expandtypeattribute (hal_neuralnetworks_service_202404) true)
+(expandtypeattribute (hal_nfc_hwservice_202404) true)
+(expandtypeattribute (hal_nfc_service_202404) true)
+(expandtypeattribute (hal_nlinterceptor_service_202404) true)
+(expandtypeattribute (hal_oemlock_hwservice_202404) true)
+(expandtypeattribute (hal_oemlock_service_202404) true)
+(expandtypeattribute (hal_omx_hwservice_202404) true)
+(expandtypeattribute (hal_power_hwservice_202404) true)
+(expandtypeattribute (hal_power_service_202404) true)
+(expandtypeattribute (hal_power_stats_hwservice_202404) true)
+(expandtypeattribute (hal_power_stats_service_202404) true)
+(expandtypeattribute (hal_radio_service_202404) true)
+(expandtypeattribute (hal_rebootescrow_service_202404) true)
+(expandtypeattribute (hal_remoteaccess_service_202404) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf_service_202404) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_202404) true)
+(expandtypeattribute (hal_renderscript_hwservice_202404) true)
+(expandtypeattribute (hal_secretkeeper_service_202404) true)
+(expandtypeattribute (hal_secure_element_hwservice_202404) true)
+(expandtypeattribute (hal_secure_element_service_202404) true)
+(expandtypeattribute (hal_secureclock_service_202404) true)
+(expandtypeattribute (hal_sensors_hwservice_202404) true)
+(expandtypeattribute (hal_sensors_service_202404) true)
+(expandtypeattribute (hal_sharedsecret_service_202404) true)
+(expandtypeattribute (hal_system_suspend_service_202404) true)
+(expandtypeattribute (hal_telephony_hwservice_202404) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_202404) true)
+(expandtypeattribute (hal_tetheroffload_service_202404) true)
+(expandtypeattribute (hal_thermal_hwservice_202404) true)
+(expandtypeattribute (hal_thermal_service_202404) true)
+(expandtypeattribute (hal_threadnetwork_service_202404) true)
+(expandtypeattribute (hal_tv_cec_hwservice_202404) true)
+(expandtypeattribute (hal_tv_hdmi_cec_service_202404) true)
+(expandtypeattribute (hal_tv_hdmi_connection_service_202404) true)
+(expandtypeattribute (hal_tv_hdmi_earc_service_202404) true)
+(expandtypeattribute (hal_tv_input_hwservice_202404) true)
+(expandtypeattribute (hal_tv_input_service_202404) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_202404) true)
+(expandtypeattribute (hal_tv_tuner_service_202404) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_202404) true)
+(expandtypeattribute (hal_usb_gadget_service_202404) true)
+(expandtypeattribute (hal_usb_hwservice_202404) true)
+(expandtypeattribute (hal_usb_service_202404) true)
+(expandtypeattribute (hal_uwb_service_202404) true)
+(expandtypeattribute (hal_vehicle_hwservice_202404) true)
+(expandtypeattribute (hal_vehicle_service_202404) true)
+(expandtypeattribute (hal_vibrator_hwservice_202404) true)
+(expandtypeattribute (hal_vibrator_service_202404) true)
+(expandtypeattribute (hal_vr_hwservice_202404) true)
+(expandtypeattribute (hal_weaver_hwservice_202404) true)
+(expandtypeattribute (hal_weaver_service_202404) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_202404) true)
+(expandtypeattribute (hal_wifi_hostapd_service_202404) true)
+(expandtypeattribute (hal_wifi_hwservice_202404) true)
+(expandtypeattribute (hal_wifi_service_202404) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_202404) true)
+(expandtypeattribute (hal_wifi_supplicant_service_202404) true)
+(expandtypeattribute (hardware_properties_service_202404) true)
+(expandtypeattribute (hardware_service_202404) true)
+(expandtypeattribute (hci_attach_dev_202404) true)
+(expandtypeattribute (hdmi_config_prop_202404) true)
+(expandtypeattribute (hdmi_control_service_202404) true)
+(expandtypeattribute (healthconnect_service_202404) true)
+(expandtypeattribute (healthd_202404) true)
+(expandtypeattribute (heapdump_data_file_202404) true)
+(expandtypeattribute (heapprofd_202404) true)
+(expandtypeattribute (heapprofd_enabled_prop_202404) true)
+(expandtypeattribute (heapprofd_prop_202404) true)
+(expandtypeattribute (heapprofd_socket_202404) true)
+(expandtypeattribute (hidl_allocator_hwservice_202404) true)
+(expandtypeattribute (hidl_base_hwservice_202404) true)
+(expandtypeattribute (hidl_manager_hwservice_202404) true)
+(expandtypeattribute (hidl_memory_hwservice_202404) true)
+(expandtypeattribute (hidl_token_hwservice_202404) true)
+(expandtypeattribute (hidraw_device_202404) true)
+(expandtypeattribute (hint_service_202404) true)
+(expandtypeattribute (hw_random_device_202404) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_202404) true)
+(expandtypeattribute (hwbinder_device_202404) true)
+(expandtypeattribute (hwservice_contexts_file_202404) true)
+(expandtypeattribute (hwservicemanager_202404) true)
+(expandtypeattribute (hwservicemanager_exec_202404) true)
+(expandtypeattribute (hwservicemanager_prop_202404) true)
+(expandtypeattribute (hypervisor_prop_202404) true)
+(expandtypeattribute (hypervisor_restricted_prop_202404) true)
+(expandtypeattribute (icon_file_202404) true)
+(expandtypeattribute (idmap_202404) true)
+(expandtypeattribute (idmap_exec_202404) true)
+(expandtypeattribute (idmap_service_202404) true)
+(expandtypeattribute (iio_device_202404) true)
+(expandtypeattribute (imms_service_202404) true)
+(expandtypeattribute (incident_202404) true)
+(expandtypeattribute (incident_data_file_202404) true)
+(expandtypeattribute (incident_helper_202404) true)
+(expandtypeattribute (incident_service_202404) true)
+(expandtypeattribute (incidentd_202404) true)
+(expandtypeattribute (incremental_control_file_202404) true)
+(expandtypeattribute (incremental_prop_202404) true)
+(expandtypeattribute (incremental_service_202404) true)
+(expandtypeattribute (init_202404) true)
+(expandtypeattribute (init_exec_202404) true)
+(expandtypeattribute (init_service_status_prop_202404) true)
+(expandtypeattribute (init_tmpfs_202404) true)
+(expandtypeattribute (inotify_202404) true)
+(expandtypeattribute (input_device_202404) true)
+(expandtypeattribute (input_device_config_prop_202404) true)
+(expandtypeattribute (input_method_service_202404) true)
+(expandtypeattribute (input_service_202404) true)
+(expandtypeattribute (inputflinger_202404) true)
+(expandtypeattribute (inputflinger_exec_202404) true)
+(expandtypeattribute (inputflinger_service_202404) true)
+(expandtypeattribute (install_data_file_202404) true)
+(expandtypeattribute (installd_202404) true)
+(expandtypeattribute (installd_exec_202404) true)
+(expandtypeattribute (installd_service_202404) true)
+(expandtypeattribute (ion_device_202404) true)
+(expandtypeattribute (ipsec_service_202404) true)
+(expandtypeattribute (iris_service_202404) true)
+(expandtypeattribute (iris_vendor_data_file_202404) true)
+(expandtypeattribute (isolated_app_202404) true)
+(expandtypeattribute (isolated_compute_app_202404) true)
+(expandtypeattribute (jobscheduler_service_202404) true)
+(expandtypeattribute (kernel_202404) true)
+(expandtypeattribute (keychain_data_file_202404) true)
+(expandtypeattribute (keychord_device_202404) true)
+(expandtypeattribute (keyguard_config_prop_202404) true)
+(expandtypeattribute (keystore2_key_contexts_file_202404) true)
+(expandtypeattribute (keystore_202404) true)
+(expandtypeattribute (keystore_compat_hal_service_202404) true)
+(expandtypeattribute (keystore_config_prop_202404) true)
+(expandtypeattribute (keystore_data_file_202404) true)
+(expandtypeattribute (keystore_exec_202404) true)
+(expandtypeattribute (keystore_maintenance_service_202404) true)
+(expandtypeattribute (keystore_metrics_service_202404) true)
+(expandtypeattribute (keystore_service_202404) true)
+(expandtypeattribute (kmsg_debug_device_202404) true)
+(expandtypeattribute (kmsg_device_202404) true)
+(expandtypeattribute (labeledfs_202404) true)
+(expandtypeattribute (launcherapps_service_202404) true)
+(expandtypeattribute (legacy_permission_service_202404) true)
+(expandtypeattribute (legacykeystore_service_202404) true)
+(expandtypeattribute (libc_debug_prop_202404) true)
+(expandtypeattribute (light_service_202404) true)
+(expandtypeattribute (linkerconfig_file_202404) true)
+(expandtypeattribute (llkd_202404) true)
+(expandtypeattribute (llkd_exec_202404) true)
+(expandtypeattribute (llkd_prop_202404) true)
+(expandtypeattribute (lmkd_202404) true)
+(expandtypeattribute (lmkd_config_prop_202404) true)
+(expandtypeattribute (lmkd_exec_202404) true)
+(expandtypeattribute (lmkd_prop_202404) true)
+(expandtypeattribute (lmkd_socket_202404) true)
+(expandtypeattribute (locale_prop_202404) true)
+(expandtypeattribute (locale_service_202404) true)
+(expandtypeattribute (location_service_202404) true)
+(expandtypeattribute (location_time_zone_manager_service_202404) true)
+(expandtypeattribute (lock_settings_service_202404) true)
+(expandtypeattribute (log_prop_202404) true)
+(expandtypeattribute (log_tag_prop_202404) true)
+(expandtypeattribute (logcat_exec_202404) true)
+(expandtypeattribute (logd_202404) true)
+(expandtypeattribute (logd_exec_202404) true)
+(expandtypeattribute (logd_prop_202404) true)
+(expandtypeattribute (logd_socket_202404) true)
+(expandtypeattribute (logdr_socket_202404) true)
+(expandtypeattribute (logdw_socket_202404) true)
+(expandtypeattribute (logpersist_202404) true)
+(expandtypeattribute (logpersistd_logging_prop_202404) true)
+(expandtypeattribute (loop_control_device_202404) true)
+(expandtypeattribute (loop_device_202404) true)
+(expandtypeattribute (looper_stats_service_202404) true)
+(expandtypeattribute (lowpan_device_202404) true)
+(expandtypeattribute (lowpan_prop_202404) true)
+(expandtypeattribute (lpdump_service_202404) true)
+(expandtypeattribute (lpdumpd_prop_202404) true)
+(expandtypeattribute (mac_perms_file_202404) true)
+(expandtypeattribute (mdns_service_202404) true)
+(expandtypeattribute (mdns_socket_202404) true)
+(expandtypeattribute (mdnsd_202404) true)
+(expandtypeattribute (mdnsd_socket_202404) true)
+(expandtypeattribute (media_communication_service_202404) true)
+(expandtypeattribute (media_config_prop_202404) true)
+(expandtypeattribute (media_data_file_202404) true)
+(expandtypeattribute (media_metrics_service_202404) true)
+(expandtypeattribute (media_projection_service_202404) true)
+(expandtypeattribute (media_router_service_202404) true)
+(expandtypeattribute (media_rw_data_file_202404) true)
+(expandtypeattribute (media_session_service_202404) true)
+(expandtypeattribute (media_userdir_file_202404) true)
+(expandtypeattribute (media_variant_prop_202404) true)
+(expandtypeattribute (mediadrm_config_prop_202404) true)
+(expandtypeattribute (mediadrmserver_202404) true)
+(expandtypeattribute (mediadrmserver_exec_202404) true)
+(expandtypeattribute (mediadrmserver_service_202404) true)
+(expandtypeattribute (mediaextractor_202404) true)
+(expandtypeattribute (mediaextractor_exec_202404) true)
+(expandtypeattribute (mediaextractor_service_202404) true)
+(expandtypeattribute (mediaextractor_tmpfs_202404) true)
+(expandtypeattribute (mediametrics_202404) true)
+(expandtypeattribute (mediametrics_exec_202404) true)
+(expandtypeattribute (mediametrics_service_202404) true)
+(expandtypeattribute (mediaprovider_202404) true)
+(expandtypeattribute (mediaserver_202404) true)
+(expandtypeattribute (mediaserver_exec_202404) true)
+(expandtypeattribute (mediaserver_service_202404) true)
+(expandtypeattribute (mediaserver_tmpfs_202404) true)
+(expandtypeattribute (mediaswcodec_202404) true)
+(expandtypeattribute (mediaswcodec_exec_202404) true)
+(expandtypeattribute (mediatranscoding_202404) true)
+(expandtypeattribute (mediatranscoding_service_202404) true)
+(expandtypeattribute (meminfo_service_202404) true)
+(expandtypeattribute (memtrackproxy_service_202404) true)
+(expandtypeattribute (metadata_block_device_202404) true)
+(expandtypeattribute (metadata_bootstat_file_202404) true)
+(expandtypeattribute (metadata_file_202404) true)
+(expandtypeattribute (method_trace_data_file_202404) true)
+(expandtypeattribute (midi_service_202404) true)
+(expandtypeattribute (mirror_data_file_202404) true)
+(expandtypeattribute (misc_block_device_202404) true)
+(expandtypeattribute (misc_logd_file_202404) true)
+(expandtypeattribute (misc_user_data_file_202404) true)
+(expandtypeattribute (mm_events_config_prop_202404) true)
+(expandtypeattribute (mmc_prop_202404) true)
+(expandtypeattribute (mnt_expand_file_202404) true)
+(expandtypeattribute (mnt_media_rw_file_202404) true)
+(expandtypeattribute (mnt_media_rw_stub_file_202404) true)
+(expandtypeattribute (mnt_pass_through_file_202404) true)
+(expandtypeattribute (mnt_product_file_202404) true)
+(expandtypeattribute (mnt_sdcard_file_202404) true)
+(expandtypeattribute (mnt_user_file_202404) true)
+(expandtypeattribute (mnt_vendor_file_202404) true)
+(expandtypeattribute (mock_ota_prop_202404) true)
+(expandtypeattribute (modprobe_202404) true)
+(expandtypeattribute (module_sdkextensions_prop_202404) true)
+(expandtypeattribute (mount_service_202404) true)
+(expandtypeattribute (mqueue_202404) true)
+(expandtypeattribute (mtp_202404) true)
+(expandtypeattribute (mtp_device_202404) true)
+(expandtypeattribute (mtpd_socket_202404) true)
+(expandtypeattribute (music_recognition_service_202404) true)
+(expandtypeattribute (nativetest_data_file_202404) true)
+(expandtypeattribute (nearby_service_202404) true)
+(expandtypeattribute (net_data_file_202404) true)
+(expandtypeattribute (net_dns_prop_202404) true)
+(expandtypeattribute (net_radio_prop_202404) true)
+(expandtypeattribute (netd_202404) true)
+(expandtypeattribute (netd_exec_202404) true)
+(expandtypeattribute (netd_listener_service_202404) true)
+(expandtypeattribute (netd_service_202404) true)
+(expandtypeattribute (netif_202404) true)
+(expandtypeattribute (netpolicy_service_202404) true)
+(expandtypeattribute (netstats_service_202404) true)
+(expandtypeattribute (netutils_wrapper_202404) true)
+(expandtypeattribute (netutils_wrapper_exec_202404) true)
+(expandtypeattribute (network_management_service_202404) true)
+(expandtypeattribute (network_score_service_202404) true)
+(expandtypeattribute (network_stack_202404) true)
+(expandtypeattribute (network_stack_service_202404) true)
+(expandtypeattribute (network_time_update_service_202404) true)
+(expandtypeattribute (network_watchlist_data_file_202404) true)
+(expandtypeattribute (network_watchlist_service_202404) true)
+(expandtypeattribute (nfc_202404) true)
+(expandtypeattribute (nfc_data_file_202404) true)
+(expandtypeattribute (nfc_device_202404) true)
+(expandtypeattribute (nfc_logs_data_file_202404) true)
+(expandtypeattribute (nfc_prop_202404) true)
+(expandtypeattribute (nfc_service_202404) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_202404) true)
+(expandtypeattribute (node_202404) true)
+(expandtypeattribute (notification_service_202404) true)
+(expandtypeattribute (null_device_202404) true)
+(expandtypeattribute (oem_lock_service_202404) true)
+(expandtypeattribute (oem_unlock_prop_202404) true)
+(expandtypeattribute (oemfs_202404) true)
+(expandtypeattribute (ondevicepersonalization_system_service_202404) true)
+(expandtypeattribute (ot_daemon_service_202404) true)
+(expandtypeattribute (ot_daemon_socket_202404) true)
+(expandtypeattribute (ota_build_prop_202404) true)
+(expandtypeattribute (ota_data_file_202404) true)
+(expandtypeattribute (ota_metadata_file_202404) true)
+(expandtypeattribute (ota_package_file_202404) true)
+(expandtypeattribute (ota_prop_202404) true)
+(expandtypeattribute (otadexopt_service_202404) true)
+(expandtypeattribute (otapreopt_chroot_202404) true)
+(expandtypeattribute (overlay_prop_202404) true)
+(expandtypeattribute (overlay_service_202404) true)
+(expandtypeattribute (overlayfs_file_202404) true)
+(expandtypeattribute (owntty_device_202404) true)
+(expandtypeattribute (pac_proxy_service_202404) true)
+(expandtypeattribute (package_native_service_202404) true)
+(expandtypeattribute (package_service_202404) true)
+(expandtypeattribute (packagemanager_config_prop_202404) true)
+(expandtypeattribute (packages_list_file_202404) true)
+(expandtypeattribute (pan_result_prop_202404) true)
+(expandtypeattribute (password_slot_metadata_file_202404) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_202404) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_bufferhub_dir_202404) true)
+(expandtypeattribute (pdx_display_client_channel_socket_202404) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_display_dir_202404) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_202404) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_202404) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_202404) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_202404) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_202404) true)
+(expandtypeattribute (pdx_performance_dir_202404) true)
+(expandtypeattribute (people_service_202404) true)
+(expandtypeattribute (perfetto_202404) true)
+(expandtypeattribute (performanced_202404) true)
+(expandtypeattribute (performanced_exec_202404) true)
+(expandtypeattribute (permission_checker_service_202404) true)
+(expandtypeattribute (permission_service_202404) true)
+(expandtypeattribute (permissionmgr_service_202404) true)
+(expandtypeattribute (permissive_mte_prop_202404) true)
+(expandtypeattribute (persist_debug_prop_202404) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_202404) true)
+(expandtypeattribute (persist_wm_debug_prop_202404) true)
+(expandtypeattribute (persistent_data_block_service_202404) true)
+(expandtypeattribute (persistent_properties_ready_prop_202404) true)
+(expandtypeattribute (pinner_service_202404) true)
+(expandtypeattribute (pipefs_202404) true)
+(expandtypeattribute (platform_app_202404) true)
+(expandtypeattribute (platform_compat_service_202404) true)
+(expandtypeattribute (pm_archiving_enabled_prop_202404) true)
+(expandtypeattribute (pmsg_device_202404) true)
+(expandtypeattribute (port_202404) true)
+(expandtypeattribute (port_device_202404) true)
+(expandtypeattribute (postinstall_202404) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_202404) true)
+(expandtypeattribute (postinstall_file_202404) true)
+(expandtypeattribute (postinstall_mnt_dir_202404) true)
+(expandtypeattribute (power_debug_prop_202404) true)
+(expandtypeattribute (power_service_202404) true)
+(expandtypeattribute (powerctl_prop_202404) true)
+(expandtypeattribute (powerstats_service_202404) true)
+(expandtypeattribute (ppp_202404) true)
+(expandtypeattribute (preloads_data_file_202404) true)
+(expandtypeattribute (preloads_media_file_202404) true)
+(expandtypeattribute (prereboot_data_file_202404) true)
+(expandtypeattribute (print_service_202404) true)
+(expandtypeattribute (priv_app_202404) true)
+(expandtypeattribute (privapp_data_file_202404) true)
+(expandtypeattribute (prng_seeder_202404) true)
+(expandtypeattribute (proc_202404) true)
+(expandtypeattribute (proc_abi_202404) true)
+(expandtypeattribute (proc_asound_202404) true)
+(expandtypeattribute (proc_bluetooth_writable_202404) true)
+(expandtypeattribute (proc_bootconfig_202404) true)
+(expandtypeattribute (proc_bpf_202404) true)
+(expandtypeattribute (proc_buddyinfo_202404) true)
+(expandtypeattribute (proc_cmdline_202404) true)
+(expandtypeattribute (proc_cpu_alignment_202404) true)
+(expandtypeattribute (proc_cpuinfo_202404) true)
+(expandtypeattribute (proc_dirty_202404) true)
+(expandtypeattribute (proc_diskstats_202404) true)
+(expandtypeattribute (proc_drop_caches_202404) true)
+(expandtypeattribute (proc_extra_free_kbytes_202404) true)
+(expandtypeattribute (proc_filesystems_202404) true)
+(expandtypeattribute (proc_fs_verity_202404) true)
+(expandtypeattribute (proc_hostname_202404) true)
+(expandtypeattribute (proc_hung_task_202404) true)
+(expandtypeattribute (proc_interrupts_202404) true)
+(expandtypeattribute (proc_iomem_202404) true)
+(expandtypeattribute (proc_kallsyms_202404) true)
+(expandtypeattribute (proc_keys_202404) true)
+(expandtypeattribute (proc_kmsg_202404) true)
+(expandtypeattribute (proc_kpageflags_202404) true)
+(expandtypeattribute (proc_loadavg_202404) true)
+(expandtypeattribute (proc_locks_202404) true)
+(expandtypeattribute (proc_lowmemorykiller_202404) true)
+(expandtypeattribute (proc_max_map_count_202404) true)
+(expandtypeattribute (proc_meminfo_202404) true)
+(expandtypeattribute (proc_min_free_order_shift_202404) true)
+(expandtypeattribute (proc_misc_202404) true)
+(expandtypeattribute (proc_modules_202404) true)
+(expandtypeattribute (proc_mounts_202404) true)
+(expandtypeattribute (proc_net_202404) true)
+(expandtypeattribute (proc_net_tcp_udp_202404) true)
+(expandtypeattribute (proc_overcommit_memory_202404) true)
+(expandtypeattribute (proc_page_cluster_202404) true)
+(expandtypeattribute (proc_pagetypeinfo_202404) true)
+(expandtypeattribute (proc_panic_202404) true)
+(expandtypeattribute (proc_percpu_pagelist_high_fraction_202404) true)
+(expandtypeattribute (proc_perf_202404) true)
+(expandtypeattribute (proc_pid_max_202404) true)
+(expandtypeattribute (proc_pipe_conf_202404) true)
+(expandtypeattribute (proc_pressure_cpu_202404) true)
+(expandtypeattribute (proc_pressure_io_202404) true)
+(expandtypeattribute (proc_pressure_mem_202404) true)
+(expandtypeattribute (proc_qtaguid_ctrl_202404) true)
+(expandtypeattribute (proc_qtaguid_stat_202404) true)
+(expandtypeattribute (proc_random_202404) true)
+(expandtypeattribute (proc_sched_202404) true)
+(expandtypeattribute (proc_security_202404) true)
+(expandtypeattribute (proc_slabinfo_202404) true)
+(expandtypeattribute (proc_stat_202404) true)
+(expandtypeattribute (proc_swaps_202404) true)
+(expandtypeattribute (proc_sysrq_202404) true)
+(expandtypeattribute (proc_timer_202404) true)
+(expandtypeattribute (proc_tty_drivers_202404) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_202404) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_202404) true)
+(expandtypeattribute (proc_uid_cpupower_202404) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_202404) true)
+(expandtypeattribute (proc_uid_cputime_showstat_202404) true)
+(expandtypeattribute (proc_uid_io_stats_202404) true)
+(expandtypeattribute (proc_uid_procstat_set_202404) true)
+(expandtypeattribute (proc_uid_time_in_state_202404) true)
+(expandtypeattribute (proc_uptime_202404) true)
+(expandtypeattribute (proc_vendor_sched_202404) true)
+(expandtypeattribute (proc_version_202404) true)
+(expandtypeattribute (proc_vmallocinfo_202404) true)
+(expandtypeattribute (proc_vmstat_202404) true)
+(expandtypeattribute (proc_watermark_boost_factor_202404) true)
+(expandtypeattribute (proc_watermark_scale_factor_202404) true)
+(expandtypeattribute (proc_zoneinfo_202404) true)
+(expandtypeattribute (processinfo_service_202404) true)
+(expandtypeattribute (procstats_service_202404) true)
+(expandtypeattribute (profiling_service_202404) true)
+(expandtypeattribute (profman_202404) true)
+(expandtypeattribute (profman_dump_data_file_202404) true)
+(expandtypeattribute (profman_exec_202404) true)
+(expandtypeattribute (properties_device_202404) true)
+(expandtypeattribute (properties_serial_202404) true)
+(expandtypeattribute (property_contexts_file_202404) true)
+(expandtypeattribute (property_data_file_202404) true)
+(expandtypeattribute (property_info_202404) true)
+(expandtypeattribute (property_service_version_prop_202404) true)
+(expandtypeattribute (property_socket_202404) true)
+(expandtypeattribute (provisioned_prop_202404) true)
+(expandtypeattribute (pstorefs_202404) true)
+(expandtypeattribute (ptmx_device_202404) true)
+(expandtypeattribute (qemu_hw_prop_202404) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_202404) true)
+(expandtypeattribute (qtaguid_device_202404) true)
+(expandtypeattribute (quick_start_prop_202404) true)
+(expandtypeattribute (racoon_socket_202404) true)
+(expandtypeattribute (radio_202404) true)
+(expandtypeattribute (radio_control_prop_202404) true)
+(expandtypeattribute (radio_core_data_file_202404) true)
+(expandtypeattribute (radio_data_file_202404) true)
+(expandtypeattribute (radio_device_202404) true)
+(expandtypeattribute (radio_prop_202404) true)
+(expandtypeattribute (radio_service_202404) true)
+(expandtypeattribute (ram_device_202404) true)
+(expandtypeattribute (random_device_202404) true)
+(expandtypeattribute (reboot_readiness_service_202404) true)
+(expandtypeattribute (rebootescrow_hal_prop_202404) true)
+(expandtypeattribute (recovery_202404) true)
+(expandtypeattribute (recovery_block_device_202404) true)
+(expandtypeattribute (recovery_config_prop_202404) true)
+(expandtypeattribute (recovery_data_file_202404) true)
+(expandtypeattribute (recovery_persist_202404) true)
+(expandtypeattribute (recovery_persist_exec_202404) true)
+(expandtypeattribute (recovery_refresh_202404) true)
+(expandtypeattribute (recovery_refresh_exec_202404) true)
+(expandtypeattribute (recovery_service_202404) true)
+(expandtypeattribute (recovery_socket_202404) true)
+(expandtypeattribute (recovery_usb_config_prop_202404) true)
+(expandtypeattribute (registry_service_202404) true)
+(expandtypeattribute (remote_auth_service_202404) true)
+(expandtypeattribute (remote_provisioning_service_202404) true)
+(expandtypeattribute (repair_mode_metadata_file_202404) true)
+(expandtypeattribute (resourcecache_data_file_202404) true)
+(expandtypeattribute (resources_manager_service_202404) true)
+(expandtypeattribute (restorecon_prop_202404) true)
+(expandtypeattribute (restrictions_service_202404) true)
+(expandtypeattribute (retaildemo_prop_202404) true)
+(expandtypeattribute (rild_debug_socket_202404) true)
+(expandtypeattribute (rild_socket_202404) true)
+(expandtypeattribute (ringtone_file_202404) true)
+(expandtypeattribute (rkpdapp_202404) true)
+(expandtypeattribute (role_service_202404) true)
+(expandtypeattribute (rollback_service_202404) true)
+(expandtypeattribute (root_block_device_202404) true)
+(expandtypeattribute (rootdisk_sysdev_202404) true)
+(expandtypeattribute (rootfs_202404) true)
+(expandtypeattribute (rpmsg_device_202404) true)
+(expandtypeattribute (rs_202404) true)
+(expandtypeattribute (rs_exec_202404) true)
+(expandtypeattribute (rss_hwm_reset_202404) true)
+(expandtypeattribute (rtc_device_202404) true)
+(expandtypeattribute (rttmanager_service_202404) true)
+(expandtypeattribute (runas_202404) true)
+(expandtypeattribute (runas_app_202404) true)
+(expandtypeattribute (runas_exec_202404) true)
+(expandtypeattribute (runtime_event_log_tags_file_202404) true)
+(expandtypeattribute (runtime_service_202404) true)
+(expandtypeattribute (safemode_prop_202404) true)
+(expandtypeattribute (same_process_hal_file_202404) true)
+(expandtypeattribute (samplingprofiler_service_202404) true)
+(expandtypeattribute (scheduling_policy_service_202404) true)
+(expandtypeattribute (sdcard_block_device_202404) true)
+(expandtypeattribute (sdcardd_202404) true)
+(expandtypeattribute (sdcardd_exec_202404) true)
+(expandtypeattribute (sdcardfs_202404) true)
+(expandtypeattribute (sdk_sandbox_service_202404) true)
+(expandtypeattribute (seapp_contexts_file_202404) true)
+(expandtypeattribute (search_service_202404) true)
+(expandtypeattribute (search_ui_service_202404) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_202404) true)
+(expandtypeattribute (secure_element_202404) true)
+(expandtypeattribute (secure_element_device_202404) true)
+(expandtypeattribute (secure_element_service_202404) true)
+(expandtypeattribute (security_state_service_202404) true)
+(expandtypeattribute (securityfs_202404) true)
+(expandtypeattribute (selection_toolbar_service_202404) true)
+(expandtypeattribute (selinuxfs_202404) true)
+(expandtypeattribute (sendbug_config_prop_202404) true)
+(expandtypeattribute (sensitive_content_protection_service_202404) true)
+(expandtypeattribute (sensor_privacy_service_202404) true)
+(expandtypeattribute (sensors_device_202404) true)
+(expandtypeattribute (sensorservice_service_202404) true)
+(expandtypeattribute (sepolicy_file_202404) true)
+(expandtypeattribute (serial_device_202404) true)
+(expandtypeattribute (serial_service_202404) true)
+(expandtypeattribute (serialno_prop_202404) true)
+(expandtypeattribute (server_configurable_flags_data_file_202404) true)
+(expandtypeattribute (service_contexts_file_202404) true)
+(expandtypeattribute (service_manager_service_202404) true)
+(expandtypeattribute (service_manager_vndservice_202404) true)
+(expandtypeattribute (servicediscovery_service_202404) true)
+(expandtypeattribute (servicemanager_202404) true)
+(expandtypeattribute (servicemanager_exec_202404) true)
+(expandtypeattribute (servicemanager_prop_202404) true)
+(expandtypeattribute (settings_service_202404) true)
+(expandtypeattribute (setupwizard_mode_prop_202404) true)
+(expandtypeattribute (sgdisk_202404) true)
+(expandtypeattribute (sgdisk_exec_202404) true)
+(expandtypeattribute (shared_relro_202404) true)
+(expandtypeattribute (shared_relro_file_202404) true)
+(expandtypeattribute (shell_202404) true)
+(expandtypeattribute (shell_data_file_202404) true)
+(expandtypeattribute (shell_exec_202404) true)
+(expandtypeattribute (shell_prop_202404) true)
+(expandtypeattribute (shell_test_data_file_202404) true)
+(expandtypeattribute (shm_202404) true)
+(expandtypeattribute (shortcut_manager_icons_202404) true)
+(expandtypeattribute (shortcut_service_202404) true)
+(expandtypeattribute (shutdown_checkpoints_system_data_file_202404) true)
+(expandtypeattribute (simpleperf_202404) true)
+(expandtypeattribute (simpleperf_app_runner_202404) true)
+(expandtypeattribute (simpleperf_app_runner_exec_202404) true)
+(expandtypeattribute (slice_service_202404) true)
+(expandtypeattribute (slideshow_202404) true)
+(expandtypeattribute (smart_idle_maint_enabled_prop_202404) true)
+(expandtypeattribute (smartspace_service_202404) true)
+(expandtypeattribute (snapshotctl_log_data_file_202404) true)
+(expandtypeattribute (snapuserd_log_data_file_202404) true)
+(expandtypeattribute (snapuserd_proxy_socket_202404) true)
+(expandtypeattribute (snapuserd_socket_202404) true)
+(expandtypeattribute (soc_prop_202404) true)
+(expandtypeattribute (socket_device_202404) true)
+(expandtypeattribute (socket_hook_prop_202404) true)
+(expandtypeattribute (sockfs_202404) true)
+(expandtypeattribute (sota_prop_202404) true)
+(expandtypeattribute (soundtrigger_middleware_service_202404) true)
+(expandtypeattribute (speech_recognition_service_202404) true)
+(expandtypeattribute (sqlite_log_prop_202404) true)
+(expandtypeattribute (staged_install_file_202404) true)
+(expandtypeattribute (staging_data_file_202404) true)
+(expandtypeattribute (stats_config_data_file_202404) true)
+(expandtypeattribute (stats_data_file_202404) true)
+(expandtypeattribute (statsd_202404) true)
+(expandtypeattribute (statsd_exec_202404) true)
+(expandtypeattribute (statsdw_socket_202404) true)
+(expandtypeattribute (statusbar_service_202404) true)
+(expandtypeattribute (storage_config_prop_202404) true)
+(expandtypeattribute (storage_file_202404) true)
+(expandtypeattribute (storage_stub_file_202404) true)
+(expandtypeattribute (storaged_service_202404) true)
+(expandtypeattribute (storagemanager_config_prop_202404) true)
+(expandtypeattribute (storagestats_service_202404) true)
+(expandtypeattribute (su_202404) true)
+(expandtypeattribute (su_exec_202404) true)
+(expandtypeattribute (super_block_device_202404) true)
+(expandtypeattribute (surfaceflinger_202404) true)
+(expandtypeattribute (surfaceflinger_color_prop_202404) true)
+(expandtypeattribute (surfaceflinger_display_prop_202404) true)
+(expandtypeattribute (surfaceflinger_prop_202404) true)
+(expandtypeattribute (surfaceflinger_service_202404) true)
+(expandtypeattribute (surfaceflinger_tmpfs_202404) true)
+(expandtypeattribute (suspend_prop_202404) true)
+(expandtypeattribute (swap_block_device_202404) true)
+(expandtypeattribute (sysfs_202404) true)
+(expandtypeattribute (sysfs_android_usb_202404) true)
+(expandtypeattribute (sysfs_batteryinfo_202404) true)
+(expandtypeattribute (sysfs_bluetooth_writable_202404) true)
+(expandtypeattribute (sysfs_devfreq_cur_202404) true)
+(expandtypeattribute (sysfs_devfreq_dir_202404) true)
+(expandtypeattribute (sysfs_devices_block_202404) true)
+(expandtypeattribute (sysfs_devices_cs_etm_202404) true)
+(expandtypeattribute (sysfs_devices_system_cpu_202404) true)
+(expandtypeattribute (sysfs_dm_202404) true)
+(expandtypeattribute (sysfs_dm_verity_202404) true)
+(expandtypeattribute (sysfs_dma_heap_202404) true)
+(expandtypeattribute (sysfs_dmabuf_stats_202404) true)
+(expandtypeattribute (sysfs_dt_firmware_android_202404) true)
+(expandtypeattribute (sysfs_extcon_202404) true)
+(expandtypeattribute (sysfs_fs_ext4_features_202404) true)
+(expandtypeattribute (sysfs_fs_f2fs_202404) true)
+(expandtypeattribute (sysfs_fs_fuse_bpf_202404) true)
+(expandtypeattribute (sysfs_fs_fuse_features_202404) true)
+(expandtypeattribute (sysfs_fs_incfs_features_202404) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_202404) true)
+(expandtypeattribute (sysfs_gpu_202404) true)
+(expandtypeattribute (sysfs_hwrandom_202404) true)
+(expandtypeattribute (sysfs_ion_202404) true)
+(expandtypeattribute (sysfs_ipv4_202404) true)
+(expandtypeattribute (sysfs_kernel_notes_202404) true)
+(expandtypeattribute (sysfs_leds_202404) true)
+(expandtypeattribute (sysfs_loop_202404) true)
+(expandtypeattribute (sysfs_lowmemorykiller_202404) true)
+(expandtypeattribute (sysfs_lru_gen_enabled_202404) true)
+(expandtypeattribute (sysfs_net_202404) true)
+(expandtypeattribute (sysfs_nfc_power_writable_202404) true)
+(expandtypeattribute (sysfs_power_202404) true)
+(expandtypeattribute (sysfs_rtc_202404) true)
+(expandtypeattribute (sysfs_suspend_stats_202404) true)
+(expandtypeattribute (sysfs_switch_202404) true)
+(expandtypeattribute (sysfs_sync_on_suspend_202404) true)
+(expandtypeattribute (sysfs_thermal_202404) true)
+(expandtypeattribute (sysfs_transparent_hugepage_202404) true)
+(expandtypeattribute (sysfs_uhid_202404) true)
+(expandtypeattribute (sysfs_uio_202404) true)
+(expandtypeattribute (sysfs_usb_202404) true)
+(expandtypeattribute (sysfs_usermodehelper_202404) true)
+(expandtypeattribute (sysfs_vendor_sched_202404) true)
+(expandtypeattribute (sysfs_vibrator_202404) true)
+(expandtypeattribute (sysfs_wake_lock_202404) true)
+(expandtypeattribute (sysfs_wakeup_202404) true)
+(expandtypeattribute (sysfs_wakeup_reasons_202404) true)
+(expandtypeattribute (sysfs_wlan_fwpath_202404) true)
+(expandtypeattribute (sysfs_zram_202404) true)
+(expandtypeattribute (sysfs_zram_uevent_202404) true)
+(expandtypeattribute (system_app_202404) true)
+(expandtypeattribute (system_app_data_file_202404) true)
+(expandtypeattribute (system_app_service_202404) true)
+(expandtypeattribute (system_asan_options_file_202404) true)
+(expandtypeattribute (system_block_device_202404) true)
+(expandtypeattribute (system_boot_reason_prop_202404) true)
+(expandtypeattribute (system_bootstrap_lib_file_202404) true)
+(expandtypeattribute (system_config_service_202404) true)
+(expandtypeattribute (system_data_file_202404) true)
+(expandtypeattribute (system_data_root_file_202404) true)
+(expandtypeattribute (system_dlkm_file_202404) true)
+(expandtypeattribute (system_event_log_tags_file_202404) true)
+(expandtypeattribute (system_file_202404) true)
+(expandtypeattribute (system_group_file_202404) true)
+(expandtypeattribute (system_jvmti_agent_prop_202404) true)
+(expandtypeattribute (system_lib_file_202404) true)
+(expandtypeattribute (system_linker_config_file_202404) true)
+(expandtypeattribute (system_linker_exec_202404) true)
+(expandtypeattribute (system_lmk_prop_202404) true)
+(expandtypeattribute (system_ndebug_socket_202404) true)
+(expandtypeattribute (system_net_netd_hwservice_202404) true)
+(expandtypeattribute (system_net_netd_service_202404) true)
+(expandtypeattribute (system_passwd_file_202404) true)
+(expandtypeattribute (system_prop_202404) true)
+(expandtypeattribute (system_seccomp_policy_file_202404) true)
+(expandtypeattribute (system_security_cacerts_file_202404) true)
+(expandtypeattribute (system_server_202404) true)
+(expandtypeattribute (system_server_dumper_service_202404) true)
+(expandtypeattribute (system_server_tmpfs_202404) true)
+(expandtypeattribute (system_suspend_control_internal_service_202404) true)
+(expandtypeattribute (system_suspend_control_service_202404) true)
+(expandtypeattribute (system_suspend_hwservice_202404) true)
+(expandtypeattribute (system_trace_prop_202404) true)
+(expandtypeattribute (system_unsolzygote_socket_202404) true)
+(expandtypeattribute (system_update_service_202404) true)
+(expandtypeattribute (system_user_mode_emulation_prop_202404) true)
+(expandtypeattribute (system_userdir_file_202404) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_202404) true)
+(expandtypeattribute (system_wpa_socket_202404) true)
+(expandtypeattribute (system_zoneinfo_file_202404) true)
+(expandtypeattribute (systemkeys_data_file_202404) true)
+(expandtypeattribute (systemsound_config_prop_202404) true)
+(expandtypeattribute (tare_service_202404) true)
+(expandtypeattribute (task_profiles_api_file_202404) true)
+(expandtypeattribute (task_profiles_file_202404) true)
+(expandtypeattribute (task_service_202404) true)
+(expandtypeattribute (tcpdump_exec_202404) true)
+(expandtypeattribute (tee_202404) true)
+(expandtypeattribute (tee_data_file_202404) true)
+(expandtypeattribute (tee_device_202404) true)
+(expandtypeattribute (telecom_service_202404) true)
+(expandtypeattribute (telephony_config_prop_202404) true)
+(expandtypeattribute (telephony_status_prop_202404) true)
+(expandtypeattribute (test_boot_reason_prop_202404) true)
+(expandtypeattribute (test_harness_prop_202404) true)
+(expandtypeattribute (testharness_service_202404) true)
+(expandtypeattribute (tethering_service_202404) true)
+(expandtypeattribute (textclassification_service_202404) true)
+(expandtypeattribute (textclassifier_data_file_202404) true)
+(expandtypeattribute (textservices_service_202404) true)
+(expandtypeattribute (texttospeech_service_202404) true)
+(expandtypeattribute (theme_prop_202404) true)
+(expandtypeattribute (thermal_service_202404) true)
+(expandtypeattribute (threadnetwork_config_prop_202404) true)
+(expandtypeattribute (threadnetwork_service_202404) true)
+(expandtypeattribute (time_prop_202404) true)
+(expandtypeattribute (timedetector_service_202404) true)
+(expandtypeattribute (timezone_prop_202404) true)
+(expandtypeattribute (timezonedetector_service_202404) true)
+(expandtypeattribute (tmpfs_202404) true)
+(expandtypeattribute (tombstone_config_prop_202404) true)
+(expandtypeattribute (tombstone_data_file_202404) true)
+(expandtypeattribute (tombstone_wifi_data_file_202404) true)
+(expandtypeattribute (tombstoned_202404) true)
+(expandtypeattribute (tombstoned_crash_socket_202404) true)
+(expandtypeattribute (tombstoned_exec_202404) true)
+(expandtypeattribute (tombstoned_intercept_socket_202404) true)
+(expandtypeattribute (tombstoned_java_trace_socket_202404) true)
+(expandtypeattribute (toolbox_202404) true)
+(expandtypeattribute (toolbox_exec_202404) true)
+(expandtypeattribute (trace_data_file_202404) true)
+(expandtypeattribute (traced_202404) true)
+(expandtypeattribute (traced_consumer_socket_202404) true)
+(expandtypeattribute (traced_enabled_prop_202404) true)
+(expandtypeattribute (traced_lazy_prop_202404) true)
+(expandtypeattribute (traced_oome_heap_session_count_prop_202404) true)
+(expandtypeattribute (traced_perf_202404) true)
+(expandtypeattribute (traced_perf_socket_202404) true)
+(expandtypeattribute (traced_probes_202404) true)
+(expandtypeattribute (traced_producer_socket_202404) true)
+(expandtypeattribute (traced_tmpfs_202404) true)
+(expandtypeattribute (traceur_app_202404) true)
+(expandtypeattribute (translation_service_202404) true)
+(expandtypeattribute (trust_service_202404) true)
+(expandtypeattribute (tty_device_202404) true)
+(expandtypeattribute (tun_device_202404) true)
+(expandtypeattribute (tuner_config_prop_202404) true)
+(expandtypeattribute (tv_ad_service_202404) true)
+(expandtypeattribute (tv_iapp_service_202404) true)
+(expandtypeattribute (tv_input_service_202404) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_202404) true)
+(expandtypeattribute (ublk_block_device_202404) true)
+(expandtypeattribute (ublk_control_device_202404) true)
+(expandtypeattribute (ueventd_202404) true)
+(expandtypeattribute (ueventd_tmpfs_202404) true)
+(expandtypeattribute (uhid_device_202404) true)
+(expandtypeattribute (uimode_service_202404) true)
+(expandtypeattribute (uio_device_202404) true)
+(expandtypeattribute (uncrypt_202404) true)
+(expandtypeattribute (uncrypt_exec_202404) true)
+(expandtypeattribute (uncrypt_socket_202404) true)
+(expandtypeattribute (unencrypted_data_file_202404) true)
+(expandtypeattribute (unlabeled_202404) true)
+(expandtypeattribute (untrusted_app_202404) true)
+(expandtypeattribute (untrusted_app_25_202404) true)
+(expandtypeattribute (untrusted_app_27_202404) true)
+(expandtypeattribute (untrusted_app_29_202404) true)
+(expandtypeattribute (untrusted_app_30_202404) true)
+(expandtypeattribute (untrusted_app_32_202404) true)
+(expandtypeattribute (update_engine_202404) true)
+(expandtypeattribute (update_engine_data_file_202404) true)
+(expandtypeattribute (update_engine_exec_202404) true)
+(expandtypeattribute (update_engine_log_data_file_202404) true)
+(expandtypeattribute (update_engine_service_202404) true)
+(expandtypeattribute (update_engine_stable_service_202404) true)
+(expandtypeattribute (update_verifier_202404) true)
+(expandtypeattribute (update_verifier_exec_202404) true)
+(expandtypeattribute (updatelock_service_202404) true)
+(expandtypeattribute (uri_grants_service_202404) true)
+(expandtypeattribute (usagestats_service_202404) true)
+(expandtypeattribute (usb_config_prop_202404) true)
+(expandtypeattribute (usb_control_prop_202404) true)
+(expandtypeattribute (usb_device_202404) true)
+(expandtypeattribute (usb_prop_202404) true)
+(expandtypeattribute (usb_serial_device_202404) true)
+(expandtypeattribute (usb_service_202404) true)
+(expandtypeattribute (usb_uvc_enabled_prop_202404) true)
+(expandtypeattribute (usbaccessory_device_202404) true)
+(expandtypeattribute (usbd_202404) true)
+(expandtypeattribute (usbd_exec_202404) true)
+(expandtypeattribute (usbfs_202404) true)
+(expandtypeattribute (use_memfd_prop_202404) true)
+(expandtypeattribute (user_profile_data_file_202404) true)
+(expandtypeattribute (user_profile_root_file_202404) true)
+(expandtypeattribute (user_service_202404) true)
+(expandtypeattribute (userdata_block_device_202404) true)
+(expandtypeattribute (userdata_sysdev_202404) true)
+(expandtypeattribute (userdebug_or_eng_prop_202404) true)
+(expandtypeattribute (usermodehelper_202404) true)
+(expandtypeattribute (userspace_reboot_config_prop_202404) true)
+(expandtypeattribute (userspace_reboot_exported_prop_202404) true)
+(expandtypeattribute (userspace_reboot_metadata_file_202404) true)
+(expandtypeattribute (uwb_service_202404) true)
+(expandtypeattribute (vcn_management_service_202404) true)
+(expandtypeattribute (vd_device_202404) true)
+(expandtypeattribute (vdc_202404) true)
+(expandtypeattribute (vdc_exec_202404) true)
+(expandtypeattribute (vehicle_hal_prop_202404) true)
+(expandtypeattribute (vendor_apex_file_202404) true)
+(expandtypeattribute (vendor_apex_metadata_file_202404) true)
+(expandtypeattribute (vendor_app_file_202404) true)
+(expandtypeattribute (vendor_cgroup_desc_file_202404) true)
+(expandtypeattribute (vendor_configs_file_202404) true)
+(expandtypeattribute (vendor_data_file_202404) true)
+(expandtypeattribute (vendor_default_prop_202404) true)
+(expandtypeattribute (vendor_file_202404) true)
+(expandtypeattribute (vendor_framework_file_202404) true)
+(expandtypeattribute (vendor_hal_file_202404) true)
+(expandtypeattribute (vendor_idc_file_202404) true)
+(expandtypeattribute (vendor_init_202404) true)
+(expandtypeattribute (vendor_kernel_modules_202404) true)
+(expandtypeattribute (vendor_keychars_file_202404) true)
+(expandtypeattribute (vendor_keylayout_file_202404) true)
+(expandtypeattribute (vendor_microdroid_file_202404) true)
+(expandtypeattribute (vendor_misc_writer_202404) true)
+(expandtypeattribute (vendor_misc_writer_exec_202404) true)
+(expandtypeattribute (vendor_modprobe_202404) true)
+(expandtypeattribute (vendor_overlay_file_202404) true)
+(expandtypeattribute (vendor_public_framework_file_202404) true)
+(expandtypeattribute (vendor_public_lib_file_202404) true)
+(expandtypeattribute (vendor_security_patch_level_prop_202404) true)
+(expandtypeattribute (vendor_service_contexts_file_202404) true)
+(expandtypeattribute (vendor_shell_202404) true)
+(expandtypeattribute (vendor_shell_exec_202404) true)
+(expandtypeattribute (vendor_socket_hook_prop_202404) true)
+(expandtypeattribute (vendor_task_profiles_file_202404) true)
+(expandtypeattribute (vendor_toolbox_exec_202404) true)
+(expandtypeattribute (vendor_userdir_file_202404) true)
+(expandtypeattribute (vendor_uuid_mapping_config_file_202404) true)
+(expandtypeattribute (vendor_vm_data_file_202404) true)
+(expandtypeattribute (vendor_vm_file_202404) true)
+(expandtypeattribute (vfat_202404) true)
+(expandtypeattribute (vfio_device_202404) true)
+(expandtypeattribute (vibrator_manager_service_202404) true)
+(expandtypeattribute (vibrator_service_202404) true)
+(expandtypeattribute (video_device_202404) true)
+(expandtypeattribute (virtual_ab_prop_202404) true)
+(expandtypeattribute (virtual_camera_service_202404) true)
+(expandtypeattribute (virtual_device_native_service_202404) true)
+(expandtypeattribute (virtual_device_service_202404) true)
+(expandtypeattribute (virtual_face_hal_prop_202404) true)
+(expandtypeattribute (virtual_fingerprint_hal_prop_202404) true)
+(expandtypeattribute (virtual_touchpad_202404) true)
+(expandtypeattribute (virtual_touchpad_exec_202404) true)
+(expandtypeattribute (virtual_touchpad_service_202404) true)
+(expandtypeattribute (virtualization_service_202404) true)
+(expandtypeattribute (vndbinder_device_202404) true)
+(expandtypeattribute (vndk_prop_202404) true)
+(expandtypeattribute (vndk_sp_file_202404) true)
+(expandtypeattribute (vndservice_contexts_file_202404) true)
+(expandtypeattribute (vndservicemanager_202404) true)
+(expandtypeattribute (voiceinteraction_service_202404) true)
+(expandtypeattribute (vold_202404) true)
+(expandtypeattribute (vold_config_prop_202404) true)
+(expandtypeattribute (vold_data_file_202404) true)
+(expandtypeattribute (vold_device_202404) true)
+(expandtypeattribute (vold_exec_202404) true)
+(expandtypeattribute (vold_metadata_file_202404) true)
+(expandtypeattribute (vold_post_fs_data_prop_202404) true)
+(expandtypeattribute (vold_prepare_subdirs_202404) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_202404) true)
+(expandtypeattribute (vold_prop_202404) true)
+(expandtypeattribute (vold_service_202404) true)
+(expandtypeattribute (vold_status_prop_202404) true)
+(expandtypeattribute (vpn_data_file_202404) true)
+(expandtypeattribute (vpn_management_service_202404) true)
+(expandtypeattribute (vr_hwc_service_202404) true)
+(expandtypeattribute (vr_manager_service_202404) true)
+(expandtypeattribute (vrflinger_vsync_service_202404) true)
+(expandtypeattribute (vts_config_prop_202404) true)
+(expandtypeattribute (vts_status_prop_202404) true)
+(expandtypeattribute (wallpaper_effects_generation_service_202404) true)
+(expandtypeattribute (wallpaper_file_202404) true)
+(expandtypeattribute (wallpaper_service_202404) true)
+(expandtypeattribute (watchdog_device_202404) true)
+(expandtypeattribute (watchdog_metadata_file_202404) true)
+(expandtypeattribute (watchdogd_202404) true)
+(expandtypeattribute (watchdogd_exec_202404) true)
+(expandtypeattribute (webview_zygote_202404) true)
+(expandtypeattribute (webview_zygote_exec_202404) true)
+(expandtypeattribute (webview_zygote_tmpfs_202404) true)
+(expandtypeattribute (webviewupdate_service_202404) true)
+(expandtypeattribute (wifi_config_prop_202404) true)
+(expandtypeattribute (wifi_data_file_202404) true)
+(expandtypeattribute (wifi_hal_prop_202404) true)
+(expandtypeattribute (wifi_key_202404) true)
+(expandtypeattribute (wifi_log_prop_202404) true)
+(expandtypeattribute (wifi_prop_202404) true)
+(expandtypeattribute (wifi_service_202404) true)
+(expandtypeattribute (wifiaware_service_202404) true)
+(expandtypeattribute (wificond_202404) true)
+(expandtypeattribute (wificond_exec_202404) true)
+(expandtypeattribute (wifinl80211_service_202404) true)
+(expandtypeattribute (wifip2p_service_202404) true)
+(expandtypeattribute (wifiscanner_service_202404) true)
+(expandtypeattribute (window_service_202404) true)
+(expandtypeattribute (wpa_socket_202404) true)
+(expandtypeattribute (zero_device_202404) true)
+(expandtypeattribute (zoned_block_device_202404) true)
+(expandtypeattribute (zram_config_prop_202404) true)
+(expandtypeattribute (zram_control_prop_202404) true)
+(expandtypeattribute (zygote_202404) true)
+(expandtypeattribute (zygote_config_prop_202404) true)
+(expandtypeattribute (zygote_exec_202404) true)
+(expandtypeattribute (zygote_socket_202404) true)
+(expandtypeattribute (zygote_tmpfs_202404) true)
+(typeattributeset DockObserver_service_202404 (DockObserver_service))
+(typeattributeset IProxyService_service_202404 (IProxyService_service))
+(typeattributeset aac_drc_prop_202404 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_202404 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_202404 (ab_update_gki_prop))
+(typeattributeset accessibility_service_202404 (accessibility_service))
+(typeattributeset account_service_202404 (account_service))
+(typeattributeset aconfig_storage_flags_metadata_file_202404 (aconfig_storage_flags_metadata_file))
+(typeattributeset aconfig_storage_metadata_file_202404 (aconfig_storage_metadata_file))
+(typeattributeset activity_service_202404 (activity_service))
+(typeattributeset activity_task_service_202404 (activity_task_service))
+(typeattributeset adaptive_haptics_prop_202404 (adaptive_haptics_prop))
+(typeattributeset adb_data_file_202404 (adb_data_file))
+(typeattributeset adb_keys_file_202404 (adb_keys_file))
+(typeattributeset adb_service_202404 (adb_service))
+(typeattributeset adbd_202404 (adbd))
+(typeattributeset adbd_config_prop_202404 (adbd_config_prop))
+(typeattributeset adbd_exec_202404 (adbd_exec))
+(typeattributeset adbd_socket_202404 (adbd_socket))
+(typeattributeset adservices_manager_service_202404 (adservices_manager_service))
+(typeattributeset aidl_lazy_test_server_202404 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_202404 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_202404 (aidl_lazy_test_service))
+(typeattributeset alarm_service_202404 (alarm_service))
+(typeattributeset anr_data_file_202404 (anr_data_file))
+(typeattributeset apc_service_202404 (apc_service))
+(typeattributeset apex_data_file_202404 (apex_data_file))
+(typeattributeset apex_info_file_202404 (apex_info_file))
+(typeattributeset apex_metadata_file_202404 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_202404 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_202404 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_202404 (apex_ota_reserved_file))
+(typeattributeset apex_ready_prop_202404 (apex_ready_prop))
+(typeattributeset apex_rollback_data_file_202404 (apex_rollback_data_file))
+(typeattributeset apex_service_202404 (apex_service))
+(typeattributeset apex_system_server_data_file_202404 (apex_system_server_data_file))
+(typeattributeset apexd_202404 (apexd))
+(typeattributeset apexd_config_prop_202404 (apexd_config_prop))
+(typeattributeset apexd_exec_202404 (apexd_exec))
+(typeattributeset apexd_prop_202404 (apexd_prop))
+(typeattributeset apexd_select_prop_202404 (apexd_select_prop))
+(typeattributeset apk_data_file_202404 (apk_data_file))
+(typeattributeset apk_private_data_file_202404 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_202404 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_202404 (apk_tmp_file))
+(typeattributeset apk_verity_prop_202404 (apk_verity_prop))
+(typeattributeset app_binding_service_202404 (app_binding_service))
+(typeattributeset app_data_file_202404 (app_data_file))
+(typeattributeset app_fuse_file_202404 (app_fuse_file))
+(typeattributeset app_fusefs_202404 (app_fusefs))
+(typeattributeset app_hibernation_service_202404 (app_hibernation_service))
+(typeattributeset app_integrity_service_202404 (app_integrity_service))
+(typeattributeset app_prediction_service_202404 (app_prediction_service))
+(typeattributeset app_search_service_202404 (app_search_service))
+(typeattributeset app_zygote_202404 (app_zygote))
+(typeattributeset app_zygote_tmpfs_202404 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_202404 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_202404 (appdomain_tmpfs))
+(typeattributeset appops_service_202404 (appops_service))
+(typeattributeset appwidget_service_202404 (appwidget_service))
+(typeattributeset archive_service_202404 (archive_service))
+(typeattributeset arm64_memtag_prop_202404 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_202404 (art_apex_dir))
+(typeattributeset artd_202404 (artd))
+(typeattributeset artd_pre_reboot_service_202404 (artd_pre_reboot_service))
+(typeattributeset artd_service_202404 (artd_service))
+(typeattributeset asec_apk_file_202404 (asec_apk_file))
+(typeattributeset asec_image_file_202404 (asec_image_file))
+(typeattributeset asec_public_file_202404 (asec_public_file))
+(typeattributeset ashmem_device_202404 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_202404 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_202404 (assetatlas_service))
+(typeattributeset atrace_202404 (atrace))
+(typeattributeset attestation_verification_service_202404 (attestation_verification_service))
+(typeattributeset audio_config_prop_202404 (audio_config_prop))
+(typeattributeset audio_data_file_202404 (audio_data_file))
+(typeattributeset audio_device_202404 (audio_device))
+(typeattributeset audio_prop_202404 (audio_prop))
+(typeattributeset audio_service_202404 (audio_service))
+(typeattributeset audiohal_data_file_202404 (audiohal_data_file))
+(typeattributeset audioserver_202404 (audioserver))
+(typeattributeset audioserver_data_file_202404 (audioserver_data_file))
+(typeattributeset audioserver_service_202404 (audioserver_service))
+(typeattributeset audioserver_tmpfs_202404 (audioserver_tmpfs))
+(typeattributeset auth_service_202404 (auth_service))
+(typeattributeset authorization_service_202404 (authorization_service))
+(typeattributeset autofill_service_202404 (autofill_service))
+(typeattributeset backup_data_file_202404 (backup_data_file))
+(typeattributeset backup_service_202404 (backup_service))
+(typeattributeset battery_service_202404 (battery_service))
+(typeattributeset batteryproperties_service_202404 (batteryproperties_service))
+(typeattributeset batterystats_service_202404 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_202404 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_202404 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_202404 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_202404 (binder_calls_stats_service))
+(typeattributeset binder_device_202404 (binder_device))
+(typeattributeset binderfs_202404 (binderfs))
+(typeattributeset binderfs_features_202404 (binderfs_features))
+(typeattributeset binderfs_logs_202404 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_202404 (binderfs_logs_proc))
+(typeattributeset binderfs_logs_stats_202404 (binderfs_logs_stats))
+(typeattributeset binfmt_miscfs_202404 (binfmt_miscfs))
+(typeattributeset biometric_service_202404 (biometric_service))
+(typeattributeset blkid_202404 (blkid))
+(typeattributeset blkid_untrusted_202404 (blkid_untrusted))
+(typeattributeset blob_store_service_202404 (blob_store_service))
+(typeattributeset block_device_202404 (block_device))
+(typeattributeset bluetooth_202404 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_202404 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_202404 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_config_prop_202404 (bluetooth_config_prop))
+(typeattributeset bluetooth_data_file_202404 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_202404 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_202404 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_202404 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_202404 (bluetooth_prop))
+(typeattributeset bluetooth_service_202404 (bluetooth_service))
+(typeattributeset bluetooth_socket_202404 (bluetooth_socket))
+(typeattributeset boot_block_device_202404 (boot_block_device))
+(typeattributeset boot_status_prop_202404 (boot_status_prop))
+(typeattributeset bootanim_202404 (bootanim))
+(typeattributeset bootanim_config_prop_202404 (bootanim_config_prop))
+(typeattributeset bootanim_exec_202404 (bootanim_exec))
+(typeattributeset bootanim_oem_file_202404 (bootanim_oem_file))
+(typeattributeset bootanim_system_prop_202404 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_202404 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_202404 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_202404 (bootloader_prop))
+(typeattributeset bootstat_202404 (bootstat))
+(typeattributeset bootstat_data_file_202404 (bootstat_data_file))
+(typeattributeset bootstat_exec_202404 (bootstat_exec))
+(typeattributeset boottime_prop_202404 (boottime_prop))
+(typeattributeset boottime_public_prop_202404 (boottime_public_prop))
+(typeattributeset boottrace_data_file_202404 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_202404 (bpf_progs_loaded_prop))
+(typeattributeset bpfloader_202404 (bpfloader))
+(typeattributeset bq_config_prop_202404 (bq_config_prop))
+(typeattributeset broadcastradio_service_202404 (broadcastradio_service))
+(typeattributeset bt_device_202404 (bt_device))
+(typeattributeset bufferhubd_202404 (bufferhubd))
+(typeattributeset bufferhubd_exec_202404 (bufferhubd_exec))
+(typeattributeset bugreport_service_202404 (bugreport_service))
+(typeattributeset build_attestation_prop_202404 (build_attestation_prop))
+(typeattributeset build_bootimage_prop_202404 (build_bootimage_prop))
+(typeattributeset build_config_prop_202404 (build_config_prop))
+(typeattributeset build_odm_prop_202404 (build_odm_prop))
+(typeattributeset build_prop_202404 (build_prop))
+(typeattributeset build_vendor_prop_202404 (build_vendor_prop))
+(typeattributeset cache_backup_file_202404 (cache_backup_file))
+(typeattributeset cache_block_device_202404 (cache_block_device))
+(typeattributeset cache_file_202404 (cache_file))
+(typeattributeset cache_private_backup_file_202404 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_202404 (cache_recovery_file))
+(typeattributeset cacheinfo_service_202404 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_202404 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_202404 (camera_calibration_prop))
+(typeattributeset camera_config_prop_202404 (camera_config_prop))
+(typeattributeset camera_data_file_202404 (camera_data_file))
+(typeattributeset camera_device_202404 (camera_device))
+(typeattributeset cameraproxy_service_202404 (cameraproxy_service))
+(typeattributeset cameraserver_202404 (cameraserver))
+(typeattributeset cameraserver_exec_202404 (cameraserver_exec))
+(typeattributeset cameraserver_service_202404 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_202404 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_202404 (camerax_extensions_prop))
+(typeattributeset cgroup_202404 (cgroup))
+(typeattributeset cgroup_desc_api_file_202404 (cgroup_desc_api_file))
+(typeattributeset cgroup_desc_file_202404 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_202404 (cgroup_rc_file))
+(typeattributeset cgroup_v2_202404 (cgroup_v2))
+(typeattributeset charger_202404 (charger))
+(typeattributeset charger_config_prop_202404 (charger_config_prop))
+(typeattributeset charger_exec_202404 (charger_exec))
+(typeattributeset charger_prop_202404 (charger_prop))
+(typeattributeset charger_status_prop_202404 (charger_status_prop))
+(typeattributeset charger_vendor_202404 (charger_vendor))
+(typeattributeset clipboard_service_202404 (clipboard_service))
+(typeattributeset cloudsearch_service_202404 (cloudsearch_service))
+(typeattributeset codec2_config_prop_202404 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_202404 (cold_boot_done_prop))
+(typeattributeset color_display_service_202404 (color_display_service))
+(typeattributeset companion_device_service_202404 (companion_device_service))
+(typeattributeset composd_vm_art_prop_202404 (composd_vm_art_prop))
+(typeattributeset composd_vm_vendor_prop_202404 (composd_vm_vendor_prop))
+(typeattributeset config_prop_202404 (config_prop))
+(typeattributeset configfs_202404 (configfs))
+(typeattributeset connectivity_native_service_202404 (connectivity_native_service))
+(typeattributeset connectivity_service_202404 (connectivity_service))
+(typeattributeset connmetrics_service_202404 (connmetrics_service))
+(typeattributeset console_device_202404 (console_device))
+(typeattributeset consumer_ir_service_202404 (consumer_ir_service))
+(typeattributeset content_capture_service_202404 (content_capture_service))
+(typeattributeset content_service_202404 (content_service))
+(typeattributeset content_suggestions_service_202404 (content_suggestions_service))
+(typeattributeset contexthub_service_202404 (contexthub_service))
+(typeattributeset contextual_search_service_202404 (contextual_search_service))
+(typeattributeset coredump_file_202404 (coredump_file))
+(typeattributeset country_detector_service_202404 (country_detector_service))
+(typeattributeset coverage_service_202404 (coverage_service))
+(typeattributeset cppreopt_prop_202404 (cppreopt_prop))
+(typeattributeset cpu_monitor_service_202404 (cpu_monitor_service))
+(typeattributeset cpu_variant_prop_202404 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_202404 (cpuinfo_service))
+(typeattributeset crash_dump_202404 (crash_dump))
+(typeattributeset crash_dump_exec_202404 (crash_dump_exec))
+(typeattributeset credential_service_202404 (credential_service))
+(typeattributeset credstore_202404 (credstore))
+(typeattributeset credstore_data_file_202404 (credstore_data_file))
+(typeattributeset credstore_exec_202404 (credstore_exec))
+(typeattributeset credstore_service_202404 (credstore_service))
+(typeattributeset crossprofileapps_service_202404 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_202404 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_202404 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_202404 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_202404 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_202404 (ctl_console_prop))
+(typeattributeset ctl_default_prop_202404 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_202404 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_202404 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_202404 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_202404 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_202404 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_202404 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_202404 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_202404 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_202404 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_202404 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_202404 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_202404 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_202404 (dalvik_config_prop))
+(typeattributeset dalvik_dynamic_config_prop_202404 (dalvik_dynamic_config_prop))
+(typeattributeset dalvik_prop_202404 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_202404 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_202404 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_202404 (dataloader_manager_service))
+(typeattributeset dbinfo_service_202404 (dbinfo_service))
+(typeattributeset dck_prop_202404 (dck_prop))
+(typeattributeset debug_prop_202404 (debug_prop))
+(typeattributeset debugfs_202404 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_202404 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_202404 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_202404 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_202404 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_202404 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_202404 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_202404 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_202404 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_202404 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_202404 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_202404 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_202404 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_202404 (debuggerd_prop))
+(typeattributeset default_android_hwservice_202404 (default_android_hwservice))
+(typeattributeset default_android_service_202404 (default_android_service))
+(typeattributeset default_android_vndservice_202404 (default_android_vndservice))
+(typeattributeset default_prop_202404 (default_prop))
+(typeattributeset dev_cpu_variant_202404 (dev_cpu_variant))
+(typeattributeset device_202404 (device))
+(typeattributeset device_config_aconfig_flags_prop_202404 (device_config_aconfig_flags_prop))
+(typeattributeset device_config_activity_manager_native_boot_prop_202404 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_202404 (device_config_boot_count_prop))
+(typeattributeset device_config_camera_native_prop_202404 (device_config_camera_native_prop))
+(typeattributeset device_config_edgetpu_native_prop_202404 (device_config_edgetpu_native_prop))
+(typeattributeset device_config_input_native_boot_prop_202404 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_202404 (device_config_media_native_prop))
+(typeattributeset device_config_memory_safety_native_boot_prop_202404 (device_config_memory_safety_native_boot_prop))
+(typeattributeset device_config_memory_safety_native_prop_202404 (device_config_memory_safety_native_prop))
+(typeattributeset device_config_netd_native_prop_202404 (device_config_netd_native_prop))
+(typeattributeset device_config_nnapi_native_prop_202404 (device_config_nnapi_native_prop))
+(typeattributeset device_config_reset_performed_prop_202404 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_202404 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_202404 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_202404 (device_config_service))
+(typeattributeset device_config_surface_flinger_native_boot_prop_202404 (device_config_surface_flinger_native_boot_prop))
+(typeattributeset device_config_updatable_service_202404 (device_config_updatable_service))
+(typeattributeset device_config_vendor_system_native_boot_prop_202404 (device_config_vendor_system_native_boot_prop))
+(typeattributeset device_config_vendor_system_native_prop_202404 (device_config_vendor_system_native_prop))
+(typeattributeset device_identifiers_service_202404 (device_identifiers_service))
+(typeattributeset device_logging_prop_202404 (device_logging_prop))
+(typeattributeset device_policy_service_202404 (device_policy_service))
+(typeattributeset device_state_service_202404 (device_state_service))
+(typeattributeset deviceidle_service_202404 (deviceidle_service))
+(typeattributeset devicelock_service_202404 (devicelock_service))
+(typeattributeset devicestoragemonitor_service_202404 (devicestoragemonitor_service))
+(typeattributeset devpts_202404 (devpts))
+(typeattributeset dexopt_chroot_setup_service_202404 (dexopt_chroot_setup_service))
+(typeattributeset dhcp_202404 (dhcp))
+(typeattributeset dhcp_data_file_202404 (dhcp_data_file))
+(typeattributeset dhcp_exec_202404 (dhcp_exec))
+(typeattributeset dhcp_prop_202404 (dhcp_prop))
+(typeattributeset diskstats_service_202404 (diskstats_service))
+(typeattributeset display_service_202404 (display_service))
+(typeattributeset dm_device_202404 (dm_device))
+(typeattributeset dm_user_device_202404 (dm_user_device))
+(typeattributeset dmabuf_heap_device_202404 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_202404 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_202404 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_202404 (dnsmasq))
+(typeattributeset dnsmasq_exec_202404 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_202404 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_202404 (dnsresolver_service))
+(typeattributeset domain_verification_service_202404 (domain_verification_service))
+(typeattributeset dreams_service_202404 (dreams_service))
+(typeattributeset drm_data_file_202404 (drm_data_file))
+(typeattributeset drm_forcel3_prop_202404 (drm_forcel3_prop))
+(typeattributeset drm_service_config_prop_202404 (drm_service_config_prop))
+(typeattributeset drmserver_202404 (drmserver))
+(typeattributeset drmserver_exec_202404 (drmserver_exec))
+(typeattributeset drmserver_service_202404 (drmserver_service))
+(typeattributeset drmserver_socket_202404 (drmserver_socket))
+(typeattributeset dropbox_data_file_202404 (dropbox_data_file))
+(typeattributeset dropbox_service_202404 (dropbox_service))
+(typeattributeset dtbo_block_device_202404 (dtbo_block_device))
+(typeattributeset dumpstate_202404 (dumpstate))
+(typeattributeset dumpstate_exec_202404 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_202404 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_202404 (dumpstate_prop))
+(typeattributeset dumpstate_service_202404 (dumpstate_service))
+(typeattributeset dumpstate_socket_202404 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_202404 (dynamic_system_prop))
+(typeattributeset e2fs_202404 (e2fs))
+(typeattributeset e2fs_exec_202404 (e2fs_exec))
+(typeattributeset ecm_enhanced_confirmation_service_202404 (ecm_enhanced_confirmation_service))
+(typeattributeset efs_file_202404 (efs_file))
+(typeattributeset emergency_affordance_service_202404 (emergency_affordance_service))
+(typeattributeset ephemeral_app_202404 (ephemeral_app))
+(typeattributeset ethernet_service_202404 (ethernet_service))
+(typeattributeset evsmanagerd_202404 (evsmanagerd))
+(typeattributeset evsmanagerd_service_202404 (evsmanagerd_service))
+(typeattributeset exfat_202404 (exfat))
+(typeattributeset exported3_system_prop_202404 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_202404 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_202404 (exported_camera_prop))
+(typeattributeset exported_config_prop_202404 (exported_config_prop))
+(typeattributeset exported_default_prop_202404 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_202404 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_202404 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_202404 (exported_pm_prop))
+(typeattributeset exported_secure_prop_202404 (exported_secure_prop))
+(typeattributeset exported_system_prop_202404 (exported_system_prop))
+(typeattributeset external_vibrator_service_202404 (external_vibrator_service))
+(typeattributeset extra_free_kbytes_202404 (extra_free_kbytes))
+(typeattributeset extra_free_kbytes_exec_202404 (extra_free_kbytes_exec))
+(typeattributeset face_service_202404 (face_service))
+(typeattributeset face_vendor_data_file_202404 (face_vendor_data_file))
+(typeattributeset fastbootd_202404 (fastbootd))
+(typeattributeset ffs_config_prop_202404 (ffs_config_prop))
+(typeattributeset ffs_control_prop_202404 (ffs_control_prop))
+(typeattributeset file_contexts_file_202404 (file_contexts_file))
+(typeattributeset file_integrity_service_202404 (file_integrity_service))
+(typeattributeset fingerprint_prop_202404 (fingerprint_prop))
+(typeattributeset fingerprint_service_202404 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_202404 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_202404 (fingerprintd))
+(typeattributeset fingerprintd_data_file_202404 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_202404 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_202404 (fingerprintd_service))
+(typeattributeset firstboot_prop_202404 (firstboot_prop))
+(typeattributeset flags_health_check_202404 (flags_health_check))
+(typeattributeset flags_health_check_exec_202404 (flags_health_check_exec))
+(typeattributeset font_service_202404 (font_service))
+(typeattributeset framework_status_prop_202404 (framework_status_prop))
+(typeattributeset framework_watchdog_config_prop_202404 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_202404 (frp_block_device))
+(typeattributeset fs_bpf_202404 (fs_bpf))
+(typeattributeset fs_bpf_tethering_202404 (fs_bpf_tethering))
+(typeattributeset fs_bpf_vendor_202404 (fs_bpf_vendor))
+(typeattributeset fsck_202404 (fsck))
+(typeattributeset fsck_exec_202404 (fsck_exec))
+(typeattributeset fsck_untrusted_202404 (fsck_untrusted))
+(typeattributeset fscklogs_202404 (fscklogs))
+(typeattributeset functionfs_202404 (functionfs))
+(typeattributeset fuse_202404 (fuse))
+(typeattributeset fuse_device_202404 (fuse_device))
+(typeattributeset fuseblk_202404 (fuseblk))
+(typeattributeset fusectlfs_202404 (fusectlfs))
+(typeattributeset future_pm_prop_202404 (future_pm_prop))
+(typeattributeset fwk_altitude_service_202404 (fwk_altitude_service))
+(typeattributeset fwk_automotive_display_hwservice_202404 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_automotive_display_service_202404 (fwk_automotive_display_service))
+(typeattributeset fwk_bufferhub_hwservice_202404 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_202404 (fwk_camera_hwservice))
+(typeattributeset fwk_camera_service_202404 (fwk_camera_service))
+(typeattributeset fwk_display_hwservice_202404 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_202404 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_202404 (fwk_sensor_hwservice))
+(typeattributeset fwk_sensor_service_202404 (fwk_sensor_service))
+(typeattributeset fwk_stats_hwservice_202404 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_202404 (fwk_stats_service))
+(typeattributeset fwk_vibrator_control_service_202404 (fwk_vibrator_control_service))
+(typeattributeset fwmarkd_socket_202404 (fwmarkd_socket))
+(typeattributeset game_mode_intervention_list_file_202404 (game_mode_intervention_list_file))
+(typeattributeset game_service_202404 (game_service))
+(typeattributeset gatekeeper_data_file_202404 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_202404 (gatekeeper_service))
+(typeattributeset gatekeeperd_202404 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_202404 (gatekeeperd_exec))
+(typeattributeset gesture_prop_202404 (gesture_prop))
+(typeattributeset gfxinfo_service_202404 (gfxinfo_service))
+(typeattributeset gmscore_app_202404 (gmscore_app))
+(typeattributeset gnss_device_202404 (gnss_device))
+(typeattributeset gnss_time_update_service_202404 (gnss_time_update_service))
+(typeattributeset gps_control_202404 (gps_control))
+(typeattributeset gpu_device_202404 (gpu_device))
+(typeattributeset gpu_service_202404 (gpu_service))
+(typeattributeset gpuservice_202404 (gpuservice))
+(typeattributeset grammatical_inflection_service_202404 (grammatical_inflection_service))
+(typeattributeset graphics_config_prop_202404 (graphics_config_prop))
+(typeattributeset graphics_config_writable_prop_202404 (graphics_config_writable_prop))
+(typeattributeset graphics_device_202404 (graphics_device))
+(typeattributeset graphicsstats_service_202404 (graphicsstats_service))
+(typeattributeset gsi_data_file_202404 (gsi_data_file))
+(typeattributeset gsi_metadata_file_202404 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_202404 (gsi_public_metadata_file))
+(typeattributeset gwp_asan_prop_202404 (gwp_asan_prop))
+(typeattributeset hal_atrace_hwservice_202404 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_202404 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_202404 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_202404 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_202404 (hal_audiocontrol_service))
+(typeattributeset hal_authgraph_service_202404 (hal_authgraph_service))
+(typeattributeset hal_authsecret_hwservice_202404 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_202404 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_202404 (hal_bluetooth_hwservice))
+(typeattributeset hal_bluetooth_service_202404 (hal_bluetooth_service))
+(typeattributeset hal_bootctl_hwservice_202404 (hal_bootctl_hwservice))
+(typeattributeset hal_bootctl_service_202404 (hal_bootctl_service))
+(typeattributeset hal_broadcastradio_hwservice_202404 (hal_broadcastradio_hwservice))
+(typeattributeset hal_broadcastradio_service_202404 (hal_broadcastradio_service))
+(typeattributeset hal_camera_hwservice_202404 (hal_camera_hwservice))
+(typeattributeset hal_camera_service_202404 (hal_camera_service))
+(typeattributeset hal_can_bus_hwservice_202404 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_202404 (hal_can_controller_hwservice))
+(typeattributeset hal_can_controller_service_202404 (hal_can_controller_service))
+(typeattributeset hal_cas_hwservice_202404 (hal_cas_hwservice))
+(typeattributeset hal_cas_service_202404 (hal_cas_service))
+(typeattributeset hal_codec2_hwservice_202404 (hal_codec2_hwservice))
+(typeattributeset hal_codec2_service_202404 (hal_codec2_service))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_202404 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_202404 (hal_confirmationui_hwservice))
+(typeattributeset hal_confirmationui_service_202404 (hal_confirmationui_service))
+(typeattributeset hal_contexthub_hwservice_202404 (hal_contexthub_hwservice))
+(typeattributeset hal_contexthub_service_202404 (hal_contexthub_service))
+(typeattributeset hal_drm_hwservice_202404 (hal_drm_hwservice))
+(typeattributeset hal_drm_service_202404 (hal_drm_service))
+(typeattributeset hal_dumpstate_config_prop_202404 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_202404 (hal_dumpstate_hwservice))
+(typeattributeset hal_dumpstate_service_202404 (hal_dumpstate_service))
+(typeattributeset hal_evs_hwservice_202404 (hal_evs_hwservice))
+(typeattributeset hal_evs_service_202404 (hal_evs_service))
+(typeattributeset hal_face_hwservice_202404 (hal_face_hwservice))
+(typeattributeset hal_face_service_202404 (hal_face_service))
+(typeattributeset hal_fastboot_service_202404 (hal_fastboot_service))
+(typeattributeset hal_fingerprint_hwservice_202404 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_202404 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_202404 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gatekeeper_service_202404 (hal_gatekeeper_service))
+(typeattributeset hal_gnss_hwservice_202404 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_202404 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_202404 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_allocator_service_202404 (hal_graphics_allocator_service))
+(typeattributeset hal_graphics_composer_hwservice_202404 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_202404 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_composer_service_202404 (hal_graphics_composer_service))
+(typeattributeset hal_graphics_mapper_hwservice_202404 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_graphics_mapper_service_202404 (hal_graphics_mapper_service))
+(typeattributeset hal_health_hwservice_202404 (hal_health_hwservice))
+(typeattributeset hal_health_service_202404 (hal_health_service))
+(typeattributeset hal_health_storage_hwservice_202404 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_202404 (hal_health_storage_service))
+(typeattributeset hal_identity_service_202404 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_202404 (hal_input_classifier_hwservice))
+(typeattributeset hal_input_processor_service_202404 (hal_input_processor_service))
+(typeattributeset hal_instrumentation_prop_202404 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_202404 (hal_ir_hwservice))
+(typeattributeset hal_ir_service_202404 (hal_ir_service))
+(typeattributeset hal_ivn_service_202404 (hal_ivn_service))
+(typeattributeset hal_keymaster_hwservice_202404 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_202404 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_202404 (hal_light_hwservice))
+(typeattributeset hal_light_service_202404 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_202404 (hal_lowpan_hwservice))
+(typeattributeset hal_macsec_service_202404 (hal_macsec_service))
+(typeattributeset hal_memtrack_hwservice_202404 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_202404 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_202404 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_202404 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_202404 (hal_nfc_hwservice))
+(typeattributeset hal_nfc_service_202404 (hal_nfc_service))
+(typeattributeset hal_nlinterceptor_service_202404 (hal_nlinterceptor_service))
+(typeattributeset hal_oemlock_hwservice_202404 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_202404 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_202404 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_202404 (hal_power_hwservice))
+(typeattributeset hal_power_service_202404 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_202404 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_202404 (hal_power_stats_service))
+(typeattributeset hal_radio_service_202404 (hal_radio_service))
+(typeattributeset hal_rebootescrow_service_202404 (hal_rebootescrow_service))
+(typeattributeset hal_remoteaccess_service_202404 (hal_remoteaccess_service))
+(typeattributeset hal_remotelyprovisionedcomponent_avf_service_202404 (hal_remotelyprovisionedcomponent_avf_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_202404 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_202404 (hal_renderscript_hwservice))
+(typeattributeset hal_secretkeeper_service_202404 (hal_secretkeeper_service))
+(typeattributeset hal_secure_element_hwservice_202404 (hal_secure_element_hwservice))
+(typeattributeset hal_secure_element_service_202404 (hal_secure_element_service))
+(typeattributeset hal_secureclock_service_202404 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_202404 (hal_sensors_hwservice))
+(typeattributeset hal_sensors_service_202404 (hal_sensors_service))
+(typeattributeset hal_sharedsecret_service_202404 (hal_sharedsecret_service))
+(typeattributeset hal_system_suspend_service_202404 (hal_system_suspend_service))
+(typeattributeset hal_telephony_hwservice_202404 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_202404 (hal_tetheroffload_hwservice))
+(typeattributeset hal_tetheroffload_service_202404 (hal_tetheroffload_service))
+(typeattributeset hal_thermal_hwservice_202404 (hal_thermal_hwservice))
+(typeattributeset hal_thermal_service_202404 (hal_thermal_service))
+(typeattributeset hal_threadnetwork_service_202404 (hal_threadnetwork_service))
+(typeattributeset hal_tv_cec_hwservice_202404 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_hdmi_cec_service_202404 (hal_tv_hdmi_cec_service))
+(typeattributeset hal_tv_hdmi_connection_service_202404 (hal_tv_hdmi_connection_service))
+(typeattributeset hal_tv_hdmi_earc_service_202404 (hal_tv_hdmi_earc_service))
+(typeattributeset hal_tv_input_hwservice_202404 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_input_service_202404 (hal_tv_input_service))
+(typeattributeset hal_tv_tuner_hwservice_202404 (hal_tv_tuner_hwservice))
+(typeattributeset hal_tv_tuner_service_202404 (hal_tv_tuner_service))
+(typeattributeset hal_usb_gadget_hwservice_202404 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_gadget_service_202404 (hal_usb_gadget_service))
+(typeattributeset hal_usb_hwservice_202404 (hal_usb_hwservice))
+(typeattributeset hal_usb_service_202404 (hal_usb_service))
+(typeattributeset hal_uwb_service_202404 (hal_uwb_service))
+(typeattributeset hal_vehicle_hwservice_202404 (hal_vehicle_hwservice))
+(typeattributeset hal_vehicle_service_202404 (hal_vehicle_service))
+(typeattributeset hal_vibrator_hwservice_202404 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_202404 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_202404 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_202404 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_202404 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_202404 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hostapd_service_202404 (hal_wifi_hostapd_service))
+(typeattributeset hal_wifi_hwservice_202404 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_service_202404 (hal_wifi_service))
+(typeattributeset hal_wifi_supplicant_hwservice_202404 (hal_wifi_supplicant_hwservice))
+(typeattributeset hal_wifi_supplicant_service_202404 (hal_wifi_supplicant_service))
+(typeattributeset hardware_properties_service_202404 (hardware_properties_service))
+(typeattributeset hardware_service_202404 (hardware_service))
+(typeattributeset hci_attach_dev_202404 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_202404 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_202404 (hdmi_control_service))
+(typeattributeset healthconnect_service_202404 (healthconnect_service))
+(typeattributeset healthd_202404 (healthd))
+(typeattributeset heapdump_data_file_202404 (heapdump_data_file))
+(typeattributeset heapprofd_202404 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_202404 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_202404 (heapprofd_prop))
+(typeattributeset heapprofd_socket_202404 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_202404 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_202404 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_202404 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_202404 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_202404 (hidl_token_hwservice))
+(typeattributeset hidraw_device_202404 (hidraw_device vendor_hidraw_device))
+(typeattributeset hint_service_202404 (hint_service))
+(typeattributeset hw_random_device_202404 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_202404 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_202404 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_202404 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_202404 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_202404 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_202404 (hwservicemanager_prop))
+(typeattributeset hypervisor_prop_202404 (hypervisor_prop))
+(typeattributeset hypervisor_restricted_prop_202404 (hypervisor_restricted_prop))
+(typeattributeset icon_file_202404 (icon_file))
+(typeattributeset idmap_202404 (idmap))
+(typeattributeset idmap_exec_202404 (idmap_exec))
+(typeattributeset idmap_service_202404 (idmap_service))
+(typeattributeset iio_device_202404 (iio_device))
+(typeattributeset imms_service_202404 (imms_service))
+(typeattributeset incident_202404 (incident))
+(typeattributeset incident_data_file_202404 (incident_data_file))
+(typeattributeset incident_helper_202404 (incident_helper))
+(typeattributeset incident_service_202404 (incident_service))
+(typeattributeset incidentd_202404 (incidentd))
+(typeattributeset incremental_control_file_202404 (incremental_control_file))
+(typeattributeset incremental_prop_202404 (incremental_prop))
+(typeattributeset incremental_service_202404 (incremental_service))
+(typeattributeset init_202404 (init))
+(typeattributeset init_exec_202404 (init_exec))
+(typeattributeset init_service_status_prop_202404 (init_service_status_prop))
+(typeattributeset init_tmpfs_202404 (init_tmpfs))
+(typeattributeset inotify_202404 (inotify))
+(typeattributeset input_device_202404 (input_device))
+(typeattributeset input_device_config_prop_202404 (input_device_config_prop))
+(typeattributeset input_method_service_202404 (input_method_service))
+(typeattributeset input_service_202404 (input_service))
+(typeattributeset inputflinger_202404 (inputflinger))
+(typeattributeset inputflinger_exec_202404 (inputflinger_exec))
+(typeattributeset inputflinger_service_202404 (inputflinger_service))
+(typeattributeset install_data_file_202404 (install_data_file))
+(typeattributeset installd_202404 (installd))
+(typeattributeset installd_exec_202404 (installd_exec))
+(typeattributeset installd_service_202404 (installd_service))
+(typeattributeset ion_device_202404 (ion_device))
+(typeattributeset ipsec_service_202404 (ipsec_service))
+(typeattributeset iris_service_202404 (iris_service))
+(typeattributeset iris_vendor_data_file_202404 (iris_vendor_data_file))
+(typeattributeset isolated_app_202404 (isolated_app))
+(typeattributeset isolated_compute_app_202404 (isolated_compute_app))
+(typeattributeset jobscheduler_service_202404 (jobscheduler_service))
+(typeattributeset kernel_202404 (kernel))
+(typeattributeset keychain_data_file_202404 (keychain_data_file))
+(typeattributeset keychord_device_202404 (keychord_device))
+(typeattributeset keyguard_config_prop_202404 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_202404 (keystore2_key_contexts_file))
+(typeattributeset keystore_202404 (keystore))
+(typeattributeset keystore_compat_hal_service_202404 (keystore_compat_hal_service))
+(typeattributeset keystore_config_prop_202404 (keystore_config_prop))
+(typeattributeset keystore_data_file_202404 (keystore_data_file))
+(typeattributeset keystore_exec_202404 (keystore_exec))
+(typeattributeset keystore_maintenance_service_202404 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_202404 (keystore_metrics_service))
+(typeattributeset keystore_service_202404 (keystore_service))
+(typeattributeset kmsg_debug_device_202404 (kmsg_debug_device))
+(typeattributeset kmsg_device_202404 (kmsg_device))
+(typeattributeset labeledfs_202404 (labeledfs))
+(typeattributeset launcherapps_service_202404 (launcherapps_service))
+(typeattributeset legacy_permission_service_202404 (legacy_permission_service))
+(typeattributeset legacykeystore_service_202404 (legacykeystore_service))
+(typeattributeset libc_debug_prop_202404 (libc_debug_prop))
+(typeattributeset light_service_202404 (light_service))
+(typeattributeset linkerconfig_file_202404 (linkerconfig_file))
+(typeattributeset llkd_202404 (llkd))
+(typeattributeset llkd_exec_202404 (llkd_exec))
+(typeattributeset llkd_prop_202404 (llkd_prop))
+(typeattributeset lmkd_202404 (lmkd))
+(typeattributeset lmkd_config_prop_202404 (lmkd_config_prop))
+(typeattributeset lmkd_exec_202404 (lmkd_exec))
+(typeattributeset lmkd_prop_202404 (lmkd_prop))
+(typeattributeset lmkd_socket_202404 (lmkd_socket))
+(typeattributeset locale_prop_202404 (locale_prop))
+(typeattributeset locale_service_202404 (locale_service))
+(typeattributeset location_service_202404 (location_service))
+(typeattributeset location_time_zone_manager_service_202404 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_202404 (lock_settings_service))
+(typeattributeset log_prop_202404 (log_prop))
+(typeattributeset log_tag_prop_202404 (log_tag_prop))
+(typeattributeset logcat_exec_202404 (logcat_exec))
+(typeattributeset logd_202404 (logd))
+(typeattributeset logd_exec_202404 (logd_exec))
+(typeattributeset logd_prop_202404 (logd_prop))
+(typeattributeset logd_socket_202404 (logd_socket))
+(typeattributeset logdr_socket_202404 (logdr_socket))
+(typeattributeset logdw_socket_202404 (logdw_socket))
+(typeattributeset logpersist_202404 (logpersist))
+(typeattributeset logpersistd_logging_prop_202404 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_202404 (loop_control_device))
+(typeattributeset loop_device_202404 (loop_device))
+(typeattributeset looper_stats_service_202404 (looper_stats_service))
+(typeattributeset lowpan_device_202404 (lowpan_device))
+(typeattributeset lowpan_prop_202404 (lowpan_prop))
+(typeattributeset lpdump_service_202404 (lpdump_service))
+(typeattributeset lpdumpd_prop_202404 (lpdumpd_prop))
+(typeattributeset mac_perms_file_202404 (mac_perms_file))
+(typeattributeset mdns_service_202404 (mdns_service))
+(typeattributeset mdns_socket_202404 (mdns_socket))
+(typeattributeset mdnsd_202404 (mdnsd))
+(typeattributeset mdnsd_socket_202404 (mdnsd_socket))
+(typeattributeset media_communication_service_202404 (media_communication_service))
+(typeattributeset media_config_prop_202404 (media_config_prop))
+(typeattributeset media_data_file_202404 (media_data_file))
+(typeattributeset media_metrics_service_202404 (media_metrics_service))
+(typeattributeset media_projection_service_202404 (media_projection_service))
+(typeattributeset media_router_service_202404 (media_router_service))
+(typeattributeset media_rw_data_file_202404 (media_rw_data_file))
+(typeattributeset media_session_service_202404 (media_session_service))
+(typeattributeset media_userdir_file_202404 (media_userdir_file))
+(typeattributeset media_variant_prop_202404 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_202404 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_202404 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_202404 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_202404 (mediadrmserver_service))
+(typeattributeset mediaextractor_202404 (mediaextractor))
+(typeattributeset mediaextractor_exec_202404 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_202404 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_202404 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_202404 (mediametrics))
+(typeattributeset mediametrics_exec_202404 (mediametrics_exec))
+(typeattributeset mediametrics_service_202404 (mediametrics_service))
+(typeattributeset mediaprovider_202404 (mediaprovider))
+(typeattributeset mediaserver_202404 (mediaserver))
+(typeattributeset mediaserver_exec_202404 (mediaserver_exec))
+(typeattributeset mediaserver_service_202404 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_202404 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_202404 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_202404 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_202404 (mediatranscoding))
+(typeattributeset mediatranscoding_service_202404 (mediatranscoding_service))
+(typeattributeset meminfo_service_202404 (meminfo_service))
+(typeattributeset memtrackproxy_service_202404 (memtrackproxy_service))
+(typeattributeset metadata_block_device_202404 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_202404 (metadata_bootstat_file))
+(typeattributeset metadata_file_202404 (metadata_file))
+(typeattributeset method_trace_data_file_202404 (method_trace_data_file))
+(typeattributeset midi_service_202404 (midi_service))
+(typeattributeset mirror_data_file_202404 (mirror_data_file))
+(typeattributeset misc_block_device_202404 (misc_block_device))
+(typeattributeset misc_logd_file_202404 (misc_logd_file))
+(typeattributeset misc_user_data_file_202404 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_202404 (mm_events_config_prop))
+(typeattributeset mmc_prop_202404 (mmc_prop))
+(typeattributeset mnt_expand_file_202404 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_202404 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_202404 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_202404 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_202404 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_202404 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_202404 (mnt_user_file))
+(typeattributeset mnt_vendor_file_202404 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_202404 (mock_ota_prop))
+(typeattributeset modprobe_202404 (modprobe))
+(typeattributeset module_sdkextensions_prop_202404 (module_sdkextensions_prop))
+(typeattributeset mount_service_202404 (mount_service))
+(typeattributeset mqueue_202404 (mqueue))
+(typeattributeset mtp_202404 (mtp))
+(typeattributeset mtp_device_202404 (mtp_device))
+(typeattributeset mtpd_socket_202404 (mtpd_socket))
+(typeattributeset music_recognition_service_202404 (music_recognition_service))
+(typeattributeset nativetest_data_file_202404 (nativetest_data_file))
+(typeattributeset nearby_service_202404 (nearby_service))
+(typeattributeset net_data_file_202404 (net_data_file))
+(typeattributeset net_dns_prop_202404 (net_dns_prop))
+(typeattributeset net_radio_prop_202404 (net_radio_prop))
+(typeattributeset netd_202404 (netd))
+(typeattributeset netd_exec_202404 (netd_exec))
+(typeattributeset netd_listener_service_202404 (netd_listener_service))
+(typeattributeset netd_service_202404 (netd_service))
+(typeattributeset netif_202404 (netif))
+(typeattributeset netpolicy_service_202404 (netpolicy_service))
+(typeattributeset netstats_service_202404 (netstats_service))
+(typeattributeset netutils_wrapper_202404 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_202404 (netutils_wrapper_exec))
+(typeattributeset network_management_service_202404 (network_management_service))
+(typeattributeset network_score_service_202404 (network_score_service))
+(typeattributeset network_stack_202404 (network_stack))
+(typeattributeset network_stack_service_202404 (network_stack_service))
+(typeattributeset network_time_update_service_202404 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_202404 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_202404 (network_watchlist_service))
+(typeattributeset nfc_202404 (nfc))
+(typeattributeset nfc_data_file_202404 (nfc_data_file))
+(typeattributeset nfc_device_202404 (nfc_device))
+(typeattributeset nfc_logs_data_file_202404 (nfc_logs_data_file))
+(typeattributeset nfc_prop_202404 (nfc_prop))
+(typeattributeset nfc_service_202404 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_202404 (nnapi_ext_deny_product_prop))
+(typeattributeset node_202404 (node))
+(typeattributeset notification_service_202404 (notification_service))
+(typeattributeset null_device_202404 (null_device))
+(typeattributeset oem_lock_service_202404 (oem_lock_service))
+(typeattributeset oem_unlock_prop_202404 (oem_unlock_prop))
+(typeattributeset oemfs_202404 (oemfs))
+(typeattributeset ondevicepersonalization_system_service_202404 (ondevicepersonalization_system_service))
+(typeattributeset ot_daemon_service_202404 (ot_daemon_service))
+(typeattributeset ot_daemon_socket_202404 (ot_daemon_socket))
+(typeattributeset ota_build_prop_202404 (ota_build_prop))
+(typeattributeset ota_data_file_202404 (ota_data_file))
+(typeattributeset ota_metadata_file_202404 (ota_metadata_file))
+(typeattributeset ota_package_file_202404 (ota_package_file))
+(typeattributeset ota_prop_202404 (ota_prop))
+(typeattributeset otadexopt_service_202404 (otadexopt_service))
+(typeattributeset otapreopt_chroot_202404 (otapreopt_chroot))
+(typeattributeset overlay_prop_202404 (overlay_prop))
+(typeattributeset overlay_service_202404 (overlay_service))
+(typeattributeset overlayfs_file_202404 (overlayfs_file))
+(typeattributeset owntty_device_202404 (owntty_device))
+(typeattributeset pac_proxy_service_202404 (pac_proxy_service))
+(typeattributeset package_native_service_202404 (package_native_service))
+(typeattributeset package_service_202404 (package_service))
+(typeattributeset packagemanager_config_prop_202404 (packagemanager_config_prop))
+(typeattributeset packages_list_file_202404 (packages_list_file))
+(typeattributeset pan_result_prop_202404 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_202404 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_202404 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_202404 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_202404 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_202404 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_202404 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_202404 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_202404 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_202404 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_202404 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_202404 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_202404 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_202404 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_202404 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_202404 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_202404 (pdx_performance_dir))
+(typeattributeset people_service_202404 (people_service))
+(typeattributeset perfetto_202404 (perfetto))
+(typeattributeset performanced_202404 (performanced))
+(typeattributeset performanced_exec_202404 (performanced_exec))
+(typeattributeset permission_checker_service_202404 (permission_checker_service))
+(typeattributeset permission_service_202404 (permission_service))
+(typeattributeset permissionmgr_service_202404 (permissionmgr_service))
+(typeattributeset permissive_mte_prop_202404 (permissive_mte_prop))
+(typeattributeset persist_debug_prop_202404 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_202404 (persist_vendor_debug_wifi_prop))
+(typeattributeset persist_wm_debug_prop_202404 (persist_wm_debug_prop))
+(typeattributeset persistent_data_block_service_202404 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_202404 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_202404 (pinner_service))
+(typeattributeset pipefs_202404 (pipefs))
+(typeattributeset platform_app_202404 (platform_app))
+(typeattributeset platform_compat_service_202404 (platform_compat_service))
+(typeattributeset pm_archiving_enabled_prop_202404 (pm_archiving_enabled_prop))
+(typeattributeset pmsg_device_202404 (pmsg_device))
+(typeattributeset port_202404 (port))
+(typeattributeset port_device_202404 (port_device))
+(typeattributeset postinstall_202404 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_202404 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_202404 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_202404 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_202404 (power_debug_prop))
+(typeattributeset power_service_202404 (power_service))
+(typeattributeset powerctl_prop_202404 (powerctl_prop))
+(typeattributeset powerstats_service_202404 (powerstats_service))
+(typeattributeset ppp_202404 (ppp))
+(typeattributeset preloads_data_file_202404 (preloads_data_file))
+(typeattributeset preloads_media_file_202404 (preloads_media_file))
+(typeattributeset prereboot_data_file_202404 (prereboot_data_file))
+(typeattributeset print_service_202404 (print_service))
+(typeattributeset priv_app_202404 (priv_app))
+(typeattributeset privapp_data_file_202404 (privapp_data_file))
+(typeattributeset prng_seeder_202404 (prng_seeder))
+(typeattributeset proc_202404 (proc))
+(typeattributeset proc_abi_202404 (proc_abi))
+(typeattributeset proc_asound_202404 (proc_asound))
+(typeattributeset proc_bluetooth_writable_202404 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_202404 (proc_bootconfig))
+(typeattributeset proc_bpf_202404 (proc_bpf))
+(typeattributeset proc_buddyinfo_202404 (proc_buddyinfo))
+(typeattributeset proc_cmdline_202404 (proc_cmdline))
+(typeattributeset proc_cpu_alignment_202404 (proc_cpu_alignment))
+(typeattributeset proc_cpuinfo_202404 (proc_cpuinfo))
+(typeattributeset proc_dirty_202404 (proc_dirty))
+(typeattributeset proc_diskstats_202404 (proc_diskstats))
+(typeattributeset proc_drop_caches_202404 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_202404 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_202404 (proc_filesystems))
+(typeattributeset proc_fs_verity_202404 (proc_fs_verity))
+(typeattributeset proc_hostname_202404 (proc_hostname))
+(typeattributeset proc_hung_task_202404 (proc_hung_task))
+(typeattributeset proc_interrupts_202404 (proc_interrupts))
+(typeattributeset proc_iomem_202404 (proc_iomem))
+(typeattributeset proc_kallsyms_202404 (proc_kallsyms))
+(typeattributeset proc_keys_202404 (proc_keys))
+(typeattributeset proc_kmsg_202404 (proc_kmsg))
+(typeattributeset proc_kpageflags_202404 (proc_kpageflags))
+(typeattributeset proc_loadavg_202404 (proc_loadavg))
+(typeattributeset proc_locks_202404 (proc_locks))
+(typeattributeset proc_lowmemorykiller_202404 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_202404 (proc_max_map_count))
+(typeattributeset proc_meminfo_202404 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_202404 (proc_min_free_order_shift))
+(typeattributeset proc_misc_202404 (proc_misc))
+(typeattributeset proc_modules_202404 (proc_modules))
+(typeattributeset proc_mounts_202404 (proc_mounts))
+(typeattributeset proc_net_202404 (proc_net))
+(typeattributeset proc_net_tcp_udp_202404 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_202404 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_202404 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_202404 (proc_pagetypeinfo))
+(typeattributeset proc_panic_202404 (proc_panic))
+(typeattributeset proc_percpu_pagelist_high_fraction_202404 (proc_percpu_pagelist_high_fraction))
+(typeattributeset proc_perf_202404 (proc_perf))
+(typeattributeset proc_pid_max_202404 (proc_pid_max))
+(typeattributeset proc_pipe_conf_202404 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_202404 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_202404 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_202404 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_202404 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_202404 (proc_qtaguid_stat))
+(typeattributeset proc_random_202404 (proc_random))
+(typeattributeset proc_sched_202404 (proc_sched))
+(typeattributeset proc_security_202404 (proc_security))
+(typeattributeset proc_slabinfo_202404 (proc_slabinfo))
+(typeattributeset proc_stat_202404 (proc_stat))
+(typeattributeset proc_swaps_202404 (proc_swaps))
+(typeattributeset proc_sysrq_202404 (proc_sysrq))
+(typeattributeset proc_timer_202404 (proc_timer))
+(typeattributeset proc_tty_drivers_202404 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_202404 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_202404 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_202404 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_202404 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_202404 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_202404 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_202404 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_202404 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_202404 (proc_uptime))
+(typeattributeset proc_vendor_sched_202404 (proc_vendor_sched))
+(typeattributeset proc_version_202404 (proc_version))
+(typeattributeset proc_vmallocinfo_202404 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_202404 (proc_vmstat))
+(typeattributeset proc_watermark_boost_factor_202404 (proc_watermark_boost_factor))
+(typeattributeset proc_watermark_scale_factor_202404 (proc_watermark_scale_factor))
+(typeattributeset proc_zoneinfo_202404 (proc_zoneinfo))
+(typeattributeset processinfo_service_202404 (processinfo_service))
+(typeattributeset procstats_service_202404 (procstats_service))
+(typeattributeset profiling_service_202404 (profiling_service))
+(typeattributeset profman_202404 (profman))
+(typeattributeset profman_dump_data_file_202404 (profman_dump_data_file))
+(typeattributeset profman_exec_202404 (profman_exec))
+(typeattributeset properties_device_202404 (properties_device))
+(typeattributeset properties_serial_202404 (properties_serial))
+(typeattributeset property_contexts_file_202404 (property_contexts_file))
+(typeattributeset property_data_file_202404 (property_data_file))
+(typeattributeset property_info_202404 (property_info))
+(typeattributeset property_service_version_prop_202404 (property_service_version_prop))
+(typeattributeset property_socket_202404 (property_socket))
+(typeattributeset provisioned_prop_202404 (provisioned_prop))
+(typeattributeset pstorefs_202404 (pstorefs))
+(typeattributeset ptmx_device_202404 (ptmx_device))
+(typeattributeset qemu_hw_prop_202404 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_202404 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_202404 (qtaguid_device))
+(typeattributeset quick_start_prop_202404 (quick_start_prop))
+(typeattributeset racoon_socket_202404 (racoon_socket))
+(typeattributeset radio_202404 (radio))
+(typeattributeset radio_control_prop_202404 (radio_control_prop))
+(typeattributeset radio_core_data_file_202404 (radio_core_data_file))
+(typeattributeset radio_data_file_202404 (radio_data_file))
+(typeattributeset radio_device_202404 (radio_device))
+(typeattributeset radio_prop_202404 (radio_prop))
+(typeattributeset radio_service_202404 (radio_service))
+(typeattributeset ram_device_202404 (ram_device))
+(typeattributeset random_device_202404 (random_device))
+(typeattributeset reboot_readiness_service_202404 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_202404 (rebootescrow_hal_prop))
+(typeattributeset recovery_202404 (recovery))
+(typeattributeset recovery_block_device_202404 (recovery_block_device))
+(typeattributeset recovery_config_prop_202404 (recovery_config_prop))
+(typeattributeset recovery_data_file_202404 (recovery_data_file))
+(typeattributeset recovery_persist_202404 (recovery_persist))
+(typeattributeset recovery_persist_exec_202404 (recovery_persist_exec))
+(typeattributeset recovery_refresh_202404 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_202404 (recovery_refresh_exec))
+(typeattributeset recovery_service_202404 (recovery_service))
+(typeattributeset recovery_socket_202404 (recovery_socket))
+(typeattributeset recovery_usb_config_prop_202404 (recovery_usb_config_prop))
+(typeattributeset registry_service_202404 (registry_service))
+(typeattributeset remote_auth_service_202404 (remote_auth_service))
+(typeattributeset remote_provisioning_service_202404 (remote_provisioning_service))
+(typeattributeset repair_mode_metadata_file_202404 (repair_mode_metadata_file))
+(typeattributeset resourcecache_data_file_202404 (resourcecache_data_file))
+(typeattributeset resources_manager_service_202404 (resources_manager_service))
+(typeattributeset restorecon_prop_202404 (restorecon_prop))
+(typeattributeset restrictions_service_202404 (restrictions_service))
+(typeattributeset retaildemo_prop_202404 (retaildemo_prop))
+(typeattributeset rild_debug_socket_202404 (rild_debug_socket))
+(typeattributeset rild_socket_202404 (rild_socket))
+(typeattributeset ringtone_file_202404 (ringtone_file))
+(typeattributeset rkpdapp_202404 (rkpdapp))
+(typeattributeset role_service_202404 (role_service))
+(typeattributeset rollback_service_202404 (rollback_service))
+(typeattributeset root_block_device_202404 (root_block_device))
+(typeattributeset rootdisk_sysdev_202404 (rootdisk_sysdev))
+(typeattributeset rootfs_202404 (rootfs))
+(typeattributeset rpmsg_device_202404 (rpmsg_device))
+(typeattributeset rs_202404 (rs))
+(typeattributeset rs_exec_202404 (rs_exec))
+(typeattributeset rss_hwm_reset_202404 (rss_hwm_reset))
+(typeattributeset rtc_device_202404 (rtc_device))
+(typeattributeset rttmanager_service_202404 (rttmanager_service))
+(typeattributeset runas_202404 (runas))
+(typeattributeset runas_app_202404 (runas_app))
+(typeattributeset runas_exec_202404 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_202404 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_202404 (runtime_service))
+(typeattributeset safemode_prop_202404 (safemode_prop))
+(typeattributeset same_process_hal_file_202404 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_202404 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_202404 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_202404 (sdcard_block_device))
+(typeattributeset sdcardd_202404 (sdcardd))
+(typeattributeset sdcardd_exec_202404 (sdcardd_exec))
+(typeattributeset sdcardfs_202404 (sdcardfs))
+(typeattributeset sdk_sandbox_service_202404 (sdk_sandbox_service))
+(typeattributeset seapp_contexts_file_202404 (seapp_contexts_file))
+(typeattributeset search_service_202404 (search_service))
+(typeattributeset search_ui_service_202404 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_202404 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_202404 (secure_element))
+(typeattributeset secure_element_device_202404 (secure_element_device))
+(typeattributeset secure_element_service_202404 (secure_element_service))
+(typeattributeset security_state_service_202404 (security_state_service))
+(typeattributeset securityfs_202404 (securityfs))
+(typeattributeset selection_toolbar_service_202404 (selection_toolbar_service))
+(typeattributeset selinuxfs_202404 (selinuxfs))
+(typeattributeset sendbug_config_prop_202404 (sendbug_config_prop))
+(typeattributeset sensitive_content_protection_service_202404 (sensitive_content_protection_service))
+(typeattributeset sensor_privacy_service_202404 (sensor_privacy_service))
+(typeattributeset sensors_device_202404 (sensors_device))
+(typeattributeset sensorservice_service_202404 (sensorservice_service))
+(typeattributeset sepolicy_file_202404 (sepolicy_file))
+(typeattributeset serial_device_202404 (serial_device))
+(typeattributeset serial_service_202404 (serial_service))
+(typeattributeset serialno_prop_202404 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_202404 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_202404 (service_contexts_file))
+(typeattributeset service_manager_service_202404 (service_manager_service))
+(typeattributeset service_manager_vndservice_202404 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_202404 (servicediscovery_service))
+(typeattributeset servicemanager_202404 (servicemanager))
+(typeattributeset servicemanager_exec_202404 (servicemanager_exec))
+(typeattributeset servicemanager_prop_202404 (servicemanager_prop))
+(typeattributeset settings_service_202404 (settings_service))
+(typeattributeset setupwizard_mode_prop_202404 (setupwizard_mode_prop))
+(typeattributeset sgdisk_202404 (sgdisk))
+(typeattributeset sgdisk_exec_202404 (sgdisk_exec))
+(typeattributeset shared_relro_202404 (shared_relro))
+(typeattributeset shared_relro_file_202404 (shared_relro_file))
+(typeattributeset shell_202404 (shell))
+(typeattributeset shell_data_file_202404 (shell_data_file))
+(typeattributeset shell_exec_202404 (shell_exec))
+(typeattributeset shell_prop_202404 (shell_prop))
+(typeattributeset shell_test_data_file_202404 (shell_test_data_file))
+(typeattributeset shm_202404 (shm))
+(typeattributeset shortcut_manager_icons_202404 (shortcut_manager_icons))
+(typeattributeset shortcut_service_202404 (shortcut_service))
+(typeattributeset shutdown_checkpoints_system_data_file_202404 (shutdown_checkpoints_system_data_file))
+(typeattributeset simpleperf_202404 (simpleperf))
+(typeattributeset simpleperf_app_runner_202404 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_202404 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_202404 (slice_service))
+(typeattributeset slideshow_202404 (slideshow))
+(typeattributeset smart_idle_maint_enabled_prop_202404 (smart_idle_maint_enabled_prop))
+(typeattributeset smartspace_service_202404 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_202404 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_log_data_file_202404 (snapuserd_log_data_file))
+(typeattributeset snapuserd_proxy_socket_202404 (snapuserd_proxy_socket))
+(typeattributeset snapuserd_socket_202404 (snapuserd_socket))
+(typeattributeset soc_prop_202404 (soc_prop))
+(typeattributeset socket_device_202404 (socket_device))
+(typeattributeset socket_hook_prop_202404 (socket_hook_prop))
+(typeattributeset sockfs_202404 (sockfs))
+(typeattributeset sota_prop_202404 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_202404 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_202404 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_202404 (sqlite_log_prop))
+(typeattributeset staged_install_file_202404 (staged_install_file))
+(typeattributeset staging_data_file_202404 (staging_data_file))
+(typeattributeset stats_config_data_file_202404 (stats_config_data_file))
+(typeattributeset stats_data_file_202404 (stats_data_file))
+(typeattributeset statsd_202404 (statsd))
+(typeattributeset statsd_exec_202404 (statsd_exec))
+(typeattributeset statsdw_socket_202404 (statsdw_socket))
+(typeattributeset statusbar_service_202404 (statusbar_service))
+(typeattributeset storage_config_prop_202404 (storage_config_prop))
+(typeattributeset storage_file_202404 (storage_file))
+(typeattributeset storage_stub_file_202404 (storage_stub_file))
+(typeattributeset storaged_service_202404 (storaged_service))
+(typeattributeset storagemanager_config_prop_202404 (storagemanager_config_prop))
+(typeattributeset storagestats_service_202404 (storagestats_service))
+(typeattributeset su_202404 (su))
+(typeattributeset su_exec_202404 (su_exec))
+(typeattributeset super_block_device_202404 (super_block_device))
+(typeattributeset surfaceflinger_202404 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_202404 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_202404 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_202404 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_202404 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_202404 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_202404 (suspend_prop))
+(typeattributeset swap_block_device_202404 (swap_block_device))
+(typeattributeset sysfs_202404 (sysfs sysfs_mem_sleep sysfs_udc))
+(typeattributeset sysfs_android_usb_202404 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_202404 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_202404 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devfreq_cur_202404 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_202404 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_202404 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_202404 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_202404 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_202404 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_202404 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_202404 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_202404 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_202404 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_202404 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_202404 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_202404 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_fuse_bpf_202404 (sysfs_fs_fuse_bpf))
+(typeattributeset sysfs_fs_fuse_features_202404 (sysfs_fs_fuse_features))
+(typeattributeset sysfs_fs_incfs_features_202404 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_202404 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_gpu_202404 (sysfs_gpu))
+(typeattributeset sysfs_hwrandom_202404 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_202404 (sysfs_ion))
+(typeattributeset sysfs_ipv4_202404 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_202404 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_202404 (sysfs_leds))
+(typeattributeset sysfs_loop_202404 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_202404 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_lru_gen_enabled_202404 (sysfs_lru_gen_enabled))
+(typeattributeset sysfs_net_202404 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_202404 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_202404 (sysfs_power))
+(typeattributeset sysfs_rtc_202404 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_202404 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_202404 (sysfs_switch))
+(typeattributeset sysfs_sync_on_suspend_202404 (sysfs_sync_on_suspend))
+(typeattributeset sysfs_thermal_202404 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_202404 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uhid_202404 (sysfs_uhid))
+(typeattributeset sysfs_uio_202404 (sysfs_uio))
+(typeattributeset sysfs_usb_202404 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_202404 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_202404 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_202404 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_202404 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_202404 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_202404 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_202404 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_202404 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_202404 (sysfs_zram_uevent))
+(typeattributeset system_app_202404 (system_app))
+(typeattributeset system_app_data_file_202404 (system_app_data_file))
+(typeattributeset system_app_service_202404 (system_app_service))
+(typeattributeset system_asan_options_file_202404 (system_asan_options_file))
+(typeattributeset system_block_device_202404 (system_block_device))
+(typeattributeset system_boot_reason_prop_202404 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_202404 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_202404 (system_config_service))
+(typeattributeset system_data_file_202404 (system_data_file))
+(typeattributeset system_data_root_file_202404 (system_data_root_file))
+(typeattributeset system_dlkm_file_202404 (system_dlkm_file))
+(typeattributeset system_event_log_tags_file_202404 (system_event_log_tags_file))
+(typeattributeset system_file_202404 (system_file))
+(typeattributeset system_group_file_202404 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_202404 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_202404 (system_lib_file))
+(typeattributeset system_linker_config_file_202404 (system_linker_config_file))
+(typeattributeset system_linker_exec_202404 (system_linker_exec))
+(typeattributeset system_lmk_prop_202404 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_202404 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_202404 (system_net_netd_hwservice))
+(typeattributeset system_net_netd_service_202404 (system_net_netd_service))
+(typeattributeset system_passwd_file_202404 (system_passwd_file))
+(typeattributeset system_prop_202404 (system_prop))
+(typeattributeset system_seccomp_policy_file_202404 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_202404 (system_security_cacerts_file))
+(typeattributeset system_server_202404 (system_server))
+(typeattributeset system_server_dumper_service_202404 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_202404 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_202404 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_202404 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_202404 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_202404 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_202404 (system_unsolzygote_socket))
+(typeattributeset system_update_service_202404 (system_update_service))
+(typeattributeset system_user_mode_emulation_prop_202404 (system_user_mode_emulation_prop))
+(typeattributeset system_userdir_file_202404 (system_userdir_file))
+(typeattributeset system_wifi_keystore_hwservice_202404 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_202404 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_202404 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_202404 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_202404 (systemsound_config_prop))
+(typeattributeset tare_service_202404 (tare_service))
+(typeattributeset task_profiles_api_file_202404 (task_profiles_api_file))
+(typeattributeset task_profiles_file_202404 (task_profiles_file))
+(typeattributeset task_service_202404 (task_service))
+(typeattributeset tcpdump_exec_202404 (tcpdump_exec))
+(typeattributeset tee_202404 (tee))
+(typeattributeset tee_data_file_202404 (tee_data_file))
+(typeattributeset tee_device_202404 (tee_device))
+(typeattributeset telecom_service_202404 (telecom_service))
+(typeattributeset telephony_config_prop_202404 (telephony_config_prop))
+(typeattributeset telephony_status_prop_202404 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_202404 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_202404 (test_harness_prop))
+(typeattributeset testharness_service_202404 (testharness_service))
+(typeattributeset tethering_service_202404 (tethering_service))
+(typeattributeset textclassification_service_202404 (textclassification_service))
+(typeattributeset textclassifier_data_file_202404 (textclassifier_data_file))
+(typeattributeset textservices_service_202404 (textservices_service))
+(typeattributeset texttospeech_service_202404 (texttospeech_service))
+(typeattributeset theme_prop_202404 (theme_prop))
+(typeattributeset thermal_service_202404 (thermal_service))
+(typeattributeset threadnetwork_config_prop_202404 (threadnetwork_config_prop))
+(typeattributeset threadnetwork_service_202404 (threadnetwork_service))
+(typeattributeset time_prop_202404 (time_prop))
+(typeattributeset timedetector_service_202404 (timedetector_service))
+(typeattributeset timezone_prop_202404 (timezone_prop))
+(typeattributeset timezonedetector_service_202404 (timezonedetector_service))
+(typeattributeset tmpfs_202404 (tmpfs))
+(typeattributeset tombstone_config_prop_202404 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_202404 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_202404 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_202404 (tombstoned))
+(typeattributeset tombstoned_crash_socket_202404 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_202404 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_202404 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_202404 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_202404 (toolbox))
+(typeattributeset toolbox_exec_202404 (toolbox_exec))
+(typeattributeset trace_data_file_202404 (trace_data_file))
+(typeattributeset traced_202404 (traced))
+(typeattributeset traced_consumer_socket_202404 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_202404 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_202404 (traced_lazy_prop))
+(typeattributeset traced_oome_heap_session_count_prop_202404 (traced_oome_heap_session_count_prop))
+(typeattributeset traced_perf_202404 (traced_perf))
+(typeattributeset traced_perf_socket_202404 (traced_perf_socket))
+(typeattributeset traced_probes_202404 (traced_probes))
+(typeattributeset traced_producer_socket_202404 (traced_producer_socket))
+(typeattributeset traced_tmpfs_202404 (traced_tmpfs))
+(typeattributeset traceur_app_202404 (traceur_app))
+(typeattributeset translation_service_202404 (translation_service))
+(typeattributeset trust_service_202404 (trust_service))
+(typeattributeset tty_device_202404 (tty_device))
+(typeattributeset tun_device_202404 (tun_device))
+(typeattributeset tuner_config_prop_202404 (tuner_config_prop))
+(typeattributeset tv_ad_service_202404 (tv_ad_service))
+(typeattributeset tv_iapp_service_202404 (tv_iapp_service))
+(typeattributeset tv_input_service_202404 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_202404 (tv_tuner_resource_mgr_service))
+(typeattributeset ublk_block_device_202404 (ublk_block_device))
+(typeattributeset ublk_control_device_202404 (ublk_control_device))
+(typeattributeset ueventd_202404 (ueventd))
+(typeattributeset ueventd_tmpfs_202404 (ueventd_tmpfs))
+(typeattributeset uhid_device_202404 (uhid_device))
+(typeattributeset uimode_service_202404 (uimode_service))
+(typeattributeset uio_device_202404 (uio_device))
+(typeattributeset uncrypt_202404 (uncrypt))
+(typeattributeset uncrypt_exec_202404 (uncrypt_exec))
+(typeattributeset uncrypt_socket_202404 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_202404 (unencrypted_data_file))
+(typeattributeset unlabeled_202404 (unlabeled))
+(typeattributeset untrusted_app_202404 (untrusted_app))
+(typeattributeset untrusted_app_25_202404 (untrusted_app_25))
+(typeattributeset untrusted_app_27_202404 (untrusted_app_27))
+(typeattributeset untrusted_app_29_202404 (untrusted_app_29))
+(typeattributeset untrusted_app_30_202404 (untrusted_app_30))
+(typeattributeset untrusted_app_32_202404 (untrusted_app_32))
+(typeattributeset update_engine_202404 (update_engine))
+(typeattributeset update_engine_data_file_202404 (update_engine_data_file))
+(typeattributeset update_engine_exec_202404 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_202404 (update_engine_log_data_file))
+(typeattributeset update_engine_service_202404 (update_engine_service))
+(typeattributeset update_engine_stable_service_202404 (update_engine_stable_service))
+(typeattributeset update_verifier_202404 (update_verifier))
+(typeattributeset update_verifier_exec_202404 (update_verifier_exec))
+(typeattributeset updatelock_service_202404 (updatelock_service))
+(typeattributeset uri_grants_service_202404 (uri_grants_service))
+(typeattributeset usagestats_service_202404 (usagestats_service))
+(typeattributeset usb_config_prop_202404 (usb_config_prop))
+(typeattributeset usb_control_prop_202404 (usb_control_prop))
+(typeattributeset usb_device_202404 (usb_device))
+(typeattributeset usb_prop_202404 (usb_prop))
+(typeattributeset usb_serial_device_202404 (usb_serial_device))
+(typeattributeset usb_service_202404 (usb_service))
+(typeattributeset usb_uvc_enabled_prop_202404 (usb_uvc_enabled_prop))
+(typeattributeset usbaccessory_device_202404 (usbaccessory_device))
+(typeattributeset usbd_202404 (usbd))
+(typeattributeset usbd_exec_202404 (usbd_exec))
+(typeattributeset usbfs_202404 (usbfs))
+(typeattributeset use_memfd_prop_202404 (use_memfd_prop))
+(typeattributeset user_profile_data_file_202404 (user_profile_data_file))
+(typeattributeset user_profile_root_file_202404 (user_profile_root_file))
+(typeattributeset user_service_202404 (user_service))
+(typeattributeset userdata_block_device_202404 (userdata_block_device))
+(typeattributeset userdata_sysdev_202404 (userdata_sysdev))
+(typeattributeset userdebug_or_eng_prop_202404 (userdebug_or_eng_prop))
+(typeattributeset usermodehelper_202404 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_202404 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_202404 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_202404 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_202404 (uwb_service))
+(typeattributeset vcn_management_service_202404 (vcn_management_service))
+(typeattributeset vd_device_202404 (vd_device))
+(typeattributeset vdc_202404 (vdc))
+(typeattributeset vdc_exec_202404 (vdc_exec))
+(typeattributeset vehicle_hal_prop_202404 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_202404 (vendor_apex_file))
+(typeattributeset vendor_apex_metadata_file_202404 (vendor_apex_metadata_file))
+(typeattributeset vendor_app_file_202404 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_202404 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_202404 (vendor_configs_file))
+(typeattributeset vendor_data_file_202404 (vendor_data_file))
+(typeattributeset vendor_default_prop_202404 (vendor_default_prop))
+(typeattributeset vendor_file_202404 (vendor_file vendor_boot_ota_file))
+(typeattributeset vendor_framework_file_202404 (vendor_framework_file))
+(typeattributeset vendor_hal_file_202404 (vendor_hal_file))
+(typeattributeset vendor_idc_file_202404 (vendor_idc_file))
+(typeattributeset vendor_init_202404 (vendor_init))
+(typeattributeset vendor_kernel_modules_202404 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_202404 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_202404 (vendor_keylayout_file))
+(typeattributeset vendor_microdroid_file_202404 (vendor_microdroid_file))
+(typeattributeset vendor_misc_writer_202404 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_202404 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_202404 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_202404 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_202404 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_202404 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_202404 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_202404 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_202404 (vendor_shell))
+(typeattributeset vendor_shell_exec_202404 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_202404 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_202404 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_202404 (vendor_toolbox_exec))
+(typeattributeset vendor_userdir_file_202404 (vendor_userdir_file))
+(typeattributeset vendor_uuid_mapping_config_file_202404 (vendor_uuid_mapping_config_file))
+(typeattributeset vendor_vm_data_file_202404 (vendor_vm_data_file))
+(typeattributeset vendor_vm_file_202404 (vendor_vm_file))
+(typeattributeset vfat_202404 (vfat))
+(typeattributeset vfio_device_202404 (vfio_device))
+(typeattributeset vibrator_manager_service_202404 (vibrator_manager_service))
+(typeattributeset vibrator_service_202404 (vibrator_service))
+(typeattributeset video_device_202404 (video_device))
+(typeattributeset virtual_ab_prop_202404 (virtual_ab_prop))
+(typeattributeset virtual_camera_service_202404 (virtual_camera_service))
+(typeattributeset virtual_device_native_service_202404 (virtual_device_native_service))
+(typeattributeset virtual_device_service_202404 (virtual_device_service))
+(typeattributeset virtual_face_hal_prop_202404 (virtual_face_hal_prop virtual_face_prop))
+(typeattributeset virtual_fingerprint_hal_prop_202404 (virtual_fingerprint_hal_prop virtual_fingerprint_prop))
+(typeattributeset virtual_touchpad_202404 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_202404 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_202404 (virtual_touchpad_service))
+(typeattributeset virtualization_service_202404 (virtualization_service))
+(typeattributeset vndbinder_device_202404 (vndbinder_device))
+(typeattributeset vndk_prop_202404 (vndk_prop))
+(typeattributeset vndk_sp_file_202404 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_202404 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_202404 (vndservicemanager))
+(typeattributeset voiceinteraction_service_202404 (voiceinteraction_service))
+(typeattributeset vold_202404 (vold))
+(typeattributeset vold_config_prop_202404 (vold_config_prop))
+(typeattributeset vold_data_file_202404 (vold_data_file))
+(typeattributeset vold_device_202404 (vold_device))
+(typeattributeset vold_exec_202404 (vold_exec))
+(typeattributeset vold_metadata_file_202404 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_202404 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_202404 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_202404 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_202404 (vold_prop))
+(typeattributeset vold_service_202404 (vold_service))
+(typeattributeset vold_status_prop_202404 (vold_status_prop))
+(typeattributeset vpn_data_file_202404 (vpn_data_file))
+(typeattributeset vpn_management_service_202404 (vpn_management_service))
+(typeattributeset vr_hwc_service_202404 (vr_hwc_service))
+(typeattributeset vr_manager_service_202404 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_202404 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_202404 (vts_config_prop))
+(typeattributeset vts_status_prop_202404 (vts_status_prop))
+(typeattributeset wallpaper_effects_generation_service_202404 (wallpaper_effects_generation_service))
+(typeattributeset wallpaper_file_202404 (wallpaper_file))
+(typeattributeset wallpaper_service_202404 (wallpaper_service))
+(typeattributeset watchdog_device_202404 (watchdog_device))
+(typeattributeset watchdog_metadata_file_202404 (watchdog_metadata_file))
+(typeattributeset watchdogd_202404 (watchdogd))
+(typeattributeset watchdogd_exec_202404 (watchdogd_exec))
+(typeattributeset webview_zygote_202404 (webview_zygote))
+(typeattributeset webview_zygote_exec_202404 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_202404 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_202404 (webviewupdate_service))
+(typeattributeset wifi_config_prop_202404 (wifi_config_prop))
+(typeattributeset wifi_data_file_202404 (wifi_data_file))
+(typeattributeset wifi_hal_prop_202404 (wifi_hal_prop))
+(typeattributeset wifi_key_202404 (wifi_key))
+(typeattributeset wifi_log_prop_202404 (wifi_log_prop))
+(typeattributeset wifi_prop_202404 (wifi_prop))
+(typeattributeset wifi_service_202404 (wifi_service))
+(typeattributeset wifiaware_service_202404 (wifiaware_service))
+(typeattributeset wificond_202404 (wificond))
+(typeattributeset wificond_exec_202404 (wificond_exec))
+(typeattributeset wifinl80211_service_202404 (wifinl80211_service))
+(typeattributeset wifip2p_service_202404 (wifip2p_service))
+(typeattributeset wifiscanner_service_202404 (wifiscanner_service))
+(typeattributeset window_service_202404 (window_service))
+(typeattributeset wpa_socket_202404 (wpa_socket))
+(typeattributeset zero_device_202404 (zero_device))
+(typeattributeset zoned_block_device_202404 (zoned_block_device))
+(typeattributeset zram_config_prop_202404 (zram_config_prop))
+(typeattributeset zram_control_prop_202404 (zram_control_prop))
+(typeattributeset zygote_202404 (zygote))
+(typeattributeset zygote_config_prop_202404 (zygote_config_prop))
+(typeattributeset zygote_exec_202404 (zygote_exec))
+(typeattributeset zygote_socket_202404 (zygote_socket))
+(typeattributeset zygote_tmpfs_202404 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/202404/202404.compat.cil b/prebuilts/api/202504/private/compat/202404/202404.compat.cil
new file mode 100644
index 0000000..e155b28
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/202404/202404.compat.cil
@@ -0,0 +1,3 @@
+;; complement CIL file for compatibility between ToT policy and 202404 vendors.
+;; will be compiled along with other normal policy files, on 202404 vendors.
+;;
diff --git a/prebuilts/api/202504/private/compat/202404/202404.ignore.cil b/prebuilts/api/202504/private/compat/202404/202404.ignore.cil
new file mode 100644
index 0000000..c10b0d5
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/202404/202404.ignore.cil
@@ -0,0 +1,40 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 202404 policy. Thus, we do not need to map these types to
+;; previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ app_function_service
+ binderfs_logs_transaction_history
+ binderfs_logs_transactions
+ bluetooth_finder_prop
+ crosvm
+ early_virtmgr
+ early_virtmgr_exec
+ forensic_service
+ fstype_prop
+ hal_mediaquality_service
+ hal_vm_capabilities_service
+ intrusion_detection_service
+ media_quality_service
+ proc_cgroups
+ proc_compaction_proactiveness
+ profcollectd_etr_prop
+ ranging_service
+ supervision_service
+ sysfs_cma
+ sysfs_firmware_acpi_tables
+ tee_service_contexts_file
+ trusty_security_vm_sys_vendor_prop
+ virtual_camera
+ virtual_camera_exec
+ virtual_face
+ virtual_face_exec
+ virtual_fingerprint
+ virtual_fingerprint_exec
+ virtualizationmanager
+ virtualizationmanager_exec
+ wifi_mainline_supplicant_service
+ wifi_usd_service
+ ))
diff --git a/prebuilts/api/202504/private/compat/29.0/29.0.cil b/prebuilts/api/202504/private/compat/29.0/29.0.cil
new file mode 100644
index 0000000..408cf33
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/29.0/29.0.cil
@@ -0,0 +1,1987 @@
+;; types removed from current policy
+(type ashmemd)
+(type clatd_exec)
+(type clatd)
+(type exported_audio_prop)
+(type exported_dalvik_prop)
+(type exported_vold_prop)
+(type exported2_config_prop)
+(type exported2_vold_prop)
+(type hal_wifi_offload_hwservice)
+(type install_recovery_exec)
+(type install_recovery)
+(type mediacodec_service)
+(type perfprofd_data_file)
+(type perfprofd_service)
+(type sysfs_mac_address)
+(type wificond_service)
+
+;; mapping information from ToT policy's types to 29.0 policy's types.
+(expandtypeattribute (accessibility_service_29_0) true)
+(expandtypeattribute (account_service_29_0) true)
+(expandtypeattribute (activity_service_29_0) true)
+(expandtypeattribute (activity_task_service_29_0) true)
+(expandtypeattribute (adbd_29_0) true)
+(expandtypeattribute (adb_data_file_29_0) true)
+(expandtypeattribute (adbd_exec_29_0) true)
+(expandtypeattribute (adbd_socket_29_0) true)
+(expandtypeattribute (adb_keys_file_29_0) true)
+(expandtypeattribute (adb_service_29_0) true)
+(expandtypeattribute (alarm_service_29_0) true)
+(expandtypeattribute (anr_data_file_29_0) true)
+(expandtypeattribute (apexd_29_0) true)
+(expandtypeattribute (apex_data_file_29_0) true)
+(expandtypeattribute (apexd_exec_29_0) true)
+(expandtypeattribute (apexd_prop_29_0) true)
+(expandtypeattribute (apex_metadata_file_29_0) true)
+(expandtypeattribute (apex_mnt_dir_29_0) true)
+(expandtypeattribute (apex_service_29_0) true)
+(expandtypeattribute (apk_data_file_29_0) true)
+(expandtypeattribute (apk_private_data_file_29_0) true)
+(expandtypeattribute (apk_private_tmp_file_29_0) true)
+(expandtypeattribute (apk_tmp_file_29_0) true)
+(expandtypeattribute (app_binding_service_29_0) true)
+(expandtypeattribute (app_data_file_29_0) true)
+(expandtypeattribute (appdomain_tmpfs_29_0) true)
+(expandtypeattribute (app_fuse_file_29_0) true)
+(expandtypeattribute (app_fusefs_29_0) true)
+(expandtypeattribute (appops_service_29_0) true)
+(expandtypeattribute (app_prediction_service_29_0) true)
+(expandtypeattribute (appwidget_service_29_0) true)
+(expandtypeattribute (app_zygote_29_0) true)
+(expandtypeattribute (app_zygote_tmpfs_29_0) true)
+(expandtypeattribute (asec_apk_file_29_0) true)
+(expandtypeattribute (asec_image_file_29_0) true)
+(expandtypeattribute (asec_public_file_29_0) true)
+(expandtypeattribute (ashmemd_29_0) true)
+(expandtypeattribute (ashmem_device_29_0) true)
+(expandtypeattribute (assetatlas_service_29_0) true)
+(expandtypeattribute (audio_data_file_29_0) true)
+(expandtypeattribute (audio_device_29_0) true)
+(expandtypeattribute (audiohal_data_file_29_0) true)
+(expandtypeattribute (audio_prop_29_0) true)
+(expandtypeattribute (audioserver_29_0) true)
+(expandtypeattribute (audioserver_data_file_29_0) true)
+(expandtypeattribute (audioserver_service_29_0) true)
+(expandtypeattribute (audioserver_tmpfs_29_0) true)
+(expandtypeattribute (audio_service_29_0) true)
+(expandtypeattribute (autofill_service_29_0) true)
+(expandtypeattribute (backup_data_file_29_0) true)
+(expandtypeattribute (backup_service_29_0) true)
+(expandtypeattribute (batteryproperties_service_29_0) true)
+(expandtypeattribute (battery_service_29_0) true)
+(expandtypeattribute (batterystats_service_29_0) true)
+(expandtypeattribute (binder_calls_stats_service_29_0) true)
+(expandtypeattribute (binder_device_29_0) true)
+(expandtypeattribute (binfmt_miscfs_29_0) true)
+(expandtypeattribute (biometric_service_29_0) true)
+(expandtypeattribute (blkid_29_0) true)
+(expandtypeattribute (blkid_untrusted_29_0) true)
+(expandtypeattribute (block_device_29_0) true)
+(expandtypeattribute (bluetooth_29_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_29_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_29_0) true)
+(expandtypeattribute (bluetooth_data_file_29_0) true)
+(expandtypeattribute (bluetooth_efs_file_29_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_29_0) true)
+(expandtypeattribute (bluetooth_manager_service_29_0) true)
+(expandtypeattribute (bluetooth_prop_29_0) true)
+(expandtypeattribute (bluetooth_service_29_0) true)
+(expandtypeattribute (bluetooth_socket_29_0) true)
+(expandtypeattribute (bootanim_29_0) true)
+(expandtypeattribute (bootanim_exec_29_0) true)
+(expandtypeattribute (boot_block_device_29_0) true)
+(expandtypeattribute (bootchart_data_file_29_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_29_0) true)
+(expandtypeattribute (bootstat_29_0) true)
+(expandtypeattribute (bootstat_data_file_29_0) true)
+(expandtypeattribute (bootstat_exec_29_0) true)
+(expandtypeattribute (boottime_prop_29_0) true)
+(expandtypeattribute (boottrace_data_file_29_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_29_0) true)
+(expandtypeattribute (broadcastradio_service_29_0) true)
+(expandtypeattribute (bufferhubd_29_0) true)
+(expandtypeattribute (bufferhubd_exec_29_0) true)
+(expandtypeattribute (bugreport_service_29_0) true)
+(expandtypeattribute (cache_backup_file_29_0) true)
+(expandtypeattribute (cache_block_device_29_0) true)
+(expandtypeattribute (cache_file_29_0) true)
+(expandtypeattribute (cache_private_backup_file_29_0) true)
+(expandtypeattribute (cache_recovery_file_29_0) true)
+(expandtypeattribute (camera_data_file_29_0) true)
+(expandtypeattribute (camera_device_29_0) true)
+(expandtypeattribute (cameraproxy_service_29_0) true)
+(expandtypeattribute (cameraserver_29_0) true)
+(expandtypeattribute (cameraserver_exec_29_0) true)
+(expandtypeattribute (cameraserver_service_29_0) true)
+(expandtypeattribute (cameraserver_tmpfs_29_0) true)
+(expandtypeattribute (cgroup_29_0) true)
+(expandtypeattribute (cgroup_bpf_29_0) true)
+(expandtypeattribute (cgroup_desc_file_29_0) true)
+(expandtypeattribute (cgroup_rc_file_29_0) true)
+(expandtypeattribute (charger_29_0) true)
+(expandtypeattribute (charger_exec_29_0) true)
+(expandtypeattribute (clatd_29_0) true)
+(expandtypeattribute (clatd_exec_29_0) true)
+(expandtypeattribute (clipboard_service_29_0) true)
+(expandtypeattribute (color_display_service_29_0) true)
+(expandtypeattribute (companion_device_service_29_0) true)
+(expandtypeattribute (configfs_29_0) true)
+(expandtypeattribute (config_prop_29_0) true)
+(expandtypeattribute (connectivity_service_29_0) true)
+(expandtypeattribute (connmetrics_service_29_0) true)
+(expandtypeattribute (console_device_29_0) true)
+(expandtypeattribute (consumer_ir_service_29_0) true)
+(expandtypeattribute (content_capture_service_29_0) true)
+(expandtypeattribute (content_service_29_0) true)
+(expandtypeattribute (content_suggestions_service_29_0) true)
+(expandtypeattribute (contexthub_service_29_0) true)
+(expandtypeattribute (coredump_file_29_0) true)
+(expandtypeattribute (country_detector_service_29_0) true)
+(expandtypeattribute (coverage_service_29_0) true)
+(expandtypeattribute (cppreopt_prop_29_0) true)
+(expandtypeattribute (cpuinfo_service_29_0) true)
+(expandtypeattribute (cpu_variant_prop_29_0) true)
+(expandtypeattribute (crash_dump_29_0) true)
+(expandtypeattribute (crash_dump_exec_29_0) true)
+(expandtypeattribute (crossprofileapps_service_29_0) true)
+(expandtypeattribute (ctl_adbd_prop_29_0) true)
+(expandtypeattribute (ctl_bootanim_prop_29_0) true)
+(expandtypeattribute (ctl_bugreport_prop_29_0) true)
+(expandtypeattribute (ctl_console_prop_29_0) true)
+(expandtypeattribute (ctl_default_prop_29_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_29_0) true)
+(expandtypeattribute (ctl_fuse_prop_29_0) true)
+(expandtypeattribute (ctl_gsid_prop_29_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_29_0) true)
+(expandtypeattribute (ctl_interface_start_prop_29_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_29_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_29_0) true)
+(expandtypeattribute (ctl_restart_prop_29_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_29_0) true)
+(expandtypeattribute (ctl_sigstop_prop_29_0) true)
+(expandtypeattribute (ctl_start_prop_29_0) true)
+(expandtypeattribute (ctl_stop_prop_29_0) true)
+(expandtypeattribute (dalvikcache_data_file_29_0) true)
+(expandtypeattribute (dalvik_prop_29_0) true)
+(expandtypeattribute (dbinfo_service_29_0) true)
+(expandtypeattribute (debugfs_29_0) true)
+(expandtypeattribute (debugfs_mmc_29_0) true)
+(expandtypeattribute (debugfs_trace_marker_29_0) true)
+(expandtypeattribute (debugfs_tracing_29_0) true)
+(expandtypeattribute (debugfs_tracing_debug_29_0) true)
+(expandtypeattribute (debugfs_tracing_instances_29_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_29_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_29_0) true)
+(expandtypeattribute (debuggerd_prop_29_0) true)
+(expandtypeattribute (debug_prop_29_0) true)
+(expandtypeattribute (default_android_hwservice_29_0) true)
+(expandtypeattribute (default_android_service_29_0) true)
+(expandtypeattribute (default_android_vndservice_29_0) true)
+(expandtypeattribute (default_prop_29_0) true)
+(expandtypeattribute (dev_cpu_variant_29_0) true)
+(expandtypeattribute (device_29_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_boot_count_prop_29_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_media_native_prop_29_0) true)
+(expandtypeattribute (device_config_netd_native_prop_29_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_29_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_29_0) true)
+(expandtypeattribute (device_config_service_29_0) true)
+(expandtypeattribute (device_identifiers_service_29_0) true)
+(expandtypeattribute (deviceidle_service_29_0) true)
+(expandtypeattribute (device_logging_prop_29_0) true)
+(expandtypeattribute (device_policy_service_29_0) true)
+(expandtypeattribute (devicestoragemonitor_service_29_0) true)
+(expandtypeattribute (devpts_29_0) true)
+(expandtypeattribute (dhcp_29_0) true)
+(expandtypeattribute (dhcp_data_file_29_0) true)
+(expandtypeattribute (dhcp_exec_29_0) true)
+(expandtypeattribute (dhcp_prop_29_0) true)
+(expandtypeattribute (diskstats_service_29_0) true)
+(expandtypeattribute (display_service_29_0) true)
+(expandtypeattribute (dm_device_29_0) true)
+(expandtypeattribute (dnsmasq_29_0) true)
+(expandtypeattribute (dnsmasq_exec_29_0) true)
+(expandtypeattribute (dnsproxyd_socket_29_0) true)
+(expandtypeattribute (dnsresolver_service_29_0) true)
+(expandtypeattribute (DockObserver_service_29_0) true)
+(expandtypeattribute (dreams_service_29_0) true)
+(expandtypeattribute (drm_data_file_29_0) true)
+(expandtypeattribute (drmserver_29_0) true)
+(expandtypeattribute (drmserver_exec_29_0) true)
+(expandtypeattribute (drmserver_service_29_0) true)
+(expandtypeattribute (drmserver_socket_29_0) true)
+(expandtypeattribute (dropbox_data_file_29_0) true)
+(expandtypeattribute (dropbox_service_29_0) true)
+(expandtypeattribute (dumpstate_29_0) true)
+(expandtypeattribute (dumpstate_exec_29_0) true)
+(expandtypeattribute (dumpstate_options_prop_29_0) true)
+(expandtypeattribute (dumpstate_prop_29_0) true)
+(expandtypeattribute (dumpstate_service_29_0) true)
+(expandtypeattribute (dumpstate_socket_29_0) true)
+(expandtypeattribute (dynamic_system_prop_29_0) true)
+(expandtypeattribute (e2fs_29_0) true)
+(expandtypeattribute (e2fs_exec_29_0) true)
+(expandtypeattribute (efs_file_29_0) true)
+(expandtypeattribute (ephemeral_app_29_0) true)
+(expandtypeattribute (ethernet_service_29_0) true)
+(expandtypeattribute (exfat_29_0) true)
+(expandtypeattribute (exported2_config_prop_29_0) true)
+(expandtypeattribute (exported2_default_prop_29_0) true)
+(expandtypeattribute (exported2_radio_prop_29_0) true)
+(expandtypeattribute (exported2_system_prop_29_0) true)
+(expandtypeattribute (exported2_vold_prop_29_0) true)
+(expandtypeattribute (exported3_default_prop_29_0) true)
+(expandtypeattribute (exported3_radio_prop_29_0) true)
+(expandtypeattribute (exported3_system_prop_29_0) true)
+(expandtypeattribute (exported_audio_prop_29_0) true)
+(expandtypeattribute (exported_bluetooth_prop_29_0) true)
+(expandtypeattribute (exported_config_prop_29_0) true)
+(expandtypeattribute (exported_dalvik_prop_29_0) true)
+(expandtypeattribute (exported_default_prop_29_0) true)
+(expandtypeattribute (exported_dumpstate_prop_29_0) true)
+(expandtypeattribute (exported_ffs_prop_29_0) true)
+(expandtypeattribute (exported_fingerprint_prop_29_0) true)
+(expandtypeattribute (exported_overlay_prop_29_0) true)
+(expandtypeattribute (exported_pm_prop_29_0) true)
+(expandtypeattribute (exported_radio_prop_29_0) true)
+(expandtypeattribute (exported_secure_prop_29_0) true)
+(expandtypeattribute (exported_system_prop_29_0) true)
+(expandtypeattribute (exported_system_radio_prop_29_0) true)
+(expandtypeattribute (exported_vold_prop_29_0) true)
+(expandtypeattribute (exported_wifi_prop_29_0) true)
+(expandtypeattribute (external_vibrator_service_29_0) true)
+(expandtypeattribute (face_service_29_0) true)
+(expandtypeattribute (face_vendor_data_file_29_0) true)
+(expandtypeattribute (fastbootd_29_0) true)
+(expandtypeattribute (ffs_prop_29_0) true)
+(expandtypeattribute (file_contexts_file_29_0) true)
+(expandtypeattribute (fingerprintd_29_0) true)
+(expandtypeattribute (fingerprintd_data_file_29_0) true)
+(expandtypeattribute (fingerprintd_exec_29_0) true)
+(expandtypeattribute (fingerprintd_service_29_0) true)
+(expandtypeattribute (fingerprint_prop_29_0) true)
+(expandtypeattribute (fingerprint_service_29_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_29_0) true)
+(expandtypeattribute (firstboot_prop_29_0) true)
+(expandtypeattribute (flags_health_check_29_0) true)
+(expandtypeattribute (flags_health_check_exec_29_0) true)
+(expandtypeattribute (font_service_29_0) true)
+(expandtypeattribute (frp_block_device_29_0) true)
+(expandtypeattribute (fs_bpf_29_0) true)
+(expandtypeattribute (fsck_29_0) true)
+(expandtypeattribute (fsck_exec_29_0) true)
+(expandtypeattribute (fscklogs_29_0) true)
+(expandtypeattribute (fsck_untrusted_29_0) true)
+(expandtypeattribute (functionfs_29_0) true)
+(expandtypeattribute (fuse_29_0) true)
+(expandtypeattribute (fuse_device_29_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_29_0) true)
+(expandtypeattribute (fwk_camera_hwservice_29_0) true)
+(expandtypeattribute (fwk_display_hwservice_29_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_29_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_29_0) true)
+(expandtypeattribute (fwk_stats_hwservice_29_0) true)
+(expandtypeattribute (fwmarkd_socket_29_0) true)
+(expandtypeattribute (gatekeeperd_29_0) true)
+(expandtypeattribute (gatekeeper_data_file_29_0) true)
+(expandtypeattribute (gatekeeperd_exec_29_0) true)
+(expandtypeattribute (gatekeeper_service_29_0) true)
+(expandtypeattribute (gfxinfo_service_29_0) true)
+(expandtypeattribute (gps_control_29_0) true)
+(expandtypeattribute (gpu_device_29_0) true)
+(expandtypeattribute (gpu_service_29_0) true)
+(expandtypeattribute (gpuservice_29_0) true)
+(expandtypeattribute (graphics_device_29_0) true)
+(expandtypeattribute (graphicsstats_service_29_0) true)
+(expandtypeattribute (gsi_data_file_29_0) true)
+(expandtypeattribute (gsid_prop_29_0) true)
+(expandtypeattribute (gsi_metadata_file_29_0) true)
+(expandtypeattribute (hal_atrace_hwservice_29_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_29_0) true)
+(expandtypeattribute (hal_audio_hwservice_29_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_29_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_29_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_29_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_29_0) true)
+(expandtypeattribute (hal_camera_hwservice_29_0) true)
+(expandtypeattribute (hal_cas_hwservice_29_0) true)
+(expandtypeattribute (hal_codec2_hwservice_29_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_29_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_29_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_29_0) true)
+(expandtypeattribute (hal_drm_hwservice_29_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_29_0) true)
+(expandtypeattribute (hal_evs_hwservice_29_0) true)
+(expandtypeattribute (hal_face_hwservice_29_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_29_0) true)
+(expandtypeattribute (hal_fingerprint_service_29_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_29_0) true)
+(expandtypeattribute (hal_gnss_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_29_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_29_0) true)
+(expandtypeattribute (hal_health_hwservice_29_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_29_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_29_0) true)
+(expandtypeattribute (hal_ir_hwservice_29_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_29_0) true)
+(expandtypeattribute (hal_light_hwservice_29_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_29_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_29_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_29_0) true)
+(expandtypeattribute (hal_nfc_hwservice_29_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_29_0) true)
+(expandtypeattribute (hal_omx_hwservice_29_0) true)
+(expandtypeattribute (hal_power_hwservice_29_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_29_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_29_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_29_0) true)
+(expandtypeattribute (hal_sensors_hwservice_29_0) true)
+(expandtypeattribute (hal_telephony_hwservice_29_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_29_0) true)
+(expandtypeattribute (hal_thermal_hwservice_29_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_29_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_29_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_29_0) true)
+(expandtypeattribute (hal_usb_hwservice_29_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_29_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_29_0) true)
+(expandtypeattribute (hal_vr_hwservice_29_0) true)
+(expandtypeattribute (hal_weaver_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_offload_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_29_0) true)
+(expandtypeattribute (hardware_properties_service_29_0) true)
+(expandtypeattribute (hardware_service_29_0) true)
+(expandtypeattribute (hci_attach_dev_29_0) true)
+(expandtypeattribute (hdmi_control_service_29_0) true)
+(expandtypeattribute (healthd_29_0) true)
+(expandtypeattribute (healthd_exec_29_0) true)
+(expandtypeattribute (heapdump_data_file_29_0) true)
+(expandtypeattribute (heapprofd_29_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_29_0) true)
+(expandtypeattribute (heapprofd_prop_29_0) true)
+(expandtypeattribute (heapprofd_socket_29_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_29_0) true)
+(expandtypeattribute (hidl_base_hwservice_29_0) true)
+(expandtypeattribute (hidl_manager_hwservice_29_0) true)
+(expandtypeattribute (hidl_memory_hwservice_29_0) true)
+(expandtypeattribute (hidl_token_hwservice_29_0) true)
+(expandtypeattribute (hwbinder_device_29_0) true)
+(expandtypeattribute (hw_random_device_29_0) true)
+(expandtypeattribute (hwservice_contexts_file_29_0) true)
+(expandtypeattribute (hwservicemanager_29_0) true)
+(expandtypeattribute (hwservicemanager_exec_29_0) true)
+(expandtypeattribute (hwservicemanager_prop_29_0) true)
+(expandtypeattribute (icon_file_29_0) true)
+(expandtypeattribute (idmap_29_0) true)
+(expandtypeattribute (idmap_exec_29_0) true)
+(expandtypeattribute (idmap_service_29_0) true)
+(expandtypeattribute (iio_device_29_0) true)
+(expandtypeattribute (imms_service_29_0) true)
+(expandtypeattribute (incident_29_0) true)
+(expandtypeattribute (incidentd_29_0) true)
+(expandtypeattribute (incident_data_file_29_0) true)
+(expandtypeattribute (incident_helper_29_0) true)
+(expandtypeattribute (incident_service_29_0) true)
+(expandtypeattribute (init_29_0) true)
+(expandtypeattribute (init_exec_29_0) true)
+(expandtypeattribute (init_tmpfs_29_0) true)
+(expandtypeattribute (inotify_29_0) true)
+(expandtypeattribute (input_device_29_0) true)
+(expandtypeattribute (inputflinger_29_0) true)
+(expandtypeattribute (inputflinger_exec_29_0) true)
+(expandtypeattribute (inputflinger_service_29_0) true)
+(expandtypeattribute (input_method_service_29_0) true)
+(expandtypeattribute (input_service_29_0) true)
+(expandtypeattribute (installd_29_0) true)
+(expandtypeattribute (install_data_file_29_0) true)
+(expandtypeattribute (installd_exec_29_0) true)
+(expandtypeattribute (installd_service_29_0) true)
+(expandtypeattribute (install_recovery_29_0) true)
+(expandtypeattribute (install_recovery_exec_29_0) true)
+(expandtypeattribute (ion_device_29_0) true)
+(expandtypeattribute (iorapd_29_0) true)
+(expandtypeattribute (iorapd_data_file_29_0) true)
+(expandtypeattribute (iorapd_exec_29_0) true)
+(expandtypeattribute (iorapd_service_29_0) true)
+(expandtypeattribute (iorapd_tmpfs_29_0) true)
+(expandtypeattribute (IProxyService_service_29_0) true)
+(expandtypeattribute (ipsec_service_29_0) true)
+(expandtypeattribute (iris_service_29_0) true)
+(expandtypeattribute (iris_vendor_data_file_29_0) true)
+(expandtypeattribute (isolated_app_29_0) true)
+(expandtypeattribute (jobscheduler_service_29_0) true)
+(expandtypeattribute (kernel_29_0) true)
+(expandtypeattribute (keychain_data_file_29_0) true)
+(expandtypeattribute (keychord_device_29_0) true)
+(expandtypeattribute (keystore_29_0) true)
+(expandtypeattribute (keystore_data_file_29_0) true)
+(expandtypeattribute (keystore_exec_29_0) true)
+(expandtypeattribute (keystore_service_29_0) true)
+(expandtypeattribute (kmsg_debug_device_29_0) true)
+(expandtypeattribute (kmsg_device_29_0) true)
+(expandtypeattribute (labeledfs_29_0) true)
+(expandtypeattribute (last_boot_reason_prop_29_0) true)
+(expandtypeattribute (launcherapps_service_29_0) true)
+(expandtypeattribute (llkd_29_0) true)
+(expandtypeattribute (llkd_exec_29_0) true)
+(expandtypeattribute (llkd_prop_29_0) true)
+(expandtypeattribute (lmkd_29_0) true)
+(expandtypeattribute (lmkd_exec_29_0) true)
+(expandtypeattribute (lmkd_socket_29_0) true)
+(expandtypeattribute (location_service_29_0) true)
+(expandtypeattribute (lock_settings_service_29_0) true)
+(expandtypeattribute (logcat_exec_29_0) true)
+(expandtypeattribute (logd_29_0) true)
+(expandtypeattribute (logd_exec_29_0) true)
+(expandtypeattribute (logd_prop_29_0) true)
+(expandtypeattribute (logdr_socket_29_0) true)
+(expandtypeattribute (logd_socket_29_0) true)
+(expandtypeattribute (logdw_socket_29_0) true)
+(expandtypeattribute (logpersist_29_0) true)
+(expandtypeattribute (logpersistd_logging_prop_29_0) true)
+(expandtypeattribute (log_prop_29_0) true)
+(expandtypeattribute (log_tag_prop_29_0) true)
+(expandtypeattribute (loop_control_device_29_0) true)
+(expandtypeattribute (loop_device_29_0) true)
+(expandtypeattribute (looper_stats_service_29_0) true)
+(expandtypeattribute (lowpan_device_29_0) true)
+(expandtypeattribute (lowpan_prop_29_0) true)
+(expandtypeattribute (lowpan_service_29_0) true)
+(expandtypeattribute (lpdumpd_prop_29_0) true)
+(expandtypeattribute (lpdump_service_29_0) true)
+(expandtypeattribute (mac_perms_file_29_0) true)
+(expandtypeattribute (mdnsd_29_0) true)
+(expandtypeattribute (mdnsd_socket_29_0) true)
+(expandtypeattribute (mdns_socket_29_0) true)
+(expandtypeattribute (mediacodec_service_29_0) true)
+(expandtypeattribute (media_data_file_29_0) true)
+(expandtypeattribute (mediadrmserver_29_0) true)
+(expandtypeattribute (mediadrmserver_exec_29_0) true)
+(expandtypeattribute (mediadrmserver_service_29_0) true)
+(expandtypeattribute (mediaextractor_29_0) true)
+(expandtypeattribute (mediaextractor_exec_29_0) true)
+(expandtypeattribute (mediaextractor_service_29_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_29_0) true)
+(expandtypeattribute (mediametrics_29_0) true)
+(expandtypeattribute (mediametrics_exec_29_0) true)
+(expandtypeattribute (mediametrics_service_29_0) true)
+(expandtypeattribute (media_projection_service_29_0) true)
+(expandtypeattribute (mediaprovider_29_0) true)
+(expandtypeattribute (media_router_service_29_0) true)
+(expandtypeattribute (media_rw_data_file_29_0) true)
+(expandtypeattribute (mediaserver_29_0) true)
+(expandtypeattribute (mediaserver_exec_29_0) true)
+(expandtypeattribute (mediaserver_service_29_0) true)
+(expandtypeattribute (mediaserver_tmpfs_29_0) true)
+(expandtypeattribute (media_session_service_29_0) true)
+(expandtypeattribute (mediaswcodec_29_0) true)
+(expandtypeattribute (mediaswcodec_exec_29_0) true)
+(expandtypeattribute (meminfo_service_29_0) true)
+(expandtypeattribute (metadata_block_device_29_0) true)
+(expandtypeattribute (metadata_file_29_0) true)
+(expandtypeattribute (method_trace_data_file_29_0) true)
+(expandtypeattribute (midi_service_29_0) true)
+(expandtypeattribute (misc_block_device_29_0) true)
+(expandtypeattribute (misc_logd_file_29_0) true)
+(expandtypeattribute (misc_user_data_file_29_0) true)
+(expandtypeattribute (mmc_prop_29_0) true)
+(expandtypeattribute (mnt_expand_file_29_0) true)
+(expandtypeattribute (mnt_media_rw_file_29_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_29_0) true)
+(expandtypeattribute (mnt_product_file_29_0) true)
+(expandtypeattribute (mnt_user_file_29_0) true)
+(expandtypeattribute (mnt_vendor_file_29_0) true)
+(expandtypeattribute (modprobe_29_0) true)
+(expandtypeattribute (mount_service_29_0) true)
+(expandtypeattribute (mqueue_29_0) true)
+(expandtypeattribute (mtp_29_0) true)
+(expandtypeattribute (mtp_device_29_0) true)
+(expandtypeattribute (mtpd_socket_29_0) true)
+(expandtypeattribute (mtp_exec_29_0) true)
+(expandtypeattribute (nativetest_data_file_29_0) true)
+(expandtypeattribute (netd_29_0) true)
+(expandtypeattribute (net_data_file_29_0) true)
+(expandtypeattribute (netd_exec_29_0) true)
+(expandtypeattribute (netd_listener_service_29_0) true)
+(expandtypeattribute (net_dns_prop_29_0) true)
+(expandtypeattribute (netd_service_29_0) true)
+(expandtypeattribute (netd_stable_secret_prop_29_0) true)
+(expandtypeattribute (netif_29_0) true)
+(expandtypeattribute (netpolicy_service_29_0) true)
+(expandtypeattribute (net_radio_prop_29_0) true)
+(expandtypeattribute (netstats_service_29_0) true)
+(expandtypeattribute (netutils_wrapper_29_0) true)
+(expandtypeattribute (netutils_wrapper_exec_29_0) true)
+(expandtypeattribute (network_management_service_29_0) true)
+(expandtypeattribute (network_score_service_29_0) true)
+(expandtypeattribute (network_stack_29_0) true)
+(expandtypeattribute (network_stack_service_29_0) true)
+(expandtypeattribute (network_time_update_service_29_0) true)
+(expandtypeattribute (network_watchlist_data_file_29_0) true)
+(expandtypeattribute (network_watchlist_service_29_0) true)
+(expandtypeattribute (nfc_29_0) true)
+(expandtypeattribute (nfc_data_file_29_0) true)
+(expandtypeattribute (nfc_device_29_0) true)
+(expandtypeattribute (nfc_prop_29_0) true)
+(expandtypeattribute (nfc_service_29_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_29_0) true)
+(expandtypeattribute (node_29_0) true)
+(expandtypeattribute (nonplat_service_contexts_file_29_0) true)
+(expandtypeattribute (notification_service_29_0) true)
+(expandtypeattribute (null_device_29_0) true)
+(expandtypeattribute (oemfs_29_0) true)
+(expandtypeattribute (oem_lock_service_29_0) true)
+(expandtypeattribute (ota_data_file_29_0) true)
+(expandtypeattribute (otadexopt_service_29_0) true)
+(expandtypeattribute (ota_package_file_29_0) true)
+(expandtypeattribute (overlayfs_file_29_0) true)
+(expandtypeattribute (overlay_prop_29_0) true)
+(expandtypeattribute (overlay_service_29_0) true)
+(expandtypeattribute (owntty_device_29_0) true)
+(expandtypeattribute (package_native_service_29_0) true)
+(expandtypeattribute (package_service_29_0) true)
+(expandtypeattribute (packages_list_file_29_0) true)
+(expandtypeattribute (pan_result_prop_29_0) true)
+(expandtypeattribute (password_slot_metadata_file_29_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_29_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_dir_29_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_performance_dir_29_0) true)
+(expandtypeattribute (perfetto_29_0) true)
+(expandtypeattribute (performanced_29_0) true)
+(expandtypeattribute (performanced_exec_29_0) true)
+(expandtypeattribute (permissionmgr_service_29_0) true)
+(expandtypeattribute (permission_service_29_0) true)
+(expandtypeattribute (persist_debug_prop_29_0) true)
+(expandtypeattribute (persistent_data_block_service_29_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_29_0) true)
+(expandtypeattribute (pinner_service_29_0) true)
+(expandtypeattribute (pipefs_29_0) true)
+(expandtypeattribute (platform_app_29_0) true)
+(expandtypeattribute (pm_prop_29_0) true)
+(expandtypeattribute (pmsg_device_29_0) true)
+(expandtypeattribute (port_29_0) true)
+(expandtypeattribute (port_device_29_0) true)
+(expandtypeattribute (postinstall_29_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_29_0) true)
+(expandtypeattribute (postinstall_file_29_0) true)
+(expandtypeattribute (postinstall_mnt_dir_29_0) true)
+(expandtypeattribute (powerctl_prop_29_0) true)
+(expandtypeattribute (power_service_29_0) true)
+(expandtypeattribute (ppp_29_0) true)
+(expandtypeattribute (ppp_device_29_0) true)
+(expandtypeattribute (ppp_exec_29_0) true)
+(expandtypeattribute (preloads_data_file_29_0) true)
+(expandtypeattribute (preloads_media_file_29_0) true)
+(expandtypeattribute (print_service_29_0) true)
+(expandtypeattribute (priv_app_29_0) true)
+(expandtypeattribute (privapp_data_file_29_0) true)
+(expandtypeattribute (proc_29_0) true)
+(expandtypeattribute (proc_abi_29_0) true)
+(expandtypeattribute (proc_asound_29_0) true)
+(expandtypeattribute (proc_bluetooth_writable_29_0) true)
+(expandtypeattribute (proc_buddyinfo_29_0) true)
+(expandtypeattribute (proc_cmdline_29_0) true)
+(expandtypeattribute (proc_cpuinfo_29_0) true)
+(expandtypeattribute (proc_dirty_29_0) true)
+(expandtypeattribute (proc_diskstats_29_0) true)
+(expandtypeattribute (proc_drop_caches_29_0) true)
+(expandtypeattribute (processinfo_service_29_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_29_0) true)
+(expandtypeattribute (proc_filesystems_29_0) true)
+(expandtypeattribute (proc_fs_verity_29_0) true)
+(expandtypeattribute (proc_hostname_29_0) true)
+(expandtypeattribute (proc_hung_task_29_0) true)
+(expandtypeattribute (proc_interrupts_29_0) true)
+(expandtypeattribute (proc_iomem_29_0) true)
+(expandtypeattribute (proc_keys_29_0) true)
+(expandtypeattribute (proc_kmsg_29_0) true)
+(expandtypeattribute (proc_loadavg_29_0) true)
+(expandtypeattribute (proc_max_map_count_29_0) true)
+(expandtypeattribute (proc_meminfo_29_0) true)
+(expandtypeattribute (proc_min_free_order_shift_29_0) true)
+(expandtypeattribute (proc_misc_29_0) true)
+(expandtypeattribute (proc_modules_29_0) true)
+(expandtypeattribute (proc_mounts_29_0) true)
+(expandtypeattribute (proc_net_29_0) true)
+(expandtypeattribute (proc_net_tcp_udp_29_0) true)
+(expandtypeattribute (proc_overcommit_memory_29_0) true)
+(expandtypeattribute (proc_page_cluster_29_0) true)
+(expandtypeattribute (proc_pagetypeinfo_29_0) true)
+(expandtypeattribute (proc_panic_29_0) true)
+(expandtypeattribute (proc_perf_29_0) true)
+(expandtypeattribute (proc_pid_max_29_0) true)
+(expandtypeattribute (proc_pipe_conf_29_0) true)
+(expandtypeattribute (proc_pressure_cpu_29_0) true)
+(expandtypeattribute (proc_pressure_io_29_0) true)
+(expandtypeattribute (proc_pressure_mem_29_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_29_0) true)
+(expandtypeattribute (proc_qtaguid_stat_29_0) true)
+(expandtypeattribute (proc_random_29_0) true)
+(expandtypeattribute (proc_sched_29_0) true)
+(expandtypeattribute (proc_security_29_0) true)
+(expandtypeattribute (proc_slabinfo_29_0) true)
+(expandtypeattribute (proc_stat_29_0) true)
+(expandtypeattribute (procstats_service_29_0) true)
+(expandtypeattribute (proc_swaps_29_0) true)
+(expandtypeattribute (proc_sysrq_29_0) true)
+(expandtypeattribute (proc_timer_29_0) true)
+(expandtypeattribute (proc_tty_drivers_29_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_29_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_29_0) true)
+(expandtypeattribute (proc_uid_cpupower_29_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_29_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_29_0) true)
+(expandtypeattribute (proc_uid_io_stats_29_0) true)
+(expandtypeattribute (proc_uid_procstat_set_29_0) true)
+(expandtypeattribute (proc_uid_time_in_state_29_0) true)
+(expandtypeattribute (proc_uptime_29_0) true)
+(expandtypeattribute (proc_version_29_0) true)
+(expandtypeattribute (proc_vmallocinfo_29_0) true)
+(expandtypeattribute (proc_vmstat_29_0) true)
+(expandtypeattribute (proc_zoneinfo_29_0) true)
+(expandtypeattribute (profman_29_0) true)
+(expandtypeattribute (profman_dump_data_file_29_0) true)
+(expandtypeattribute (profman_exec_29_0) true)
+(expandtypeattribute (properties_device_29_0) true)
+(expandtypeattribute (properties_serial_29_0) true)
+(expandtypeattribute (property_contexts_file_29_0) true)
+(expandtypeattribute (property_data_file_29_0) true)
+(expandtypeattribute (property_info_29_0) true)
+(expandtypeattribute (property_socket_29_0) true)
+(expandtypeattribute (pstorefs_29_0) true)
+(expandtypeattribute (ptmx_device_29_0) true)
+(expandtypeattribute (qtaguid_device_29_0) true)
+(expandtypeattribute (racoon_29_0) true)
+(expandtypeattribute (racoon_exec_29_0) true)
+(expandtypeattribute (racoon_socket_29_0) true)
+(expandtypeattribute (radio_29_0) true)
+(expandtypeattribute (radio_data_file_29_0) true)
+(expandtypeattribute (radio_device_29_0) true)
+(expandtypeattribute (radio_prop_29_0) true)
+(expandtypeattribute (radio_service_29_0) true)
+(expandtypeattribute (ram_device_29_0) true)
+(expandtypeattribute (random_device_29_0) true)
+(expandtypeattribute (recovery_29_0) true)
+(expandtypeattribute (recovery_block_device_29_0) true)
+(expandtypeattribute (recovery_data_file_29_0) true)
+(expandtypeattribute (recovery_persist_29_0) true)
+(expandtypeattribute (recovery_persist_exec_29_0) true)
+(expandtypeattribute (recovery_refresh_29_0) true)
+(expandtypeattribute (recovery_refresh_exec_29_0) true)
+(expandtypeattribute (recovery_service_29_0) true)
+(expandtypeattribute (recovery_socket_29_0) true)
+(expandtypeattribute (registry_service_29_0) true)
+(expandtypeattribute (resourcecache_data_file_29_0) true)
+(expandtypeattribute (restorecon_prop_29_0) true)
+(expandtypeattribute (restrictions_service_29_0) true)
+(expandtypeattribute (rild_debug_socket_29_0) true)
+(expandtypeattribute (rild_socket_29_0) true)
+(expandtypeattribute (ringtone_file_29_0) true)
+(expandtypeattribute (role_service_29_0) true)
+(expandtypeattribute (rollback_service_29_0) true)
+(expandtypeattribute (root_block_device_29_0) true)
+(expandtypeattribute (rootfs_29_0) true)
+(expandtypeattribute (rpmsg_device_29_0) true)
+(expandtypeattribute (rs_29_0) true)
+(expandtypeattribute (rs_exec_29_0) true)
+(expandtypeattribute (rss_hwm_reset_29_0) true)
+(expandtypeattribute (rtc_device_29_0) true)
+(expandtypeattribute (rttmanager_service_29_0) true)
+(expandtypeattribute (runas_29_0) true)
+(expandtypeattribute (runas_app_29_0) true)
+(expandtypeattribute (runas_exec_29_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_29_0) true)
+(expandtypeattribute (runtime_service_29_0) true)
+(expandtypeattribute (safemode_prop_29_0) true)
+(expandtypeattribute (same_process_hal_file_29_0) true)
+(expandtypeattribute (samplingprofiler_service_29_0) true)
+(expandtypeattribute (scheduling_policy_service_29_0) true)
+(expandtypeattribute (sdcard_block_device_29_0) true)
+(expandtypeattribute (sdcardd_29_0) true)
+(expandtypeattribute (sdcardd_exec_29_0) true)
+(expandtypeattribute (sdcardfs_29_0) true)
+(expandtypeattribute (seapp_contexts_file_29_0) true)
+(expandtypeattribute (search_service_29_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_29_0) true)
+(expandtypeattribute (secure_element_29_0) true)
+(expandtypeattribute (secure_element_device_29_0) true)
+(expandtypeattribute (secure_element_service_29_0) true)
+(expandtypeattribute (selinuxfs_29_0) true)
+(expandtypeattribute (sensor_privacy_service_29_0) true)
+(expandtypeattribute (sensors_device_29_0) true)
+(expandtypeattribute (sensorservice_service_29_0) true)
+(expandtypeattribute (sepolicy_file_29_0) true)
+(expandtypeattribute (serial_device_29_0) true)
+(expandtypeattribute (serialno_prop_29_0) true)
+(expandtypeattribute (serial_service_29_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_29_0) true)
+(expandtypeattribute (service_contexts_file_29_0) true)
+(expandtypeattribute (servicediscovery_service_29_0) true)
+(expandtypeattribute (servicemanager_29_0) true)
+(expandtypeattribute (servicemanager_exec_29_0) true)
+(expandtypeattribute (settings_service_29_0) true)
+(expandtypeattribute (sgdisk_29_0) true)
+(expandtypeattribute (sgdisk_exec_29_0) true)
+(expandtypeattribute (shared_relro_29_0) true)
+(expandtypeattribute (shared_relro_file_29_0) true)
+(expandtypeattribute (shell_29_0) true)
+(expandtypeattribute (shell_data_file_29_0) true)
+(expandtypeattribute (shell_exec_29_0) true)
+(expandtypeattribute (shell_prop_29_0) true)
+(expandtypeattribute (shm_29_0) true)
+(expandtypeattribute (shortcut_manager_icons_29_0) true)
+(expandtypeattribute (shortcut_service_29_0) true)
+(expandtypeattribute (simpleperf_app_runner_29_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_29_0) true)
+(expandtypeattribute (slice_service_29_0) true)
+(expandtypeattribute (slideshow_29_0) true)
+(expandtypeattribute (socket_device_29_0) true)
+(expandtypeattribute (sockfs_29_0) true)
+(expandtypeattribute (staging_data_file_29_0) true)
+(expandtypeattribute (statsd_29_0) true)
+(expandtypeattribute (stats_data_file_29_0) true)
+(expandtypeattribute (statsd_exec_29_0) true)
+(expandtypeattribute (statsdw_socket_29_0) true)
+(expandtypeattribute (statusbar_service_29_0) true)
+(expandtypeattribute (storaged_service_29_0) true)
+(expandtypeattribute (storage_file_29_0) true)
+(expandtypeattribute (storagestats_service_29_0) true)
+(expandtypeattribute (storage_stub_file_29_0) true)
+(expandtypeattribute (su_29_0) true)
+(expandtypeattribute (su_exec_29_0) true)
+(expandtypeattribute (super_block_device_29_0) true)
+(expandtypeattribute (surfaceflinger_29_0) true)
+(expandtypeattribute (surfaceflinger_service_29_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_29_0) true)
+(expandtypeattribute (swap_block_device_29_0) true)
+(expandtypeattribute (sysfs_29_0) true)
+(expandtypeattribute (sysfs_android_usb_29_0) true)
+(expandtypeattribute (sysfs_batteryinfo_29_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_29_0) true)
+(expandtypeattribute (sysfs_devices_block_29_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_29_0) true)
+(expandtypeattribute (sysfs_dm_29_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_29_0) true)
+(expandtypeattribute (sysfs_extcon_29_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_29_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_29_0) true)
+(expandtypeattribute (sysfs_hwrandom_29_0) true)
+(expandtypeattribute (sysfs_ipv4_29_0) true)
+(expandtypeattribute (sysfs_kernel_notes_29_0) true)
+(expandtypeattribute (sysfs_leds_29_0) true)
+(expandtypeattribute (sysfs_loop_29_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_29_0) true)
+(expandtypeattribute (sysfs_mac_address_29_0) true)
+(expandtypeattribute (sysfs_net_29_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_29_0) true)
+(expandtypeattribute (sysfs_power_29_0) true)
+(expandtypeattribute (sysfs_rtc_29_0) true)
+(expandtypeattribute (sysfs_switch_29_0) true)
+(expandtypeattribute (sysfs_thermal_29_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_29_0) true)
+(expandtypeattribute (sysfs_uio_29_0) true)
+(expandtypeattribute (sysfs_usb_29_0) true)
+(expandtypeattribute (sysfs_usermodehelper_29_0) true)
+(expandtypeattribute (sysfs_vibrator_29_0) true)
+(expandtypeattribute (sysfs_wake_lock_29_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_29_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_29_0) true)
+(expandtypeattribute (sysfs_zram_29_0) true)
+(expandtypeattribute (sysfs_zram_uevent_29_0) true)
+(expandtypeattribute (system_app_29_0) true)
+(expandtypeattribute (system_app_data_file_29_0) true)
+(expandtypeattribute (system_app_service_29_0) true)
+(expandtypeattribute (system_asan_options_file_29_0) true)
+(expandtypeattribute (system_block_device_29_0) true)
+(expandtypeattribute (system_boot_reason_prop_29_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_29_0) true)
+(expandtypeattribute (system_data_file_29_0) true)
+(expandtypeattribute (system_event_log_tags_file_29_0) true)
+(expandtypeattribute (system_file_29_0) true)
+(expandtypeattribute (systemkeys_data_file_29_0) true)
+(expandtypeattribute (system_lib_file_29_0) true)
+(expandtypeattribute (system_linker_config_file_29_0) true)
+(expandtypeattribute (system_linker_exec_29_0) true)
+(expandtypeattribute (system_lmk_prop_29_0) true)
+(expandtypeattribute (system_ndebug_socket_29_0) true)
+(expandtypeattribute (system_net_netd_hwservice_29_0) true)
+(expandtypeattribute (system_prop_29_0) true)
+(expandtypeattribute (system_radio_prop_29_0) true)
+(expandtypeattribute (system_seccomp_policy_file_29_0) true)
+(expandtypeattribute (system_security_cacerts_file_29_0) true)
+(expandtypeattribute (system_server_29_0) true)
+(expandtypeattribute (system_server_tmpfs_29_0) true)
+(expandtypeattribute (system_suspend_control_service_29_0) true)
+(expandtypeattribute (system_suspend_hwservice_29_0) true)
+(expandtypeattribute (system_trace_prop_29_0) true)
+(expandtypeattribute (system_update_service_29_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_29_0) true)
+(expandtypeattribute (system_wpa_socket_29_0) true)
+(expandtypeattribute (system_zoneinfo_file_29_0) true)
+(expandtypeattribute (task_profiles_file_29_0) true)
+(expandtypeattribute (task_service_29_0) true)
+(expandtypeattribute (tcpdump_exec_29_0) true)
+(expandtypeattribute (tee_29_0) true)
+(expandtypeattribute (tee_data_file_29_0) true)
+(expandtypeattribute (tee_device_29_0) true)
+(expandtypeattribute (telecom_service_29_0) true)
+(expandtypeattribute (test_boot_reason_prop_29_0) true)
+(expandtypeattribute (test_harness_prop_29_0) true)
+(expandtypeattribute (testharness_service_29_0) true)
+(expandtypeattribute (textclassification_service_29_0) true)
+(expandtypeattribute (textclassifier_data_file_29_0) true)
+(expandtypeattribute (textservices_service_29_0) true)
+(expandtypeattribute (thermalcallback_hwservice_29_0) true)
+(expandtypeattribute (thermal_service_29_0) true)
+(expandtypeattribute (timedetector_service_29_0) true)
+(expandtypeattribute (time_prop_29_0) true)
+(expandtypeattribute (timezone_service_29_0) true)
+(expandtypeattribute (tmpfs_29_0) true)
+(expandtypeattribute (tombstoned_29_0) true)
+(expandtypeattribute (tombstone_data_file_29_0) true)
+(expandtypeattribute (tombstoned_crash_socket_29_0) true)
+(expandtypeattribute (tombstoned_exec_29_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_29_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_29_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_29_0) true)
+(expandtypeattribute (toolbox_29_0) true)
+(expandtypeattribute (toolbox_exec_29_0) true)
+(expandtypeattribute (traced_29_0) true)
+(expandtypeattribute (trace_data_file_29_0) true)
+(expandtypeattribute (traced_consumer_socket_29_0) true)
+(expandtypeattribute (traced_enabled_prop_29_0) true)
+(expandtypeattribute (traced_lazy_prop_29_0) true)
+(expandtypeattribute (traced_probes_29_0) true)
+(expandtypeattribute (traced_producer_socket_29_0) true)
+(expandtypeattribute (traceur_app_29_0) true)
+(expandtypeattribute (trust_service_29_0) true)
+(expandtypeattribute (tty_device_29_0) true)
+(expandtypeattribute (tun_device_29_0) true)
+(expandtypeattribute (tv_input_service_29_0) true)
+(expandtypeattribute (tzdatacheck_29_0) true)
+(expandtypeattribute (tzdatacheck_exec_29_0) true)
+(expandtypeattribute (ueventd_29_0) true)
+(expandtypeattribute (ueventd_tmpfs_29_0) true)
+(expandtypeattribute (uhid_device_29_0) true)
+(expandtypeattribute (uimode_service_29_0) true)
+(expandtypeattribute (uio_device_29_0) true)
+(expandtypeattribute (uncrypt_29_0) true)
+(expandtypeattribute (uncrypt_exec_29_0) true)
+(expandtypeattribute (uncrypt_socket_29_0) true)
+(expandtypeattribute (unencrypted_data_file_29_0) true)
+(expandtypeattribute (unlabeled_29_0) true)
+(expandtypeattribute (untrusted_app_25_29_0) true)
+(expandtypeattribute (untrusted_app_27_29_0) true)
+(expandtypeattribute (untrusted_app_29_0) true)
+(expandtypeattribute (update_engine_29_0) true)
+(expandtypeattribute (update_engine_data_file_29_0) true)
+(expandtypeattribute (update_engine_exec_29_0) true)
+(expandtypeattribute (update_engine_log_data_file_29_0) true)
+(expandtypeattribute (update_engine_service_29_0) true)
+(expandtypeattribute (updatelock_service_29_0) true)
+(expandtypeattribute (update_verifier_29_0) true)
+(expandtypeattribute (update_verifier_exec_29_0) true)
+(expandtypeattribute (uri_grants_service_29_0) true)
+(expandtypeattribute (usagestats_service_29_0) true)
+(expandtypeattribute (usbaccessory_device_29_0) true)
+(expandtypeattribute (usbd_29_0) true)
+(expandtypeattribute (usb_device_29_0) true)
+(expandtypeattribute (usbd_exec_29_0) true)
+(expandtypeattribute (usbfs_29_0) true)
+(expandtypeattribute (usb_service_29_0) true)
+(expandtypeattribute (use_memfd_prop_29_0) true)
+(expandtypeattribute (userdata_block_device_29_0) true)
+(expandtypeattribute (usermodehelper_29_0) true)
+(expandtypeattribute (user_profile_data_file_29_0) true)
+(expandtypeattribute (user_service_29_0) true)
+(expandtypeattribute (vdc_29_0) true)
+(expandtypeattribute (vdc_exec_29_0) true)
+(expandtypeattribute (vendor_app_file_29_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_29_0) true)
+(expandtypeattribute (vendor_configs_file_29_0) true)
+(expandtypeattribute (vendor_data_file_29_0) true)
+(expandtypeattribute (vendor_default_prop_29_0) true)
+(expandtypeattribute (vendor_file_29_0) true)
+(expandtypeattribute (vendor_framework_file_29_0) true)
+(expandtypeattribute (vendor_hal_file_29_0) true)
+(expandtypeattribute (vendor_idc_file_29_0) true)
+(expandtypeattribute (vendor_init_29_0) true)
+(expandtypeattribute (vendor_keychars_file_29_0) true)
+(expandtypeattribute (vendor_keylayout_file_29_0) true)
+(expandtypeattribute (vendor_overlay_file_29_0) true)
+(expandtypeattribute (vendor_public_lib_file_29_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_29_0) true)
+(expandtypeattribute (vendor_shell_29_0) true)
+(expandtypeattribute (vendor_shell_exec_29_0) true)
+(expandtypeattribute (vendor_task_profiles_file_29_0) true)
+(expandtypeattribute (vendor_toolbox_exec_29_0) true)
+(expandtypeattribute (vfat_29_0) true)
+(expandtypeattribute (vibrator_service_29_0) true)
+(expandtypeattribute (video_device_29_0) true)
+(expandtypeattribute (virtual_touchpad_29_0) true)
+(expandtypeattribute (virtual_touchpad_exec_29_0) true)
+(expandtypeattribute (virtual_touchpad_service_29_0) true)
+(expandtypeattribute (vndbinder_device_29_0) true)
+(expandtypeattribute (vndk_sp_file_29_0) true)
+(expandtypeattribute (vndservice_contexts_file_29_0) true)
+(expandtypeattribute (vndservicemanager_29_0) true)
+(expandtypeattribute (voiceinteraction_service_29_0) true)
+(expandtypeattribute (vold_29_0) true)
+(expandtypeattribute (vold_data_file_29_0) true)
+(expandtypeattribute (vold_device_29_0) true)
+(expandtypeattribute (vold_exec_29_0) true)
+(expandtypeattribute (vold_metadata_file_29_0) true)
+(expandtypeattribute (vold_prepare_subdirs_29_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_29_0) true)
+(expandtypeattribute (vold_prop_29_0) true)
+(expandtypeattribute (vold_service_29_0) true)
+(expandtypeattribute (vpn_data_file_29_0) true)
+(expandtypeattribute (vrflinger_vsync_service_29_0) true)
+(expandtypeattribute (vr_hwc_29_0) true)
+(expandtypeattribute (vr_hwc_exec_29_0) true)
+(expandtypeattribute (vr_hwc_service_29_0) true)
+(expandtypeattribute (vr_manager_service_29_0) true)
+(expandtypeattribute (wallpaper_file_29_0) true)
+(expandtypeattribute (wallpaper_service_29_0) true)
+(expandtypeattribute (watchdogd_29_0) true)
+(expandtypeattribute (watchdog_device_29_0) true)
+(expandtypeattribute (watchdogd_exec_29_0) true)
+(expandtypeattribute (webviewupdate_service_29_0) true)
+(expandtypeattribute (webview_zygote_29_0) true)
+(expandtypeattribute (webview_zygote_exec_29_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_29_0) true)
+(expandtypeattribute (wifiaware_service_29_0) true)
+(expandtypeattribute (wificond_29_0) true)
+(expandtypeattribute (wificond_exec_29_0) true)
+(expandtypeattribute (wificond_service_29_0) true)
+(expandtypeattribute (wifi_data_file_29_0) true)
+(expandtypeattribute (wifi_log_prop_29_0) true)
+(expandtypeattribute (wifip2p_service_29_0) true)
+(expandtypeattribute (wifi_prop_29_0) true)
+(expandtypeattribute (wifiscanner_service_29_0) true)
+(expandtypeattribute (wifi_service_29_0) true)
+(expandtypeattribute (window_service_29_0) true)
+(expandtypeattribute (wpantund_29_0) true)
+(expandtypeattribute (wpantund_exec_29_0) true)
+(expandtypeattribute (wpantund_service_29_0) true)
+(expandtypeattribute (wpa_socket_29_0) true)
+(expandtypeattribute (zero_device_29_0) true)
+(expandtypeattribute (zoneinfo_data_file_29_0) true)
+(expandtypeattribute (zygote_29_0) true)
+(expandtypeattribute (zygote_exec_29_0) true)
+(expandtypeattribute (zygote_socket_29_0) true)
+(expandtypeattribute (zygote_tmpfs_29_0) true)
+(typeattributeset accessibility_service_29_0 (accessibility_service))
+(typeattributeset account_service_29_0 (account_service))
+(typeattributeset activity_service_29_0 (activity_service))
+(typeattributeset activity_task_service_29_0 (activity_task_service))
+(typeattributeset adbd_29_0 (adbd))
+(typeattributeset adb_data_file_29_0 (adb_data_file))
+(typeattributeset adbd_exec_29_0 (adbd_exec))
+(typeattributeset adbd_socket_29_0 (adbd_socket))
+(typeattributeset adb_keys_file_29_0 (adb_keys_file))
+(typeattributeset adb_service_29_0 (adb_service))
+(typeattributeset alarm_service_29_0 (alarm_service))
+(typeattributeset anr_data_file_29_0 (anr_data_file))
+(typeattributeset apexd_29_0 (apexd))
+(typeattributeset apex_data_file_29_0 (apex_data_file))
+(typeattributeset apexd_exec_29_0 (apexd_exec))
+(typeattributeset apexd_prop_29_0 (apexd_prop))
+(typeattributeset apex_metadata_file_29_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_29_0 (apex_mnt_dir))
+(typeattributeset apex_service_29_0 (apex_service))
+(typeattributeset apk_data_file_29_0 (apk_data_file))
+(typeattributeset apk_private_data_file_29_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_29_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_29_0 (apk_tmp_file))
+(typeattributeset app_binding_service_29_0 (app_binding_service))
+(typeattributeset app_data_file_29_0 (app_data_file))
+(typeattributeset appdomain_tmpfs_29_0 (appdomain_tmpfs))
+(typeattributeset app_fuse_file_29_0 (app_fuse_file))
+(typeattributeset app_fusefs_29_0 (app_fusefs))
+(typeattributeset appops_service_29_0 (appops_service))
+(typeattributeset app_prediction_service_29_0 (app_prediction_service))
+(typeattributeset appwidget_service_29_0 (appwidget_service))
+(typeattributeset app_zygote_29_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_29_0 (app_zygote_tmpfs))
+(typeattributeset asec_apk_file_29_0 (asec_apk_file))
+(typeattributeset asec_image_file_29_0 (asec_image_file))
+(typeattributeset asec_public_file_29_0 (asec_public_file))
+(typeattributeset ashmemd_29_0 (ashmemd))
+(typeattributeset ashmem_device_29_0 (ashmem_device))
+(typeattributeset assetatlas_service_29_0 (assetatlas_service))
+(typeattributeset audio_data_file_29_0 (audio_data_file))
+(typeattributeset audio_device_29_0 (audio_device))
+(typeattributeset audiohal_data_file_29_0 (audiohal_data_file))
+(typeattributeset audio_prop_29_0 (audio_prop))
+(typeattributeset audioserver_29_0 (audioserver))
+(typeattributeset audioserver_data_file_29_0 (audioserver_data_file))
+(typeattributeset audioserver_service_29_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_29_0 (audioserver_tmpfs))
+(typeattributeset audio_service_29_0 (audio_service))
+(typeattributeset autofill_service_29_0 (autofill_service))
+(typeattributeset backup_data_file_29_0 (backup_data_file))
+(typeattributeset backup_service_29_0 (backup_service))
+(typeattributeset batteryproperties_service_29_0 (batteryproperties_service))
+(typeattributeset battery_service_29_0 (battery_service))
+(typeattributeset batterystats_service_29_0 (batterystats_service))
+(typeattributeset binder_calls_stats_service_29_0 (binder_calls_stats_service))
+(typeattributeset binder_device_29_0 (binder_device))
+(typeattributeset binfmt_miscfs_29_0 (binfmt_miscfs))
+(typeattributeset biometric_service_29_0 (biometric_service))
+(typeattributeset blkid_29_0 (blkid))
+(typeattributeset blkid_untrusted_29_0 (blkid_untrusted))
+(typeattributeset block_device_29_0 (block_device))
+(typeattributeset bluetooth_29_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_29_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_29_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_data_file_29_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_29_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_29_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_29_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_29_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_29_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_29_0 (bluetooth_socket))
+(typeattributeset bootanim_29_0 (bootanim))
+(typeattributeset bootanim_exec_29_0 (bootanim_exec))
+(typeattributeset boot_block_device_29_0 (boot_block_device))
+(typeattributeset bootchart_data_file_29_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_29_0 (bootloader_boot_reason_prop))
+(typeattributeset bootstat_29_0 (bootstat))
+(typeattributeset bootstat_data_file_29_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_29_0 (bootstat_exec))
+(typeattributeset boottime_prop_29_0 (boottime_prop))
+(typeattributeset boottrace_data_file_29_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_29_0 (bpf_progs_loaded_prop))
+(typeattributeset broadcastradio_service_29_0 (broadcastradio_service))
+(typeattributeset bufferhubd_29_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_29_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_29_0 (bugreport_service))
+(typeattributeset cache_backup_file_29_0 (cache_backup_file))
+(typeattributeset cache_block_device_29_0 (cache_block_device))
+(typeattributeset cache_file_29_0 (cache_file))
+(typeattributeset cache_private_backup_file_29_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_29_0 (cache_recovery_file))
+(typeattributeset camera_data_file_29_0 (camera_data_file))
+(typeattributeset camera_device_29_0 (camera_device))
+(typeattributeset cameraproxy_service_29_0 (cameraproxy_service))
+(typeattributeset cameraserver_29_0 (cameraserver))
+(typeattributeset cameraserver_exec_29_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_29_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_29_0 (cameraserver_tmpfs))
+(typeattributeset cgroup_29_0 (cgroup))
+(typeattributeset cgroup_bpf_29_0 (cgroup_bpf))
+(typeattributeset cgroup_desc_file_29_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_29_0 (cgroup_rc_file))
+(typeattributeset charger_29_0 (charger))
+(typeattributeset charger_exec_29_0 (charger_exec))
+(typeattributeset clatd_29_0 (clatd))
+(typeattributeset clatd_exec_29_0 (clatd_exec))
+(typeattributeset clipboard_service_29_0 (clipboard_service))
+(typeattributeset color_display_service_29_0 (color_display_service))
+(typeattributeset companion_device_service_29_0 (companion_device_service))
+(typeattributeset configfs_29_0 (configfs))
+(typeattributeset config_prop_29_0 (config_prop))
+(typeattributeset connectivity_service_29_0 (connectivity_service))
+(typeattributeset connmetrics_service_29_0 (connmetrics_service))
+(typeattributeset console_device_29_0 (console_device))
+(typeattributeset consumer_ir_service_29_0 (consumer_ir_service))
+(typeattributeset content_capture_service_29_0 (content_capture_service))
+(typeattributeset content_service_29_0 (content_service))
+(typeattributeset content_suggestions_service_29_0 (content_suggestions_service))
+(typeattributeset contexthub_service_29_0 (contexthub_service))
+(typeattributeset coredump_file_29_0 (coredump_file))
+(typeattributeset country_detector_service_29_0 (country_detector_service))
+(typeattributeset coverage_service_29_0 (coverage_service))
+(typeattributeset cppreopt_prop_29_0 (cppreopt_prop))
+(typeattributeset cpuinfo_service_29_0 (cpuinfo_service))
+(typeattributeset cpu_variant_prop_29_0 (cpu_variant_prop))
+(typeattributeset crash_dump_29_0 (crash_dump))
+(typeattributeset crash_dump_exec_29_0 (crash_dump_exec))
+(typeattributeset crossprofileapps_service_29_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_29_0 (ctl_adbd_prop))
+(typeattributeset ctl_bootanim_prop_29_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_29_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_29_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_29_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_29_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_29_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_29_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_29_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_29_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_29_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_29_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_29_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_29_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_29_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_29_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_29_0 (ctl_stop_prop))
+(typeattributeset dalvikcache_data_file_29_0 (dalvikcache_data_file))
+(typeattributeset dalvik_prop_29_0 (dalvik_prop))
+(typeattributeset dbinfo_service_29_0 (dbinfo_service))
+(typeattributeset debugfs_29_0 (debugfs))
+(typeattributeset debugfs_mmc_29_0 (debugfs_mmc))
+(typeattributeset debugfs_trace_marker_29_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_29_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_29_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_29_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_wakeup_sources_29_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_29_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_29_0 (debuggerd_prop))
+(typeattributeset debug_prop_29_0 (debug_prop))
+(typeattributeset default_android_hwservice_29_0 (default_android_hwservice))
+(typeattributeset default_android_service_29_0 (default_android_service))
+(typeattributeset default_android_vndservice_29_0 (default_android_vndservice))
+(typeattributeset default_prop_29_0 (default_prop apk_verity_prop))
+(typeattributeset dev_cpu_variant_29_0 (dev_cpu_variant))
+(typeattributeset device_29_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_29_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_29_0 (device_config_boot_count_prop))
+(typeattributeset device_config_input_native_boot_prop_29_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_29_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_29_0 (device_config_netd_native_prop))
+(typeattributeset device_config_reset_performed_prop_29_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_29_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_29_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_29_0 (device_config_service))
+(typeattributeset device_identifiers_service_29_0 (device_identifiers_service))
+(typeattributeset deviceidle_service_29_0 (deviceidle_service))
+(typeattributeset device_logging_prop_29_0 (device_logging_prop))
+(typeattributeset device_policy_service_29_0 (device_policy_service))
+(typeattributeset devicestoragemonitor_service_29_0 (devicestoragemonitor_service))
+(typeattributeset devpts_29_0 (devpts))
+(typeattributeset dhcp_29_0 (dhcp))
+(typeattributeset dhcp_data_file_29_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_29_0 (dhcp_exec))
+(typeattributeset dhcp_prop_29_0 (dhcp_prop))
+(typeattributeset diskstats_service_29_0 (diskstats_service))
+(typeattributeset display_service_29_0 (display_service))
+(typeattributeset dm_device_29_0 (dm_device))
+(typeattributeset dnsmasq_29_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_29_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_29_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_29_0 (dnsresolver_service))
+(typeattributeset DockObserver_service_29_0 (DockObserver_service))
+(typeattributeset dreams_service_29_0 (dreams_service))
+(typeattributeset drm_data_file_29_0 (drm_data_file))
+(typeattributeset drmserver_29_0 (drmserver))
+(typeattributeset drmserver_exec_29_0 (drmserver_exec))
+(typeattributeset drmserver_service_29_0 (drmserver_service))
+(typeattributeset drmserver_socket_29_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_29_0 (dropbox_data_file))
+(typeattributeset dropbox_service_29_0 (dropbox_service))
+(typeattributeset dumpstate_29_0 (dumpstate))
+(typeattributeset dumpstate_exec_29_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_29_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_29_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_29_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_29_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_29_0 (dynamic_system_prop))
+(typeattributeset e2fs_29_0 (e2fs))
+(typeattributeset e2fs_exec_29_0 (e2fs_exec))
+(typeattributeset efs_file_29_0 (efs_file))
+(typeattributeset ephemeral_app_29_0 (ephemeral_app))
+(typeattributeset ethernet_service_29_0 (ethernet_service))
+(typeattributeset exfat_29_0 (exfat))
+(typeattributeset exported2_config_prop_29_0 (exported2_config_prop systemsound_config_prop))
+(typeattributeset exported2_default_prop_29_0 (exported2_default_prop))
+(typeattributeset exported2_radio_prop_29_0 (exported2_radio_prop))
+(typeattributeset exported2_system_prop_29_0
+ ( exported2_system_prop
+ surfaceflinger_color_prop))
+(typeattributeset exported2_vold_prop_29_0
+ ( exported2_vold_prop
+ vold_config_prop
+ vold_post_fs_data_prop))
+(typeattributeset exported3_default_prop_29_0 (exported3_default_prop lmkd_config_prop))
+(typeattributeset exported3_radio_prop_29_0 (exported3_radio_prop))
+(typeattributeset exported3_system_prop_29_0 (exported3_system_prop boot_status_prop))
+(typeattributeset exported_audio_prop_29_0 (exported_audio_prop audio_config_prop))
+(typeattributeset exported_bluetooth_prop_29_0 (exported_bluetooth_prop))
+(typeattributeset exported_config_prop_29_0 (exported_config_prop))
+(typeattributeset exported_dalvik_prop_29_0 (exported_dalvik_prop dalvik_config_prop))
+(typeattributeset exported_default_prop_29_0
+ ( exported_default_prop
+ surfaceflinger_prop
+ vndk_prop))
+(typeattributeset exported_dumpstate_prop_29_0 (exported_dumpstate_prop))
+(typeattributeset exported_ffs_prop_29_0 (exported_ffs_prop))
+(typeattributeset exported_fingerprint_prop_29_0 (exported_fingerprint_prop))
+(typeattributeset exported_overlay_prop_29_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_29_0 (exported_pm_prop))
+(typeattributeset exported_radio_prop_29_0 (exported_radio_prop))
+(typeattributeset exported_secure_prop_29_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_29_0 (exported_system_prop))
+(typeattributeset exported_system_radio_prop_29_0 (exported_system_radio_prop))
+(typeattributeset exported_vold_prop_29_0 (exported_vold_prop vold_status_prop))
+(typeattributeset exported_wifi_prop_29_0 (exported_wifi_prop))
+(typeattributeset external_vibrator_service_29_0 (external_vibrator_service))
+(typeattributeset face_service_29_0 (face_service))
+(typeattributeset face_vendor_data_file_29_0 (face_vendor_data_file))
+(typeattributeset fastbootd_29_0 (fastbootd))
+(typeattributeset ffs_prop_29_0 (ffs_prop))
+(typeattributeset file_contexts_file_29_0 (file_contexts_file))
+(typeattributeset fingerprintd_29_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_29_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_29_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_29_0 (fingerprintd_service))
+(typeattributeset fingerprint_prop_29_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_29_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_29_0 (fingerprint_vendor_data_file))
+(typeattributeset firstboot_prop_29_0 (firstboot_prop))
+(typeattributeset flags_health_check_29_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_29_0 (flags_health_check_exec))
+(typeattributeset font_service_29_0 (font_service))
+(typeattributeset frp_block_device_29_0 (frp_block_device))
+(typeattributeset fs_bpf_29_0 (fs_bpf))
+(typeattributeset fsck_29_0 (fsck))
+(typeattributeset fsck_exec_29_0 (fsck_exec))
+(typeattributeset fscklogs_29_0 (fscklogs))
+(typeattributeset fsck_untrusted_29_0 (fsck_untrusted))
+(typeattributeset functionfs_29_0 (functionfs))
+(typeattributeset fuse_29_0 (fuse))
+(typeattributeset fuse_device_29_0 (fuse_device))
+(typeattributeset fwk_bufferhub_hwservice_29_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_29_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_29_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_29_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_29_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_29_0 (fwk_stats_hwservice))
+(typeattributeset fwmarkd_socket_29_0 (fwmarkd_socket))
+(typeattributeset gatekeeperd_29_0 (gatekeeperd))
+(typeattributeset gatekeeper_data_file_29_0 (gatekeeper_data_file))
+(typeattributeset gatekeeperd_exec_29_0 (gatekeeperd_exec))
+(typeattributeset gatekeeper_service_29_0 (gatekeeper_service))
+(typeattributeset gfxinfo_service_29_0 (gfxinfo_service))
+(typeattributeset gps_control_29_0 (gps_control))
+(typeattributeset gpu_device_29_0 (gpu_device))
+(typeattributeset gpu_service_29_0 (gpu_service))
+(typeattributeset gpuservice_29_0 (gpuservice))
+(typeattributeset graphics_device_29_0 (graphics_device))
+(typeattributeset graphicsstats_service_29_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_29_0 (gsi_data_file))
+(typeattributeset gsid_prop_29_0 (gsid_prop))
+(typeattributeset gsi_metadata_file_29_0 (gsi_metadata_file))
+(typeattributeset hal_atrace_hwservice_29_0 (hal_atrace_hwservice))
+(typeattributeset hal_audiocontrol_hwservice_29_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audio_hwservice_29_0 (hal_audio_hwservice))
+(typeattributeset hal_authsecret_hwservice_29_0 (hal_authsecret_hwservice))
+(typeattributeset hal_bluetooth_hwservice_29_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_29_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_29_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_29_0 (hal_camera_hwservice))
+(typeattributeset hal_cas_hwservice_29_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_29_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_29_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_29_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_29_0 (hal_contexthub_hwservice))
+(typeattributeset hal_drm_hwservice_29_0 (hal_drm_hwservice))
+(typeattributeset hal_dumpstate_hwservice_29_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_evs_hwservice_29_0 (hal_evs_hwservice))
+(typeattributeset hal_face_hwservice_29_0 (hal_face_hwservice))
+(typeattributeset hal_fingerprint_hwservice_29_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_29_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_29_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_29_0 (hal_gnss_hwservice))
+(typeattributeset hal_graphics_allocator_hwservice_29_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_composer_hwservice_29_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_29_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_mapper_hwservice_29_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_29_0 (hal_health_hwservice))
+(typeattributeset hal_health_storage_hwservice_29_0 (hal_health_storage_hwservice))
+(typeattributeset hal_input_classifier_hwservice_29_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_ir_hwservice_29_0 (hal_ir_hwservice))
+(typeattributeset hal_keymaster_hwservice_29_0 (hal_keymaster_hwservice))
+(typeattributeset hal_light_hwservice_29_0 (hal_light_hwservice))
+(typeattributeset hal_lowpan_hwservice_29_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_29_0 (hal_memtrack_hwservice))
+(typeattributeset hal_neuralnetworks_hwservice_29_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_nfc_hwservice_29_0 (hal_nfc_hwservice))
+(typeattributeset hal_oemlock_hwservice_29_0 (hal_oemlock_hwservice))
+(typeattributeset hal_omx_hwservice_29_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_29_0 (hal_power_hwservice))
+(typeattributeset hal_power_stats_hwservice_29_0 (hal_power_stats_hwservice))
+(typeattributeset hal_renderscript_hwservice_29_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_29_0 (hal_secure_element_hwservice))
+(typeattributeset hal_sensors_hwservice_29_0 (hal_sensors_hwservice))
+(typeattributeset hal_telephony_hwservice_29_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_29_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_29_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_29_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_29_0 (hal_tv_input_hwservice))
+(typeattributeset hal_usb_gadget_hwservice_29_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_29_0 (hal_usb_hwservice))
+(typeattributeset hal_vehicle_hwservice_29_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vibrator_hwservice_29_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vr_hwservice_29_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_29_0 (hal_weaver_hwservice))
+(typeattributeset hal_wifi_hostapd_hwservice_29_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hwservice_29_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_offload_hwservice_29_0 (hal_wifi_offload_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_29_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hardware_properties_service_29_0 (hardware_properties_service))
+(typeattributeset hardware_service_29_0 (hardware_service))
+(typeattributeset hci_attach_dev_29_0 (hci_attach_dev))
+(typeattributeset hdmi_control_service_29_0 (hdmi_control_service))
+(typeattributeset healthd_29_0 (healthd))
+(typeattributeset healthd_exec_29_0 (healthd_exec))
+(typeattributeset heapdump_data_file_29_0 (heapdump_data_file))
+(typeattributeset heapprofd_29_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_29_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_29_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_29_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_29_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_29_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_29_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_29_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_29_0 (hidl_token_hwservice))
+(typeattributeset hwbinder_device_29_0 (hwbinder_device))
+(typeattributeset hw_random_device_29_0 (hw_random_device))
+(typeattributeset hwservice_contexts_file_29_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_29_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_29_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_29_0 (hwservicemanager_prop))
+(typeattributeset icon_file_29_0 (icon_file))
+(typeattributeset idmap_29_0 (idmap))
+(typeattributeset idmap_exec_29_0 (idmap_exec))
+(typeattributeset idmap_service_29_0 (idmap_service))
+(typeattributeset iio_device_29_0 (iio_device))
+(typeattributeset imms_service_29_0 (imms_service))
+(typeattributeset incident_29_0 (incident))
+(typeattributeset incidentd_29_0 (incidentd))
+(typeattributeset incident_data_file_29_0 (incident_data_file))
+(typeattributeset incident_helper_29_0 (incident_helper))
+(typeattributeset incident_service_29_0 (incident_service))
+(typeattributeset init_29_0 (init))
+(typeattributeset init_exec_29_0 (init_exec))
+(typeattributeset init_tmpfs_29_0 (init_tmpfs))
+(typeattributeset inotify_29_0 (inotify))
+(typeattributeset input_device_29_0 (input_device))
+(typeattributeset inputflinger_29_0 (inputflinger))
+(typeattributeset inputflinger_exec_29_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_29_0 (inputflinger_service))
+(typeattributeset input_method_service_29_0 (input_method_service))
+(typeattributeset input_service_29_0 (input_service))
+(typeattributeset installd_29_0 (installd))
+(typeattributeset install_data_file_29_0 (install_data_file))
+(typeattributeset installd_exec_29_0 (installd_exec))
+(typeattributeset installd_service_29_0 (installd_service))
+(typeattributeset install_recovery_29_0 (install_recovery))
+(typeattributeset install_recovery_exec_29_0 (install_recovery_exec))
+(typeattributeset ion_device_29_0 (ion_device))
+(typeattributeset iorapd_29_0 (iorapd))
+(typeattributeset iorapd_data_file_29_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_29_0 (iorapd_exec))
+(typeattributeset iorapd_service_29_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_29_0 (iorapd_tmpfs))
+(typeattributeset IProxyService_service_29_0 (IProxyService_service))
+(typeattributeset ipsec_service_29_0 (ipsec_service))
+(typeattributeset iris_service_29_0 (iris_service))
+(typeattributeset iris_vendor_data_file_29_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_29_0 (isolated_app))
+(typeattributeset jobscheduler_service_29_0 (jobscheduler_service))
+(typeattributeset kernel_29_0 (kernel))
+(typeattributeset keychain_data_file_29_0 (keychain_data_file))
+(typeattributeset keychord_device_29_0 (keychord_device))
+(typeattributeset keystore_29_0 (keystore))
+(typeattributeset keystore_data_file_29_0 (keystore_data_file))
+(typeattributeset keystore_exec_29_0 (keystore_exec))
+(typeattributeset keystore_service_29_0 (keystore_service))
+(typeattributeset kmsg_debug_device_29_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_29_0 (kmsg_device))
+(typeattributeset labeledfs_29_0 (labeledfs))
+(typeattributeset last_boot_reason_prop_29_0 (last_boot_reason_prop))
+(typeattributeset launcherapps_service_29_0 (launcherapps_service))
+(typeattributeset llkd_29_0 (llkd))
+(typeattributeset llkd_exec_29_0 (llkd_exec))
+(typeattributeset llkd_prop_29_0 (llkd_prop))
+(typeattributeset lmkd_29_0 (lmkd))
+(typeattributeset lmkd_exec_29_0 (lmkd_exec))
+(typeattributeset lmkd_socket_29_0 (lmkd_socket))
+(typeattributeset location_service_29_0 (location_service))
+(typeattributeset lock_settings_service_29_0 (lock_settings_service))
+(typeattributeset logcat_exec_29_0 (logcat_exec))
+(typeattributeset logd_29_0 (logd))
+(typeattributeset logd_exec_29_0 (logd_exec))
+(typeattributeset logd_prop_29_0 (logd_prop))
+(typeattributeset logdr_socket_29_0 (logdr_socket))
+(typeattributeset logd_socket_29_0 (logd_socket))
+(typeattributeset logdw_socket_29_0 (logdw_socket))
+(typeattributeset logpersist_29_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_29_0 (logpersistd_logging_prop))
+(typeattributeset log_prop_29_0 (log_prop))
+(typeattributeset log_tag_prop_29_0 (log_tag_prop))
+(typeattributeset loop_control_device_29_0 (loop_control_device))
+(typeattributeset loop_device_29_0 (loop_device))
+(typeattributeset looper_stats_service_29_0 (looper_stats_service))
+(typeattributeset lowpan_device_29_0 (lowpan_device))
+(typeattributeset lowpan_prop_29_0 (lowpan_prop))
+(typeattributeset lowpan_service_29_0 (lowpan_service))
+(typeattributeset lpdumpd_prop_29_0 (lpdumpd_prop))
+(typeattributeset lpdump_service_29_0 (lpdump_service))
+(typeattributeset mac_perms_file_29_0 (mac_perms_file))
+(typeattributeset mdnsd_29_0 (mdnsd))
+(typeattributeset mdnsd_socket_29_0 (mdnsd_socket))
+(typeattributeset mdns_socket_29_0 (mdns_socket))
+(typeattributeset mediacodec_service_29_0 (mediacodec_service))
+(typeattributeset media_data_file_29_0 (media_data_file))
+(typeattributeset mediadrmserver_29_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_29_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_29_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_29_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_29_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_29_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_29_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_29_0 (mediametrics))
+(typeattributeset mediametrics_exec_29_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_29_0 (mediametrics_service))
+(typeattributeset media_projection_service_29_0 (media_projection_service))
+(typeattributeset mediaprovider_29_0 (mediaprovider))
+(typeattributeset media_router_service_29_0 (media_router_service))
+(typeattributeset media_rw_data_file_29_0 (media_rw_data_file))
+(typeattributeset mediaserver_29_0 (mediaserver))
+(typeattributeset mediaserver_exec_29_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_29_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_29_0 (mediaserver_tmpfs))
+(typeattributeset media_session_service_29_0 (media_session_service))
+(typeattributeset mediaswcodec_29_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_29_0 (mediaswcodec_exec))
+(typeattributeset meminfo_service_29_0 (meminfo_service))
+(typeattributeset metadata_block_device_29_0 (metadata_block_device))
+(typeattributeset metadata_file_29_0 (metadata_file))
+(typeattributeset method_trace_data_file_29_0 (method_trace_data_file))
+(typeattributeset midi_service_29_0 (midi_service))
+(typeattributeset misc_block_device_29_0 (misc_block_device))
+(typeattributeset misc_logd_file_29_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_29_0 (misc_user_data_file))
+(typeattributeset mmc_prop_29_0 (mmc_prop))
+(typeattributeset mnt_expand_file_29_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_29_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_29_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_product_file_29_0 (mnt_product_file))
+(typeattributeset mnt_user_file_29_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_29_0 (mnt_vendor_file))
+(typeattributeset modprobe_29_0 (modprobe))
+(typeattributeset mount_service_29_0 (mount_service))
+(typeattributeset mqueue_29_0 (mqueue))
+(typeattributeset mtp_29_0 (mtp))
+(typeattributeset mtp_device_29_0 (mtp_device))
+(typeattributeset mtpd_socket_29_0 (mtpd_socket))
+(typeattributeset mtp_exec_29_0 (mtp_exec))
+(typeattributeset nativetest_data_file_29_0 (nativetest_data_file))
+(typeattributeset netd_29_0 (netd))
+(typeattributeset net_data_file_29_0 (net_data_file))
+(typeattributeset netd_exec_29_0 (netd_exec))
+(typeattributeset netd_listener_service_29_0 (netd_listener_service))
+(typeattributeset net_dns_prop_29_0 (net_dns_prop))
+(typeattributeset netd_service_29_0 (netd_service))
+(typeattributeset netd_stable_secret_prop_29_0 (netd_stable_secret_prop))
+(typeattributeset netif_29_0 (netif))
+(typeattributeset netpolicy_service_29_0 (netpolicy_service))
+(typeattributeset net_radio_prop_29_0 (net_radio_prop))
+(typeattributeset netstats_service_29_0 (netstats_service))
+(typeattributeset netutils_wrapper_29_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_29_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_29_0 (network_management_service))
+(typeattributeset network_score_service_29_0 (network_score_service))
+(typeattributeset network_stack_29_0 (network_stack))
+(typeattributeset network_stack_service_29_0 (network_stack_service))
+(typeattributeset network_time_update_service_29_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_29_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_29_0 (network_watchlist_service))
+(typeattributeset nfc_29_0 (nfc))
+(typeattributeset nfc_data_file_29_0 (nfc_data_file))
+(typeattributeset nfc_device_29_0 (nfc_device))
+(typeattributeset nfc_prop_29_0 (nfc_prop))
+(typeattributeset nfc_service_29_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_29_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_29_0 (node))
+(typeattributeset nonplat_service_contexts_file_29_0 (nonplat_service_contexts_file))
+(typeattributeset notification_service_29_0 (notification_service))
+(typeattributeset null_device_29_0 (null_device))
+(typeattributeset oemfs_29_0 (oemfs))
+(typeattributeset oem_lock_service_29_0 (oem_lock_service))
+(typeattributeset ota_data_file_29_0 (ota_data_file))
+(typeattributeset otadexopt_service_29_0 (otadexopt_service))
+(typeattributeset ota_package_file_29_0 (ota_package_file))
+(typeattributeset overlayfs_file_29_0 (overlayfs_file))
+(typeattributeset overlay_prop_29_0 (overlay_prop))
+(typeattributeset overlay_service_29_0 (overlay_service))
+(typeattributeset owntty_device_29_0 (owntty_device))
+(typeattributeset package_native_service_29_0 (package_native_service))
+(typeattributeset package_service_29_0 (package_service))
+(typeattributeset packages_list_file_29_0 (packages_list_file))
+(typeattributeset pan_result_prop_29_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_29_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_29_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_29_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_29_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_29_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_29_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_29_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_29_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_29_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_29_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_29_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_29_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_29_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_29_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_29_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_29_0 (pdx_performance_dir))
+(typeattributeset perfetto_29_0 (perfetto))
+(typeattributeset performanced_29_0 (performanced))
+(typeattributeset performanced_exec_29_0 (performanced_exec))
+(typeattributeset permissionmgr_service_29_0 (permissionmgr_service))
+(typeattributeset permission_service_29_0 (permission_service))
+(typeattributeset persist_debug_prop_29_0 (persist_debug_prop))
+(typeattributeset persistent_data_block_service_29_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_29_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_29_0 (pinner_service))
+(typeattributeset pipefs_29_0 (pipefs))
+(typeattributeset platform_app_29_0 (platform_app))
+(typeattributeset pm_prop_29_0 (pm_prop))
+(typeattributeset pmsg_device_29_0 (pmsg_device))
+(typeattributeset port_29_0 (port))
+(typeattributeset port_device_29_0 (port_device))
+(typeattributeset postinstall_29_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_29_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_29_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_29_0 (postinstall_mnt_dir))
+(typeattributeset powerctl_prop_29_0 (powerctl_prop))
+(typeattributeset power_service_29_0 (power_service))
+(typeattributeset ppp_29_0 (ppp))
+(typeattributeset ppp_device_29_0 (ppp_device))
+(typeattributeset ppp_exec_29_0 (ppp_exec))
+(typeattributeset preloads_data_file_29_0 (preloads_data_file))
+(typeattributeset preloads_media_file_29_0 (preloads_media_file))
+(typeattributeset print_service_29_0 (print_service))
+(typeattributeset priv_app_29_0 (priv_app))
+(typeattributeset privapp_data_file_29_0 (privapp_data_file))
+(typeattributeset proc_29_0
+ ( proc
+ proc_kpageflags
+ proc_lowmemorykiller
+ proc_watermark_scale_factor))
+(typeattributeset proc_abi_29_0 (proc_abi))
+(typeattributeset proc_asound_29_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_29_0 (proc_bluetooth_writable))
+(typeattributeset proc_buddyinfo_29_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_29_0 (proc_cmdline))
+(typeattributeset proc_cpuinfo_29_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_29_0 (proc_dirty))
+(typeattributeset proc_diskstats_29_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_29_0 (proc_drop_caches))
+(typeattributeset processinfo_service_29_0 (processinfo_service))
+(typeattributeset proc_extra_free_kbytes_29_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_29_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_29_0 (proc_fs_verity))
+(typeattributeset proc_hostname_29_0 (proc_hostname))
+(typeattributeset proc_hung_task_29_0 (proc_hung_task))
+(typeattributeset proc_interrupts_29_0 (proc_interrupts))
+(typeattributeset proc_iomem_29_0 (proc_iomem))
+(typeattributeset proc_keys_29_0 (proc_keys))
+(typeattributeset proc_kmsg_29_0 (proc_kmsg))
+(typeattributeset proc_loadavg_29_0 (proc_loadavg))
+(typeattributeset proc_max_map_count_29_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_29_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_29_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_29_0 (proc_misc))
+(typeattributeset proc_modules_29_0 (proc_modules))
+(typeattributeset proc_mounts_29_0 (proc_mounts))
+(typeattributeset proc_net_29_0 (proc_net))
+(typeattributeset proc_net_tcp_udp_29_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_29_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_29_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_29_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_29_0 (proc_panic))
+(typeattributeset proc_perf_29_0 (proc_perf))
+(typeattributeset proc_pid_max_29_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_29_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_29_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_29_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_29_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_29_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_29_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_29_0 (proc_random))
+(typeattributeset proc_sched_29_0 (proc_sched))
+(typeattributeset proc_security_29_0 (proc_security))
+(typeattributeset proc_slabinfo_29_0 (proc_slabinfo))
+(typeattributeset proc_stat_29_0 (proc_stat))
+(typeattributeset procstats_service_29_0 (procstats_service))
+(typeattributeset proc_swaps_29_0 (proc_swaps))
+(typeattributeset proc_sysrq_29_0 (proc_sysrq))
+(typeattributeset proc_timer_29_0 (proc_timer))
+(typeattributeset proc_tty_drivers_29_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_29_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_29_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_29_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_29_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_29_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_29_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_29_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_29_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_29_0 (proc_uptime))
+(typeattributeset proc_version_29_0 (proc_version))
+(typeattributeset proc_vmallocinfo_29_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_29_0 (proc_vmstat))
+(typeattributeset proc_zoneinfo_29_0 (proc_zoneinfo))
+(typeattributeset profman_29_0 (profman))
+(typeattributeset profman_dump_data_file_29_0 (profman_dump_data_file))
+(typeattributeset profman_exec_29_0 (profman_exec))
+(typeattributeset properties_device_29_0 (properties_device))
+(typeattributeset properties_serial_29_0 (properties_serial))
+(typeattributeset property_contexts_file_29_0 (property_contexts_file))
+(typeattributeset property_data_file_29_0 (property_data_file))
+(typeattributeset property_info_29_0 (property_info))
+(typeattributeset property_socket_29_0 (property_socket))
+(typeattributeset pstorefs_29_0 (pstorefs))
+(typeattributeset ptmx_device_29_0 (ptmx_device))
+(typeattributeset qtaguid_device_29_0 (qtaguid_device))
+(typeattributeset racoon_29_0 (racoon))
+(typeattributeset racoon_exec_29_0 (racoon_exec))
+(typeattributeset racoon_socket_29_0 (racoon_socket))
+(typeattributeset radio_29_0 (radio))
+(typeattributeset radio_data_file_29_0 (radio_data_file))
+(typeattributeset radio_device_29_0 (radio_device))
+(typeattributeset radio_prop_29_0 (radio_prop))
+(typeattributeset radio_service_29_0 (radio_service))
+(typeattributeset ram_device_29_0 (ram_device))
+(typeattributeset random_device_29_0 (random_device))
+(typeattributeset recovery_29_0 (recovery))
+(typeattributeset recovery_block_device_29_0 (recovery_block_device))
+(typeattributeset recovery_data_file_29_0 (recovery_data_file))
+(typeattributeset recovery_persist_29_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_29_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_29_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_29_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_29_0 (recovery_service))
+(typeattributeset recovery_socket_29_0 (recovery_socket))
+(typeattributeset registry_service_29_0 (registry_service))
+(typeattributeset resourcecache_data_file_29_0 (resourcecache_data_file))
+(typeattributeset restorecon_prop_29_0 (restorecon_prop))
+(typeattributeset restrictions_service_29_0 (restrictions_service))
+(typeattributeset rild_debug_socket_29_0 (rild_debug_socket))
+(typeattributeset rild_socket_29_0 (rild_socket))
+(typeattributeset ringtone_file_29_0 (ringtone_file))
+(typeattributeset role_service_29_0 (role_service))
+(typeattributeset rollback_service_29_0 (rollback_service))
+(typeattributeset root_block_device_29_0 (root_block_device))
+(typeattributeset rootfs_29_0 (rootfs))
+(typeattributeset rpmsg_device_29_0 (rpmsg_device))
+(typeattributeset rs_29_0 (rs))
+(typeattributeset rs_exec_29_0 (rs_exec))
+(typeattributeset rss_hwm_reset_29_0 (rss_hwm_reset))
+(typeattributeset rtc_device_29_0 (rtc_device))
+(typeattributeset rttmanager_service_29_0 (rttmanager_service))
+(typeattributeset runas_29_0 (runas))
+(typeattributeset runas_app_29_0 (runas_app))
+(typeattributeset runas_exec_29_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_29_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_29_0 (runtime_service))
+(typeattributeset safemode_prop_29_0 (safemode_prop))
+(typeattributeset same_process_hal_file_29_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_29_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_29_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_29_0 (sdcard_block_device))
+(typeattributeset sdcardd_29_0 (sdcardd))
+(typeattributeset sdcardd_exec_29_0 (sdcardd_exec))
+(typeattributeset sdcardfs_29_0 (sdcardfs))
+(typeattributeset seapp_contexts_file_29_0 (seapp_contexts_file))
+(typeattributeset search_service_29_0 (search_service))
+(typeattributeset sec_key_att_app_id_provider_service_29_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_29_0 (secure_element))
+(typeattributeset secure_element_device_29_0 (secure_element_device))
+(typeattributeset secure_element_service_29_0 (secure_element_service))
+(typeattributeset selinuxfs_29_0 (selinuxfs))
+(typeattributeset sensor_privacy_service_29_0 (sensor_privacy_service))
+(typeattributeset sensors_device_29_0 (sensors_device))
+(typeattributeset sensorservice_service_29_0 (sensorservice_service))
+(typeattributeset sepolicy_file_29_0 (sepolicy_file))
+(typeattributeset serial_device_29_0 (serial_device))
+(typeattributeset serialno_prop_29_0 (serialno_prop))
+(typeattributeset serial_service_29_0 (serial_service))
+(typeattributeset server_configurable_flags_data_file_29_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_29_0 (service_contexts_file))
+(typeattributeset servicediscovery_service_29_0 (servicediscovery_service))
+(typeattributeset servicemanager_29_0 (servicemanager))
+(typeattributeset servicemanager_exec_29_0 (servicemanager_exec))
+(typeattributeset settings_service_29_0 (settings_service))
+(typeattributeset sgdisk_29_0 (sgdisk))
+(typeattributeset sgdisk_exec_29_0 (sgdisk_exec))
+(typeattributeset shared_relro_29_0 (shared_relro))
+(typeattributeset shared_relro_file_29_0 (shared_relro_file))
+(typeattributeset shell_29_0 (shell))
+(typeattributeset shell_data_file_29_0 (shell_data_file))
+(typeattributeset shell_exec_29_0 (shell_exec))
+(typeattributeset shell_prop_29_0 (shell_prop))
+(typeattributeset shm_29_0 (shm))
+(typeattributeset shortcut_manager_icons_29_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_29_0 (shortcut_service))
+(typeattributeset simpleperf_app_runner_29_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_29_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_29_0 (slice_service))
+(typeattributeset slideshow_29_0 (slideshow))
+(typeattributeset socket_device_29_0 (socket_device))
+(typeattributeset sockfs_29_0 (sockfs))
+(typeattributeset staging_data_file_29_0 (staging_data_file))
+(typeattributeset statsd_29_0 (statsd))
+(typeattributeset stats_data_file_29_0 (stats_data_file))
+(typeattributeset statsd_exec_29_0 (statsd_exec))
+(typeattributeset statsdw_socket_29_0 (statsdw_socket))
+(typeattributeset statusbar_service_29_0 (statusbar_service))
+(typeattributeset storaged_service_29_0 (storaged_service))
+(typeattributeset storage_file_29_0 (storage_file))
+(typeattributeset storagestats_service_29_0 (storagestats_service))
+(typeattributeset storage_stub_file_29_0 (storage_stub_file))
+(typeattributeset su_29_0 (su))
+(typeattributeset su_exec_29_0 (su_exec))
+(typeattributeset super_block_device_29_0 (super_block_device))
+(typeattributeset surfaceflinger_29_0 (surfaceflinger))
+(typeattributeset surfaceflinger_service_29_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_29_0 (surfaceflinger_tmpfs))
+(typeattributeset swap_block_device_29_0 (swap_block_device))
+(typeattributeset sysfs_29_0
+ ( sysfs
+ sysfs_ion
+ sysfs_suspend_stats
+ sysfs_wakeup))
+(typeattributeset sysfs_android_usb_29_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_29_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_29_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devices_block_29_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_system_cpu_29_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_29_0 (sysfs_dm))
+(typeattributeset sysfs_dt_firmware_android_29_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_29_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_29_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_29_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_hwrandom_29_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ipv4_29_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_29_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_29_0 (sysfs_leds))
+(typeattributeset sysfs_loop_29_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_29_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_mac_address_29_0 (sysfs_mac_address))
+(typeattributeset sysfs_net_29_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_29_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_29_0 (sysfs_power))
+(typeattributeset sysfs_rtc_29_0 (sysfs_rtc))
+(typeattributeset sysfs_switch_29_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_29_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_29_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uio_29_0 (sysfs_uio))
+(typeattributeset sysfs_usb_29_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_29_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vibrator_29_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_29_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_reasons_29_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_29_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_29_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_29_0 (sysfs_zram_uevent))
+(typeattributeset system_app_29_0 (system_app))
+(typeattributeset system_app_data_file_29_0 (system_app_data_file))
+(typeattributeset system_app_service_29_0 (system_app_service))
+(typeattributeset system_asan_options_file_29_0 (system_asan_options_file))
+(typeattributeset system_block_device_29_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_29_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_29_0 (system_bootstrap_lib_file))
+(typeattributeset system_data_file_29_0 (system_data_file system_data_root_file))
+(typeattributeset system_event_log_tags_file_29_0 (system_event_log_tags_file))
+(typeattributeset system_file_29_0 (system_file))
+(typeattributeset systemkeys_data_file_29_0 (systemkeys_data_file))
+(typeattributeset system_lib_file_29_0 (system_lib_file))
+(typeattributeset system_linker_config_file_29_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_29_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_29_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_29_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_29_0 (system_net_netd_hwservice))
+(typeattributeset system_prop_29_0 (system_prop))
+(typeattributeset system_radio_prop_29_0 (system_radio_prop))
+(typeattributeset system_seccomp_policy_file_29_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_29_0 (system_security_cacerts_file))
+(typeattributeset system_server_29_0 (system_server))
+(typeattributeset system_server_tmpfs_29_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_service_29_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_29_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_29_0 (system_trace_prop))
+(typeattributeset system_update_service_29_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_29_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_29_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_29_0 (system_zoneinfo_file))
+(typeattributeset task_profiles_file_29_0 (task_profiles_file))
+(typeattributeset task_service_29_0 (task_service))
+(typeattributeset tcpdump_exec_29_0 (tcpdump_exec))
+(typeattributeset tee_29_0 (tee))
+(typeattributeset tee_data_file_29_0 (tee_data_file))
+(typeattributeset tee_device_29_0 (tee_device))
+(typeattributeset telecom_service_29_0 (telecom_service))
+(typeattributeset test_boot_reason_prop_29_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_29_0 (test_harness_prop))
+(typeattributeset testharness_service_29_0 (testharness_service))
+(typeattributeset textclassification_service_29_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_29_0 (textclassifier_data_file))
+(typeattributeset textservices_service_29_0 (textservices_service))
+(typeattributeset thermalcallback_hwservice_29_0 (thermalcallback_hwservice))
+(typeattributeset thermal_service_29_0 (thermal_service))
+(typeattributeset timedetector_service_29_0 (timedetector_service))
+(typeattributeset time_prop_29_0 (time_prop))
+(typeattributeset timezone_service_29_0 (timezone_service))
+(typeattributeset tmpfs_29_0
+ ( mnt_sdcard_file
+ tmpfs))
+(typeattributeset tombstoned_29_0 (tombstoned))
+(typeattributeset tombstone_data_file_29_0 (tombstone_data_file))
+(typeattributeset tombstoned_crash_socket_29_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_29_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_29_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_29_0 (tombstoned_java_trace_socket))
+(typeattributeset tombstone_wifi_data_file_29_0 (tombstone_wifi_data_file))
+(typeattributeset toolbox_29_0 (toolbox))
+(typeattributeset toolbox_exec_29_0 (toolbox_exec))
+(typeattributeset traced_29_0 (traced))
+(typeattributeset trace_data_file_29_0 (trace_data_file))
+(typeattributeset traced_consumer_socket_29_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_29_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_29_0 (traced_lazy_prop))
+(typeattributeset traced_probes_29_0 (traced_probes))
+(typeattributeset traced_producer_socket_29_0 (traced_producer_socket))
+(typeattributeset traceur_app_29_0 (traceur_app))
+(typeattributeset trust_service_29_0 (trust_service))
+(typeattributeset tty_device_29_0 (tty_device))
+(typeattributeset tun_device_29_0 (tun_device))
+(typeattributeset tv_input_service_29_0 (tv_input_service))
+(typeattributeset tzdatacheck_29_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_29_0 (tzdatacheck_exec))
+(typeattributeset ueventd_29_0 (ueventd))
+(typeattributeset ueventd_tmpfs_29_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_29_0 (uhid_device))
+(typeattributeset uimode_service_29_0 (uimode_service))
+(typeattributeset uio_device_29_0 (uio_device))
+(typeattributeset uncrypt_29_0 (uncrypt))
+(typeattributeset uncrypt_exec_29_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_29_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_29_0 (unencrypted_data_file))
+(typeattributeset unlabeled_29_0 (unlabeled))
+(typeattributeset untrusted_app_25_29_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_29_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_0 (untrusted_app))
+(typeattributeset update_engine_29_0 (update_engine))
+(typeattributeset update_engine_data_file_29_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_29_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_29_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_29_0 (update_engine_service))
+(typeattributeset updatelock_service_29_0 (updatelock_service))
+(typeattributeset update_verifier_29_0 (update_verifier))
+(typeattributeset update_verifier_exec_29_0 (update_verifier_exec))
+(typeattributeset uri_grants_service_29_0 (uri_grants_service))
+(typeattributeset usagestats_service_29_0 (usagestats_service))
+(typeattributeset usbaccessory_device_29_0 (usbaccessory_device))
+(typeattributeset usbd_29_0 (usbd))
+(typeattributeset usb_device_29_0 (usb_device))
+(typeattributeset usbd_exec_29_0 (usbd_exec))
+(typeattributeset usbfs_29_0 (usbfs))
+(typeattributeset usb_service_29_0 (usb_service))
+(typeattributeset use_memfd_prop_29_0 (use_memfd_prop))
+(typeattributeset userdata_block_device_29_0 (userdata_block_device))
+(typeattributeset usermodehelper_29_0 (usermodehelper))
+(typeattributeset user_profile_data_file_29_0 (user_profile_data_file))
+(typeattributeset user_service_29_0 (user_service))
+(typeattributeset vdc_29_0 (vdc))
+(typeattributeset vdc_exec_29_0 (vdc_exec))
+(typeattributeset vendor_app_file_29_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_29_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_29_0 (vendor_configs_file))
+(typeattributeset vendor_data_file_29_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_29_0 (vendor_default_prop))
+(typeattributeset vendor_file_29_0 (vendor_file))
+(typeattributeset vendor_framework_file_29_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_29_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_29_0 (vendor_idc_file))
+(typeattributeset vendor_init_29_0 (vendor_init))
+(typeattributeset vendor_keychars_file_29_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_29_0 (vendor_keylayout_file))
+(typeattributeset vendor_overlay_file_29_0 (vendor_overlay_file))
+(typeattributeset vendor_public_lib_file_29_0
+ ( vendor_public_framework_file
+ vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_29_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_shell_29_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_29_0 (vendor_shell_exec))
+(typeattributeset vendor_task_profiles_file_29_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_29_0 (vendor_toolbox_exec))
+(typeattributeset vfat_29_0 (vfat))
+(typeattributeset vibrator_service_29_0 (vibrator_service))
+(typeattributeset video_device_29_0 (video_device))
+(typeattributeset virtual_touchpad_29_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_29_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_29_0 (virtual_touchpad_service))
+(typeattributeset vndbinder_device_29_0 (vndbinder_device))
+(typeattributeset vndk_sp_file_29_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_29_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_29_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_29_0 (voiceinteraction_service))
+(typeattributeset vold_29_0 (vold))
+(typeattributeset vold_data_file_29_0 (vold_data_file))
+(typeattributeset vold_device_29_0 (vold_device))
+(typeattributeset vold_exec_29_0 (vold_exec))
+(typeattributeset vold_metadata_file_29_0 (vold_metadata_file))
+(typeattributeset vold_prepare_subdirs_29_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_29_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_29_0 (vold_prop))
+(typeattributeset vold_service_29_0 (vold_service))
+(typeattributeset vpn_data_file_29_0 (vpn_data_file))
+(typeattributeset vrflinger_vsync_service_29_0 (vrflinger_vsync_service))
+(typeattributeset vr_hwc_29_0 (vr_hwc))
+(typeattributeset vr_hwc_exec_29_0 (vr_hwc_exec))
+(typeattributeset vr_hwc_service_29_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_29_0 (vr_manager_service))
+(typeattributeset wallpaper_file_29_0 (wallpaper_file))
+(typeattributeset wallpaper_service_29_0 (wallpaper_service))
+(typeattributeset watchdogd_29_0 (watchdogd))
+(typeattributeset watchdog_device_29_0 (watchdog_device))
+(typeattributeset watchdogd_exec_29_0 (watchdogd_exec))
+(typeattributeset webviewupdate_service_29_0 (webviewupdate_service))
+(typeattributeset webview_zygote_29_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_29_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_29_0 (webview_zygote_tmpfs))
+(typeattributeset wifiaware_service_29_0 (wifiaware_service))
+(typeattributeset wificond_29_0 (wificond))
+(typeattributeset wificond_exec_29_0 (wificond_exec))
+(typeattributeset wificond_service_29_0 (wificond_service wifinl80211_service))
+(typeattributeset wifi_data_file_29_0 (wifi_data_file))
+(typeattributeset wifi_log_prop_29_0 (wifi_log_prop))
+(typeattributeset wifip2p_service_29_0 (wifip2p_service))
+(typeattributeset wifi_prop_29_0 (wifi_prop))
+(typeattributeset wifiscanner_service_29_0 (wifiscanner_service))
+(typeattributeset wifi_service_29_0 (wifi_service))
+(typeattributeset window_service_29_0 (window_service))
+(typeattributeset wpantund_29_0 (wpantund))
+(typeattributeset wpantund_exec_29_0 (wpantund_exec))
+(typeattributeset wpantund_service_29_0 (wpantund_service))
+(typeattributeset wpa_socket_29_0 (wpa_socket))
+(typeattributeset zero_device_29_0 (zero_device))
+(typeattributeset zoneinfo_data_file_29_0 (zoneinfo_data_file))
+(typeattributeset zygote_29_0 (zygote))
+(typeattributeset zygote_exec_29_0 (zygote_exec))
+(typeattributeset zygote_socket_29_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_29_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/29.0/29.0.compat.cil b/prebuilts/api/202504/private/compat/29.0/29.0.compat.cil
new file mode 100644
index 0000000..2d37de6
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/29.0/29.0.compat.cil
@@ -0,0 +1,38 @@
+;; complement CIL file for compatibility between ToT policy and 29.0 vendors.
+;; will be compiled along with other normal policy files, on 29.0 vendors.
+;;
+
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+(allow vendordomain self (netlink_route_socket (nlmsg_readpriv)))
+
+(typeattributeset mlsvendorcompat (and appdomain vendordomain))
+(allow mlsvendorcompat app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mlsvendorcompat app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mlsvendorcompat privapp_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mlsvendorcompat privapp_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+
+;; permission for devices (older than S) where debugfs restriction doesn't apply.
+(typeattribute debugfs_file_type)
+(typeattributeset debugfs_file_type (and debugfs_type file_type))
+(typeattribute debugfs_fs_type)
+(typeattributeset debugfs_fs_type (and debugfs_type fs_type))
+
+(allow dumpstate debugfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate debugfs_mmc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
+(auditallow dumpstate debugfs (file (ioctl read getattr lock map open watch watch_reads)))
+
+(allow init debugfs (dir (getattr relabelfrom)))
+(allow init debugfs (file (getattr relabelfrom)))
+(allow init debugfs (lnk_file (getattr relabelfrom)))
+(allow init debugfs_file_type (file (create getattr open read write setattr relabelfrom unlink map)))
+(allow init debugfs_fs_type (filesystem (mount remount unmount getattr relabelfrom associate quotamod quotaget watch)))
+(allow init debugfs_type (dir (getattr relabelto)))
+(allow init debugfs_type (file (getattr relabelto)))
+(allow init debugfs_type (lnk_file (getattr relabelto)))
+
+(allow system_server debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
+
+(allow vendor_init debugfs_file_type (file (create getattr open read write setattr relabelfrom unlink map)))
+(allow vendor_init debugfs_fs_type (file (open read setattr map)))
diff --git a/prebuilts/api/202504/private/compat/29.0/29.0.ignore.cil b/prebuilts/api/202504/private/compat/29.0/29.0.ignore.cil
new file mode 100644
index 0000000..e40888d
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/29.0/29.0.ignore.cil
@@ -0,0 +1,130 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 29.0 policy. Thus, we do not need to map
+;; these types to previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ aidl_lazy_test_server
+ aidl_lazy_test_server_exec
+ aidl_lazy_test_service
+ adbd_prop
+ apex_module_data_file
+ apex_permission_data_file
+ apex_rollback_data_file
+ apex_wifi_data_file
+ app_integrity_service
+ app_search_service
+ auth_service
+ automotive_display_service
+ automotive_display_service_exec
+ ashmem_libcutils_device
+ blob_store_service
+ binder_cache_bluetooth_server_prop
+ binder_cache_system_server_prop
+ binder_cache_telephony_server_prop
+ binderfs
+ binderfs_logs
+ binderfs_logs_proc
+ boringssl_self_test
+ bq_config_prop
+ cacheinfo_service
+ charger_prop
+ cold_boot_done_prop
+ credstore
+ credstore_data_file
+ credstore_exec
+ credstore_service
+ platform_compat_service
+ ctl_apexd_prop
+ dataloader_manager_service
+ device_config_storage_native_boot_prop
+ device_config_sys_traced_prop
+ device_config_window_manager_native_boot_prop
+ device_config_configuration_prop
+ emergency_affordance_service
+ exported_camera_prop
+ fastbootd_protocol_prop
+ file_integrity_service
+ fwk_automotive_display_hwservice
+ fusectlfs
+ gmscore_app
+ gnss_device
+ graphics_config_prop
+ hal_can_bus_hwservice
+ hal_can_controller_hwservice
+ hal_identity_service
+ hal_light_service
+ hal_power_service
+ hal_rebootescrow_service
+ hal_tv_tuner_hwservice
+ hal_vibrator_service
+ incremental_control_file
+ incremental_prop
+ incremental_service
+ init_perf_lsm_hooks_prop
+ init_svc_debug_prop
+ iorap_inode2filename
+ iorap_inode2filename_data_file
+ iorap_inode2filename_exec
+ iorap_inode2filename_tmpfs
+ iorap_prefetcherd
+ iorap_prefetcherd_data_file
+ iorap_prefetcherd_exec
+ iorap_prefetcherd_tmpfs
+ mediatranscoding_service
+ mediatranscoding
+ mediatranscoding_exec
+ mediatranscoding_tmpfs
+ mirror_data_file
+ light_service
+ linkerconfig_file
+ lmkd_prop
+ media_variant_prop
+ metadata_bootstat_file
+ mnt_pass_through_file
+ mock_ota_prop
+ module_sdkextensions_prop
+ ota_metadata_file
+ ota_prop
+ prereboot_data_file
+ art_apex_dir
+ rebootescrow_hal_prop
+ securityfs
+ service_manager_service
+ service_manager_vndservice
+ simpleperf
+ snapshotctl_log_data_file
+ socket_hook_prop
+ soundtrigger_middleware_service
+ staged_install_file
+ storage_config_prop
+ surfaceflinger_display_prop
+ sysfs_dm_verity
+ system_adbd_prop
+ system_config_service
+ system_group_file
+ system_jvmti_agent_prop
+ system_passwd_file
+ system_unsolzygote_socket
+ tethering_service
+ traced_perf
+ traced_perf_enabled_prop
+ traced_perf_socket
+ timezonedetector_service
+ untrusted_app_29
+ usb_serial_device
+ userspace_reboot_config_prop
+ userspace_reboot_exported_prop
+ userspace_reboot_log_prop
+ userspace_reboot_test_prop
+ vehicle_hal_prop
+ tv_tuner_resource_mgr_service
+ vendor_apex_file
+ vendor_boringssl_self_test
+ vendor_install_recovery
+ vendor_install_recovery_exec
+ vendor_service_contexts_file
+ vendor_socket_hook_prop
+ vendor_socket_hook_prop
+ virtual_ab_prop))
diff --git a/prebuilts/api/202504/private/compat/30.0/30.0.cil b/prebuilts/api/202504/private/compat/30.0/30.0.cil
new file mode 100644
index 0000000..f95488c
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/30.0/30.0.cil
@@ -0,0 +1,2284 @@
+;; types removed from current policy
+(type adbd_prop)
+(type cgroup_bpf)
+(type device_config_configuration_prop)
+(type device_config_storage_native_boot_prop)
+(type device_config_sys_traced_prop)
+(type device_config_window_manager_native_boot_prop)
+(type exported_audio_prop)
+(type exported_dalvik_prop)
+(type exported_ffs_prop)
+(type exported_fingerprint_prop)
+(type exported_radio_prop)
+(type exported_system_radio_prop)
+(type exported_vold_prop)
+(type exported_wifi_prop)
+(type exported2_config_prop)
+(type exported2_default_prop)
+(type exported2_radio_prop)
+(type exported2_system_prop)
+(type exported2_vold_prop)
+(type exported3_default_prop)
+(type exported3_radio_prop)
+(type ffs_prop)
+(type gsid_prop)
+(type init_perf_lsm_hooks_prop)
+(type init_svc_debug_prop)
+(type last_boot_reason_prop)
+(type mediatranscoding_exec)
+(type netd_stable_secret_prop)
+(type pm_prop)
+(type system_adbd_prop)
+(type system_radio_prop)
+(type thermalcallback_hwservice)
+(type traced_perf_enabled_prop)
+(type userspace_reboot_log_prop)
+(type userspace_reboot_test_prop)
+
+(typeattribute binder_in_vendor_violators)
+
+;; mapping information from ToT policy's types to 30.0 policy's types.
+(expandtypeattribute (DockObserver_service_30_0) true)
+(expandtypeattribute (IProxyService_service_30_0) true)
+(expandtypeattribute (accessibility_service_30_0) true)
+(expandtypeattribute (account_service_30_0) true)
+(expandtypeattribute (activity_service_30_0) true)
+(expandtypeattribute (activity_task_service_30_0) true)
+(expandtypeattribute (adb_data_file_30_0) true)
+(expandtypeattribute (adb_keys_file_30_0) true)
+(expandtypeattribute (adb_service_30_0) true)
+(expandtypeattribute (adbd_30_0) true)
+(expandtypeattribute (adbd_exec_30_0) true)
+(expandtypeattribute (adbd_prop_30_0) true)
+(expandtypeattribute (adbd_socket_30_0) true)
+(expandtypeattribute (aidl_lazy_test_server_30_0) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_30_0) true)
+(expandtypeattribute (aidl_lazy_test_service_30_0) true)
+(expandtypeattribute (alarm_service_30_0) true)
+(expandtypeattribute (anr_data_file_30_0) true)
+(expandtypeattribute (apex_data_file_30_0) true)
+(expandtypeattribute (apex_metadata_file_30_0) true)
+(expandtypeattribute (apex_mnt_dir_30_0) true)
+(expandtypeattribute (apex_module_data_file_30_0) true)
+(expandtypeattribute (apex_permission_data_file_30_0) true)
+(expandtypeattribute (apex_rollback_data_file_30_0) true)
+(expandtypeattribute (apex_service_30_0) true)
+(expandtypeattribute (apex_wifi_data_file_30_0) true)
+(expandtypeattribute (apexd_30_0) true)
+(expandtypeattribute (apexd_exec_30_0) true)
+(expandtypeattribute (apexd_prop_30_0) true)
+(expandtypeattribute (apk_data_file_30_0) true)
+(expandtypeattribute (apk_private_data_file_30_0) true)
+(expandtypeattribute (apk_private_tmp_file_30_0) true)
+(expandtypeattribute (apk_tmp_file_30_0) true)
+(expandtypeattribute (apk_verity_prop_30_0) true)
+(expandtypeattribute (app_binding_service_30_0) true)
+(expandtypeattribute (app_data_file_30_0) true)
+(expandtypeattribute (app_fuse_file_30_0) true)
+(expandtypeattribute (app_fusefs_30_0) true)
+(expandtypeattribute (app_integrity_service_30_0) true)
+(expandtypeattribute (app_prediction_service_30_0) true)
+(expandtypeattribute (app_search_service_30_0) true)
+(expandtypeattribute (app_zygote_30_0) true)
+(expandtypeattribute (app_zygote_tmpfs_30_0) true)
+(expandtypeattribute (appdomain_tmpfs_30_0) true)
+(expandtypeattribute (appops_service_30_0) true)
+(expandtypeattribute (appwidget_service_30_0) true)
+(expandtypeattribute (art_apex_dir_30_0) true)
+(expandtypeattribute (asec_apk_file_30_0) true)
+(expandtypeattribute (asec_image_file_30_0) true)
+(expandtypeattribute (asec_public_file_30_0) true)
+(expandtypeattribute (ashmem_device_30_0) true)
+(expandtypeattribute (ashmem_libcutils_device_30_0) true)
+(expandtypeattribute (assetatlas_service_30_0) true)
+(expandtypeattribute (audio_data_file_30_0) true)
+(expandtypeattribute (audio_device_30_0) true)
+(expandtypeattribute (audio_prop_30_0) true)
+(expandtypeattribute (audio_service_30_0) true)
+(expandtypeattribute (audiohal_data_file_30_0) true)
+(expandtypeattribute (audioserver_30_0) true)
+(expandtypeattribute (audioserver_data_file_30_0) true)
+(expandtypeattribute (audioserver_service_30_0) true)
+(expandtypeattribute (audioserver_tmpfs_30_0) true)
+(expandtypeattribute (auth_service_30_0) true)
+(expandtypeattribute (autofill_service_30_0) true)
+(expandtypeattribute (backup_data_file_30_0) true)
+(expandtypeattribute (backup_service_30_0) true)
+(expandtypeattribute (battery_service_30_0) true)
+(expandtypeattribute (batteryproperties_service_30_0) true)
+(expandtypeattribute (batterystats_service_30_0) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_30_0) true)
+(expandtypeattribute (binder_cache_system_server_prop_30_0) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_30_0) true)
+(expandtypeattribute (binder_calls_stats_service_30_0) true)
+(expandtypeattribute (binder_device_30_0) true)
+(expandtypeattribute (binderfs_30_0) true)
+(expandtypeattribute (binderfs_logs_30_0) true)
+(expandtypeattribute (binderfs_logs_proc_30_0) true)
+(expandtypeattribute (binfmt_miscfs_30_0) true)
+(expandtypeattribute (biometric_service_30_0) true)
+(expandtypeattribute (blkid_30_0) true)
+(expandtypeattribute (blkid_untrusted_30_0) true)
+(expandtypeattribute (blob_store_service_30_0) true)
+(expandtypeattribute (block_device_30_0) true)
+(expandtypeattribute (bluetooth_30_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_30_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_30_0) true)
+(expandtypeattribute (bluetooth_data_file_30_0) true)
+(expandtypeattribute (bluetooth_efs_file_30_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_30_0) true)
+(expandtypeattribute (bluetooth_manager_service_30_0) true)
+(expandtypeattribute (bluetooth_prop_30_0) true)
+(expandtypeattribute (bluetooth_service_30_0) true)
+(expandtypeattribute (bluetooth_socket_30_0) true)
+(expandtypeattribute (boot_block_device_30_0) true)
+(expandtypeattribute (bootanim_30_0) true)
+(expandtypeattribute (bootanim_exec_30_0) true)
+(expandtypeattribute (bootchart_data_file_30_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_30_0) true)
+(expandtypeattribute (bootstat_30_0) true)
+(expandtypeattribute (bootstat_data_file_30_0) true)
+(expandtypeattribute (bootstat_exec_30_0) true)
+(expandtypeattribute (boottime_prop_30_0) true)
+(expandtypeattribute (boottime_public_prop_30_0) true)
+(expandtypeattribute (boottrace_data_file_30_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_30_0) true)
+(expandtypeattribute (bq_config_prop_30_0) true)
+(expandtypeattribute (broadcastradio_service_30_0) true)
+(expandtypeattribute (bufferhubd_30_0) true)
+(expandtypeattribute (bufferhubd_exec_30_0) true)
+(expandtypeattribute (bugreport_service_30_0) true)
+(expandtypeattribute (cache_backup_file_30_0) true)
+(expandtypeattribute (cache_block_device_30_0) true)
+(expandtypeattribute (cache_file_30_0) true)
+(expandtypeattribute (cache_private_backup_file_30_0) true)
+(expandtypeattribute (cache_recovery_file_30_0) true)
+(expandtypeattribute (camera_data_file_30_0) true)
+(expandtypeattribute (camera_device_30_0) true)
+(expandtypeattribute (cameraproxy_service_30_0) true)
+(expandtypeattribute (cameraserver_30_0) true)
+(expandtypeattribute (cameraserver_exec_30_0) true)
+(expandtypeattribute (cameraserver_service_30_0) true)
+(expandtypeattribute (cameraserver_tmpfs_30_0) true)
+(expandtypeattribute (cgroup_30_0) true)
+(expandtypeattribute (cgroup_bpf_30_0) true)
+(expandtypeattribute (cgroup_desc_file_30_0) true)
+(expandtypeattribute (cgroup_rc_file_30_0) true)
+(expandtypeattribute (charger_30_0) true)
+(expandtypeattribute (charger_exec_30_0) true)
+(expandtypeattribute (charger_prop_30_0) true)
+(expandtypeattribute (clipboard_service_30_0) true)
+(expandtypeattribute (cold_boot_done_prop_30_0) true)
+(expandtypeattribute (color_display_service_30_0) true)
+(expandtypeattribute (companion_device_service_30_0) true)
+(expandtypeattribute (config_prop_30_0) true)
+(expandtypeattribute (configfs_30_0) true)
+(expandtypeattribute (connectivity_service_30_0) true)
+(expandtypeattribute (connmetrics_service_30_0) true)
+(expandtypeattribute (console_device_30_0) true)
+(expandtypeattribute (consumer_ir_service_30_0) true)
+(expandtypeattribute (content_capture_service_30_0) true)
+(expandtypeattribute (content_service_30_0) true)
+(expandtypeattribute (content_suggestions_service_30_0) true)
+(expandtypeattribute (contexthub_service_30_0) true)
+(expandtypeattribute (coredump_file_30_0) true)
+(expandtypeattribute (country_detector_service_30_0) true)
+(expandtypeattribute (coverage_service_30_0) true)
+(expandtypeattribute (cppreopt_prop_30_0) true)
+(expandtypeattribute (cpu_variant_prop_30_0) true)
+(expandtypeattribute (cpuinfo_service_30_0) true)
+(expandtypeattribute (crash_dump_30_0) true)
+(expandtypeattribute (crash_dump_exec_30_0) true)
+(expandtypeattribute (credstore_30_0) true)
+(expandtypeattribute (credstore_data_file_30_0) true)
+(expandtypeattribute (credstore_exec_30_0) true)
+(expandtypeattribute (credstore_service_30_0) true)
+(expandtypeattribute (crossprofileapps_service_30_0) true)
+(expandtypeattribute (ctl_adbd_prop_30_0) true)
+(expandtypeattribute (ctl_apexd_prop_30_0) true)
+(expandtypeattribute (ctl_bootanim_prop_30_0) true)
+(expandtypeattribute (ctl_bugreport_prop_30_0) true)
+(expandtypeattribute (ctl_console_prop_30_0) true)
+(expandtypeattribute (ctl_default_prop_30_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_30_0) true)
+(expandtypeattribute (ctl_fuse_prop_30_0) true)
+(expandtypeattribute (ctl_gsid_prop_30_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_30_0) true)
+(expandtypeattribute (ctl_interface_start_prop_30_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_30_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_30_0) true)
+(expandtypeattribute (ctl_restart_prop_30_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_30_0) true)
+(expandtypeattribute (ctl_sigstop_prop_30_0) true)
+(expandtypeattribute (ctl_start_prop_30_0) true)
+(expandtypeattribute (ctl_stop_prop_30_0) true)
+(expandtypeattribute (dalvik_prop_30_0) true)
+(expandtypeattribute (dalvikcache_data_file_30_0) true)
+(expandtypeattribute (dataloader_manager_service_30_0) true)
+(expandtypeattribute (dbinfo_service_30_0) true)
+(expandtypeattribute (debug_prop_30_0) true)
+(expandtypeattribute (debugfs_30_0) true)
+(expandtypeattribute (debugfs_mmc_30_0) true)
+(expandtypeattribute (debugfs_trace_marker_30_0) true)
+(expandtypeattribute (debugfs_tracing_30_0) true)
+(expandtypeattribute (debugfs_tracing_debug_30_0) true)
+(expandtypeattribute (debugfs_tracing_instances_30_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_30_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_30_0) true)
+(expandtypeattribute (debuggerd_prop_30_0) true)
+(expandtypeattribute (default_android_hwservice_30_0) true)
+(expandtypeattribute (default_android_service_30_0) true)
+(expandtypeattribute (default_android_vndservice_30_0) true)
+(expandtypeattribute (default_prop_30_0) true)
+(expandtypeattribute (dev_cpu_variant_30_0) true)
+(expandtypeattribute (device_30_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_30_0) true)
+(expandtypeattribute (device_config_boot_count_prop_30_0) true)
+(expandtypeattribute (device_config_configuration_prop_30_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_30_0) true)
+(expandtypeattribute (device_config_media_native_prop_30_0) true)
+(expandtypeattribute (device_config_netd_native_prop_30_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_30_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_30_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_30_0) true)
+(expandtypeattribute (device_config_service_30_0) true)
+(expandtypeattribute (device_config_storage_native_boot_prop_30_0) true)
+(expandtypeattribute (device_config_sys_traced_prop_30_0) true)
+(expandtypeattribute (device_config_window_manager_native_boot_prop_30_0) true)
+(expandtypeattribute (device_identifiers_service_30_0) true)
+(expandtypeattribute (device_logging_prop_30_0) true)
+(expandtypeattribute (device_policy_service_30_0) true)
+(expandtypeattribute (deviceidle_service_30_0) true)
+(expandtypeattribute (devicestoragemonitor_service_30_0) true)
+(expandtypeattribute (devpts_30_0) true)
+(expandtypeattribute (dhcp_30_0) true)
+(expandtypeattribute (dhcp_data_file_30_0) true)
+(expandtypeattribute (dhcp_exec_30_0) true)
+(expandtypeattribute (dhcp_prop_30_0) true)
+(expandtypeattribute (diskstats_service_30_0) true)
+(expandtypeattribute (display_service_30_0) true)
+(expandtypeattribute (dm_device_30_0) true)
+(expandtypeattribute (dnsmasq_30_0) true)
+(expandtypeattribute (dnsmasq_exec_30_0) true)
+(expandtypeattribute (dnsproxyd_socket_30_0) true)
+(expandtypeattribute (dnsresolver_service_30_0) true)
+(expandtypeattribute (dreams_service_30_0) true)
+(expandtypeattribute (drm_data_file_30_0) true)
+(expandtypeattribute (drmserver_30_0) true)
+(expandtypeattribute (drmserver_exec_30_0) true)
+(expandtypeattribute (drmserver_service_30_0) true)
+(expandtypeattribute (drmserver_socket_30_0) true)
+(expandtypeattribute (dropbox_data_file_30_0) true)
+(expandtypeattribute (dropbox_service_30_0) true)
+(expandtypeattribute (dumpstate_30_0) true)
+(expandtypeattribute (dumpstate_exec_30_0) true)
+(expandtypeattribute (dumpstate_options_prop_30_0) true)
+(expandtypeattribute (dumpstate_prop_30_0) true)
+(expandtypeattribute (dumpstate_service_30_0) true)
+(expandtypeattribute (dumpstate_socket_30_0) true)
+(expandtypeattribute (dynamic_system_prop_30_0) true)
+(expandtypeattribute (e2fs_30_0) true)
+(expandtypeattribute (e2fs_exec_30_0) true)
+(expandtypeattribute (efs_file_30_0) true)
+(expandtypeattribute (emergency_affordance_service_30_0) true)
+(expandtypeattribute (ephemeral_app_30_0) true)
+(expandtypeattribute (ethernet_service_30_0) true)
+(expandtypeattribute (exfat_30_0) true)
+(expandtypeattribute (exported2_config_prop_30_0) true)
+(expandtypeattribute (exported2_default_prop_30_0) true)
+(expandtypeattribute (exported2_radio_prop_30_0) true)
+(expandtypeattribute (exported2_system_prop_30_0) true)
+(expandtypeattribute (exported2_vold_prop_30_0) true)
+(expandtypeattribute (exported3_default_prop_30_0) true)
+(expandtypeattribute (exported3_radio_prop_30_0) true)
+(expandtypeattribute (exported3_system_prop_30_0) true)
+(expandtypeattribute (exported_audio_prop_30_0) true)
+(expandtypeattribute (exported_bluetooth_prop_30_0) true)
+(expandtypeattribute (exported_camera_prop_30_0) true)
+(expandtypeattribute (exported_config_prop_30_0) true)
+(expandtypeattribute (exported_dalvik_prop_30_0) true)
+(expandtypeattribute (exported_default_prop_30_0) true)
+(expandtypeattribute (exported_dumpstate_prop_30_0) true)
+(expandtypeattribute (exported_ffs_prop_30_0) true)
+(expandtypeattribute (exported_fingerprint_prop_30_0) true)
+(expandtypeattribute (exported_overlay_prop_30_0) true)
+(expandtypeattribute (exported_pm_prop_30_0) true)
+(expandtypeattribute (exported_radio_prop_30_0) true)
+(expandtypeattribute (exported_secure_prop_30_0) true)
+(expandtypeattribute (exported_system_prop_30_0) true)
+(expandtypeattribute (exported_system_radio_prop_30_0) true)
+(expandtypeattribute (exported_vold_prop_30_0) true)
+(expandtypeattribute (exported_wifi_prop_30_0) true)
+(expandtypeattribute (external_vibrator_service_30_0) true)
+(expandtypeattribute (face_service_30_0) true)
+(expandtypeattribute (face_vendor_data_file_30_0) true)
+(expandtypeattribute (fastbootd_30_0) true)
+(expandtypeattribute (ffs_prop_30_0) true)
+(expandtypeattribute (file_contexts_file_30_0) true)
+(expandtypeattribute (file_integrity_service_30_0) true)
+(expandtypeattribute (fingerprint_service_30_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_30_0) true)
+(expandtypeattribute (fingerprintd_30_0) true)
+(expandtypeattribute (fingerprintd_data_file_30_0) true)
+(expandtypeattribute (fingerprintd_exec_30_0) true)
+(expandtypeattribute (fingerprintd_service_30_0) true)
+(expandtypeattribute (firstboot_prop_30_0) true)
+(expandtypeattribute (flags_health_check_30_0) true)
+(expandtypeattribute (flags_health_check_exec_30_0) true)
+(expandtypeattribute (font_service_30_0) true)
+(expandtypeattribute (frp_block_device_30_0) true)
+(expandtypeattribute (fs_bpf_30_0) true)
+(expandtypeattribute (fsck_30_0) true)
+(expandtypeattribute (fsck_exec_30_0) true)
+(expandtypeattribute (fsck_untrusted_30_0) true)
+(expandtypeattribute (fscklogs_30_0) true)
+(expandtypeattribute (functionfs_30_0) true)
+(expandtypeattribute (fuse_30_0) true)
+(expandtypeattribute (fuse_device_30_0) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_30_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_30_0) true)
+(expandtypeattribute (fwk_camera_hwservice_30_0) true)
+(expandtypeattribute (fwk_display_hwservice_30_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_30_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_30_0) true)
+(expandtypeattribute (fwk_stats_hwservice_30_0) true)
+(expandtypeattribute (fwmarkd_socket_30_0) true)
+(expandtypeattribute (gatekeeper_data_file_30_0) true)
+(expandtypeattribute (gatekeeper_service_30_0) true)
+(expandtypeattribute (gatekeeperd_30_0) true)
+(expandtypeattribute (gatekeeperd_exec_30_0) true)
+(expandtypeattribute (gfxinfo_service_30_0) true)
+(expandtypeattribute (gmscore_app_30_0) true)
+(expandtypeattribute (gps_control_30_0) true)
+(expandtypeattribute (gpu_device_30_0) true)
+(expandtypeattribute (gpu_service_30_0) true)
+(expandtypeattribute (gpuservice_30_0) true)
+(expandtypeattribute (graphics_device_30_0) true)
+(expandtypeattribute (graphicsstats_service_30_0) true)
+(expandtypeattribute (gsi_data_file_30_0) true)
+(expandtypeattribute (gsi_metadata_file_30_0) true)
+(expandtypeattribute (gsid_prop_30_0) true)
+(expandtypeattribute (hal_atrace_hwservice_30_0) true)
+(expandtypeattribute (hal_audio_hwservice_30_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_30_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_30_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_30_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_30_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_30_0) true)
+(expandtypeattribute (hal_camera_hwservice_30_0) true)
+(expandtypeattribute (hal_can_bus_hwservice_30_0) true)
+(expandtypeattribute (hal_can_controller_hwservice_30_0) true)
+(expandtypeattribute (hal_cas_hwservice_30_0) true)
+(expandtypeattribute (hal_codec2_hwservice_30_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_30_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_30_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_30_0) true)
+(expandtypeattribute (hal_drm_hwservice_30_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_30_0) true)
+(expandtypeattribute (hal_evs_hwservice_30_0) true)
+(expandtypeattribute (hal_face_hwservice_30_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_30_0) true)
+(expandtypeattribute (hal_fingerprint_service_30_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_30_0) true)
+(expandtypeattribute (hal_gnss_hwservice_30_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_30_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_30_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_30_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_30_0) true)
+(expandtypeattribute (hal_health_hwservice_30_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_30_0) true)
+(expandtypeattribute (hal_identity_service_30_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_30_0) true)
+(expandtypeattribute (hal_ir_hwservice_30_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_30_0) true)
+(expandtypeattribute (hal_light_hwservice_30_0) true)
+(expandtypeattribute (hal_light_service_30_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_30_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_30_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_30_0) true)
+(expandtypeattribute (hal_nfc_hwservice_30_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_30_0) true)
+(expandtypeattribute (hal_omx_hwservice_30_0) true)
+(expandtypeattribute (hal_power_hwservice_30_0) true)
+(expandtypeattribute (hal_power_service_30_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_30_0) true)
+(expandtypeattribute (hal_rebootescrow_service_30_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_30_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_30_0) true)
+(expandtypeattribute (hal_sensors_hwservice_30_0) true)
+(expandtypeattribute (hal_telephony_hwservice_30_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_30_0) true)
+(expandtypeattribute (hal_thermal_hwservice_30_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_30_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_30_0) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_30_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_30_0) true)
+(expandtypeattribute (hal_usb_hwservice_30_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_30_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_30_0) true)
+(expandtypeattribute (hal_vibrator_service_30_0) true)
+(expandtypeattribute (hal_vr_hwservice_30_0) true)
+(expandtypeattribute (hal_weaver_hwservice_30_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_30_0) true)
+(expandtypeattribute (hal_wifi_hwservice_30_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_30_0) true)
+(expandtypeattribute (hardware_properties_service_30_0) true)
+(expandtypeattribute (hardware_service_30_0) true)
+(expandtypeattribute (hci_attach_dev_30_0) true)
+(expandtypeattribute (hdmi_control_service_30_0) true)
+(expandtypeattribute (healthd_30_0) true)
+(expandtypeattribute (healthd_exec_30_0) true)
+(expandtypeattribute (heapdump_data_file_30_0) true)
+(expandtypeattribute (heapprofd_30_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_30_0) true)
+(expandtypeattribute (heapprofd_prop_30_0) true)
+(expandtypeattribute (heapprofd_socket_30_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_30_0) true)
+(expandtypeattribute (hidl_base_hwservice_30_0) true)
+(expandtypeattribute (hidl_manager_hwservice_30_0) true)
+(expandtypeattribute (hidl_memory_hwservice_30_0) true)
+(expandtypeattribute (hidl_token_hwservice_30_0) true)
+(expandtypeattribute (hw_random_device_30_0) true)
+(expandtypeattribute (hwbinder_device_30_0) true)
+(expandtypeattribute (hwservice_contexts_file_30_0) true)
+(expandtypeattribute (hwservicemanager_30_0) true)
+(expandtypeattribute (hwservicemanager_exec_30_0) true)
+(expandtypeattribute (hwservicemanager_prop_30_0) true)
+(expandtypeattribute (icon_file_30_0) true)
+(expandtypeattribute (idmap_30_0) true)
+(expandtypeattribute (idmap_exec_30_0) true)
+(expandtypeattribute (idmap_service_30_0) true)
+(expandtypeattribute (iio_device_30_0) true)
+(expandtypeattribute (imms_service_30_0) true)
+(expandtypeattribute (incident_30_0) true)
+(expandtypeattribute (incident_data_file_30_0) true)
+(expandtypeattribute (incident_helper_30_0) true)
+(expandtypeattribute (incident_service_30_0) true)
+(expandtypeattribute (incidentd_30_0) true)
+(expandtypeattribute (incremental_control_file_30_0) true)
+(expandtypeattribute (incremental_prop_30_0) true)
+(expandtypeattribute (incremental_service_30_0) true)
+(expandtypeattribute (init_30_0) true)
+(expandtypeattribute (init_exec_30_0) true)
+(expandtypeattribute (init_perf_lsm_hooks_prop_30_0) true)
+(expandtypeattribute (init_svc_debug_prop_30_0) true)
+(expandtypeattribute (init_tmpfs_30_0) true)
+(expandtypeattribute (inotify_30_0) true)
+(expandtypeattribute (input_device_30_0) true)
+(expandtypeattribute (input_method_service_30_0) true)
+(expandtypeattribute (input_service_30_0) true)
+(expandtypeattribute (inputflinger_30_0) true)
+(expandtypeattribute (inputflinger_exec_30_0) true)
+(expandtypeattribute (inputflinger_service_30_0) true)
+(expandtypeattribute (install_data_file_30_0) true)
+(expandtypeattribute (installd_30_0) true)
+(expandtypeattribute (installd_exec_30_0) true)
+(expandtypeattribute (installd_service_30_0) true)
+(expandtypeattribute (ion_device_30_0) true)
+(expandtypeattribute (iorap_inode2filename_30_0) true)
+(expandtypeattribute (iorap_inode2filename_exec_30_0) true)
+(expandtypeattribute (iorap_inode2filename_tmpfs_30_0) true)
+(expandtypeattribute (iorap_prefetcherd_30_0) true)
+(expandtypeattribute (iorap_prefetcherd_exec_30_0) true)
+(expandtypeattribute (iorap_prefetcherd_tmpfs_30_0) true)
+(expandtypeattribute (iorapd_30_0) true)
+(expandtypeattribute (iorapd_data_file_30_0) true)
+(expandtypeattribute (iorapd_exec_30_0) true)
+(expandtypeattribute (iorapd_service_30_0) true)
+(expandtypeattribute (iorapd_tmpfs_30_0) true)
+(expandtypeattribute (ipsec_service_30_0) true)
+(expandtypeattribute (iris_service_30_0) true)
+(expandtypeattribute (iris_vendor_data_file_30_0) true)
+(expandtypeattribute (isolated_app_30_0) true)
+(expandtypeattribute (jobscheduler_service_30_0) true)
+(expandtypeattribute (kernel_30_0) true)
+(expandtypeattribute (keychain_data_file_30_0) true)
+(expandtypeattribute (keychord_device_30_0) true)
+(expandtypeattribute (keystore_30_0) true)
+(expandtypeattribute (keystore_data_file_30_0) true)
+(expandtypeattribute (keystore_exec_30_0) true)
+(expandtypeattribute (keystore_service_30_0) true)
+(expandtypeattribute (kmsg_debug_device_30_0) true)
+(expandtypeattribute (kmsg_device_30_0) true)
+(expandtypeattribute (labeledfs_30_0) true)
+(expandtypeattribute (last_boot_reason_prop_30_0) true)
+(expandtypeattribute (launcherapps_service_30_0) true)
+(expandtypeattribute (light_service_30_0) true)
+(expandtypeattribute (linkerconfig_file_30_0) true)
+(expandtypeattribute (llkd_30_0) true)
+(expandtypeattribute (llkd_exec_30_0) true)
+(expandtypeattribute (llkd_prop_30_0) true)
+(expandtypeattribute (lmkd_30_0) true)
+(expandtypeattribute (lmkd_exec_30_0) true)
+(expandtypeattribute (lmkd_prop_30_0) true)
+(expandtypeattribute (lmkd_socket_30_0) true)
+(expandtypeattribute (location_service_30_0) true)
+(expandtypeattribute (lock_settings_service_30_0) true)
+(expandtypeattribute (log_prop_30_0) true)
+(expandtypeattribute (log_tag_prop_30_0) true)
+(expandtypeattribute (logcat_exec_30_0) true)
+(expandtypeattribute (logd_30_0) true)
+(expandtypeattribute (logd_exec_30_0) true)
+(expandtypeattribute (logd_prop_30_0) true)
+(expandtypeattribute (logd_socket_30_0) true)
+(expandtypeattribute (logdr_socket_30_0) true)
+(expandtypeattribute (logdw_socket_30_0) true)
+(expandtypeattribute (logpersist_30_0) true)
+(expandtypeattribute (logpersistd_logging_prop_30_0) true)
+(expandtypeattribute (loop_control_device_30_0) true)
+(expandtypeattribute (loop_device_30_0) true)
+(expandtypeattribute (looper_stats_service_30_0) true)
+(expandtypeattribute (lowpan_device_30_0) true)
+(expandtypeattribute (lowpan_prop_30_0) true)
+(expandtypeattribute (lowpan_service_30_0) true)
+(expandtypeattribute (lpdump_service_30_0) true)
+(expandtypeattribute (lpdumpd_prop_30_0) true)
+(expandtypeattribute (mac_perms_file_30_0) true)
+(expandtypeattribute (mdns_socket_30_0) true)
+(expandtypeattribute (mdnsd_30_0) true)
+(expandtypeattribute (mdnsd_socket_30_0) true)
+(expandtypeattribute (media_data_file_30_0) true)
+(expandtypeattribute (media_projection_service_30_0) true)
+(expandtypeattribute (media_router_service_30_0) true)
+(expandtypeattribute (media_rw_data_file_30_0) true)
+(expandtypeattribute (media_session_service_30_0) true)
+(expandtypeattribute (media_variant_prop_30_0) true)
+(expandtypeattribute (mediadrmserver_30_0) true)
+(expandtypeattribute (mediadrmserver_exec_30_0) true)
+(expandtypeattribute (mediadrmserver_service_30_0) true)
+(expandtypeattribute (mediaextractor_30_0) true)
+(expandtypeattribute (mediaextractor_exec_30_0) true)
+(expandtypeattribute (mediaextractor_service_30_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_30_0) true)
+(expandtypeattribute (mediametrics_30_0) true)
+(expandtypeattribute (mediametrics_exec_30_0) true)
+(expandtypeattribute (mediametrics_service_30_0) true)
+(expandtypeattribute (mediaprovider_30_0) true)
+(expandtypeattribute (mediaserver_30_0) true)
+(expandtypeattribute (mediaserver_exec_30_0) true)
+(expandtypeattribute (mediaserver_service_30_0) true)
+(expandtypeattribute (mediaserver_tmpfs_30_0) true)
+(expandtypeattribute (mediaswcodec_30_0) true)
+(expandtypeattribute (mediaswcodec_exec_30_0) true)
+(expandtypeattribute (mediatranscoding_30_0) true)
+(expandtypeattribute (mediatranscoding_exec_30_0) true)
+(expandtypeattribute (mediatranscoding_service_30_0) true)
+(expandtypeattribute (meminfo_service_30_0) true)
+(expandtypeattribute (metadata_block_device_30_0) true)
+(expandtypeattribute (metadata_bootstat_file_30_0) true)
+(expandtypeattribute (metadata_file_30_0) true)
+(expandtypeattribute (method_trace_data_file_30_0) true)
+(expandtypeattribute (midi_service_30_0) true)
+(expandtypeattribute (mirror_data_file_30_0) true)
+(expandtypeattribute (misc_block_device_30_0) true)
+(expandtypeattribute (misc_logd_file_30_0) true)
+(expandtypeattribute (misc_user_data_file_30_0) true)
+(expandtypeattribute (mmc_prop_30_0) true)
+(expandtypeattribute (mnt_expand_file_30_0) true)
+(expandtypeattribute (mnt_media_rw_file_30_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_30_0) true)
+(expandtypeattribute (mnt_pass_through_file_30_0) true)
+(expandtypeattribute (mnt_product_file_30_0) true)
+(expandtypeattribute (mnt_sdcard_file_30_0) true)
+(expandtypeattribute (mnt_user_file_30_0) true)
+(expandtypeattribute (mnt_vendor_file_30_0) true)
+(expandtypeattribute (mock_ota_prop_30_0) true)
+(expandtypeattribute (modprobe_30_0) true)
+(expandtypeattribute (module_sdkextensions_prop_30_0) true)
+(expandtypeattribute (mount_service_30_0) true)
+(expandtypeattribute (mqueue_30_0) true)
+(expandtypeattribute (mtp_30_0) true)
+(expandtypeattribute (mtp_device_30_0) true)
+(expandtypeattribute (mtp_exec_30_0) true)
+(expandtypeattribute (mtpd_socket_30_0) true)
+(expandtypeattribute (nativetest_data_file_30_0) true)
+(expandtypeattribute (net_data_file_30_0) true)
+(expandtypeattribute (net_dns_prop_30_0) true)
+(expandtypeattribute (net_radio_prop_30_0) true)
+(expandtypeattribute (netd_30_0) true)
+(expandtypeattribute (netd_exec_30_0) true)
+(expandtypeattribute (netd_listener_service_30_0) true)
+(expandtypeattribute (netd_service_30_0) true)
+(expandtypeattribute (netd_stable_secret_prop_30_0) true)
+(expandtypeattribute (netif_30_0) true)
+(expandtypeattribute (netpolicy_service_30_0) true)
+(expandtypeattribute (netstats_service_30_0) true)
+(expandtypeattribute (netutils_wrapper_30_0) true)
+(expandtypeattribute (netutils_wrapper_exec_30_0) true)
+(expandtypeattribute (network_management_service_30_0) true)
+(expandtypeattribute (network_score_service_30_0) true)
+(expandtypeattribute (network_stack_30_0) true)
+(expandtypeattribute (network_stack_service_30_0) true)
+(expandtypeattribute (network_time_update_service_30_0) true)
+(expandtypeattribute (network_watchlist_data_file_30_0) true)
+(expandtypeattribute (network_watchlist_service_30_0) true)
+(expandtypeattribute (nfc_30_0) true)
+(expandtypeattribute (nfc_data_file_30_0) true)
+(expandtypeattribute (nfc_device_30_0) true)
+(expandtypeattribute (nfc_prop_30_0) true)
+(expandtypeattribute (nfc_service_30_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_30_0) true)
+(expandtypeattribute (node_30_0) true)
+(expandtypeattribute (nonplat_service_contexts_file_30_0) true)
+(expandtypeattribute (notification_service_30_0) true)
+(expandtypeattribute (null_device_30_0) true)
+(expandtypeattribute (oem_lock_service_30_0) true)
+(expandtypeattribute (oemfs_30_0) true)
+(expandtypeattribute (ota_data_file_30_0) true)
+(expandtypeattribute (ota_metadata_file_30_0) true)
+(expandtypeattribute (ota_package_file_30_0) true)
+(expandtypeattribute (ota_prop_30_0) true)
+(expandtypeattribute (otadexopt_service_30_0) true)
+(expandtypeattribute (overlay_prop_30_0) true)
+(expandtypeattribute (overlay_service_30_0) true)
+(expandtypeattribute (overlayfs_file_30_0) true)
+(expandtypeattribute (owntty_device_30_0) true)
+(expandtypeattribute (package_native_service_30_0) true)
+(expandtypeattribute (package_service_30_0) true)
+(expandtypeattribute (packages_list_file_30_0) true)
+(expandtypeattribute (pan_result_prop_30_0) true)
+(expandtypeattribute (password_slot_metadata_file_30_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_30_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_30_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_30_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_display_dir_30_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_30_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_30_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_30_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_30_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_30_0) true)
+(expandtypeattribute (pdx_performance_dir_30_0) true)
+(expandtypeattribute (perfetto_30_0) true)
+(expandtypeattribute (performanced_30_0) true)
+(expandtypeattribute (performanced_exec_30_0) true)
+(expandtypeattribute (permission_service_30_0) true)
+(expandtypeattribute (permissionmgr_service_30_0) true)
+(expandtypeattribute (persist_debug_prop_30_0) true)
+(expandtypeattribute (persistent_data_block_service_30_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_30_0) true)
+(expandtypeattribute (pinner_service_30_0) true)
+(expandtypeattribute (pipefs_30_0) true)
+(expandtypeattribute (platform_app_30_0) true)
+(expandtypeattribute (platform_compat_service_30_0) true)
+(expandtypeattribute (pm_prop_30_0) true)
+(expandtypeattribute (pmsg_device_30_0) true)
+(expandtypeattribute (port_30_0) true)
+(expandtypeattribute (port_device_30_0) true)
+(expandtypeattribute (postinstall_30_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_30_0) true)
+(expandtypeattribute (postinstall_file_30_0) true)
+(expandtypeattribute (postinstall_mnt_dir_30_0) true)
+(expandtypeattribute (power_service_30_0) true)
+(expandtypeattribute (powerctl_prop_30_0) true)
+(expandtypeattribute (ppp_30_0) true)
+(expandtypeattribute (ppp_device_30_0) true)
+(expandtypeattribute (ppp_exec_30_0) true)
+(expandtypeattribute (preloads_data_file_30_0) true)
+(expandtypeattribute (preloads_media_file_30_0) true)
+(expandtypeattribute (prereboot_data_file_30_0) true)
+(expandtypeattribute (print_service_30_0) true)
+(expandtypeattribute (priv_app_30_0) true)
+(expandtypeattribute (privapp_data_file_30_0) true)
+(expandtypeattribute (proc_30_0) true)
+(expandtypeattribute (proc_abi_30_0) true)
+(expandtypeattribute (proc_asound_30_0) true)
+(expandtypeattribute (proc_bluetooth_writable_30_0) true)
+(expandtypeattribute (proc_buddyinfo_30_0) true)
+(expandtypeattribute (proc_cmdline_30_0) true)
+(expandtypeattribute (proc_cpuinfo_30_0) true)
+(expandtypeattribute (proc_dirty_30_0) true)
+(expandtypeattribute (proc_diskstats_30_0) true)
+(expandtypeattribute (proc_drop_caches_30_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_30_0) true)
+(expandtypeattribute (proc_filesystems_30_0) true)
+(expandtypeattribute (proc_fs_verity_30_0) true)
+(expandtypeattribute (proc_hostname_30_0) true)
+(expandtypeattribute (proc_hung_task_30_0) true)
+(expandtypeattribute (proc_interrupts_30_0) true)
+(expandtypeattribute (proc_iomem_30_0) true)
+(expandtypeattribute (proc_keys_30_0) true)
+(expandtypeattribute (proc_kmsg_30_0) true)
+(expandtypeattribute (proc_kpageflags_30_0) true)
+(expandtypeattribute (proc_loadavg_30_0) true)
+(expandtypeattribute (proc_lowmemorykiller_30_0) true)
+(expandtypeattribute (proc_max_map_count_30_0) true)
+(expandtypeattribute (proc_meminfo_30_0) true)
+(expandtypeattribute (proc_min_free_order_shift_30_0) true)
+(expandtypeattribute (proc_misc_30_0) true)
+(expandtypeattribute (proc_modules_30_0) true)
+(expandtypeattribute (proc_mounts_30_0) true)
+(expandtypeattribute (proc_net_30_0) true)
+(expandtypeattribute (proc_net_tcp_udp_30_0) true)
+(expandtypeattribute (proc_overcommit_memory_30_0) true)
+(expandtypeattribute (proc_page_cluster_30_0) true)
+(expandtypeattribute (proc_pagetypeinfo_30_0) true)
+(expandtypeattribute (proc_panic_30_0) true)
+(expandtypeattribute (proc_perf_30_0) true)
+(expandtypeattribute (proc_pid_max_30_0) true)
+(expandtypeattribute (proc_pipe_conf_30_0) true)
+(expandtypeattribute (proc_pressure_cpu_30_0) true)
+(expandtypeattribute (proc_pressure_io_30_0) true)
+(expandtypeattribute (proc_pressure_mem_30_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_30_0) true)
+(expandtypeattribute (proc_qtaguid_stat_30_0) true)
+(expandtypeattribute (proc_random_30_0) true)
+(expandtypeattribute (proc_sched_30_0) true)
+(expandtypeattribute (proc_security_30_0) true)
+(expandtypeattribute (proc_slabinfo_30_0) true)
+(expandtypeattribute (proc_stat_30_0) true)
+(expandtypeattribute (proc_swaps_30_0) true)
+(expandtypeattribute (proc_sysrq_30_0) true)
+(expandtypeattribute (proc_timer_30_0) true)
+(expandtypeattribute (proc_tty_drivers_30_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_30_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_30_0) true)
+(expandtypeattribute (proc_uid_cpupower_30_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_30_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_30_0) true)
+(expandtypeattribute (proc_uid_io_stats_30_0) true)
+(expandtypeattribute (proc_uid_procstat_set_30_0) true)
+(expandtypeattribute (proc_uid_time_in_state_30_0) true)
+(expandtypeattribute (proc_uptime_30_0) true)
+(expandtypeattribute (proc_version_30_0) true)
+(expandtypeattribute (proc_vmallocinfo_30_0) true)
+(expandtypeattribute (proc_vmstat_30_0) true)
+(expandtypeattribute (proc_zoneinfo_30_0) true)
+(expandtypeattribute (processinfo_service_30_0) true)
+(expandtypeattribute (procstats_service_30_0) true)
+(expandtypeattribute (profman_30_0) true)
+(expandtypeattribute (profman_dump_data_file_30_0) true)
+(expandtypeattribute (profman_exec_30_0) true)
+(expandtypeattribute (properties_device_30_0) true)
+(expandtypeattribute (properties_serial_30_0) true)
+(expandtypeattribute (property_contexts_file_30_0) true)
+(expandtypeattribute (property_data_file_30_0) true)
+(expandtypeattribute (property_info_30_0) true)
+(expandtypeattribute (property_socket_30_0) true)
+(expandtypeattribute (pstorefs_30_0) true)
+(expandtypeattribute (ptmx_device_30_0) true)
+(expandtypeattribute (qtaguid_device_30_0) true)
+(expandtypeattribute (racoon_30_0) true)
+(expandtypeattribute (racoon_exec_30_0) true)
+(expandtypeattribute (racoon_socket_30_0) true)
+(expandtypeattribute (radio_30_0) true)
+(expandtypeattribute (radio_data_file_30_0) true)
+(expandtypeattribute (radio_device_30_0) true)
+(expandtypeattribute (radio_prop_30_0) true)
+(expandtypeattribute (radio_service_30_0) true)
+(expandtypeattribute (ram_device_30_0) true)
+(expandtypeattribute (random_device_30_0) true)
+(expandtypeattribute (rebootescrow_hal_prop_30_0) true)
+(expandtypeattribute (recovery_30_0) true)
+(expandtypeattribute (recovery_block_device_30_0) true)
+(expandtypeattribute (recovery_data_file_30_0) true)
+(expandtypeattribute (recovery_persist_30_0) true)
+(expandtypeattribute (recovery_persist_exec_30_0) true)
+(expandtypeattribute (recovery_refresh_30_0) true)
+(expandtypeattribute (recovery_refresh_exec_30_0) true)
+(expandtypeattribute (recovery_service_30_0) true)
+(expandtypeattribute (recovery_socket_30_0) true)
+(expandtypeattribute (registry_service_30_0) true)
+(expandtypeattribute (resourcecache_data_file_30_0) true)
+(expandtypeattribute (restorecon_prop_30_0) true)
+(expandtypeattribute (restrictions_service_30_0) true)
+(expandtypeattribute (rild_debug_socket_30_0) true)
+(expandtypeattribute (rild_socket_30_0) true)
+(expandtypeattribute (ringtone_file_30_0) true)
+(expandtypeattribute (role_service_30_0) true)
+(expandtypeattribute (rollback_service_30_0) true)
+(expandtypeattribute (root_block_device_30_0) true)
+(expandtypeattribute (rootfs_30_0) true)
+(expandtypeattribute (rpmsg_device_30_0) true)
+(expandtypeattribute (rs_30_0) true)
+(expandtypeattribute (rs_exec_30_0) true)
+(expandtypeattribute (rss_hwm_reset_30_0) true)
+(expandtypeattribute (rtc_device_30_0) true)
+(expandtypeattribute (rttmanager_service_30_0) true)
+(expandtypeattribute (runas_30_0) true)
+(expandtypeattribute (runas_app_30_0) true)
+(expandtypeattribute (runas_exec_30_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_30_0) true)
+(expandtypeattribute (runtime_service_30_0) true)
+(expandtypeattribute (safemode_prop_30_0) true)
+(expandtypeattribute (same_process_hal_file_30_0) true)
+(expandtypeattribute (samplingprofiler_service_30_0) true)
+(expandtypeattribute (scheduling_policy_service_30_0) true)
+(expandtypeattribute (sdcard_block_device_30_0) true)
+(expandtypeattribute (sdcardd_30_0) true)
+(expandtypeattribute (sdcardd_exec_30_0) true)
+(expandtypeattribute (sdcardfs_30_0) true)
+(expandtypeattribute (seapp_contexts_file_30_0) true)
+(expandtypeattribute (search_service_30_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_30_0) true)
+(expandtypeattribute (secure_element_30_0) true)
+(expandtypeattribute (secure_element_device_30_0) true)
+(expandtypeattribute (secure_element_service_30_0) true)
+(expandtypeattribute (securityfs_30_0) true)
+(expandtypeattribute (selinuxfs_30_0) true)
+(expandtypeattribute (sensor_privacy_service_30_0) true)
+(expandtypeattribute (sensors_device_30_0) true)
+(expandtypeattribute (sensorservice_service_30_0) true)
+(expandtypeattribute (sepolicy_file_30_0) true)
+(expandtypeattribute (serial_device_30_0) true)
+(expandtypeattribute (serial_service_30_0) true)
+(expandtypeattribute (serialno_prop_30_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_30_0) true)
+(expandtypeattribute (service_contexts_file_30_0) true)
+(expandtypeattribute (service_manager_service_30_0) true)
+(expandtypeattribute (service_manager_vndservice_30_0) true)
+(expandtypeattribute (servicediscovery_service_30_0) true)
+(expandtypeattribute (servicemanager_30_0) true)
+(expandtypeattribute (servicemanager_exec_30_0) true)
+(expandtypeattribute (settings_service_30_0) true)
+(expandtypeattribute (sgdisk_30_0) true)
+(expandtypeattribute (sgdisk_exec_30_0) true)
+(expandtypeattribute (shared_relro_30_0) true)
+(expandtypeattribute (shared_relro_file_30_0) true)
+(expandtypeattribute (shell_30_0) true)
+(expandtypeattribute (shell_data_file_30_0) true)
+(expandtypeattribute (shell_exec_30_0) true)
+(expandtypeattribute (shell_prop_30_0) true)
+(expandtypeattribute (shm_30_0) true)
+(expandtypeattribute (shortcut_manager_icons_30_0) true)
+(expandtypeattribute (shortcut_service_30_0) true)
+(expandtypeattribute (simpleperf_30_0) true)
+(expandtypeattribute (simpleperf_app_runner_30_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_30_0) true)
+(expandtypeattribute (slice_service_30_0) true)
+(expandtypeattribute (slideshow_30_0) true)
+(expandtypeattribute (snapshotctl_log_data_file_30_0) true)
+(expandtypeattribute (socket_device_30_0) true)
+(expandtypeattribute (socket_hook_prop_30_0) true)
+(expandtypeattribute (sockfs_30_0) true)
+(expandtypeattribute (sota_prop_30_0) true)
+(expandtypeattribute (soundtrigger_middleware_service_30_0) true)
+(expandtypeattribute (staging_data_file_30_0) true)
+(expandtypeattribute (stats_data_file_30_0) true)
+(expandtypeattribute (statsd_30_0) true)
+(expandtypeattribute (statsd_exec_30_0) true)
+(expandtypeattribute (statsdw_socket_30_0) true)
+(expandtypeattribute (statusbar_service_30_0) true)
+(expandtypeattribute (storage_config_prop_30_0) true)
+(expandtypeattribute (storage_file_30_0) true)
+(expandtypeattribute (storage_stub_file_30_0) true)
+(expandtypeattribute (storaged_service_30_0) true)
+(expandtypeattribute (storagestats_service_30_0) true)
+(expandtypeattribute (su_30_0) true)
+(expandtypeattribute (su_exec_30_0) true)
+(expandtypeattribute (super_block_device_30_0) true)
+(expandtypeattribute (surfaceflinger_30_0) true)
+(expandtypeattribute (surfaceflinger_service_30_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_30_0) true)
+(expandtypeattribute (swap_block_device_30_0) true)
+(expandtypeattribute (sysfs_30_0) true)
+(expandtypeattribute (sysfs_android_usb_30_0) true)
+(expandtypeattribute (sysfs_batteryinfo_30_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_30_0) true)
+(expandtypeattribute (sysfs_devices_block_30_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_30_0) true)
+(expandtypeattribute (sysfs_dm_30_0) true)
+(expandtypeattribute (sysfs_dm_verity_30_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_30_0) true)
+(expandtypeattribute (sysfs_extcon_30_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_30_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_30_0) true)
+(expandtypeattribute (sysfs_hwrandom_30_0) true)
+(expandtypeattribute (sysfs_ion_30_0) true)
+(expandtypeattribute (sysfs_ipv4_30_0) true)
+(expandtypeattribute (sysfs_kernel_notes_30_0) true)
+(expandtypeattribute (sysfs_leds_30_0) true)
+(expandtypeattribute (sysfs_loop_30_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_30_0) true)
+(expandtypeattribute (sysfs_net_30_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_30_0) true)
+(expandtypeattribute (sysfs_power_30_0) true)
+(expandtypeattribute (sysfs_rtc_30_0) true)
+(expandtypeattribute (sysfs_suspend_stats_30_0) true)
+(expandtypeattribute (sysfs_switch_30_0) true)
+(expandtypeattribute (sysfs_thermal_30_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_30_0) true)
+(expandtypeattribute (sysfs_uio_30_0) true)
+(expandtypeattribute (sysfs_usb_30_0) true)
+(expandtypeattribute (sysfs_usermodehelper_30_0) true)
+(expandtypeattribute (sysfs_vibrator_30_0) true)
+(expandtypeattribute (sysfs_wake_lock_30_0) true)
+(expandtypeattribute (sysfs_wakeup_30_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_30_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_30_0) true)
+(expandtypeattribute (sysfs_zram_30_0) true)
+(expandtypeattribute (sysfs_zram_uevent_30_0) true)
+(expandtypeattribute (system_adbd_prop_30_0) true)
+(expandtypeattribute (system_app_30_0) true)
+(expandtypeattribute (system_app_data_file_30_0) true)
+(expandtypeattribute (system_app_service_30_0) true)
+(expandtypeattribute (system_asan_options_file_30_0) true)
+(expandtypeattribute (system_block_device_30_0) true)
+(expandtypeattribute (system_boot_reason_prop_30_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_30_0) true)
+(expandtypeattribute (system_config_service_30_0) true)
+(expandtypeattribute (system_data_file_30_0) true)
+(expandtypeattribute (system_data_root_file_30_0) true)
+(expandtypeattribute (system_event_log_tags_file_30_0) true)
+(expandtypeattribute (system_file_30_0) true)
+(expandtypeattribute (system_group_file_30_0) true)
+(expandtypeattribute (system_jvmti_agent_prop_30_0) true)
+(expandtypeattribute (system_lib_file_30_0) true)
+(expandtypeattribute (system_linker_config_file_30_0) true)
+(expandtypeattribute (system_linker_exec_30_0) true)
+(expandtypeattribute (system_lmk_prop_30_0) true)
+(expandtypeattribute (system_ndebug_socket_30_0) true)
+(expandtypeattribute (system_net_netd_hwservice_30_0) true)
+(expandtypeattribute (system_passwd_file_30_0) true)
+(expandtypeattribute (system_prop_30_0) true)
+(expandtypeattribute (system_radio_prop_30_0) true)
+(expandtypeattribute (system_seccomp_policy_file_30_0) true)
+(expandtypeattribute (system_security_cacerts_file_30_0) true)
+(expandtypeattribute (system_server_30_0) true)
+(expandtypeattribute (system_server_tmpfs_30_0) true)
+(expandtypeattribute (system_suspend_control_service_30_0) true)
+(expandtypeattribute (system_suspend_hwservice_30_0) true)
+(expandtypeattribute (system_trace_prop_30_0) true)
+(expandtypeattribute (system_unsolzygote_socket_30_0) true)
+(expandtypeattribute (system_update_service_30_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_30_0) true)
+(expandtypeattribute (system_wpa_socket_30_0) true)
+(expandtypeattribute (system_zoneinfo_file_30_0) true)
+(expandtypeattribute (systemkeys_data_file_30_0) true)
+(expandtypeattribute (task_profiles_file_30_0) true)
+(expandtypeattribute (task_service_30_0) true)
+(expandtypeattribute (tcpdump_exec_30_0) true)
+(expandtypeattribute (tee_30_0) true)
+(expandtypeattribute (tee_data_file_30_0) true)
+(expandtypeattribute (tee_device_30_0) true)
+(expandtypeattribute (telecom_service_30_0) true)
+(expandtypeattribute (test_boot_reason_prop_30_0) true)
+(expandtypeattribute (test_harness_prop_30_0) true)
+(expandtypeattribute (testharness_service_30_0) true)
+(expandtypeattribute (tethering_service_30_0) true)
+(expandtypeattribute (textclassification_service_30_0) true)
+(expandtypeattribute (textclassifier_data_file_30_0) true)
+(expandtypeattribute (textservices_service_30_0) true)
+(expandtypeattribute (theme_prop_30_0) true)
+(expandtypeattribute (thermal_service_30_0) true)
+(expandtypeattribute (thermalcallback_hwservice_30_0) true)
+(expandtypeattribute (time_prop_30_0) true)
+(expandtypeattribute (timedetector_service_30_0) true)
+(expandtypeattribute (timezone_service_30_0) true)
+(expandtypeattribute (timezonedetector_service_30_0) true)
+(expandtypeattribute (tmpfs_30_0) true)
+(expandtypeattribute (tombstone_data_file_30_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_30_0) true)
+(expandtypeattribute (tombstoned_30_0) true)
+(expandtypeattribute (tombstoned_crash_socket_30_0) true)
+(expandtypeattribute (tombstoned_exec_30_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_30_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_30_0) true)
+(expandtypeattribute (toolbox_30_0) true)
+(expandtypeattribute (toolbox_exec_30_0) true)
+(expandtypeattribute (trace_data_file_30_0) true)
+(expandtypeattribute (traced_30_0) true)
+(expandtypeattribute (traced_consumer_socket_30_0) true)
+(expandtypeattribute (traced_enabled_prop_30_0) true)
+(expandtypeattribute (traced_lazy_prop_30_0) true)
+(expandtypeattribute (traced_perf_30_0) true)
+(expandtypeattribute (traced_perf_enabled_prop_30_0) true)
+(expandtypeattribute (traced_perf_socket_30_0) true)
+(expandtypeattribute (traced_probes_30_0) true)
+(expandtypeattribute (traced_producer_socket_30_0) true)
+(expandtypeattribute (traceur_app_30_0) true)
+(expandtypeattribute (trust_service_30_0) true)
+(expandtypeattribute (tty_device_30_0) true)
+(expandtypeattribute (tun_device_30_0) true)
+(expandtypeattribute (tv_input_service_30_0) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_30_0) true)
+(expandtypeattribute (tzdatacheck_30_0) true)
+(expandtypeattribute (tzdatacheck_exec_30_0) true)
+(expandtypeattribute (ueventd_30_0) true)
+(expandtypeattribute (ueventd_tmpfs_30_0) true)
+(expandtypeattribute (uhid_device_30_0) true)
+(expandtypeattribute (uimode_service_30_0) true)
+(expandtypeattribute (uio_device_30_0) true)
+(expandtypeattribute (uncrypt_30_0) true)
+(expandtypeattribute (uncrypt_exec_30_0) true)
+(expandtypeattribute (uncrypt_socket_30_0) true)
+(expandtypeattribute (unencrypted_data_file_30_0) true)
+(expandtypeattribute (unlabeled_30_0) true)
+(expandtypeattribute (untrusted_app_25_30_0) true)
+(expandtypeattribute (untrusted_app_27_30_0) true)
+(expandtypeattribute (untrusted_app_29_30_0) true)
+(expandtypeattribute (untrusted_app_30_0) true)
+(expandtypeattribute (update_engine_30_0) true)
+(expandtypeattribute (update_engine_data_file_30_0) true)
+(expandtypeattribute (update_engine_exec_30_0) true)
+(expandtypeattribute (update_engine_log_data_file_30_0) true)
+(expandtypeattribute (update_engine_service_30_0) true)
+(expandtypeattribute (update_verifier_30_0) true)
+(expandtypeattribute (update_verifier_exec_30_0) true)
+(expandtypeattribute (updatelock_service_30_0) true)
+(expandtypeattribute (uri_grants_service_30_0) true)
+(expandtypeattribute (usagestats_service_30_0) true)
+(expandtypeattribute (usb_device_30_0) true)
+(expandtypeattribute (usb_serial_device_30_0) true)
+(expandtypeattribute (usb_service_30_0) true)
+(expandtypeattribute (usbaccessory_device_30_0) true)
+(expandtypeattribute (usbd_30_0) true)
+(expandtypeattribute (usbd_exec_30_0) true)
+(expandtypeattribute (usbfs_30_0) true)
+(expandtypeattribute (use_memfd_prop_30_0) true)
+(expandtypeattribute (user_profile_data_file_30_0) true)
+(expandtypeattribute (user_service_30_0) true)
+(expandtypeattribute (userdata_block_device_30_0) true)
+(expandtypeattribute (usermodehelper_30_0) true)
+(expandtypeattribute (userspace_reboot_config_prop_30_0) true)
+(expandtypeattribute (userspace_reboot_exported_prop_30_0) true)
+(expandtypeattribute (userspace_reboot_log_prop_30_0) true)
+(expandtypeattribute (userspace_reboot_test_prop_30_0) true)
+(expandtypeattribute (vdc_30_0) true)
+(expandtypeattribute (vdc_exec_30_0) true)
+(expandtypeattribute (vehicle_hal_prop_30_0) true)
+(expandtypeattribute (vendor_apex_file_30_0) true)
+(expandtypeattribute (vendor_app_file_30_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_30_0) true)
+(expandtypeattribute (vendor_configs_file_30_0) true)
+(expandtypeattribute (vendor_data_file_30_0) true)
+(expandtypeattribute (vendor_default_prop_30_0) true)
+(expandtypeattribute (vendor_file_30_0) true)
+(expandtypeattribute (vendor_framework_file_30_0) true)
+(expandtypeattribute (vendor_hal_file_30_0) true)
+(expandtypeattribute (vendor_idc_file_30_0) true)
+(expandtypeattribute (vendor_init_30_0) true)
+(expandtypeattribute (vendor_keychars_file_30_0) true)
+(expandtypeattribute (vendor_keylayout_file_30_0) true)
+(expandtypeattribute (vendor_misc_writer_30_0) true)
+(expandtypeattribute (vendor_misc_writer_exec_30_0) true)
+(expandtypeattribute (vendor_overlay_file_30_0) true)
+(expandtypeattribute (vendor_public_lib_file_30_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_30_0) true)
+(expandtypeattribute (vendor_shell_30_0) true)
+(expandtypeattribute (vendor_shell_exec_30_0) true)
+(expandtypeattribute (vendor_socket_hook_prop_30_0) true)
+(expandtypeattribute (vendor_task_profiles_file_30_0) true)
+(expandtypeattribute (vendor_toolbox_exec_30_0) true)
+(expandtypeattribute (vfat_30_0) true)
+(expandtypeattribute (vibrator_service_30_0) true)
+(expandtypeattribute (video_device_30_0) true)
+(expandtypeattribute (virtual_ab_prop_30_0) true)
+(expandtypeattribute (virtual_touchpad_30_0) true)
+(expandtypeattribute (virtual_touchpad_exec_30_0) true)
+(expandtypeattribute (virtual_touchpad_service_30_0) true)
+(expandtypeattribute (vndbinder_device_30_0) true)
+(expandtypeattribute (vndk_prop_30_0) true)
+(expandtypeattribute (vndk_sp_file_30_0) true)
+(expandtypeattribute (vndservice_contexts_file_30_0) true)
+(expandtypeattribute (vndservicemanager_30_0) true)
+(expandtypeattribute (voiceinteraction_service_30_0) true)
+(expandtypeattribute (vold_30_0) true)
+(expandtypeattribute (vold_data_file_30_0) true)
+(expandtypeattribute (vold_device_30_0) true)
+(expandtypeattribute (vold_exec_30_0) true)
+(expandtypeattribute (vold_metadata_file_30_0) true)
+(expandtypeattribute (vold_prepare_subdirs_30_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_30_0) true)
+(expandtypeattribute (vold_prop_30_0) true)
+(expandtypeattribute (vold_service_30_0) true)
+(expandtypeattribute (vpn_data_file_30_0) true)
+(expandtypeattribute (vr_hwc_30_0) true)
+(expandtypeattribute (vr_hwc_exec_30_0) true)
+(expandtypeattribute (vr_hwc_service_30_0) true)
+(expandtypeattribute (vr_manager_service_30_0) true)
+(expandtypeattribute (vrflinger_vsync_service_30_0) true)
+(expandtypeattribute (wallpaper_file_30_0) true)
+(expandtypeattribute (wallpaper_service_30_0) true)
+(expandtypeattribute (watchdog_device_30_0) true)
+(expandtypeattribute (watchdogd_30_0) true)
+(expandtypeattribute (watchdogd_exec_30_0) true)
+(expandtypeattribute (webview_zygote_30_0) true)
+(expandtypeattribute (webview_zygote_exec_30_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_30_0) true)
+(expandtypeattribute (webviewupdate_service_30_0) true)
+(expandtypeattribute (wifi_data_file_30_0) true)
+(expandtypeattribute (wifi_log_prop_30_0) true)
+(expandtypeattribute (wifi_prop_30_0) true)
+(expandtypeattribute (wifi_service_30_0) true)
+(expandtypeattribute (wifiaware_service_30_0) true)
+(expandtypeattribute (wificond_30_0) true)
+(expandtypeattribute (wificond_exec_30_0) true)
+(expandtypeattribute (wifinl80211_service_30_0) true)
+(expandtypeattribute (wifip2p_service_30_0) true)
+(expandtypeattribute (wifiscanner_service_30_0) true)
+(expandtypeattribute (window_service_30_0) true)
+(expandtypeattribute (wpa_socket_30_0) true)
+(expandtypeattribute (wpantund_30_0) true)
+(expandtypeattribute (wpantund_exec_30_0) true)
+(expandtypeattribute (wpantund_service_30_0) true)
+(expandtypeattribute (zero_device_30_0) true)
+(expandtypeattribute (zoneinfo_data_file_30_0) true)
+(expandtypeattribute (zygote_30_0) true)
+(expandtypeattribute (zygote_exec_30_0) true)
+(expandtypeattribute (zygote_socket_30_0) true)
+(expandtypeattribute (zygote_tmpfs_30_0) true)
+(typeattributeset DockObserver_service_30_0 (DockObserver_service))
+(typeattributeset IProxyService_service_30_0 (IProxyService_service))
+(typeattributeset accessibility_service_30_0 (accessibility_service))
+(typeattributeset account_service_30_0 (account_service))
+(typeattributeset activity_service_30_0 (activity_service))
+(typeattributeset activity_task_service_30_0 (activity_task_service))
+(typeattributeset adb_data_file_30_0 (adb_data_file))
+(typeattributeset adb_keys_file_30_0 (adb_keys_file))
+(typeattributeset adb_service_30_0 (adb_service))
+(typeattributeset adbd_30_0 (adbd))
+(typeattributeset adbd_exec_30_0 (adbd_exec))
+(typeattributeset adbd_prop_30_0 (adbd_prop))
+(typeattributeset adbd_socket_30_0 (adbd_socket))
+(typeattributeset aidl_lazy_test_server_30_0 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_30_0 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_30_0 (aidl_lazy_test_service))
+(typeattributeset alarm_service_30_0 (alarm_service))
+(typeattributeset anr_data_file_30_0 (anr_data_file))
+(typeattributeset apex_data_file_30_0 (apex_data_file))
+(typeattributeset apex_metadata_file_30_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_30_0 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_30_0 (apex_module_data_file))
+(typeattributeset apex_permission_data_file_30_0 (apex_permission_data_file))
+(typeattributeset apex_rollback_data_file_30_0 (apex_rollback_data_file))
+(typeattributeset apex_service_30_0 (apex_service))
+(typeattributeset apex_wifi_data_file_30_0 (apex_wifi_data_file))
+(typeattributeset apexd_30_0 (apexd))
+(typeattributeset apexd_exec_30_0 (apexd_exec))
+(typeattributeset apexd_prop_30_0 (apexd_prop))
+(typeattributeset apk_data_file_30_0 (apk_data_file))
+(typeattributeset apk_private_data_file_30_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_30_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_30_0 (apk_tmp_file))
+(typeattributeset apk_verity_prop_30_0 (apk_verity_prop))
+(typeattributeset app_binding_service_30_0 (app_binding_service))
+(typeattributeset app_data_file_30_0 (app_data_file))
+(typeattributeset app_fuse_file_30_0 (app_fuse_file))
+(typeattributeset app_fusefs_30_0 (app_fusefs))
+(typeattributeset app_integrity_service_30_0 (app_integrity_service))
+(typeattributeset app_prediction_service_30_0 (app_prediction_service))
+(typeattributeset app_search_service_30_0 (app_search_service))
+(typeattributeset app_zygote_30_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_30_0 (app_zygote_tmpfs))
+(typeattributeset appdomain_tmpfs_30_0 (appdomain_tmpfs))
+(typeattributeset appops_service_30_0 (appops_service))
+(typeattributeset appwidget_service_30_0 (appwidget_service))
+(typeattributeset art_apex_dir_30_0 (art_apex_dir))
+(typeattributeset asec_apk_file_30_0 (asec_apk_file))
+(typeattributeset asec_image_file_30_0 (asec_image_file))
+(typeattributeset asec_public_file_30_0 (asec_public_file))
+(typeattributeset ashmem_device_30_0 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_30_0 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_30_0 (assetatlas_service))
+(typeattributeset audio_data_file_30_0 (audio_data_file))
+(typeattributeset audio_device_30_0 (audio_device))
+(typeattributeset audio_prop_30_0 (audio_prop))
+(typeattributeset audio_service_30_0 (audio_service))
+(typeattributeset audiohal_data_file_30_0 (audiohal_data_file))
+(typeattributeset audioserver_30_0 (audioserver))
+(typeattributeset audioserver_data_file_30_0 (audioserver_data_file))
+(typeattributeset audioserver_service_30_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_30_0 (audioserver_tmpfs))
+(typeattributeset auth_service_30_0 (auth_service))
+(typeattributeset autofill_service_30_0 (autofill_service))
+(typeattributeset backup_data_file_30_0 (backup_data_file))
+(typeattributeset backup_service_30_0 (backup_service))
+(typeattributeset battery_service_30_0 (battery_service))
+(typeattributeset batteryproperties_service_30_0 (batteryproperties_service))
+(typeattributeset batterystats_service_30_0 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_30_0 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_30_0 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_30_0 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_30_0 (binder_calls_stats_service))
+(typeattributeset binder_device_30_0 (binder_device))
+(typeattributeset binderfs_30_0 (binderfs))
+(typeattributeset binderfs_logs_30_0 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_30_0 (binderfs_logs_proc))
+(typeattributeset binfmt_miscfs_30_0 (binfmt_miscfs))
+(typeattributeset biometric_service_30_0 (biometric_service))
+(typeattributeset blkid_30_0 (blkid))
+(typeattributeset blkid_untrusted_30_0 (blkid_untrusted))
+(typeattributeset blob_store_service_30_0 (blob_store_service))
+(typeattributeset block_device_30_0 (block_device))
+(typeattributeset bluetooth_30_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_30_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_30_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_data_file_30_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_30_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_30_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_30_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_30_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_30_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_30_0 (bluetooth_socket))
+(typeattributeset boot_block_device_30_0 (boot_block_device))
+(typeattributeset bootanim_30_0 (bootanim))
+(typeattributeset bootanim_exec_30_0 (bootanim_exec))
+(typeattributeset bootchart_data_file_30_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_30_0 (bootloader_boot_reason_prop))
+(typeattributeset bootstat_30_0 (bootstat))
+(typeattributeset bootstat_data_file_30_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_30_0 (bootstat_exec))
+(typeattributeset boottime_prop_30_0 (boottime_prop))
+(typeattributeset boottime_public_prop_30_0 (boottime_public_prop))
+(typeattributeset boottrace_data_file_30_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_30_0 (bpf_progs_loaded_prop))
+(typeattributeset bq_config_prop_30_0 (bq_config_prop))
+(typeattributeset broadcastradio_service_30_0 (broadcastradio_service))
+(typeattributeset bufferhubd_30_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_30_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_30_0 (bugreport_service))
+(typeattributeset cache_backup_file_30_0 (cache_backup_file))
+(typeattributeset cache_block_device_30_0 (cache_block_device))
+(typeattributeset cache_file_30_0 (cache_file))
+(typeattributeset cache_private_backup_file_30_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_30_0 (cache_recovery_file))
+(typeattributeset camera_data_file_30_0 (camera_data_file))
+(typeattributeset camera_device_30_0 (camera_device))
+(typeattributeset cameraproxy_service_30_0 (cameraproxy_service))
+(typeattributeset cameraserver_30_0 (cameraserver))
+(typeattributeset cameraserver_exec_30_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_30_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_30_0 (cameraserver_tmpfs))
+(typeattributeset cgroup_30_0 (cgroup))
+(typeattributeset cgroup_bpf_30_0 (cgroup_bpf))
+(typeattributeset cgroup_desc_file_30_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_30_0 (cgroup_rc_file))
+(typeattributeset charger_30_0 (charger))
+(typeattributeset charger_exec_30_0 (charger_exec))
+(typeattributeset charger_prop_30_0 (charger_prop))
+(typeattributeset clipboard_service_30_0 (clipboard_service))
+(typeattributeset cold_boot_done_prop_30_0 (cold_boot_done_prop))
+(typeattributeset color_display_service_30_0 (color_display_service))
+(typeattributeset companion_device_service_30_0 (companion_device_service))
+(typeattributeset config_prop_30_0 (config_prop))
+(typeattributeset configfs_30_0 (configfs))
+(typeattributeset connectivity_service_30_0 (connectivity_service))
+(typeattributeset connmetrics_service_30_0 (connmetrics_service))
+(typeattributeset console_device_30_0 (console_device))
+(typeattributeset consumer_ir_service_30_0 (consumer_ir_service))
+(typeattributeset content_capture_service_30_0 (content_capture_service))
+(typeattributeset content_service_30_0 (content_service))
+(typeattributeset content_suggestions_service_30_0 (content_suggestions_service))
+(typeattributeset contexthub_service_30_0 (contexthub_service))
+(typeattributeset coredump_file_30_0 (coredump_file))
+(typeattributeset country_detector_service_30_0 (country_detector_service))
+(typeattributeset coverage_service_30_0 (coverage_service))
+(typeattributeset cppreopt_prop_30_0 (cppreopt_prop))
+(typeattributeset cpu_variant_prop_30_0 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_30_0 (cpuinfo_service))
+(typeattributeset crash_dump_30_0 (crash_dump))
+(typeattributeset crash_dump_exec_30_0 (crash_dump_exec))
+(typeattributeset credstore_30_0 (credstore))
+(typeattributeset credstore_data_file_30_0 (credstore_data_file))
+(typeattributeset credstore_exec_30_0 (credstore_exec))
+(typeattributeset credstore_service_30_0 (credstore_service))
+(typeattributeset crossprofileapps_service_30_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_30_0 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_30_0 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_30_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_30_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_30_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_30_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_30_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_30_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_30_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_30_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_30_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_30_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_30_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_30_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_30_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_30_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_30_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_30_0 (ctl_stop_prop))
+(typeattributeset dalvik_prop_30_0 (dalvik_prop))
+(typeattributeset dalvikcache_data_file_30_0 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_30_0 (dataloader_manager_service))
+(typeattributeset dbinfo_service_30_0 (dbinfo_service))
+(typeattributeset debug_prop_30_0 (debug_prop))
+(typeattributeset debugfs_30_0 (debugfs))
+(typeattributeset debugfs_mmc_30_0 (debugfs_mmc))
+(typeattributeset debugfs_trace_marker_30_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_30_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_30_0 (debugfs_tracing_debug
+ debugfs_tracing_printk_formats))
+(typeattributeset debugfs_tracing_instances_30_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_wakeup_sources_30_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_30_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_30_0 (debuggerd_prop))
+(typeattributeset default_android_hwservice_30_0 (default_android_hwservice))
+(typeattributeset default_android_service_30_0 (default_android_service))
+(typeattributeset default_android_vndservice_30_0 (default_android_vndservice))
+(typeattributeset default_prop_30_0 (
+ default_prop
+ audio_config_prop
+ build_config_prop
+ suspend_prop
+ init_service_status_private_prop
+ setupwizard_prop
+ sqlite_log_prop
+ verity_status_prop
+ zygote_wrap_prop
+))
+(typeattributeset dev_cpu_variant_30_0 (dev_cpu_variant))
+(typeattributeset device_30_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_30_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_30_0 (device_config_boot_count_prop))
+(typeattributeset device_config_configuration_prop_30_0 (device_config_configuration_prop))
+(typeattributeset device_config_input_native_boot_prop_30_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_30_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_30_0 (device_config_netd_native_prop))
+(typeattributeset device_config_reset_performed_prop_30_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_30_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_30_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_30_0 (device_config_service))
+(typeattributeset device_config_storage_native_boot_prop_30_0 (device_config_storage_native_boot_prop))
+(typeattributeset device_config_sys_traced_prop_30_0 (device_config_sys_traced_prop))
+(typeattributeset device_config_window_manager_native_boot_prop_30_0 (device_config_window_manager_native_boot_prop))
+(typeattributeset device_identifiers_service_30_0 (device_identifiers_service))
+(typeattributeset device_logging_prop_30_0 (device_logging_prop))
+(typeattributeset device_policy_service_30_0 (device_policy_service))
+(typeattributeset deviceidle_service_30_0 (deviceidle_service))
+(typeattributeset devicestoragemonitor_service_30_0 (devicestoragemonitor_service))
+(typeattributeset devpts_30_0 (devpts))
+(typeattributeset dhcp_30_0 (dhcp))
+(typeattributeset dhcp_data_file_30_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_30_0 (dhcp_exec))
+(typeattributeset dhcp_prop_30_0 (dhcp_prop))
+(typeattributeset diskstats_service_30_0 (diskstats_service))
+(typeattributeset display_service_30_0 (display_service))
+(typeattributeset dm_device_30_0 (dm_device))
+(typeattributeset dnsmasq_30_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_30_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_30_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_30_0 (dnsresolver_service))
+(typeattributeset dreams_service_30_0 (dreams_service))
+(typeattributeset drm_data_file_30_0 (drm_data_file))
+(typeattributeset drmserver_30_0 (drmserver))
+(typeattributeset drmserver_exec_30_0 (drmserver_exec))
+(typeattributeset drmserver_service_30_0 (drmserver_service))
+(typeattributeset drmserver_socket_30_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_30_0 (dropbox_data_file))
+(typeattributeset dropbox_service_30_0 (dropbox_service))
+(typeattributeset dumpstate_30_0 (dumpstate))
+(typeattributeset dumpstate_exec_30_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_30_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_30_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_30_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_30_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_30_0 (dynamic_system_prop))
+(typeattributeset e2fs_30_0 (e2fs))
+(typeattributeset e2fs_exec_30_0 (e2fs_exec))
+(typeattributeset efs_file_30_0 (efs_file))
+(typeattributeset emergency_affordance_service_30_0 (emergency_affordance_service))
+(typeattributeset ephemeral_app_30_0 (ephemeral_app))
+(typeattributeset ethernet_service_30_0 (ethernet_service))
+(typeattributeset exfat_30_0 (exfat))
+(typeattributeset exported2_config_prop_30_0 (exported2_config_prop systemsound_config_prop))
+(typeattributeset exported2_default_prop_30_0
+ ( exported2_default_prop
+ aac_drc_prop
+ bootloader_prop
+ build_prop
+ hal_instrumentation_prop
+ init_service_status_prop
+ libc_debug_prop
+ property_service_version_prop))
+(typeattributeset exported2_radio_prop_30_0 (exported2_radio_prop))
+(typeattributeset exported2_system_prop_30_0
+ ( exported2_system_prop
+ dalvik_runtime_prop
+ surfaceflinger_color_prop
+ zram_control_prop))
+(typeattributeset exported2_vold_prop_30_0
+ ( exported2_vold_prop
+ vold_config_prop
+ vold_post_fs_data_prop))
+(typeattributeset exported3_default_prop_30_0
+ ( exported3_default_prop
+ camera_calibration_prop
+ camera_config_prop
+ charger_config_prop
+ drm_service_config_prop
+ hdmi_config_prop
+ keyguard_config_prop
+ lmkd_config_prop
+ media_config_prop
+ mediadrm_config_prop
+ oem_unlock_prop
+ packagemanager_config_prop
+ recovery_config_prop
+ sendbug_config_prop
+ storagemanager_config_prop
+ telephony_config_prop
+ tombstone_config_prop
+ vts_status_prop
+ wifi_config_prop
+ zram_config_prop))
+(typeattributeset exported3_radio_prop_30_0 (exported3_radio_prop radio_control_prop))
+(typeattributeset exported3_system_prop_30_0
+ ( exported3_system_prop
+ boot_status_prop
+ provisioned_prop
+ retaildemo_prop))
+(typeattributeset exported_audio_prop_30_0 (exported_audio_prop audio_config_prop))
+(typeattributeset exported_bluetooth_prop_30_0 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_30_0 (exported_camera_prop))
+(typeattributeset exported_config_prop_30_0 (exported_config_prop))
+(typeattributeset exported_dalvik_prop_30_0 (exported_dalvik_prop dalvik_config_prop))
+(typeattributeset exported_default_prop_30_0
+ ( exported_default_prop
+ aaudio_config_prop
+ build_bootimage_prop
+ build_odm_prop
+ build_vendor_prop
+ surfaceflinger_prop
+ vts_config_prop))
+(typeattributeset exported_dumpstate_prop_30_0 (exported_dumpstate_prop))
+(typeattributeset exported_ffs_prop_30_0
+ ( exported_ffs_prop
+ ffs_config_prop
+ ffs_control_prop))
+(typeattributeset exported_fingerprint_prop_30_0 (exported_fingerprint_prop fingerprint_prop))
+(typeattributeset exported_overlay_prop_30_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_30_0 (exported_pm_prop))
+(typeattributeset exported_radio_prop_30_0 (exported_radio_prop telephony_status_prop))
+(typeattributeset exported_secure_prop_30_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_30_0 (exported_system_prop charger_status_prop))
+(typeattributeset exported_system_prop_30_0 (exported_system_prop bootanim_system_prop))
+
+(typeattributeset exported_system_radio_prop_30_0
+ ( exported_system_radio_prop
+ usb_config_prop
+ usb_control_prop))
+(typeattributeset exported_vold_prop_30_0 (exported_vold_prop vold_status_prop))
+(typeattributeset exported_wifi_prop_30_0 (exported_wifi_prop wifi_hal_prop))
+(typeattributeset external_vibrator_service_30_0 (external_vibrator_service))
+(typeattributeset face_service_30_0 (face_service))
+(typeattributeset face_vendor_data_file_30_0 (face_vendor_data_file))
+(typeattributeset fastbootd_30_0 (fastbootd))
+(typeattributeset ffs_prop_30_0 (ffs_prop))
+(typeattributeset file_contexts_file_30_0 (file_contexts_file))
+(typeattributeset file_integrity_service_30_0 (file_integrity_service))
+(typeattributeset fingerprint_service_30_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_30_0 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_30_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_30_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_30_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_30_0 (fingerprintd_service))
+(typeattributeset firstboot_prop_30_0 (firstboot_prop))
+(typeattributeset flags_health_check_30_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_30_0 (flags_health_check_exec))
+(typeattributeset font_service_30_0 (font_service))
+(typeattributeset frp_block_device_30_0 (frp_block_device))
+(typeattributeset fs_bpf_30_0 (fs_bpf))
+(typeattributeset fsck_30_0 (fsck))
+(typeattributeset fsck_exec_30_0 (fsck_exec))
+(typeattributeset fsck_untrusted_30_0 (fsck_untrusted))
+(typeattributeset fscklogs_30_0 (fscklogs))
+(typeattributeset functionfs_30_0 (functionfs))
+(typeattributeset fuse_30_0 (fuse))
+(typeattributeset fuse_device_30_0 (fuse_device))
+(typeattributeset fwk_automotive_display_hwservice_30_0 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_bufferhub_hwservice_30_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_30_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_30_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_30_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_30_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_30_0 (fwk_stats_hwservice))
+(typeattributeset fwmarkd_socket_30_0 (fwmarkd_socket))
+(typeattributeset gatekeeper_data_file_30_0 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_30_0 (gatekeeper_service))
+(typeattributeset gatekeeperd_30_0 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_30_0 (gatekeeperd_exec))
+(typeattributeset gfxinfo_service_30_0 (gfxinfo_service))
+(typeattributeset gmscore_app_30_0 (gmscore_app))
+(typeattributeset gps_control_30_0 (gps_control))
+(typeattributeset gpu_device_30_0 (gpu_device))
+(typeattributeset gpu_service_30_0 (gpu_service))
+(typeattributeset gpuservice_30_0 (gpuservice))
+(typeattributeset graphics_device_30_0 (graphics_device))
+(typeattributeset graphicsstats_service_30_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_30_0 (gsi_data_file))
+(typeattributeset gsi_metadata_file_30_0
+ ( gsi_metadata_file
+ gsi_public_metadata_file))
+(typeattributeset gsid_prop_30_0 (gsid_prop))
+(typeattributeset hal_atrace_hwservice_30_0 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_30_0 (hal_audio_hwservice))
+(typeattributeset hal_audiocontrol_hwservice_30_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_authsecret_hwservice_30_0 (hal_authsecret_hwservice))
+(typeattributeset hal_bluetooth_hwservice_30_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_30_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_30_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_30_0 (hal_camera_hwservice))
+(typeattributeset hal_can_bus_hwservice_30_0 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_30_0 (hal_can_controller_hwservice))
+(typeattributeset hal_cas_hwservice_30_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_30_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_30_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_30_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_30_0 (hal_contexthub_hwservice))
+(typeattributeset hal_drm_hwservice_30_0 (hal_drm_hwservice))
+(typeattributeset hal_dumpstate_hwservice_30_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_evs_hwservice_30_0 (hal_evs_hwservice))
+(typeattributeset hal_face_hwservice_30_0 (hal_face_hwservice))
+(typeattributeset hal_fingerprint_hwservice_30_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_30_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_30_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_30_0 (hal_gnss_hwservice))
+(typeattributeset hal_graphics_allocator_hwservice_30_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_composer_hwservice_30_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_30_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_mapper_hwservice_30_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_30_0 (hal_health_hwservice))
+(typeattributeset hal_health_storage_hwservice_30_0 (hal_health_storage_hwservice))
+(typeattributeset hal_identity_service_30_0 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_30_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_ir_hwservice_30_0 (hal_ir_hwservice))
+(typeattributeset hal_keymaster_hwservice_30_0 (hal_keymaster_hwservice))
+(typeattributeset hal_light_hwservice_30_0 (hal_light_hwservice))
+(typeattributeset hal_light_service_30_0 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_30_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_30_0 (hal_memtrack_hwservice))
+(typeattributeset hal_neuralnetworks_hwservice_30_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_nfc_hwservice_30_0 (hal_nfc_hwservice))
+(typeattributeset hal_oemlock_hwservice_30_0 (hal_oemlock_hwservice))
+(typeattributeset hal_omx_hwservice_30_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_30_0 (hal_power_hwservice))
+(typeattributeset hal_power_service_30_0 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_30_0 (hal_power_stats_hwservice))
+(typeattributeset hal_rebootescrow_service_30_0 (hal_rebootescrow_service))
+(typeattributeset hal_renderscript_hwservice_30_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_30_0 (hal_secure_element_hwservice))
+(typeattributeset hal_sensors_hwservice_30_0 (hal_sensors_hwservice))
+(typeattributeset hal_telephony_hwservice_30_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_30_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_30_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_30_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_30_0 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_tuner_hwservice_30_0 (hal_tv_tuner_hwservice))
+(typeattributeset hal_usb_gadget_hwservice_30_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_30_0 (hal_usb_hwservice))
+(typeattributeset hal_vehicle_hwservice_30_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vibrator_hwservice_30_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_30_0 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_30_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_30_0 (hal_weaver_hwservice))
+(typeattributeset hal_wifi_hostapd_hwservice_30_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hwservice_30_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_30_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hardware_properties_service_30_0 (hardware_properties_service))
+(typeattributeset hardware_service_30_0 (hardware_service))
+(typeattributeset hci_attach_dev_30_0 (hci_attach_dev))
+(typeattributeset hdmi_control_service_30_0 (hdmi_control_service))
+(typeattributeset healthd_30_0 (healthd))
+(typeattributeset healthd_exec_30_0 (healthd_exec))
+(typeattributeset heapdump_data_file_30_0 (heapdump_data_file))
+(typeattributeset heapprofd_30_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_30_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_30_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_30_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_30_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_30_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_30_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_30_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_30_0 (hidl_token_hwservice))
+(typeattributeset hw_random_device_30_0 (hw_random_device))
+(typeattributeset hwbinder_device_30_0 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_30_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_30_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_30_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_30_0 (hwservicemanager_prop))
+(typeattributeset icon_file_30_0 (icon_file))
+(typeattributeset idmap_30_0 (idmap))
+(typeattributeset idmap_exec_30_0 (idmap_exec))
+(typeattributeset idmap_service_30_0 (idmap_service))
+(typeattributeset iio_device_30_0 (iio_device))
+(typeattributeset imms_service_30_0 (imms_service))
+(typeattributeset incident_30_0 (incident))
+(typeattributeset incident_data_file_30_0 (incident_data_file))
+(typeattributeset incident_helper_30_0 (incident_helper))
+(typeattributeset incident_service_30_0 (incident_service))
+(typeattributeset incidentd_30_0 (incidentd))
+(typeattributeset incremental_control_file_30_0 (incremental_control_file))
+(typeattributeset incremental_prop_30_0 (incremental_prop))
+(typeattributeset incremental_service_30_0 (incremental_service))
+(typeattributeset init_30_0 (init))
+(typeattributeset init_exec_30_0 (init_exec))
+(typeattributeset init_perf_lsm_hooks_prop_30_0 (init_perf_lsm_hooks_prop))
+(typeattributeset init_svc_debug_prop_30_0 (init_svc_debug_prop))
+(typeattributeset init_tmpfs_30_0 (init_tmpfs))
+(typeattributeset inotify_30_0 (inotify))
+(typeattributeset input_device_30_0 (input_device))
+(typeattributeset input_method_service_30_0 (input_method_service))
+(typeattributeset input_service_30_0 (input_service))
+(typeattributeset inputflinger_30_0 (inputflinger))
+(typeattributeset inputflinger_exec_30_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_30_0 (inputflinger_service))
+(typeattributeset install_data_file_30_0 (install_data_file))
+(typeattributeset installd_30_0 (installd))
+(typeattributeset installd_exec_30_0 (installd_exec))
+(typeattributeset installd_service_30_0 (installd_service))
+(typeattributeset ion_device_30_0 (ion_device))
+(typeattributeset iorap_inode2filename_30_0 (iorap_inode2filename))
+(typeattributeset iorap_inode2filename_exec_30_0 (iorap_inode2filename_exec))
+(typeattributeset iorap_inode2filename_tmpfs_30_0 (iorap_inode2filename_tmpfs))
+(typeattributeset iorap_prefetcherd_30_0 (iorap_prefetcherd))
+(typeattributeset iorap_prefetcherd_exec_30_0 (iorap_prefetcherd_exec))
+(typeattributeset iorap_prefetcherd_tmpfs_30_0 (iorap_prefetcherd_tmpfs))
+(typeattributeset iorapd_30_0 (iorapd))
+(typeattributeset iorapd_data_file_30_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_30_0 (iorapd_exec))
+(typeattributeset iorapd_service_30_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_30_0 (iorapd_tmpfs))
+(typeattributeset ipsec_service_30_0 (ipsec_service))
+(typeattributeset iris_service_30_0 (iris_service))
+(typeattributeset iris_vendor_data_file_30_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_30_0 (isolated_app))
+(typeattributeset jobscheduler_service_30_0 (jobscheduler_service))
+(typeattributeset kernel_30_0 (kernel))
+(typeattributeset keychain_data_file_30_0 (keychain_data_file))
+(typeattributeset keychord_device_30_0 (keychord_device))
+(typeattributeset keystore_30_0 (keystore))
+(typeattributeset keystore_data_file_30_0 (keystore_data_file))
+(typeattributeset keystore_exec_30_0 (keystore_exec))
+(typeattributeset keystore_service_30_0 (keystore_service))
+(typeattributeset kmsg_debug_device_30_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_30_0 (kmsg_device))
+(typeattributeset labeledfs_30_0 (labeledfs))
+(typeattributeset last_boot_reason_prop_30_0 (last_boot_reason_prop))
+(typeattributeset launcherapps_service_30_0 (launcherapps_service))
+(typeattributeset light_service_30_0 (light_service))
+(typeattributeset linkerconfig_file_30_0 (linkerconfig_file))
+(typeattributeset llkd_30_0 (llkd))
+(typeattributeset llkd_exec_30_0 (llkd_exec))
+(typeattributeset llkd_prop_30_0 (llkd_prop))
+(typeattributeset lmkd_30_0 (lmkd))
+(typeattributeset lmkd_exec_30_0 (lmkd_exec))
+(typeattributeset lmkd_prop_30_0 (lmkd_prop))
+(typeattributeset lmkd_socket_30_0 (lmkd_socket))
+(typeattributeset location_service_30_0 (location_service))
+(typeattributeset lock_settings_service_30_0 (lock_settings_service))
+(typeattributeset log_prop_30_0 (log_prop))
+(typeattributeset log_tag_prop_30_0 (log_tag_prop))
+(typeattributeset logcat_exec_30_0 (logcat_exec))
+(typeattributeset logd_30_0 (logd))
+(typeattributeset logd_exec_30_0 (logd_exec))
+(typeattributeset logd_prop_30_0 (logd_prop))
+(typeattributeset logd_socket_30_0 (logd_socket))
+(typeattributeset logdr_socket_30_0 (logdr_socket))
+(typeattributeset logdw_socket_30_0 (logdw_socket))
+(typeattributeset logpersist_30_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_30_0 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_30_0 (loop_control_device))
+(typeattributeset loop_device_30_0 (loop_device))
+(typeattributeset looper_stats_service_30_0 (looper_stats_service))
+(typeattributeset lowpan_device_30_0 (lowpan_device))
+(typeattributeset lowpan_prop_30_0 (lowpan_prop))
+(typeattributeset lowpan_service_30_0 (lowpan_service))
+(typeattributeset lpdump_service_30_0 (lpdump_service))
+(typeattributeset lpdumpd_prop_30_0 (lpdumpd_prop))
+(typeattributeset mac_perms_file_30_0 (mac_perms_file))
+(typeattributeset mdns_socket_30_0 (mdns_socket))
+(typeattributeset mdnsd_30_0 (mdnsd))
+(typeattributeset mdnsd_socket_30_0 (mdnsd_socket))
+(typeattributeset media_data_file_30_0 (media_data_file))
+(typeattributeset media_projection_service_30_0 (media_projection_service))
+(typeattributeset media_router_service_30_0 (media_router_service))
+(typeattributeset media_rw_data_file_30_0 (media_rw_data_file))
+(typeattributeset media_session_service_30_0 (media_session_service))
+(typeattributeset media_variant_prop_30_0 (media_variant_prop))
+(typeattributeset mediadrmserver_30_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_30_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_30_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_30_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_30_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_30_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_30_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_30_0 (mediametrics))
+(typeattributeset mediametrics_exec_30_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_30_0 (mediametrics_service))
+(typeattributeset mediaprovider_30_0 (mediaprovider))
+(typeattributeset mediaserver_30_0 (mediaserver))
+(typeattributeset mediaserver_exec_30_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_30_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_30_0 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_30_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_30_0 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_30_0 (mediatranscoding))
+(typeattributeset mediatranscoding_exec_30_0 (mediatranscoding_exec))
+(typeattributeset mediatranscoding_service_30_0 (mediatranscoding_service))
+(typeattributeset meminfo_service_30_0 (meminfo_service))
+(typeattributeset metadata_block_device_30_0 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_30_0 (metadata_bootstat_file))
+(typeattributeset metadata_file_30_0 (metadata_file))
+(typeattributeset method_trace_data_file_30_0 (method_trace_data_file))
+(typeattributeset midi_service_30_0 (midi_service))
+(typeattributeset mirror_data_file_30_0 (mirror_data_file))
+(typeattributeset misc_block_device_30_0 (misc_block_device))
+(typeattributeset misc_logd_file_30_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_30_0 (misc_user_data_file))
+(typeattributeset mmc_prop_30_0 (mmc_prop))
+(typeattributeset mnt_expand_file_30_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_30_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_30_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_30_0 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_30_0 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_30_0 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_30_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_30_0 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_30_0 (mock_ota_prop))
+(typeattributeset modprobe_30_0 (modprobe))
+(typeattributeset module_sdkextensions_prop_30_0 (module_sdkextensions_prop))
+(typeattributeset mount_service_30_0 (mount_service))
+(typeattributeset mqueue_30_0 (mqueue))
+(typeattributeset mtp_30_0 (mtp))
+(typeattributeset mtp_device_30_0 (mtp_device))
+(typeattributeset mtp_exec_30_0 (mtp_exec))
+(typeattributeset mtpd_socket_30_0 (mtpd_socket))
+(typeattributeset nativetest_data_file_30_0 (nativetest_data_file))
+(typeattributeset net_data_file_30_0 (net_data_file))
+(typeattributeset net_dns_prop_30_0 (net_dns_prop))
+(typeattributeset net_radio_prop_30_0 (net_radio_prop))
+(typeattributeset netd_30_0 (netd))
+(typeattributeset netd_exec_30_0 (netd_exec))
+(typeattributeset netd_listener_service_30_0 (netd_listener_service))
+(typeattributeset netd_service_30_0 (netd_service))
+(typeattributeset netd_stable_secret_prop_30_0 (netd_stable_secret_prop))
+(typeattributeset netif_30_0 (netif))
+(typeattributeset netpolicy_service_30_0 (netpolicy_service))
+(typeattributeset netstats_service_30_0 (netstats_service))
+(typeattributeset netutils_wrapper_30_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_30_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_30_0 (network_management_service))
+(typeattributeset network_score_service_30_0 (network_score_service))
+(typeattributeset network_stack_30_0 (network_stack))
+(typeattributeset network_stack_service_30_0 (network_stack_service))
+(typeattributeset network_time_update_service_30_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_30_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_30_0 (network_watchlist_service))
+(typeattributeset nfc_30_0 (nfc))
+(typeattributeset nfc_data_file_30_0 (nfc_data_file))
+(typeattributeset nfc_device_30_0 (nfc_device))
+(typeattributeset nfc_prop_30_0 (nfc_prop))
+(typeattributeset nfc_service_30_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_30_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_30_0 (node))
+(typeattributeset nonplat_service_contexts_file_30_0 (nonplat_service_contexts_file))
+(typeattributeset notification_service_30_0 (notification_service))
+(typeattributeset null_device_30_0 (null_device))
+(typeattributeset oem_lock_service_30_0 (oem_lock_service))
+(typeattributeset oemfs_30_0 (oemfs))
+(typeattributeset ota_data_file_30_0 (ota_data_file))
+(typeattributeset ota_metadata_file_30_0 (ota_metadata_file))
+(typeattributeset ota_package_file_30_0 (ota_package_file))
+(typeattributeset ota_prop_30_0 (ota_prop))
+(typeattributeset otadexopt_service_30_0 (otadexopt_service))
+(typeattributeset overlay_prop_30_0 (overlay_prop))
+(typeattributeset overlay_service_30_0 (overlay_service))
+(typeattributeset overlayfs_file_30_0 (overlayfs_file))
+(typeattributeset owntty_device_30_0 (owntty_device))
+(typeattributeset package_native_service_30_0 (package_native_service))
+(typeattributeset package_service_30_0 (package_service))
+(typeattributeset packages_list_file_30_0 (packages_list_file))
+(typeattributeset pan_result_prop_30_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_30_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_30_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_30_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_30_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_30_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_30_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_30_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_30_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_30_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_30_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_30_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_30_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_30_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_30_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_30_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_30_0 (pdx_performance_dir))
+(typeattributeset perfetto_30_0 (perfetto))
+(typeattributeset performanced_30_0 (performanced))
+(typeattributeset performanced_exec_30_0 (performanced_exec))
+(typeattributeset permission_service_30_0 (permission_service))
+(typeattributeset permissionmgr_service_30_0 (permissionmgr_service))
+(typeattributeset persist_debug_prop_30_0 (persist_debug_prop))
+(typeattributeset persistent_data_block_service_30_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_30_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_30_0 (pinner_service))
+(typeattributeset pipefs_30_0 (pipefs))
+(typeattributeset platform_app_30_0 (platform_app))
+(typeattributeset platform_compat_service_30_0 (platform_compat_service))
+(typeattributeset pm_prop_30_0 (pm_prop))
+(typeattributeset pmsg_device_30_0 (pmsg_device))
+(typeattributeset port_30_0 (port))
+(typeattributeset port_device_30_0 (port_device))
+(typeattributeset postinstall_30_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_30_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_30_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_30_0 (postinstall_mnt_dir))
+(typeattributeset power_service_30_0 (power_service))
+(typeattributeset powerctl_prop_30_0 (powerctl_prop))
+(typeattributeset ppp_30_0 (ppp))
+(typeattributeset ppp_device_30_0 (ppp_device))
+(typeattributeset ppp_exec_30_0 (ppp_exec))
+(typeattributeset preloads_data_file_30_0 (preloads_data_file))
+(typeattributeset preloads_media_file_30_0 (preloads_media_file))
+(typeattributeset prereboot_data_file_30_0 (prereboot_data_file))
+(typeattributeset print_service_30_0 (print_service))
+(typeattributeset priv_app_30_0 (priv_app))
+(typeattributeset privapp_data_file_30_0 (privapp_data_file))
+(typeattributeset proc_30_0
+ ( proc
+ proc_bootconfig
+ proc_watermark_scale_factor))
+(typeattributeset proc_abi_30_0 (proc_abi))
+(typeattributeset proc_asound_30_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_30_0 (proc_bluetooth_writable))
+(typeattributeset proc_buddyinfo_30_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_30_0 (proc_cmdline))
+(typeattributeset proc_cpuinfo_30_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_30_0 (proc_dirty))
+(typeattributeset proc_diskstats_30_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_30_0 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_30_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_30_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_30_0 (proc_fs_verity))
+(typeattributeset proc_hostname_30_0 (proc_hostname))
+(typeattributeset proc_hung_task_30_0 (proc_hung_task))
+(typeattributeset proc_interrupts_30_0 (proc_interrupts))
+(typeattributeset proc_iomem_30_0 (proc_iomem))
+(typeattributeset proc_keys_30_0 (proc_keys))
+(typeattributeset proc_kmsg_30_0 (proc_kmsg))
+(typeattributeset proc_kpageflags_30_0 (proc_kpageflags))
+(typeattributeset proc_loadavg_30_0 (proc_loadavg))
+(typeattributeset proc_lowmemorykiller_30_0 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_30_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_30_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_30_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_30_0 (proc_misc))
+(typeattributeset proc_modules_30_0 (proc_modules))
+(typeattributeset proc_mounts_30_0 (proc_mounts))
+(typeattributeset proc_net_30_0 (proc_net))
+(typeattributeset proc_net_tcp_udp_30_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_30_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_30_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_30_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_30_0 (proc_panic))
+(typeattributeset proc_perf_30_0 (proc_perf))
+(typeattributeset proc_pid_max_30_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_30_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_30_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_30_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_30_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_30_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_30_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_30_0 (proc_random))
+(typeattributeset proc_sched_30_0 (proc_sched))
+(typeattributeset proc_security_30_0 (proc_security))
+(typeattributeset proc_slabinfo_30_0 (proc_slabinfo))
+(typeattributeset proc_stat_30_0 (proc_stat))
+(typeattributeset proc_swaps_30_0 (proc_swaps))
+(typeattributeset proc_sysrq_30_0 (proc_sysrq))
+(typeattributeset proc_timer_30_0 (proc_timer))
+(typeattributeset proc_tty_drivers_30_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_30_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_30_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_30_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_30_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_30_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_30_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_30_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_30_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_30_0 (proc_uptime))
+(typeattributeset proc_version_30_0 (proc_version))
+(typeattributeset proc_vmallocinfo_30_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_30_0 (proc_vmstat))
+(typeattributeset proc_zoneinfo_30_0 (proc_zoneinfo))
+(typeattributeset processinfo_service_30_0 (processinfo_service))
+(typeattributeset procstats_service_30_0 (procstats_service))
+(typeattributeset profman_30_0 (profman))
+(typeattributeset profman_dump_data_file_30_0 (profman_dump_data_file))
+(typeattributeset profman_exec_30_0 (profman_exec))
+(typeattributeset properties_device_30_0 (properties_device))
+(typeattributeset properties_serial_30_0 (properties_serial))
+(typeattributeset property_contexts_file_30_0 (property_contexts_file))
+(typeattributeset property_data_file_30_0 (property_data_file))
+(typeattributeset property_info_30_0 (property_info))
+(typeattributeset property_socket_30_0 (property_socket))
+(typeattributeset pstorefs_30_0 (pstorefs))
+(typeattributeset ptmx_device_30_0 (ptmx_device))
+(typeattributeset qtaguid_device_30_0 (qtaguid_device))
+(typeattributeset racoon_30_0 (racoon))
+(typeattributeset racoon_exec_30_0 (racoon_exec))
+(typeattributeset racoon_socket_30_0 (racoon_socket))
+(typeattributeset radio_30_0 (radio))
+(typeattributeset radio_data_file_30_0 (radio_data_file))
+(typeattributeset radio_device_30_0 (radio_device))
+(typeattributeset radio_prop_30_0 (radio_prop))
+(typeattributeset radio_service_30_0 (radio_service))
+(typeattributeset ram_device_30_0 (ram_device))
+(typeattributeset random_device_30_0 (random_device))
+(typeattributeset rebootescrow_hal_prop_30_0 (rebootescrow_hal_prop))
+(typeattributeset recovery_30_0 (recovery))
+(typeattributeset recovery_block_device_30_0 (recovery_block_device))
+(typeattributeset recovery_data_file_30_0 (recovery_data_file))
+(typeattributeset recovery_persist_30_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_30_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_30_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_30_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_30_0 (recovery_service))
+(typeattributeset recovery_socket_30_0 (recovery_socket))
+(typeattributeset registry_service_30_0 (registry_service))
+(typeattributeset resourcecache_data_file_30_0 (resourcecache_data_file))
+(typeattributeset restorecon_prop_30_0 (restorecon_prop))
+(typeattributeset restrictions_service_30_0 (restrictions_service))
+(typeattributeset rild_debug_socket_30_0 (rild_debug_socket))
+(typeattributeset rild_socket_30_0 (rild_socket))
+(typeattributeset ringtone_file_30_0 (ringtone_file))
+(typeattributeset role_service_30_0 (role_service))
+(typeattributeset rollback_service_30_0 (rollback_service))
+(typeattributeset root_block_device_30_0 (root_block_device))
+(typeattributeset rootfs_30_0 (rootfs))
+(typeattributeset rpmsg_device_30_0 (rpmsg_device))
+(typeattributeset rs_30_0 (rs))
+(typeattributeset rs_exec_30_0 (rs_exec))
+(typeattributeset rss_hwm_reset_30_0 (rss_hwm_reset))
+(typeattributeset rtc_device_30_0 (rtc_device))
+(typeattributeset rttmanager_service_30_0 (rttmanager_service))
+(typeattributeset runas_30_0 (runas))
+(typeattributeset runas_app_30_0 (runas_app))
+(typeattributeset runas_exec_30_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_30_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_30_0 (runtime_service))
+(typeattributeset safemode_prop_30_0 (safemode_prop))
+(typeattributeset same_process_hal_file_30_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_30_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_30_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_30_0 (sdcard_block_device))
+(typeattributeset sdcardd_30_0 (sdcardd))
+(typeattributeset sdcardd_exec_30_0 (sdcardd_exec))
+(typeattributeset sdcardfs_30_0 (sdcardfs))
+(typeattributeset seapp_contexts_file_30_0 (seapp_contexts_file))
+(typeattributeset search_service_30_0 (search_service))
+(typeattributeset sec_key_att_app_id_provider_service_30_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_30_0 (secure_element))
+(typeattributeset secure_element_device_30_0 (secure_element_device))
+(typeattributeset secure_element_service_30_0 (secure_element_service))
+(typeattributeset securityfs_30_0 (securityfs))
+(typeattributeset selinuxfs_30_0 (selinuxfs))
+(typeattributeset sensor_privacy_service_30_0 (sensor_privacy_service))
+(typeattributeset sensors_device_30_0 (sensors_device))
+(typeattributeset sensorservice_service_30_0 (sensorservice_service))
+(typeattributeset sepolicy_file_30_0 (sepolicy_file))
+(typeattributeset serial_device_30_0 (serial_device))
+(typeattributeset serial_service_30_0 (serial_service))
+(typeattributeset serialno_prop_30_0 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_30_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_30_0 (service_contexts_file))
+(typeattributeset service_manager_service_30_0 (service_manager_service))
+(typeattributeset service_manager_vndservice_30_0 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_30_0 (servicediscovery_service))
+(typeattributeset servicemanager_30_0 (servicemanager))
+(typeattributeset servicemanager_exec_30_0 (servicemanager_exec))
+(typeattributeset settings_service_30_0 (settings_service))
+(typeattributeset sgdisk_30_0 (sgdisk))
+(typeattributeset sgdisk_exec_30_0 (sgdisk_exec))
+(typeattributeset shared_relro_30_0 (shared_relro))
+(typeattributeset shared_relro_file_30_0 (shared_relro_file))
+(typeattributeset shell_30_0 (shell))
+(typeattributeset shell_data_file_30_0 (shell_data_file))
+(typeattributeset shell_exec_30_0 (shell_exec))
+(typeattributeset shell_prop_30_0 (shell_prop))
+(typeattributeset shm_30_0 (shm))
+(typeattributeset shortcut_manager_icons_30_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_30_0 (shortcut_service))
+(typeattributeset simpleperf_30_0 (simpleperf))
+(typeattributeset simpleperf_app_runner_30_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_30_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_30_0 (slice_service))
+(typeattributeset slideshow_30_0 (slideshow))
+(typeattributeset snapshotctl_log_data_file_30_0 (snapshotctl_log_data_file))
+(typeattributeset socket_device_30_0 (socket_device))
+(typeattributeset socket_hook_prop_30_0 (socket_hook_prop))
+(typeattributeset sockfs_30_0 (sockfs))
+(typeattributeset sota_prop_30_0 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_30_0 (soundtrigger_middleware_service))
+(typeattributeset staging_data_file_30_0 (staging_data_file))
+(typeattributeset stats_data_file_30_0 (stats_data_file))
+(typeattributeset statsd_30_0 (statsd))
+(typeattributeset statsd_exec_30_0 (statsd_exec))
+(typeattributeset statsdw_socket_30_0 (statsdw_socket))
+(typeattributeset statusbar_service_30_0 (statusbar_service))
+(typeattributeset storage_config_prop_30_0 (storage_config_prop))
+(typeattributeset storage_file_30_0 (storage_file))
+(typeattributeset storage_stub_file_30_0 (storage_stub_file))
+(typeattributeset storaged_service_30_0 (storaged_service))
+(typeattributeset storagestats_service_30_0 (storagestats_service))
+(typeattributeset su_30_0 (su))
+(typeattributeset su_exec_30_0 (su_exec))
+(typeattributeset super_block_device_30_0 (super_block_device))
+(typeattributeset surfaceflinger_30_0 (surfaceflinger))
+(typeattributeset surfaceflinger_service_30_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_30_0 (surfaceflinger_tmpfs))
+(typeattributeset swap_block_device_30_0 (swap_block_device))
+(typeattributeset sysfs_30_0 (sysfs sysfs_fs_incfs_features))
+(typeattributeset sysfs_30_0 (sysfs sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_android_usb_30_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_30_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_30_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devices_block_30_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_system_cpu_30_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_30_0 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_30_0 (sysfs_dm_verity))
+(typeattributeset sysfs_dt_firmware_android_30_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_30_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_30_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_30_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_hwrandom_30_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_30_0 (sysfs_ion))
+(typeattributeset sysfs_ipv4_30_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_30_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_30_0 (sysfs_leds))
+(typeattributeset sysfs_loop_30_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_30_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_net_30_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_30_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_30_0 (sysfs_power))
+(typeattributeset sysfs_rtc_30_0 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_30_0 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_30_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_30_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_30_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uio_30_0 (sysfs_uio))
+(typeattributeset sysfs_usb_30_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_30_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vibrator_30_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_30_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_30_0 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_30_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_30_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_30_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_30_0 (sysfs_zram_uevent))
+(typeattributeset system_adbd_prop_30_0 (system_adbd_prop))
+(typeattributeset system_app_30_0 (system_app))
+(typeattributeset system_app_data_file_30_0 (system_app_data_file))
+(typeattributeset system_app_service_30_0 (system_app_service))
+(typeattributeset system_asan_options_file_30_0 (system_asan_options_file))
+(typeattributeset system_block_device_30_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_30_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_30_0 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_30_0 (system_config_service))
+(typeattributeset system_data_file_30_0 (system_data_file))
+(typeattributeset system_data_root_file_30_0 (system_data_root_file))
+(typeattributeset system_event_log_tags_file_30_0 (system_event_log_tags_file))
+(typeattributeset system_file_30_0 (system_file))
+(typeattributeset system_group_file_30_0 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_30_0 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_30_0 (system_lib_file))
+(typeattributeset system_linker_config_file_30_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_30_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_30_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_30_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_30_0 (system_net_netd_hwservice))
+(typeattributeset system_passwd_file_30_0 (system_passwd_file))
+(typeattributeset system_prop_30_0 (system_prop))
+(typeattributeset system_radio_prop_30_0 (system_radio_prop usb_prop))
+(typeattributeset system_seccomp_policy_file_30_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_30_0 (system_security_cacerts_file))
+(typeattributeset system_server_30_0 (system_server))
+(typeattributeset system_server_tmpfs_30_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_service_30_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_30_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_30_0 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_30_0 (system_unsolzygote_socket))
+(typeattributeset system_update_service_30_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_30_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_30_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_30_0 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_30_0 (systemkeys_data_file))
+(typeattributeset task_profiles_file_30_0 (task_profiles_file))
+(typeattributeset task_service_30_0 (task_service))
+(typeattributeset tcpdump_exec_30_0 (tcpdump_exec))
+(typeattributeset tee_30_0 (tee))
+(typeattributeset tee_data_file_30_0 (tee_data_file))
+(typeattributeset tee_device_30_0 (tee_device))
+(typeattributeset telecom_service_30_0 (telecom_service))
+(typeattributeset test_boot_reason_prop_30_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_30_0 (test_harness_prop))
+(typeattributeset testharness_service_30_0 (testharness_service))
+(typeattributeset tethering_service_30_0 (tethering_service))
+(typeattributeset textclassification_service_30_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_30_0 (textclassifier_data_file))
+(typeattributeset textservices_service_30_0 (textservices_service))
+(typeattributeset theme_prop_30_0 (theme_prop))
+(typeattributeset thermal_service_30_0 (thermal_service))
+(typeattributeset thermalcallback_hwservice_30_0 (thermalcallback_hwservice))
+(typeattributeset time_prop_30_0 (time_prop))
+(typeattributeset timedetector_service_30_0 (timedetector_service))
+(typeattributeset timezone_service_30_0 (timezone_service))
+(typeattributeset timezonedetector_service_30_0 (timezonedetector_service))
+(typeattributeset tmpfs_30_0 (tmpfs))
+(typeattributeset tombstone_data_file_30_0 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_30_0 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_30_0 (tombstoned))
+(typeattributeset tombstoned_crash_socket_30_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_30_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_30_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_30_0 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_30_0 (toolbox))
+(typeattributeset toolbox_exec_30_0 (toolbox_exec))
+(typeattributeset trace_data_file_30_0 (trace_data_file))
+(typeattributeset traced_30_0 (traced))
+(typeattributeset traced_consumer_socket_30_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_30_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_30_0 (traced_lazy_prop))
+(typeattributeset traced_perf_30_0 (traced_perf))
+(typeattributeset traced_perf_enabled_prop_30_0 (traced_perf_enabled_prop))
+(typeattributeset traced_perf_socket_30_0 (traced_perf_socket))
+(typeattributeset traced_probes_30_0 (traced_probes))
+(typeattributeset traced_producer_socket_30_0 (traced_producer_socket))
+(typeattributeset traceur_app_30_0 (traceur_app))
+(typeattributeset trust_service_30_0 (trust_service))
+(typeattributeset tty_device_30_0 (tty_device))
+(typeattributeset tun_device_30_0 (tun_device))
+(typeattributeset tv_input_service_30_0 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_30_0 (tv_tuner_resource_mgr_service))
+(typeattributeset tzdatacheck_30_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_30_0 (tzdatacheck_exec))
+(typeattributeset ueventd_30_0 (ueventd))
+(typeattributeset ueventd_tmpfs_30_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_30_0 (uhid_device))
+(typeattributeset uimode_service_30_0 (uimode_service))
+(typeattributeset uio_device_30_0 (uio_device))
+(typeattributeset uncrypt_30_0 (uncrypt))
+(typeattributeset uncrypt_exec_30_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_30_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_30_0 (unencrypted_data_file))
+(typeattributeset unlabeled_30_0 (unlabeled))
+(typeattributeset untrusted_app_25_30_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_30_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_30_0 (untrusted_app_29))
+(typeattributeset untrusted_app_30_0 (untrusted_app))
+(typeattributeset update_engine_30_0 (update_engine))
+(typeattributeset update_engine_data_file_30_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_30_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_30_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_30_0 (update_engine_service))
+(typeattributeset update_verifier_30_0 (update_verifier))
+(typeattributeset update_verifier_exec_30_0 (update_verifier_exec))
+(typeattributeset updatelock_service_30_0 (updatelock_service))
+(typeattributeset uri_grants_service_30_0 (uri_grants_service))
+(typeattributeset usagestats_service_30_0 (usagestats_service))
+(typeattributeset usb_device_30_0 (usb_device))
+(typeattributeset usb_serial_device_30_0 (usb_serial_device))
+(typeattributeset usb_service_30_0 (usb_service))
+(typeattributeset usbaccessory_device_30_0 (usbaccessory_device))
+(typeattributeset usbd_30_0 (usbd))
+(typeattributeset usbd_exec_30_0 (usbd_exec))
+(typeattributeset usbfs_30_0 (usbfs))
+(typeattributeset use_memfd_prop_30_0 (use_memfd_prop))
+(typeattributeset user_profile_data_file_30_0
+ ( user_profile_data_file
+ user_profile_root_file
+))
+(typeattributeset user_service_30_0 (user_service))
+(typeattributeset userdata_block_device_30_0 (userdata_block_device))
+(typeattributeset usermodehelper_30_0 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_30_0 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_30_0 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_log_prop_30_0 (userspace_reboot_log_prop))
+(typeattributeset userspace_reboot_test_prop_30_0 (userspace_reboot_test_prop))
+(typeattributeset vdc_30_0 (vdc))
+(typeattributeset vdc_exec_30_0 (vdc_exec))
+(typeattributeset vehicle_hal_prop_30_0 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_30_0 (vendor_apex_file))
+(typeattributeset vendor_app_file_30_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_30_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_30_0 (vendor_configs_file))
+(typeattributeset vendor_data_file_30_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_30_0 (vendor_default_prop))
+(typeattributeset vendor_file_30_0 (vendor_file))
+(typeattributeset vendor_framework_file_30_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_30_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_30_0 (vendor_idc_file))
+(typeattributeset vendor_init_30_0 (vendor_init))
+(typeattributeset vendor_keychars_file_30_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_30_0 (vendor_keylayout_file))
+(typeattributeset vendor_misc_writer_30_0 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_30_0 (vendor_misc_writer_exec))
+(typeattributeset vendor_overlay_file_30_0 (vendor_overlay_file))
+(typeattributeset vendor_public_lib_file_30_0
+ ( vendor_public_framework_file
+ vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_30_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_shell_30_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_30_0 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_30_0 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_30_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_30_0 (vendor_toolbox_exec))
+(typeattributeset vfat_30_0 (vfat))
+(typeattributeset vibrator_service_30_0 (vibrator_service))
+(typeattributeset video_device_30_0 (video_device))
+(typeattributeset virtual_ab_prop_30_0 (virtual_ab_prop))
+(typeattributeset virtual_touchpad_30_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_30_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_30_0 (virtual_touchpad_service))
+(typeattributeset vndbinder_device_30_0 (vndbinder_device))
+(typeattributeset vndk_prop_30_0 (vndk_prop))
+(typeattributeset vndk_sp_file_30_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_30_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_30_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_30_0 (voiceinteraction_service))
+(typeattributeset vold_30_0 (vold))
+(typeattributeset vold_data_file_30_0 (vold_data_file))
+(typeattributeset vold_device_30_0 (vold_device))
+(typeattributeset vold_exec_30_0 (vold_exec))
+(typeattributeset vold_metadata_file_30_0 (vold_metadata_file))
+(typeattributeset vold_prepare_subdirs_30_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_30_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_30_0 (vold_prop))
+(typeattributeset vold_service_30_0 (vold_service))
+(typeattributeset vpn_data_file_30_0 (vpn_data_file))
+(typeattributeset vr_hwc_30_0 (vr_hwc))
+(typeattributeset vr_hwc_exec_30_0 (vr_hwc_exec))
+(typeattributeset vr_hwc_service_30_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_30_0 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_30_0 (vrflinger_vsync_service))
+(typeattributeset wallpaper_file_30_0 (wallpaper_file))
+(typeattributeset wallpaper_service_30_0 (wallpaper_service))
+(typeattributeset watchdog_device_30_0 (watchdog_device))
+(typeattributeset watchdogd_30_0 (watchdogd))
+(typeattributeset watchdogd_exec_30_0 (watchdogd_exec))
+(typeattributeset webview_zygote_30_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_30_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_30_0 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_30_0 (webviewupdate_service))
+(typeattributeset wifi_data_file_30_0 (wifi_data_file))
+(typeattributeset wifi_log_prop_30_0 (wifi_log_prop))
+(typeattributeset wifi_prop_30_0 (wifi_prop))
+(typeattributeset wifi_service_30_0 (wifi_service))
+(typeattributeset wifiaware_service_30_0 (wifiaware_service))
+(typeattributeset wificond_30_0 (wificond))
+(typeattributeset wificond_exec_30_0 (wificond_exec))
+(typeattributeset wifinl80211_service_30_0 (wifinl80211_service))
+(typeattributeset wifip2p_service_30_0 (wifip2p_service))
+(typeattributeset wifiscanner_service_30_0 (wifiscanner_service))
+(typeattributeset window_service_30_0 (window_service))
+(typeattributeset wpa_socket_30_0 (wpa_socket))
+(typeattributeset wpantund_30_0 (wpantund))
+(typeattributeset wpantund_exec_30_0 (wpantund_exec))
+(typeattributeset wpantund_service_30_0 (wpantund_service))
+(typeattributeset zero_device_30_0 (zero_device))
+(typeattributeset zoneinfo_data_file_30_0 (zoneinfo_data_file))
+(typeattributeset zygote_30_0 (zygote))
+(typeattributeset zygote_exec_30_0 (zygote_exec))
+(typeattributeset zygote_socket_30_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_30_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/30.0/30.0.compat.cil b/prebuilts/api/202504/private/compat/30.0/30.0.compat.cil
new file mode 100644
index 0000000..c9c5f47
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/30.0/30.0.compat.cil
@@ -0,0 +1,39 @@
+;; complement CIL file for compatibility between ToT policy and 30.0 vendors.
+;; will be compiled along with other normal policy files, on 30.0 vendors.
+;;
+
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+
+;; TODO: Once 30.0 is no longer supported for vendor images,
+;; mlsvendorcompat can be completely from the system policy.
+(typeattributeset mlsvendorcompat (and appdomain vendordomain))
+(allow mlsvendorcompat app_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mlsvendorcompat app_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+(allow mlsvendorcompat privapp_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
+(allow mlsvendorcompat privapp_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
+
+;; permission for devices (older than S) where debugfs restriction doesn't apply.
+(typeattribute debugfs_file_type)
+(typeattributeset debugfs_file_type (and debugfs_type file_type))
+(typeattribute debugfs_fs_type)
+(typeattributeset debugfs_fs_type (and debugfs_type fs_type))
+
+(allow dumpstate debugfs (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate debugfs_mmc (file (ioctl read getattr lock map open watch watch_reads)))
+(allow dumpstate debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
+(auditallow dumpstate debugfs (file (ioctl read getattr lock map open watch watch_reads)))
+
+(allow init debugfs (dir (getattr relabelfrom)))
+(allow init debugfs (file (getattr relabelfrom)))
+(allow init debugfs (lnk_file (getattr relabelfrom)))
+(allow init debugfs_file_type (file (create getattr open read write setattr relabelfrom unlink map)))
+(allow init debugfs_fs_type (filesystem (mount remount unmount getattr relabelfrom associate quotamod quotaget watch)))
+(allow init debugfs_type (dir (getattr relabelto)))
+(allow init debugfs_type (file (getattr relabelto)))
+(allow init debugfs_type (lnk_file (getattr relabelto)))
+
+(allow system_server debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
+
+(allow vendor_init debugfs_file_type (file (create getattr open read write setattr relabelfrom unlink map)))
+(allow vendor_init debugfs_fs_type (file (open read setattr map)))
diff --git a/prebuilts/api/202504/private/compat/30.0/30.0.ignore.cil b/prebuilts/api/202504/private/compat/30.0/30.0.ignore.cil
new file mode 100644
index 0000000..0a3d2e9
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/30.0/30.0.ignore.cil
@@ -0,0 +1,156 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 30.0 policy. Thus, we do not need to map
+;; these types to previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ ab_update_gki_prop
+ adbd_config_prop
+ apc_service
+ apex_appsearch_data_file
+ apex_art_data_file
+ apex_art_staging_data_file
+ apex_info_file
+ apex_ota_reserved_file
+ apex_scheduling_data_file
+ apex_system_server_data_file
+ apexd_config_prop
+ app_hibernation_service
+ appcompat_data_file
+ arm64_memtag_prop
+ artd
+ artd_exec
+ artd_service
+ authorization_service
+ bootanim_config_prop
+ camerax_extensions_prop
+ cgroup_desc_api_file
+ cgroup_v2
+ codec2_config_prop
+ ctl_snapuserd_prop
+ dck_prop
+ debugfs_kprobes
+ debugfs_mm_events_tracing
+ debugfs_bootreceiver_tracing
+ debugfs_restriction_prop
+ device_config_profcollect_native_boot_prop
+ device_config_connectivity_prop
+ device_config_swcodec_native_prop
+ device_state_service
+ dm_user_device
+ dmabuf_heap_device
+ dmabuf_system_heap_device
+ dmabuf_system_secure_heap_device
+ domain_verification_service
+ dumpstate_tmpfs
+ framework_watchdog_config_prop
+ fs_bpf_tethering
+ fwk_stats_service
+ game_service
+ font_data_file
+ gki_apex_prepostinstall
+ gki_apex_prepostinstall_exec
+ hal_audio_service
+ hal_authsecret_service
+ hal_audiocontrol_service
+ hal_face_service
+ hal_fingerprint_service
+ hal_health_storage_service
+ hal_memtrack_service
+ hal_oemlock_service
+ hint_service
+ gnss_device
+ gnss_time_update_service
+ hal_dumpstate_config_prop
+ hal_gnss_service
+ hal_keymint_service
+ hal_neuralnetworks_service
+ hal_power_stats_service
+ hal_remotelyprovisionedcomponent_service
+ hal_secureclock_service
+ hal_sharedsecret_service
+ hal_uwb_service
+ hal_weaver_service
+ hw_timeout_multiplier_prop
+ keystore_compat_hal_service
+ keystore_maintenance_service
+ keystore_metrics_service
+ keystore2_key_contexts_file
+ legacy_permission_service
+ legacykeystore_service
+ location_time_zone_manager_service
+ media_communication_service
+ media_metrics_service
+ mediatuner_exec
+ mediatuner_service
+ mediatuner
+ mediatranscoding_tmpfs
+ memtrackproxy_service
+ mm_events_config_prop
+ music_recognition_service
+ nfc_logs_data_file
+ odrefresh
+ odrefresh_exec
+ odsign
+ odsign_data_file
+ odsign_exec
+ pac_proxy_service
+ permission_checker_service
+ people_service
+ persist_vendor_debug_wifi_prop
+ postinstall_dexopt_exec
+ postinstall_device_mnt_dir
+ postinstall_product_mnt_dir
+ postinstall_vendor_mnt_dir
+ power_debug_prop
+ powerstats_service
+ proc_kallsyms
+ proc_locks
+ profcollectd
+ profcollectd_data_file
+ profcollectd_exec
+ profcollectd_node_id_prop
+ profcollectd_service
+ qemu_hw_prop
+ qemu_sf_lcd_density_prop
+ radio_core_data_file
+ reboot_readiness_service
+ remote_prov_app
+ remoteprovisioning_service
+ resolver_service
+ search_ui_service
+ shell_test_data_file
+ smartspace_service
+ snapuserd
+ snapuserd_exec
+ snapuserd_socket
+ soc_prop
+ speech_recognition_service
+ sysfs_block
+ sysfs_devfreq_cur
+ sysfs_devfreq_dir
+ sysfs_devices_cs_etm
+ sysfs_dma_heap
+ sysfs_dmabuf_stats
+ sysfs_uhid
+ system_server_dumper_service
+ system_suspend_control_internal_service
+ task_profiles_api_file
+ texttospeech_service
+ translation_service
+ update_engine_stable_service
+ userdata_sysdev
+ userspace_reboot_metadata_file
+ uwb_service
+ vcn_management_service
+ vd_device
+ vendor_kernel_modules
+ vendor_modprobe
+ vendor_uuid_mapping_config_file
+ vibrator_manager_service
+ virtualization_service
+ vpn_management_service
+ watchdog_metadata_file
+ wifi_key
+ zygote_config_prop))
diff --git a/prebuilts/api/202504/private/compat/31.0/31.0.cil b/prebuilts/api/202504/private/compat/31.0/31.0.cil
new file mode 100644
index 0000000..b0df314
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/31.0/31.0.cil
@@ -0,0 +1,2490 @@
+;; types removed from current policy
+(type apex_appsearch_data_file)
+(type apex_permission_data_file)
+(type apex_scheduling_data_file)
+(type apex_wifi_data_file)
+(type healthd_exec)
+(type nonplat_service_contexts_file)
+(type sysfs_block)
+(type vr_hwc)
+(type vr_hwc_exec)
+
+;; mapping information from ToT policy's types to 31.0 policy's types.
+(expandtypeattribute (DockObserver_service_31_0) true)
+(expandtypeattribute (IProxyService_service_31_0) true)
+(expandtypeattribute (aac_drc_prop_31_0) true)
+(expandtypeattribute (aaudio_config_prop_31_0) true)
+(expandtypeattribute (ab_update_gki_prop_31_0) true)
+(expandtypeattribute (accessibility_service_31_0) true)
+(expandtypeattribute (account_service_31_0) true)
+(expandtypeattribute (activity_service_31_0) true)
+(expandtypeattribute (activity_task_service_31_0) true)
+(expandtypeattribute (adb_data_file_31_0) true)
+(expandtypeattribute (adb_keys_file_31_0) true)
+(expandtypeattribute (adb_service_31_0) true)
+(expandtypeattribute (adbd_31_0) true)
+(expandtypeattribute (adbd_config_prop_31_0) true)
+(expandtypeattribute (adbd_exec_31_0) true)
+(expandtypeattribute (adbd_socket_31_0) true)
+(expandtypeattribute (aidl_lazy_test_server_31_0) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_31_0) true)
+(expandtypeattribute (aidl_lazy_test_service_31_0) true)
+(expandtypeattribute (alarm_service_31_0) true)
+(expandtypeattribute (anr_data_file_31_0) true)
+(expandtypeattribute (apc_service_31_0) true)
+(expandtypeattribute (apex_appsearch_data_file_31_0) true)
+(expandtypeattribute (apex_data_file_31_0) true)
+(expandtypeattribute (apex_info_file_31_0) true)
+(expandtypeattribute (apex_metadata_file_31_0) true)
+(expandtypeattribute (apex_mnt_dir_31_0) true)
+(expandtypeattribute (apex_module_data_file_31_0) true)
+(expandtypeattribute (apex_ota_reserved_file_31_0) true)
+(expandtypeattribute (apex_permission_data_file_31_0) true)
+(expandtypeattribute (apex_rollback_data_file_31_0) true)
+(expandtypeattribute (apex_scheduling_data_file_31_0) true)
+(expandtypeattribute (apex_service_31_0) true)
+(expandtypeattribute (apex_wifi_data_file_31_0) true)
+(expandtypeattribute (apexd_31_0) true)
+(expandtypeattribute (apexd_config_prop_31_0) true)
+(expandtypeattribute (apexd_exec_31_0) true)
+(expandtypeattribute (apexd_prop_31_0) true)
+(expandtypeattribute (apk_data_file_31_0) true)
+(expandtypeattribute (apk_private_data_file_31_0) true)
+(expandtypeattribute (apk_private_tmp_file_31_0) true)
+(expandtypeattribute (apk_tmp_file_31_0) true)
+(expandtypeattribute (apk_verity_prop_31_0) true)
+(expandtypeattribute (app_binding_service_31_0) true)
+(expandtypeattribute (app_data_file_31_0) true)
+(expandtypeattribute (app_fuse_file_31_0) true)
+(expandtypeattribute (app_fusefs_31_0) true)
+(expandtypeattribute (app_hibernation_service_31_0) true)
+(expandtypeattribute (app_integrity_service_31_0) true)
+(expandtypeattribute (app_prediction_service_31_0) true)
+(expandtypeattribute (app_search_service_31_0) true)
+(expandtypeattribute (app_zygote_31_0) true)
+(expandtypeattribute (app_zygote_tmpfs_31_0) true)
+(expandtypeattribute (appcompat_data_file_31_0) true)
+(expandtypeattribute (appdomain_tmpfs_31_0) true)
+(expandtypeattribute (appops_service_31_0) true)
+(expandtypeattribute (appwidget_service_31_0) true)
+(expandtypeattribute (arm64_memtag_prop_31_0) true)
+(expandtypeattribute (art_apex_dir_31_0) true)
+(expandtypeattribute (asec_apk_file_31_0) true)
+(expandtypeattribute (asec_image_file_31_0) true)
+(expandtypeattribute (asec_public_file_31_0) true)
+(expandtypeattribute (ashmem_device_31_0) true)
+(expandtypeattribute (ashmem_libcutils_device_31_0) true)
+(expandtypeattribute (assetatlas_service_31_0) true)
+(expandtypeattribute (atrace_31_0) true)
+(expandtypeattribute (audio_config_prop_31_0) true)
+(expandtypeattribute (audio_data_file_31_0) true)
+(expandtypeattribute (audio_device_31_0) true)
+(expandtypeattribute (audio_prop_31_0) true)
+(expandtypeattribute (audio_service_31_0) true)
+(expandtypeattribute (audiohal_data_file_31_0) true)
+(expandtypeattribute (audioserver_31_0) true)
+(expandtypeattribute (audioserver_data_file_31_0) true)
+(expandtypeattribute (audioserver_service_31_0) true)
+(expandtypeattribute (audioserver_tmpfs_31_0) true)
+(expandtypeattribute (auth_service_31_0) true)
+(expandtypeattribute (authorization_service_31_0) true)
+(expandtypeattribute (autofill_service_31_0) true)
+(expandtypeattribute (backup_data_file_31_0) true)
+(expandtypeattribute (backup_service_31_0) true)
+(expandtypeattribute (battery_service_31_0) true)
+(expandtypeattribute (batteryproperties_service_31_0) true)
+(expandtypeattribute (batterystats_service_31_0) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_31_0) true)
+(expandtypeattribute (binder_cache_system_server_prop_31_0) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_31_0) true)
+(expandtypeattribute (binder_calls_stats_service_31_0) true)
+(expandtypeattribute (binder_device_31_0) true)
+(expandtypeattribute (binderfs_31_0) true)
+(expandtypeattribute (binderfs_logs_31_0) true)
+(expandtypeattribute (binderfs_logs_proc_31_0) true)
+(expandtypeattribute (binfmt_miscfs_31_0) true)
+(expandtypeattribute (biometric_service_31_0) true)
+(expandtypeattribute (blkid_31_0) true)
+(expandtypeattribute (blkid_untrusted_31_0) true)
+(expandtypeattribute (blob_store_service_31_0) true)
+(expandtypeattribute (block_device_31_0) true)
+(expandtypeattribute (bluetooth_31_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_31_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_31_0) true)
+(expandtypeattribute (bluetooth_data_file_31_0) true)
+(expandtypeattribute (bluetooth_efs_file_31_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_31_0) true)
+(expandtypeattribute (bluetooth_manager_service_31_0) true)
+(expandtypeattribute (bluetooth_prop_31_0) true)
+(expandtypeattribute (bluetooth_service_31_0) true)
+(expandtypeattribute (bluetooth_socket_31_0) true)
+(expandtypeattribute (boot_block_device_31_0) true)
+(expandtypeattribute (boot_status_prop_31_0) true)
+(expandtypeattribute (bootanim_31_0) true)
+(expandtypeattribute (bootanim_config_prop_31_0) true)
+(expandtypeattribute (bootanim_exec_31_0) true)
+(expandtypeattribute (bootanim_system_prop_31_0) true)
+(expandtypeattribute (bootchart_data_file_31_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_31_0) true)
+(expandtypeattribute (bootloader_prop_31_0) true)
+(expandtypeattribute (bootstat_31_0) true)
+(expandtypeattribute (bootstat_data_file_31_0) true)
+(expandtypeattribute (bootstat_exec_31_0) true)
+(expandtypeattribute (boottime_prop_31_0) true)
+(expandtypeattribute (boottime_public_prop_31_0) true)
+(expandtypeattribute (boottrace_data_file_31_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_31_0) true)
+(expandtypeattribute (bq_config_prop_31_0) true)
+(expandtypeattribute (broadcastradio_service_31_0) true)
+(expandtypeattribute (bufferhubd_31_0) true)
+(expandtypeattribute (bufferhubd_exec_31_0) true)
+(expandtypeattribute (bugreport_service_31_0) true)
+(expandtypeattribute (build_bootimage_prop_31_0) true)
+(expandtypeattribute (build_config_prop_31_0) true)
+(expandtypeattribute (build_odm_prop_31_0) true)
+(expandtypeattribute (build_prop_31_0) true)
+(expandtypeattribute (build_vendor_prop_31_0) true)
+(expandtypeattribute (cache_backup_file_31_0) true)
+(expandtypeattribute (cache_block_device_31_0) true)
+(expandtypeattribute (cache_file_31_0) true)
+(expandtypeattribute (cache_private_backup_file_31_0) true)
+(expandtypeattribute (cache_recovery_file_31_0) true)
+(expandtypeattribute (cacheinfo_service_31_0) true)
+(expandtypeattribute (camera2_extensions_prop_31_0) true)
+(expandtypeattribute (camera_calibration_prop_31_0) true)
+(expandtypeattribute (camera_config_prop_31_0) true)
+(expandtypeattribute (camera_data_file_31_0) true)
+(expandtypeattribute (camera_device_31_0) true)
+(expandtypeattribute (cameraproxy_service_31_0) true)
+(expandtypeattribute (cameraserver_31_0) true)
+(expandtypeattribute (cameraserver_exec_31_0) true)
+(expandtypeattribute (cameraserver_service_31_0) true)
+(expandtypeattribute (cameraserver_tmpfs_31_0) true)
+(expandtypeattribute (camerax_extensions_prop_31_0) true)
+(expandtypeattribute (cgroup_31_0) true)
+(expandtypeattribute (cgroup_desc_api_file_31_0) true)
+(expandtypeattribute (cgroup_desc_file_31_0) true)
+(expandtypeattribute (cgroup_rc_file_31_0) true)
+(expandtypeattribute (cgroup_v2_31_0) true)
+(expandtypeattribute (charger_31_0) true)
+(expandtypeattribute (charger_config_prop_31_0) true)
+(expandtypeattribute (charger_exec_31_0) true)
+(expandtypeattribute (charger_prop_31_0) true)
+(expandtypeattribute (charger_status_prop_31_0) true)
+(expandtypeattribute (clipboard_service_31_0) true)
+(expandtypeattribute (codec2_config_prop_31_0) true)
+(expandtypeattribute (cold_boot_done_prop_31_0) true)
+(expandtypeattribute (color_display_service_31_0) true)
+(expandtypeattribute (companion_device_service_31_0) true)
+(expandtypeattribute (config_prop_31_0) true)
+(expandtypeattribute (configfs_31_0) true)
+(expandtypeattribute (connectivity_service_31_0) true)
+(expandtypeattribute (connmetrics_service_31_0) true)
+(expandtypeattribute (console_device_31_0) true)
+(expandtypeattribute (consumer_ir_service_31_0) true)
+(expandtypeattribute (content_capture_service_31_0) true)
+(expandtypeattribute (content_service_31_0) true)
+(expandtypeattribute (content_suggestions_service_31_0) true)
+(expandtypeattribute (contexthub_service_31_0) true)
+(expandtypeattribute (coredump_file_31_0) true)
+(expandtypeattribute (country_detector_service_31_0) true)
+(expandtypeattribute (coverage_service_31_0) true)
+(expandtypeattribute (cppreopt_prop_31_0) true)
+(expandtypeattribute (cpu_variant_prop_31_0) true)
+(expandtypeattribute (cpuinfo_service_31_0) true)
+(expandtypeattribute (crash_dump_31_0) true)
+(expandtypeattribute (crash_dump_exec_31_0) true)
+(expandtypeattribute (credstore_31_0) true)
+(expandtypeattribute (credstore_data_file_31_0) true)
+(expandtypeattribute (credstore_exec_31_0) true)
+(expandtypeattribute (credstore_service_31_0) true)
+(expandtypeattribute (crossprofileapps_service_31_0) true)
+(expandtypeattribute (ctl_adbd_prop_31_0) true)
+(expandtypeattribute (ctl_apexd_prop_31_0) true)
+(expandtypeattribute (ctl_bootanim_prop_31_0) true)
+(expandtypeattribute (ctl_bugreport_prop_31_0) true)
+(expandtypeattribute (ctl_console_prop_31_0) true)
+(expandtypeattribute (ctl_default_prop_31_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_31_0) true)
+(expandtypeattribute (ctl_fuse_prop_31_0) true)
+(expandtypeattribute (ctl_gsid_prop_31_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_31_0) true)
+(expandtypeattribute (ctl_interface_start_prop_31_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_31_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_31_0) true)
+(expandtypeattribute (ctl_restart_prop_31_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_31_0) true)
+(expandtypeattribute (ctl_sigstop_prop_31_0) true)
+(expandtypeattribute (ctl_start_prop_31_0) true)
+(expandtypeattribute (ctl_stop_prop_31_0) true)
+(expandtypeattribute (dalvik_config_prop_31_0) true)
+(expandtypeattribute (dalvik_prop_31_0) true)
+(expandtypeattribute (dalvik_runtime_prop_31_0) true)
+(expandtypeattribute (dalvikcache_data_file_31_0) true)
+(expandtypeattribute (dataloader_manager_service_31_0) true)
+(expandtypeattribute (dbinfo_service_31_0) true)
+(expandtypeattribute (dck_prop_31_0) true)
+(expandtypeattribute (debug_prop_31_0) true)
+(expandtypeattribute (debugfs_31_0) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_31_0) true)
+(expandtypeattribute (debugfs_kprobes_31_0) true)
+(expandtypeattribute (debugfs_mm_events_tracing_31_0) true)
+(expandtypeattribute (debugfs_mmc_31_0) true)
+(expandtypeattribute (debugfs_restriction_prop_31_0) true)
+(expandtypeattribute (debugfs_trace_marker_31_0) true)
+(expandtypeattribute (debugfs_tracing_31_0) true)
+(expandtypeattribute (debugfs_tracing_debug_31_0) true)
+(expandtypeattribute (debugfs_tracing_instances_31_0) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_31_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_31_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_31_0) true)
+(expandtypeattribute (debuggerd_prop_31_0) true)
+(expandtypeattribute (default_android_hwservice_31_0) true)
+(expandtypeattribute (default_android_service_31_0) true)
+(expandtypeattribute (default_android_vndservice_31_0) true)
+(expandtypeattribute (default_prop_31_0) true)
+(expandtypeattribute (dev_cpu_variant_31_0) true)
+(expandtypeattribute (device_31_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_31_0) true)
+(expandtypeattribute (device_config_boot_count_prop_31_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_31_0) true)
+(expandtypeattribute (device_config_media_native_prop_31_0) true)
+(expandtypeattribute (device_config_netd_native_prop_31_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_31_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_31_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_31_0) true)
+(expandtypeattribute (device_config_service_31_0) true)
+(expandtypeattribute (device_identifiers_service_31_0) true)
+(expandtypeattribute (device_logging_prop_31_0) true)
+(expandtypeattribute (device_policy_service_31_0) true)
+(expandtypeattribute (device_state_service_31_0) true)
+(expandtypeattribute (deviceidle_service_31_0) true)
+(expandtypeattribute (devicestoragemonitor_service_31_0) true)
+(expandtypeattribute (devpts_31_0) true)
+(expandtypeattribute (dhcp_31_0) true)
+(expandtypeattribute (dhcp_data_file_31_0) true)
+(expandtypeattribute (dhcp_exec_31_0) true)
+(expandtypeattribute (dhcp_prop_31_0) true)
+(expandtypeattribute (diskstats_service_31_0) true)
+(expandtypeattribute (display_service_31_0) true)
+(expandtypeattribute (dm_device_31_0) true)
+(expandtypeattribute (dm_user_device_31_0) true)
+(expandtypeattribute (dmabuf_heap_device_31_0) true)
+(expandtypeattribute (dmabuf_system_heap_device_31_0) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_31_0) true)
+(expandtypeattribute (dnsmasq_31_0) true)
+(expandtypeattribute (dnsmasq_exec_31_0) true)
+(expandtypeattribute (dnsproxyd_socket_31_0) true)
+(expandtypeattribute (dnsresolver_service_31_0) true)
+(expandtypeattribute (domain_verification_service_31_0) true)
+(expandtypeattribute (dreams_service_31_0) true)
+(expandtypeattribute (drm_data_file_31_0) true)
+(expandtypeattribute (drm_service_config_prop_31_0) true)
+(expandtypeattribute (drmserver_31_0) true)
+(expandtypeattribute (drmserver_exec_31_0) true)
+(expandtypeattribute (drmserver_service_31_0) true)
+(expandtypeattribute (drmserver_socket_31_0) true)
+(expandtypeattribute (dropbox_data_file_31_0) true)
+(expandtypeattribute (dropbox_service_31_0) true)
+(expandtypeattribute (dumpstate_31_0) true)
+(expandtypeattribute (dumpstate_exec_31_0) true)
+(expandtypeattribute (dumpstate_options_prop_31_0) true)
+(expandtypeattribute (dumpstate_prop_31_0) true)
+(expandtypeattribute (dumpstate_service_31_0) true)
+(expandtypeattribute (dumpstate_socket_31_0) true)
+(expandtypeattribute (dynamic_system_prop_31_0) true)
+(expandtypeattribute (e2fs_31_0) true)
+(expandtypeattribute (e2fs_exec_31_0) true)
+(expandtypeattribute (efs_file_31_0) true)
+(expandtypeattribute (emergency_affordance_service_31_0) true)
+(expandtypeattribute (ephemeral_app_31_0) true)
+(expandtypeattribute (ethernet_service_31_0) true)
+(expandtypeattribute (exfat_31_0) true)
+(expandtypeattribute (exported3_system_prop_31_0) true)
+(expandtypeattribute (exported_bluetooth_prop_31_0) true)
+(expandtypeattribute (exported_camera_prop_31_0) true)
+(expandtypeattribute (exported_config_prop_31_0) true)
+(expandtypeattribute (exported_default_prop_31_0) true)
+(expandtypeattribute (exported_dumpstate_prop_31_0) true)
+(expandtypeattribute (exported_overlay_prop_31_0) true)
+(expandtypeattribute (exported_pm_prop_31_0) true)
+(expandtypeattribute (exported_secure_prop_31_0) true)
+(expandtypeattribute (exported_system_prop_31_0) true)
+(expandtypeattribute (external_vibrator_service_31_0) true)
+(expandtypeattribute (face_service_31_0) true)
+(expandtypeattribute (face_vendor_data_file_31_0) true)
+(expandtypeattribute (fastbootd_31_0) true)
+(expandtypeattribute (ffs_config_prop_31_0) true)
+(expandtypeattribute (ffs_control_prop_31_0) true)
+(expandtypeattribute (file_contexts_file_31_0) true)
+(expandtypeattribute (file_integrity_service_31_0) true)
+(expandtypeattribute (fingerprint_prop_31_0) true)
+(expandtypeattribute (fingerprint_service_31_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_31_0) true)
+(expandtypeattribute (fingerprintd_31_0) true)
+(expandtypeattribute (fingerprintd_data_file_31_0) true)
+(expandtypeattribute (fingerprintd_exec_31_0) true)
+(expandtypeattribute (fingerprintd_service_31_0) true)
+(expandtypeattribute (firstboot_prop_31_0) true)
+(expandtypeattribute (flags_health_check_31_0) true)
+(expandtypeattribute (flags_health_check_exec_31_0) true)
+(expandtypeattribute (font_service_31_0) true)
+(expandtypeattribute (framework_watchdog_config_prop_31_0) true)
+(expandtypeattribute (frp_block_device_31_0) true)
+(expandtypeattribute (fs_bpf_31_0) true)
+(expandtypeattribute (fs_bpf_tethering_31_0) true)
+(expandtypeattribute (fsck_31_0) true)
+(expandtypeattribute (fsck_exec_31_0) true)
+(expandtypeattribute (fsck_untrusted_31_0) true)
+(expandtypeattribute (fscklogs_31_0) true)
+(expandtypeattribute (functionfs_31_0) true)
+(expandtypeattribute (fuse_31_0) true)
+(expandtypeattribute (fuse_device_31_0) true)
+(expandtypeattribute (fusectlfs_31_0) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_31_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_31_0) true)
+(expandtypeattribute (fwk_camera_hwservice_31_0) true)
+(expandtypeattribute (fwk_display_hwservice_31_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_31_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_31_0) true)
+(expandtypeattribute (fwk_stats_hwservice_31_0) true)
+(expandtypeattribute (fwk_stats_service_31_0) true)
+(expandtypeattribute (fwmarkd_socket_31_0) true)
+(expandtypeattribute (game_service_31_0) true)
+(expandtypeattribute (gatekeeper_data_file_31_0) true)
+(expandtypeattribute (gatekeeper_service_31_0) true)
+(expandtypeattribute (gatekeeperd_31_0) true)
+(expandtypeattribute (gatekeeperd_exec_31_0) true)
+(expandtypeattribute (gfxinfo_service_31_0) true)
+(expandtypeattribute (gmscore_app_31_0) true)
+(expandtypeattribute (gnss_device_31_0) true)
+(expandtypeattribute (gnss_time_update_service_31_0) true)
+(expandtypeattribute (gps_control_31_0) true)
+(expandtypeattribute (gpu_device_31_0) true)
+(expandtypeattribute (gpu_service_31_0) true)
+(expandtypeattribute (gpuservice_31_0) true)
+(expandtypeattribute (graphics_config_prop_31_0) true)
+(expandtypeattribute (graphics_device_31_0) true)
+(expandtypeattribute (graphicsstats_service_31_0) true)
+(expandtypeattribute (gsi_data_file_31_0) true)
+(expandtypeattribute (gsi_metadata_file_31_0) true)
+(expandtypeattribute (gsi_public_metadata_file_31_0) true)
+(expandtypeattribute (hal_atrace_hwservice_31_0) true)
+(expandtypeattribute (hal_audio_hwservice_31_0) true)
+(expandtypeattribute (hal_audio_service_31_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_31_0) true)
+(expandtypeattribute (hal_audiocontrol_service_31_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_31_0) true)
+(expandtypeattribute (hal_authsecret_service_31_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_31_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_31_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_31_0) true)
+(expandtypeattribute (hal_camera_hwservice_31_0) true)
+(expandtypeattribute (hal_can_bus_hwservice_31_0) true)
+(expandtypeattribute (hal_can_controller_hwservice_31_0) true)
+(expandtypeattribute (hal_cas_hwservice_31_0) true)
+(expandtypeattribute (hal_codec2_hwservice_31_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_31_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_31_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_31_0) true)
+(expandtypeattribute (hal_drm_hwservice_31_0) true)
+(expandtypeattribute (hal_dumpstate_config_prop_31_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_31_0) true)
+(expandtypeattribute (hal_evs_hwservice_31_0) true)
+(expandtypeattribute (hal_face_hwservice_31_0) true)
+(expandtypeattribute (hal_face_service_31_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_31_0) true)
+(expandtypeattribute (hal_fingerprint_service_31_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_31_0) true)
+(expandtypeattribute (hal_gnss_hwservice_31_0) true)
+(expandtypeattribute (hal_gnss_service_31_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_31_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_31_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_31_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_31_0) true)
+(expandtypeattribute (hal_health_hwservice_31_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_31_0) true)
+(expandtypeattribute (hal_health_storage_service_31_0) true)
+(expandtypeattribute (hal_identity_service_31_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_31_0) true)
+(expandtypeattribute (hal_instrumentation_prop_31_0) true)
+(expandtypeattribute (hal_ir_hwservice_31_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_31_0) true)
+(expandtypeattribute (hal_keymint_service_31_0) true)
+(expandtypeattribute (hal_light_hwservice_31_0) true)
+(expandtypeattribute (hal_light_service_31_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_31_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_31_0) true)
+(expandtypeattribute (hal_memtrack_service_31_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_31_0) true)
+(expandtypeattribute (hal_neuralnetworks_service_31_0) true)
+(expandtypeattribute (hal_nfc_hwservice_31_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_31_0) true)
+(expandtypeattribute (hal_oemlock_service_31_0) true)
+(expandtypeattribute (hal_omx_hwservice_31_0) true)
+(expandtypeattribute (hal_power_hwservice_31_0) true)
+(expandtypeattribute (hal_power_service_31_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_31_0) true)
+(expandtypeattribute (hal_power_stats_service_31_0) true)
+(expandtypeattribute (hal_rebootescrow_service_31_0) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_31_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_31_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_31_0) true)
+(expandtypeattribute (hal_secureclock_service_31_0) true)
+(expandtypeattribute (hal_sensors_hwservice_31_0) true)
+(expandtypeattribute (hal_sharedsecret_service_31_0) true)
+(expandtypeattribute (hal_telephony_hwservice_31_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_31_0) true)
+(expandtypeattribute (hal_thermal_hwservice_31_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_31_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_31_0) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_31_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_31_0) true)
+(expandtypeattribute (hal_usb_hwservice_31_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_31_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_31_0) true)
+(expandtypeattribute (hal_vibrator_service_31_0) true)
+(expandtypeattribute (hal_vr_hwservice_31_0) true)
+(expandtypeattribute (hal_weaver_hwservice_31_0) true)
+(expandtypeattribute (hal_weaver_service_31_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_31_0) true)
+(expandtypeattribute (hal_wifi_hwservice_31_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_31_0) true)
+(expandtypeattribute (hardware_properties_service_31_0) true)
+(expandtypeattribute (hardware_service_31_0) true)
+(expandtypeattribute (hci_attach_dev_31_0) true)
+(expandtypeattribute (hdmi_config_prop_31_0) true)
+(expandtypeattribute (hdmi_control_service_31_0) true)
+(expandtypeattribute (healthd_31_0) true)
+(expandtypeattribute (healthd_exec_31_0) true)
+(expandtypeattribute (heapdump_data_file_31_0) true)
+(expandtypeattribute (heapprofd_31_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_31_0) true)
+(expandtypeattribute (heapprofd_prop_31_0) true)
+(expandtypeattribute (heapprofd_socket_31_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_31_0) true)
+(expandtypeattribute (hidl_base_hwservice_31_0) true)
+(expandtypeattribute (hidl_manager_hwservice_31_0) true)
+(expandtypeattribute (hidl_memory_hwservice_31_0) true)
+(expandtypeattribute (hidl_token_hwservice_31_0) true)
+(expandtypeattribute (hint_service_31_0) true)
+(expandtypeattribute (hw_random_device_31_0) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_31_0) true)
+(expandtypeattribute (hwbinder_device_31_0) true)
+(expandtypeattribute (hwservice_contexts_file_31_0) true)
+(expandtypeattribute (hwservicemanager_31_0) true)
+(expandtypeattribute (hwservicemanager_exec_31_0) true)
+(expandtypeattribute (hwservicemanager_prop_31_0) true)
+(expandtypeattribute (icon_file_31_0) true)
+(expandtypeattribute (idmap_31_0) true)
+(expandtypeattribute (idmap_exec_31_0) true)
+(expandtypeattribute (idmap_service_31_0) true)
+(expandtypeattribute (iio_device_31_0) true)
+(expandtypeattribute (imms_service_31_0) true)
+(expandtypeattribute (incident_31_0) true)
+(expandtypeattribute (incident_data_file_31_0) true)
+(expandtypeattribute (incident_helper_31_0) true)
+(expandtypeattribute (incident_service_31_0) true)
+(expandtypeattribute (incidentd_31_0) true)
+(expandtypeattribute (incremental_control_file_31_0) true)
+(expandtypeattribute (incremental_prop_31_0) true)
+(expandtypeattribute (incremental_service_31_0) true)
+(expandtypeattribute (init_31_0) true)
+(expandtypeattribute (init_exec_31_0) true)
+(expandtypeattribute (init_service_status_prop_31_0) true)
+(expandtypeattribute (init_tmpfs_31_0) true)
+(expandtypeattribute (inotify_31_0) true)
+(expandtypeattribute (input_device_31_0) true)
+(expandtypeattribute (input_method_service_31_0) true)
+(expandtypeattribute (input_service_31_0) true)
+(expandtypeattribute (inputflinger_31_0) true)
+(expandtypeattribute (inputflinger_exec_31_0) true)
+(expandtypeattribute (inputflinger_service_31_0) true)
+(expandtypeattribute (install_data_file_31_0) true)
+(expandtypeattribute (installd_31_0) true)
+(expandtypeattribute (installd_exec_31_0) true)
+(expandtypeattribute (installd_service_31_0) true)
+(expandtypeattribute (ion_device_31_0) true)
+(expandtypeattribute (iorap_inode2filename_31_0) true)
+(expandtypeattribute (iorap_inode2filename_exec_31_0) true)
+(expandtypeattribute (iorap_inode2filename_tmpfs_31_0) true)
+(expandtypeattribute (iorap_prefetcherd_31_0) true)
+(expandtypeattribute (iorap_prefetcherd_exec_31_0) true)
+(expandtypeattribute (iorap_prefetcherd_tmpfs_31_0) true)
+(expandtypeattribute (iorapd_31_0) true)
+(expandtypeattribute (iorapd_data_file_31_0) true)
+(expandtypeattribute (iorapd_exec_31_0) true)
+(expandtypeattribute (iorapd_service_31_0) true)
+(expandtypeattribute (iorapd_tmpfs_31_0) true)
+(expandtypeattribute (ipsec_service_31_0) true)
+(expandtypeattribute (iris_service_31_0) true)
+(expandtypeattribute (iris_vendor_data_file_31_0) true)
+(expandtypeattribute (isolated_app_31_0) true)
+(expandtypeattribute (jobscheduler_service_31_0) true)
+(expandtypeattribute (kernel_31_0) true)
+(expandtypeattribute (keychain_data_file_31_0) true)
+(expandtypeattribute (keychord_device_31_0) true)
+(expandtypeattribute (keyguard_config_prop_31_0) true)
+(expandtypeattribute (keystore2_key_contexts_file_31_0) true)
+(expandtypeattribute (keystore_31_0) true)
+(expandtypeattribute (keystore_compat_hal_service_31_0) true)
+(expandtypeattribute (keystore_data_file_31_0) true)
+(expandtypeattribute (keystore_exec_31_0) true)
+(expandtypeattribute (keystore_maintenance_service_31_0) true)
+(expandtypeattribute (keystore_metrics_service_31_0) true)
+(expandtypeattribute (keystore_service_31_0) true)
+(expandtypeattribute (kmsg_debug_device_31_0) true)
+(expandtypeattribute (kmsg_device_31_0) true)
+(expandtypeattribute (labeledfs_31_0) true)
+(expandtypeattribute (launcherapps_service_31_0) true)
+(expandtypeattribute (legacy_permission_service_31_0) true)
+(expandtypeattribute (legacykeystore_service_31_0) true)
+(expandtypeattribute (libc_debug_prop_31_0) true)
+(expandtypeattribute (light_service_31_0) true)
+(expandtypeattribute (linkerconfig_file_31_0) true)
+(expandtypeattribute (llkd_31_0) true)
+(expandtypeattribute (llkd_exec_31_0) true)
+(expandtypeattribute (llkd_prop_31_0) true)
+(expandtypeattribute (lmkd_31_0) true)
+(expandtypeattribute (lmkd_config_prop_31_0) true)
+(expandtypeattribute (lmkd_exec_31_0) true)
+(expandtypeattribute (lmkd_prop_31_0) true)
+(expandtypeattribute (lmkd_socket_31_0) true)
+(expandtypeattribute (location_service_31_0) true)
+(expandtypeattribute (location_time_zone_manager_service_31_0) true)
+(expandtypeattribute (lock_settings_service_31_0) true)
+(expandtypeattribute (log_prop_31_0) true)
+(expandtypeattribute (log_tag_prop_31_0) true)
+(expandtypeattribute (logcat_exec_31_0) true)
+(expandtypeattribute (logd_31_0) true)
+(expandtypeattribute (logd_exec_31_0) true)
+(expandtypeattribute (logd_prop_31_0) true)
+(expandtypeattribute (logd_socket_31_0) true)
+(expandtypeattribute (logdr_socket_31_0) true)
+(expandtypeattribute (logdw_socket_31_0) true)
+(expandtypeattribute (logpersist_31_0) true)
+(expandtypeattribute (logpersistd_logging_prop_31_0) true)
+(expandtypeattribute (loop_control_device_31_0) true)
+(expandtypeattribute (loop_device_31_0) true)
+(expandtypeattribute (looper_stats_service_31_0) true)
+(expandtypeattribute (lowpan_device_31_0) true)
+(expandtypeattribute (lowpan_prop_31_0) true)
+(expandtypeattribute (lowpan_service_31_0) true)
+(expandtypeattribute (lpdump_service_31_0) true)
+(expandtypeattribute (lpdumpd_prop_31_0) true)
+(expandtypeattribute (mac_perms_file_31_0) true)
+(expandtypeattribute (mdns_socket_31_0) true)
+(expandtypeattribute (mdnsd_31_0) true)
+(expandtypeattribute (mdnsd_socket_31_0) true)
+(expandtypeattribute (media_communication_service_31_0) true)
+(expandtypeattribute (media_config_prop_31_0) true)
+(expandtypeattribute (media_data_file_31_0) true)
+(expandtypeattribute (media_metrics_service_31_0) true)
+(expandtypeattribute (media_projection_service_31_0) true)
+(expandtypeattribute (media_router_service_31_0) true)
+(expandtypeattribute (media_rw_data_file_31_0) true)
+(expandtypeattribute (media_session_service_31_0) true)
+(expandtypeattribute (media_variant_prop_31_0) true)
+(expandtypeattribute (mediadrm_config_prop_31_0) true)
+(expandtypeattribute (mediadrmserver_31_0) true)
+(expandtypeattribute (mediadrmserver_exec_31_0) true)
+(expandtypeattribute (mediadrmserver_service_31_0) true)
+(expandtypeattribute (mediaextractor_31_0) true)
+(expandtypeattribute (mediaextractor_exec_31_0) true)
+(expandtypeattribute (mediaextractor_service_31_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_31_0) true)
+(expandtypeattribute (mediametrics_31_0) true)
+(expandtypeattribute (mediametrics_exec_31_0) true)
+(expandtypeattribute (mediametrics_service_31_0) true)
+(expandtypeattribute (mediaprovider_31_0) true)
+(expandtypeattribute (mediaserver_31_0) true)
+(expandtypeattribute (mediaserver_exec_31_0) true)
+(expandtypeattribute (mediaserver_service_31_0) true)
+(expandtypeattribute (mediaserver_tmpfs_31_0) true)
+(expandtypeattribute (mediaswcodec_31_0) true)
+(expandtypeattribute (mediaswcodec_exec_31_0) true)
+(expandtypeattribute (mediatranscoding_service_31_0) true)
+(expandtypeattribute (meminfo_service_31_0) true)
+(expandtypeattribute (memtrackproxy_service_31_0) true)
+(expandtypeattribute (metadata_block_device_31_0) true)
+(expandtypeattribute (metadata_bootstat_file_31_0) true)
+(expandtypeattribute (metadata_file_31_0) true)
+(expandtypeattribute (method_trace_data_file_31_0) true)
+(expandtypeattribute (midi_service_31_0) true)
+(expandtypeattribute (mirror_data_file_31_0) true)
+(expandtypeattribute (misc_block_device_31_0) true)
+(expandtypeattribute (misc_logd_file_31_0) true)
+(expandtypeattribute (misc_user_data_file_31_0) true)
+(expandtypeattribute (mm_events_config_prop_31_0) true)
+(expandtypeattribute (mmc_prop_31_0) true)
+(expandtypeattribute (mnt_expand_file_31_0) true)
+(expandtypeattribute (mnt_media_rw_file_31_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_31_0) true)
+(expandtypeattribute (mnt_pass_through_file_31_0) true)
+(expandtypeattribute (mnt_product_file_31_0) true)
+(expandtypeattribute (mnt_sdcard_file_31_0) true)
+(expandtypeattribute (mnt_user_file_31_0) true)
+(expandtypeattribute (mnt_vendor_file_31_0) true)
+(expandtypeattribute (mock_ota_prop_31_0) true)
+(expandtypeattribute (modprobe_31_0) true)
+(expandtypeattribute (module_sdkextensions_prop_31_0) true)
+(expandtypeattribute (mount_service_31_0) true)
+(expandtypeattribute (mqueue_31_0) true)
+(expandtypeattribute (mtp_31_0) true)
+(expandtypeattribute (mtp_device_31_0) true)
+(expandtypeattribute (mtp_exec_31_0) true)
+(expandtypeattribute (mtpd_socket_31_0) true)
+(expandtypeattribute (music_recognition_service_31_0) true)
+(expandtypeattribute (nativetest_data_file_31_0) true)
+(expandtypeattribute (net_data_file_31_0) true)
+(expandtypeattribute (net_dns_prop_31_0) true)
+(expandtypeattribute (net_radio_prop_31_0) true)
+(expandtypeattribute (netd_31_0) true)
+(expandtypeattribute (netd_exec_31_0) true)
+(expandtypeattribute (netd_listener_service_31_0) true)
+(expandtypeattribute (netd_service_31_0) true)
+(expandtypeattribute (netif_31_0) true)
+(expandtypeattribute (netpolicy_service_31_0) true)
+(expandtypeattribute (netstats_service_31_0) true)
+(expandtypeattribute (netutils_wrapper_31_0) true)
+(expandtypeattribute (netutils_wrapper_exec_31_0) true)
+(expandtypeattribute (network_management_service_31_0) true)
+(expandtypeattribute (network_score_service_31_0) true)
+(expandtypeattribute (network_stack_31_0) true)
+(expandtypeattribute (network_stack_service_31_0) true)
+(expandtypeattribute (network_time_update_service_31_0) true)
+(expandtypeattribute (network_watchlist_data_file_31_0) true)
+(expandtypeattribute (network_watchlist_service_31_0) true)
+(expandtypeattribute (nfc_31_0) true)
+(expandtypeattribute (nfc_data_file_31_0) true)
+(expandtypeattribute (nfc_device_31_0) true)
+(expandtypeattribute (nfc_logs_data_file_31_0) true)
+(expandtypeattribute (nfc_prop_31_0) true)
+(expandtypeattribute (nfc_service_31_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_31_0) true)
+(expandtypeattribute (node_31_0) true)
+(expandtypeattribute (nonplat_service_contexts_file_31_0) true)
+(expandtypeattribute (notification_service_31_0) true)
+(expandtypeattribute (null_device_31_0) true)
+(expandtypeattribute (oem_lock_service_31_0) true)
+(expandtypeattribute (oem_unlock_prop_31_0) true)
+(expandtypeattribute (oemfs_31_0) true)
+(expandtypeattribute (ota_data_file_31_0) true)
+(expandtypeattribute (ota_metadata_file_31_0) true)
+(expandtypeattribute (ota_package_file_31_0) true)
+(expandtypeattribute (ota_prop_31_0) true)
+(expandtypeattribute (otadexopt_service_31_0) true)
+(expandtypeattribute (otapreopt_chroot_31_0) true)
+(expandtypeattribute (overlay_prop_31_0) true)
+(expandtypeattribute (overlay_service_31_0) true)
+(expandtypeattribute (overlayfs_file_31_0) true)
+(expandtypeattribute (owntty_device_31_0) true)
+(expandtypeattribute (pac_proxy_service_31_0) true)
+(expandtypeattribute (package_native_service_31_0) true)
+(expandtypeattribute (package_service_31_0) true)
+(expandtypeattribute (packagemanager_config_prop_31_0) true)
+(expandtypeattribute (packages_list_file_31_0) true)
+(expandtypeattribute (pan_result_prop_31_0) true)
+(expandtypeattribute (password_slot_metadata_file_31_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_31_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_31_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_31_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_display_dir_31_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_31_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_31_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_31_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_31_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_31_0) true)
+(expandtypeattribute (pdx_performance_dir_31_0) true)
+(expandtypeattribute (people_service_31_0) true)
+(expandtypeattribute (perfetto_31_0) true)
+(expandtypeattribute (performanced_31_0) true)
+(expandtypeattribute (performanced_exec_31_0) true)
+(expandtypeattribute (permission_checker_service_31_0) true)
+(expandtypeattribute (permission_service_31_0) true)
+(expandtypeattribute (permissionmgr_service_31_0) true)
+(expandtypeattribute (persist_debug_prop_31_0) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_31_0) true)
+(expandtypeattribute (persistent_data_block_service_31_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_31_0) true)
+(expandtypeattribute (pinner_service_31_0) true)
+(expandtypeattribute (pipefs_31_0) true)
+(expandtypeattribute (platform_app_31_0) true)
+(expandtypeattribute (platform_compat_service_31_0) true)
+(expandtypeattribute (pmsg_device_31_0) true)
+(expandtypeattribute (port_31_0) true)
+(expandtypeattribute (port_device_31_0) true)
+(expandtypeattribute (postinstall_31_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_31_0) true)
+(expandtypeattribute (postinstall_file_31_0) true)
+(expandtypeattribute (postinstall_mnt_dir_31_0) true)
+(expandtypeattribute (power_debug_prop_31_0) true)
+(expandtypeattribute (power_service_31_0) true)
+(expandtypeattribute (powerctl_prop_31_0) true)
+(expandtypeattribute (powerstats_service_31_0) true)
+(expandtypeattribute (ppp_31_0) true)
+(expandtypeattribute (ppp_device_31_0) true)
+(expandtypeattribute (ppp_exec_31_0) true)
+(expandtypeattribute (preloads_data_file_31_0) true)
+(expandtypeattribute (preloads_media_file_31_0) true)
+(expandtypeattribute (prereboot_data_file_31_0) true)
+(expandtypeattribute (print_service_31_0) true)
+(expandtypeattribute (priv_app_31_0) true)
+(expandtypeattribute (privapp_data_file_31_0) true)
+(expandtypeattribute (proc_31_0) true)
+(expandtypeattribute (proc_abi_31_0) true)
+(expandtypeattribute (proc_asound_31_0) true)
+(expandtypeattribute (proc_bluetooth_writable_31_0) true)
+(expandtypeattribute (proc_bootconfig_31_0) true)
+(expandtypeattribute (proc_buddyinfo_31_0) true)
+(expandtypeattribute (proc_cmdline_31_0) true)
+(expandtypeattribute (proc_cpuinfo_31_0) true)
+(expandtypeattribute (proc_dirty_31_0) true)
+(expandtypeattribute (proc_diskstats_31_0) true)
+(expandtypeattribute (proc_drop_caches_31_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_31_0) true)
+(expandtypeattribute (proc_filesystems_31_0) true)
+(expandtypeattribute (proc_fs_verity_31_0) true)
+(expandtypeattribute (proc_hostname_31_0) true)
+(expandtypeattribute (proc_hung_task_31_0) true)
+(expandtypeattribute (proc_interrupts_31_0) true)
+(expandtypeattribute (proc_iomem_31_0) true)
+(expandtypeattribute (proc_kallsyms_31_0) true)
+(expandtypeattribute (proc_keys_31_0) true)
+(expandtypeattribute (proc_kmsg_31_0) true)
+(expandtypeattribute (proc_kpageflags_31_0) true)
+(expandtypeattribute (proc_loadavg_31_0) true)
+(expandtypeattribute (proc_locks_31_0) true)
+(expandtypeattribute (proc_lowmemorykiller_31_0) true)
+(expandtypeattribute (proc_max_map_count_31_0) true)
+(expandtypeattribute (proc_meminfo_31_0) true)
+(expandtypeattribute (proc_min_free_order_shift_31_0) true)
+(expandtypeattribute (proc_misc_31_0) true)
+(expandtypeattribute (proc_modules_31_0) true)
+(expandtypeattribute (proc_mounts_31_0) true)
+(expandtypeattribute (proc_net_31_0) true)
+(expandtypeattribute (proc_net_tcp_udp_31_0) true)
+(expandtypeattribute (proc_overcommit_memory_31_0) true)
+(expandtypeattribute (proc_page_cluster_31_0) true)
+(expandtypeattribute (proc_pagetypeinfo_31_0) true)
+(expandtypeattribute (proc_panic_31_0) true)
+(expandtypeattribute (proc_perf_31_0) true)
+(expandtypeattribute (proc_pid_max_31_0) true)
+(expandtypeattribute (proc_pipe_conf_31_0) true)
+(expandtypeattribute (proc_pressure_cpu_31_0) true)
+(expandtypeattribute (proc_pressure_io_31_0) true)
+(expandtypeattribute (proc_pressure_mem_31_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_31_0) true)
+(expandtypeattribute (proc_qtaguid_stat_31_0) true)
+(expandtypeattribute (proc_random_31_0) true)
+(expandtypeattribute (proc_sched_31_0) true)
+(expandtypeattribute (proc_security_31_0) true)
+(expandtypeattribute (proc_slabinfo_31_0) true)
+(expandtypeattribute (proc_stat_31_0) true)
+(expandtypeattribute (proc_swaps_31_0) true)
+(expandtypeattribute (proc_sysrq_31_0) true)
+(expandtypeattribute (proc_timer_31_0) true)
+(expandtypeattribute (proc_tty_drivers_31_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_31_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_31_0) true)
+(expandtypeattribute (proc_uid_cpupower_31_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_31_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_31_0) true)
+(expandtypeattribute (proc_uid_io_stats_31_0) true)
+(expandtypeattribute (proc_uid_procstat_set_31_0) true)
+(expandtypeattribute (proc_uid_time_in_state_31_0) true)
+(expandtypeattribute (proc_uptime_31_0) true)
+(expandtypeattribute (proc_vendor_sched_31_0) true)
+(expandtypeattribute (proc_version_31_0) true)
+(expandtypeattribute (proc_vmallocinfo_31_0) true)
+(expandtypeattribute (proc_vmstat_31_0) true)
+(expandtypeattribute (proc_zoneinfo_31_0) true)
+(expandtypeattribute (processinfo_service_31_0) true)
+(expandtypeattribute (procstats_service_31_0) true)
+(expandtypeattribute (profman_31_0) true)
+(expandtypeattribute (profman_dump_data_file_31_0) true)
+(expandtypeattribute (profman_exec_31_0) true)
+(expandtypeattribute (properties_device_31_0) true)
+(expandtypeattribute (properties_serial_31_0) true)
+(expandtypeattribute (property_contexts_file_31_0) true)
+(expandtypeattribute (property_data_file_31_0) true)
+(expandtypeattribute (property_info_31_0) true)
+(expandtypeattribute (property_service_version_prop_31_0) true)
+(expandtypeattribute (property_socket_31_0) true)
+(expandtypeattribute (provisioned_prop_31_0) true)
+(expandtypeattribute (pstorefs_31_0) true)
+(expandtypeattribute (ptmx_device_31_0) true)
+(expandtypeattribute (qemu_hw_prop_31_0) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_31_0) true)
+(expandtypeattribute (qtaguid_device_31_0) true)
+(expandtypeattribute (racoon_31_0) true)
+(expandtypeattribute (racoon_exec_31_0) true)
+(expandtypeattribute (racoon_socket_31_0) true)
+(expandtypeattribute (radio_31_0) true)
+(expandtypeattribute (radio_control_prop_31_0) true)
+(expandtypeattribute (radio_core_data_file_31_0) true)
+(expandtypeattribute (radio_data_file_31_0) true)
+(expandtypeattribute (radio_device_31_0) true)
+(expandtypeattribute (radio_prop_31_0) true)
+(expandtypeattribute (radio_service_31_0) true)
+(expandtypeattribute (ram_device_31_0) true)
+(expandtypeattribute (random_device_31_0) true)
+(expandtypeattribute (reboot_readiness_service_31_0) true)
+(expandtypeattribute (rebootescrow_hal_prop_31_0) true)
+(expandtypeattribute (recovery_31_0) true)
+(expandtypeattribute (recovery_block_device_31_0) true)
+(expandtypeattribute (recovery_config_prop_31_0) true)
+(expandtypeattribute (recovery_data_file_31_0) true)
+(expandtypeattribute (recovery_persist_31_0) true)
+(expandtypeattribute (recovery_persist_exec_31_0) true)
+(expandtypeattribute (recovery_refresh_31_0) true)
+(expandtypeattribute (recovery_refresh_exec_31_0) true)
+(expandtypeattribute (recovery_service_31_0) true)
+(expandtypeattribute (recovery_socket_31_0) true)
+(expandtypeattribute (registry_service_31_0) true)
+(expandtypeattribute (remoteprovisioning_service_31_0) true)
+(expandtypeattribute (resourcecache_data_file_31_0) true)
+(expandtypeattribute (restorecon_prop_31_0) true)
+(expandtypeattribute (restrictions_service_31_0) true)
+(expandtypeattribute (retaildemo_prop_31_0) true)
+(expandtypeattribute (rild_debug_socket_31_0) true)
+(expandtypeattribute (rild_socket_31_0) true)
+(expandtypeattribute (ringtone_file_31_0) true)
+(expandtypeattribute (role_service_31_0) true)
+(expandtypeattribute (rollback_service_31_0) true)
+(expandtypeattribute (root_block_device_31_0) true)
+(expandtypeattribute (rootfs_31_0) true)
+(expandtypeattribute (rpmsg_device_31_0) true)
+(expandtypeattribute (rs_31_0) true)
+(expandtypeattribute (rs_exec_31_0) true)
+(expandtypeattribute (rss_hwm_reset_31_0) true)
+(expandtypeattribute (rtc_device_31_0) true)
+(expandtypeattribute (rttmanager_service_31_0) true)
+(expandtypeattribute (runas_31_0) true)
+(expandtypeattribute (runas_app_31_0) true)
+(expandtypeattribute (runas_exec_31_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_31_0) true)
+(expandtypeattribute (runtime_service_31_0) true)
+(expandtypeattribute (safemode_prop_31_0) true)
+(expandtypeattribute (same_process_hal_file_31_0) true)
+(expandtypeattribute (samplingprofiler_service_31_0) true)
+(expandtypeattribute (scheduling_policy_service_31_0) true)
+(expandtypeattribute (sdcard_block_device_31_0) true)
+(expandtypeattribute (sdcardd_31_0) true)
+(expandtypeattribute (sdcardd_exec_31_0) true)
+(expandtypeattribute (sdcardfs_31_0) true)
+(expandtypeattribute (seapp_contexts_file_31_0) true)
+(expandtypeattribute (search_service_31_0) true)
+(expandtypeattribute (search_ui_service_31_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_31_0) true)
+(expandtypeattribute (secure_element_31_0) true)
+(expandtypeattribute (secure_element_device_31_0) true)
+(expandtypeattribute (secure_element_service_31_0) true)
+(expandtypeattribute (securityfs_31_0) true)
+(expandtypeattribute (selinuxfs_31_0) true)
+(expandtypeattribute (sendbug_config_prop_31_0) true)
+(expandtypeattribute (sensor_privacy_service_31_0) true)
+(expandtypeattribute (sensors_device_31_0) true)
+(expandtypeattribute (sensorservice_service_31_0) true)
+(expandtypeattribute (sepolicy_file_31_0) true)
+(expandtypeattribute (serial_device_31_0) true)
+(expandtypeattribute (serial_service_31_0) true)
+(expandtypeattribute (serialno_prop_31_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_31_0) true)
+(expandtypeattribute (service_contexts_file_31_0) true)
+(expandtypeattribute (service_manager_service_31_0) true)
+(expandtypeattribute (service_manager_vndservice_31_0) true)
+(expandtypeattribute (servicediscovery_service_31_0) true)
+(expandtypeattribute (servicemanager_31_0) true)
+(expandtypeattribute (servicemanager_exec_31_0) true)
+(expandtypeattribute (settings_service_31_0) true)
+(expandtypeattribute (sgdisk_31_0) true)
+(expandtypeattribute (sgdisk_exec_31_0) true)
+(expandtypeattribute (shared_relro_31_0) true)
+(expandtypeattribute (shared_relro_file_31_0) true)
+(expandtypeattribute (shell_31_0) true)
+(expandtypeattribute (shell_data_file_31_0) true)
+(expandtypeattribute (shell_exec_31_0) true)
+(expandtypeattribute (shell_prop_31_0) true)
+(expandtypeattribute (shell_test_data_file_31_0) true)
+(expandtypeattribute (shm_31_0) true)
+(expandtypeattribute (shortcut_manager_icons_31_0) true)
+(expandtypeattribute (shortcut_service_31_0) true)
+(expandtypeattribute (simpleperf_31_0) true)
+(expandtypeattribute (simpleperf_app_runner_31_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_31_0) true)
+(expandtypeattribute (slice_service_31_0) true)
+(expandtypeattribute (slideshow_31_0) true)
+(expandtypeattribute (smartspace_service_31_0) true)
+(expandtypeattribute (snapshotctl_log_data_file_31_0) true)
+(expandtypeattribute (snapuserd_socket_31_0) true)
+(expandtypeattribute (soc_prop_31_0) true)
+(expandtypeattribute (socket_device_31_0) true)
+(expandtypeattribute (socket_hook_prop_31_0) true)
+(expandtypeattribute (sockfs_31_0) true)
+(expandtypeattribute (sota_prop_31_0) true)
+(expandtypeattribute (soundtrigger_middleware_service_31_0) true)
+(expandtypeattribute (speech_recognition_service_31_0) true)
+(expandtypeattribute (sqlite_log_prop_31_0) true)
+(expandtypeattribute (staged_install_file_31_0) true)
+(expandtypeattribute (staging_data_file_31_0) true)
+(expandtypeattribute (stats_data_file_31_0) true)
+(expandtypeattribute (statsd_31_0) true)
+(expandtypeattribute (statsd_exec_31_0) true)
+(expandtypeattribute (statsdw_socket_31_0) true)
+(expandtypeattribute (statusbar_service_31_0) true)
+(expandtypeattribute (storage_config_prop_31_0) true)
+(expandtypeattribute (storage_file_31_0) true)
+(expandtypeattribute (storage_stub_file_31_0) true)
+(expandtypeattribute (storaged_service_31_0) true)
+(expandtypeattribute (storagemanager_config_prop_31_0) true)
+(expandtypeattribute (storagestats_service_31_0) true)
+(expandtypeattribute (su_31_0) true)
+(expandtypeattribute (su_exec_31_0) true)
+(expandtypeattribute (super_block_device_31_0) true)
+(expandtypeattribute (surfaceflinger_31_0) true)
+(expandtypeattribute (surfaceflinger_color_prop_31_0) true)
+(expandtypeattribute (surfaceflinger_display_prop_31_0) true)
+(expandtypeattribute (surfaceflinger_prop_31_0) true)
+(expandtypeattribute (surfaceflinger_service_31_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_31_0) true)
+(expandtypeattribute (suspend_prop_31_0) true)
+(expandtypeattribute (swap_block_device_31_0) true)
+(expandtypeattribute (sysfs_31_0) true)
+(expandtypeattribute (sysfs_android_usb_31_0) true)
+(expandtypeattribute (sysfs_batteryinfo_31_0) true)
+(expandtypeattribute (sysfs_block_31_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_31_0) true)
+(expandtypeattribute (sysfs_devfreq_cur_31_0) true)
+(expandtypeattribute (sysfs_devfreq_dir_31_0) true)
+(expandtypeattribute (sysfs_devices_block_31_0) true)
+(expandtypeattribute (sysfs_devices_cs_etm_31_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_31_0) true)
+(expandtypeattribute (sysfs_dm_31_0) true)
+(expandtypeattribute (sysfs_dm_verity_31_0) true)
+(expandtypeattribute (sysfs_dma_heap_31_0) true)
+(expandtypeattribute (sysfs_dmabuf_stats_31_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_31_0) true)
+(expandtypeattribute (sysfs_extcon_31_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_31_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_31_0) true)
+(expandtypeattribute (sysfs_fs_incfs_features_31_0) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_31_0) true)
+(expandtypeattribute (sysfs_hwrandom_31_0) true)
+(expandtypeattribute (sysfs_ion_31_0) true)
+(expandtypeattribute (sysfs_ipv4_31_0) true)
+(expandtypeattribute (sysfs_kernel_notes_31_0) true)
+(expandtypeattribute (sysfs_leds_31_0) true)
+(expandtypeattribute (sysfs_loop_31_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_31_0) true)
+(expandtypeattribute (sysfs_net_31_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_31_0) true)
+(expandtypeattribute (sysfs_power_31_0) true)
+(expandtypeattribute (sysfs_rtc_31_0) true)
+(expandtypeattribute (sysfs_suspend_stats_31_0) true)
+(expandtypeattribute (sysfs_switch_31_0) true)
+(expandtypeattribute (sysfs_thermal_31_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_31_0) true)
+(expandtypeattribute (sysfs_uhid_31_0) true)
+(expandtypeattribute (sysfs_uio_31_0) true)
+(expandtypeattribute (sysfs_usb_31_0) true)
+(expandtypeattribute (sysfs_usermodehelper_31_0) true)
+(expandtypeattribute (sysfs_vendor_sched_31_0) true)
+(expandtypeattribute (sysfs_vibrator_31_0) true)
+(expandtypeattribute (sysfs_wake_lock_31_0) true)
+(expandtypeattribute (sysfs_wakeup_31_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_31_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_31_0) true)
+(expandtypeattribute (sysfs_zram_31_0) true)
+(expandtypeattribute (sysfs_zram_uevent_31_0) true)
+(expandtypeattribute (system_app_31_0) true)
+(expandtypeattribute (system_app_data_file_31_0) true)
+(expandtypeattribute (system_app_service_31_0) true)
+(expandtypeattribute (system_asan_options_file_31_0) true)
+(expandtypeattribute (system_block_device_31_0) true)
+(expandtypeattribute (system_boot_reason_prop_31_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_31_0) true)
+(expandtypeattribute (system_config_service_31_0) true)
+(expandtypeattribute (system_data_file_31_0) true)
+(expandtypeattribute (system_data_root_file_31_0) true)
+(expandtypeattribute (system_event_log_tags_file_31_0) true)
+(expandtypeattribute (system_file_31_0) true)
+(expandtypeattribute (system_group_file_31_0) true)
+(expandtypeattribute (system_jvmti_agent_prop_31_0) true)
+(expandtypeattribute (system_lib_file_31_0) true)
+(expandtypeattribute (system_linker_config_file_31_0) true)
+(expandtypeattribute (system_linker_exec_31_0) true)
+(expandtypeattribute (system_lmk_prop_31_0) true)
+(expandtypeattribute (system_ndebug_socket_31_0) true)
+(expandtypeattribute (system_net_netd_hwservice_31_0) true)
+(expandtypeattribute (system_passwd_file_31_0) true)
+(expandtypeattribute (system_prop_31_0) true)
+(expandtypeattribute (system_seccomp_policy_file_31_0) true)
+(expandtypeattribute (system_security_cacerts_file_31_0) true)
+(expandtypeattribute (system_server_31_0) true)
+(expandtypeattribute (system_server_dumper_service_31_0) true)
+(expandtypeattribute (system_server_tmpfs_31_0) true)
+(expandtypeattribute (system_suspend_control_internal_service_31_0) true)
+(expandtypeattribute (system_suspend_control_service_31_0) true)
+(expandtypeattribute (system_suspend_hwservice_31_0) true)
+(expandtypeattribute (system_trace_prop_31_0) true)
+(expandtypeattribute (system_unsolzygote_socket_31_0) true)
+(expandtypeattribute (system_update_service_31_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_31_0) true)
+(expandtypeattribute (system_wpa_socket_31_0) true)
+(expandtypeattribute (system_zoneinfo_file_31_0) true)
+(expandtypeattribute (systemkeys_data_file_31_0) true)
+(expandtypeattribute (systemsound_config_prop_31_0) true)
+(expandtypeattribute (task_profiles_api_file_31_0) true)
+(expandtypeattribute (task_profiles_file_31_0) true)
+(expandtypeattribute (task_service_31_0) true)
+(expandtypeattribute (tcpdump_exec_31_0) true)
+(expandtypeattribute (tee_31_0) true)
+(expandtypeattribute (tee_data_file_31_0) true)
+(expandtypeattribute (tee_device_31_0) true)
+(expandtypeattribute (telecom_service_31_0) true)
+(expandtypeattribute (telephony_config_prop_31_0) true)
+(expandtypeattribute (telephony_status_prop_31_0) true)
+(expandtypeattribute (test_boot_reason_prop_31_0) true)
+(expandtypeattribute (test_harness_prop_31_0) true)
+(expandtypeattribute (testharness_service_31_0) true)
+(expandtypeattribute (tethering_service_31_0) true)
+(expandtypeattribute (textclassification_service_31_0) true)
+(expandtypeattribute (textclassifier_data_file_31_0) true)
+(expandtypeattribute (textservices_service_31_0) true)
+(expandtypeattribute (texttospeech_service_31_0) true)
+(expandtypeattribute (theme_prop_31_0) true)
+(expandtypeattribute (thermal_service_31_0) true)
+(expandtypeattribute (time_prop_31_0) true)
+(expandtypeattribute (timedetector_service_31_0) true)
+(expandtypeattribute (timezone_service_31_0) true)
+(expandtypeattribute (timezonedetector_service_31_0) true)
+(expandtypeattribute (tmpfs_31_0) true)
+(expandtypeattribute (tombstone_config_prop_31_0) true)
+(expandtypeattribute (tombstone_data_file_31_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_31_0) true)
+(expandtypeattribute (tombstoned_31_0) true)
+(expandtypeattribute (tombstoned_crash_socket_31_0) true)
+(expandtypeattribute (tombstoned_exec_31_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_31_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_31_0) true)
+(expandtypeattribute (toolbox_31_0) true)
+(expandtypeattribute (toolbox_exec_31_0) true)
+(expandtypeattribute (trace_data_file_31_0) true)
+(expandtypeattribute (traced_31_0) true)
+(expandtypeattribute (traced_consumer_socket_31_0) true)
+(expandtypeattribute (traced_enabled_prop_31_0) true)
+(expandtypeattribute (traced_lazy_prop_31_0) true)
+(expandtypeattribute (traced_perf_31_0) true)
+(expandtypeattribute (traced_perf_socket_31_0) true)
+(expandtypeattribute (traced_probes_31_0) true)
+(expandtypeattribute (traced_producer_socket_31_0) true)
+(expandtypeattribute (traced_tmpfs_31_0) true)
+(expandtypeattribute (traceur_app_31_0) true)
+(expandtypeattribute (translation_service_31_0) true)
+(expandtypeattribute (trust_service_31_0) true)
+(expandtypeattribute (tty_device_31_0) true)
+(expandtypeattribute (tun_device_31_0) true)
+(expandtypeattribute (tv_input_service_31_0) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_31_0) true)
+(expandtypeattribute (tzdatacheck_31_0) true)
+(expandtypeattribute (tzdatacheck_exec_31_0) true)
+(expandtypeattribute (ueventd_31_0) true)
+(expandtypeattribute (ueventd_tmpfs_31_0) true)
+(expandtypeattribute (uhid_device_31_0) true)
+(expandtypeattribute (uimode_service_31_0) true)
+(expandtypeattribute (uio_device_31_0) true)
+(expandtypeattribute (uncrypt_31_0) true)
+(expandtypeattribute (uncrypt_exec_31_0) true)
+(expandtypeattribute (uncrypt_socket_31_0) true)
+(expandtypeattribute (unencrypted_data_file_31_0) true)
+(expandtypeattribute (unlabeled_31_0) true)
+(expandtypeattribute (untrusted_app_25_31_0) true)
+(expandtypeattribute (untrusted_app_27_31_0) true)
+(expandtypeattribute (untrusted_app_29_31_0) true)
+(expandtypeattribute (untrusted_app_31_0) true)
+(expandtypeattribute (update_engine_31_0) true)
+(expandtypeattribute (update_engine_data_file_31_0) true)
+(expandtypeattribute (update_engine_exec_31_0) true)
+(expandtypeattribute (update_engine_log_data_file_31_0) true)
+(expandtypeattribute (update_engine_service_31_0) true)
+(expandtypeattribute (update_engine_stable_service_31_0) true)
+(expandtypeattribute (update_verifier_31_0) true)
+(expandtypeattribute (update_verifier_exec_31_0) true)
+(expandtypeattribute (updatelock_service_31_0) true)
+(expandtypeattribute (uri_grants_service_31_0) true)
+(expandtypeattribute (usagestats_service_31_0) true)
+(expandtypeattribute (usb_config_prop_31_0) true)
+(expandtypeattribute (usb_control_prop_31_0) true)
+(expandtypeattribute (usb_device_31_0) true)
+(expandtypeattribute (usb_prop_31_0) true)
+(expandtypeattribute (usb_serial_device_31_0) true)
+(expandtypeattribute (usb_service_31_0) true)
+(expandtypeattribute (usbaccessory_device_31_0) true)
+(expandtypeattribute (usbd_31_0) true)
+(expandtypeattribute (usbd_exec_31_0) true)
+(expandtypeattribute (usbfs_31_0) true)
+(expandtypeattribute (use_memfd_prop_31_0) true)
+(expandtypeattribute (user_profile_data_file_31_0) true)
+(expandtypeattribute (user_profile_root_file_31_0) true)
+(expandtypeattribute (user_service_31_0) true)
+(expandtypeattribute (userdata_block_device_31_0) true)
+(expandtypeattribute (userdata_sysdev_31_0) true)
+(expandtypeattribute (usermodehelper_31_0) true)
+(expandtypeattribute (userspace_reboot_config_prop_31_0) true)
+(expandtypeattribute (userspace_reboot_exported_prop_31_0) true)
+(expandtypeattribute (userspace_reboot_metadata_file_31_0) true)
+(expandtypeattribute (uwb_service_31_0) true)
+(expandtypeattribute (vcn_management_service_31_0) true)
+(expandtypeattribute (vd_device_31_0) true)
+(expandtypeattribute (vdc_31_0) true)
+(expandtypeattribute (vdc_exec_31_0) true)
+(expandtypeattribute (vehicle_hal_prop_31_0) true)
+(expandtypeattribute (vendor_apex_file_31_0) true)
+(expandtypeattribute (vendor_app_file_31_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_31_0) true)
+(expandtypeattribute (vendor_configs_file_31_0) true)
+(expandtypeattribute (vendor_data_file_31_0) true)
+(expandtypeattribute (vendor_default_prop_31_0) true)
+(expandtypeattribute (vendor_file_31_0) true)
+(expandtypeattribute (vendor_framework_file_31_0) true)
+(expandtypeattribute (vendor_hal_file_31_0) true)
+(expandtypeattribute (vendor_idc_file_31_0) true)
+(expandtypeattribute (vendor_init_31_0) true)
+(expandtypeattribute (vendor_kernel_modules_31_0) true)
+(expandtypeattribute (vendor_keychars_file_31_0) true)
+(expandtypeattribute (vendor_keylayout_file_31_0) true)
+(expandtypeattribute (vendor_misc_writer_31_0) true)
+(expandtypeattribute (vendor_misc_writer_exec_31_0) true)
+(expandtypeattribute (vendor_modprobe_31_0) true)
+(expandtypeattribute (vendor_overlay_file_31_0) true)
+(expandtypeattribute (vendor_public_framework_file_31_0) true)
+(expandtypeattribute (vendor_public_lib_file_31_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_31_0) true)
+(expandtypeattribute (vendor_service_contexts_file_31_0) true)
+(expandtypeattribute (vendor_shell_31_0) true)
+(expandtypeattribute (vendor_shell_exec_31_0) true)
+(expandtypeattribute (vendor_socket_hook_prop_31_0) true)
+(expandtypeattribute (vendor_task_profiles_file_31_0) true)
+(expandtypeattribute (vendor_toolbox_exec_31_0) true)
+(expandtypeattribute (vfat_31_0) true)
+(expandtypeattribute (vibrator_manager_service_31_0) true)
+(expandtypeattribute (vibrator_service_31_0) true)
+(expandtypeattribute (video_device_31_0) true)
+(expandtypeattribute (virtual_ab_prop_31_0) true)
+(expandtypeattribute (virtual_touchpad_31_0) true)
+(expandtypeattribute (virtual_touchpad_exec_31_0) true)
+(expandtypeattribute (virtual_touchpad_service_31_0) true)
+(expandtypeattribute (virtualization_service_31_0) true)
+(expandtypeattribute (vndbinder_device_31_0) true)
+(expandtypeattribute (vndk_prop_31_0) true)
+(expandtypeattribute (vndk_sp_file_31_0) true)
+(expandtypeattribute (vndservice_contexts_file_31_0) true)
+(expandtypeattribute (vndservicemanager_31_0) true)
+(expandtypeattribute (voiceinteraction_service_31_0) true)
+(expandtypeattribute (vold_31_0) true)
+(expandtypeattribute (vold_config_prop_31_0) true)
+(expandtypeattribute (vold_data_file_31_0) true)
+(expandtypeattribute (vold_device_31_0) true)
+(expandtypeattribute (vold_exec_31_0) true)
+(expandtypeattribute (vold_metadata_file_31_0) true)
+(expandtypeattribute (vold_post_fs_data_prop_31_0) true)
+(expandtypeattribute (vold_prepare_subdirs_31_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_31_0) true)
+(expandtypeattribute (vold_prop_31_0) true)
+(expandtypeattribute (vold_service_31_0) true)
+(expandtypeattribute (vold_status_prop_31_0) true)
+(expandtypeattribute (vpn_data_file_31_0) true)
+(expandtypeattribute (vpn_management_service_31_0) true)
+(expandtypeattribute (vr_hwc_31_0) true)
+(expandtypeattribute (vr_hwc_exec_31_0) true)
+(expandtypeattribute (vr_hwc_service_31_0) true)
+(expandtypeattribute (vr_manager_service_31_0) true)
+(expandtypeattribute (vrflinger_vsync_service_31_0) true)
+(expandtypeattribute (vts_config_prop_31_0) true)
+(expandtypeattribute (vts_status_prop_31_0) true)
+(expandtypeattribute (wallpaper_file_31_0) true)
+(expandtypeattribute (wallpaper_service_31_0) true)
+(expandtypeattribute (watchdog_device_31_0) true)
+(expandtypeattribute (watchdog_metadata_file_31_0) true)
+(expandtypeattribute (watchdogd_31_0) true)
+(expandtypeattribute (watchdogd_exec_31_0) true)
+(expandtypeattribute (webview_zygote_31_0) true)
+(expandtypeattribute (webview_zygote_exec_31_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_31_0) true)
+(expandtypeattribute (webviewupdate_service_31_0) true)
+(expandtypeattribute (wifi_config_prop_31_0) true)
+(expandtypeattribute (wifi_data_file_31_0) true)
+(expandtypeattribute (wifi_hal_prop_31_0) true)
+(expandtypeattribute (wifi_key_31_0) true)
+(expandtypeattribute (wifi_log_prop_31_0) true)
+(expandtypeattribute (wifi_prop_31_0) true)
+(expandtypeattribute (wifi_service_31_0) true)
+(expandtypeattribute (wifiaware_service_31_0) true)
+(expandtypeattribute (wificond_31_0) true)
+(expandtypeattribute (wificond_exec_31_0) true)
+(expandtypeattribute (wifinl80211_service_31_0) true)
+(expandtypeattribute (wifip2p_service_31_0) true)
+(expandtypeattribute (wifiscanner_service_31_0) true)
+(expandtypeattribute (window_service_31_0) true)
+(expandtypeattribute (wpa_socket_31_0) true)
+(expandtypeattribute (wpantund_31_0) true)
+(expandtypeattribute (wpantund_exec_31_0) true)
+(expandtypeattribute (wpantund_service_31_0) true)
+(expandtypeattribute (zero_device_31_0) true)
+(expandtypeattribute (zoneinfo_data_file_31_0) true)
+(expandtypeattribute (zram_config_prop_31_0) true)
+(expandtypeattribute (zram_control_prop_31_0) true)
+(expandtypeattribute (zygote_31_0) true)
+(expandtypeattribute (zygote_config_prop_31_0) true)
+(expandtypeattribute (zygote_exec_31_0) true)
+(expandtypeattribute (zygote_socket_31_0) true)
+(expandtypeattribute (zygote_tmpfs_31_0) true)
+(typeattributeset DockObserver_service_31_0 (DockObserver_service))
+(typeattributeset IProxyService_service_31_0 (IProxyService_service))
+(typeattributeset aac_drc_prop_31_0 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_31_0 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_31_0 (ab_update_gki_prop))
+(typeattributeset accessibility_service_31_0 (accessibility_service))
+(typeattributeset account_service_31_0 (account_service))
+(typeattributeset activity_service_31_0 (activity_service))
+(typeattributeset activity_task_service_31_0 (activity_task_service))
+(typeattributeset adb_data_file_31_0 (adb_data_file))
+(typeattributeset adb_keys_file_31_0 (adb_keys_file))
+(typeattributeset adb_service_31_0 (adb_service))
+(typeattributeset adbd_31_0 (adbd))
+(typeattributeset adbd_config_prop_31_0 (adbd_config_prop))
+(typeattributeset adbd_exec_31_0 (adbd_exec))
+(typeattributeset adbd_socket_31_0 (adbd_socket))
+(typeattributeset aidl_lazy_test_server_31_0 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_31_0 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_31_0 (aidl_lazy_test_service))
+(typeattributeset alarm_service_31_0 (alarm_service))
+(typeattributeset anr_data_file_31_0 (anr_data_file))
+(typeattributeset apc_service_31_0 (apc_service))
+(typeattributeset apex_appsearch_data_file_31_0 (apex_appsearch_data_file apex_system_server_data_file))
+(typeattributeset apex_data_file_31_0 (apex_data_file))
+(typeattributeset apex_info_file_31_0 (apex_info_file))
+(typeattributeset apex_metadata_file_31_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_31_0 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_31_0 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_31_0 (apex_ota_reserved_file))
+(typeattributeset apex_permission_data_file_31_0 (apex_permission_data_file apex_system_server_data_file))
+(typeattributeset apex_rollback_data_file_31_0 (apex_rollback_data_file))
+(typeattributeset apex_scheduling_data_file_31_0 (apex_scheduling_data_file apex_system_server_data_file))
+(typeattributeset apex_service_31_0 (apex_service))
+(typeattributeset apex_wifi_data_file_31_0 (apex_wifi_data_file apex_system_server_data_file))
+(typeattributeset apexd_31_0 (apexd))
+(typeattributeset apexd_config_prop_31_0 (apexd_config_prop))
+(typeattributeset apexd_exec_31_0 (apexd_exec))
+(typeattributeset apexd_prop_31_0 (apexd_prop))
+(typeattributeset apk_data_file_31_0 (apk_data_file))
+(typeattributeset apk_private_data_file_31_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_31_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_31_0 (apk_tmp_file))
+(typeattributeset apk_verity_prop_31_0 (apk_verity_prop))
+(typeattributeset app_binding_service_31_0 (app_binding_service))
+(typeattributeset app_data_file_31_0 (app_data_file))
+(typeattributeset app_fuse_file_31_0 (app_fuse_file))
+(typeattributeset app_fusefs_31_0 (app_fusefs))
+(typeattributeset app_hibernation_service_31_0 (app_hibernation_service))
+(typeattributeset app_integrity_service_31_0 (app_integrity_service))
+(typeattributeset app_prediction_service_31_0 (app_prediction_service))
+(typeattributeset app_search_service_31_0 (app_search_service))
+(typeattributeset app_zygote_31_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_31_0 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_31_0 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_31_0 (appdomain_tmpfs))
+(typeattributeset appops_service_31_0 (appops_service))
+(typeattributeset appwidget_service_31_0 (appwidget_service))
+(typeattributeset arm64_memtag_prop_31_0 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_31_0 (art_apex_dir))
+(typeattributeset asec_apk_file_31_0 (asec_apk_file))
+(typeattributeset asec_image_file_31_0 (asec_image_file))
+(typeattributeset asec_public_file_31_0 (asec_public_file))
+(typeattributeset ashmem_device_31_0 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_31_0 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_31_0 (assetatlas_service))
+(typeattributeset atrace_31_0 (atrace))
+(typeattributeset audio_config_prop_31_0 (audio_config_prop))
+(typeattributeset audio_data_file_31_0 (audio_data_file))
+(typeattributeset audio_device_31_0 (audio_device))
+(typeattributeset audio_prop_31_0 (audio_prop))
+(typeattributeset audio_service_31_0 (audio_service))
+(typeattributeset audiohal_data_file_31_0 (audiohal_data_file))
+(typeattributeset audioserver_31_0 (audioserver))
+(typeattributeset audioserver_data_file_31_0 (audioserver_data_file))
+(typeattributeset audioserver_service_31_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_31_0 (audioserver_tmpfs))
+(typeattributeset auth_service_31_0 (auth_service))
+(typeattributeset authorization_service_31_0 (authorization_service))
+(typeattributeset autofill_service_31_0 (autofill_service))
+(typeattributeset backup_data_file_31_0 (backup_data_file))
+(typeattributeset backup_service_31_0 (backup_service))
+(typeattributeset battery_service_31_0 (battery_service))
+(typeattributeset batteryproperties_service_31_0 (batteryproperties_service))
+(typeattributeset batterystats_service_31_0 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_31_0 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_31_0 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_31_0 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_31_0 (binder_calls_stats_service))
+(typeattributeset binder_device_31_0 (binder_device))
+(typeattributeset binderfs_31_0 (binderfs))
+(typeattributeset binderfs_logs_31_0 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_31_0 (binderfs_logs_proc))
+(typeattributeset binfmt_miscfs_31_0 (binfmt_miscfs))
+(typeattributeset biometric_service_31_0 (biometric_service))
+(typeattributeset blkid_31_0 (blkid))
+(typeattributeset blkid_untrusted_31_0 (blkid_untrusted))
+(typeattributeset blob_store_service_31_0 (blob_store_service))
+(typeattributeset block_device_31_0 (block_device))
+(typeattributeset bluetooth_31_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_31_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_31_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_data_file_31_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_31_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_31_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_31_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_31_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_31_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_31_0 (bluetooth_socket))
+(typeattributeset boot_block_device_31_0 (boot_block_device))
+(typeattributeset boot_status_prop_31_0 (boot_status_prop))
+(typeattributeset bootanim_31_0 (bootanim))
+(typeattributeset bootanim_config_prop_31_0 (bootanim_config_prop))
+(typeattributeset bootanim_exec_31_0 (bootanim_exec))
+(typeattributeset bootanim_system_prop_31_0 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_31_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_31_0 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_31_0 (bootloader_prop))
+(typeattributeset bootstat_31_0 (bootstat))
+(typeattributeset bootstat_data_file_31_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_31_0 (bootstat_exec))
+(typeattributeset boottime_prop_31_0 (boottime_prop))
+(typeattributeset boottime_public_prop_31_0 (boottime_public_prop))
+(typeattributeset boottrace_data_file_31_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_31_0 (bpf_progs_loaded_prop))
+(typeattributeset bq_config_prop_31_0 (bq_config_prop))
+(typeattributeset broadcastradio_service_31_0 (broadcastradio_service))
+(typeattributeset bufferhubd_31_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_31_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_31_0 (bugreport_service))
+(typeattributeset build_bootimage_prop_31_0 (build_bootimage_prop))
+(typeattributeset build_config_prop_31_0 (build_config_prop))
+(typeattributeset build_odm_prop_31_0 (build_odm_prop))
+(typeattributeset build_prop_31_0 (build_prop))
+(typeattributeset build_vendor_prop_31_0 (build_vendor_prop))
+(typeattributeset cache_backup_file_31_0 (cache_backup_file))
+(typeattributeset cache_block_device_31_0 (cache_block_device))
+(typeattributeset cache_file_31_0 (cache_file))
+(typeattributeset cache_private_backup_file_31_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_31_0 (cache_recovery_file))
+(typeattributeset cacheinfo_service_31_0 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_31_0 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_31_0 (camera_calibration_prop))
+(typeattributeset camera_config_prop_31_0 (camera_config_prop))
+(typeattributeset camera_data_file_31_0 (camera_data_file))
+(typeattributeset camera_device_31_0 (camera_device))
+(typeattributeset cameraproxy_service_31_0 (cameraproxy_service))
+(typeattributeset cameraserver_31_0 (cameraserver))
+(typeattributeset cameraserver_exec_31_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_31_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_31_0 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_31_0 (camerax_extensions_prop))
+(typeattributeset cgroup_31_0 (cgroup))
+(typeattributeset cgroup_desc_api_file_31_0 (cgroup_desc_api_file))
+(typeattributeset cgroup_desc_file_31_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_31_0 (cgroup_rc_file))
+(typeattributeset cgroup_v2_31_0 (cgroup_v2))
+(typeattributeset charger_31_0 (charger))
+(typeattributeset charger_config_prop_31_0 (charger_config_prop))
+(typeattributeset charger_exec_31_0 (charger_exec))
+(typeattributeset charger_prop_31_0 (charger_prop))
+(typeattributeset charger_status_prop_31_0 (charger_status_prop))
+(typeattributeset clipboard_service_31_0 (clipboard_service))
+(typeattributeset codec2_config_prop_31_0 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_31_0 (cold_boot_done_prop))
+(typeattributeset color_display_service_31_0 (color_display_service))
+(typeattributeset companion_device_service_31_0 (companion_device_service))
+(typeattributeset config_prop_31_0 (config_prop))
+(typeattributeset configfs_31_0 (configfs))
+(typeattributeset connectivity_service_31_0 (connectivity_service))
+(typeattributeset connmetrics_service_31_0 (connmetrics_service))
+(typeattributeset console_device_31_0 (console_device))
+(typeattributeset consumer_ir_service_31_0 (consumer_ir_service))
+(typeattributeset content_capture_service_31_0 (content_capture_service))
+(typeattributeset content_service_31_0 (content_service))
+(typeattributeset content_suggestions_service_31_0 (content_suggestions_service))
+(typeattributeset contexthub_service_31_0 (contexthub_service))
+(typeattributeset coredump_file_31_0 (coredump_file))
+(typeattributeset country_detector_service_31_0 (country_detector_service))
+(typeattributeset coverage_service_31_0 (coverage_service))
+(typeattributeset cppreopt_prop_31_0 (cppreopt_prop))
+(typeattributeset cpu_variant_prop_31_0 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_31_0 (cpuinfo_service))
+(typeattributeset crash_dump_31_0 (crash_dump))
+(typeattributeset crash_dump_exec_31_0 (crash_dump_exec))
+(typeattributeset credstore_31_0 (credstore))
+(typeattributeset credstore_data_file_31_0 (credstore_data_file))
+(typeattributeset credstore_exec_31_0 (credstore_exec))
+(typeattributeset credstore_service_31_0 (credstore_service))
+(typeattributeset crossprofileapps_service_31_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_31_0 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_31_0 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_31_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_31_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_31_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_31_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_31_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_31_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_31_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_31_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_31_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_31_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_31_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_31_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_31_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_31_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_31_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_31_0 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_31_0 (dalvik_config_prop))
+(typeattributeset dalvik_prop_31_0 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_31_0 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_31_0 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_31_0 (dataloader_manager_service))
+(typeattributeset dbinfo_service_31_0 (dbinfo_service))
+(typeattributeset dck_prop_31_0 (dck_prop))
+(typeattributeset debug_prop_31_0 (debug_prop))
+(typeattributeset debugfs_31_0 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_31_0 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_31_0 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_31_0 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_31_0 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_31_0 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_31_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_31_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_31_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_31_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_31_0 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_31_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_31_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_31_0 (debuggerd_prop))
+(typeattributeset default_android_hwservice_31_0 (default_android_hwservice))
+(typeattributeset default_android_service_31_0 (default_android_service))
+(typeattributeset default_android_vndservice_31_0 (default_android_vndservice))
+(typeattributeset default_prop_31_0 (default_prop))
+(typeattributeset dev_cpu_variant_31_0 (dev_cpu_variant))
+(typeattributeset device_31_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_31_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_31_0 (device_config_boot_count_prop))
+(typeattributeset device_config_input_native_boot_prop_31_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_31_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_31_0 (device_config_netd_native_prop))
+(typeattributeset device_config_reset_performed_prop_31_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_31_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_31_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_31_0 (device_config_service))
+(typeattributeset device_identifiers_service_31_0 (device_identifiers_service))
+(typeattributeset device_logging_prop_31_0 (device_logging_prop))
+(typeattributeset device_policy_service_31_0 (device_policy_service))
+(typeattributeset device_state_service_31_0 (device_state_service))
+(typeattributeset deviceidle_service_31_0 (deviceidle_service))
+(typeattributeset devicestoragemonitor_service_31_0 (devicestoragemonitor_service))
+(typeattributeset devpts_31_0 (devpts))
+(typeattributeset dhcp_31_0 (dhcp))
+(typeattributeset dhcp_data_file_31_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_31_0 (dhcp_exec))
+(typeattributeset dhcp_prop_31_0 (dhcp_prop))
+(typeattributeset diskstats_service_31_0 (diskstats_service))
+(typeattributeset display_service_31_0 (display_service))
+(typeattributeset dm_device_31_0 (dm_device))
+(typeattributeset dm_user_device_31_0 (dm_user_device))
+(typeattributeset dmabuf_heap_device_31_0 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_31_0 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_31_0 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_31_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_31_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_31_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_31_0 (dnsresolver_service))
+(typeattributeset domain_verification_service_31_0 (domain_verification_service))
+(typeattributeset dreams_service_31_0 (dreams_service))
+(typeattributeset drm_data_file_31_0 (drm_data_file))
+(typeattributeset drm_service_config_prop_31_0 (drm_service_config_prop))
+(typeattributeset drmserver_31_0 (drmserver))
+(typeattributeset drmserver_exec_31_0 (drmserver_exec))
+(typeattributeset drmserver_service_31_0 (drmserver_service))
+(typeattributeset drmserver_socket_31_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_31_0 (dropbox_data_file))
+(typeattributeset dropbox_service_31_0 (dropbox_service))
+(typeattributeset dumpstate_31_0 (dumpstate))
+(typeattributeset dumpstate_exec_31_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_31_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_31_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_31_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_31_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_31_0 (dynamic_system_prop))
+(typeattributeset e2fs_31_0 (e2fs))
+(typeattributeset e2fs_exec_31_0 (e2fs_exec))
+(typeattributeset efs_file_31_0 (efs_file))
+(typeattributeset emergency_affordance_service_31_0 (emergency_affordance_service))
+(typeattributeset ephemeral_app_31_0 (ephemeral_app))
+(typeattributeset ethernet_service_31_0 (ethernet_service))
+(typeattributeset exfat_31_0 (exfat))
+(typeattributeset exported3_system_prop_31_0 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_31_0 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_31_0 (exported_camera_prop))
+(typeattributeset exported_config_prop_31_0 (exported_config_prop))
+(typeattributeset exported_default_prop_31_0 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_31_0 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_31_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_31_0 (exported_pm_prop))
+(typeattributeset exported_secure_prop_31_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_31_0 (exported_system_prop))
+(typeattributeset external_vibrator_service_31_0 (external_vibrator_service))
+(typeattributeset face_service_31_0 (face_service))
+(typeattributeset face_vendor_data_file_31_0 (face_vendor_data_file))
+(typeattributeset fastbootd_31_0 (fastbootd))
+(typeattributeset ffs_config_prop_31_0 (ffs_config_prop))
+(typeattributeset ffs_control_prop_31_0 (ffs_control_prop))
+(typeattributeset file_contexts_file_31_0 (file_contexts_file))
+(typeattributeset file_integrity_service_31_0 (file_integrity_service))
+(typeattributeset fingerprint_prop_31_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_31_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_31_0 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_31_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_31_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_31_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_31_0 (fingerprintd_service))
+(typeattributeset firstboot_prop_31_0 (firstboot_prop))
+(typeattributeset flags_health_check_31_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_31_0 (flags_health_check_exec))
+(typeattributeset font_service_31_0 (font_service))
+(typeattributeset framework_watchdog_config_prop_31_0 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_31_0 (frp_block_device))
+(typeattributeset fs_bpf_31_0 (fs_bpf))
+(typeattributeset fs_bpf_tethering_31_0 (fs_bpf_tethering))
+(typeattributeset fsck_31_0 (fsck))
+(typeattributeset fsck_exec_31_0 (fsck_exec))
+(typeattributeset fsck_untrusted_31_0 (fsck_untrusted))
+(typeattributeset fscklogs_31_0 (fscklogs))
+(typeattributeset functionfs_31_0 (functionfs))
+(typeattributeset fuse_31_0 (fuse))
+(typeattributeset fuse_device_31_0 (fuse_device))
+(typeattributeset fusectlfs_31_0 (fusectlfs))
+(typeattributeset fwk_automotive_display_hwservice_31_0 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_bufferhub_hwservice_31_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_31_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_31_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_31_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_31_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_31_0 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_31_0 (fwk_stats_service))
+(typeattributeset fwmarkd_socket_31_0 (fwmarkd_socket))
+(typeattributeset game_service_31_0 (game_service))
+(typeattributeset gatekeeper_data_file_31_0 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_31_0 (gatekeeper_service))
+(typeattributeset gatekeeperd_31_0 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_31_0 (gatekeeperd_exec))
+(typeattributeset gfxinfo_service_31_0 (gfxinfo_service))
+(typeattributeset gmscore_app_31_0 (gmscore_app))
+(typeattributeset gnss_device_31_0 (gnss_device))
+(typeattributeset gnss_time_update_service_31_0 (gnss_time_update_service))
+(typeattributeset gps_control_31_0 (gps_control))
+(typeattributeset gpu_device_31_0 (gpu_device))
+(typeattributeset gpu_service_31_0 (gpu_service))
+(typeattributeset gpuservice_31_0 (gpuservice))
+(typeattributeset graphics_config_prop_31_0 (graphics_config_prop))
+(typeattributeset graphics_device_31_0 (graphics_device))
+(typeattributeset graphicsstats_service_31_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_31_0 (gsi_data_file))
+(typeattributeset gsi_metadata_file_31_0 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_31_0 (gsi_public_metadata_file))
+(typeattributeset hal_atrace_hwservice_31_0 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_31_0 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_31_0 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_31_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_31_0 (hal_audiocontrol_service))
+(typeattributeset hal_authsecret_hwservice_31_0 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_31_0 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_31_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_31_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_31_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_31_0 (hal_camera_hwservice))
+(typeattributeset hal_can_bus_hwservice_31_0 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_31_0 (hal_can_controller_hwservice))
+(typeattributeset hal_cas_hwservice_31_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_31_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_31_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_31_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_31_0 (hal_contexthub_hwservice))
+(typeattributeset hal_drm_hwservice_31_0 (hal_drm_hwservice))
+(typeattributeset hal_dumpstate_config_prop_31_0 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_31_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_evs_hwservice_31_0 (hal_evs_hwservice))
+(typeattributeset hal_face_hwservice_31_0 (hal_face_hwservice))
+(typeattributeset hal_face_service_31_0 (hal_face_service))
+(typeattributeset hal_fingerprint_hwservice_31_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_31_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_31_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_31_0 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_31_0 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_31_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_composer_hwservice_31_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_31_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_mapper_hwservice_31_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_31_0 (hal_health_hwservice))
+(typeattributeset hal_health_storage_hwservice_31_0 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_31_0 (hal_health_storage_service))
+(typeattributeset hal_identity_service_31_0 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_31_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_instrumentation_prop_31_0 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_31_0 (hal_ir_hwservice))
+(typeattributeset hal_keymaster_hwservice_31_0 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_31_0 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_31_0 (hal_light_hwservice))
+(typeattributeset hal_light_service_31_0 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_31_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_31_0 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_31_0 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_31_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_31_0 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_31_0 (hal_nfc_hwservice))
+(typeattributeset hal_oemlock_hwservice_31_0 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_31_0 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_31_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_31_0 (hal_power_hwservice))
+(typeattributeset hal_power_service_31_0 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_31_0 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_31_0 (hal_power_stats_service))
+(typeattributeset hal_rebootescrow_service_31_0 (hal_rebootescrow_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_31_0 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_31_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_31_0 (hal_secure_element_hwservice))
+(typeattributeset hal_secureclock_service_31_0 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_31_0 (hal_sensors_hwservice))
+(typeattributeset hal_sharedsecret_service_31_0 (hal_sharedsecret_service))
+(typeattributeset hal_telephony_hwservice_31_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_31_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_31_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_31_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_31_0 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_tuner_hwservice_31_0 (hal_tv_tuner_hwservice))
+(typeattributeset hal_usb_gadget_hwservice_31_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_31_0 (hal_usb_hwservice))
+(typeattributeset hal_vehicle_hwservice_31_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vibrator_hwservice_31_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_31_0 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_31_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_31_0 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_31_0 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_31_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hwservice_31_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_31_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hardware_properties_service_31_0 (hardware_properties_service))
+(typeattributeset hardware_service_31_0 (hardware_service))
+(typeattributeset hci_attach_dev_31_0 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_31_0 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_31_0 (hdmi_control_service))
+(typeattributeset healthd_31_0 (healthd))
+(typeattributeset healthd_exec_31_0 (healthd_exec))
+(typeattributeset heapdump_data_file_31_0 (heapdump_data_file))
+(typeattributeset heapprofd_31_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_31_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_31_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_31_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_31_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_31_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_31_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_31_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_31_0 (hidl_token_hwservice))
+(typeattributeset hint_service_31_0 (hint_service))
+(typeattributeset hw_random_device_31_0 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_31_0 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_31_0 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_31_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_31_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_31_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_31_0 (hwservicemanager_prop))
+(typeattributeset icon_file_31_0 (icon_file))
+(typeattributeset idmap_31_0 (idmap))
+(typeattributeset idmap_exec_31_0 (idmap_exec))
+(typeattributeset idmap_service_31_0 (idmap_service))
+(typeattributeset iio_device_31_0 (iio_device))
+(typeattributeset imms_service_31_0 (imms_service))
+(typeattributeset incident_31_0 (incident))
+(typeattributeset incident_data_file_31_0 (incident_data_file))
+(typeattributeset incident_helper_31_0 (incident_helper))
+(typeattributeset incident_service_31_0 (incident_service))
+(typeattributeset incidentd_31_0 (incidentd))
+(typeattributeset incremental_control_file_31_0 (incremental_control_file))
+(typeattributeset incremental_prop_31_0 (incremental_prop))
+(typeattributeset incremental_service_31_0 (incremental_service))
+(typeattributeset init_31_0 (init))
+(typeattributeset init_exec_31_0 (init_exec))
+(typeattributeset init_service_status_prop_31_0 (init_service_status_prop))
+(typeattributeset init_tmpfs_31_0 (init_tmpfs))
+(typeattributeset inotify_31_0 (inotify))
+(typeattributeset input_device_31_0 (input_device))
+(typeattributeset input_method_service_31_0 (input_method_service))
+(typeattributeset input_service_31_0 (input_service))
+(typeattributeset inputflinger_31_0 (inputflinger))
+(typeattributeset inputflinger_exec_31_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_31_0 (inputflinger_service))
+(typeattributeset install_data_file_31_0 (install_data_file))
+(typeattributeset installd_31_0 (installd))
+(typeattributeset installd_exec_31_0 (installd_exec))
+(typeattributeset installd_service_31_0 (installd_service))
+(typeattributeset ion_device_31_0 (ion_device))
+(typeattributeset iorap_inode2filename_31_0 (iorap_inode2filename))
+(typeattributeset iorap_inode2filename_exec_31_0 (iorap_inode2filename_exec))
+(typeattributeset iorap_inode2filename_tmpfs_31_0 (iorap_inode2filename_tmpfs))
+(typeattributeset iorap_prefetcherd_31_0 (iorap_prefetcherd))
+(typeattributeset iorap_prefetcherd_exec_31_0 (iorap_prefetcherd_exec))
+(typeattributeset iorap_prefetcherd_tmpfs_31_0 (iorap_prefetcherd_tmpfs))
+(typeattributeset iorapd_31_0 (iorapd))
+(typeattributeset iorapd_data_file_31_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_31_0 (iorapd_exec))
+(typeattributeset iorapd_service_31_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_31_0 (iorapd_tmpfs))
+(typeattributeset ipsec_service_31_0 (ipsec_service))
+(typeattributeset iris_service_31_0 (iris_service))
+(typeattributeset iris_vendor_data_file_31_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_31_0 (isolated_app))
+(typeattributeset jobscheduler_service_31_0 (jobscheduler_service))
+(typeattributeset kernel_31_0 (kernel))
+(typeattributeset keychain_data_file_31_0 (keychain_data_file))
+(typeattributeset keychord_device_31_0 (keychord_device))
+(typeattributeset keyguard_config_prop_31_0 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_31_0 (keystore2_key_contexts_file))
+(typeattributeset keystore_31_0 (keystore))
+(typeattributeset keystore_compat_hal_service_31_0 (keystore_compat_hal_service))
+(typeattributeset keystore_data_file_31_0 (keystore_data_file))
+(typeattributeset keystore_exec_31_0 (keystore_exec))
+(typeattributeset keystore_maintenance_service_31_0 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_31_0 (keystore_metrics_service))
+(typeattributeset keystore_service_31_0 (keystore_service))
+(typeattributeset kmsg_debug_device_31_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_31_0 (kmsg_device))
+(typeattributeset labeledfs_31_0 (labeledfs))
+(typeattributeset launcherapps_service_31_0 (launcherapps_service))
+(typeattributeset legacy_permission_service_31_0 (legacy_permission_service))
+(typeattributeset legacykeystore_service_31_0 (legacykeystore_service))
+(typeattributeset libc_debug_prop_31_0 (libc_debug_prop))
+(typeattributeset light_service_31_0 (light_service))
+(typeattributeset linkerconfig_file_31_0 (linkerconfig_file))
+(typeattributeset llkd_31_0 (llkd))
+(typeattributeset llkd_exec_31_0 (llkd_exec))
+(typeattributeset llkd_prop_31_0 (llkd_prop))
+(typeattributeset lmkd_31_0 (lmkd))
+(typeattributeset lmkd_config_prop_31_0 (lmkd_config_prop))
+(typeattributeset lmkd_exec_31_0 (lmkd_exec))
+(typeattributeset lmkd_prop_31_0 (lmkd_prop))
+(typeattributeset lmkd_socket_31_0 (lmkd_socket))
+(typeattributeset location_service_31_0 (location_service))
+(typeattributeset location_time_zone_manager_service_31_0 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_31_0 (lock_settings_service))
+(typeattributeset log_prop_31_0 (log_prop))
+(typeattributeset log_tag_prop_31_0 (log_tag_prop))
+(typeattributeset logcat_exec_31_0 (logcat_exec))
+(typeattributeset logd_31_0 (logd))
+(typeattributeset logd_exec_31_0 (logd_exec))
+(typeattributeset logd_prop_31_0 (logd_prop))
+(typeattributeset logd_socket_31_0 (logd_socket))
+(typeattributeset logdr_socket_31_0 (logdr_socket))
+(typeattributeset logdw_socket_31_0 (logdw_socket))
+(typeattributeset logpersist_31_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_31_0 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_31_0 (loop_control_device))
+(typeattributeset loop_device_31_0 (loop_device))
+(typeattributeset looper_stats_service_31_0 (looper_stats_service))
+(typeattributeset lowpan_device_31_0 (lowpan_device))
+(typeattributeset lowpan_prop_31_0 (lowpan_prop))
+(typeattributeset lowpan_service_31_0 (lowpan_service))
+(typeattributeset lpdump_service_31_0 (lpdump_service))
+(typeattributeset lpdumpd_prop_31_0 (lpdumpd_prop))
+(typeattributeset mac_perms_file_31_0 (mac_perms_file))
+(typeattributeset mdns_socket_31_0 (mdns_socket))
+(typeattributeset mdnsd_31_0 (mdnsd))
+(typeattributeset mdnsd_socket_31_0 (mdnsd_socket))
+(typeattributeset media_communication_service_31_0 (media_communication_service))
+(typeattributeset media_config_prop_31_0 (media_config_prop))
+(typeattributeset media_data_file_31_0 (media_data_file))
+(typeattributeset media_metrics_service_31_0 (media_metrics_service))
+(typeattributeset media_projection_service_31_0 (media_projection_service))
+(typeattributeset media_router_service_31_0 (media_router_service))
+(typeattributeset media_rw_data_file_31_0 (media_rw_data_file))
+(typeattributeset media_session_service_31_0 (media_session_service))
+(typeattributeset media_variant_prop_31_0 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_31_0 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_31_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_31_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_31_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_31_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_31_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_31_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_31_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_31_0 (mediametrics))
+(typeattributeset mediametrics_exec_31_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_31_0 (mediametrics_service))
+(typeattributeset mediaprovider_31_0 (mediaprovider))
+(typeattributeset mediaserver_31_0 (mediaserver))
+(typeattributeset mediaserver_exec_31_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_31_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_31_0 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_31_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_31_0 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_service_31_0 (mediatranscoding_service))
+(typeattributeset meminfo_service_31_0 (meminfo_service))
+(typeattributeset memtrackproxy_service_31_0 (memtrackproxy_service))
+(typeattributeset metadata_block_device_31_0 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_31_0 (metadata_bootstat_file))
+(typeattributeset metadata_file_31_0 (metadata_file))
+(typeattributeset method_trace_data_file_31_0 (method_trace_data_file))
+(typeattributeset midi_service_31_0 (midi_service))
+(typeattributeset mirror_data_file_31_0 (mirror_data_file))
+(typeattributeset misc_block_device_31_0 (misc_block_device))
+(typeattributeset misc_logd_file_31_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_31_0 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_31_0 (mm_events_config_prop))
+(typeattributeset mmc_prop_31_0 (mmc_prop))
+(typeattributeset mnt_expand_file_31_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_31_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_31_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_31_0 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_31_0 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_31_0 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_31_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_31_0 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_31_0 (mock_ota_prop))
+(typeattributeset modprobe_31_0 (modprobe))
+(typeattributeset module_sdkextensions_prop_31_0 (module_sdkextensions_prop))
+(typeattributeset mount_service_31_0 (mount_service))
+(typeattributeset mqueue_31_0 (mqueue))
+(typeattributeset mtp_31_0 (mtp))
+(typeattributeset mtp_device_31_0 (mtp_device))
+(typeattributeset mtp_exec_31_0 (mtp_exec))
+(typeattributeset mtpd_socket_31_0 (mtpd_socket))
+(typeattributeset music_recognition_service_31_0 (music_recognition_service))
+(typeattributeset nativetest_data_file_31_0 (nativetest_data_file))
+(typeattributeset net_data_file_31_0 (net_data_file))
+(typeattributeset net_dns_prop_31_0 (net_dns_prop))
+(typeattributeset net_radio_prop_31_0 (net_radio_prop))
+(typeattributeset netd_31_0 (netd))
+(typeattributeset netd_exec_31_0 (netd_exec))
+(typeattributeset netd_listener_service_31_0 (netd_listener_service))
+(typeattributeset netd_service_31_0 (netd_service))
+(typeattributeset netif_31_0 (netif))
+(typeattributeset netpolicy_service_31_0 (netpolicy_service))
+(typeattributeset netstats_service_31_0 (netstats_service))
+(typeattributeset netutils_wrapper_31_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_31_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_31_0 (network_management_service))
+(typeattributeset network_score_service_31_0 (network_score_service))
+(typeattributeset network_stack_31_0 (network_stack))
+(typeattributeset network_stack_service_31_0 (network_stack_service))
+(typeattributeset network_time_update_service_31_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_31_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_31_0 (network_watchlist_service))
+(typeattributeset nfc_31_0 (nfc))
+(typeattributeset nfc_data_file_31_0 (nfc_data_file))
+(typeattributeset nfc_device_31_0 (nfc_device))
+(typeattributeset nfc_logs_data_file_31_0 (nfc_logs_data_file))
+(typeattributeset nfc_prop_31_0 (nfc_prop))
+(typeattributeset nfc_service_31_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_31_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_31_0 (node))
+(typeattributeset nonplat_service_contexts_file_31_0 (nonplat_service_contexts_file))
+(typeattributeset notification_service_31_0 (notification_service))
+(typeattributeset null_device_31_0 (null_device))
+(typeattributeset oem_lock_service_31_0 (oem_lock_service))
+(typeattributeset oem_unlock_prop_31_0 (oem_unlock_prop))
+(typeattributeset oemfs_31_0 (oemfs))
+(typeattributeset ota_data_file_31_0 (ota_data_file))
+(typeattributeset ota_metadata_file_31_0 (ota_metadata_file))
+(typeattributeset ota_package_file_31_0 (ota_package_file))
+(typeattributeset ota_prop_31_0 (ota_prop))
+(typeattributeset otadexopt_service_31_0 (otadexopt_service))
+(typeattributeset otapreopt_chroot_31_0 (otapreopt_chroot))
+(typeattributeset overlay_prop_31_0 (overlay_prop))
+(typeattributeset overlay_service_31_0 (overlay_service))
+(typeattributeset overlayfs_file_31_0 (overlayfs_file))
+(typeattributeset owntty_device_31_0 (owntty_device))
+(typeattributeset pac_proxy_service_31_0 (pac_proxy_service))
+(typeattributeset package_native_service_31_0 (package_native_service))
+(typeattributeset package_service_31_0 (package_service))
+(typeattributeset packagemanager_config_prop_31_0 (packagemanager_config_prop))
+(typeattributeset packages_list_file_31_0 (packages_list_file))
+(typeattributeset pan_result_prop_31_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_31_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_31_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_31_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_31_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_31_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_31_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_31_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_31_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_31_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_31_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_31_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_31_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_31_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_31_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_31_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_31_0 (pdx_performance_dir))
+(typeattributeset people_service_31_0 (people_service))
+(typeattributeset perfetto_31_0 (perfetto))
+(typeattributeset performanced_31_0 (performanced))
+(typeattributeset performanced_exec_31_0 (performanced_exec))
+(typeattributeset permission_checker_service_31_0 (permission_checker_service))
+(typeattributeset permission_service_31_0 (permission_service))
+(typeattributeset permissionmgr_service_31_0 (permissionmgr_service))
+(typeattributeset persist_debug_prop_31_0 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_31_0 (persist_vendor_debug_wifi_prop))
+(typeattributeset persistent_data_block_service_31_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_31_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_31_0 (pinner_service))
+(typeattributeset pipefs_31_0 (pipefs))
+(typeattributeset platform_app_31_0 (platform_app))
+(typeattributeset platform_compat_service_31_0 (platform_compat_service))
+(typeattributeset pmsg_device_31_0 (pmsg_device))
+(typeattributeset port_31_0 (port))
+(typeattributeset port_device_31_0 (port_device))
+(typeattributeset postinstall_31_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_31_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_31_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_31_0 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_31_0 (power_debug_prop))
+(typeattributeset power_service_31_0 (power_service))
+(typeattributeset powerctl_prop_31_0 (powerctl_prop))
+(typeattributeset powerstats_service_31_0 (powerstats_service))
+(typeattributeset ppp_31_0 (ppp))
+(typeattributeset ppp_device_31_0 (ppp_device))
+(typeattributeset ppp_exec_31_0 (ppp_exec))
+(typeattributeset preloads_data_file_31_0 (preloads_data_file))
+(typeattributeset preloads_media_file_31_0 (preloads_media_file))
+(typeattributeset prereboot_data_file_31_0 (prereboot_data_file))
+(typeattributeset print_service_31_0 (print_service))
+(typeattributeset priv_app_31_0 (priv_app))
+(typeattributeset privapp_data_file_31_0 (privapp_data_file))
+(typeattributeset proc_31_0
+ ( proc
+ proc_bpf
+ proc_cpu_alignment
+ proc_watermark_scale_factor
+))
+(typeattributeset proc_abi_31_0 (proc_abi))
+(typeattributeset proc_asound_31_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_31_0 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_31_0 (proc_bootconfig))
+(typeattributeset proc_buddyinfo_31_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_31_0 (proc_cmdline))
+(typeattributeset proc_cpuinfo_31_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_31_0 (proc_dirty))
+(typeattributeset proc_diskstats_31_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_31_0 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_31_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_31_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_31_0 (proc_fs_verity))
+(typeattributeset proc_hostname_31_0 (proc_hostname))
+(typeattributeset proc_hung_task_31_0 (proc_hung_task))
+(typeattributeset proc_interrupts_31_0 (proc_interrupts))
+(typeattributeset proc_iomem_31_0 (proc_iomem))
+(typeattributeset proc_kallsyms_31_0 (proc_kallsyms))
+(typeattributeset proc_keys_31_0 (proc_keys))
+(typeattributeset proc_kmsg_31_0 (proc_kmsg))
+(typeattributeset proc_kpageflags_31_0 (proc_kpageflags))
+(typeattributeset proc_loadavg_31_0 (proc_loadavg))
+(typeattributeset proc_locks_31_0 (proc_locks))
+(typeattributeset proc_lowmemorykiller_31_0 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_31_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_31_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_31_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_31_0 (proc_misc))
+(typeattributeset proc_modules_31_0 (proc_modules))
+(typeattributeset proc_mounts_31_0 (proc_mounts))
+(typeattributeset proc_net_31_0
+ ( proc_bpf
+ proc_net
+))
+(typeattributeset proc_net_tcp_udp_31_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_31_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_31_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_31_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_31_0 (proc_panic))
+(typeattributeset proc_perf_31_0 (proc_perf))
+(typeattributeset proc_pid_max_31_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_31_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_31_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_31_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_31_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_31_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_31_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_31_0 (proc_random))
+(typeattributeset proc_sched_31_0 (proc_sched))
+(typeattributeset proc_security_31_0 (proc_security))
+(typeattributeset proc_slabinfo_31_0 (proc_slabinfo))
+(typeattributeset proc_stat_31_0 (proc_stat))
+(typeattributeset proc_swaps_31_0 (proc_swaps))
+(typeattributeset proc_sysrq_31_0 (proc_sysrq))
+(typeattributeset proc_timer_31_0 (proc_timer))
+(typeattributeset proc_tty_drivers_31_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_31_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_31_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_31_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_31_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_31_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_31_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_31_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_31_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_31_0 (proc_uptime))
+(typeattributeset proc_vendor_sched_31_0 (proc_vendor_sched))
+(typeattributeset proc_version_31_0 (proc_version))
+(typeattributeset proc_vmallocinfo_31_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_31_0 (proc_vmstat))
+(typeattributeset proc_zoneinfo_31_0 (proc_zoneinfo))
+(typeattributeset processinfo_service_31_0 (processinfo_service))
+(typeattributeset procstats_service_31_0 (procstats_service))
+(typeattributeset profman_31_0 (profman))
+(typeattributeset profman_dump_data_file_31_0 (profman_dump_data_file))
+(typeattributeset profman_exec_31_0 (profman_exec))
+(typeattributeset properties_device_31_0 (properties_device))
+(typeattributeset properties_serial_31_0 (properties_serial))
+(typeattributeset property_contexts_file_31_0 (property_contexts_file))
+(typeattributeset property_data_file_31_0 (property_data_file))
+(typeattributeset property_info_31_0 (property_info))
+(typeattributeset property_service_version_prop_31_0 (property_service_version_prop))
+(typeattributeset property_socket_31_0 (property_socket))
+(typeattributeset provisioned_prop_31_0 (provisioned_prop))
+(typeattributeset pstorefs_31_0 (pstorefs))
+(typeattributeset ptmx_device_31_0 (ptmx_device))
+(typeattributeset qemu_hw_prop_31_0 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_31_0 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_31_0 (qtaguid_device))
+(typeattributeset racoon_31_0 (racoon))
+(typeattributeset racoon_exec_31_0 (racoon_exec))
+(typeattributeset racoon_socket_31_0 (racoon_socket))
+(typeattributeset radio_31_0 (radio))
+(typeattributeset radio_control_prop_31_0 (radio_control_prop))
+(typeattributeset radio_core_data_file_31_0 (radio_core_data_file))
+(typeattributeset radio_data_file_31_0 (radio_data_file))
+(typeattributeset radio_device_31_0 (radio_device))
+(typeattributeset radio_prop_31_0 (radio_prop))
+(typeattributeset radio_service_31_0 (radio_service))
+(typeattributeset ram_device_31_0 (ram_device))
+(typeattributeset random_device_31_0 (random_device))
+(typeattributeset reboot_readiness_service_31_0 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_31_0 (rebootescrow_hal_prop))
+(typeattributeset recovery_31_0 (recovery))
+(typeattributeset recovery_block_device_31_0 (recovery_block_device))
+(typeattributeset recovery_config_prop_31_0 (recovery_config_prop))
+(typeattributeset recovery_data_file_31_0 (recovery_data_file))
+(typeattributeset recovery_persist_31_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_31_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_31_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_31_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_31_0 (recovery_service))
+(typeattributeset recovery_socket_31_0 (recovery_socket))
+(typeattributeset registry_service_31_0 (registry_service))
+(typeattributeset remoteprovisioning_service_31_0 (remoteprovisioning_service))
+(typeattributeset resourcecache_data_file_31_0 (resourcecache_data_file))
+(typeattributeset restorecon_prop_31_0 (restorecon_prop))
+(typeattributeset restrictions_service_31_0 (restrictions_service))
+(typeattributeset retaildemo_prop_31_0 (retaildemo_prop))
+(typeattributeset rild_debug_socket_31_0 (rild_debug_socket))
+(typeattributeset rild_socket_31_0 (rild_socket))
+(typeattributeset ringtone_file_31_0 (ringtone_file))
+(typeattributeset role_service_31_0 (role_service))
+(typeattributeset rollback_service_31_0 (rollback_service))
+(typeattributeset root_block_device_31_0 (root_block_device))
+(typeattributeset rootfs_31_0 (rootfs))
+(typeattributeset rpmsg_device_31_0 (rpmsg_device))
+(typeattributeset rs_31_0 (rs))
+(typeattributeset rs_exec_31_0 (rs_exec))
+(typeattributeset rss_hwm_reset_31_0 (rss_hwm_reset))
+(typeattributeset rtc_device_31_0 (rtc_device))
+(typeattributeset rttmanager_service_31_0 (rttmanager_service))
+(typeattributeset runas_31_0 (runas))
+(typeattributeset runas_app_31_0 (runas_app))
+(typeattributeset runas_exec_31_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_31_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_31_0 (runtime_service))
+(typeattributeset safemode_prop_31_0 (safemode_prop))
+(typeattributeset same_process_hal_file_31_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_31_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_31_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_31_0 (sdcard_block_device))
+(typeattributeset sdcardd_31_0 (sdcardd))
+(typeattributeset sdcardd_exec_31_0 (sdcardd_exec))
+(typeattributeset sdcardfs_31_0 (sdcardfs))
+(typeattributeset seapp_contexts_file_31_0 (seapp_contexts_file))
+(typeattributeset search_service_31_0 (search_service))
+(typeattributeset search_ui_service_31_0 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_31_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_31_0 (secure_element))
+(typeattributeset secure_element_device_31_0 (secure_element_device))
+(typeattributeset secure_element_service_31_0 (secure_element_service))
+(typeattributeset securityfs_31_0 (securityfs))
+(typeattributeset selinuxfs_31_0 (selinuxfs))
+(typeattributeset sendbug_config_prop_31_0 (sendbug_config_prop))
+(typeattributeset sensor_privacy_service_31_0 (sensor_privacy_service))
+(typeattributeset sensors_device_31_0 (sensors_device))
+(typeattributeset sensorservice_service_31_0 (sensorservice_service))
+(typeattributeset sepolicy_file_31_0 (sepolicy_file))
+(typeattributeset serial_device_31_0 (serial_device))
+(typeattributeset serial_service_31_0 (serial_service))
+(typeattributeset serialno_prop_31_0 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_31_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_31_0 (service_contexts_file))
+(typeattributeset service_manager_service_31_0 (service_manager_service))
+(typeattributeset service_manager_vndservice_31_0 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_31_0 (servicediscovery_service))
+(typeattributeset servicemanager_31_0 (servicemanager))
+(typeattributeset servicemanager_exec_31_0 (servicemanager_exec))
+(typeattributeset settings_service_31_0 (settings_service))
+(typeattributeset sgdisk_31_0 (sgdisk))
+(typeattributeset sgdisk_exec_31_0 (sgdisk_exec))
+(typeattributeset shared_relro_31_0 (shared_relro))
+(typeattributeset shared_relro_file_31_0 (shared_relro_file))
+(typeattributeset shell_31_0 (shell))
+(typeattributeset shell_data_file_31_0 (shell_data_file))
+(typeattributeset shell_exec_31_0 (shell_exec))
+(typeattributeset shell_prop_31_0 (shell_prop))
+(typeattributeset shell_test_data_file_31_0 (shell_test_data_file))
+(typeattributeset shm_31_0 (shm))
+(typeattributeset shortcut_manager_icons_31_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_31_0 (shortcut_service))
+(typeattributeset simpleperf_31_0 (simpleperf))
+(typeattributeset simpleperf_app_runner_31_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_31_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_31_0 (slice_service))
+(typeattributeset slideshow_31_0 (slideshow))
+(typeattributeset smartspace_service_31_0 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_31_0 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_socket_31_0 (snapuserd_socket))
+(typeattributeset soc_prop_31_0 (soc_prop))
+(typeattributeset socket_device_31_0 (socket_device))
+(typeattributeset socket_hook_prop_31_0 (socket_hook_prop))
+(typeattributeset sockfs_31_0 (sockfs))
+(typeattributeset sota_prop_31_0 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_31_0 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_31_0 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_31_0 (sqlite_log_prop))
+(typeattributeset staged_install_file_31_0 (staged_install_file))
+(typeattributeset staging_data_file_31_0 (staging_data_file))
+(typeattributeset stats_data_file_31_0 (stats_data_file))
+(typeattributeset statsd_31_0 (statsd))
+(typeattributeset statsd_exec_31_0 (statsd_exec))
+(typeattributeset statsdw_socket_31_0 (statsdw_socket))
+(typeattributeset statusbar_service_31_0 (statusbar_service))
+(typeattributeset storage_config_prop_31_0 (storage_config_prop))
+(typeattributeset storage_file_31_0 (storage_file))
+(typeattributeset storage_stub_file_31_0 (storage_stub_file))
+(typeattributeset storaged_service_31_0 (storaged_service))
+(typeattributeset storagemanager_config_prop_31_0 (storagemanager_config_prop))
+(typeattributeset storagestats_service_31_0 (storagestats_service))
+(typeattributeset su_31_0 (su))
+(typeattributeset su_exec_31_0 (su_exec))
+(typeattributeset super_block_device_31_0 (super_block_device))
+(typeattributeset surfaceflinger_31_0 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_31_0 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_31_0 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_31_0 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_31_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_31_0 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_31_0 (suspend_prop))
+(typeattributeset swap_block_device_31_0 (swap_block_device))
+(typeattributeset sysfs_31_0 (sysfs))
+(typeattributeset sysfs_android_usb_31_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_31_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_block_31_0 (sysfs_block))
+(typeattributeset sysfs_bluetooth_writable_31_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devfreq_cur_31_0 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_31_0 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_31_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_31_0 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_31_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_31_0 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_31_0 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_31_0 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_31_0 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_31_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_31_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_31_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_31_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_incfs_features_31_0 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_31_0 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_hwrandom_31_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_31_0 (sysfs_ion))
+(typeattributeset sysfs_ipv4_31_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_31_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_31_0 (sysfs_leds))
+(typeattributeset sysfs_loop_31_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_31_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_net_31_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_31_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_31_0 (sysfs_power))
+(typeattributeset sysfs_rtc_31_0 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_31_0 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_31_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_31_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_31_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uhid_31_0 (sysfs_uhid))
+(typeattributeset sysfs_uio_31_0 (sysfs_uio))
+(typeattributeset sysfs_usb_31_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_31_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_31_0 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_31_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_31_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_31_0 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_31_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_31_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_31_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_31_0 (sysfs_zram_uevent))
+(typeattributeset system_app_31_0 (system_app))
+(typeattributeset system_app_data_file_31_0 (system_app_data_file))
+(typeattributeset system_app_service_31_0 (system_app_service))
+(typeattributeset system_asan_options_file_31_0 (system_asan_options_file))
+(typeattributeset system_block_device_31_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_31_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_31_0 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_31_0 (system_config_service))
+(typeattributeset system_data_file_31_0 (system_data_file))
+(typeattributeset system_data_root_file_31_0 (system_data_root_file))
+(typeattributeset system_event_log_tags_file_31_0 (system_event_log_tags_file))
+(typeattributeset system_file_31_0 (system_file))
+(typeattributeset system_group_file_31_0 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_31_0 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_31_0 (system_lib_file))
+(typeattributeset system_linker_config_file_31_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_31_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_31_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_31_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_31_0 (system_net_netd_hwservice))
+(typeattributeset system_passwd_file_31_0 (system_passwd_file))
+(typeattributeset system_prop_31_0 (system_prop))
+(typeattributeset system_seccomp_policy_file_31_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_31_0 (system_security_cacerts_file))
+(typeattributeset system_server_31_0 (system_server))
+(typeattributeset system_server_dumper_service_31_0 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_31_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_31_0 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_31_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_31_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_31_0 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_31_0 (system_unsolzygote_socket))
+(typeattributeset system_update_service_31_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_31_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_31_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_31_0 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_31_0 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_31_0 (systemsound_config_prop))
+(typeattributeset task_profiles_api_file_31_0 (task_profiles_api_file))
+(typeattributeset task_profiles_file_31_0 (task_profiles_file))
+(typeattributeset task_service_31_0 (task_service))
+(typeattributeset tcpdump_exec_31_0 (tcpdump_exec))
+(typeattributeset tee_31_0 (tee))
+(typeattributeset tee_data_file_31_0 (tee_data_file))
+(typeattributeset tee_device_31_0 (tee_device))
+(typeattributeset telecom_service_31_0 (telecom_service))
+(typeattributeset telephony_config_prop_31_0 (telephony_config_prop))
+(typeattributeset telephony_status_prop_31_0 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_31_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_31_0 (test_harness_prop))
+(typeattributeset testharness_service_31_0 (testharness_service))
+(typeattributeset tethering_service_31_0 (tethering_service))
+(typeattributeset textclassification_service_31_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_31_0 (textclassifier_data_file))
+(typeattributeset textservices_service_31_0 (textservices_service))
+(typeattributeset texttospeech_service_31_0 (texttospeech_service))
+(typeattributeset theme_prop_31_0 (theme_prop))
+(typeattributeset thermal_service_31_0 (thermal_service))
+(typeattributeset time_prop_31_0 (time_prop))
+(typeattributeset timedetector_service_31_0 (timedetector_service))
+(typeattributeset timezone_service_31_0 (timezone_service))
+(typeattributeset timezonedetector_service_31_0 (timezonedetector_service))
+(typeattributeset tmpfs_31_0 (tmpfs))
+(typeattributeset tombstone_config_prop_31_0 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_31_0 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_31_0 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_31_0 (tombstoned))
+(typeattributeset tombstoned_crash_socket_31_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_31_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_31_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_31_0 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_31_0 (toolbox))
+(typeattributeset toolbox_exec_31_0 (toolbox_exec))
+(typeattributeset trace_data_file_31_0 (trace_data_file))
+(typeattributeset traced_31_0 (traced))
+(typeattributeset traced_consumer_socket_31_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_31_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_31_0 (traced_lazy_prop))
+(typeattributeset traced_perf_31_0 (traced_perf))
+(typeattributeset traced_perf_socket_31_0 (traced_perf_socket))
+(typeattributeset traced_probes_31_0 (traced_probes))
+(typeattributeset traced_producer_socket_31_0 (traced_producer_socket))
+(typeattributeset traced_tmpfs_31_0 (traced_tmpfs))
+(typeattributeset traceur_app_31_0 (traceur_app))
+(typeattributeset translation_service_31_0 (translation_service))
+(typeattributeset trust_service_31_0 (trust_service))
+(typeattributeset tty_device_31_0 (tty_device))
+(typeattributeset tun_device_31_0 (tun_device))
+(typeattributeset tv_input_service_31_0 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_31_0 (tv_tuner_resource_mgr_service))
+(typeattributeset tzdatacheck_31_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_31_0 (tzdatacheck_exec))
+(typeattributeset ueventd_31_0 (ueventd))
+(typeattributeset ueventd_tmpfs_31_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_31_0 (uhid_device))
+(typeattributeset uimode_service_31_0 (uimode_service))
+(typeattributeset uio_device_31_0 (uio_device))
+(typeattributeset uncrypt_31_0 (uncrypt))
+(typeattributeset uncrypt_exec_31_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_31_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_31_0 (unencrypted_data_file))
+(typeattributeset unlabeled_31_0 (unlabeled))
+(typeattributeset untrusted_app_25_31_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_31_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_31_0 (untrusted_app_29))
+(typeattributeset untrusted_app_31_0 (untrusted_app))
+(typeattributeset update_engine_31_0 (update_engine))
+(typeattributeset update_engine_data_file_31_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_31_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_31_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_31_0 (update_engine_service))
+(typeattributeset update_engine_stable_service_31_0 (update_engine_stable_service))
+(typeattributeset update_verifier_31_0 (update_verifier))
+(typeattributeset update_verifier_exec_31_0 (update_verifier_exec))
+(typeattributeset updatelock_service_31_0 (updatelock_service))
+(typeattributeset uri_grants_service_31_0 (uri_grants_service))
+(typeattributeset usagestats_service_31_0 (usagestats_service))
+(typeattributeset usb_config_prop_31_0 (usb_config_prop))
+(typeattributeset usb_control_prop_31_0 (usb_control_prop))
+(typeattributeset usb_device_31_0 (usb_device))
+(typeattributeset usb_prop_31_0 (usb_prop))
+(typeattributeset usb_serial_device_31_0 (usb_serial_device))
+(typeattributeset usb_service_31_0 (usb_service))
+(typeattributeset usbaccessory_device_31_0 (usbaccessory_device))
+(typeattributeset usbd_31_0 (usbd))
+(typeattributeset usbd_exec_31_0 (usbd_exec))
+(typeattributeset usbfs_31_0 (usbfs))
+(typeattributeset use_memfd_prop_31_0 (use_memfd_prop))
+(typeattributeset user_profile_data_file_31_0 (user_profile_data_file))
+(typeattributeset user_profile_root_file_31_0 (user_profile_root_file))
+(typeattributeset user_service_31_0 (user_service))
+(typeattributeset userdata_block_device_31_0 (userdata_block_device))
+(typeattributeset userdata_sysdev_31_0 (userdata_sysdev))
+(typeattributeset usermodehelper_31_0 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_31_0 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_31_0 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_31_0 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_31_0 (uwb_service))
+(typeattributeset vcn_management_service_31_0 (vcn_management_service))
+(typeattributeset vd_device_31_0 (vd_device))
+(typeattributeset vdc_31_0 (vdc))
+(typeattributeset vdc_exec_31_0 (vdc_exec))
+(typeattributeset vehicle_hal_prop_31_0 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_31_0 (vendor_apex_file))
+(typeattributeset vendor_app_file_31_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_31_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_31_0 (vendor_configs_file))
+(typeattributeset vendor_data_file_31_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_31_0 (vendor_default_prop))
+(typeattributeset vendor_file_31_0 (vendor_file))
+(typeattributeset vendor_framework_file_31_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_31_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_31_0 (vendor_idc_file))
+(typeattributeset vendor_init_31_0 (vendor_init))
+(typeattributeset vendor_kernel_modules_31_0 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_31_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_31_0 (vendor_keylayout_file))
+(typeattributeset vendor_misc_writer_31_0 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_31_0 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_31_0 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_31_0 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_31_0 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_31_0 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_31_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_31_0 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_31_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_31_0 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_31_0 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_31_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_31_0 (vendor_toolbox_exec))
+(typeattributeset vfat_31_0 (vfat))
+(typeattributeset vibrator_manager_service_31_0 (vibrator_manager_service))
+(typeattributeset vibrator_service_31_0 (vibrator_service))
+(typeattributeset video_device_31_0 (video_device))
+(typeattributeset virtual_ab_prop_31_0 (virtual_ab_prop))
+(typeattributeset virtual_touchpad_31_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_31_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_31_0 (virtual_touchpad_service))
+(typeattributeset virtualization_service_31_0 (virtualization_service))
+(typeattributeset vndbinder_device_31_0 (vndbinder_device))
+(typeattributeset vndk_prop_31_0 (vndk_prop))
+(typeattributeset vndk_sp_file_31_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_31_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_31_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_31_0 (voiceinteraction_service))
+(typeattributeset vold_31_0 (vold))
+(typeattributeset vold_config_prop_31_0 (vold_config_prop))
+(typeattributeset vold_data_file_31_0 (vold_data_file))
+(typeattributeset vold_device_31_0 (vold_device))
+(typeattributeset vold_exec_31_0 (vold_exec))
+(typeattributeset vold_metadata_file_31_0 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_31_0 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_31_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_31_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_31_0 (vold_prop))
+(typeattributeset vold_service_31_0 (vold_service))
+(typeattributeset vold_status_prop_31_0 (vold_status_prop))
+(typeattributeset vpn_data_file_31_0 (vpn_data_file))
+(typeattributeset vpn_management_service_31_0 (vpn_management_service))
+(typeattributeset vr_hwc_31_0 (vr_hwc))
+(typeattributeset vr_hwc_exec_31_0 (vr_hwc_exec))
+(typeattributeset vr_hwc_service_31_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_31_0 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_31_0 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_31_0 (vts_config_prop))
+(typeattributeset vts_status_prop_31_0 (vts_status_prop))
+(typeattributeset wallpaper_file_31_0 (wallpaper_file))
+(typeattributeset wallpaper_service_31_0 (wallpaper_service))
+(typeattributeset watchdog_device_31_0 (watchdog_device))
+(typeattributeset watchdog_metadata_file_31_0 (watchdog_metadata_file))
+(typeattributeset watchdogd_31_0 (watchdogd))
+(typeattributeset watchdogd_exec_31_0 (watchdogd_exec))
+(typeattributeset webview_zygote_31_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_31_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_31_0 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_31_0 (webviewupdate_service))
+(typeattributeset wifi_config_prop_31_0 (wifi_config_prop))
+(typeattributeset wifi_data_file_31_0 (wifi_data_file))
+(typeattributeset wifi_hal_prop_31_0 (wifi_hal_prop))
+(typeattributeset wifi_key_31_0 (wifi_key))
+(typeattributeset wifi_log_prop_31_0 (wifi_log_prop))
+(typeattributeset wifi_prop_31_0 (wifi_prop))
+(typeattributeset wifi_service_31_0 (wifi_service))
+(typeattributeset wifiaware_service_31_0 (wifiaware_service))
+(typeattributeset wificond_31_0 (wificond))
+(typeattributeset wificond_exec_31_0 (wificond_exec))
+(typeattributeset wifinl80211_service_31_0 (wifinl80211_service))
+(typeattributeset wifip2p_service_31_0 (wifip2p_service))
+(typeattributeset wifiscanner_service_31_0 (wifiscanner_service))
+(typeattributeset window_service_31_0 (window_service))
+(typeattributeset wpa_socket_31_0 (wpa_socket))
+(typeattributeset wpantund_31_0 (wpantund))
+(typeattributeset wpantund_exec_31_0 (wpantund_exec))
+(typeattributeset wpantund_service_31_0 (wpantund_service))
+(typeattributeset zero_device_31_0 (zero_device))
+(typeattributeset zoneinfo_data_file_31_0 (zoneinfo_data_file))
+(typeattributeset zram_config_prop_31_0 (zram_config_prop))
+(typeattributeset zram_control_prop_31_0 (zram_control_prop))
+(typeattributeset zygote_31_0 (zygote))
+(typeattributeset zygote_config_prop_31_0 (zygote_config_prop))
+(typeattributeset zygote_exec_31_0 (zygote_exec))
+(typeattributeset zygote_socket_31_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_31_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/31.0/31.0.compat.cil b/prebuilts/api/202504/private/compat/31.0/31.0.compat.cil
new file mode 100644
index 0000000..787c92a
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/31.0/31.0.compat.cil
@@ -0,0 +1,3 @@
+;; complement CIL file for compatibility between ToT policy and 31.0 vendors.
+;; will be compiled along with other normal policy files, on 31.0 vendors.
+;;
diff --git a/prebuilts/api/202504/private/compat/31.0/31.0.ignore.cil b/prebuilts/api/202504/private/compat/31.0/31.0.ignore.cil
new file mode 100644
index 0000000..0e39f3e
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/31.0/31.0.ignore.cil
@@ -0,0 +1,52 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 31.0 policy. Thus, we do not need to map
+;; these types to previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ apexd_select_prop
+ artd_service
+ attestation_verification_service
+ camera2_extensions_prop
+ communal_service
+ device_config_nnapi_native_prop
+ dice_maintenance_service
+ dice_node_service
+ diced
+ diced_exec
+ extra_free_kbytes
+ extra_free_kbytes_exec
+ hal_contexthub_service
+ hal_dice_service
+ hal_dumpstate_service
+ hal_graphics_composer_service
+ hal_health_service
+ hal_radio_service
+ hal_sensors_service
+ hal_system_suspend_service
+ hal_tv_tuner_service
+ hal_uwb_service
+ hal_uwb_vendor_service
+ hal_wifi_hostapd_service
+ hal_wifi_supplicant_service
+ hal_nlinterceptor_service
+ hypervisor_prop
+ locale_service
+ power_stats_service
+ snapuserd_prop
+ snapuserd_proxy_socket
+ tare_service
+ transformer_service
+ proc_watermark_boost_factor
+ untrusted_app_30
+ proc_vendor_sched
+ sdk_sandbox_service
+ sysfs_fs_fuse_bpf
+ sysfs_vendor_sched
+ tv_iapp_service
+ vendor_uuid_mapping_config_file
+ vendor_vm_file
+ vendor_vm_data_file
+ virtual_device_service
+ ))
diff --git a/prebuilts/api/202504/private/compat/32.0/32.0.cil b/prebuilts/api/202504/private/compat/32.0/32.0.cil
new file mode 100644
index 0000000..171f0ad
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/32.0/32.0.cil
@@ -0,0 +1,2487 @@
+;; types removed from current policy
+(type apex_appsearch_data_file)
+(type apex_permission_data_file)
+(type apex_scheduling_data_file)
+(type apex_wifi_data_file)
+(type healthd_exec)
+(type nonplat_service_contexts_file)
+(type sysfs_block)
+(type vr_hwc)
+(type vr_hwc_exec)
+
+;; mapping information from ToT policy's types to 32.0 policy's types.
+(expandtypeattribute (DockObserver_service_32_0) true)
+(expandtypeattribute (IProxyService_service_32_0) true)
+(expandtypeattribute (aac_drc_prop_32_0) true)
+(expandtypeattribute (aaudio_config_prop_32_0) true)
+(expandtypeattribute (ab_update_gki_prop_32_0) true)
+(expandtypeattribute (accessibility_service_32_0) true)
+(expandtypeattribute (account_service_32_0) true)
+(expandtypeattribute (activity_service_32_0) true)
+(expandtypeattribute (activity_task_service_32_0) true)
+(expandtypeattribute (adb_data_file_32_0) true)
+(expandtypeattribute (adb_keys_file_32_0) true)
+(expandtypeattribute (adb_service_32_0) true)
+(expandtypeattribute (adbd_32_0) true)
+(expandtypeattribute (adbd_config_prop_32_0) true)
+(expandtypeattribute (adbd_exec_32_0) true)
+(expandtypeattribute (adbd_socket_32_0) true)
+(expandtypeattribute (aidl_lazy_test_server_32_0) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_32_0) true)
+(expandtypeattribute (aidl_lazy_test_service_32_0) true)
+(expandtypeattribute (alarm_service_32_0) true)
+(expandtypeattribute (anr_data_file_32_0) true)
+(expandtypeattribute (apc_service_32_0) true)
+(expandtypeattribute (apex_appsearch_data_file_32_0) true)
+(expandtypeattribute (apex_data_file_32_0) true)
+(expandtypeattribute (apex_info_file_32_0) true)
+(expandtypeattribute (apex_metadata_file_32_0) true)
+(expandtypeattribute (apex_mnt_dir_32_0) true)
+(expandtypeattribute (apex_module_data_file_32_0) true)
+(expandtypeattribute (apex_ota_reserved_file_32_0) true)
+(expandtypeattribute (apex_permission_data_file_32_0) true)
+(expandtypeattribute (apex_rollback_data_file_32_0) true)
+(expandtypeattribute (apex_scheduling_data_file_32_0) true)
+(expandtypeattribute (apex_service_32_0) true)
+(expandtypeattribute (apex_wifi_data_file_32_0) true)
+(expandtypeattribute (apexd_32_0) true)
+(expandtypeattribute (apexd_config_prop_32_0) true)
+(expandtypeattribute (apexd_exec_32_0) true)
+(expandtypeattribute (apexd_prop_32_0) true)
+(expandtypeattribute (apk_data_file_32_0) true)
+(expandtypeattribute (apk_private_data_file_32_0) true)
+(expandtypeattribute (apk_private_tmp_file_32_0) true)
+(expandtypeattribute (apk_tmp_file_32_0) true)
+(expandtypeattribute (apk_verity_prop_32_0) true)
+(expandtypeattribute (app_binding_service_32_0) true)
+(expandtypeattribute (app_data_file_32_0) true)
+(expandtypeattribute (app_fuse_file_32_0) true)
+(expandtypeattribute (app_fusefs_32_0) true)
+(expandtypeattribute (app_hibernation_service_32_0) true)
+(expandtypeattribute (app_integrity_service_32_0) true)
+(expandtypeattribute (app_prediction_service_32_0) true)
+(expandtypeattribute (app_search_service_32_0) true)
+(expandtypeattribute (app_zygote_32_0) true)
+(expandtypeattribute (app_zygote_tmpfs_32_0) true)
+(expandtypeattribute (appcompat_data_file_32_0) true)
+(expandtypeattribute (appdomain_tmpfs_32_0) true)
+(expandtypeattribute (appops_service_32_0) true)
+(expandtypeattribute (appwidget_service_32_0) true)
+(expandtypeattribute (arm64_memtag_prop_32_0) true)
+(expandtypeattribute (art_apex_dir_32_0) true)
+(expandtypeattribute (asec_apk_file_32_0) true)
+(expandtypeattribute (asec_image_file_32_0) true)
+(expandtypeattribute (asec_public_file_32_0) true)
+(expandtypeattribute (ashmem_device_32_0) true)
+(expandtypeattribute (ashmem_libcutils_device_32_0) true)
+(expandtypeattribute (assetatlas_service_32_0) true)
+(expandtypeattribute (atrace_32_0) true)
+(expandtypeattribute (audio_config_prop_32_0) true)
+(expandtypeattribute (audio_data_file_32_0) true)
+(expandtypeattribute (audio_device_32_0) true)
+(expandtypeattribute (audio_prop_32_0) true)
+(expandtypeattribute (audio_service_32_0) true)
+(expandtypeattribute (audiohal_data_file_32_0) true)
+(expandtypeattribute (audioserver_32_0) true)
+(expandtypeattribute (audioserver_data_file_32_0) true)
+(expandtypeattribute (audioserver_service_32_0) true)
+(expandtypeattribute (audioserver_tmpfs_32_0) true)
+(expandtypeattribute (auth_service_32_0) true)
+(expandtypeattribute (authorization_service_32_0) true)
+(expandtypeattribute (autofill_service_32_0) true)
+(expandtypeattribute (backup_data_file_32_0) true)
+(expandtypeattribute (backup_service_32_0) true)
+(expandtypeattribute (battery_service_32_0) true)
+(expandtypeattribute (batteryproperties_service_32_0) true)
+(expandtypeattribute (batterystats_service_32_0) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_32_0) true)
+(expandtypeattribute (binder_cache_system_server_prop_32_0) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_32_0) true)
+(expandtypeattribute (binder_calls_stats_service_32_0) true)
+(expandtypeattribute (binder_device_32_0) true)
+(expandtypeattribute (binderfs_32_0) true)
+(expandtypeattribute (binderfs_logs_32_0) true)
+(expandtypeattribute (binderfs_logs_proc_32_0) true)
+(expandtypeattribute (binfmt_miscfs_32_0) true)
+(expandtypeattribute (biometric_service_32_0) true)
+(expandtypeattribute (blkid_32_0) true)
+(expandtypeattribute (blkid_untrusted_32_0) true)
+(expandtypeattribute (blob_store_service_32_0) true)
+(expandtypeattribute (block_device_32_0) true)
+(expandtypeattribute (bluetooth_32_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_32_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_32_0) true)
+(expandtypeattribute (bluetooth_data_file_32_0) true)
+(expandtypeattribute (bluetooth_efs_file_32_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_32_0) true)
+(expandtypeattribute (bluetooth_manager_service_32_0) true)
+(expandtypeattribute (bluetooth_prop_32_0) true)
+(expandtypeattribute (bluetooth_service_32_0) true)
+(expandtypeattribute (bluetooth_socket_32_0) true)
+(expandtypeattribute (boot_block_device_32_0) true)
+(expandtypeattribute (boot_status_prop_32_0) true)
+(expandtypeattribute (bootanim_32_0) true)
+(expandtypeattribute (bootanim_config_prop_32_0) true)
+(expandtypeattribute (bootanim_exec_32_0) true)
+(expandtypeattribute (bootanim_system_prop_32_0) true)
+(expandtypeattribute (bootchart_data_file_32_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_32_0) true)
+(expandtypeattribute (bootloader_prop_32_0) true)
+(expandtypeattribute (bootstat_32_0) true)
+(expandtypeattribute (bootstat_data_file_32_0) true)
+(expandtypeattribute (bootstat_exec_32_0) true)
+(expandtypeattribute (boottime_prop_32_0) true)
+(expandtypeattribute (boottime_public_prop_32_0) true)
+(expandtypeattribute (boottrace_data_file_32_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_32_0) true)
+(expandtypeattribute (bq_config_prop_32_0) true)
+(expandtypeattribute (broadcastradio_service_32_0) true)
+(expandtypeattribute (bufferhubd_32_0) true)
+(expandtypeattribute (bufferhubd_exec_32_0) true)
+(expandtypeattribute (bugreport_service_32_0) true)
+(expandtypeattribute (build_bootimage_prop_32_0) true)
+(expandtypeattribute (build_config_prop_32_0) true)
+(expandtypeattribute (build_odm_prop_32_0) true)
+(expandtypeattribute (build_prop_32_0) true)
+(expandtypeattribute (build_vendor_prop_32_0) true)
+(expandtypeattribute (cache_backup_file_32_0) true)
+(expandtypeattribute (cache_block_device_32_0) true)
+(expandtypeattribute (cache_file_32_0) true)
+(expandtypeattribute (cache_private_backup_file_32_0) true)
+(expandtypeattribute (cache_recovery_file_32_0) true)
+(expandtypeattribute (cacheinfo_service_32_0) true)
+(expandtypeattribute (camera2_extensions_prop_32_0) true)
+(expandtypeattribute (camera_calibration_prop_32_0) true)
+(expandtypeattribute (camera_config_prop_32_0) true)
+(expandtypeattribute (camera_data_file_32_0) true)
+(expandtypeattribute (camera_device_32_0) true)
+(expandtypeattribute (cameraproxy_service_32_0) true)
+(expandtypeattribute (cameraserver_32_0) true)
+(expandtypeattribute (cameraserver_exec_32_0) true)
+(expandtypeattribute (cameraserver_service_32_0) true)
+(expandtypeattribute (cameraserver_tmpfs_32_0) true)
+(expandtypeattribute (camerax_extensions_prop_32_0) true)
+(expandtypeattribute (cgroup_32_0) true)
+(expandtypeattribute (cgroup_desc_api_file_32_0) true)
+(expandtypeattribute (cgroup_desc_file_32_0) true)
+(expandtypeattribute (cgroup_rc_file_32_0) true)
+(expandtypeattribute (cgroup_v2_32_0) true)
+(expandtypeattribute (charger_32_0) true)
+(expandtypeattribute (charger_config_prop_32_0) true)
+(expandtypeattribute (charger_exec_32_0) true)
+(expandtypeattribute (charger_prop_32_0) true)
+(expandtypeattribute (charger_status_prop_32_0) true)
+(expandtypeattribute (clipboard_service_32_0) true)
+(expandtypeattribute (codec2_config_prop_32_0) true)
+(expandtypeattribute (cold_boot_done_prop_32_0) true)
+(expandtypeattribute (color_display_service_32_0) true)
+(expandtypeattribute (companion_device_service_32_0) true)
+(expandtypeattribute (config_prop_32_0) true)
+(expandtypeattribute (configfs_32_0) true)
+(expandtypeattribute (connectivity_service_32_0) true)
+(expandtypeattribute (connmetrics_service_32_0) true)
+(expandtypeattribute (console_device_32_0) true)
+(expandtypeattribute (consumer_ir_service_32_0) true)
+(expandtypeattribute (content_capture_service_32_0) true)
+(expandtypeattribute (content_service_32_0) true)
+(expandtypeattribute (content_suggestions_service_32_0) true)
+(expandtypeattribute (contexthub_service_32_0) true)
+(expandtypeattribute (coredump_file_32_0) true)
+(expandtypeattribute (country_detector_service_32_0) true)
+(expandtypeattribute (coverage_service_32_0) true)
+(expandtypeattribute (cppreopt_prop_32_0) true)
+(expandtypeattribute (cpu_variant_prop_32_0) true)
+(expandtypeattribute (cpuinfo_service_32_0) true)
+(expandtypeattribute (crash_dump_32_0) true)
+(expandtypeattribute (crash_dump_exec_32_0) true)
+(expandtypeattribute (credstore_32_0) true)
+(expandtypeattribute (credstore_data_file_32_0) true)
+(expandtypeattribute (credstore_exec_32_0) true)
+(expandtypeattribute (credstore_service_32_0) true)
+(expandtypeattribute (crossprofileapps_service_32_0) true)
+(expandtypeattribute (ctl_adbd_prop_32_0) true)
+(expandtypeattribute (ctl_apexd_prop_32_0) true)
+(expandtypeattribute (ctl_bootanim_prop_32_0) true)
+(expandtypeattribute (ctl_bugreport_prop_32_0) true)
+(expandtypeattribute (ctl_console_prop_32_0) true)
+(expandtypeattribute (ctl_default_prop_32_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_32_0) true)
+(expandtypeattribute (ctl_fuse_prop_32_0) true)
+(expandtypeattribute (ctl_gsid_prop_32_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_32_0) true)
+(expandtypeattribute (ctl_interface_start_prop_32_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_32_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_32_0) true)
+(expandtypeattribute (ctl_restart_prop_32_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_32_0) true)
+(expandtypeattribute (ctl_sigstop_prop_32_0) true)
+(expandtypeattribute (ctl_start_prop_32_0) true)
+(expandtypeattribute (ctl_stop_prop_32_0) true)
+(expandtypeattribute (dalvik_config_prop_32_0) true)
+(expandtypeattribute (dalvik_prop_32_0) true)
+(expandtypeattribute (dalvik_runtime_prop_32_0) true)
+(expandtypeattribute (dalvikcache_data_file_32_0) true)
+(expandtypeattribute (dataloader_manager_service_32_0) true)
+(expandtypeattribute (dbinfo_service_32_0) true)
+(expandtypeattribute (dck_prop_32_0) true)
+(expandtypeattribute (debug_prop_32_0) true)
+(expandtypeattribute (debugfs_32_0) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_32_0) true)
+(expandtypeattribute (debugfs_kprobes_32_0) true)
+(expandtypeattribute (debugfs_mm_events_tracing_32_0) true)
+(expandtypeattribute (debugfs_mmc_32_0) true)
+(expandtypeattribute (debugfs_restriction_prop_32_0) true)
+(expandtypeattribute (debugfs_trace_marker_32_0) true)
+(expandtypeattribute (debugfs_tracing_32_0) true)
+(expandtypeattribute (debugfs_tracing_debug_32_0) true)
+(expandtypeattribute (debugfs_tracing_instances_32_0) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_32_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_32_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_32_0) true)
+(expandtypeattribute (debuggerd_prop_32_0) true)
+(expandtypeattribute (default_android_hwservice_32_0) true)
+(expandtypeattribute (default_android_service_32_0) true)
+(expandtypeattribute (default_android_vndservice_32_0) true)
+(expandtypeattribute (default_prop_32_0) true)
+(expandtypeattribute (dev_cpu_variant_32_0) true)
+(expandtypeattribute (device_32_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_32_0) true)
+(expandtypeattribute (device_config_boot_count_prop_32_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_32_0) true)
+(expandtypeattribute (device_config_media_native_prop_32_0) true)
+(expandtypeattribute (device_config_netd_native_prop_32_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_32_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_32_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_32_0) true)
+(expandtypeattribute (device_config_service_32_0) true)
+(expandtypeattribute (device_identifiers_service_32_0) true)
+(expandtypeattribute (device_logging_prop_32_0) true)
+(expandtypeattribute (device_policy_service_32_0) true)
+(expandtypeattribute (device_state_service_32_0) true)
+(expandtypeattribute (deviceidle_service_32_0) true)
+(expandtypeattribute (devicestoragemonitor_service_32_0) true)
+(expandtypeattribute (devpts_32_0) true)
+(expandtypeattribute (dhcp_32_0) true)
+(expandtypeattribute (dhcp_data_file_32_0) true)
+(expandtypeattribute (dhcp_exec_32_0) true)
+(expandtypeattribute (dhcp_prop_32_0) true)
+(expandtypeattribute (diskstats_service_32_0) true)
+(expandtypeattribute (display_service_32_0) true)
+(expandtypeattribute (dm_device_32_0) true)
+(expandtypeattribute (dm_user_device_32_0) true)
+(expandtypeattribute (dmabuf_heap_device_32_0) true)
+(expandtypeattribute (dmabuf_system_heap_device_32_0) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_32_0) true)
+(expandtypeattribute (dnsmasq_32_0) true)
+(expandtypeattribute (dnsmasq_exec_32_0) true)
+(expandtypeattribute (dnsproxyd_socket_32_0) true)
+(expandtypeattribute (dnsresolver_service_32_0) true)
+(expandtypeattribute (domain_verification_service_32_0) true)
+(expandtypeattribute (dreams_service_32_0) true)
+(expandtypeattribute (drm_data_file_32_0) true)
+(expandtypeattribute (drm_service_config_prop_32_0) true)
+(expandtypeattribute (drmserver_32_0) true)
+(expandtypeattribute (drmserver_exec_32_0) true)
+(expandtypeattribute (drmserver_service_32_0) true)
+(expandtypeattribute (drmserver_socket_32_0) true)
+(expandtypeattribute (dropbox_data_file_32_0) true)
+(expandtypeattribute (dropbox_service_32_0) true)
+(expandtypeattribute (dumpstate_32_0) true)
+(expandtypeattribute (dumpstate_exec_32_0) true)
+(expandtypeattribute (dumpstate_options_prop_32_0) true)
+(expandtypeattribute (dumpstate_prop_32_0) true)
+(expandtypeattribute (dumpstate_service_32_0) true)
+(expandtypeattribute (dumpstate_socket_32_0) true)
+(expandtypeattribute (dynamic_system_prop_32_0) true)
+(expandtypeattribute (e2fs_32_0) true)
+(expandtypeattribute (e2fs_exec_32_0) true)
+(expandtypeattribute (efs_file_32_0) true)
+(expandtypeattribute (emergency_affordance_service_32_0) true)
+(expandtypeattribute (ephemeral_app_32_0) true)
+(expandtypeattribute (ethernet_service_32_0) true)
+(expandtypeattribute (exfat_32_0) true)
+(expandtypeattribute (exported3_system_prop_32_0) true)
+(expandtypeattribute (exported_bluetooth_prop_32_0) true)
+(expandtypeattribute (exported_camera_prop_32_0) true)
+(expandtypeattribute (exported_config_prop_32_0) true)
+(expandtypeattribute (exported_default_prop_32_0) true)
+(expandtypeattribute (exported_dumpstate_prop_32_0) true)
+(expandtypeattribute (exported_overlay_prop_32_0) true)
+(expandtypeattribute (exported_pm_prop_32_0) true)
+(expandtypeattribute (exported_secure_prop_32_0) true)
+(expandtypeattribute (exported_system_prop_32_0) true)
+(expandtypeattribute (external_vibrator_service_32_0) true)
+(expandtypeattribute (face_service_32_0) true)
+(expandtypeattribute (face_vendor_data_file_32_0) true)
+(expandtypeattribute (fastbootd_32_0) true)
+(expandtypeattribute (ffs_config_prop_32_0) true)
+(expandtypeattribute (ffs_control_prop_32_0) true)
+(expandtypeattribute (file_contexts_file_32_0) true)
+(expandtypeattribute (file_integrity_service_32_0) true)
+(expandtypeattribute (fingerprint_prop_32_0) true)
+(expandtypeattribute (fingerprint_service_32_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_32_0) true)
+(expandtypeattribute (fingerprintd_32_0) true)
+(expandtypeattribute (fingerprintd_data_file_32_0) true)
+(expandtypeattribute (fingerprintd_exec_32_0) true)
+(expandtypeattribute (fingerprintd_service_32_0) true)
+(expandtypeattribute (firstboot_prop_32_0) true)
+(expandtypeattribute (flags_health_check_32_0) true)
+(expandtypeattribute (flags_health_check_exec_32_0) true)
+(expandtypeattribute (font_service_32_0) true)
+(expandtypeattribute (framework_watchdog_config_prop_32_0) true)
+(expandtypeattribute (frp_block_device_32_0) true)
+(expandtypeattribute (fs_bpf_32_0) true)
+(expandtypeattribute (fs_bpf_tethering_32_0) true)
+(expandtypeattribute (fsck_32_0) true)
+(expandtypeattribute (fsck_exec_32_0) true)
+(expandtypeattribute (fsck_untrusted_32_0) true)
+(expandtypeattribute (fscklogs_32_0) true)
+(expandtypeattribute (functionfs_32_0) true)
+(expandtypeattribute (fuse_32_0) true)
+(expandtypeattribute (fuse_device_32_0) true)
+(expandtypeattribute (fusectlfs_32_0) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_32_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_32_0) true)
+(expandtypeattribute (fwk_camera_hwservice_32_0) true)
+(expandtypeattribute (fwk_display_hwservice_32_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_32_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_32_0) true)
+(expandtypeattribute (fwk_stats_hwservice_32_0) true)
+(expandtypeattribute (fwk_stats_service_32_0) true)
+(expandtypeattribute (fwmarkd_socket_32_0) true)
+(expandtypeattribute (game_service_32_0) true)
+(expandtypeattribute (gatekeeper_data_file_32_0) true)
+(expandtypeattribute (gatekeeper_service_32_0) true)
+(expandtypeattribute (gatekeeperd_32_0) true)
+(expandtypeattribute (gatekeeperd_exec_32_0) true)
+(expandtypeattribute (gfxinfo_service_32_0) true)
+(expandtypeattribute (gmscore_app_32_0) true)
+(expandtypeattribute (gnss_device_32_0) true)
+(expandtypeattribute (gnss_time_update_service_32_0) true)
+(expandtypeattribute (gps_control_32_0) true)
+(expandtypeattribute (gpu_device_32_0) true)
+(expandtypeattribute (gpu_service_32_0) true)
+(expandtypeattribute (gpuservice_32_0) true)
+(expandtypeattribute (graphics_config_prop_32_0) true)
+(expandtypeattribute (graphics_device_32_0) true)
+(expandtypeattribute (graphicsstats_service_32_0) true)
+(expandtypeattribute (gsi_data_file_32_0) true)
+(expandtypeattribute (gsi_metadata_file_32_0) true)
+(expandtypeattribute (gsi_public_metadata_file_32_0) true)
+(expandtypeattribute (hal_atrace_hwservice_32_0) true)
+(expandtypeattribute (hal_audio_hwservice_32_0) true)
+(expandtypeattribute (hal_audio_service_32_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_32_0) true)
+(expandtypeattribute (hal_audiocontrol_service_32_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_32_0) true)
+(expandtypeattribute (hal_authsecret_service_32_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_32_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_32_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_32_0) true)
+(expandtypeattribute (hal_camera_hwservice_32_0) true)
+(expandtypeattribute (hal_can_bus_hwservice_32_0) true)
+(expandtypeattribute (hal_can_controller_hwservice_32_0) true)
+(expandtypeattribute (hal_cas_hwservice_32_0) true)
+(expandtypeattribute (hal_codec2_hwservice_32_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_32_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_32_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_32_0) true)
+(expandtypeattribute (hal_drm_hwservice_32_0) true)
+(expandtypeattribute (hal_dumpstate_config_prop_32_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_32_0) true)
+(expandtypeattribute (hal_evs_hwservice_32_0) true)
+(expandtypeattribute (hal_face_hwservice_32_0) true)
+(expandtypeattribute (hal_face_service_32_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_32_0) true)
+(expandtypeattribute (hal_fingerprint_service_32_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_32_0) true)
+(expandtypeattribute (hal_gnss_hwservice_32_0) true)
+(expandtypeattribute (hal_gnss_service_32_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_32_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_32_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_32_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_32_0) true)
+(expandtypeattribute (hal_health_hwservice_32_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_32_0) true)
+(expandtypeattribute (hal_health_storage_service_32_0) true)
+(expandtypeattribute (hal_identity_service_32_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_32_0) true)
+(expandtypeattribute (hal_instrumentation_prop_32_0) true)
+(expandtypeattribute (hal_ir_hwservice_32_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_32_0) true)
+(expandtypeattribute (hal_keymint_service_32_0) true)
+(expandtypeattribute (hal_light_hwservice_32_0) true)
+(expandtypeattribute (hal_light_service_32_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_32_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_32_0) true)
+(expandtypeattribute (hal_memtrack_service_32_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_32_0) true)
+(expandtypeattribute (hal_neuralnetworks_service_32_0) true)
+(expandtypeattribute (hal_nfc_hwservice_32_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_32_0) true)
+(expandtypeattribute (hal_oemlock_service_32_0) true)
+(expandtypeattribute (hal_omx_hwservice_32_0) true)
+(expandtypeattribute (hal_power_hwservice_32_0) true)
+(expandtypeattribute (hal_power_service_32_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_32_0) true)
+(expandtypeattribute (hal_power_stats_service_32_0) true)
+(expandtypeattribute (hal_rebootescrow_service_32_0) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_32_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_32_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_32_0) true)
+(expandtypeattribute (hal_secureclock_service_32_0) true)
+(expandtypeattribute (hal_sensors_hwservice_32_0) true)
+(expandtypeattribute (hal_sharedsecret_service_32_0) true)
+(expandtypeattribute (hal_telephony_hwservice_32_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_32_0) true)
+(expandtypeattribute (hal_thermal_hwservice_32_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_32_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_32_0) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_32_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_32_0) true)
+(expandtypeattribute (hal_usb_hwservice_32_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_32_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_32_0) true)
+(expandtypeattribute (hal_vibrator_service_32_0) true)
+(expandtypeattribute (hal_vr_hwservice_32_0) true)
+(expandtypeattribute (hal_weaver_hwservice_32_0) true)
+(expandtypeattribute (hal_weaver_service_32_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_32_0) true)
+(expandtypeattribute (hal_wifi_hwservice_32_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_32_0) true)
+(expandtypeattribute (hardware_properties_service_32_0) true)
+(expandtypeattribute (hardware_service_32_0) true)
+(expandtypeattribute (hci_attach_dev_32_0) true)
+(expandtypeattribute (hdmi_config_prop_32_0) true)
+(expandtypeattribute (hdmi_control_service_32_0) true)
+(expandtypeattribute (healthd_32_0) true)
+(expandtypeattribute (healthd_exec_32_0) true)
+(expandtypeattribute (heapdump_data_file_32_0) true)
+(expandtypeattribute (heapprofd_32_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_32_0) true)
+(expandtypeattribute (heapprofd_prop_32_0) true)
+(expandtypeattribute (heapprofd_socket_32_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_32_0) true)
+(expandtypeattribute (hidl_base_hwservice_32_0) true)
+(expandtypeattribute (hidl_manager_hwservice_32_0) true)
+(expandtypeattribute (hidl_memory_hwservice_32_0) true)
+(expandtypeattribute (hidl_token_hwservice_32_0) true)
+(expandtypeattribute (hint_service_32_0) true)
+(expandtypeattribute (hw_random_device_32_0) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_32_0) true)
+(expandtypeattribute (hwbinder_device_32_0) true)
+(expandtypeattribute (hwservice_contexts_file_32_0) true)
+(expandtypeattribute (hwservicemanager_32_0) true)
+(expandtypeattribute (hwservicemanager_exec_32_0) true)
+(expandtypeattribute (hwservicemanager_prop_32_0) true)
+(expandtypeattribute (hypervisor_prop_32_0) true)
+(expandtypeattribute (icon_file_32_0) true)
+(expandtypeattribute (idmap_32_0) true)
+(expandtypeattribute (idmap_exec_32_0) true)
+(expandtypeattribute (idmap_service_32_0) true)
+(expandtypeattribute (iio_device_32_0) true)
+(expandtypeattribute (imms_service_32_0) true)
+(expandtypeattribute (incident_32_0) true)
+(expandtypeattribute (incident_data_file_32_0) true)
+(expandtypeattribute (incident_helper_32_0) true)
+(expandtypeattribute (incident_service_32_0) true)
+(expandtypeattribute (incidentd_32_0) true)
+(expandtypeattribute (incremental_control_file_32_0) true)
+(expandtypeattribute (incremental_prop_32_0) true)
+(expandtypeattribute (incremental_service_32_0) true)
+(expandtypeattribute (init_32_0) true)
+(expandtypeattribute (init_exec_32_0) true)
+(expandtypeattribute (init_service_status_prop_32_0) true)
+(expandtypeattribute (init_tmpfs_32_0) true)
+(expandtypeattribute (inotify_32_0) true)
+(expandtypeattribute (input_device_32_0) true)
+(expandtypeattribute (input_method_service_32_0) true)
+(expandtypeattribute (input_service_32_0) true)
+(expandtypeattribute (inputflinger_32_0) true)
+(expandtypeattribute (inputflinger_exec_32_0) true)
+(expandtypeattribute (inputflinger_service_32_0) true)
+(expandtypeattribute (install_data_file_32_0) true)
+(expandtypeattribute (installd_32_0) true)
+(expandtypeattribute (installd_exec_32_0) true)
+(expandtypeattribute (installd_service_32_0) true)
+(expandtypeattribute (ion_device_32_0) true)
+(expandtypeattribute (iorap_inode2filename_32_0) true)
+(expandtypeattribute (iorap_inode2filename_exec_32_0) true)
+(expandtypeattribute (iorap_inode2filename_tmpfs_32_0) true)
+(expandtypeattribute (iorap_prefetcherd_32_0) true)
+(expandtypeattribute (iorap_prefetcherd_exec_32_0) true)
+(expandtypeattribute (iorap_prefetcherd_tmpfs_32_0) true)
+(expandtypeattribute (iorapd_32_0) true)
+(expandtypeattribute (iorapd_data_file_32_0) true)
+(expandtypeattribute (iorapd_exec_32_0) true)
+(expandtypeattribute (iorapd_service_32_0) true)
+(expandtypeattribute (iorapd_tmpfs_32_0) true)
+(expandtypeattribute (ipsec_service_32_0) true)
+(expandtypeattribute (iris_service_32_0) true)
+(expandtypeattribute (iris_vendor_data_file_32_0) true)
+(expandtypeattribute (isolated_app_32_0) true)
+(expandtypeattribute (jobscheduler_service_32_0) true)
+(expandtypeattribute (kernel_32_0) true)
+(expandtypeattribute (keychain_data_file_32_0) true)
+(expandtypeattribute (keychord_device_32_0) true)
+(expandtypeattribute (keyguard_config_prop_32_0) true)
+(expandtypeattribute (keystore2_key_contexts_file_32_0) true)
+(expandtypeattribute (keystore_32_0) true)
+(expandtypeattribute (keystore_compat_hal_service_32_0) true)
+(expandtypeattribute (keystore_data_file_32_0) true)
+(expandtypeattribute (keystore_exec_32_0) true)
+(expandtypeattribute (keystore_maintenance_service_32_0) true)
+(expandtypeattribute (keystore_metrics_service_32_0) true)
+(expandtypeattribute (keystore_service_32_0) true)
+(expandtypeattribute (kmsg_debug_device_32_0) true)
+(expandtypeattribute (kmsg_device_32_0) true)
+(expandtypeattribute (labeledfs_32_0) true)
+(expandtypeattribute (launcherapps_service_32_0) true)
+(expandtypeattribute (legacy_permission_service_32_0) true)
+(expandtypeattribute (legacykeystore_service_32_0) true)
+(expandtypeattribute (libc_debug_prop_32_0) true)
+(expandtypeattribute (light_service_32_0) true)
+(expandtypeattribute (linkerconfig_file_32_0) true)
+(expandtypeattribute (llkd_32_0) true)
+(expandtypeattribute (llkd_exec_32_0) true)
+(expandtypeattribute (llkd_prop_32_0) true)
+(expandtypeattribute (lmkd_32_0) true)
+(expandtypeattribute (lmkd_config_prop_32_0) true)
+(expandtypeattribute (lmkd_exec_32_0) true)
+(expandtypeattribute (lmkd_prop_32_0) true)
+(expandtypeattribute (lmkd_socket_32_0) true)
+(expandtypeattribute (location_service_32_0) true)
+(expandtypeattribute (location_time_zone_manager_service_32_0) true)
+(expandtypeattribute (lock_settings_service_32_0) true)
+(expandtypeattribute (log_prop_32_0) true)
+(expandtypeattribute (log_tag_prop_32_0) true)
+(expandtypeattribute (logcat_exec_32_0) true)
+(expandtypeattribute (logd_32_0) true)
+(expandtypeattribute (logd_exec_32_0) true)
+(expandtypeattribute (logd_prop_32_0) true)
+(expandtypeattribute (logd_socket_32_0) true)
+(expandtypeattribute (logdr_socket_32_0) true)
+(expandtypeattribute (logdw_socket_32_0) true)
+(expandtypeattribute (logpersist_32_0) true)
+(expandtypeattribute (logpersistd_logging_prop_32_0) true)
+(expandtypeattribute (loop_control_device_32_0) true)
+(expandtypeattribute (loop_device_32_0) true)
+(expandtypeattribute (looper_stats_service_32_0) true)
+(expandtypeattribute (lowpan_device_32_0) true)
+(expandtypeattribute (lowpan_prop_32_0) true)
+(expandtypeattribute (lowpan_service_32_0) true)
+(expandtypeattribute (lpdump_service_32_0) true)
+(expandtypeattribute (lpdumpd_prop_32_0) true)
+(expandtypeattribute (mac_perms_file_32_0) true)
+(expandtypeattribute (mdns_socket_32_0) true)
+(expandtypeattribute (mdnsd_32_0) true)
+(expandtypeattribute (mdnsd_socket_32_0) true)
+(expandtypeattribute (media_communication_service_32_0) true)
+(expandtypeattribute (media_config_prop_32_0) true)
+(expandtypeattribute (media_data_file_32_0) true)
+(expandtypeattribute (media_metrics_service_32_0) true)
+(expandtypeattribute (media_projection_service_32_0) true)
+(expandtypeattribute (media_router_service_32_0) true)
+(expandtypeattribute (media_rw_data_file_32_0) true)
+(expandtypeattribute (media_session_service_32_0) true)
+(expandtypeattribute (media_variant_prop_32_0) true)
+(expandtypeattribute (mediadrm_config_prop_32_0) true)
+(expandtypeattribute (mediadrmserver_32_0) true)
+(expandtypeattribute (mediadrmserver_exec_32_0) true)
+(expandtypeattribute (mediadrmserver_service_32_0) true)
+(expandtypeattribute (mediaextractor_32_0) true)
+(expandtypeattribute (mediaextractor_exec_32_0) true)
+(expandtypeattribute (mediaextractor_service_32_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_32_0) true)
+(expandtypeattribute (mediametrics_32_0) true)
+(expandtypeattribute (mediametrics_exec_32_0) true)
+(expandtypeattribute (mediametrics_service_32_0) true)
+(expandtypeattribute (mediaprovider_32_0) true)
+(expandtypeattribute (mediaserver_32_0) true)
+(expandtypeattribute (mediaserver_exec_32_0) true)
+(expandtypeattribute (mediaserver_service_32_0) true)
+(expandtypeattribute (mediaserver_tmpfs_32_0) true)
+(expandtypeattribute (mediaswcodec_32_0) true)
+(expandtypeattribute (mediaswcodec_exec_32_0) true)
+(expandtypeattribute (mediatranscoding_service_32_0) true)
+(expandtypeattribute (meminfo_service_32_0) true)
+(expandtypeattribute (memtrackproxy_service_32_0) true)
+(expandtypeattribute (metadata_block_device_32_0) true)
+(expandtypeattribute (metadata_bootstat_file_32_0) true)
+(expandtypeattribute (metadata_file_32_0) true)
+(expandtypeattribute (method_trace_data_file_32_0) true)
+(expandtypeattribute (midi_service_32_0) true)
+(expandtypeattribute (mirror_data_file_32_0) true)
+(expandtypeattribute (misc_block_device_32_0) true)
+(expandtypeattribute (misc_logd_file_32_0) true)
+(expandtypeattribute (misc_user_data_file_32_0) true)
+(expandtypeattribute (mm_events_config_prop_32_0) true)
+(expandtypeattribute (mmc_prop_32_0) true)
+(expandtypeattribute (mnt_expand_file_32_0) true)
+(expandtypeattribute (mnt_media_rw_file_32_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_32_0) true)
+(expandtypeattribute (mnt_pass_through_file_32_0) true)
+(expandtypeattribute (mnt_product_file_32_0) true)
+(expandtypeattribute (mnt_sdcard_file_32_0) true)
+(expandtypeattribute (mnt_user_file_32_0) true)
+(expandtypeattribute (mnt_vendor_file_32_0) true)
+(expandtypeattribute (mock_ota_prop_32_0) true)
+(expandtypeattribute (modprobe_32_0) true)
+(expandtypeattribute (module_sdkextensions_prop_32_0) true)
+(expandtypeattribute (mount_service_32_0) true)
+(expandtypeattribute (mqueue_32_0) true)
+(expandtypeattribute (mtp_32_0) true)
+(expandtypeattribute (mtp_device_32_0) true)
+(expandtypeattribute (mtp_exec_32_0) true)
+(expandtypeattribute (mtpd_socket_32_0) true)
+(expandtypeattribute (music_recognition_service_32_0) true)
+(expandtypeattribute (nativetest_data_file_32_0) true)
+(expandtypeattribute (net_data_file_32_0) true)
+(expandtypeattribute (net_dns_prop_32_0) true)
+(expandtypeattribute (net_radio_prop_32_0) true)
+(expandtypeattribute (netd_32_0) true)
+(expandtypeattribute (netd_exec_32_0) true)
+(expandtypeattribute (netd_listener_service_32_0) true)
+(expandtypeattribute (netd_service_32_0) true)
+(expandtypeattribute (netif_32_0) true)
+(expandtypeattribute (netpolicy_service_32_0) true)
+(expandtypeattribute (netstats_service_32_0) true)
+(expandtypeattribute (netutils_wrapper_32_0) true)
+(expandtypeattribute (netutils_wrapper_exec_32_0) true)
+(expandtypeattribute (network_management_service_32_0) true)
+(expandtypeattribute (network_score_service_32_0) true)
+(expandtypeattribute (network_stack_32_0) true)
+(expandtypeattribute (network_stack_service_32_0) true)
+(expandtypeattribute (network_time_update_service_32_0) true)
+(expandtypeattribute (network_watchlist_data_file_32_0) true)
+(expandtypeattribute (network_watchlist_service_32_0) true)
+(expandtypeattribute (nfc_32_0) true)
+(expandtypeattribute (nfc_data_file_32_0) true)
+(expandtypeattribute (nfc_device_32_0) true)
+(expandtypeattribute (nfc_logs_data_file_32_0) true)
+(expandtypeattribute (nfc_prop_32_0) true)
+(expandtypeattribute (nfc_service_32_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_32_0) true)
+(expandtypeattribute (node_32_0) true)
+(expandtypeattribute (nonplat_service_contexts_file_32_0) true)
+(expandtypeattribute (notification_service_32_0) true)
+(expandtypeattribute (null_device_32_0) true)
+(expandtypeattribute (oem_lock_service_32_0) true)
+(expandtypeattribute (oem_unlock_prop_32_0) true)
+(expandtypeattribute (oemfs_32_0) true)
+(expandtypeattribute (ota_data_file_32_0) true)
+(expandtypeattribute (ota_metadata_file_32_0) true)
+(expandtypeattribute (ota_package_file_32_0) true)
+(expandtypeattribute (ota_prop_32_0) true)
+(expandtypeattribute (otadexopt_service_32_0) true)
+(expandtypeattribute (otapreopt_chroot_32_0) true)
+(expandtypeattribute (overlay_prop_32_0) true)
+(expandtypeattribute (overlay_service_32_0) true)
+(expandtypeattribute (overlayfs_file_32_0) true)
+(expandtypeattribute (owntty_device_32_0) true)
+(expandtypeattribute (pac_proxy_service_32_0) true)
+(expandtypeattribute (package_native_service_32_0) true)
+(expandtypeattribute (package_service_32_0) true)
+(expandtypeattribute (packagemanager_config_prop_32_0) true)
+(expandtypeattribute (packages_list_file_32_0) true)
+(expandtypeattribute (pan_result_prop_32_0) true)
+(expandtypeattribute (password_slot_metadata_file_32_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_32_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_32_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_32_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_display_dir_32_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_32_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_32_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_32_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_32_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_32_0) true)
+(expandtypeattribute (pdx_performance_dir_32_0) true)
+(expandtypeattribute (people_service_32_0) true)
+(expandtypeattribute (perfetto_32_0) true)
+(expandtypeattribute (performanced_32_0) true)
+(expandtypeattribute (performanced_exec_32_0) true)
+(expandtypeattribute (permission_checker_service_32_0) true)
+(expandtypeattribute (permission_service_32_0) true)
+(expandtypeattribute (permissionmgr_service_32_0) true)
+(expandtypeattribute (persist_debug_prop_32_0) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_32_0) true)
+(expandtypeattribute (persistent_data_block_service_32_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_32_0) true)
+(expandtypeattribute (pinner_service_32_0) true)
+(expandtypeattribute (pipefs_32_0) true)
+(expandtypeattribute (platform_app_32_0) true)
+(expandtypeattribute (platform_compat_service_32_0) true)
+(expandtypeattribute (pmsg_device_32_0) true)
+(expandtypeattribute (port_32_0) true)
+(expandtypeattribute (port_device_32_0) true)
+(expandtypeattribute (postinstall_32_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_32_0) true)
+(expandtypeattribute (postinstall_file_32_0) true)
+(expandtypeattribute (postinstall_mnt_dir_32_0) true)
+(expandtypeattribute (power_debug_prop_32_0) true)
+(expandtypeattribute (power_service_32_0) true)
+(expandtypeattribute (powerctl_prop_32_0) true)
+(expandtypeattribute (powerstats_service_32_0) true)
+(expandtypeattribute (ppp_32_0) true)
+(expandtypeattribute (ppp_device_32_0) true)
+(expandtypeattribute (ppp_exec_32_0) true)
+(expandtypeattribute (preloads_data_file_32_0) true)
+(expandtypeattribute (preloads_media_file_32_0) true)
+(expandtypeattribute (prereboot_data_file_32_0) true)
+(expandtypeattribute (print_service_32_0) true)
+(expandtypeattribute (priv_app_32_0) true)
+(expandtypeattribute (privapp_data_file_32_0) true)
+(expandtypeattribute (proc_32_0) true)
+(expandtypeattribute (proc_abi_32_0) true)
+(expandtypeattribute (proc_asound_32_0) true)
+(expandtypeattribute (proc_bluetooth_writable_32_0) true)
+(expandtypeattribute (proc_bootconfig_32_0) true)
+(expandtypeattribute (proc_buddyinfo_32_0) true)
+(expandtypeattribute (proc_cmdline_32_0) true)
+(expandtypeattribute (proc_cpuinfo_32_0) true)
+(expandtypeattribute (proc_dirty_32_0) true)
+(expandtypeattribute (proc_diskstats_32_0) true)
+(expandtypeattribute (proc_drop_caches_32_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_32_0) true)
+(expandtypeattribute (proc_filesystems_32_0) true)
+(expandtypeattribute (proc_fs_verity_32_0) true)
+(expandtypeattribute (proc_hostname_32_0) true)
+(expandtypeattribute (proc_hung_task_32_0) true)
+(expandtypeattribute (proc_interrupts_32_0) true)
+(expandtypeattribute (proc_iomem_32_0) true)
+(expandtypeattribute (proc_kallsyms_32_0) true)
+(expandtypeattribute (proc_keys_32_0) true)
+(expandtypeattribute (proc_kmsg_32_0) true)
+(expandtypeattribute (proc_kpageflags_32_0) true)
+(expandtypeattribute (proc_loadavg_32_0) true)
+(expandtypeattribute (proc_locks_32_0) true)
+(expandtypeattribute (proc_lowmemorykiller_32_0) true)
+(expandtypeattribute (proc_max_map_count_32_0) true)
+(expandtypeattribute (proc_meminfo_32_0) true)
+(expandtypeattribute (proc_min_free_order_shift_32_0) true)
+(expandtypeattribute (proc_misc_32_0) true)
+(expandtypeattribute (proc_modules_32_0) true)
+(expandtypeattribute (proc_mounts_32_0) true)
+(expandtypeattribute (proc_net_32_0) true)
+(expandtypeattribute (proc_net_tcp_udp_32_0) true)
+(expandtypeattribute (proc_overcommit_memory_32_0) true)
+(expandtypeattribute (proc_page_cluster_32_0) true)
+(expandtypeattribute (proc_pagetypeinfo_32_0) true)
+(expandtypeattribute (proc_panic_32_0) true)
+(expandtypeattribute (proc_perf_32_0) true)
+(expandtypeattribute (proc_pid_max_32_0) true)
+(expandtypeattribute (proc_pipe_conf_32_0) true)
+(expandtypeattribute (proc_pressure_cpu_32_0) true)
+(expandtypeattribute (proc_pressure_io_32_0) true)
+(expandtypeattribute (proc_pressure_mem_32_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_32_0) true)
+(expandtypeattribute (proc_qtaguid_stat_32_0) true)
+(expandtypeattribute (proc_random_32_0) true)
+(expandtypeattribute (proc_sched_32_0) true)
+(expandtypeattribute (proc_security_32_0) true)
+(expandtypeattribute (proc_slabinfo_32_0) true)
+(expandtypeattribute (proc_stat_32_0) true)
+(expandtypeattribute (proc_swaps_32_0) true)
+(expandtypeattribute (proc_sysrq_32_0) true)
+(expandtypeattribute (proc_timer_32_0) true)
+(expandtypeattribute (proc_tty_drivers_32_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_32_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_32_0) true)
+(expandtypeattribute (proc_uid_cpupower_32_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_32_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_32_0) true)
+(expandtypeattribute (proc_uid_io_stats_32_0) true)
+(expandtypeattribute (proc_uid_procstat_set_32_0) true)
+(expandtypeattribute (proc_uid_time_in_state_32_0) true)
+(expandtypeattribute (proc_uptime_32_0) true)
+(expandtypeattribute (proc_vendor_sched_32_0) true)
+(expandtypeattribute (proc_version_32_0) true)
+(expandtypeattribute (proc_vmallocinfo_32_0) true)
+(expandtypeattribute (proc_vmstat_32_0) true)
+(expandtypeattribute (proc_zoneinfo_32_0) true)
+(expandtypeattribute (processinfo_service_32_0) true)
+(expandtypeattribute (procstats_service_32_0) true)
+(expandtypeattribute (profman_32_0) true)
+(expandtypeattribute (profman_dump_data_file_32_0) true)
+(expandtypeattribute (profman_exec_32_0) true)
+(expandtypeattribute (properties_device_32_0) true)
+(expandtypeattribute (properties_serial_32_0) true)
+(expandtypeattribute (property_contexts_file_32_0) true)
+(expandtypeattribute (property_data_file_32_0) true)
+(expandtypeattribute (property_info_32_0) true)
+(expandtypeattribute (property_service_version_prop_32_0) true)
+(expandtypeattribute (property_socket_32_0) true)
+(expandtypeattribute (provisioned_prop_32_0) true)
+(expandtypeattribute (pstorefs_32_0) true)
+(expandtypeattribute (ptmx_device_32_0) true)
+(expandtypeattribute (qemu_hw_prop_32_0) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_32_0) true)
+(expandtypeattribute (qtaguid_device_32_0) true)
+(expandtypeattribute (racoon_32_0) true)
+(expandtypeattribute (racoon_exec_32_0) true)
+(expandtypeattribute (racoon_socket_32_0) true)
+(expandtypeattribute (radio_32_0) true)
+(expandtypeattribute (radio_control_prop_32_0) true)
+(expandtypeattribute (radio_core_data_file_32_0) true)
+(expandtypeattribute (radio_data_file_32_0) true)
+(expandtypeattribute (radio_device_32_0) true)
+(expandtypeattribute (radio_prop_32_0) true)
+(expandtypeattribute (radio_service_32_0) true)
+(expandtypeattribute (ram_device_32_0) true)
+(expandtypeattribute (random_device_32_0) true)
+(expandtypeattribute (reboot_readiness_service_32_0) true)
+(expandtypeattribute (rebootescrow_hal_prop_32_0) true)
+(expandtypeattribute (recovery_32_0) true)
+(expandtypeattribute (recovery_block_device_32_0) true)
+(expandtypeattribute (recovery_config_prop_32_0) true)
+(expandtypeattribute (recovery_data_file_32_0) true)
+(expandtypeattribute (recovery_persist_32_0) true)
+(expandtypeattribute (recovery_persist_exec_32_0) true)
+(expandtypeattribute (recovery_refresh_32_0) true)
+(expandtypeattribute (recovery_refresh_exec_32_0) true)
+(expandtypeattribute (recovery_service_32_0) true)
+(expandtypeattribute (recovery_socket_32_0) true)
+(expandtypeattribute (registry_service_32_0) true)
+(expandtypeattribute (remoteprovisioning_service_32_0) true)
+(expandtypeattribute (resourcecache_data_file_32_0) true)
+(expandtypeattribute (restorecon_prop_32_0) true)
+(expandtypeattribute (restrictions_service_32_0) true)
+(expandtypeattribute (retaildemo_prop_32_0) true)
+(expandtypeattribute (rild_debug_socket_32_0) true)
+(expandtypeattribute (rild_socket_32_0) true)
+(expandtypeattribute (ringtone_file_32_0) true)
+(expandtypeattribute (role_service_32_0) true)
+(expandtypeattribute (rollback_service_32_0) true)
+(expandtypeattribute (root_block_device_32_0) true)
+(expandtypeattribute (rootfs_32_0) true)
+(expandtypeattribute (rpmsg_device_32_0) true)
+(expandtypeattribute (rs_32_0) true)
+(expandtypeattribute (rs_exec_32_0) true)
+(expandtypeattribute (rss_hwm_reset_32_0) true)
+(expandtypeattribute (rtc_device_32_0) true)
+(expandtypeattribute (rttmanager_service_32_0) true)
+(expandtypeattribute (runas_32_0) true)
+(expandtypeattribute (runas_app_32_0) true)
+(expandtypeattribute (runas_exec_32_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_32_0) true)
+(expandtypeattribute (runtime_service_32_0) true)
+(expandtypeattribute (safemode_prop_32_0) true)
+(expandtypeattribute (same_process_hal_file_32_0) true)
+(expandtypeattribute (samplingprofiler_service_32_0) true)
+(expandtypeattribute (scheduling_policy_service_32_0) true)
+(expandtypeattribute (sdcard_block_device_32_0) true)
+(expandtypeattribute (sdcardd_32_0) true)
+(expandtypeattribute (sdcardd_exec_32_0) true)
+(expandtypeattribute (sdcardfs_32_0) true)
+(expandtypeattribute (seapp_contexts_file_32_0) true)
+(expandtypeattribute (search_service_32_0) true)
+(expandtypeattribute (search_ui_service_32_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_32_0) true)
+(expandtypeattribute (secure_element_32_0) true)
+(expandtypeattribute (secure_element_device_32_0) true)
+(expandtypeattribute (secure_element_service_32_0) true)
+(expandtypeattribute (securityfs_32_0) true)
+(expandtypeattribute (selinuxfs_32_0) true)
+(expandtypeattribute (sendbug_config_prop_32_0) true)
+(expandtypeattribute (sensor_privacy_service_32_0) true)
+(expandtypeattribute (sensors_device_32_0) true)
+(expandtypeattribute (sensorservice_service_32_0) true)
+(expandtypeattribute (sepolicy_file_32_0) true)
+(expandtypeattribute (serial_device_32_0) true)
+(expandtypeattribute (serial_service_32_0) true)
+(expandtypeattribute (serialno_prop_32_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_32_0) true)
+(expandtypeattribute (service_contexts_file_32_0) true)
+(expandtypeattribute (service_manager_service_32_0) true)
+(expandtypeattribute (service_manager_vndservice_32_0) true)
+(expandtypeattribute (servicediscovery_service_32_0) true)
+(expandtypeattribute (servicemanager_32_0) true)
+(expandtypeattribute (servicemanager_exec_32_0) true)
+(expandtypeattribute (settings_service_32_0) true)
+(expandtypeattribute (sgdisk_32_0) true)
+(expandtypeattribute (sgdisk_exec_32_0) true)
+(expandtypeattribute (shared_relro_32_0) true)
+(expandtypeattribute (shared_relro_file_32_0) true)
+(expandtypeattribute (shell_32_0) true)
+(expandtypeattribute (shell_data_file_32_0) true)
+(expandtypeattribute (shell_exec_32_0) true)
+(expandtypeattribute (shell_prop_32_0) true)
+(expandtypeattribute (shell_test_data_file_32_0) true)
+(expandtypeattribute (shm_32_0) true)
+(expandtypeattribute (shortcut_manager_icons_32_0) true)
+(expandtypeattribute (shortcut_service_32_0) true)
+(expandtypeattribute (simpleperf_32_0) true)
+(expandtypeattribute (simpleperf_app_runner_32_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_32_0) true)
+(expandtypeattribute (slice_service_32_0) true)
+(expandtypeattribute (slideshow_32_0) true)
+(expandtypeattribute (smartspace_service_32_0) true)
+(expandtypeattribute (snapshotctl_log_data_file_32_0) true)
+(expandtypeattribute (snapuserd_socket_32_0) true)
+(expandtypeattribute (soc_prop_32_0) true)
+(expandtypeattribute (socket_device_32_0) true)
+(expandtypeattribute (socket_hook_prop_32_0) true)
+(expandtypeattribute (sockfs_32_0) true)
+(expandtypeattribute (sota_prop_32_0) true)
+(expandtypeattribute (soundtrigger_middleware_service_32_0) true)
+(expandtypeattribute (speech_recognition_service_32_0) true)
+(expandtypeattribute (sqlite_log_prop_32_0) true)
+(expandtypeattribute (staged_install_file_32_0) true)
+(expandtypeattribute (staging_data_file_32_0) true)
+(expandtypeattribute (stats_data_file_32_0) true)
+(expandtypeattribute (statsd_32_0) true)
+(expandtypeattribute (statsd_exec_32_0) true)
+(expandtypeattribute (statsdw_socket_32_0) true)
+(expandtypeattribute (statusbar_service_32_0) true)
+(expandtypeattribute (storage_config_prop_32_0) true)
+(expandtypeattribute (storage_file_32_0) true)
+(expandtypeattribute (storage_stub_file_32_0) true)
+(expandtypeattribute (storaged_service_32_0) true)
+(expandtypeattribute (storagemanager_config_prop_32_0) true)
+(expandtypeattribute (storagestats_service_32_0) true)
+(expandtypeattribute (su_32_0) true)
+(expandtypeattribute (su_exec_32_0) true)
+(expandtypeattribute (super_block_device_32_0) true)
+(expandtypeattribute (surfaceflinger_32_0) true)
+(expandtypeattribute (surfaceflinger_color_prop_32_0) true)
+(expandtypeattribute (surfaceflinger_display_prop_32_0) true)
+(expandtypeattribute (surfaceflinger_prop_32_0) true)
+(expandtypeattribute (surfaceflinger_service_32_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_32_0) true)
+(expandtypeattribute (suspend_prop_32_0) true)
+(expandtypeattribute (swap_block_device_32_0) true)
+(expandtypeattribute (sysfs_32_0) true)
+(expandtypeattribute (sysfs_android_usb_32_0) true)
+(expandtypeattribute (sysfs_batteryinfo_32_0) true)
+(expandtypeattribute (sysfs_block_32_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_32_0) true)
+(expandtypeattribute (sysfs_devfreq_cur_32_0) true)
+(expandtypeattribute (sysfs_devfreq_dir_32_0) true)
+(expandtypeattribute (sysfs_devices_block_32_0) true)
+(expandtypeattribute (sysfs_devices_cs_etm_32_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_32_0) true)
+(expandtypeattribute (sysfs_dm_32_0) true)
+(expandtypeattribute (sysfs_dm_verity_32_0) true)
+(expandtypeattribute (sysfs_dma_heap_32_0) true)
+(expandtypeattribute (sysfs_dmabuf_stats_32_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_32_0) true)
+(expandtypeattribute (sysfs_extcon_32_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_32_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_32_0) true)
+(expandtypeattribute (sysfs_fs_incfs_features_32_0) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_32_0) true)
+(expandtypeattribute (sysfs_hwrandom_32_0) true)
+(expandtypeattribute (sysfs_ion_32_0) true)
+(expandtypeattribute (sysfs_ipv4_32_0) true)
+(expandtypeattribute (sysfs_kernel_notes_32_0) true)
+(expandtypeattribute (sysfs_leds_32_0) true)
+(expandtypeattribute (sysfs_loop_32_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_32_0) true)
+(expandtypeattribute (sysfs_net_32_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_32_0) true)
+(expandtypeattribute (sysfs_power_32_0) true)
+(expandtypeattribute (sysfs_rtc_32_0) true)
+(expandtypeattribute (sysfs_suspend_stats_32_0) true)
+(expandtypeattribute (sysfs_switch_32_0) true)
+(expandtypeattribute (sysfs_thermal_32_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_32_0) true)
+(expandtypeattribute (sysfs_uhid_32_0) true)
+(expandtypeattribute (sysfs_uio_32_0) true)
+(expandtypeattribute (sysfs_usb_32_0) true)
+(expandtypeattribute (sysfs_usermodehelper_32_0) true)
+(expandtypeattribute (sysfs_vendor_sched_32_0) true)
+(expandtypeattribute (sysfs_vibrator_32_0) true)
+(expandtypeattribute (sysfs_wake_lock_32_0) true)
+(expandtypeattribute (sysfs_wakeup_32_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_32_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_32_0) true)
+(expandtypeattribute (sysfs_zram_32_0) true)
+(expandtypeattribute (sysfs_zram_uevent_32_0) true)
+(expandtypeattribute (system_app_32_0) true)
+(expandtypeattribute (system_app_data_file_32_0) true)
+(expandtypeattribute (system_app_service_32_0) true)
+(expandtypeattribute (system_asan_options_file_32_0) true)
+(expandtypeattribute (system_block_device_32_0) true)
+(expandtypeattribute (system_boot_reason_prop_32_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_32_0) true)
+(expandtypeattribute (system_config_service_32_0) true)
+(expandtypeattribute (system_data_file_32_0) true)
+(expandtypeattribute (system_data_root_file_32_0) true)
+(expandtypeattribute (system_event_log_tags_file_32_0) true)
+(expandtypeattribute (system_file_32_0) true)
+(expandtypeattribute (system_group_file_32_0) true)
+(expandtypeattribute (system_jvmti_agent_prop_32_0) true)
+(expandtypeattribute (system_lib_file_32_0) true)
+(expandtypeattribute (system_linker_config_file_32_0) true)
+(expandtypeattribute (system_linker_exec_32_0) true)
+(expandtypeattribute (system_lmk_prop_32_0) true)
+(expandtypeattribute (system_ndebug_socket_32_0) true)
+(expandtypeattribute (system_net_netd_hwservice_32_0) true)
+(expandtypeattribute (system_passwd_file_32_0) true)
+(expandtypeattribute (system_prop_32_0) true)
+(expandtypeattribute (system_seccomp_policy_file_32_0) true)
+(expandtypeattribute (system_security_cacerts_file_32_0) true)
+(expandtypeattribute (system_server_32_0) true)
+(expandtypeattribute (system_server_dumper_service_32_0) true)
+(expandtypeattribute (system_server_tmpfs_32_0) true)
+(expandtypeattribute (system_suspend_control_internal_service_32_0) true)
+(expandtypeattribute (system_suspend_control_service_32_0) true)
+(expandtypeattribute (system_suspend_hwservice_32_0) true)
+(expandtypeattribute (system_trace_prop_32_0) true)
+(expandtypeattribute (system_unsolzygote_socket_32_0) true)
+(expandtypeattribute (system_update_service_32_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_32_0) true)
+(expandtypeattribute (system_wpa_socket_32_0) true)
+(expandtypeattribute (system_zoneinfo_file_32_0) true)
+(expandtypeattribute (systemkeys_data_file_32_0) true)
+(expandtypeattribute (systemsound_config_prop_32_0) true)
+(expandtypeattribute (task_profiles_api_file_32_0) true)
+(expandtypeattribute (task_profiles_file_32_0) true)
+(expandtypeattribute (task_service_32_0) true)
+(expandtypeattribute (tcpdump_exec_32_0) true)
+(expandtypeattribute (tee_32_0) true)
+(expandtypeattribute (tee_data_file_32_0) true)
+(expandtypeattribute (tee_device_32_0) true)
+(expandtypeattribute (telecom_service_32_0) true)
+(expandtypeattribute (telephony_config_prop_32_0) true)
+(expandtypeattribute (telephony_status_prop_32_0) true)
+(expandtypeattribute (test_boot_reason_prop_32_0) true)
+(expandtypeattribute (test_harness_prop_32_0) true)
+(expandtypeattribute (testharness_service_32_0) true)
+(expandtypeattribute (tethering_service_32_0) true)
+(expandtypeattribute (textclassification_service_32_0) true)
+(expandtypeattribute (textclassifier_data_file_32_0) true)
+(expandtypeattribute (textservices_service_32_0) true)
+(expandtypeattribute (texttospeech_service_32_0) true)
+(expandtypeattribute (theme_prop_32_0) true)
+(expandtypeattribute (thermal_service_32_0) true)
+(expandtypeattribute (time_prop_32_0) true)
+(expandtypeattribute (timedetector_service_32_0) true)
+(expandtypeattribute (timezone_service_32_0) true)
+(expandtypeattribute (timezonedetector_service_32_0) true)
+(expandtypeattribute (tmpfs_32_0) true)
+(expandtypeattribute (tombstone_config_prop_32_0) true)
+(expandtypeattribute (tombstone_data_file_32_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_32_0) true)
+(expandtypeattribute (tombstoned_32_0) true)
+(expandtypeattribute (tombstoned_crash_socket_32_0) true)
+(expandtypeattribute (tombstoned_exec_32_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_32_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_32_0) true)
+(expandtypeattribute (toolbox_32_0) true)
+(expandtypeattribute (toolbox_exec_32_0) true)
+(expandtypeattribute (trace_data_file_32_0) true)
+(expandtypeattribute (traced_32_0) true)
+(expandtypeattribute (traced_consumer_socket_32_0) true)
+(expandtypeattribute (traced_enabled_prop_32_0) true)
+(expandtypeattribute (traced_lazy_prop_32_0) true)
+(expandtypeattribute (traced_perf_32_0) true)
+(expandtypeattribute (traced_perf_socket_32_0) true)
+(expandtypeattribute (traced_probes_32_0) true)
+(expandtypeattribute (traced_producer_socket_32_0) true)
+(expandtypeattribute (traced_tmpfs_32_0) true)
+(expandtypeattribute (traceur_app_32_0) true)
+(expandtypeattribute (translation_service_32_0) true)
+(expandtypeattribute (trust_service_32_0) true)
+(expandtypeattribute (tty_device_32_0) true)
+(expandtypeattribute (tun_device_32_0) true)
+(expandtypeattribute (tv_input_service_32_0) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_32_0) true)
+(expandtypeattribute (tzdatacheck_32_0) true)
+(expandtypeattribute (tzdatacheck_exec_32_0) true)
+(expandtypeattribute (ueventd_32_0) true)
+(expandtypeattribute (ueventd_tmpfs_32_0) true)
+(expandtypeattribute (uhid_device_32_0) true)
+(expandtypeattribute (uimode_service_32_0) true)
+(expandtypeattribute (uio_device_32_0) true)
+(expandtypeattribute (uncrypt_32_0) true)
+(expandtypeattribute (uncrypt_exec_32_0) true)
+(expandtypeattribute (uncrypt_socket_32_0) true)
+(expandtypeattribute (unencrypted_data_file_32_0) true)
+(expandtypeattribute (unlabeled_32_0) true)
+(expandtypeattribute (untrusted_app_25_32_0) true)
+(expandtypeattribute (untrusted_app_27_32_0) true)
+(expandtypeattribute (untrusted_app_29_32_0) true)
+(expandtypeattribute (untrusted_app_32_0) true)
+(expandtypeattribute (update_engine_32_0) true)
+(expandtypeattribute (update_engine_data_file_32_0) true)
+(expandtypeattribute (update_engine_exec_32_0) true)
+(expandtypeattribute (update_engine_log_data_file_32_0) true)
+(expandtypeattribute (update_engine_service_32_0) true)
+(expandtypeattribute (update_engine_stable_service_32_0) true)
+(expandtypeattribute (update_verifier_32_0) true)
+(expandtypeattribute (update_verifier_exec_32_0) true)
+(expandtypeattribute (updatelock_service_32_0) true)
+(expandtypeattribute (uri_grants_service_32_0) true)
+(expandtypeattribute (usagestats_service_32_0) true)
+(expandtypeattribute (usb_config_prop_32_0) true)
+(expandtypeattribute (usb_control_prop_32_0) true)
+(expandtypeattribute (usb_device_32_0) true)
+(expandtypeattribute (usb_prop_32_0) true)
+(expandtypeattribute (usb_serial_device_32_0) true)
+(expandtypeattribute (usb_service_32_0) true)
+(expandtypeattribute (usbaccessory_device_32_0) true)
+(expandtypeattribute (usbd_32_0) true)
+(expandtypeattribute (usbd_exec_32_0) true)
+(expandtypeattribute (usbfs_32_0) true)
+(expandtypeattribute (use_memfd_prop_32_0) true)
+(expandtypeattribute (user_profile_data_file_32_0) true)
+(expandtypeattribute (user_profile_root_file_32_0) true)
+(expandtypeattribute (user_service_32_0) true)
+(expandtypeattribute (userdata_block_device_32_0) true)
+(expandtypeattribute (userdata_sysdev_32_0) true)
+(expandtypeattribute (usermodehelper_32_0) true)
+(expandtypeattribute (userspace_reboot_config_prop_32_0) true)
+(expandtypeattribute (userspace_reboot_exported_prop_32_0) true)
+(expandtypeattribute (userspace_reboot_metadata_file_32_0) true)
+(expandtypeattribute (uwb_service_32_0) true)
+(expandtypeattribute (vcn_management_service_32_0) true)
+(expandtypeattribute (vd_device_32_0) true)
+(expandtypeattribute (vdc_32_0) true)
+(expandtypeattribute (vdc_exec_32_0) true)
+(expandtypeattribute (vehicle_hal_prop_32_0) true)
+(expandtypeattribute (vendor_apex_file_32_0) true)
+(expandtypeattribute (vendor_app_file_32_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_32_0) true)
+(expandtypeattribute (vendor_configs_file_32_0) true)
+(expandtypeattribute (vendor_data_file_32_0) true)
+(expandtypeattribute (vendor_default_prop_32_0) true)
+(expandtypeattribute (vendor_file_32_0) true)
+(expandtypeattribute (vendor_framework_file_32_0) true)
+(expandtypeattribute (vendor_hal_file_32_0) true)
+(expandtypeattribute (vendor_idc_file_32_0) true)
+(expandtypeattribute (vendor_init_32_0) true)
+(expandtypeattribute (vendor_kernel_modules_32_0) true)
+(expandtypeattribute (vendor_keychars_file_32_0) true)
+(expandtypeattribute (vendor_keylayout_file_32_0) true)
+(expandtypeattribute (vendor_misc_writer_32_0) true)
+(expandtypeattribute (vendor_misc_writer_exec_32_0) true)
+(expandtypeattribute (vendor_modprobe_32_0) true)
+(expandtypeattribute (vendor_overlay_file_32_0) true)
+(expandtypeattribute (vendor_public_framework_file_32_0) true)
+(expandtypeattribute (vendor_public_lib_file_32_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_32_0) true)
+(expandtypeattribute (vendor_service_contexts_file_32_0) true)
+(expandtypeattribute (vendor_shell_32_0) true)
+(expandtypeattribute (vendor_shell_exec_32_0) true)
+(expandtypeattribute (vendor_socket_hook_prop_32_0) true)
+(expandtypeattribute (vendor_task_profiles_file_32_0) true)
+(expandtypeattribute (vendor_toolbox_exec_32_0) true)
+(expandtypeattribute (vfat_32_0) true)
+(expandtypeattribute (vibrator_manager_service_32_0) true)
+(expandtypeattribute (vibrator_service_32_0) true)
+(expandtypeattribute (video_device_32_0) true)
+(expandtypeattribute (virtual_ab_prop_32_0) true)
+(expandtypeattribute (virtual_touchpad_32_0) true)
+(expandtypeattribute (virtual_touchpad_exec_32_0) true)
+(expandtypeattribute (virtual_touchpad_service_32_0) true)
+(expandtypeattribute (virtualization_service_32_0) true)
+(expandtypeattribute (vndbinder_device_32_0) true)
+(expandtypeattribute (vndk_prop_32_0) true)
+(expandtypeattribute (vndk_sp_file_32_0) true)
+(expandtypeattribute (vndservice_contexts_file_32_0) true)
+(expandtypeattribute (vndservicemanager_32_0) true)
+(expandtypeattribute (voiceinteraction_service_32_0) true)
+(expandtypeattribute (vold_32_0) true)
+(expandtypeattribute (vold_config_prop_32_0) true)
+(expandtypeattribute (vold_data_file_32_0) true)
+(expandtypeattribute (vold_device_32_0) true)
+(expandtypeattribute (vold_exec_32_0) true)
+(expandtypeattribute (vold_metadata_file_32_0) true)
+(expandtypeattribute (vold_post_fs_data_prop_32_0) true)
+(expandtypeattribute (vold_prepare_subdirs_32_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_32_0) true)
+(expandtypeattribute (vold_prop_32_0) true)
+(expandtypeattribute (vold_service_32_0) true)
+(expandtypeattribute (vold_status_prop_32_0) true)
+(expandtypeattribute (vpn_data_file_32_0) true)
+(expandtypeattribute (vpn_management_service_32_0) true)
+(expandtypeattribute (vr_hwc_32_0) true)
+(expandtypeattribute (vr_hwc_exec_32_0) true)
+(expandtypeattribute (vr_hwc_service_32_0) true)
+(expandtypeattribute (vr_manager_service_32_0) true)
+(expandtypeattribute (vrflinger_vsync_service_32_0) true)
+(expandtypeattribute (vts_config_prop_32_0) true)
+(expandtypeattribute (vts_status_prop_32_0) true)
+(expandtypeattribute (wallpaper_file_32_0) true)
+(expandtypeattribute (wallpaper_service_32_0) true)
+(expandtypeattribute (watchdog_device_32_0) true)
+(expandtypeattribute (watchdog_metadata_file_32_0) true)
+(expandtypeattribute (watchdogd_32_0) true)
+(expandtypeattribute (watchdogd_exec_32_0) true)
+(expandtypeattribute (webview_zygote_32_0) true)
+(expandtypeattribute (webview_zygote_exec_32_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_32_0) true)
+(expandtypeattribute (webviewupdate_service_32_0) true)
+(expandtypeattribute (wifi_config_prop_32_0) true)
+(expandtypeattribute (wifi_data_file_32_0) true)
+(expandtypeattribute (wifi_hal_prop_32_0) true)
+(expandtypeattribute (wifi_key_32_0) true)
+(expandtypeattribute (wifi_log_prop_32_0) true)
+(expandtypeattribute (wifi_prop_32_0) true)
+(expandtypeattribute (wifi_service_32_0) true)
+(expandtypeattribute (wifiaware_service_32_0) true)
+(expandtypeattribute (wificond_32_0) true)
+(expandtypeattribute (wificond_exec_32_0) true)
+(expandtypeattribute (wifinl80211_service_32_0) true)
+(expandtypeattribute (wifip2p_service_32_0) true)
+(expandtypeattribute (wifiscanner_service_32_0) true)
+(expandtypeattribute (window_service_32_0) true)
+(expandtypeattribute (wpa_socket_32_0) true)
+(expandtypeattribute (wpantund_32_0) true)
+(expandtypeattribute (wpantund_exec_32_0) true)
+(expandtypeattribute (wpantund_service_32_0) true)
+(expandtypeattribute (zero_device_32_0) true)
+(expandtypeattribute (zoneinfo_data_file_32_0) true)
+(expandtypeattribute (zram_config_prop_32_0) true)
+(expandtypeattribute (zram_control_prop_32_0) true)
+(expandtypeattribute (zygote_32_0) true)
+(expandtypeattribute (zygote_config_prop_32_0) true)
+(expandtypeattribute (zygote_exec_32_0) true)
+(expandtypeattribute (zygote_socket_32_0) true)
+(expandtypeattribute (zygote_tmpfs_32_0) true)
+(typeattributeset DockObserver_service_32_0 (DockObserver_service))
+(typeattributeset IProxyService_service_32_0 (IProxyService_service))
+(typeattributeset aac_drc_prop_32_0 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_32_0 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_32_0 (ab_update_gki_prop))
+(typeattributeset accessibility_service_32_0 (accessibility_service))
+(typeattributeset account_service_32_0 (account_service))
+(typeattributeset activity_service_32_0 (activity_service))
+(typeattributeset activity_task_service_32_0 (activity_task_service))
+(typeattributeset adb_data_file_32_0 (adb_data_file))
+(typeattributeset adb_keys_file_32_0 (adb_keys_file))
+(typeattributeset adb_service_32_0 (adb_service))
+(typeattributeset adbd_32_0 (adbd))
+(typeattributeset adbd_config_prop_32_0 (adbd_config_prop))
+(typeattributeset adbd_exec_32_0 (adbd_exec))
+(typeattributeset adbd_socket_32_0 (adbd_socket))
+(typeattributeset aidl_lazy_test_server_32_0 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_32_0 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_32_0 (aidl_lazy_test_service))
+(typeattributeset alarm_service_32_0 (alarm_service))
+(typeattributeset anr_data_file_32_0 (anr_data_file))
+(typeattributeset apc_service_32_0 (apc_service))
+(typeattributeset apex_appsearch_data_file_32_0 (apex_appsearch_data_file apex_system_server_data_file))
+(typeattributeset apex_data_file_32_0 (apex_data_file))
+(typeattributeset apex_info_file_32_0 (apex_info_file))
+(typeattributeset apex_metadata_file_32_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_32_0 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_32_0 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_32_0 (apex_ota_reserved_file))
+(typeattributeset apex_permission_data_file_32_0 (apex_permission_data_file apex_system_server_data_file))
+(typeattributeset apex_rollback_data_file_32_0 (apex_rollback_data_file))
+(typeattributeset apex_scheduling_data_file_32_0 (apex_scheduling_data_file apex_system_server_data_file))
+(typeattributeset apex_service_32_0 (apex_service))
+(typeattributeset apex_wifi_data_file_32_0 (apex_wifi_data_file apex_system_server_data_file))
+(typeattributeset apexd_32_0 (apexd))
+(typeattributeset apexd_config_prop_32_0 (apexd_config_prop))
+(typeattributeset apexd_exec_32_0 (apexd_exec))
+(typeattributeset apexd_prop_32_0 (apexd_prop))
+(typeattributeset apk_data_file_32_0 (apk_data_file))
+(typeattributeset apk_private_data_file_32_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_32_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_32_0 (apk_tmp_file))
+(typeattributeset apk_verity_prop_32_0 (apk_verity_prop))
+(typeattributeset app_binding_service_32_0 (app_binding_service))
+(typeattributeset app_data_file_32_0 (app_data_file))
+(typeattributeset app_fuse_file_32_0 (app_fuse_file))
+(typeattributeset app_fusefs_32_0 (app_fusefs))
+(typeattributeset app_hibernation_service_32_0 (app_hibernation_service))
+(typeattributeset app_integrity_service_32_0 (app_integrity_service))
+(typeattributeset app_prediction_service_32_0 (app_prediction_service))
+(typeattributeset app_search_service_32_0 (app_search_service))
+(typeattributeset app_zygote_32_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_32_0 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_32_0 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_32_0 (appdomain_tmpfs))
+(typeattributeset appops_service_32_0 (appops_service))
+(typeattributeset appwidget_service_32_0 (appwidget_service))
+(typeattributeset arm64_memtag_prop_32_0 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_32_0 (art_apex_dir))
+(typeattributeset asec_apk_file_32_0 (asec_apk_file))
+(typeattributeset asec_image_file_32_0 (asec_image_file))
+(typeattributeset asec_public_file_32_0 (asec_public_file))
+(typeattributeset ashmem_device_32_0 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_32_0 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_32_0 (assetatlas_service))
+(typeattributeset atrace_32_0 (atrace))
+(typeattributeset audio_config_prop_32_0 (audio_config_prop))
+(typeattributeset audio_data_file_32_0 (audio_data_file))
+(typeattributeset audio_device_32_0 (audio_device))
+(typeattributeset audio_prop_32_0 (audio_prop))
+(typeattributeset audio_service_32_0 (audio_service))
+(typeattributeset audiohal_data_file_32_0 (audiohal_data_file))
+(typeattributeset audioserver_32_0 (audioserver))
+(typeattributeset audioserver_data_file_32_0 (audioserver_data_file))
+(typeattributeset audioserver_service_32_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_32_0 (audioserver_tmpfs))
+(typeattributeset auth_service_32_0 (auth_service))
+(typeattributeset authorization_service_32_0 (authorization_service))
+(typeattributeset autofill_service_32_0 (autofill_service))
+(typeattributeset backup_data_file_32_0 (backup_data_file))
+(typeattributeset backup_service_32_0 (backup_service))
+(typeattributeset battery_service_32_0 (battery_service))
+(typeattributeset batteryproperties_service_32_0 (batteryproperties_service))
+(typeattributeset batterystats_service_32_0 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_32_0 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_32_0 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_32_0 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_32_0 (binder_calls_stats_service))
+(typeattributeset binder_device_32_0 (binder_device))
+(typeattributeset binderfs_32_0 (binderfs))
+(typeattributeset binderfs_logs_32_0 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_32_0 (binderfs_logs_proc))
+(typeattributeset binfmt_miscfs_32_0 (binfmt_miscfs))
+(typeattributeset biometric_service_32_0 (biometric_service))
+(typeattributeset blkid_32_0 (blkid))
+(typeattributeset blkid_untrusted_32_0 (blkid_untrusted))
+(typeattributeset blob_store_service_32_0 (blob_store_service))
+(typeattributeset block_device_32_0 (block_device))
+(typeattributeset bluetooth_32_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_32_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_32_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_data_file_32_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_32_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_32_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_32_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_32_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_32_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_32_0 (bluetooth_socket))
+(typeattributeset boot_block_device_32_0 (boot_block_device))
+(typeattributeset boot_status_prop_32_0 (boot_status_prop))
+(typeattributeset bootanim_32_0 (bootanim))
+(typeattributeset bootanim_config_prop_32_0 (bootanim_config_prop))
+(typeattributeset bootanim_exec_32_0 (bootanim_exec))
+(typeattributeset bootanim_system_prop_32_0 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_32_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_32_0 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_32_0 (bootloader_prop))
+(typeattributeset bootstat_32_0 (bootstat))
+(typeattributeset bootstat_data_file_32_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_32_0 (bootstat_exec))
+(typeattributeset boottime_prop_32_0 (boottime_prop))
+(typeattributeset boottime_public_prop_32_0 (boottime_public_prop))
+(typeattributeset boottrace_data_file_32_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_32_0 (bpf_progs_loaded_prop))
+(typeattributeset bq_config_prop_32_0 (bq_config_prop))
+(typeattributeset broadcastradio_service_32_0 (broadcastradio_service))
+(typeattributeset bufferhubd_32_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_32_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_32_0 (bugreport_service))
+(typeattributeset build_bootimage_prop_32_0 (build_bootimage_prop))
+(typeattributeset build_config_prop_32_0 (build_config_prop))
+(typeattributeset build_odm_prop_32_0 (build_odm_prop))
+(typeattributeset build_prop_32_0 (build_prop))
+(typeattributeset build_vendor_prop_32_0 (build_vendor_prop))
+(typeattributeset cache_backup_file_32_0 (cache_backup_file))
+(typeattributeset cache_block_device_32_0 (cache_block_device))
+(typeattributeset cache_file_32_0 (cache_file))
+(typeattributeset cache_private_backup_file_32_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_32_0 (cache_recovery_file))
+(typeattributeset cacheinfo_service_32_0 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_32_0 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_32_0 (camera_calibration_prop))
+(typeattributeset camera_config_prop_32_0 (camera_config_prop))
+(typeattributeset camera_data_file_32_0 (camera_data_file))
+(typeattributeset camera_device_32_0 (camera_device))
+(typeattributeset cameraproxy_service_32_0 (cameraproxy_service))
+(typeattributeset cameraserver_32_0 (cameraserver))
+(typeattributeset cameraserver_exec_32_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_32_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_32_0 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_32_0 (camerax_extensions_prop))
+(typeattributeset cgroup_32_0 (cgroup))
+(typeattributeset cgroup_desc_api_file_32_0 (cgroup_desc_api_file))
+(typeattributeset cgroup_desc_file_32_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_32_0 (cgroup_rc_file))
+(typeattributeset cgroup_v2_32_0 (cgroup_v2))
+(typeattributeset charger_32_0 (charger))
+(typeattributeset charger_config_prop_32_0 (charger_config_prop))
+(typeattributeset charger_exec_32_0 (charger_exec))
+(typeattributeset charger_prop_32_0 (charger_prop))
+(typeattributeset charger_status_prop_32_0 (charger_status_prop))
+(typeattributeset clipboard_service_32_0 (clipboard_service))
+(typeattributeset codec2_config_prop_32_0 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_32_0 (cold_boot_done_prop))
+(typeattributeset color_display_service_32_0 (color_display_service))
+(typeattributeset companion_device_service_32_0 (companion_device_service))
+(typeattributeset config_prop_32_0 (config_prop))
+(typeattributeset configfs_32_0 (configfs))
+(typeattributeset connectivity_service_32_0 (connectivity_service))
+(typeattributeset connmetrics_service_32_0 (connmetrics_service))
+(typeattributeset console_device_32_0 (console_device))
+(typeattributeset consumer_ir_service_32_0 (consumer_ir_service))
+(typeattributeset content_capture_service_32_0 (content_capture_service))
+(typeattributeset content_service_32_0 (content_service))
+(typeattributeset content_suggestions_service_32_0 (content_suggestions_service))
+(typeattributeset contexthub_service_32_0 (contexthub_service))
+(typeattributeset coredump_file_32_0 (coredump_file))
+(typeattributeset country_detector_service_32_0 (country_detector_service))
+(typeattributeset coverage_service_32_0 (coverage_service))
+(typeattributeset cppreopt_prop_32_0 (cppreopt_prop))
+(typeattributeset cpu_variant_prop_32_0 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_32_0 (cpuinfo_service))
+(typeattributeset crash_dump_32_0 (crash_dump))
+(typeattributeset crash_dump_exec_32_0 (crash_dump_exec))
+(typeattributeset credstore_32_0 (credstore))
+(typeattributeset credstore_data_file_32_0 (credstore_data_file))
+(typeattributeset credstore_exec_32_0 (credstore_exec))
+(typeattributeset credstore_service_32_0 (credstore_service))
+(typeattributeset crossprofileapps_service_32_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_32_0 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_32_0 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_32_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_32_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_32_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_32_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_32_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_32_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_32_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_32_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_32_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_32_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_32_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_32_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_32_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_32_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_32_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_32_0 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_32_0 (dalvik_config_prop))
+(typeattributeset dalvik_prop_32_0 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_32_0 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_32_0 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_32_0 (dataloader_manager_service))
+(typeattributeset dbinfo_service_32_0 (dbinfo_service))
+(typeattributeset dck_prop_32_0 (dck_prop))
+(typeattributeset debug_prop_32_0 (debug_prop))
+(typeattributeset debugfs_32_0 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_32_0 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_32_0 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_32_0 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_32_0 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_32_0 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_32_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_32_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_32_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_32_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_32_0 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_32_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_32_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_32_0 (debuggerd_prop))
+(typeattributeset default_android_hwservice_32_0 (default_android_hwservice))
+(typeattributeset default_android_service_32_0 (default_android_service))
+(typeattributeset default_android_vndservice_32_0 (default_android_vndservice))
+(typeattributeset default_prop_32_0 (default_prop))
+(typeattributeset dev_cpu_variant_32_0 (dev_cpu_variant))
+(typeattributeset device_32_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_32_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_32_0 (device_config_boot_count_prop))
+(typeattributeset device_config_input_native_boot_prop_32_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_32_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_32_0 (device_config_netd_native_prop))
+(typeattributeset device_config_reset_performed_prop_32_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_32_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_32_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_32_0 (device_config_service))
+(typeattributeset device_identifiers_service_32_0 (device_identifiers_service))
+(typeattributeset device_logging_prop_32_0 (device_logging_prop))
+(typeattributeset device_policy_service_32_0 (device_policy_service))
+(typeattributeset device_state_service_32_0 (device_state_service))
+(typeattributeset deviceidle_service_32_0 (deviceidle_service))
+(typeattributeset devicestoragemonitor_service_32_0 (devicestoragemonitor_service))
+(typeattributeset devpts_32_0 (devpts))
+(typeattributeset dhcp_32_0 (dhcp))
+(typeattributeset dhcp_data_file_32_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_32_0 (dhcp_exec))
+(typeattributeset dhcp_prop_32_0 (dhcp_prop))
+(typeattributeset diskstats_service_32_0 (diskstats_service))
+(typeattributeset display_service_32_0 (display_service))
+(typeattributeset dm_device_32_0 (dm_device))
+(typeattributeset dm_user_device_32_0 (dm_user_device))
+(typeattributeset dmabuf_heap_device_32_0 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_32_0 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_32_0 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_32_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_32_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_32_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_32_0 (dnsresolver_service))
+(typeattributeset domain_verification_service_32_0 (domain_verification_service))
+(typeattributeset dreams_service_32_0 (dreams_service))
+(typeattributeset drm_data_file_32_0 (drm_data_file))
+(typeattributeset drm_service_config_prop_32_0 (drm_service_config_prop))
+(typeattributeset drmserver_32_0 (drmserver))
+(typeattributeset drmserver_exec_32_0 (drmserver_exec))
+(typeattributeset drmserver_service_32_0 (drmserver_service))
+(typeattributeset drmserver_socket_32_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_32_0 (dropbox_data_file))
+(typeattributeset dropbox_service_32_0 (dropbox_service))
+(typeattributeset dumpstate_32_0 (dumpstate))
+(typeattributeset dumpstate_exec_32_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_32_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_32_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_32_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_32_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_32_0 (dynamic_system_prop))
+(typeattributeset e2fs_32_0 (e2fs))
+(typeattributeset e2fs_exec_32_0 (e2fs_exec))
+(typeattributeset efs_file_32_0 (efs_file))
+(typeattributeset emergency_affordance_service_32_0 (emergency_affordance_service))
+(typeattributeset ephemeral_app_32_0 (ephemeral_app))
+(typeattributeset ethernet_service_32_0 (ethernet_service))
+(typeattributeset exfat_32_0 (exfat))
+(typeattributeset exported3_system_prop_32_0 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_32_0 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_32_0 (exported_camera_prop))
+(typeattributeset exported_config_prop_32_0 (exported_config_prop))
+(typeattributeset exported_default_prop_32_0 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_32_0 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_32_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_32_0 (exported_pm_prop))
+(typeattributeset exported_secure_prop_32_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_32_0 (exported_system_prop))
+(typeattributeset external_vibrator_service_32_0 (external_vibrator_service))
+(typeattributeset face_service_32_0 (face_service))
+(typeattributeset face_vendor_data_file_32_0 (face_vendor_data_file))
+(typeattributeset fastbootd_32_0 (fastbootd))
+(typeattributeset ffs_config_prop_32_0 (ffs_config_prop))
+(typeattributeset ffs_control_prop_32_0 (ffs_control_prop))
+(typeattributeset file_contexts_file_32_0 (file_contexts_file))
+(typeattributeset file_integrity_service_32_0 (file_integrity_service))
+(typeattributeset fingerprint_prop_32_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_32_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_32_0 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_32_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_32_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_32_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_32_0 (fingerprintd_service))
+(typeattributeset firstboot_prop_32_0 (firstboot_prop))
+(typeattributeset flags_health_check_32_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_32_0 (flags_health_check_exec))
+(typeattributeset font_service_32_0 (font_service))
+(typeattributeset framework_watchdog_config_prop_32_0 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_32_0 (frp_block_device))
+(typeattributeset fs_bpf_32_0 (fs_bpf))
+(typeattributeset fs_bpf_tethering_32_0 (fs_bpf_tethering))
+(typeattributeset fsck_32_0 (fsck))
+(typeattributeset fsck_exec_32_0 (fsck_exec))
+(typeattributeset fsck_untrusted_32_0 (fsck_untrusted))
+(typeattributeset fscklogs_32_0 (fscklogs))
+(typeattributeset functionfs_32_0 (functionfs))
+(typeattributeset fuse_32_0 (fuse))
+(typeattributeset fuse_device_32_0 (fuse_device))
+(typeattributeset fusectlfs_32_0 (fusectlfs))
+(typeattributeset fwk_automotive_display_hwservice_32_0 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_bufferhub_hwservice_32_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_32_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_32_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_32_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_32_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_32_0 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_32_0 (fwk_stats_service))
+(typeattributeset fwmarkd_socket_32_0 (fwmarkd_socket))
+(typeattributeset game_service_32_0 (game_service))
+(typeattributeset gatekeeper_data_file_32_0 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_32_0 (gatekeeper_service))
+(typeattributeset gatekeeperd_32_0 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_32_0 (gatekeeperd_exec))
+(typeattributeset gfxinfo_service_32_0 (gfxinfo_service))
+(typeattributeset gmscore_app_32_0 (gmscore_app))
+(typeattributeset gnss_device_32_0 (gnss_device))
+(typeattributeset gnss_time_update_service_32_0 (gnss_time_update_service))
+(typeattributeset gps_control_32_0 (gps_control))
+(typeattributeset gpu_device_32_0 (gpu_device))
+(typeattributeset gpu_service_32_0 (gpu_service))
+(typeattributeset gpuservice_32_0 (gpuservice))
+(typeattributeset graphics_config_prop_32_0 (graphics_config_prop))
+(typeattributeset graphics_device_32_0 (graphics_device))
+(typeattributeset graphicsstats_service_32_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_32_0 (gsi_data_file))
+(typeattributeset gsi_metadata_file_32_0 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_32_0 (gsi_public_metadata_file))
+(typeattributeset hal_atrace_hwservice_32_0 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_32_0 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_32_0 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_32_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_32_0 (hal_audiocontrol_service))
+(typeattributeset hal_authsecret_hwservice_32_0 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_32_0 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_32_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_32_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_32_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_32_0 (hal_camera_hwservice))
+(typeattributeset hal_can_bus_hwservice_32_0 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_32_0 (hal_can_controller_hwservice))
+(typeattributeset hal_cas_hwservice_32_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_32_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_32_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_32_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_32_0 (hal_contexthub_hwservice))
+(typeattributeset hal_drm_hwservice_32_0 (hal_drm_hwservice))
+(typeattributeset hal_dumpstate_config_prop_32_0 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_32_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_evs_hwservice_32_0 (hal_evs_hwservice))
+(typeattributeset hal_face_hwservice_32_0 (hal_face_hwservice))
+(typeattributeset hal_face_service_32_0 (hal_face_service))
+(typeattributeset hal_fingerprint_hwservice_32_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_32_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_32_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_32_0 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_32_0 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_32_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_composer_hwservice_32_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_32_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_mapper_hwservice_32_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_32_0 (hal_health_hwservice))
+(typeattributeset hal_health_storage_hwservice_32_0 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_32_0 (hal_health_storage_service))
+(typeattributeset hal_identity_service_32_0 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_32_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_instrumentation_prop_32_0 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_32_0 (hal_ir_hwservice))
+(typeattributeset hal_keymaster_hwservice_32_0 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_32_0 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_32_0 (hal_light_hwservice))
+(typeattributeset hal_light_service_32_0 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_32_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_32_0 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_32_0 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_32_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_32_0 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_32_0 (hal_nfc_hwservice))
+(typeattributeset hal_oemlock_hwservice_32_0 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_32_0 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_32_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_32_0 (hal_power_hwservice))
+(typeattributeset hal_power_service_32_0 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_32_0 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_32_0 (hal_power_stats_service))
+(typeattributeset hal_rebootescrow_service_32_0 (hal_rebootescrow_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_32_0 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_32_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_32_0 (hal_secure_element_hwservice))
+(typeattributeset hal_secureclock_service_32_0 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_32_0 (hal_sensors_hwservice))
+(typeattributeset hal_sharedsecret_service_32_0 (hal_sharedsecret_service))
+(typeattributeset hal_telephony_hwservice_32_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_32_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_32_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_32_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_32_0 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_tuner_hwservice_32_0 (hal_tv_tuner_hwservice))
+(typeattributeset hal_usb_gadget_hwservice_32_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_32_0 (hal_usb_hwservice))
+(typeattributeset hal_vehicle_hwservice_32_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vibrator_hwservice_32_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_32_0 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_32_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_32_0 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_32_0 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_32_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hwservice_32_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_32_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hardware_properties_service_32_0 (hardware_properties_service))
+(typeattributeset hardware_service_32_0 (hardware_service))
+(typeattributeset hci_attach_dev_32_0 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_32_0 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_32_0 (hdmi_control_service))
+(typeattributeset healthd_32_0 (healthd))
+(typeattributeset healthd_exec_32_0 (healthd_exec))
+(typeattributeset heapdump_data_file_32_0 (heapdump_data_file))
+(typeattributeset heapprofd_32_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_32_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_32_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_32_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_32_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_32_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_32_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_32_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_32_0 (hidl_token_hwservice))
+(typeattributeset hint_service_32_0 (hint_service))
+(typeattributeset hw_random_device_32_0 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_32_0 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_32_0 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_32_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_32_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_32_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_32_0 (hwservicemanager_prop))
+(typeattributeset hypervisor_prop_32_0 (hypervisor_prop))
+(typeattributeset icon_file_32_0 (icon_file))
+(typeattributeset idmap_32_0 (idmap))
+(typeattributeset idmap_exec_32_0 (idmap_exec))
+(typeattributeset idmap_service_32_0 (idmap_service))
+(typeattributeset iio_device_32_0 (iio_device))
+(typeattributeset imms_service_32_0 (imms_service))
+(typeattributeset incident_32_0 (incident))
+(typeattributeset incident_data_file_32_0 (incident_data_file))
+(typeattributeset incident_helper_32_0 (incident_helper))
+(typeattributeset incident_service_32_0 (incident_service))
+(typeattributeset incidentd_32_0 (incidentd))
+(typeattributeset incremental_control_file_32_0 (incremental_control_file))
+(typeattributeset incremental_prop_32_0 (incremental_prop))
+(typeattributeset incremental_service_32_0 (incremental_service))
+(typeattributeset init_32_0 (init))
+(typeattributeset init_exec_32_0 (init_exec))
+(typeattributeset init_service_status_prop_32_0 (init_service_status_prop))
+(typeattributeset init_tmpfs_32_0 (init_tmpfs))
+(typeattributeset inotify_32_0 (inotify))
+(typeattributeset input_device_32_0 (input_device))
+(typeattributeset input_method_service_32_0 (input_method_service))
+(typeattributeset input_service_32_0 (input_service))
+(typeattributeset inputflinger_32_0 (inputflinger))
+(typeattributeset inputflinger_exec_32_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_32_0 (inputflinger_service))
+(typeattributeset install_data_file_32_0 (install_data_file))
+(typeattributeset installd_32_0 (installd))
+(typeattributeset installd_exec_32_0 (installd_exec))
+(typeattributeset installd_service_32_0 (installd_service))
+(typeattributeset ion_device_32_0 (ion_device))
+(typeattributeset iorap_inode2filename_32_0 (iorap_inode2filename))
+(typeattributeset iorap_inode2filename_exec_32_0 (iorap_inode2filename_exec))
+(typeattributeset iorap_inode2filename_tmpfs_32_0 (iorap_inode2filename_tmpfs))
+(typeattributeset iorap_prefetcherd_32_0 (iorap_prefetcherd))
+(typeattributeset iorap_prefetcherd_exec_32_0 (iorap_prefetcherd_exec))
+(typeattributeset iorap_prefetcherd_tmpfs_32_0 (iorap_prefetcherd_tmpfs))
+(typeattributeset iorapd_32_0 (iorapd))
+(typeattributeset iorapd_data_file_32_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_32_0 (iorapd_exec))
+(typeattributeset iorapd_service_32_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_32_0 (iorapd_tmpfs))
+(typeattributeset ipsec_service_32_0 (ipsec_service))
+(typeattributeset iris_service_32_0 (iris_service))
+(typeattributeset iris_vendor_data_file_32_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_32_0 (isolated_app))
+(typeattributeset jobscheduler_service_32_0 (jobscheduler_service))
+(typeattributeset kernel_32_0 (kernel))
+(typeattributeset keychain_data_file_32_0 (keychain_data_file))
+(typeattributeset keychord_device_32_0 (keychord_device))
+(typeattributeset keyguard_config_prop_32_0 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_32_0 (keystore2_key_contexts_file))
+(typeattributeset keystore_32_0 (keystore))
+(typeattributeset keystore_compat_hal_service_32_0 (keystore_compat_hal_service))
+(typeattributeset keystore_data_file_32_0 (keystore_data_file))
+(typeattributeset keystore_exec_32_0 (keystore_exec))
+(typeattributeset keystore_maintenance_service_32_0 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_32_0 (keystore_metrics_service))
+(typeattributeset keystore_service_32_0 (keystore_service))
+(typeattributeset kmsg_debug_device_32_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_32_0 (kmsg_device))
+(typeattributeset labeledfs_32_0 (labeledfs))
+(typeattributeset launcherapps_service_32_0 (launcherapps_service))
+(typeattributeset legacy_permission_service_32_0 (legacy_permission_service))
+(typeattributeset legacykeystore_service_32_0 (legacykeystore_service))
+(typeattributeset libc_debug_prop_32_0 (libc_debug_prop))
+(typeattributeset light_service_32_0 (light_service))
+(typeattributeset linkerconfig_file_32_0 (linkerconfig_file))
+(typeattributeset llkd_32_0 (llkd))
+(typeattributeset llkd_exec_32_0 (llkd_exec))
+(typeattributeset llkd_prop_32_0 (llkd_prop))
+(typeattributeset lmkd_32_0 (lmkd))
+(typeattributeset lmkd_config_prop_32_0 (lmkd_config_prop))
+(typeattributeset lmkd_exec_32_0 (lmkd_exec))
+(typeattributeset lmkd_prop_32_0 (lmkd_prop))
+(typeattributeset lmkd_socket_32_0 (lmkd_socket))
+(typeattributeset location_service_32_0 (location_service))
+(typeattributeset location_time_zone_manager_service_32_0 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_32_0 (lock_settings_service))
+(typeattributeset log_prop_32_0 (log_prop))
+(typeattributeset log_tag_prop_32_0 (log_tag_prop))
+(typeattributeset logcat_exec_32_0 (logcat_exec))
+(typeattributeset logd_32_0 (logd))
+(typeattributeset logd_exec_32_0 (logd_exec))
+(typeattributeset logd_prop_32_0 (logd_prop))
+(typeattributeset logd_socket_32_0 (logd_socket))
+(typeattributeset logdr_socket_32_0 (logdr_socket))
+(typeattributeset logdw_socket_32_0 (logdw_socket))
+(typeattributeset logpersist_32_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_32_0 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_32_0 (loop_control_device))
+(typeattributeset loop_device_32_0 (loop_device))
+(typeattributeset looper_stats_service_32_0 (looper_stats_service))
+(typeattributeset lowpan_device_32_0 (lowpan_device))
+(typeattributeset lowpan_prop_32_0 (lowpan_prop))
+(typeattributeset lowpan_service_32_0 (lowpan_service))
+(typeattributeset lpdump_service_32_0 (lpdump_service))
+(typeattributeset lpdumpd_prop_32_0 (lpdumpd_prop))
+(typeattributeset mac_perms_file_32_0 (mac_perms_file))
+(typeattributeset mdns_socket_32_0 (mdns_socket))
+(typeattributeset mdnsd_32_0 (mdnsd))
+(typeattributeset mdnsd_socket_32_0 (mdnsd_socket))
+(typeattributeset media_communication_service_32_0 (media_communication_service))
+(typeattributeset media_config_prop_32_0 (media_config_prop))
+(typeattributeset media_data_file_32_0 (media_data_file))
+(typeattributeset media_metrics_service_32_0 (media_metrics_service))
+(typeattributeset media_projection_service_32_0 (media_projection_service))
+(typeattributeset media_router_service_32_0 (media_router_service))
+(typeattributeset media_rw_data_file_32_0 (media_rw_data_file))
+(typeattributeset media_session_service_32_0 (media_session_service))
+(typeattributeset media_variant_prop_32_0 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_32_0 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_32_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_32_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_32_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_32_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_32_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_32_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_32_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_32_0 (mediametrics))
+(typeattributeset mediametrics_exec_32_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_32_0 (mediametrics_service))
+(typeattributeset mediaprovider_32_0 (mediaprovider))
+(typeattributeset mediaserver_32_0 (mediaserver))
+(typeattributeset mediaserver_exec_32_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_32_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_32_0 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_32_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_32_0 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_service_32_0 (mediatranscoding_service))
+(typeattributeset meminfo_service_32_0 (meminfo_service))
+(typeattributeset memtrackproxy_service_32_0 (memtrackproxy_service))
+(typeattributeset metadata_block_device_32_0 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_32_0 (metadata_bootstat_file))
+(typeattributeset metadata_file_32_0 (metadata_file))
+(typeattributeset method_trace_data_file_32_0 (method_trace_data_file))
+(typeattributeset midi_service_32_0 (midi_service))
+(typeattributeset mirror_data_file_32_0 (mirror_data_file))
+(typeattributeset misc_block_device_32_0 (misc_block_device))
+(typeattributeset misc_logd_file_32_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_32_0 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_32_0 (mm_events_config_prop))
+(typeattributeset mmc_prop_32_0 (mmc_prop))
+(typeattributeset mnt_expand_file_32_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_32_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_32_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_32_0 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_32_0 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_32_0 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_32_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_32_0 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_32_0 (mock_ota_prop))
+(typeattributeset modprobe_32_0 (modprobe))
+(typeattributeset module_sdkextensions_prop_32_0 (module_sdkextensions_prop))
+(typeattributeset mount_service_32_0 (mount_service))
+(typeattributeset mqueue_32_0 (mqueue))
+(typeattributeset mtp_32_0 (mtp))
+(typeattributeset mtp_device_32_0 (mtp_device))
+(typeattributeset mtp_exec_32_0 (mtp_exec))
+(typeattributeset mtpd_socket_32_0 (mtpd_socket))
+(typeattributeset music_recognition_service_32_0 (music_recognition_service))
+(typeattributeset nativetest_data_file_32_0 (nativetest_data_file))
+(typeattributeset net_data_file_32_0 (net_data_file))
+(typeattributeset net_dns_prop_32_0 (net_dns_prop))
+(typeattributeset net_radio_prop_32_0 (net_radio_prop))
+(typeattributeset netd_32_0 (netd))
+(typeattributeset netd_exec_32_0 (netd_exec))
+(typeattributeset netd_listener_service_32_0 (netd_listener_service))
+(typeattributeset netd_service_32_0 (netd_service))
+(typeattributeset netif_32_0 (netif))
+(typeattributeset netpolicy_service_32_0 (netpolicy_service))
+(typeattributeset netstats_service_32_0 (netstats_service))
+(typeattributeset netutils_wrapper_32_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_32_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_32_0 (network_management_service))
+(typeattributeset network_score_service_32_0 (network_score_service))
+(typeattributeset network_stack_32_0 (network_stack))
+(typeattributeset network_stack_service_32_0 (network_stack_service))
+(typeattributeset network_time_update_service_32_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_32_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_32_0 (network_watchlist_service))
+(typeattributeset nfc_32_0 (nfc))
+(typeattributeset nfc_data_file_32_0 (nfc_data_file))
+(typeattributeset nfc_device_32_0 (nfc_device))
+(typeattributeset nfc_logs_data_file_32_0 (nfc_logs_data_file))
+(typeattributeset nfc_prop_32_0 (nfc_prop))
+(typeattributeset nfc_service_32_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_32_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_32_0 (node))
+(typeattributeset nonplat_service_contexts_file_32_0 (nonplat_service_contexts_file))
+(typeattributeset notification_service_32_0 (notification_service))
+(typeattributeset null_device_32_0 (null_device))
+(typeattributeset oem_lock_service_32_0 (oem_lock_service))
+(typeattributeset oem_unlock_prop_32_0 (oem_unlock_prop))
+(typeattributeset oemfs_32_0 (oemfs))
+(typeattributeset ota_data_file_32_0 (ota_data_file))
+(typeattributeset ota_metadata_file_32_0 (ota_metadata_file))
+(typeattributeset ota_package_file_32_0 (ota_package_file))
+(typeattributeset ota_prop_32_0 (ota_prop))
+(typeattributeset otadexopt_service_32_0 (otadexopt_service))
+(typeattributeset otapreopt_chroot_32_0 (otapreopt_chroot))
+(typeattributeset overlay_prop_32_0 (overlay_prop))
+(typeattributeset overlay_service_32_0 (overlay_service))
+(typeattributeset overlayfs_file_32_0 (overlayfs_file))
+(typeattributeset owntty_device_32_0 (owntty_device))
+(typeattributeset pac_proxy_service_32_0 (pac_proxy_service))
+(typeattributeset package_native_service_32_0 (package_native_service))
+(typeattributeset package_service_32_0 (package_service))
+(typeattributeset packagemanager_config_prop_32_0 (packagemanager_config_prop))
+(typeattributeset packages_list_file_32_0 (packages_list_file))
+(typeattributeset pan_result_prop_32_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_32_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_32_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_32_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_32_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_32_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_32_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_32_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_32_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_32_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_32_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_32_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_32_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_32_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_32_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_32_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_32_0 (pdx_performance_dir))
+(typeattributeset people_service_32_0 (people_service))
+(typeattributeset perfetto_32_0 (perfetto))
+(typeattributeset performanced_32_0 (performanced))
+(typeattributeset performanced_exec_32_0 (performanced_exec))
+(typeattributeset permission_checker_service_32_0 (permission_checker_service))
+(typeattributeset permission_service_32_0 (permission_service))
+(typeattributeset permissionmgr_service_32_0 (permissionmgr_service))
+(typeattributeset persist_debug_prop_32_0 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_32_0 (persist_vendor_debug_wifi_prop))
+(typeattributeset persistent_data_block_service_32_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_32_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_32_0 (pinner_service))
+(typeattributeset pipefs_32_0 (pipefs))
+(typeattributeset platform_app_32_0 (platform_app))
+(typeattributeset platform_compat_service_32_0 (platform_compat_service))
+(typeattributeset pmsg_device_32_0 (pmsg_device))
+(typeattributeset port_32_0 (port))
+(typeattributeset port_device_32_0 (port_device))
+(typeattributeset postinstall_32_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_32_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_32_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_32_0 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_32_0 (power_debug_prop))
+(typeattributeset power_service_32_0 (power_service))
+(typeattributeset powerctl_prop_32_0 (powerctl_prop))
+(typeattributeset powerstats_service_32_0 (powerstats_service))
+(typeattributeset ppp_32_0 (ppp))
+(typeattributeset ppp_device_32_0 (ppp_device))
+(typeattributeset ppp_exec_32_0 (ppp_exec))
+(typeattributeset preloads_data_file_32_0 (preloads_data_file))
+(typeattributeset preloads_media_file_32_0 (preloads_media_file))
+(typeattributeset prereboot_data_file_32_0 (prereboot_data_file))
+(typeattributeset print_service_32_0 (print_service))
+(typeattributeset priv_app_32_0 (priv_app))
+(typeattributeset privapp_data_file_32_0 (privapp_data_file))
+(typeattributeset proc_32_0 (proc))
+(typeattributeset proc_32_0 (proc_bpf))
+(typeattributeset proc_32_0 (proc_cpu_alignment))
+(typeattributeset proc_32_0 (proc_watermark_scale_factor))
+(typeattributeset proc_abi_32_0 (proc_abi))
+(typeattributeset proc_asound_32_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_32_0 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_32_0 (proc_bootconfig))
+(typeattributeset proc_buddyinfo_32_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_32_0 (proc_cmdline))
+(typeattributeset proc_cpuinfo_32_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_32_0 (proc_dirty))
+(typeattributeset proc_diskstats_32_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_32_0 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_32_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_32_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_32_0 (proc_fs_verity))
+(typeattributeset proc_hostname_32_0 (proc_hostname))
+(typeattributeset proc_hung_task_32_0 (proc_hung_task))
+(typeattributeset proc_interrupts_32_0 (proc_interrupts))
+(typeattributeset proc_iomem_32_0 (proc_iomem))
+(typeattributeset proc_kallsyms_32_0 (proc_kallsyms))
+(typeattributeset proc_keys_32_0 (proc_keys))
+(typeattributeset proc_kmsg_32_0 (proc_kmsg))
+(typeattributeset proc_kpageflags_32_0 (proc_kpageflags))
+(typeattributeset proc_loadavg_32_0 (proc_loadavg))
+(typeattributeset proc_locks_32_0 (proc_locks))
+(typeattributeset proc_lowmemorykiller_32_0 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_32_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_32_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_32_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_32_0 (proc_misc))
+(typeattributeset proc_modules_32_0 (proc_modules))
+(typeattributeset proc_mounts_32_0 (proc_mounts))
+(typeattributeset proc_net_32_0 (proc_net proc_bpf))
+(typeattributeset proc_net_tcp_udp_32_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_32_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_32_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_32_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_32_0 (proc_panic))
+(typeattributeset proc_perf_32_0 (proc_perf))
+(typeattributeset proc_pid_max_32_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_32_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_32_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_32_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_32_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_32_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_32_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_32_0 (proc_random))
+(typeattributeset proc_sched_32_0 (proc_sched))
+(typeattributeset proc_security_32_0 (proc_security))
+(typeattributeset proc_slabinfo_32_0 (proc_slabinfo))
+(typeattributeset proc_stat_32_0 (proc_stat))
+(typeattributeset proc_swaps_32_0 (proc_swaps))
+(typeattributeset proc_sysrq_32_0 (proc_sysrq))
+(typeattributeset proc_timer_32_0 (proc_timer))
+(typeattributeset proc_tty_drivers_32_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_32_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_32_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_32_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_32_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_32_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_32_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_32_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_32_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_32_0 (proc_uptime))
+(typeattributeset proc_vendor_sched_32_0 (proc_vendor_sched))
+(typeattributeset proc_version_32_0 (proc_version))
+(typeattributeset proc_vmallocinfo_32_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_32_0 (proc_vmstat))
+(typeattributeset proc_zoneinfo_32_0 (proc_zoneinfo))
+(typeattributeset processinfo_service_32_0 (processinfo_service))
+(typeattributeset procstats_service_32_0 (procstats_service))
+(typeattributeset profman_32_0 (profman))
+(typeattributeset profman_dump_data_file_32_0 (profman_dump_data_file))
+(typeattributeset profman_exec_32_0 (profman_exec))
+(typeattributeset properties_device_32_0 (properties_device))
+(typeattributeset properties_serial_32_0 (properties_serial))
+(typeattributeset property_contexts_file_32_0 (property_contexts_file))
+(typeattributeset property_data_file_32_0 (property_data_file))
+(typeattributeset property_info_32_0 (property_info))
+(typeattributeset property_service_version_prop_32_0 (property_service_version_prop))
+(typeattributeset property_socket_32_0 (property_socket))
+(typeattributeset provisioned_prop_32_0 (provisioned_prop))
+(typeattributeset pstorefs_32_0 (pstorefs))
+(typeattributeset ptmx_device_32_0 (ptmx_device))
+(typeattributeset qemu_hw_prop_32_0 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_32_0 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_32_0 (qtaguid_device))
+(typeattributeset racoon_32_0 (racoon))
+(typeattributeset racoon_exec_32_0 (racoon_exec))
+(typeattributeset racoon_socket_32_0 (racoon_socket))
+(typeattributeset radio_32_0 (radio))
+(typeattributeset radio_control_prop_32_0 (radio_control_prop))
+(typeattributeset radio_core_data_file_32_0 (radio_core_data_file))
+(typeattributeset radio_data_file_32_0 (radio_data_file))
+(typeattributeset radio_device_32_0 (radio_device))
+(typeattributeset radio_prop_32_0 (radio_prop))
+(typeattributeset radio_service_32_0 (radio_service))
+(typeattributeset ram_device_32_0 (ram_device))
+(typeattributeset random_device_32_0 (random_device))
+(typeattributeset reboot_readiness_service_32_0 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_32_0 (rebootescrow_hal_prop))
+(typeattributeset recovery_32_0 (recovery))
+(typeattributeset recovery_block_device_32_0 (recovery_block_device))
+(typeattributeset recovery_config_prop_32_0 (recovery_config_prop))
+(typeattributeset recovery_data_file_32_0 (recovery_data_file))
+(typeattributeset recovery_persist_32_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_32_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_32_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_32_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_32_0 (recovery_service))
+(typeattributeset recovery_socket_32_0 (recovery_socket))
+(typeattributeset registry_service_32_0 (registry_service))
+(typeattributeset remoteprovisioning_service_32_0 (remoteprovisioning_service))
+(typeattributeset resourcecache_data_file_32_0 (resourcecache_data_file))
+(typeattributeset restorecon_prop_32_0 (restorecon_prop))
+(typeattributeset restrictions_service_32_0 (restrictions_service))
+(typeattributeset retaildemo_prop_32_0 (retaildemo_prop))
+(typeattributeset rild_debug_socket_32_0 (rild_debug_socket))
+(typeattributeset rild_socket_32_0 (rild_socket))
+(typeattributeset ringtone_file_32_0 (ringtone_file))
+(typeattributeset role_service_32_0 (role_service))
+(typeattributeset rollback_service_32_0 (rollback_service))
+(typeattributeset root_block_device_32_0 (root_block_device))
+(typeattributeset rootfs_32_0 (rootfs))
+(typeattributeset rpmsg_device_32_0 (rpmsg_device))
+(typeattributeset rs_32_0 (rs))
+(typeattributeset rs_exec_32_0 (rs_exec))
+(typeattributeset rss_hwm_reset_32_0 (rss_hwm_reset))
+(typeattributeset rtc_device_32_0 (rtc_device))
+(typeattributeset rttmanager_service_32_0 (rttmanager_service))
+(typeattributeset runas_32_0 (runas))
+(typeattributeset runas_app_32_0 (runas_app))
+(typeattributeset runas_exec_32_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_32_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_32_0 (runtime_service))
+(typeattributeset safemode_prop_32_0 (safemode_prop))
+(typeattributeset same_process_hal_file_32_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_32_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_32_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_32_0 (sdcard_block_device))
+(typeattributeset sdcardd_32_0 (sdcardd))
+(typeattributeset sdcardd_exec_32_0 (sdcardd_exec))
+(typeattributeset sdcardfs_32_0 (sdcardfs))
+(typeattributeset seapp_contexts_file_32_0 (seapp_contexts_file))
+(typeattributeset search_service_32_0 (search_service))
+(typeattributeset search_ui_service_32_0 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_32_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_32_0 (secure_element))
+(typeattributeset secure_element_device_32_0 (secure_element_device))
+(typeattributeset secure_element_service_32_0 (secure_element_service))
+(typeattributeset securityfs_32_0 (securityfs))
+(typeattributeset selinuxfs_32_0 (selinuxfs))
+(typeattributeset sendbug_config_prop_32_0 (sendbug_config_prop))
+(typeattributeset sensor_privacy_service_32_0 (sensor_privacy_service))
+(typeattributeset sensors_device_32_0 (sensors_device))
+(typeattributeset sensorservice_service_32_0 (sensorservice_service))
+(typeattributeset sepolicy_file_32_0 (sepolicy_file))
+(typeattributeset serial_device_32_0 (serial_device))
+(typeattributeset serial_service_32_0 (serial_service))
+(typeattributeset serialno_prop_32_0 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_32_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_32_0 (service_contexts_file))
+(typeattributeset service_manager_service_32_0 (service_manager_service))
+(typeattributeset service_manager_vndservice_32_0 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_32_0 (servicediscovery_service))
+(typeattributeset servicemanager_32_0 (servicemanager))
+(typeattributeset servicemanager_exec_32_0 (servicemanager_exec))
+(typeattributeset settings_service_32_0 (settings_service))
+(typeattributeset sgdisk_32_0 (sgdisk))
+(typeattributeset sgdisk_exec_32_0 (sgdisk_exec))
+(typeattributeset shared_relro_32_0 (shared_relro))
+(typeattributeset shared_relro_file_32_0 (shared_relro_file))
+(typeattributeset shell_32_0 (shell))
+(typeattributeset shell_data_file_32_0 (shell_data_file))
+(typeattributeset shell_exec_32_0 (shell_exec))
+(typeattributeset shell_prop_32_0 (shell_prop))
+(typeattributeset shell_test_data_file_32_0 (shell_test_data_file))
+(typeattributeset shm_32_0 (shm))
+(typeattributeset shortcut_manager_icons_32_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_32_0 (shortcut_service))
+(typeattributeset simpleperf_32_0 (simpleperf))
+(typeattributeset simpleperf_app_runner_32_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_32_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_32_0 (slice_service))
+(typeattributeset slideshow_32_0 (slideshow))
+(typeattributeset smartspace_service_32_0 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_32_0 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_socket_32_0 (snapuserd_socket))
+(typeattributeset soc_prop_32_0 (soc_prop))
+(typeattributeset socket_device_32_0 (socket_device))
+(typeattributeset socket_hook_prop_32_0 (socket_hook_prop))
+(typeattributeset sockfs_32_0 (sockfs))
+(typeattributeset sota_prop_32_0 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_32_0 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_32_0 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_32_0 (sqlite_log_prop))
+(typeattributeset staged_install_file_32_0 (staged_install_file))
+(typeattributeset staging_data_file_32_0 (staging_data_file))
+(typeattributeset stats_data_file_32_0 (stats_data_file))
+(typeattributeset statsd_32_0 (statsd))
+(typeattributeset statsd_exec_32_0 (statsd_exec))
+(typeattributeset statsdw_socket_32_0 (statsdw_socket))
+(typeattributeset statusbar_service_32_0 (statusbar_service))
+(typeattributeset storage_config_prop_32_0 (storage_config_prop))
+(typeattributeset storage_file_32_0 (storage_file))
+(typeattributeset storage_stub_file_32_0 (storage_stub_file))
+(typeattributeset storaged_service_32_0 (storaged_service))
+(typeattributeset storagemanager_config_prop_32_0 (storagemanager_config_prop))
+(typeattributeset storagestats_service_32_0 (storagestats_service))
+(typeattributeset su_32_0 (su))
+(typeattributeset su_exec_32_0 (su_exec))
+(typeattributeset super_block_device_32_0 (super_block_device))
+(typeattributeset surfaceflinger_32_0 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_32_0 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_32_0 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_32_0 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_32_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_32_0 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_32_0 (suspend_prop))
+(typeattributeset swap_block_device_32_0 (swap_block_device))
+(typeattributeset sysfs_32_0 (sysfs))
+(typeattributeset sysfs_android_usb_32_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_32_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_block_32_0 (sysfs_block))
+(typeattributeset sysfs_bluetooth_writable_32_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devfreq_cur_32_0 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_32_0 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_32_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_32_0 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_32_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_32_0 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_32_0 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_32_0 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_32_0 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_32_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_32_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_32_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_32_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_incfs_features_32_0 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_32_0 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_hwrandom_32_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_32_0 (sysfs_ion))
+(typeattributeset sysfs_ipv4_32_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_32_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_32_0 (sysfs_leds))
+(typeattributeset sysfs_loop_32_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_32_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_net_32_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_32_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_32_0 (sysfs_power))
+(typeattributeset sysfs_rtc_32_0 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_32_0 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_32_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_32_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_32_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uhid_32_0 (sysfs_uhid))
+(typeattributeset sysfs_uio_32_0 (sysfs_uio))
+(typeattributeset sysfs_usb_32_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_32_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_32_0 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_32_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_32_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_32_0 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_32_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_32_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_32_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_32_0 (sysfs_zram_uevent))
+(typeattributeset system_app_32_0 (system_app))
+(typeattributeset system_app_data_file_32_0 (system_app_data_file))
+(typeattributeset system_app_service_32_0 (system_app_service))
+(typeattributeset system_asan_options_file_32_0 (system_asan_options_file))
+(typeattributeset system_block_device_32_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_32_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_32_0 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_32_0 (system_config_service))
+(typeattributeset system_data_file_32_0 (system_data_file))
+(typeattributeset system_data_root_file_32_0 (system_data_root_file))
+(typeattributeset system_event_log_tags_file_32_0 (system_event_log_tags_file))
+(typeattributeset system_file_32_0 (system_file))
+(typeattributeset system_group_file_32_0 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_32_0 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_32_0 (system_lib_file))
+(typeattributeset system_linker_config_file_32_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_32_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_32_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_32_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_32_0 (system_net_netd_hwservice))
+(typeattributeset system_passwd_file_32_0 (system_passwd_file))
+(typeattributeset system_prop_32_0 (system_prop))
+(typeattributeset system_seccomp_policy_file_32_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_32_0 (system_security_cacerts_file))
+(typeattributeset system_server_32_0 (system_server))
+(typeattributeset system_server_dumper_service_32_0 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_32_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_32_0 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_32_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_32_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_32_0 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_32_0 (system_unsolzygote_socket))
+(typeattributeset system_update_service_32_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_32_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_32_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_32_0 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_32_0 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_32_0 (systemsound_config_prop))
+(typeattributeset task_profiles_api_file_32_0 (task_profiles_api_file))
+(typeattributeset task_profiles_file_32_0 (task_profiles_file))
+(typeattributeset task_service_32_0 (task_service))
+(typeattributeset tcpdump_exec_32_0 (tcpdump_exec))
+(typeattributeset tee_32_0 (tee))
+(typeattributeset tee_data_file_32_0 (tee_data_file))
+(typeattributeset tee_device_32_0 (tee_device))
+(typeattributeset telecom_service_32_0 (telecom_service))
+(typeattributeset telephony_config_prop_32_0 (telephony_config_prop))
+(typeattributeset telephony_status_prop_32_0 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_32_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_32_0 (test_harness_prop))
+(typeattributeset testharness_service_32_0 (testharness_service))
+(typeattributeset tethering_service_32_0 (tethering_service))
+(typeattributeset textclassification_service_32_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_32_0 (textclassifier_data_file))
+(typeattributeset textservices_service_32_0 (textservices_service))
+(typeattributeset texttospeech_service_32_0 (texttospeech_service))
+(typeattributeset theme_prop_32_0 (theme_prop))
+(typeattributeset thermal_service_32_0 (thermal_service))
+(typeattributeset time_prop_32_0 (time_prop))
+(typeattributeset timedetector_service_32_0 (timedetector_service))
+(typeattributeset timezone_service_32_0 (timezone_service))
+(typeattributeset timezonedetector_service_32_0 (timezonedetector_service))
+(typeattributeset tmpfs_32_0 (tmpfs))
+(typeattributeset tombstone_config_prop_32_0 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_32_0 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_32_0 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_32_0 (tombstoned))
+(typeattributeset tombstoned_crash_socket_32_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_32_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_32_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_32_0 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_32_0 (toolbox))
+(typeattributeset toolbox_exec_32_0 (toolbox_exec))
+(typeattributeset trace_data_file_32_0 (trace_data_file))
+(typeattributeset traced_32_0 (traced))
+(typeattributeset traced_consumer_socket_32_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_32_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_32_0 (traced_lazy_prop))
+(typeattributeset traced_perf_32_0 (traced_perf))
+(typeattributeset traced_perf_socket_32_0 (traced_perf_socket))
+(typeattributeset traced_probes_32_0 (traced_probes))
+(typeattributeset traced_producer_socket_32_0 (traced_producer_socket))
+(typeattributeset traced_tmpfs_32_0 (traced_tmpfs))
+(typeattributeset traceur_app_32_0 (traceur_app))
+(typeattributeset translation_service_32_0 (translation_service))
+(typeattributeset trust_service_32_0 (trust_service))
+(typeattributeset tty_device_32_0 (tty_device))
+(typeattributeset tun_device_32_0 (tun_device))
+(typeattributeset tv_input_service_32_0 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_32_0 (tv_tuner_resource_mgr_service))
+(typeattributeset tzdatacheck_32_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_32_0 (tzdatacheck_exec))
+(typeattributeset ueventd_32_0 (ueventd))
+(typeattributeset ueventd_tmpfs_32_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_32_0 (uhid_device))
+(typeattributeset uimode_service_32_0 (uimode_service))
+(typeattributeset uio_device_32_0 (uio_device))
+(typeattributeset uncrypt_32_0 (uncrypt))
+(typeattributeset uncrypt_exec_32_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_32_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_32_0 (unencrypted_data_file))
+(typeattributeset unlabeled_32_0 (unlabeled))
+(typeattributeset untrusted_app_25_32_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_32_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_32_0 (untrusted_app_29))
+(typeattributeset untrusted_app_32_0 (untrusted_app))
+(typeattributeset update_engine_32_0 (update_engine))
+(typeattributeset update_engine_data_file_32_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_32_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_32_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_32_0 (update_engine_service))
+(typeattributeset update_engine_stable_service_32_0 (update_engine_stable_service))
+(typeattributeset update_verifier_32_0 (update_verifier))
+(typeattributeset update_verifier_exec_32_0 (update_verifier_exec))
+(typeattributeset updatelock_service_32_0 (updatelock_service))
+(typeattributeset uri_grants_service_32_0 (uri_grants_service))
+(typeattributeset usagestats_service_32_0 (usagestats_service))
+(typeattributeset usb_config_prop_32_0 (usb_config_prop))
+(typeattributeset usb_control_prop_32_0 (usb_control_prop))
+(typeattributeset usb_device_32_0 (usb_device))
+(typeattributeset usb_prop_32_0 (usb_prop))
+(typeattributeset usb_serial_device_32_0 (usb_serial_device))
+(typeattributeset usb_service_32_0 (usb_service))
+(typeattributeset usbaccessory_device_32_0 (usbaccessory_device))
+(typeattributeset usbd_32_0 (usbd))
+(typeattributeset usbd_exec_32_0 (usbd_exec))
+(typeattributeset usbfs_32_0 (usbfs))
+(typeattributeset use_memfd_prop_32_0 (use_memfd_prop))
+(typeattributeset user_profile_data_file_32_0 (user_profile_data_file))
+(typeattributeset user_profile_root_file_32_0 (user_profile_root_file))
+(typeattributeset user_service_32_0 (user_service))
+(typeattributeset userdata_block_device_32_0 (userdata_block_device))
+(typeattributeset userdata_sysdev_32_0 (userdata_sysdev))
+(typeattributeset usermodehelper_32_0 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_32_0 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_32_0 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_32_0 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_32_0 (uwb_service))
+(typeattributeset vcn_management_service_32_0 (vcn_management_service))
+(typeattributeset vd_device_32_0 (vd_device))
+(typeattributeset vdc_32_0 (vdc))
+(typeattributeset vdc_exec_32_0 (vdc_exec))
+(typeattributeset vehicle_hal_prop_32_0 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_32_0 (vendor_apex_file))
+(typeattributeset vendor_app_file_32_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_32_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_32_0 (vendor_configs_file))
+(typeattributeset vendor_data_file_32_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_32_0 (vendor_default_prop))
+(typeattributeset vendor_file_32_0 (vendor_file))
+(typeattributeset vendor_framework_file_32_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_32_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_32_0 (vendor_idc_file))
+(typeattributeset vendor_init_32_0 (vendor_init))
+(typeattributeset vendor_kernel_modules_32_0 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_32_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_32_0 (vendor_keylayout_file))
+(typeattributeset vendor_misc_writer_32_0 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_32_0 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_32_0 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_32_0 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_32_0 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_32_0 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_32_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_32_0 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_32_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_32_0 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_32_0 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_32_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_32_0 (vendor_toolbox_exec))
+(typeattributeset vfat_32_0 (vfat))
+(typeattributeset vibrator_manager_service_32_0 (vibrator_manager_service))
+(typeattributeset vibrator_service_32_0 (vibrator_service))
+(typeattributeset video_device_32_0 (video_device))
+(typeattributeset virtual_ab_prop_32_0 (virtual_ab_prop))
+(typeattributeset virtual_touchpad_32_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_32_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_32_0 (virtual_touchpad_service))
+(typeattributeset virtualization_service_32_0 (virtualization_service))
+(typeattributeset vndbinder_device_32_0 (vndbinder_device))
+(typeattributeset vndk_prop_32_0 (vndk_prop))
+(typeattributeset vndk_sp_file_32_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_32_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_32_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_32_0 (voiceinteraction_service))
+(typeattributeset vold_32_0 (vold))
+(typeattributeset vold_config_prop_32_0 (vold_config_prop))
+(typeattributeset vold_data_file_32_0 (vold_data_file))
+(typeattributeset vold_device_32_0 (vold_device))
+(typeattributeset vold_exec_32_0 (vold_exec))
+(typeattributeset vold_metadata_file_32_0 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_32_0 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_32_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_32_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_32_0 (vold_prop))
+(typeattributeset vold_service_32_0 (vold_service))
+(typeattributeset vold_status_prop_32_0 (vold_status_prop))
+(typeattributeset vpn_data_file_32_0 (vpn_data_file))
+(typeattributeset vpn_management_service_32_0 (vpn_management_service))
+(typeattributeset vr_hwc_32_0 (vr_hwc))
+(typeattributeset vr_hwc_exec_32_0 (vr_hwc_exec))
+(typeattributeset vr_hwc_service_32_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_32_0 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_32_0 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_32_0 (vts_config_prop))
+(typeattributeset vts_status_prop_32_0 (vts_status_prop))
+(typeattributeset wallpaper_file_32_0 (wallpaper_file))
+(typeattributeset wallpaper_service_32_0 (wallpaper_service))
+(typeattributeset watchdog_device_32_0 (watchdog_device))
+(typeattributeset watchdog_metadata_file_32_0 (watchdog_metadata_file))
+(typeattributeset watchdogd_32_0 (watchdogd))
+(typeattributeset watchdogd_exec_32_0 (watchdogd_exec))
+(typeattributeset webview_zygote_32_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_32_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_32_0 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_32_0 (webviewupdate_service))
+(typeattributeset wifi_config_prop_32_0 (wifi_config_prop))
+(typeattributeset wifi_data_file_32_0 (wifi_data_file))
+(typeattributeset wifi_hal_prop_32_0 (wifi_hal_prop))
+(typeattributeset wifi_key_32_0 (wifi_key))
+(typeattributeset wifi_log_prop_32_0 (wifi_log_prop))
+(typeattributeset wifi_prop_32_0 (wifi_prop))
+(typeattributeset wifi_service_32_0 (wifi_service))
+(typeattributeset wifiaware_service_32_0 (wifiaware_service))
+(typeattributeset wificond_32_0 (wificond))
+(typeattributeset wificond_exec_32_0 (wificond_exec))
+(typeattributeset wifinl80211_service_32_0 (wifinl80211_service))
+(typeattributeset wifip2p_service_32_0 (wifip2p_service))
+(typeattributeset wifiscanner_service_32_0 (wifiscanner_service))
+(typeattributeset window_service_32_0 (window_service))
+(typeattributeset wpa_socket_32_0 (wpa_socket))
+(typeattributeset wpantund_32_0 (wpantund))
+(typeattributeset wpantund_exec_32_0 (wpantund_exec))
+(typeattributeset wpantund_service_32_0 (wpantund_service))
+(typeattributeset zero_device_32_0 (zero_device))
+(typeattributeset zoneinfo_data_file_32_0 (zoneinfo_data_file))
+(typeattributeset zram_config_prop_32_0 (zram_config_prop))
+(typeattributeset zram_control_prop_32_0 (zram_control_prop))
+(typeattributeset zygote_32_0 (zygote))
+(typeattributeset zygote_config_prop_32_0 (zygote_config_prop))
+(typeattributeset zygote_exec_32_0 (zygote_exec))
+(typeattributeset zygote_socket_32_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_32_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/32.0/32.0.compat.cil b/prebuilts/api/202504/private/compat/32.0/32.0.compat.cil
new file mode 100644
index 0000000..00ac11f
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/32.0/32.0.compat.cil
@@ -0,0 +1,3 @@
+;; complement CIL file for compatibility between ToT policy and 32.0 vendors.
+;; will be compiled along with other normal policy files, on 32.0 vendors.
+;;
diff --git a/prebuilts/api/202504/private/compat/32.0/32.0.ignore.cil b/prebuilts/api/202504/private/compat/32.0/32.0.ignore.cil
new file mode 100644
index 0000000..43ce0a1
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/32.0/32.0.ignore.cil
@@ -0,0 +1,84 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 32.0 policy. Thus, we do not need to map
+;; these types to previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ adaptive_haptics_prop
+ adservices_manager_service
+ apexd_select_prop
+ artd_service
+ attestation_verification_service
+ bluetooth_config_prop
+ binderfs_features
+ charger_vendor
+ cloudsearch
+ cloudsearch_service
+ connectivity_native_service
+ device_config_nnapi_native_prop
+ device_config_surface_flinger_native_boot_prop
+ device_config_vendor_system_native_prop
+ device_config_vendor_system_native_boot_prop
+ dice_maintenance_service
+ dice_node_service
+ diced
+ diced_exec
+ fwk_automotive_display_service
+ evsmanagerd
+ evsmanagerd_service
+ extra_free_kbytes
+ extra_free_kbytes_exec
+ framework_status_prop
+ fs_bpf_vendor
+ game_mode_intervention_list_file
+ gesture_prop
+ gwp_asan_prop
+ hal_contexthub_service
+ hal_camera_service
+ hal_evs_service
+ hal_dice_service
+ hal_drm_service
+ hal_dumpstate_service
+ hal_graphics_allocator_service
+ hal_graphics_composer_service
+ hal_health_service
+ hal_input_processor_service
+ hal_ir_service
+ hal_nfc_service
+ hal_nlinterceptor_service
+ hal_radio_service
+ hal_sensors_service
+ hal_system_suspend_service
+ hal_tv_tuner_service
+ hal_usb_service
+ hal_uwb_service
+ hal_vehicle_service
+ hal_wifi_hostapd_service
+ hal_wifi_supplicant_service
+ locale_service
+ mdns_service
+ nearby_service
+ persist_wm_debug_prop
+ proc_watermark_boost_factor
+ remotelyprovisionedkeypool_service
+ resources_manager_service
+ rootdisk_sysdev
+ sdk_sandbox_service
+ selection_toolbar_service
+ smart_idle_maint_enabled_prop
+ snapuserd_proxy_socket
+ sysfs_fs_fuse_bpf
+ sysfs_gpu
+ sysfs_lru_gen_enabled
+ system_dlkm_file
+ system_user_mode_emulation_prop
+ tare_service
+ tv_iapp_service
+ untrusted_app_30
+ vendor_uuid_mapping_config_file
+ vendor_vm_data_file
+ vendor_vm_file
+ virtual_device_service
+ wallpaper_effects_generation_service
+))
diff --git a/prebuilts/api/202504/private/compat/33.0/33.0.cil b/prebuilts/api/202504/private/compat/33.0/33.0.cil
new file mode 100644
index 0000000..204048e
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/33.0/33.0.cil
@@ -0,0 +1,2649 @@
+;; types removed from current policy
+(type dice_maintenance_service)
+(type dice_node_service)
+(type diced)
+(type diced_exec)
+(type hal_dice_service)
+(type iorap_inode2filename)
+(type iorap_inode2filename_exec)
+(type iorap_inode2filename_tmpfs)
+(type iorap_prefetcherd)
+(type iorap_prefetcherd_exec)
+(type iorap_prefetcherd_tmpfs)
+(type iorapd)
+(type iorapd_data_file)
+(type iorapd_exec)
+(type iorapd_service)
+(type iorapd_tmpfs)
+(type lowpan_service)
+(type remotelyprovisionedkeypool_service)
+(type remoteprovisioning_service)
+(type timezone_service)
+(type tzdatacheck)
+(type tzdatacheck_exec)
+(type wpantund)
+(type wpantund_exec)
+(type wpantund_service)
+(type zoneinfo_data_file)
+
+;; mapping information from ToT policy's types to 33.0 policy's types.
+(expandtypeattribute (DockObserver_service_33_0) true)
+(expandtypeattribute (IProxyService_service_33_0) true)
+(expandtypeattribute (aac_drc_prop_33_0) true)
+(expandtypeattribute (aaudio_config_prop_33_0) true)
+(expandtypeattribute (ab_update_gki_prop_33_0) true)
+(expandtypeattribute (accessibility_service_33_0) true)
+(expandtypeattribute (account_service_33_0) true)
+(expandtypeattribute (activity_service_33_0) true)
+(expandtypeattribute (activity_task_service_33_0) true)
+(expandtypeattribute (adb_data_file_33_0) true)
+(expandtypeattribute (adb_keys_file_33_0) true)
+(expandtypeattribute (adb_service_33_0) true)
+(expandtypeattribute (adbd_33_0) true)
+(expandtypeattribute (adbd_config_prop_33_0) true)
+(expandtypeattribute (adbd_exec_33_0) true)
+(expandtypeattribute (adbd_socket_33_0) true)
+(expandtypeattribute (adservices_manager_service_33_0) true)
+(expandtypeattribute (aidl_lazy_test_server_33_0) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_33_0) true)
+(expandtypeattribute (aidl_lazy_test_service_33_0) true)
+(expandtypeattribute (alarm_service_33_0) true)
+(expandtypeattribute (anr_data_file_33_0) true)
+(expandtypeattribute (apc_service_33_0) true)
+(expandtypeattribute (apex_data_file_33_0) true)
+(expandtypeattribute (apex_info_file_33_0) true)
+(expandtypeattribute (apex_metadata_file_33_0) true)
+(expandtypeattribute (apex_mnt_dir_33_0) true)
+(expandtypeattribute (apex_module_data_file_33_0) true)
+(expandtypeattribute (apex_ota_reserved_file_33_0) true)
+(expandtypeattribute (apex_rollback_data_file_33_0) true)
+(expandtypeattribute (apex_service_33_0) true)
+(expandtypeattribute (apex_system_server_data_file_33_0) true)
+(expandtypeattribute (apexd_33_0) true)
+(expandtypeattribute (apexd_config_prop_33_0) true)
+(expandtypeattribute (apexd_exec_33_0) true)
+(expandtypeattribute (apexd_prop_33_0) true)
+(expandtypeattribute (apexd_select_prop_33_0) true)
+(expandtypeattribute (apk_data_file_33_0) true)
+(expandtypeattribute (apk_private_data_file_33_0) true)
+(expandtypeattribute (apk_private_tmp_file_33_0) true)
+(expandtypeattribute (apk_tmp_file_33_0) true)
+(expandtypeattribute (apk_verity_prop_33_0) true)
+(expandtypeattribute (app_binding_service_33_0) true)
+(expandtypeattribute (app_data_file_33_0) true)
+(expandtypeattribute (app_fuse_file_33_0) true)
+(expandtypeattribute (app_fusefs_33_0) true)
+(expandtypeattribute (app_hibernation_service_33_0) true)
+(expandtypeattribute (app_integrity_service_33_0) true)
+(expandtypeattribute (app_prediction_service_33_0) true)
+(expandtypeattribute (app_search_service_33_0) true)
+(expandtypeattribute (app_zygote_33_0) true)
+(expandtypeattribute (app_zygote_tmpfs_33_0) true)
+(expandtypeattribute (appcompat_data_file_33_0) true)
+(expandtypeattribute (appdomain_tmpfs_33_0) true)
+(expandtypeattribute (appops_service_33_0) true)
+(expandtypeattribute (appwidget_service_33_0) true)
+(expandtypeattribute (arm64_memtag_prop_33_0) true)
+(expandtypeattribute (art_apex_dir_33_0) true)
+(expandtypeattribute (artd_service_33_0) true)
+(expandtypeattribute (asec_apk_file_33_0) true)
+(expandtypeattribute (asec_image_file_33_0) true)
+(expandtypeattribute (asec_public_file_33_0) true)
+(expandtypeattribute (ashmem_device_33_0) true)
+(expandtypeattribute (ashmem_libcutils_device_33_0) true)
+(expandtypeattribute (assetatlas_service_33_0) true)
+(expandtypeattribute (atrace_33_0) true)
+(expandtypeattribute (attestation_verification_service_33_0) true)
+(expandtypeattribute (audio_config_prop_33_0) true)
+(expandtypeattribute (audio_data_file_33_0) true)
+(expandtypeattribute (audio_device_33_0) true)
+(expandtypeattribute (audio_prop_33_0) true)
+(expandtypeattribute (audio_service_33_0) true)
+(expandtypeattribute (audiohal_data_file_33_0) true)
+(expandtypeattribute (audioserver_33_0) true)
+(expandtypeattribute (audioserver_data_file_33_0) true)
+(expandtypeattribute (audioserver_service_33_0) true)
+(expandtypeattribute (audioserver_tmpfs_33_0) true)
+(expandtypeattribute (auth_service_33_0) true)
+(expandtypeattribute (authorization_service_33_0) true)
+(expandtypeattribute (autofill_service_33_0) true)
+(expandtypeattribute (backup_data_file_33_0) true)
+(expandtypeattribute (backup_service_33_0) true)
+(expandtypeattribute (battery_service_33_0) true)
+(expandtypeattribute (batteryproperties_service_33_0) true)
+(expandtypeattribute (batterystats_service_33_0) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_33_0) true)
+(expandtypeattribute (binder_cache_system_server_prop_33_0) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_33_0) true)
+(expandtypeattribute (binder_calls_stats_service_33_0) true)
+(expandtypeattribute (binder_device_33_0) true)
+(expandtypeattribute (binderfs_33_0) true)
+(expandtypeattribute (binderfs_features_33_0) true)
+(expandtypeattribute (binderfs_logs_33_0) true)
+(expandtypeattribute (binderfs_logs_proc_33_0) true)
+(expandtypeattribute (binfmt_miscfs_33_0) true)
+(expandtypeattribute (biometric_service_33_0) true)
+(expandtypeattribute (blkid_33_0) true)
+(expandtypeattribute (blkid_untrusted_33_0) true)
+(expandtypeattribute (blob_store_service_33_0) true)
+(expandtypeattribute (block_device_33_0) true)
+(expandtypeattribute (bluetooth_33_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_33_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_33_0) true)
+(expandtypeattribute (bluetooth_config_prop_33_0) true)
+(expandtypeattribute (bluetooth_data_file_33_0) true)
+(expandtypeattribute (bluetooth_efs_file_33_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_33_0) true)
+(expandtypeattribute (bluetooth_manager_service_33_0) true)
+(expandtypeattribute (bluetooth_prop_33_0) true)
+(expandtypeattribute (bluetooth_service_33_0) true)
+(expandtypeattribute (bluetooth_socket_33_0) true)
+(expandtypeattribute (boot_block_device_33_0) true)
+(expandtypeattribute (boot_status_prop_33_0) true)
+(expandtypeattribute (bootanim_33_0) true)
+(expandtypeattribute (bootanim_config_prop_33_0) true)
+(expandtypeattribute (bootanim_exec_33_0) true)
+(expandtypeattribute (bootanim_system_prop_33_0) true)
+(expandtypeattribute (bootchart_data_file_33_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_33_0) true)
+(expandtypeattribute (bootloader_prop_33_0) true)
+(expandtypeattribute (bootstat_33_0) true)
+(expandtypeattribute (bootstat_data_file_33_0) true)
+(expandtypeattribute (bootstat_exec_33_0) true)
+(expandtypeattribute (boottime_prop_33_0) true)
+(expandtypeattribute (boottime_public_prop_33_0) true)
+(expandtypeattribute (boottrace_data_file_33_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_33_0) true)
+(expandtypeattribute (bpfloader_33_0) true)
+(expandtypeattribute (bq_config_prop_33_0) true)
+(expandtypeattribute (broadcastradio_service_33_0) true)
+(expandtypeattribute (bufferhubd_33_0) true)
+(expandtypeattribute (bufferhubd_exec_33_0) true)
+(expandtypeattribute (bugreport_service_33_0) true)
+(expandtypeattribute (build_bootimage_prop_33_0) true)
+(expandtypeattribute (build_config_prop_33_0) true)
+(expandtypeattribute (build_odm_prop_33_0) true)
+(expandtypeattribute (build_prop_33_0) true)
+(expandtypeattribute (build_vendor_prop_33_0) true)
+(expandtypeattribute (cache_backup_file_33_0) true)
+(expandtypeattribute (cache_block_device_33_0) true)
+(expandtypeattribute (cache_file_33_0) true)
+(expandtypeattribute (cache_private_backup_file_33_0) true)
+(expandtypeattribute (cache_recovery_file_33_0) true)
+(expandtypeattribute (cacheinfo_service_33_0) true)
+(expandtypeattribute (camera2_extensions_prop_33_0) true)
+(expandtypeattribute (camera_calibration_prop_33_0) true)
+(expandtypeattribute (camera_config_prop_33_0) true)
+(expandtypeattribute (camera_data_file_33_0) true)
+(expandtypeattribute (camera_device_33_0) true)
+(expandtypeattribute (cameraproxy_service_33_0) true)
+(expandtypeattribute (cameraserver_33_0) true)
+(expandtypeattribute (cameraserver_exec_33_0) true)
+(expandtypeattribute (cameraserver_service_33_0) true)
+(expandtypeattribute (cameraserver_tmpfs_33_0) true)
+(expandtypeattribute (camerax_extensions_prop_33_0) true)
+(expandtypeattribute (cgroup_33_0) true)
+(expandtypeattribute (cgroup_desc_api_file_33_0) true)
+(expandtypeattribute (cgroup_desc_file_33_0) true)
+(expandtypeattribute (cgroup_rc_file_33_0) true)
+(expandtypeattribute (cgroup_v2_33_0) true)
+(expandtypeattribute (charger_33_0) true)
+(expandtypeattribute (charger_config_prop_33_0) true)
+(expandtypeattribute (charger_exec_33_0) true)
+(expandtypeattribute (charger_prop_33_0) true)
+(expandtypeattribute (charger_status_prop_33_0) true)
+(expandtypeattribute (charger_vendor_33_0) true)
+(expandtypeattribute (clipboard_service_33_0) true)
+(expandtypeattribute (cloudsearch_service_33_0) true)
+(expandtypeattribute (codec2_config_prop_33_0) true)
+(expandtypeattribute (cold_boot_done_prop_33_0) true)
+(expandtypeattribute (color_display_service_33_0) true)
+(expandtypeattribute (companion_device_service_33_0) true)
+(expandtypeattribute (config_prop_33_0) true)
+(expandtypeattribute (configfs_33_0) true)
+(expandtypeattribute (connectivity_native_service_33_0) true)
+(expandtypeattribute (connectivity_service_33_0) true)
+(expandtypeattribute (connmetrics_service_33_0) true)
+(expandtypeattribute (console_device_33_0) true)
+(expandtypeattribute (consumer_ir_service_33_0) true)
+(expandtypeattribute (content_capture_service_33_0) true)
+(expandtypeattribute (content_service_33_0) true)
+(expandtypeattribute (content_suggestions_service_33_0) true)
+(expandtypeattribute (contexthub_service_33_0) true)
+(expandtypeattribute (coredump_file_33_0) true)
+(expandtypeattribute (country_detector_service_33_0) true)
+(expandtypeattribute (coverage_service_33_0) true)
+(expandtypeattribute (cppreopt_prop_33_0) true)
+(expandtypeattribute (cpu_variant_prop_33_0) true)
+(expandtypeattribute (cpuinfo_service_33_0) true)
+(expandtypeattribute (crash_dump_33_0) true)
+(expandtypeattribute (crash_dump_exec_33_0) true)
+(expandtypeattribute (credstore_33_0) true)
+(expandtypeattribute (credstore_data_file_33_0) true)
+(expandtypeattribute (credstore_exec_33_0) true)
+(expandtypeattribute (credstore_service_33_0) true)
+(expandtypeattribute (crossprofileapps_service_33_0) true)
+(expandtypeattribute (ctl_adbd_prop_33_0) true)
+(expandtypeattribute (ctl_apexd_prop_33_0) true)
+(expandtypeattribute (ctl_bootanim_prop_33_0) true)
+(expandtypeattribute (ctl_bugreport_prop_33_0) true)
+(expandtypeattribute (ctl_console_prop_33_0) true)
+(expandtypeattribute (ctl_default_prop_33_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_33_0) true)
+(expandtypeattribute (ctl_fuse_prop_33_0) true)
+(expandtypeattribute (ctl_gsid_prop_33_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_33_0) true)
+(expandtypeattribute (ctl_interface_start_prop_33_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_33_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_33_0) true)
+(expandtypeattribute (ctl_restart_prop_33_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_33_0) true)
+(expandtypeattribute (ctl_sigstop_prop_33_0) true)
+(expandtypeattribute (ctl_start_prop_33_0) true)
+(expandtypeattribute (ctl_stop_prop_33_0) true)
+(expandtypeattribute (dalvik_config_prop_33_0) true)
+(expandtypeattribute (dalvik_prop_33_0) true)
+(expandtypeattribute (dalvik_runtime_prop_33_0) true)
+(expandtypeattribute (dalvikcache_data_file_33_0) true)
+(expandtypeattribute (dataloader_manager_service_33_0) true)
+(expandtypeattribute (dbinfo_service_33_0) true)
+(expandtypeattribute (dck_prop_33_0) true)
+(expandtypeattribute (debug_prop_33_0) true)
+(expandtypeattribute (debugfs_33_0) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_33_0) true)
+(expandtypeattribute (debugfs_kprobes_33_0) true)
+(expandtypeattribute (debugfs_mm_events_tracing_33_0) true)
+(expandtypeattribute (debugfs_mmc_33_0) true)
+(expandtypeattribute (debugfs_restriction_prop_33_0) true)
+(expandtypeattribute (debugfs_trace_marker_33_0) true)
+(expandtypeattribute (debugfs_tracing_33_0) true)
+(expandtypeattribute (debugfs_tracing_debug_33_0) true)
+(expandtypeattribute (debugfs_tracing_instances_33_0) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_33_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_33_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_33_0) true)
+(expandtypeattribute (debuggerd_prop_33_0) true)
+(expandtypeattribute (default_android_hwservice_33_0) true)
+(expandtypeattribute (default_android_service_33_0) true)
+(expandtypeattribute (default_android_vndservice_33_0) true)
+(expandtypeattribute (default_prop_33_0) true)
+(expandtypeattribute (dev_cpu_variant_33_0) true)
+(expandtypeattribute (device_33_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_33_0) true)
+(expandtypeattribute (device_config_boot_count_prop_33_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_33_0) true)
+(expandtypeattribute (device_config_media_native_prop_33_0) true)
+(expandtypeattribute (device_config_netd_native_prop_33_0) true)
+(expandtypeattribute (device_config_nnapi_native_prop_33_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_33_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_33_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_33_0) true)
+(expandtypeattribute (device_config_service_33_0) true)
+(expandtypeattribute (device_config_surface_flinger_native_boot_prop_33_0) true)
+(expandtypeattribute (device_identifiers_service_33_0) true)
+(expandtypeattribute (device_logging_prop_33_0) true)
+(expandtypeattribute (device_policy_service_33_0) true)
+(expandtypeattribute (device_state_service_33_0) true)
+(expandtypeattribute (deviceidle_service_33_0) true)
+(expandtypeattribute (devicestoragemonitor_service_33_0) true)
+(expandtypeattribute (devpts_33_0) true)
+(expandtypeattribute (dhcp_33_0) true)
+(expandtypeattribute (dhcp_data_file_33_0) true)
+(expandtypeattribute (dhcp_exec_33_0) true)
+(expandtypeattribute (dhcp_prop_33_0) true)
+(expandtypeattribute (dice_maintenance_service_33_0) true)
+(expandtypeattribute (dice_node_service_33_0) true)
+(expandtypeattribute (diced_33_0) true)
+(expandtypeattribute (diced_exec_33_0) true)
+(expandtypeattribute (diskstats_service_33_0) true)
+(expandtypeattribute (display_service_33_0) true)
+(expandtypeattribute (dm_device_33_0) true)
+(expandtypeattribute (dm_user_device_33_0) true)
+(expandtypeattribute (dmabuf_heap_device_33_0) true)
+(expandtypeattribute (dmabuf_system_heap_device_33_0) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_33_0) true)
+(expandtypeattribute (dnsmasq_33_0) true)
+(expandtypeattribute (dnsmasq_exec_33_0) true)
+(expandtypeattribute (dnsproxyd_socket_33_0) true)
+(expandtypeattribute (dnsresolver_service_33_0) true)
+(expandtypeattribute (domain_verification_service_33_0) true)
+(expandtypeattribute (dreams_service_33_0) true)
+(expandtypeattribute (drm_data_file_33_0) true)
+(expandtypeattribute (drm_service_config_prop_33_0) true)
+(expandtypeattribute (drmserver_33_0) true)
+(expandtypeattribute (drmserver_exec_33_0) true)
+(expandtypeattribute (drmserver_service_33_0) true)
+(expandtypeattribute (drmserver_socket_33_0) true)
+(expandtypeattribute (dropbox_data_file_33_0) true)
+(expandtypeattribute (dropbox_service_33_0) true)
+(expandtypeattribute (dumpstate_33_0) true)
+(expandtypeattribute (dumpstate_exec_33_0) true)
+(expandtypeattribute (dumpstate_options_prop_33_0) true)
+(expandtypeattribute (dumpstate_prop_33_0) true)
+(expandtypeattribute (dumpstate_service_33_0) true)
+(expandtypeattribute (dumpstate_socket_33_0) true)
+(expandtypeattribute (dynamic_system_prop_33_0) true)
+(expandtypeattribute (e2fs_33_0) true)
+(expandtypeattribute (e2fs_exec_33_0) true)
+(expandtypeattribute (efs_file_33_0) true)
+(expandtypeattribute (emergency_affordance_service_33_0) true)
+(expandtypeattribute (ephemeral_app_33_0) true)
+(expandtypeattribute (ethernet_service_33_0) true)
+(expandtypeattribute (evsmanagerd_33_0) true)
+(expandtypeattribute (evsmanagerd_service_33_0) true)
+(expandtypeattribute (exfat_33_0) true)
+(expandtypeattribute (exported3_system_prop_33_0) true)
+(expandtypeattribute (exported_bluetooth_prop_33_0) true)
+(expandtypeattribute (exported_camera_prop_33_0) true)
+(expandtypeattribute (exported_config_prop_33_0) true)
+(expandtypeattribute (exported_default_prop_33_0) true)
+(expandtypeattribute (exported_dumpstate_prop_33_0) true)
+(expandtypeattribute (exported_overlay_prop_33_0) true)
+(expandtypeattribute (exported_pm_prop_33_0) true)
+(expandtypeattribute (exported_secure_prop_33_0) true)
+(expandtypeattribute (exported_system_prop_33_0) true)
+(expandtypeattribute (external_vibrator_service_33_0) true)
+(expandtypeattribute (extra_free_kbytes_33_0) true)
+(expandtypeattribute (extra_free_kbytes_exec_33_0) true)
+(expandtypeattribute (face_service_33_0) true)
+(expandtypeattribute (face_vendor_data_file_33_0) true)
+(expandtypeattribute (fastbootd_33_0) true)
+(expandtypeattribute (ffs_config_prop_33_0) true)
+(expandtypeattribute (ffs_control_prop_33_0) true)
+(expandtypeattribute (file_contexts_file_33_0) true)
+(expandtypeattribute (file_integrity_service_33_0) true)
+(expandtypeattribute (fingerprint_prop_33_0) true)
+(expandtypeattribute (fingerprint_service_33_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_33_0) true)
+(expandtypeattribute (fingerprintd_33_0) true)
+(expandtypeattribute (fingerprintd_data_file_33_0) true)
+(expandtypeattribute (fingerprintd_exec_33_0) true)
+(expandtypeattribute (fingerprintd_service_33_0) true)
+(expandtypeattribute (firstboot_prop_33_0) true)
+(expandtypeattribute (flags_health_check_33_0) true)
+(expandtypeattribute (flags_health_check_exec_33_0) true)
+(expandtypeattribute (font_service_33_0) true)
+(expandtypeattribute (framework_watchdog_config_prop_33_0) true)
+(expandtypeattribute (frp_block_device_33_0) true)
+(expandtypeattribute (fs_bpf_33_0) true)
+(expandtypeattribute (fs_bpf_tethering_33_0) true)
+(expandtypeattribute (fs_bpf_vendor_33_0) true)
+(expandtypeattribute (fsck_33_0) true)
+(expandtypeattribute (fsck_exec_33_0) true)
+(expandtypeattribute (fsck_untrusted_33_0) true)
+(expandtypeattribute (fscklogs_33_0) true)
+(expandtypeattribute (functionfs_33_0) true)
+(expandtypeattribute (fuse_33_0) true)
+(expandtypeattribute (fuse_device_33_0) true)
+(expandtypeattribute (fusectlfs_33_0) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_33_0) true)
+(expandtypeattribute (fwk_automotive_display_service_33_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_33_0) true)
+(expandtypeattribute (fwk_camera_hwservice_33_0) true)
+(expandtypeattribute (fwk_display_hwservice_33_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_33_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_33_0) true)
+(expandtypeattribute (fwk_stats_hwservice_33_0) true)
+(expandtypeattribute (fwk_stats_service_33_0) true)
+(expandtypeattribute (fwmarkd_socket_33_0) true)
+(expandtypeattribute (game_mode_intervention_list_file_33_0) true)
+(expandtypeattribute (game_service_33_0) true)
+(expandtypeattribute (gatekeeper_data_file_33_0) true)
+(expandtypeattribute (gatekeeper_service_33_0) true)
+(expandtypeattribute (gatekeeperd_33_0) true)
+(expandtypeattribute (gatekeeperd_exec_33_0) true)
+(expandtypeattribute (gesture_prop_33_0) true)
+(expandtypeattribute (gfxinfo_service_33_0) true)
+(expandtypeattribute (gmscore_app_33_0) true)
+(expandtypeattribute (gnss_device_33_0) true)
+(expandtypeattribute (gnss_time_update_service_33_0) true)
+(expandtypeattribute (gps_control_33_0) true)
+(expandtypeattribute (gpu_device_33_0) true)
+(expandtypeattribute (gpu_service_33_0) true)
+(expandtypeattribute (gpuservice_33_0) true)
+(expandtypeattribute (graphics_config_prop_33_0) true)
+(expandtypeattribute (graphics_device_33_0) true)
+(expandtypeattribute (graphicsstats_service_33_0) true)
+(expandtypeattribute (gsi_data_file_33_0) true)
+(expandtypeattribute (gsi_metadata_file_33_0) true)
+(expandtypeattribute (gsi_public_metadata_file_33_0) true)
+(expandtypeattribute (gwp_asan_prop_33_0) true)
+(expandtypeattribute (hal_atrace_hwservice_33_0) true)
+(expandtypeattribute (hal_audio_hwservice_33_0) true)
+(expandtypeattribute (hal_audio_service_33_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_33_0) true)
+(expandtypeattribute (hal_audiocontrol_service_33_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_33_0) true)
+(expandtypeattribute (hal_authsecret_service_33_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_33_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_33_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_33_0) true)
+(expandtypeattribute (hal_camera_hwservice_33_0) true)
+(expandtypeattribute (hal_camera_service_33_0) true)
+(expandtypeattribute (hal_can_bus_hwservice_33_0) true)
+(expandtypeattribute (hal_can_controller_hwservice_33_0) true)
+(expandtypeattribute (hal_cas_hwservice_33_0) true)
+(expandtypeattribute (hal_codec2_hwservice_33_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_33_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_33_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_33_0) true)
+(expandtypeattribute (hal_contexthub_service_33_0) true)
+(expandtypeattribute (hal_dice_service_33_0) true)
+(expandtypeattribute (hal_drm_hwservice_33_0) true)
+(expandtypeattribute (hal_drm_service_33_0) true)
+(expandtypeattribute (hal_dumpstate_config_prop_33_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_33_0) true)
+(expandtypeattribute (hal_dumpstate_service_33_0) true)
+(expandtypeattribute (hal_evs_hwservice_33_0) true)
+(expandtypeattribute (hal_evs_service_33_0) true)
+(expandtypeattribute (hal_face_hwservice_33_0) true)
+(expandtypeattribute (hal_face_service_33_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_33_0) true)
+(expandtypeattribute (hal_fingerprint_service_33_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_33_0) true)
+(expandtypeattribute (hal_gnss_hwservice_33_0) true)
+(expandtypeattribute (hal_gnss_service_33_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_33_0) true)
+(expandtypeattribute (hal_graphics_allocator_service_33_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_33_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_33_0) true)
+(expandtypeattribute (hal_graphics_composer_service_33_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_33_0) true)
+(expandtypeattribute (hal_health_hwservice_33_0) true)
+(expandtypeattribute (hal_health_service_33_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_33_0) true)
+(expandtypeattribute (hal_health_storage_service_33_0) true)
+(expandtypeattribute (hal_identity_service_33_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_33_0) true)
+(expandtypeattribute (hal_input_processor_service_33_0) true)
+(expandtypeattribute (hal_instrumentation_prop_33_0) true)
+(expandtypeattribute (hal_ir_hwservice_33_0) true)
+(expandtypeattribute (hal_ir_service_33_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_33_0) true)
+(expandtypeattribute (hal_keymint_service_33_0) true)
+(expandtypeattribute (hal_light_hwservice_33_0) true)
+(expandtypeattribute (hal_light_service_33_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_33_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_33_0) true)
+(expandtypeattribute (hal_memtrack_service_33_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_33_0) true)
+(expandtypeattribute (hal_neuralnetworks_service_33_0) true)
+(expandtypeattribute (hal_nfc_hwservice_33_0) true)
+(expandtypeattribute (hal_nfc_service_33_0) true)
+(expandtypeattribute (hal_nlinterceptor_service_33_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_33_0) true)
+(expandtypeattribute (hal_oemlock_service_33_0) true)
+(expandtypeattribute (hal_omx_hwservice_33_0) true)
+(expandtypeattribute (hal_power_hwservice_33_0) true)
+(expandtypeattribute (hal_power_service_33_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_33_0) true)
+(expandtypeattribute (hal_power_stats_service_33_0) true)
+(expandtypeattribute (hal_radio_service_33_0) true)
+(expandtypeattribute (hal_rebootescrow_service_33_0) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_33_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_33_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_33_0) true)
+(expandtypeattribute (hal_secureclock_service_33_0) true)
+(expandtypeattribute (hal_sensors_hwservice_33_0) true)
+(expandtypeattribute (hal_sensors_service_33_0) true)
+(expandtypeattribute (hal_sharedsecret_service_33_0) true)
+(expandtypeattribute (hal_system_suspend_service_33_0) true)
+(expandtypeattribute (hal_telephony_hwservice_33_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_33_0) true)
+(expandtypeattribute (hal_thermal_hwservice_33_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_33_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_33_0) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_33_0) true)
+(expandtypeattribute (hal_tv_tuner_service_33_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_33_0) true)
+(expandtypeattribute (hal_usb_hwservice_33_0) true)
+(expandtypeattribute (hal_usb_service_33_0) true)
+(expandtypeattribute (hal_uwb_service_33_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_33_0) true)
+(expandtypeattribute (hal_vehicle_service_33_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_33_0) true)
+(expandtypeattribute (hal_vibrator_service_33_0) true)
+(expandtypeattribute (hal_vr_hwservice_33_0) true)
+(expandtypeattribute (hal_weaver_hwservice_33_0) true)
+(expandtypeattribute (hal_weaver_service_33_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_33_0) true)
+(expandtypeattribute (hal_wifi_hostapd_service_33_0) true)
+(expandtypeattribute (hal_wifi_hwservice_33_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_33_0) true)
+(expandtypeattribute (hal_wifi_supplicant_service_33_0) true)
+(expandtypeattribute (hardware_properties_service_33_0) true)
+(expandtypeattribute (hardware_service_33_0) true)
+(expandtypeattribute (hci_attach_dev_33_0) true)
+(expandtypeattribute (hdmi_config_prop_33_0) true)
+(expandtypeattribute (hdmi_control_service_33_0) true)
+(expandtypeattribute (healthd_33_0) true)
+(expandtypeattribute (heapdump_data_file_33_0) true)
+(expandtypeattribute (heapprofd_33_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_33_0) true)
+(expandtypeattribute (heapprofd_prop_33_0) true)
+(expandtypeattribute (heapprofd_socket_33_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_33_0) true)
+(expandtypeattribute (hidl_base_hwservice_33_0) true)
+(expandtypeattribute (hidl_manager_hwservice_33_0) true)
+(expandtypeattribute (hidl_memory_hwservice_33_0) true)
+(expandtypeattribute (hidl_token_hwservice_33_0) true)
+(expandtypeattribute (hint_service_33_0) true)
+(expandtypeattribute (hw_random_device_33_0) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_33_0) true)
+(expandtypeattribute (hwbinder_device_33_0) true)
+(expandtypeattribute (hwservice_contexts_file_33_0) true)
+(expandtypeattribute (hwservicemanager_33_0) true)
+(expandtypeattribute (hwservicemanager_exec_33_0) true)
+(expandtypeattribute (hwservicemanager_prop_33_0) true)
+(expandtypeattribute (hypervisor_prop_33_0) true)
+(expandtypeattribute (icon_file_33_0) true)
+(expandtypeattribute (idmap_33_0) true)
+(expandtypeattribute (idmap_exec_33_0) true)
+(expandtypeattribute (idmap_service_33_0) true)
+(expandtypeattribute (iio_device_33_0) true)
+(expandtypeattribute (imms_service_33_0) true)
+(expandtypeattribute (incident_33_0) true)
+(expandtypeattribute (incident_data_file_33_0) true)
+(expandtypeattribute (incident_helper_33_0) true)
+(expandtypeattribute (incident_service_33_0) true)
+(expandtypeattribute (incidentd_33_0) true)
+(expandtypeattribute (incremental_control_file_33_0) true)
+(expandtypeattribute (incremental_prop_33_0) true)
+(expandtypeattribute (incremental_service_33_0) true)
+(expandtypeattribute (init_33_0) true)
+(expandtypeattribute (init_exec_33_0) true)
+(expandtypeattribute (init_service_status_prop_33_0) true)
+(expandtypeattribute (init_tmpfs_33_0) true)
+(expandtypeattribute (inotify_33_0) true)
+(expandtypeattribute (input_device_33_0) true)
+(expandtypeattribute (input_method_service_33_0) true)
+(expandtypeattribute (input_service_33_0) true)
+(expandtypeattribute (inputflinger_33_0) true)
+(expandtypeattribute (inputflinger_exec_33_0) true)
+(expandtypeattribute (inputflinger_service_33_0) true)
+(expandtypeattribute (install_data_file_33_0) true)
+(expandtypeattribute (installd_33_0) true)
+(expandtypeattribute (installd_exec_33_0) true)
+(expandtypeattribute (installd_service_33_0) true)
+(expandtypeattribute (ion_device_33_0) true)
+(expandtypeattribute (iorap_inode2filename_33_0) true)
+(expandtypeattribute (iorap_inode2filename_exec_33_0) true)
+(expandtypeattribute (iorap_inode2filename_tmpfs_33_0) true)
+(expandtypeattribute (iorap_prefetcherd_33_0) true)
+(expandtypeattribute (iorap_prefetcherd_exec_33_0) true)
+(expandtypeattribute (iorap_prefetcherd_tmpfs_33_0) true)
+(expandtypeattribute (iorapd_33_0) true)
+(expandtypeattribute (iorapd_data_file_33_0) true)
+(expandtypeattribute (iorapd_exec_33_0) true)
+(expandtypeattribute (iorapd_service_33_0) true)
+(expandtypeattribute (iorapd_tmpfs_33_0) true)
+(expandtypeattribute (ipsec_service_33_0) true)
+(expandtypeattribute (iris_service_33_0) true)
+(expandtypeattribute (iris_vendor_data_file_33_0) true)
+(expandtypeattribute (isolated_app_33_0) true)
+(expandtypeattribute (jobscheduler_service_33_0) true)
+(expandtypeattribute (kernel_33_0) true)
+(expandtypeattribute (keychain_data_file_33_0) true)
+(expandtypeattribute (keychord_device_33_0) true)
+(expandtypeattribute (keyguard_config_prop_33_0) true)
+(expandtypeattribute (keystore2_key_contexts_file_33_0) true)
+(expandtypeattribute (keystore_33_0) true)
+(expandtypeattribute (keystore_compat_hal_service_33_0) true)
+(expandtypeattribute (keystore_data_file_33_0) true)
+(expandtypeattribute (keystore_exec_33_0) true)
+(expandtypeattribute (keystore_maintenance_service_33_0) true)
+(expandtypeattribute (keystore_metrics_service_33_0) true)
+(expandtypeattribute (keystore_service_33_0) true)
+(expandtypeattribute (kmsg_debug_device_33_0) true)
+(expandtypeattribute (kmsg_device_33_0) true)
+(expandtypeattribute (labeledfs_33_0) true)
+(expandtypeattribute (launcherapps_service_33_0) true)
+(expandtypeattribute (legacy_permission_service_33_0) true)
+(expandtypeattribute (legacykeystore_service_33_0) true)
+(expandtypeattribute (libc_debug_prop_33_0) true)
+(expandtypeattribute (light_service_33_0) true)
+(expandtypeattribute (linkerconfig_file_33_0) true)
+(expandtypeattribute (llkd_33_0) true)
+(expandtypeattribute (llkd_exec_33_0) true)
+(expandtypeattribute (llkd_prop_33_0) true)
+(expandtypeattribute (lmkd_33_0) true)
+(expandtypeattribute (lmkd_config_prop_33_0) true)
+(expandtypeattribute (lmkd_exec_33_0) true)
+(expandtypeattribute (lmkd_prop_33_0) true)
+(expandtypeattribute (lmkd_socket_33_0) true)
+(expandtypeattribute (locale_service_33_0) true)
+(expandtypeattribute (location_service_33_0) true)
+(expandtypeattribute (location_time_zone_manager_service_33_0) true)
+(expandtypeattribute (lock_settings_service_33_0) true)
+(expandtypeattribute (log_prop_33_0) true)
+(expandtypeattribute (log_tag_prop_33_0) true)
+(expandtypeattribute (logcat_exec_33_0) true)
+(expandtypeattribute (logd_33_0) true)
+(expandtypeattribute (logd_exec_33_0) true)
+(expandtypeattribute (logd_prop_33_0) true)
+(expandtypeattribute (logd_socket_33_0) true)
+(expandtypeattribute (logdr_socket_33_0) true)
+(expandtypeattribute (logdw_socket_33_0) true)
+(expandtypeattribute (logpersist_33_0) true)
+(expandtypeattribute (logpersistd_logging_prop_33_0) true)
+(expandtypeattribute (loop_control_device_33_0) true)
+(expandtypeattribute (loop_device_33_0) true)
+(expandtypeattribute (looper_stats_service_33_0) true)
+(expandtypeattribute (lowpan_device_33_0) true)
+(expandtypeattribute (lowpan_prop_33_0) true)
+(expandtypeattribute (lowpan_service_33_0) true)
+(expandtypeattribute (lpdump_service_33_0) true)
+(expandtypeattribute (lpdumpd_prop_33_0) true)
+(expandtypeattribute (mac_perms_file_33_0) true)
+(expandtypeattribute (mdns_service_33_0) true)
+(expandtypeattribute (mdns_socket_33_0) true)
+(expandtypeattribute (mdnsd_33_0) true)
+(expandtypeattribute (mdnsd_socket_33_0) true)
+(expandtypeattribute (media_communication_service_33_0) true)
+(expandtypeattribute (media_config_prop_33_0) true)
+(expandtypeattribute (media_data_file_33_0) true)
+(expandtypeattribute (media_metrics_service_33_0) true)
+(expandtypeattribute (media_projection_service_33_0) true)
+(expandtypeattribute (media_router_service_33_0) true)
+(expandtypeattribute (media_rw_data_file_33_0) true)
+(expandtypeattribute (media_session_service_33_0) true)
+(expandtypeattribute (media_variant_prop_33_0) true)
+(expandtypeattribute (mediadrm_config_prop_33_0) true)
+(expandtypeattribute (mediadrmserver_33_0) true)
+(expandtypeattribute (mediadrmserver_exec_33_0) true)
+(expandtypeattribute (mediadrmserver_service_33_0) true)
+(expandtypeattribute (mediaextractor_33_0) true)
+(expandtypeattribute (mediaextractor_exec_33_0) true)
+(expandtypeattribute (mediaextractor_service_33_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_33_0) true)
+(expandtypeattribute (mediametrics_33_0) true)
+(expandtypeattribute (mediametrics_exec_33_0) true)
+(expandtypeattribute (mediametrics_service_33_0) true)
+(expandtypeattribute (mediaprovider_33_0) true)
+(expandtypeattribute (mediaserver_33_0) true)
+(expandtypeattribute (mediaserver_exec_33_0) true)
+(expandtypeattribute (mediaserver_service_33_0) true)
+(expandtypeattribute (mediaserver_tmpfs_33_0) true)
+(expandtypeattribute (mediaswcodec_33_0) true)
+(expandtypeattribute (mediaswcodec_exec_33_0) true)
+(expandtypeattribute (mediatranscoding_33_0) true)
+(expandtypeattribute (mediatranscoding_service_33_0) true)
+(expandtypeattribute (meminfo_service_33_0) true)
+(expandtypeattribute (memtrackproxy_service_33_0) true)
+(expandtypeattribute (metadata_block_device_33_0) true)
+(expandtypeattribute (metadata_bootstat_file_33_0) true)
+(expandtypeattribute (metadata_file_33_0) true)
+(expandtypeattribute (method_trace_data_file_33_0) true)
+(expandtypeattribute (midi_service_33_0) true)
+(expandtypeattribute (mirror_data_file_33_0) true)
+(expandtypeattribute (misc_block_device_33_0) true)
+(expandtypeattribute (misc_logd_file_33_0) true)
+(expandtypeattribute (misc_user_data_file_33_0) true)
+(expandtypeattribute (mm_events_config_prop_33_0) true)
+(expandtypeattribute (mmc_prop_33_0) true)
+(expandtypeattribute (mnt_expand_file_33_0) true)
+(expandtypeattribute (mnt_media_rw_file_33_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_33_0) true)
+(expandtypeattribute (mnt_pass_through_file_33_0) true)
+(expandtypeattribute (mnt_product_file_33_0) true)
+(expandtypeattribute (mnt_sdcard_file_33_0) true)
+(expandtypeattribute (mnt_user_file_33_0) true)
+(expandtypeattribute (mnt_vendor_file_33_0) true)
+(expandtypeattribute (mock_ota_prop_33_0) true)
+(expandtypeattribute (modprobe_33_0) true)
+(expandtypeattribute (module_sdkextensions_prop_33_0) true)
+(expandtypeattribute (mount_service_33_0) true)
+(expandtypeattribute (mqueue_33_0) true)
+(expandtypeattribute (mtp_33_0) true)
+(expandtypeattribute (mtp_device_33_0) true)
+(expandtypeattribute (mtp_exec_33_0) true)
+(expandtypeattribute (mtpd_socket_33_0) true)
+(expandtypeattribute (music_recognition_service_33_0) true)
+(expandtypeattribute (nativetest_data_file_33_0) true)
+(expandtypeattribute (nearby_service_33_0) true)
+(expandtypeattribute (net_data_file_33_0) true)
+(expandtypeattribute (net_dns_prop_33_0) true)
+(expandtypeattribute (net_radio_prop_33_0) true)
+(expandtypeattribute (netd_33_0) true)
+(expandtypeattribute (netd_exec_33_0) true)
+(expandtypeattribute (netd_listener_service_33_0) true)
+(expandtypeattribute (netd_service_33_0) true)
+(expandtypeattribute (netif_33_0) true)
+(expandtypeattribute (netpolicy_service_33_0) true)
+(expandtypeattribute (netstats_service_33_0) true)
+(expandtypeattribute (netutils_wrapper_33_0) true)
+(expandtypeattribute (netutils_wrapper_exec_33_0) true)
+(expandtypeattribute (network_management_service_33_0) true)
+(expandtypeattribute (network_score_service_33_0) true)
+(expandtypeattribute (network_stack_33_0) true)
+(expandtypeattribute (network_stack_service_33_0) true)
+(expandtypeattribute (network_time_update_service_33_0) true)
+(expandtypeattribute (network_watchlist_data_file_33_0) true)
+(expandtypeattribute (network_watchlist_service_33_0) true)
+(expandtypeattribute (nfc_33_0) true)
+(expandtypeattribute (nfc_data_file_33_0) true)
+(expandtypeattribute (nfc_device_33_0) true)
+(expandtypeattribute (nfc_logs_data_file_33_0) true)
+(expandtypeattribute (nfc_prop_33_0) true)
+(expandtypeattribute (nfc_service_33_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_33_0) true)
+(expandtypeattribute (node_33_0) true)
+(expandtypeattribute (notification_service_33_0) true)
+(expandtypeattribute (null_device_33_0) true)
+(expandtypeattribute (oem_lock_service_33_0) true)
+(expandtypeattribute (oem_unlock_prop_33_0) true)
+(expandtypeattribute (oemfs_33_0) true)
+(expandtypeattribute (ota_data_file_33_0) true)
+(expandtypeattribute (ota_metadata_file_33_0) true)
+(expandtypeattribute (ota_package_file_33_0) true)
+(expandtypeattribute (ota_prop_33_0) true)
+(expandtypeattribute (otadexopt_service_33_0) true)
+(expandtypeattribute (otapreopt_chroot_33_0) true)
+(expandtypeattribute (overlay_prop_33_0) true)
+(expandtypeattribute (overlay_service_33_0) true)
+(expandtypeattribute (overlayfs_file_33_0) true)
+(expandtypeattribute (owntty_device_33_0) true)
+(expandtypeattribute (pac_proxy_service_33_0) true)
+(expandtypeattribute (package_native_service_33_0) true)
+(expandtypeattribute (package_service_33_0) true)
+(expandtypeattribute (packagemanager_config_prop_33_0) true)
+(expandtypeattribute (packages_list_file_33_0) true)
+(expandtypeattribute (pan_result_prop_33_0) true)
+(expandtypeattribute (password_slot_metadata_file_33_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_33_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_33_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_33_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_display_dir_33_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_33_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_33_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_33_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_33_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_33_0) true)
+(expandtypeattribute (pdx_performance_dir_33_0) true)
+(expandtypeattribute (people_service_33_0) true)
+(expandtypeattribute (perfetto_33_0) true)
+(expandtypeattribute (performanced_33_0) true)
+(expandtypeattribute (performanced_exec_33_0) true)
+(expandtypeattribute (permission_checker_service_33_0) true)
+(expandtypeattribute (permission_service_33_0) true)
+(expandtypeattribute (permissionmgr_service_33_0) true)
+(expandtypeattribute (persist_debug_prop_33_0) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_33_0) true)
+(expandtypeattribute (persist_wm_debug_prop_33_0) true)
+(expandtypeattribute (persistent_data_block_service_33_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_33_0) true)
+(expandtypeattribute (pinner_service_33_0) true)
+(expandtypeattribute (pipefs_33_0) true)
+(expandtypeattribute (platform_app_33_0) true)
+(expandtypeattribute (platform_compat_service_33_0) true)
+(expandtypeattribute (pmsg_device_33_0) true)
+(expandtypeattribute (port_33_0) true)
+(expandtypeattribute (port_device_33_0) true)
+(expandtypeattribute (postinstall_33_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_33_0) true)
+(expandtypeattribute (postinstall_file_33_0) true)
+(expandtypeattribute (postinstall_mnt_dir_33_0) true)
+(expandtypeattribute (power_debug_prop_33_0) true)
+(expandtypeattribute (power_service_33_0) true)
+(expandtypeattribute (powerctl_prop_33_0) true)
+(expandtypeattribute (powerstats_service_33_0) true)
+(expandtypeattribute (ppp_33_0) true)
+(expandtypeattribute (ppp_device_33_0) true)
+(expandtypeattribute (ppp_exec_33_0) true)
+(expandtypeattribute (preloads_data_file_33_0) true)
+(expandtypeattribute (preloads_media_file_33_0) true)
+(expandtypeattribute (prereboot_data_file_33_0) true)
+(expandtypeattribute (print_service_33_0) true)
+(expandtypeattribute (priv_app_33_0) true)
+(expandtypeattribute (privapp_data_file_33_0) true)
+(expandtypeattribute (proc_33_0) true)
+(expandtypeattribute (proc_abi_33_0) true)
+(expandtypeattribute (proc_asound_33_0) true)
+(expandtypeattribute (proc_bluetooth_writable_33_0) true)
+(expandtypeattribute (proc_bootconfig_33_0) true)
+(expandtypeattribute (proc_bpf_33_0) true)
+(expandtypeattribute (proc_buddyinfo_33_0) true)
+(expandtypeattribute (proc_cmdline_33_0) true)
+(expandtypeattribute (proc_cpu_alignment_33_0) true)
+(expandtypeattribute (proc_cpuinfo_33_0) true)
+(expandtypeattribute (proc_dirty_33_0) true)
+(expandtypeattribute (proc_diskstats_33_0) true)
+(expandtypeattribute (proc_drop_caches_33_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_33_0) true)
+(expandtypeattribute (proc_filesystems_33_0) true)
+(expandtypeattribute (proc_fs_verity_33_0) true)
+(expandtypeattribute (proc_hostname_33_0) true)
+(expandtypeattribute (proc_hung_task_33_0) true)
+(expandtypeattribute (proc_interrupts_33_0) true)
+(expandtypeattribute (proc_iomem_33_0) true)
+(expandtypeattribute (proc_kallsyms_33_0) true)
+(expandtypeattribute (proc_keys_33_0) true)
+(expandtypeattribute (proc_kmsg_33_0) true)
+(expandtypeattribute (proc_kpageflags_33_0) true)
+(expandtypeattribute (proc_loadavg_33_0) true)
+(expandtypeattribute (proc_locks_33_0) true)
+(expandtypeattribute (proc_lowmemorykiller_33_0) true)
+(expandtypeattribute (proc_max_map_count_33_0) true)
+(expandtypeattribute (proc_meminfo_33_0) true)
+(expandtypeattribute (proc_min_free_order_shift_33_0) true)
+(expandtypeattribute (proc_misc_33_0) true)
+(expandtypeattribute (proc_modules_33_0) true)
+(expandtypeattribute (proc_mounts_33_0) true)
+(expandtypeattribute (proc_net_33_0) true)
+(expandtypeattribute (proc_net_tcp_udp_33_0) true)
+(expandtypeattribute (proc_overcommit_memory_33_0) true)
+(expandtypeattribute (proc_page_cluster_33_0) true)
+(expandtypeattribute (proc_pagetypeinfo_33_0) true)
+(expandtypeattribute (proc_panic_33_0) true)
+(expandtypeattribute (proc_perf_33_0) true)
+(expandtypeattribute (proc_pid_max_33_0) true)
+(expandtypeattribute (proc_pipe_conf_33_0) true)
+(expandtypeattribute (proc_pressure_cpu_33_0) true)
+(expandtypeattribute (proc_pressure_io_33_0) true)
+(expandtypeattribute (proc_pressure_mem_33_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_33_0) true)
+(expandtypeattribute (proc_qtaguid_stat_33_0) true)
+(expandtypeattribute (proc_random_33_0) true)
+(expandtypeattribute (proc_sched_33_0) true)
+(expandtypeattribute (proc_security_33_0) true)
+(expandtypeattribute (proc_slabinfo_33_0) true)
+(expandtypeattribute (proc_stat_33_0) true)
+(expandtypeattribute (proc_swaps_33_0) true)
+(expandtypeattribute (proc_sysrq_33_0) true)
+(expandtypeattribute (proc_timer_33_0) true)
+(expandtypeattribute (proc_tty_drivers_33_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_33_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_33_0) true)
+(expandtypeattribute (proc_uid_cpupower_33_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_33_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_33_0) true)
+(expandtypeattribute (proc_uid_io_stats_33_0) true)
+(expandtypeattribute (proc_uid_procstat_set_33_0) true)
+(expandtypeattribute (proc_uid_time_in_state_33_0) true)
+(expandtypeattribute (proc_uptime_33_0) true)
+(expandtypeattribute (proc_vendor_sched_33_0) true)
+(expandtypeattribute (proc_version_33_0) true)
+(expandtypeattribute (proc_vmallocinfo_33_0) true)
+(expandtypeattribute (proc_vmstat_33_0) true)
+(expandtypeattribute (proc_watermark_boost_factor_33_0) true)
+(expandtypeattribute (proc_watermark_scale_factor_33_0) true)
+(expandtypeattribute (proc_zoneinfo_33_0) true)
+(expandtypeattribute (processinfo_service_33_0) true)
+(expandtypeattribute (procstats_service_33_0) true)
+(expandtypeattribute (profman_33_0) true)
+(expandtypeattribute (profman_dump_data_file_33_0) true)
+(expandtypeattribute (profman_exec_33_0) true)
+(expandtypeattribute (properties_device_33_0) true)
+(expandtypeattribute (properties_serial_33_0) true)
+(expandtypeattribute (property_contexts_file_33_0) true)
+(expandtypeattribute (property_data_file_33_0) true)
+(expandtypeattribute (property_info_33_0) true)
+(expandtypeattribute (property_service_version_prop_33_0) true)
+(expandtypeattribute (property_socket_33_0) true)
+(expandtypeattribute (provisioned_prop_33_0) true)
+(expandtypeattribute (pstorefs_33_0) true)
+(expandtypeattribute (ptmx_device_33_0) true)
+(expandtypeattribute (qemu_hw_prop_33_0) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_33_0) true)
+(expandtypeattribute (qtaguid_device_33_0) true)
+(expandtypeattribute (racoon_33_0) true)
+(expandtypeattribute (racoon_exec_33_0) true)
+(expandtypeattribute (racoon_socket_33_0) true)
+(expandtypeattribute (radio_33_0) true)
+(expandtypeattribute (radio_control_prop_33_0) true)
+(expandtypeattribute (radio_core_data_file_33_0) true)
+(expandtypeattribute (radio_data_file_33_0) true)
+(expandtypeattribute (radio_device_33_0) true)
+(expandtypeattribute (radio_prop_33_0) true)
+(expandtypeattribute (radio_service_33_0) true)
+(expandtypeattribute (ram_device_33_0) true)
+(expandtypeattribute (random_device_33_0) true)
+(expandtypeattribute (reboot_readiness_service_33_0) true)
+(expandtypeattribute (rebootescrow_hal_prop_33_0) true)
+(expandtypeattribute (recovery_33_0) true)
+(expandtypeattribute (recovery_block_device_33_0) true)
+(expandtypeattribute (recovery_config_prop_33_0) true)
+(expandtypeattribute (recovery_data_file_33_0) true)
+(expandtypeattribute (recovery_persist_33_0) true)
+(expandtypeattribute (recovery_persist_exec_33_0) true)
+(expandtypeattribute (recovery_refresh_33_0) true)
+(expandtypeattribute (recovery_refresh_exec_33_0) true)
+(expandtypeattribute (recovery_service_33_0) true)
+(expandtypeattribute (recovery_socket_33_0) true)
+(expandtypeattribute (registry_service_33_0) true)
+(expandtypeattribute (remotelyprovisionedkeypool_service_33_0) true)
+(expandtypeattribute (remoteprovisioning_service_33_0) true)
+(expandtypeattribute (resourcecache_data_file_33_0) true)
+(expandtypeattribute (resources_manager_service_33_0) true)
+(expandtypeattribute (restorecon_prop_33_0) true)
+(expandtypeattribute (restrictions_service_33_0) true)
+(expandtypeattribute (retaildemo_prop_33_0) true)
+(expandtypeattribute (rild_debug_socket_33_0) true)
+(expandtypeattribute (rild_socket_33_0) true)
+(expandtypeattribute (ringtone_file_33_0) true)
+(expandtypeattribute (role_service_33_0) true)
+(expandtypeattribute (rollback_service_33_0) true)
+(expandtypeattribute (root_block_device_33_0) true)
+(expandtypeattribute (rootdisk_sysdev_33_0) true)
+(expandtypeattribute (rootfs_33_0) true)
+(expandtypeattribute (rpmsg_device_33_0) true)
+(expandtypeattribute (rs_33_0) true)
+(expandtypeattribute (rs_exec_33_0) true)
+(expandtypeattribute (rss_hwm_reset_33_0) true)
+(expandtypeattribute (rtc_device_33_0) true)
+(expandtypeattribute (rttmanager_service_33_0) true)
+(expandtypeattribute (runas_33_0) true)
+(expandtypeattribute (runas_app_33_0) true)
+(expandtypeattribute (runas_exec_33_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_33_0) true)
+(expandtypeattribute (runtime_service_33_0) true)
+(expandtypeattribute (safemode_prop_33_0) true)
+(expandtypeattribute (same_process_hal_file_33_0) true)
+(expandtypeattribute (samplingprofiler_service_33_0) true)
+(expandtypeattribute (scheduling_policy_service_33_0) true)
+(expandtypeattribute (sdcard_block_device_33_0) true)
+(expandtypeattribute (sdcardd_33_0) true)
+(expandtypeattribute (sdcardd_exec_33_0) true)
+(expandtypeattribute (sdcardfs_33_0) true)
+(expandtypeattribute (sdk_sandbox_service_33_0) true)
+(expandtypeattribute (seapp_contexts_file_33_0) true)
+(expandtypeattribute (search_service_33_0) true)
+(expandtypeattribute (search_ui_service_33_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_33_0) true)
+(expandtypeattribute (secure_element_33_0) true)
+(expandtypeattribute (secure_element_device_33_0) true)
+(expandtypeattribute (secure_element_service_33_0) true)
+(expandtypeattribute (securityfs_33_0) true)
+(expandtypeattribute (selection_toolbar_service_33_0) true)
+(expandtypeattribute (selinuxfs_33_0) true)
+(expandtypeattribute (sendbug_config_prop_33_0) true)
+(expandtypeattribute (sensor_privacy_service_33_0) true)
+(expandtypeattribute (sensors_device_33_0) true)
+(expandtypeattribute (sensorservice_service_33_0) true)
+(expandtypeattribute (sepolicy_file_33_0) true)
+(expandtypeattribute (serial_device_33_0) true)
+(expandtypeattribute (serial_service_33_0) true)
+(expandtypeattribute (serialno_prop_33_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_33_0) true)
+(expandtypeattribute (service_contexts_file_33_0) true)
+(expandtypeattribute (service_manager_service_33_0) true)
+(expandtypeattribute (service_manager_vndservice_33_0) true)
+(expandtypeattribute (servicediscovery_service_33_0) true)
+(expandtypeattribute (servicemanager_33_0) true)
+(expandtypeattribute (servicemanager_exec_33_0) true)
+(expandtypeattribute (settings_service_33_0) true)
+(expandtypeattribute (sgdisk_33_0) true)
+(expandtypeattribute (sgdisk_exec_33_0) true)
+(expandtypeattribute (shared_relro_33_0) true)
+(expandtypeattribute (shared_relro_file_33_0) true)
+(expandtypeattribute (shell_33_0) true)
+(expandtypeattribute (shell_data_file_33_0) true)
+(expandtypeattribute (shell_exec_33_0) true)
+(expandtypeattribute (shell_prop_33_0) true)
+(expandtypeattribute (shell_test_data_file_33_0) true)
+(expandtypeattribute (shm_33_0) true)
+(expandtypeattribute (shortcut_manager_icons_33_0) true)
+(expandtypeattribute (shortcut_service_33_0) true)
+(expandtypeattribute (simpleperf_33_0) true)
+(expandtypeattribute (simpleperf_app_runner_33_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_33_0) true)
+(expandtypeattribute (slice_service_33_0) true)
+(expandtypeattribute (slideshow_33_0) true)
+(expandtypeattribute (smart_idle_maint_enabled_prop_33_0) true)
+(expandtypeattribute (smartspace_service_33_0) true)
+(expandtypeattribute (snapshotctl_log_data_file_33_0) true)
+(expandtypeattribute (snapuserd_proxy_socket_33_0) true)
+(expandtypeattribute (snapuserd_socket_33_0) true)
+(expandtypeattribute (soc_prop_33_0) true)
+(expandtypeattribute (socket_device_33_0) true)
+(expandtypeattribute (socket_hook_prop_33_0) true)
+(expandtypeattribute (sockfs_33_0) true)
+(expandtypeattribute (sota_prop_33_0) true)
+(expandtypeattribute (soundtrigger_middleware_service_33_0) true)
+(expandtypeattribute (speech_recognition_service_33_0) true)
+(expandtypeattribute (sqlite_log_prop_33_0) true)
+(expandtypeattribute (staged_install_file_33_0) true)
+(expandtypeattribute (staging_data_file_33_0) true)
+(expandtypeattribute (stats_data_file_33_0) true)
+(expandtypeattribute (statsd_33_0) true)
+(expandtypeattribute (statsd_exec_33_0) true)
+(expandtypeattribute (statsdw_socket_33_0) true)
+(expandtypeattribute (statusbar_service_33_0) true)
+(expandtypeattribute (storage_config_prop_33_0) true)
+(expandtypeattribute (storage_file_33_0) true)
+(expandtypeattribute (storage_stub_file_33_0) true)
+(expandtypeattribute (storaged_service_33_0) true)
+(expandtypeattribute (storagemanager_config_prop_33_0) true)
+(expandtypeattribute (storagestats_service_33_0) true)
+(expandtypeattribute (su_33_0) true)
+(expandtypeattribute (su_exec_33_0) true)
+(expandtypeattribute (super_block_device_33_0) true)
+(expandtypeattribute (surfaceflinger_33_0) true)
+(expandtypeattribute (surfaceflinger_color_prop_33_0) true)
+(expandtypeattribute (surfaceflinger_display_prop_33_0) true)
+(expandtypeattribute (surfaceflinger_prop_33_0) true)
+(expandtypeattribute (surfaceflinger_service_33_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_33_0) true)
+(expandtypeattribute (suspend_prop_33_0) true)
+(expandtypeattribute (swap_block_device_33_0) true)
+(expandtypeattribute (sysfs_33_0) true)
+(expandtypeattribute (sysfs_android_usb_33_0) true)
+(expandtypeattribute (sysfs_batteryinfo_33_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_33_0) true)
+(expandtypeattribute (sysfs_devfreq_cur_33_0) true)
+(expandtypeattribute (sysfs_devfreq_dir_33_0) true)
+(expandtypeattribute (sysfs_devices_block_33_0) true)
+(expandtypeattribute (sysfs_devices_cs_etm_33_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_33_0) true)
+(expandtypeattribute (sysfs_dm_33_0) true)
+(expandtypeattribute (sysfs_dm_verity_33_0) true)
+(expandtypeattribute (sysfs_dma_heap_33_0) true)
+(expandtypeattribute (sysfs_dmabuf_stats_33_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_33_0) true)
+(expandtypeattribute (sysfs_extcon_33_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_33_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_33_0) true)
+(expandtypeattribute (sysfs_fs_fuse_bpf_33_0) true)
+(expandtypeattribute (sysfs_fs_incfs_features_33_0) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_33_0) true)
+(expandtypeattribute (sysfs_gpu_33_0) true)
+(expandtypeattribute (sysfs_hwrandom_33_0) true)
+(expandtypeattribute (sysfs_ion_33_0) true)
+(expandtypeattribute (sysfs_ipv4_33_0) true)
+(expandtypeattribute (sysfs_kernel_notes_33_0) true)
+(expandtypeattribute (sysfs_leds_33_0) true)
+(expandtypeattribute (sysfs_loop_33_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_33_0) true)
+(expandtypeattribute (sysfs_lru_gen_enabled_33_0) true)
+(expandtypeattribute (sysfs_net_33_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_33_0) true)
+(expandtypeattribute (sysfs_power_33_0) true)
+(expandtypeattribute (sysfs_rtc_33_0) true)
+(expandtypeattribute (sysfs_suspend_stats_33_0) true)
+(expandtypeattribute (sysfs_switch_33_0) true)
+(expandtypeattribute (sysfs_thermal_33_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_33_0) true)
+(expandtypeattribute (sysfs_uhid_33_0) true)
+(expandtypeattribute (sysfs_uio_33_0) true)
+(expandtypeattribute (sysfs_usb_33_0) true)
+(expandtypeattribute (sysfs_usermodehelper_33_0) true)
+(expandtypeattribute (sysfs_vendor_sched_33_0) true)
+(expandtypeattribute (sysfs_vibrator_33_0) true)
+(expandtypeattribute (sysfs_wake_lock_33_0) true)
+(expandtypeattribute (sysfs_wakeup_33_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_33_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_33_0) true)
+(expandtypeattribute (sysfs_zram_33_0) true)
+(expandtypeattribute (sysfs_zram_uevent_33_0) true)
+(expandtypeattribute (system_app_33_0) true)
+(expandtypeattribute (system_app_data_file_33_0) true)
+(expandtypeattribute (system_app_service_33_0) true)
+(expandtypeattribute (system_asan_options_file_33_0) true)
+(expandtypeattribute (system_block_device_33_0) true)
+(expandtypeattribute (system_boot_reason_prop_33_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_33_0) true)
+(expandtypeattribute (system_config_service_33_0) true)
+(expandtypeattribute (system_data_file_33_0) true)
+(expandtypeattribute (system_data_root_file_33_0) true)
+(expandtypeattribute (system_dlkm_file_33_0) true)
+(expandtypeattribute (system_event_log_tags_file_33_0) true)
+(expandtypeattribute (system_file_33_0) true)
+(expandtypeattribute (system_group_file_33_0) true)
+(expandtypeattribute (system_jvmti_agent_prop_33_0) true)
+(expandtypeattribute (system_lib_file_33_0) true)
+(expandtypeattribute (system_linker_config_file_33_0) true)
+(expandtypeattribute (system_linker_exec_33_0) true)
+(expandtypeattribute (system_lmk_prop_33_0) true)
+(expandtypeattribute (system_ndebug_socket_33_0) true)
+(expandtypeattribute (system_net_netd_hwservice_33_0) true)
+(expandtypeattribute (system_passwd_file_33_0) true)
+(expandtypeattribute (system_prop_33_0) true)
+(expandtypeattribute (system_seccomp_policy_file_33_0) true)
+(expandtypeattribute (system_security_cacerts_file_33_0) true)
+(expandtypeattribute (system_server_33_0) true)
+(expandtypeattribute (system_server_dumper_service_33_0) true)
+(expandtypeattribute (system_server_tmpfs_33_0) true)
+(expandtypeattribute (system_suspend_control_internal_service_33_0) true)
+(expandtypeattribute (system_suspend_control_service_33_0) true)
+(expandtypeattribute (system_suspend_hwservice_33_0) true)
+(expandtypeattribute (system_trace_prop_33_0) true)
+(expandtypeattribute (system_unsolzygote_socket_33_0) true)
+(expandtypeattribute (system_update_service_33_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_33_0) true)
+(expandtypeattribute (system_wpa_socket_33_0) true)
+(expandtypeattribute (system_zoneinfo_file_33_0) true)
+(expandtypeattribute (systemkeys_data_file_33_0) true)
+(expandtypeattribute (systemsound_config_prop_33_0) true)
+(expandtypeattribute (tare_service_33_0) true)
+(expandtypeattribute (task_profiles_api_file_33_0) true)
+(expandtypeattribute (task_profiles_file_33_0) true)
+(expandtypeattribute (task_service_33_0) true)
+(expandtypeattribute (tcpdump_exec_33_0) true)
+(expandtypeattribute (tee_33_0) true)
+(expandtypeattribute (tee_data_file_33_0) true)
+(expandtypeattribute (tee_device_33_0) true)
+(expandtypeattribute (telecom_service_33_0) true)
+(expandtypeattribute (telephony_config_prop_33_0) true)
+(expandtypeattribute (telephony_status_prop_33_0) true)
+(expandtypeattribute (test_boot_reason_prop_33_0) true)
+(expandtypeattribute (test_harness_prop_33_0) true)
+(expandtypeattribute (testharness_service_33_0) true)
+(expandtypeattribute (tethering_service_33_0) true)
+(expandtypeattribute (textclassification_service_33_0) true)
+(expandtypeattribute (textclassifier_data_file_33_0) true)
+(expandtypeattribute (textservices_service_33_0) true)
+(expandtypeattribute (texttospeech_service_33_0) true)
+(expandtypeattribute (theme_prop_33_0) true)
+(expandtypeattribute (thermal_service_33_0) true)
+(expandtypeattribute (time_prop_33_0) true)
+(expandtypeattribute (timedetector_service_33_0) true)
+(expandtypeattribute (timezone_service_33_0) true)
+(expandtypeattribute (timezonedetector_service_33_0) true)
+(expandtypeattribute (tmpfs_33_0) true)
+(expandtypeattribute (tombstone_config_prop_33_0) true)
+(expandtypeattribute (tombstone_data_file_33_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_33_0) true)
+(expandtypeattribute (tombstoned_33_0) true)
+(expandtypeattribute (tombstoned_crash_socket_33_0) true)
+(expandtypeattribute (tombstoned_exec_33_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_33_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_33_0) true)
+(expandtypeattribute (toolbox_33_0) true)
+(expandtypeattribute (toolbox_exec_33_0) true)
+(expandtypeattribute (trace_data_file_33_0) true)
+(expandtypeattribute (traced_33_0) true)
+(expandtypeattribute (traced_consumer_socket_33_0) true)
+(expandtypeattribute (traced_enabled_prop_33_0) true)
+(expandtypeattribute (traced_lazy_prop_33_0) true)
+(expandtypeattribute (traced_perf_33_0) true)
+(expandtypeattribute (traced_perf_socket_33_0) true)
+(expandtypeattribute (traced_probes_33_0) true)
+(expandtypeattribute (traced_producer_socket_33_0) true)
+(expandtypeattribute (traced_tmpfs_33_0) true)
+(expandtypeattribute (traceur_app_33_0) true)
+(expandtypeattribute (translation_service_33_0) true)
+(expandtypeattribute (trust_service_33_0) true)
+(expandtypeattribute (tty_device_33_0) true)
+(expandtypeattribute (tun_device_33_0) true)
+(expandtypeattribute (tv_iapp_service_33_0) true)
+(expandtypeattribute (tv_input_service_33_0) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_33_0) true)
+(expandtypeattribute (tzdatacheck_33_0) true)
+(expandtypeattribute (tzdatacheck_exec_33_0) true)
+(expandtypeattribute (ueventd_33_0) true)
+(expandtypeattribute (ueventd_tmpfs_33_0) true)
+(expandtypeattribute (uhid_device_33_0) true)
+(expandtypeattribute (uimode_service_33_0) true)
+(expandtypeattribute (uio_device_33_0) true)
+(expandtypeattribute (uncrypt_33_0) true)
+(expandtypeattribute (uncrypt_exec_33_0) true)
+(expandtypeattribute (uncrypt_socket_33_0) true)
+(expandtypeattribute (unencrypted_data_file_33_0) true)
+(expandtypeattribute (unlabeled_33_0) true)
+(expandtypeattribute (untrusted_app_25_33_0) true)
+(expandtypeattribute (untrusted_app_27_33_0) true)
+(expandtypeattribute (untrusted_app_29_33_0) true)
+(expandtypeattribute (untrusted_app_30_33_0) true)
+(expandtypeattribute (untrusted_app_33_0) true)
+(expandtypeattribute (update_engine_33_0) true)
+(expandtypeattribute (update_engine_data_file_33_0) true)
+(expandtypeattribute (update_engine_exec_33_0) true)
+(expandtypeattribute (update_engine_log_data_file_33_0) true)
+(expandtypeattribute (update_engine_service_33_0) true)
+(expandtypeattribute (update_engine_stable_service_33_0) true)
+(expandtypeattribute (update_verifier_33_0) true)
+(expandtypeattribute (update_verifier_exec_33_0) true)
+(expandtypeattribute (updatelock_service_33_0) true)
+(expandtypeattribute (uri_grants_service_33_0) true)
+(expandtypeattribute (usagestats_service_33_0) true)
+(expandtypeattribute (usb_config_prop_33_0) true)
+(expandtypeattribute (usb_control_prop_33_0) true)
+(expandtypeattribute (usb_device_33_0) true)
+(expandtypeattribute (usb_prop_33_0) true)
+(expandtypeattribute (usb_serial_device_33_0) true)
+(expandtypeattribute (usb_service_33_0) true)
+(expandtypeattribute (usbaccessory_device_33_0) true)
+(expandtypeattribute (usbd_33_0) true)
+(expandtypeattribute (usbd_exec_33_0) true)
+(expandtypeattribute (usbfs_33_0) true)
+(expandtypeattribute (use_memfd_prop_33_0) true)
+(expandtypeattribute (user_profile_data_file_33_0) true)
+(expandtypeattribute (user_profile_root_file_33_0) true)
+(expandtypeattribute (user_service_33_0) true)
+(expandtypeattribute (userdata_block_device_33_0) true)
+(expandtypeattribute (userdata_sysdev_33_0) true)
+(expandtypeattribute (usermodehelper_33_0) true)
+(expandtypeattribute (userspace_reboot_config_prop_33_0) true)
+(expandtypeattribute (userspace_reboot_exported_prop_33_0) true)
+(expandtypeattribute (userspace_reboot_metadata_file_33_0) true)
+(expandtypeattribute (uwb_service_33_0) true)
+(expandtypeattribute (vcn_management_service_33_0) true)
+(expandtypeattribute (vd_device_33_0) true)
+(expandtypeattribute (vdc_33_0) true)
+(expandtypeattribute (vdc_exec_33_0) true)
+(expandtypeattribute (vehicle_hal_prop_33_0) true)
+(expandtypeattribute (vendor_apex_file_33_0) true)
+(expandtypeattribute (vendor_app_file_33_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_33_0) true)
+(expandtypeattribute (vendor_configs_file_33_0) true)
+(expandtypeattribute (vendor_data_file_33_0) true)
+(expandtypeattribute (vendor_default_prop_33_0) true)
+(expandtypeattribute (vendor_file_33_0) true)
+(expandtypeattribute (vendor_framework_file_33_0) true)
+(expandtypeattribute (vendor_hal_file_33_0) true)
+(expandtypeattribute (vendor_idc_file_33_0) true)
+(expandtypeattribute (vendor_init_33_0) true)
+(expandtypeattribute (vendor_kernel_modules_33_0) true)
+(expandtypeattribute (vendor_keychars_file_33_0) true)
+(expandtypeattribute (vendor_keylayout_file_33_0) true)
+(expandtypeattribute (vendor_misc_writer_33_0) true)
+(expandtypeattribute (vendor_misc_writer_exec_33_0) true)
+(expandtypeattribute (vendor_modprobe_33_0) true)
+(expandtypeattribute (vendor_overlay_file_33_0) true)
+(expandtypeattribute (vendor_public_framework_file_33_0) true)
+(expandtypeattribute (vendor_public_lib_file_33_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_33_0) true)
+(expandtypeattribute (vendor_service_contexts_file_33_0) true)
+(expandtypeattribute (vendor_shell_33_0) true)
+(expandtypeattribute (vendor_shell_exec_33_0) true)
+(expandtypeattribute (vendor_socket_hook_prop_33_0) true)
+(expandtypeattribute (vendor_task_profiles_file_33_0) true)
+(expandtypeattribute (vendor_toolbox_exec_33_0) true)
+(expandtypeattribute (vendor_uuid_mapping_config_file_33_0) true)
+(expandtypeattribute (vendor_vm_data_file_33_0) true)
+(expandtypeattribute (vendor_vm_file_33_0) true)
+(expandtypeattribute (vfat_33_0) true)
+(expandtypeattribute (vibrator_manager_service_33_0) true)
+(expandtypeattribute (vibrator_service_33_0) true)
+(expandtypeattribute (video_device_33_0) true)
+(expandtypeattribute (virtual_ab_prop_33_0) true)
+(expandtypeattribute (virtual_device_service_33_0) true)
+(expandtypeattribute (virtual_touchpad_33_0) true)
+(expandtypeattribute (virtual_touchpad_exec_33_0) true)
+(expandtypeattribute (virtual_touchpad_service_33_0) true)
+(expandtypeattribute (virtualization_service_33_0) true)
+(expandtypeattribute (vndbinder_device_33_0) true)
+(expandtypeattribute (vndk_prop_33_0) true)
+(expandtypeattribute (vndk_sp_file_33_0) true)
+(expandtypeattribute (vndservice_contexts_file_33_0) true)
+(expandtypeattribute (vndservicemanager_33_0) true)
+(expandtypeattribute (voiceinteraction_service_33_0) true)
+(expandtypeattribute (vold_33_0) true)
+(expandtypeattribute (vold_config_prop_33_0) true)
+(expandtypeattribute (vold_data_file_33_0) true)
+(expandtypeattribute (vold_device_33_0) true)
+(expandtypeattribute (vold_exec_33_0) true)
+(expandtypeattribute (vold_metadata_file_33_0) true)
+(expandtypeattribute (vold_post_fs_data_prop_33_0) true)
+(expandtypeattribute (vold_prepare_subdirs_33_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_33_0) true)
+(expandtypeattribute (vold_prop_33_0) true)
+(expandtypeattribute (vold_service_33_0) true)
+(expandtypeattribute (vold_status_prop_33_0) true)
+(expandtypeattribute (vpn_data_file_33_0) true)
+(expandtypeattribute (vpn_management_service_33_0) true)
+(expandtypeattribute (vr_hwc_service_33_0) true)
+(expandtypeattribute (vr_manager_service_33_0) true)
+(expandtypeattribute (vrflinger_vsync_service_33_0) true)
+(expandtypeattribute (vts_config_prop_33_0) true)
+(expandtypeattribute (vts_status_prop_33_0) true)
+(expandtypeattribute (wallpaper_effects_generation_service_33_0) true)
+(expandtypeattribute (wallpaper_file_33_0) true)
+(expandtypeattribute (wallpaper_service_33_0) true)
+(expandtypeattribute (watchdog_device_33_0) true)
+(expandtypeattribute (watchdog_metadata_file_33_0) true)
+(expandtypeattribute (watchdogd_33_0) true)
+(expandtypeattribute (watchdogd_exec_33_0) true)
+(expandtypeattribute (webview_zygote_33_0) true)
+(expandtypeattribute (webview_zygote_exec_33_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_33_0) true)
+(expandtypeattribute (webviewupdate_service_33_0) true)
+(expandtypeattribute (wifi_config_prop_33_0) true)
+(expandtypeattribute (wifi_data_file_33_0) true)
+(expandtypeattribute (wifi_hal_prop_33_0) true)
+(expandtypeattribute (wifi_key_33_0) true)
+(expandtypeattribute (wifi_log_prop_33_0) true)
+(expandtypeattribute (wifi_prop_33_0) true)
+(expandtypeattribute (wifi_service_33_0) true)
+(expandtypeattribute (wifiaware_service_33_0) true)
+(expandtypeattribute (wificond_33_0) true)
+(expandtypeattribute (wificond_exec_33_0) true)
+(expandtypeattribute (wifinl80211_service_33_0) true)
+(expandtypeattribute (wifip2p_service_33_0) true)
+(expandtypeattribute (wifiscanner_service_33_0) true)
+(expandtypeattribute (window_service_33_0) true)
+(expandtypeattribute (wpa_socket_33_0) true)
+(expandtypeattribute (wpantund_33_0) true)
+(expandtypeattribute (wpantund_exec_33_0) true)
+(expandtypeattribute (wpantund_service_33_0) true)
+(expandtypeattribute (zero_device_33_0) true)
+(expandtypeattribute (zoneinfo_data_file_33_0) true)
+(expandtypeattribute (zram_config_prop_33_0) true)
+(expandtypeattribute (zram_control_prop_33_0) true)
+(expandtypeattribute (zygote_33_0) true)
+(expandtypeattribute (zygote_config_prop_33_0) true)
+(expandtypeattribute (zygote_exec_33_0) true)
+(expandtypeattribute (zygote_socket_33_0) true)
+(expandtypeattribute (zygote_tmpfs_33_0) true)
+(typeattributeset DockObserver_service_33_0 (DockObserver_service))
+(typeattributeset IProxyService_service_33_0 (IProxyService_service))
+(typeattributeset aac_drc_prop_33_0 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_33_0 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_33_0 (ab_update_gki_prop))
+(typeattributeset accessibility_service_33_0 (accessibility_service))
+(typeattributeset account_service_33_0 (account_service))
+(typeattributeset activity_service_33_0 (activity_service))
+(typeattributeset activity_task_service_33_0 (activity_task_service))
+(typeattributeset adb_data_file_33_0 (adb_data_file))
+(typeattributeset adb_keys_file_33_0 (adb_keys_file))
+(typeattributeset adb_service_33_0 (adb_service))
+(typeattributeset adbd_33_0 (adbd))
+(typeattributeset adbd_config_prop_33_0 (adbd_config_prop))
+(typeattributeset adbd_exec_33_0 (adbd_exec))
+(typeattributeset adbd_socket_33_0 (adbd_socket))
+(typeattributeset adservices_manager_service_33_0 (adservices_manager_service))
+(typeattributeset aidl_lazy_test_server_33_0 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_33_0 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_33_0 (aidl_lazy_test_service))
+(typeattributeset alarm_service_33_0 (alarm_service))
+(typeattributeset anr_data_file_33_0 (anr_data_file))
+(typeattributeset apc_service_33_0 (apc_service))
+(typeattributeset apex_data_file_33_0 (apex_data_file))
+(typeattributeset apex_info_file_33_0 (apex_info_file))
+(typeattributeset apex_metadata_file_33_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_33_0 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_33_0 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_33_0 (apex_ota_reserved_file))
+(typeattributeset apex_rollback_data_file_33_0 (apex_rollback_data_file))
+(typeattributeset apex_service_33_0 (apex_service))
+(typeattributeset apex_system_server_data_file_33_0 (apex_system_server_data_file))
+(typeattributeset apexd_33_0 (apexd))
+(typeattributeset apexd_config_prop_33_0 (apexd_config_prop))
+(typeattributeset apexd_exec_33_0 (apexd_exec))
+(typeattributeset apexd_prop_33_0 (apexd_prop))
+(typeattributeset apexd_select_prop_33_0 (apexd_select_prop))
+(typeattributeset apk_data_file_33_0 (apk_data_file))
+(typeattributeset apk_private_data_file_33_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_33_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_33_0 (apk_tmp_file))
+(typeattributeset apk_verity_prop_33_0 (apk_verity_prop))
+(typeattributeset app_binding_service_33_0 (app_binding_service))
+(typeattributeset app_data_file_33_0 (app_data_file))
+(typeattributeset app_fuse_file_33_0 (app_fuse_file))
+(typeattributeset app_fusefs_33_0 (app_fusefs))
+(typeattributeset app_hibernation_service_33_0 (app_hibernation_service))
+(typeattributeset app_integrity_service_33_0 (app_integrity_service))
+(typeattributeset app_prediction_service_33_0 (app_prediction_service))
+(typeattributeset app_search_service_33_0 (app_search_service))
+(typeattributeset app_zygote_33_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_33_0 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_33_0 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_33_0 (appdomain_tmpfs))
+(typeattributeset appops_service_33_0 (appops_service))
+(typeattributeset appwidget_service_33_0 (appwidget_service))
+(typeattributeset arm64_memtag_prop_33_0 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_33_0 (art_apex_dir))
+(typeattributeset artd_service_33_0 (artd_service))
+(typeattributeset asec_apk_file_33_0 (asec_apk_file))
+(typeattributeset asec_image_file_33_0 (asec_image_file))
+(typeattributeset asec_public_file_33_0 (asec_public_file))
+(typeattributeset ashmem_device_33_0 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_33_0 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_33_0 (assetatlas_service))
+(typeattributeset atrace_33_0 (atrace))
+(typeattributeset attestation_verification_service_33_0 (attestation_verification_service))
+(typeattributeset audio_config_prop_33_0 (audio_config_prop))
+(typeattributeset audio_data_file_33_0 (audio_data_file))
+(typeattributeset audio_device_33_0 (audio_device))
+(typeattributeset audio_prop_33_0 (audio_prop))
+(typeattributeset audio_service_33_0 (audio_service))
+(typeattributeset audiohal_data_file_33_0 (audiohal_data_file))
+(typeattributeset audioserver_33_0 (audioserver))
+(typeattributeset audioserver_data_file_33_0 (audioserver_data_file))
+(typeattributeset audioserver_service_33_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_33_0 (audioserver_tmpfs))
+(typeattributeset auth_service_33_0 (auth_service))
+(typeattributeset authorization_service_33_0 (authorization_service))
+(typeattributeset autofill_service_33_0 (autofill_service))
+(typeattributeset backup_data_file_33_0 (backup_data_file))
+(typeattributeset backup_service_33_0 (backup_service))
+(typeattributeset battery_service_33_0 (battery_service))
+(typeattributeset batteryproperties_service_33_0 (batteryproperties_service))
+(typeattributeset batterystats_service_33_0 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_33_0 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_33_0 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_33_0 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_33_0 (binder_calls_stats_service))
+(typeattributeset binder_device_33_0 (binder_device))
+(typeattributeset binderfs_33_0 (binderfs))
+(typeattributeset binderfs_features_33_0 (binderfs_features))
+(typeattributeset binderfs_logs_33_0 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_33_0 (binderfs_logs_proc))
+(typeattributeset binfmt_miscfs_33_0 (binfmt_miscfs))
+(typeattributeset biometric_service_33_0 (biometric_service))
+(typeattributeset blkid_33_0 (blkid))
+(typeattributeset blkid_untrusted_33_0 (blkid_untrusted))
+(typeattributeset blob_store_service_33_0 (blob_store_service))
+(typeattributeset block_device_33_0 (block_device))
+(typeattributeset bluetooth_33_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_33_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_33_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_config_prop_33_0 (bluetooth_config_prop))
+(typeattributeset bluetooth_data_file_33_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_33_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_33_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_33_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_33_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_33_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_33_0 (bluetooth_socket))
+(typeattributeset boot_block_device_33_0 (boot_block_device))
+(typeattributeset boot_status_prop_33_0 (boot_status_prop))
+(typeattributeset bootanim_33_0 (bootanim))
+(typeattributeset bootanim_config_prop_33_0 (bootanim_config_prop))
+(typeattributeset bootanim_exec_33_0 (bootanim_exec))
+(typeattributeset bootanim_system_prop_33_0 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_33_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_33_0 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_33_0 (bootloader_prop))
+(typeattributeset bootstat_33_0 (bootstat))
+(typeattributeset bootstat_data_file_33_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_33_0 (bootstat_exec))
+(typeattributeset boottime_prop_33_0 (boottime_prop))
+(typeattributeset boottime_public_prop_33_0 (boottime_public_prop))
+(typeattributeset boottrace_data_file_33_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_33_0 (bpf_progs_loaded_prop))
+(typeattributeset bpfloader_33_0 (bpfloader))
+(typeattributeset bq_config_prop_33_0 (bq_config_prop))
+(typeattributeset broadcastradio_service_33_0 (broadcastradio_service))
+(typeattributeset bufferhubd_33_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_33_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_33_0 (bugreport_service))
+(typeattributeset build_bootimage_prop_33_0 (build_bootimage_prop))
+(typeattributeset build_config_prop_33_0 (build_config_prop))
+(typeattributeset build_odm_prop_33_0 (build_odm_prop))
+(typeattributeset build_prop_33_0 (build_prop))
+(typeattributeset build_prop_33_0 (userdebug_or_eng_prop))
+(typeattributeset build_vendor_prop_33_0 (build_vendor_prop))
+(typeattributeset cache_backup_file_33_0 (cache_backup_file))
+(typeattributeset cache_block_device_33_0 (cache_block_device))
+(typeattributeset cache_file_33_0 (cache_file))
+(typeattributeset cache_private_backup_file_33_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_33_0 (cache_recovery_file))
+(typeattributeset cacheinfo_service_33_0 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_33_0 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_33_0 (camera_calibration_prop))
+(typeattributeset camera_config_prop_33_0 (camera_config_prop))
+(typeattributeset camera_data_file_33_0 (camera_data_file))
+(typeattributeset camera_device_33_0 (camera_device))
+(typeattributeset cameraproxy_service_33_0 (cameraproxy_service))
+(typeattributeset cameraserver_33_0 (cameraserver))
+(typeattributeset cameraserver_exec_33_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_33_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_33_0 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_33_0 (camerax_extensions_prop))
+(typeattributeset cgroup_33_0 (cgroup))
+(typeattributeset cgroup_desc_api_file_33_0 (cgroup_desc_api_file))
+(typeattributeset cgroup_desc_file_33_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_33_0 (cgroup_rc_file))
+(typeattributeset cgroup_v2_33_0 (cgroup_v2))
+(typeattributeset charger_33_0 (charger))
+(typeattributeset charger_config_prop_33_0 (charger_config_prop))
+(typeattributeset charger_exec_33_0 (charger_exec))
+(typeattributeset charger_prop_33_0 (charger_prop))
+(typeattributeset charger_status_prop_33_0 (charger_status_prop))
+(typeattributeset charger_vendor_33_0 (charger_vendor))
+(typeattributeset clipboard_service_33_0 (clipboard_service))
+(typeattributeset cloudsearch_service_33_0 (cloudsearch_service))
+(typeattributeset codec2_config_prop_33_0 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_33_0 (cold_boot_done_prop))
+(typeattributeset color_display_service_33_0 (color_display_service))
+(typeattributeset companion_device_service_33_0 (companion_device_service))
+(typeattributeset config_prop_33_0 (config_prop))
+(typeattributeset configfs_33_0 (configfs))
+(typeattributeset connectivity_native_service_33_0 (connectivity_native_service))
+(typeattributeset connectivity_service_33_0 (connectivity_service))
+(typeattributeset connmetrics_service_33_0 (connmetrics_service))
+(typeattributeset console_device_33_0 (console_device))
+(typeattributeset consumer_ir_service_33_0 (consumer_ir_service))
+(typeattributeset content_capture_service_33_0 (content_capture_service))
+(typeattributeset content_service_33_0 (content_service))
+(typeattributeset content_suggestions_service_33_0 (content_suggestions_service))
+(typeattributeset contexthub_service_33_0 (contexthub_service))
+(typeattributeset coredump_file_33_0 (coredump_file))
+(typeattributeset country_detector_service_33_0 (country_detector_service))
+(typeattributeset coverage_service_33_0 (coverage_service))
+(typeattributeset cppreopt_prop_33_0 (cppreopt_prop))
+(typeattributeset cpu_variant_prop_33_0 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_33_0 (cpuinfo_service))
+(typeattributeset crash_dump_33_0 (crash_dump))
+(typeattributeset crash_dump_exec_33_0 (crash_dump_exec))
+(typeattributeset credstore_33_0 (credstore))
+(typeattributeset credstore_data_file_33_0 (credstore_data_file))
+(typeattributeset credstore_exec_33_0 (credstore_exec))
+(typeattributeset credstore_service_33_0 (credstore_service))
+(typeattributeset crossprofileapps_service_33_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_33_0 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_33_0 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_33_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_33_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_33_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_33_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_33_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_33_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_33_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_33_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_33_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_33_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_33_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_33_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_33_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_33_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_33_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_33_0 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_33_0
+ ( dalvik_config_prop
+ dalvik_dynamic_config_prop
+))
+(typeattributeset dalvik_prop_33_0 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_33_0 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_33_0 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_33_0 (dataloader_manager_service))
+(typeattributeset dbinfo_service_33_0 (dbinfo_service))
+(typeattributeset dck_prop_33_0 (dck_prop))
+(typeattributeset debug_prop_33_0 (debug_prop))
+(typeattributeset debugfs_33_0 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_33_0 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_33_0 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_33_0 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_33_0 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_33_0 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_33_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_33_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_33_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_33_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_33_0 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_33_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_33_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_33_0 (debuggerd_prop))
+(typeattributeset default_android_hwservice_33_0 (default_android_hwservice))
+(typeattributeset default_android_service_33_0 (default_android_service))
+(typeattributeset default_android_vndservice_33_0 (default_android_vndservice))
+(typeattributeset default_prop_33_0 (default_prop))
+(typeattributeset dev_cpu_variant_33_0 (dev_cpu_variant))
+(typeattributeset device_33_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_33_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_33_0 (device_config_boot_count_prop))
+(typeattributeset device_config_input_native_boot_prop_33_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_33_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_33_0 (device_config_netd_native_prop))
+(typeattributeset device_config_nnapi_native_prop_33_0 (device_config_nnapi_native_prop))
+(typeattributeset device_config_reset_performed_prop_33_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_33_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_33_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_33_0 (device_config_service))
+(typeattributeset device_config_surface_flinger_native_boot_prop_33_0 (device_config_surface_flinger_native_boot_prop))
+(typeattributeset device_identifiers_service_33_0 (device_identifiers_service))
+(typeattributeset device_logging_prop_33_0 (device_logging_prop))
+(typeattributeset device_policy_service_33_0 (device_policy_service))
+(typeattributeset device_state_service_33_0 (device_state_service))
+(typeattributeset deviceidle_service_33_0 (deviceidle_service))
+(typeattributeset devicestoragemonitor_service_33_0 (devicestoragemonitor_service))
+(typeattributeset devpts_33_0 (devpts))
+(typeattributeset dhcp_33_0 (dhcp))
+(typeattributeset dhcp_data_file_33_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_33_0 (dhcp_exec))
+(typeattributeset dhcp_prop_33_0 (dhcp_prop))
+(typeattributeset dice_maintenance_service_33_0 (dice_maintenance_service))
+(typeattributeset dice_node_service_33_0 (dice_node_service))
+(typeattributeset diced_33_0 (diced))
+(typeattributeset diced_exec_33_0 (diced_exec))
+(typeattributeset diskstats_service_33_0 (diskstats_service))
+(typeattributeset display_service_33_0 (display_service))
+(typeattributeset dm_device_33_0 (dm_device))
+(typeattributeset dm_user_device_33_0 (dm_user_device))
+(typeattributeset dmabuf_heap_device_33_0 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_33_0 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_33_0 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_33_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_33_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_33_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_33_0 (dnsresolver_service))
+(typeattributeset domain_verification_service_33_0 (domain_verification_service))
+(typeattributeset dreams_service_33_0 (dreams_service))
+(typeattributeset drm_data_file_33_0 (drm_data_file))
+(typeattributeset drm_service_config_prop_33_0 (drm_service_config_prop))
+(typeattributeset drmserver_33_0 (drmserver))
+(typeattributeset drmserver_exec_33_0 (drmserver_exec))
+(typeattributeset drmserver_service_33_0 (drmserver_service))
+(typeattributeset drmserver_socket_33_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_33_0 (dropbox_data_file))
+(typeattributeset dropbox_service_33_0 (dropbox_service))
+(typeattributeset dumpstate_33_0 (dumpstate))
+(typeattributeset dumpstate_exec_33_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_33_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_33_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_33_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_33_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_33_0 (dynamic_system_prop))
+(typeattributeset e2fs_33_0 (e2fs))
+(typeattributeset e2fs_exec_33_0 (e2fs_exec))
+(typeattributeset efs_file_33_0 (efs_file))
+(typeattributeset emergency_affordance_service_33_0 (emergency_affordance_service))
+(typeattributeset ephemeral_app_33_0 (ephemeral_app))
+(typeattributeset ethernet_service_33_0 (ethernet_service))
+(typeattributeset evsmanagerd_33_0 (evsmanagerd))
+(typeattributeset evsmanagerd_service_33_0 (evsmanagerd_service))
+(typeattributeset exfat_33_0 (exfat))
+(typeattributeset exported3_system_prop_33_0 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_33_0 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_33_0 (exported_camera_prop))
+(typeattributeset exported_config_prop_33_0 (exported_config_prop))
+(typeattributeset exported_default_prop_33_0 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_33_0 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_33_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_33_0 (exported_pm_prop))
+(typeattributeset exported_secure_prop_33_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_33_0
+ ( exported_system_prop
+ locale_prop
+ timezone_prop
+))
+(typeattributeset external_vibrator_service_33_0 (external_vibrator_service))
+(typeattributeset extra_free_kbytes_33_0 (extra_free_kbytes))
+(typeattributeset extra_free_kbytes_exec_33_0 (extra_free_kbytes_exec))
+(typeattributeset face_service_33_0 (face_service))
+(typeattributeset face_vendor_data_file_33_0 (face_vendor_data_file))
+(typeattributeset fastbootd_33_0 (fastbootd))
+(typeattributeset ffs_config_prop_33_0 (ffs_config_prop))
+(typeattributeset ffs_control_prop_33_0 (ffs_control_prop))
+(typeattributeset file_contexts_file_33_0 (file_contexts_file))
+(typeattributeset file_integrity_service_33_0 (file_integrity_service))
+(typeattributeset fingerprint_prop_33_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_33_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_33_0 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_33_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_33_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_33_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_33_0 (fingerprintd_service))
+(typeattributeset firstboot_prop_33_0 (firstboot_prop))
+(typeattributeset flags_health_check_33_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_33_0 (flags_health_check_exec))
+(typeattributeset font_service_33_0 (font_service))
+(typeattributeset framework_watchdog_config_prop_33_0 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_33_0 (frp_block_device))
+(typeattributeset fs_bpf_33_0 (fs_bpf))
+(typeattributeset fs_bpf_tethering_33_0 (fs_bpf_tethering))
+(typeattributeset fs_bpf_vendor_33_0 (fs_bpf_vendor))
+(typeattributeset fsck_33_0 (fsck))
+(typeattributeset fsck_exec_33_0 (fsck_exec))
+(typeattributeset fsck_untrusted_33_0 (fsck_untrusted))
+(typeattributeset fscklogs_33_0 (fscklogs))
+(typeattributeset functionfs_33_0 (functionfs))
+(typeattributeset fuse_33_0 (fuse))
+(typeattributeset fuse_device_33_0 (fuse_device))
+(typeattributeset fusectlfs_33_0 (fusectlfs))
+(typeattributeset fwk_automotive_display_hwservice_33_0 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_automotive_display_service_33_0 (fwk_automotive_display_service))
+(typeattributeset fwk_bufferhub_hwservice_33_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_33_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_33_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_33_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_33_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_33_0 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_33_0 (fwk_stats_service))
+(typeattributeset fwmarkd_socket_33_0 (fwmarkd_socket))
+(typeattributeset game_mode_intervention_list_file_33_0 (game_mode_intervention_list_file))
+(typeattributeset game_service_33_0 (game_service))
+(typeattributeset gatekeeper_data_file_33_0 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_33_0 (gatekeeper_service))
+(typeattributeset gatekeeperd_33_0 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_33_0 (gatekeeperd_exec))
+(typeattributeset gesture_prop_33_0 (gesture_prop))
+(typeattributeset gfxinfo_service_33_0 (gfxinfo_service))
+(typeattributeset gmscore_app_33_0 (gmscore_app))
+(typeattributeset gnss_device_33_0 (gnss_device))
+(typeattributeset gnss_time_update_service_33_0 (gnss_time_update_service))
+(typeattributeset gps_control_33_0 (gps_control))
+(typeattributeset gpu_device_33_0 (gpu_device))
+(typeattributeset gpu_service_33_0 (gpu_service))
+(typeattributeset gpuservice_33_0 (gpuservice))
+(typeattributeset graphics_config_prop_33_0 (graphics_config_prop))
+(typeattributeset graphics_device_33_0 (graphics_device))
+(typeattributeset graphicsstats_service_33_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_33_0 (gsi_data_file))
+(typeattributeset gsi_metadata_file_33_0 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_33_0 (gsi_public_metadata_file))
+(typeattributeset gwp_asan_prop_33_0 (gwp_asan_prop))
+(typeattributeset hal_atrace_hwservice_33_0 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_33_0 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_33_0 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_33_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_33_0 (hal_audiocontrol_service))
+(typeattributeset hal_authsecret_hwservice_33_0 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_33_0 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_33_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_33_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_33_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_33_0 (hal_camera_hwservice))
+(typeattributeset hal_camera_service_33_0 (hal_camera_service))
+(typeattributeset hal_can_bus_hwservice_33_0 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_33_0 (hal_can_controller_hwservice))
+(typeattributeset hal_cas_hwservice_33_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_33_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_33_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_33_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_33_0 (hal_contexthub_hwservice))
+(typeattributeset hal_contexthub_service_33_0 (hal_contexthub_service))
+(typeattributeset hal_dice_service_33_0 (hal_dice_service))
+(typeattributeset hal_drm_hwservice_33_0 (hal_drm_hwservice))
+(typeattributeset hal_drm_service_33_0 (hal_drm_service))
+(typeattributeset hal_dumpstate_config_prop_33_0 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_33_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_dumpstate_service_33_0 (hal_dumpstate_service))
+(typeattributeset hal_evs_hwservice_33_0 (hal_evs_hwservice))
+(typeattributeset hal_evs_service_33_0 (hal_evs_service))
+(typeattributeset hal_face_hwservice_33_0 (hal_face_hwservice))
+(typeattributeset hal_face_service_33_0 (hal_face_service))
+(typeattributeset hal_fingerprint_hwservice_33_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_33_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_33_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_33_0 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_33_0 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_33_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_allocator_service_33_0 (hal_graphics_allocator_service))
+(typeattributeset hal_graphics_composer_hwservice_33_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_33_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_composer_service_33_0 (hal_graphics_composer_service))
+(typeattributeset hal_graphics_mapper_hwservice_33_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_33_0 (hal_health_hwservice))
+(typeattributeset hal_health_service_33_0 (hal_health_service))
+(typeattributeset hal_health_storage_hwservice_33_0 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_33_0 (hal_health_storage_service))
+(typeattributeset hal_identity_service_33_0 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_33_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_input_processor_service_33_0 (hal_input_processor_service))
+(typeattributeset hal_instrumentation_prop_33_0 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_33_0 (hal_ir_hwservice))
+(typeattributeset hal_ir_service_33_0 (hal_ir_service))
+(typeattributeset hal_keymaster_hwservice_33_0 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_33_0 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_33_0 (hal_light_hwservice))
+(typeattributeset hal_light_service_33_0 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_33_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_33_0 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_33_0 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_33_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_33_0 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_33_0 (hal_nfc_hwservice))
+(typeattributeset hal_nfc_service_33_0 (hal_nfc_service))
+(typeattributeset hal_nlinterceptor_service_33_0 (hal_nlinterceptor_service))
+(typeattributeset hal_oemlock_hwservice_33_0 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_33_0 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_33_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_33_0 (hal_power_hwservice))
+(typeattributeset hal_power_service_33_0 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_33_0 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_33_0 (hal_power_stats_service))
+(typeattributeset hal_radio_service_33_0 (hal_radio_service))
+(typeattributeset hal_rebootescrow_service_33_0 (hal_rebootescrow_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_33_0 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_33_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_33_0 (hal_secure_element_hwservice))
+(typeattributeset hal_secureclock_service_33_0 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_33_0 (hal_sensors_hwservice))
+(typeattributeset hal_sensors_service_33_0 (hal_sensors_service))
+(typeattributeset hal_sharedsecret_service_33_0 (hal_sharedsecret_service))
+(typeattributeset hal_system_suspend_service_33_0 (hal_system_suspend_service))
+(typeattributeset hal_telephony_hwservice_33_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_33_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_33_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_33_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_33_0 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_tuner_hwservice_33_0 (hal_tv_tuner_hwservice))
+(typeattributeset hal_tv_tuner_service_33_0 (hal_tv_tuner_service))
+(typeattributeset hal_usb_gadget_hwservice_33_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_33_0 (hal_usb_hwservice))
+(typeattributeset hal_usb_service_33_0 (hal_usb_service))
+(typeattributeset hal_uwb_service_33_0 (hal_uwb_service))
+(typeattributeset hal_vehicle_hwservice_33_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vehicle_service_33_0 (hal_vehicle_service))
+(typeattributeset hal_vibrator_hwservice_33_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_33_0 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_33_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_33_0 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_33_0 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_33_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hostapd_service_33_0 (hal_wifi_hostapd_service))
+(typeattributeset hal_wifi_hwservice_33_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_33_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hal_wifi_supplicant_service_33_0 (hal_wifi_supplicant_service))
+(typeattributeset hardware_properties_service_33_0 (hardware_properties_service))
+(typeattributeset hardware_service_33_0 (hardware_service))
+(typeattributeset hci_attach_dev_33_0 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_33_0 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_33_0 (hdmi_control_service))
+(typeattributeset healthd_33_0 (healthd))
+(typeattributeset heapdump_data_file_33_0 (heapdump_data_file))
+(typeattributeset heapprofd_33_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_33_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_33_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_33_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_33_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_33_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_33_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_33_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_33_0 (hidl_token_hwservice))
+(typeattributeset hint_service_33_0 (hint_service))
+(typeattributeset hw_random_device_33_0 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_33_0 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_33_0 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_33_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_33_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_33_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_33_0 (hwservicemanager_prop))
+(typeattributeset hypervisor_prop_33_0 (hypervisor_prop))
+(typeattributeset icon_file_33_0 (icon_file))
+(typeattributeset idmap_33_0 (idmap))
+(typeattributeset idmap_exec_33_0 (idmap_exec))
+(typeattributeset idmap_service_33_0 (idmap_service))
+(typeattributeset iio_device_33_0 (iio_device))
+(typeattributeset imms_service_33_0 (imms_service))
+(typeattributeset incident_33_0 (incident))
+(typeattributeset incident_data_file_33_0 (incident_data_file))
+(typeattributeset incident_helper_33_0 (incident_helper))
+(typeattributeset incident_service_33_0 (incident_service))
+(typeattributeset incidentd_33_0 (incidentd))
+(typeattributeset incremental_control_file_33_0 (incremental_control_file))
+(typeattributeset incremental_prop_33_0 (incremental_prop))
+(typeattributeset incremental_service_33_0 (incremental_service))
+(typeattributeset init_33_0 (init))
+(typeattributeset init_exec_33_0 (init_exec))
+(typeattributeset init_service_status_prop_33_0 (init_service_status_prop))
+(typeattributeset init_tmpfs_33_0 (init_tmpfs))
+(typeattributeset inotify_33_0 (inotify))
+(typeattributeset input_device_33_0 (input_device))
+(typeattributeset input_method_service_33_0 (input_method_service))
+(typeattributeset input_service_33_0 (input_service))
+(typeattributeset inputflinger_33_0 (inputflinger))
+(typeattributeset inputflinger_exec_33_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_33_0 (inputflinger_service))
+(typeattributeset install_data_file_33_0 (install_data_file))
+(typeattributeset installd_33_0 (installd))
+(typeattributeset installd_exec_33_0 (installd_exec))
+(typeattributeset installd_service_33_0 (installd_service))
+(typeattributeset ion_device_33_0 (ion_device))
+(typeattributeset iorap_inode2filename_33_0 (iorap_inode2filename))
+(typeattributeset iorap_inode2filename_exec_33_0 (iorap_inode2filename_exec))
+(typeattributeset iorap_inode2filename_tmpfs_33_0 (iorap_inode2filename_tmpfs))
+(typeattributeset iorap_prefetcherd_33_0 (iorap_prefetcherd))
+(typeattributeset iorap_prefetcherd_exec_33_0 (iorap_prefetcherd_exec))
+(typeattributeset iorap_prefetcherd_tmpfs_33_0 (iorap_prefetcherd_tmpfs))
+(typeattributeset iorapd_33_0 (iorapd))
+(typeattributeset iorapd_data_file_33_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_33_0 (iorapd_exec))
+(typeattributeset iorapd_service_33_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_33_0 (iorapd_tmpfs))
+(typeattributeset ipsec_service_33_0 (ipsec_service))
+(typeattributeset iris_service_33_0 (iris_service))
+(typeattributeset iris_vendor_data_file_33_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_33_0 (isolated_app))
+(typeattributeset jobscheduler_service_33_0 (jobscheduler_service))
+(typeattributeset kernel_33_0 (kernel))
+(typeattributeset keychain_data_file_33_0 (keychain_data_file))
+(typeattributeset keychord_device_33_0 (keychord_device))
+(typeattributeset keyguard_config_prop_33_0 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_33_0 (keystore2_key_contexts_file))
+(typeattributeset keystore_33_0 (keystore))
+(typeattributeset keystore_compat_hal_service_33_0 (keystore_compat_hal_service))
+(typeattributeset keystore_data_file_33_0 (keystore_data_file))
+(typeattributeset keystore_exec_33_0 (keystore_exec))
+(typeattributeset keystore_maintenance_service_33_0 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_33_0 (keystore_metrics_service))
+(typeattributeset keystore_service_33_0 (keystore_service))
+(typeattributeset kmsg_debug_device_33_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_33_0 (kmsg_device))
+(typeattributeset labeledfs_33_0 (labeledfs))
+(typeattributeset launcherapps_service_33_0 (launcherapps_service))
+(typeattributeset legacy_permission_service_33_0 (legacy_permission_service))
+(typeattributeset legacykeystore_service_33_0 (legacykeystore_service))
+(typeattributeset libc_debug_prop_33_0 (libc_debug_prop))
+(typeattributeset light_service_33_0 (light_service))
+(typeattributeset linkerconfig_file_33_0 (linkerconfig_file))
+(typeattributeset llkd_33_0 (llkd))
+(typeattributeset llkd_exec_33_0 (llkd_exec))
+(typeattributeset llkd_prop_33_0 (llkd_prop))
+(typeattributeset lmkd_33_0 (lmkd))
+(typeattributeset lmkd_config_prop_33_0 (lmkd_config_prop))
+(typeattributeset lmkd_exec_33_0 (lmkd_exec))
+(typeattributeset lmkd_prop_33_0 (lmkd_prop))
+(typeattributeset lmkd_socket_33_0 (lmkd_socket))
+(typeattributeset locale_service_33_0 (locale_service))
+(typeattributeset location_service_33_0 (location_service))
+(typeattributeset location_time_zone_manager_service_33_0 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_33_0 (lock_settings_service))
+(typeattributeset log_prop_33_0 (log_prop))
+(typeattributeset log_tag_prop_33_0 (log_tag_prop))
+(typeattributeset logcat_exec_33_0 (logcat_exec))
+(typeattributeset logd_33_0 (logd))
+(typeattributeset logd_exec_33_0 (logd_exec))
+(typeattributeset logd_prop_33_0 (logd_prop))
+(typeattributeset logd_socket_33_0 (logd_socket))
+(typeattributeset logdr_socket_33_0 (logdr_socket))
+(typeattributeset logdw_socket_33_0 (logdw_socket))
+(typeattributeset logpersist_33_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_33_0 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_33_0 (loop_control_device))
+(typeattributeset loop_device_33_0 (loop_device))
+(typeattributeset looper_stats_service_33_0 (looper_stats_service))
+(typeattributeset lowpan_device_33_0 (lowpan_device))
+(typeattributeset lowpan_prop_33_0 (lowpan_prop))
+(typeattributeset lowpan_service_33_0 (lowpan_service))
+(typeattributeset lpdump_service_33_0 (lpdump_service))
+(typeattributeset lpdumpd_prop_33_0 (lpdumpd_prop))
+(typeattributeset mac_perms_file_33_0 (mac_perms_file))
+(typeattributeset mdns_service_33_0 (mdns_service))
+(typeattributeset mdns_socket_33_0 (mdns_socket))
+(typeattributeset mdnsd_33_0 (mdnsd))
+(typeattributeset mdnsd_socket_33_0 (mdnsd_socket))
+(typeattributeset media_communication_service_33_0 (media_communication_service))
+(typeattributeset media_config_prop_33_0 (media_config_prop))
+(typeattributeset media_data_file_33_0 (media_data_file))
+(typeattributeset media_metrics_service_33_0 (media_metrics_service))
+(typeattributeset media_projection_service_33_0 (media_projection_service))
+(typeattributeset media_router_service_33_0 (media_router_service))
+(typeattributeset media_rw_data_file_33_0 (media_rw_data_file media_userdir_file))
+(typeattributeset media_session_service_33_0 (media_session_service))
+(typeattributeset media_variant_prop_33_0 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_33_0 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_33_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_33_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_33_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_33_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_33_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_33_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_33_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_33_0 (mediametrics))
+(typeattributeset mediametrics_exec_33_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_33_0 (mediametrics_service))
+(typeattributeset mediaprovider_33_0 (mediaprovider))
+(typeattributeset mediaserver_33_0 (mediaserver))
+(typeattributeset mediaserver_exec_33_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_33_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_33_0 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_33_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_33_0 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_33_0 (mediatranscoding))
+(typeattributeset mediatranscoding_service_33_0 (mediatranscoding_service))
+(typeattributeset meminfo_service_33_0 (meminfo_service))
+(typeattributeset memtrackproxy_service_33_0 (memtrackproxy_service))
+(typeattributeset metadata_block_device_33_0 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_33_0 (metadata_bootstat_file))
+(typeattributeset metadata_file_33_0 (metadata_file))
+(typeattributeset method_trace_data_file_33_0 (method_trace_data_file))
+(typeattributeset midi_service_33_0 (midi_service))
+(typeattributeset mirror_data_file_33_0 (mirror_data_file))
+(typeattributeset misc_block_device_33_0 (misc_block_device))
+(typeattributeset misc_logd_file_33_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_33_0 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_33_0 (mm_events_config_prop))
+(typeattributeset mmc_prop_33_0 (mmc_prop))
+(typeattributeset mnt_expand_file_33_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_33_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_33_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_33_0 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_33_0 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_33_0 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_33_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_33_0 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_33_0 (mock_ota_prop))
+(typeattributeset modprobe_33_0 (modprobe))
+(typeattributeset module_sdkextensions_prop_33_0 (module_sdkextensions_prop))
+(typeattributeset mount_service_33_0 (mount_service))
+(typeattributeset mqueue_33_0 (mqueue))
+(typeattributeset mtp_33_0 (mtp))
+(typeattributeset mtp_device_33_0 (mtp_device))
+(typeattributeset mtp_exec_33_0 (mtp_exec))
+(typeattributeset mtpd_socket_33_0 (mtpd_socket))
+(typeattributeset music_recognition_service_33_0 (music_recognition_service))
+(typeattributeset nativetest_data_file_33_0 (nativetest_data_file))
+(typeattributeset nearby_service_33_0 (nearby_service))
+(typeattributeset net_data_file_33_0 (net_data_file))
+(typeattributeset net_dns_prop_33_0 (net_dns_prop))
+(typeattributeset net_radio_prop_33_0 (net_radio_prop))
+(typeattributeset netd_33_0 (netd))
+(typeattributeset netd_exec_33_0 (netd_exec))
+(typeattributeset netd_listener_service_33_0 (netd_listener_service))
+(typeattributeset netd_service_33_0 (netd_service))
+(typeattributeset netif_33_0 (netif))
+(typeattributeset netpolicy_service_33_0 (netpolicy_service))
+(typeattributeset netstats_service_33_0 (netstats_service))
+(typeattributeset netutils_wrapper_33_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_33_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_33_0 (network_management_service))
+(typeattributeset network_score_service_33_0 (network_score_service))
+(typeattributeset network_stack_33_0 (network_stack))
+(typeattributeset network_stack_service_33_0 (network_stack_service))
+(typeattributeset network_time_update_service_33_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_33_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_33_0 (network_watchlist_service))
+(typeattributeset nfc_33_0 (nfc))
+(typeattributeset nfc_data_file_33_0 (nfc_data_file))
+(typeattributeset nfc_device_33_0 (nfc_device))
+(typeattributeset nfc_logs_data_file_33_0 (nfc_logs_data_file))
+(typeattributeset nfc_prop_33_0 (nfc_prop))
+(typeattributeset nfc_service_33_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_33_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_33_0 (node))
+(typeattributeset notification_service_33_0 (notification_service))
+(typeattributeset null_device_33_0 (null_device))
+(typeattributeset oem_lock_service_33_0 (oem_lock_service))
+(typeattributeset oem_unlock_prop_33_0 (oem_unlock_prop))
+(typeattributeset oemfs_33_0 (oemfs))
+(typeattributeset ota_data_file_33_0 (ota_data_file))
+(typeattributeset ota_metadata_file_33_0 (ota_metadata_file))
+(typeattributeset ota_package_file_33_0 (ota_package_file))
+(typeattributeset ota_prop_33_0 (ota_prop))
+(typeattributeset otadexopt_service_33_0 (otadexopt_service))
+(typeattributeset otapreopt_chroot_33_0 (otapreopt_chroot))
+(typeattributeset overlay_prop_33_0 (overlay_prop))
+(typeattributeset overlay_service_33_0 (overlay_service))
+(typeattributeset overlayfs_file_33_0 (overlayfs_file))
+(typeattributeset owntty_device_33_0 (owntty_device))
+(typeattributeset pac_proxy_service_33_0 (pac_proxy_service))
+(typeattributeset package_native_service_33_0 (package_native_service))
+(typeattributeset package_service_33_0 (package_service))
+(typeattributeset packagemanager_config_prop_33_0 (packagemanager_config_prop))
+(typeattributeset packages_list_file_33_0 (packages_list_file))
+(typeattributeset pan_result_prop_33_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_33_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_33_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_33_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_33_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_33_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_33_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_33_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_33_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_33_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_33_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_33_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_33_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_33_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_33_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_33_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_33_0 (pdx_performance_dir))
+(typeattributeset people_service_33_0 (people_service))
+(typeattributeset perfetto_33_0 (perfetto))
+(typeattributeset performanced_33_0 (performanced))
+(typeattributeset performanced_exec_33_0 (performanced_exec))
+(typeattributeset permission_checker_service_33_0 (permission_checker_service))
+(typeattributeset permission_service_33_0 (permission_service))
+(typeattributeset permissionmgr_service_33_0 (permissionmgr_service))
+(typeattributeset persist_debug_prop_33_0 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_33_0 (persist_vendor_debug_wifi_prop))
+(typeattributeset persist_wm_debug_prop_33_0 (persist_wm_debug_prop))
+(typeattributeset persistent_data_block_service_33_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_33_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_33_0 (pinner_service))
+(typeattributeset pipefs_33_0 (pipefs))
+(typeattributeset platform_app_33_0 (platform_app))
+(typeattributeset platform_compat_service_33_0 (platform_compat_service))
+(typeattributeset pmsg_device_33_0 (pmsg_device))
+(typeattributeset port_33_0 (port))
+(typeattributeset port_device_33_0 (port_device))
+(typeattributeset postinstall_33_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_33_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_33_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_33_0 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_33_0 (power_debug_prop))
+(typeattributeset power_service_33_0 (power_service))
+(typeattributeset powerctl_prop_33_0 (powerctl_prop))
+(typeattributeset powerstats_service_33_0 (powerstats_service))
+(typeattributeset ppp_33_0 (ppp))
+(typeattributeset ppp_device_33_0 (ppp_device))
+(typeattributeset ppp_exec_33_0 (ppp_exec))
+(typeattributeset preloads_data_file_33_0 (preloads_data_file))
+(typeattributeset preloads_media_file_33_0 (preloads_media_file))
+(typeattributeset prereboot_data_file_33_0 (prereboot_data_file))
+(typeattributeset print_service_33_0 (print_service))
+(typeattributeset priv_app_33_0 (priv_app))
+(typeattributeset privapp_data_file_33_0 (privapp_data_file))
+(typeattributeset proc_33_0 (proc))
+(typeattributeset proc_abi_33_0 (proc_abi))
+(typeattributeset proc_asound_33_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_33_0 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_33_0 (proc_bootconfig))
+(typeattributeset proc_bpf_33_0 (proc_bpf))
+(typeattributeset proc_buddyinfo_33_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_33_0 (proc_cmdline))
+(typeattributeset proc_cpu_alignment_33_0 (proc_cpu_alignment))
+(typeattributeset proc_cpuinfo_33_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_33_0 (proc_dirty))
+(typeattributeset proc_diskstats_33_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_33_0 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_33_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_33_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_33_0 (proc))
+(typeattributeset proc_hostname_33_0 (proc_hostname))
+(typeattributeset proc_hung_task_33_0 (proc_hung_task))
+(typeattributeset proc_interrupts_33_0 (proc_interrupts))
+(typeattributeset proc_iomem_33_0 (proc_iomem))
+(typeattributeset proc_kallsyms_33_0 (proc_kallsyms))
+(typeattributeset proc_keys_33_0 (proc_keys))
+(typeattributeset proc_kmsg_33_0 (proc_kmsg))
+(typeattributeset proc_kpageflags_33_0 (proc_kpageflags))
+(typeattributeset proc_loadavg_33_0 (proc_loadavg))
+(typeattributeset proc_locks_33_0 (proc_locks))
+(typeattributeset proc_lowmemorykiller_33_0 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_33_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_33_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_33_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_33_0 (proc_misc))
+(typeattributeset proc_modules_33_0 (proc_modules))
+(typeattributeset proc_mounts_33_0 (proc_mounts))
+(typeattributeset proc_net_33_0 (proc_net))
+(typeattributeset proc_net_tcp_udp_33_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_33_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_33_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_33_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_33_0 (proc_panic))
+(typeattributeset proc_perf_33_0 (proc_perf))
+(typeattributeset proc_pid_max_33_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_33_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_33_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_33_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_33_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_33_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_33_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_33_0 (proc_random))
+(typeattributeset proc_sched_33_0 (proc_sched))
+(typeattributeset proc_security_33_0 (proc_security))
+(typeattributeset proc_slabinfo_33_0 (proc_slabinfo))
+(typeattributeset proc_stat_33_0 (proc_stat))
+(typeattributeset proc_swaps_33_0 (proc_swaps))
+(typeattributeset proc_sysrq_33_0 (proc_sysrq))
+(typeattributeset proc_timer_33_0 (proc_timer))
+(typeattributeset proc_tty_drivers_33_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_33_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_33_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_33_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_33_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_33_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_33_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_33_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_33_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_33_0 (proc_uptime))
+(typeattributeset proc_vendor_sched_33_0 (proc_vendor_sched))
+(typeattributeset proc_version_33_0 (proc_version))
+(typeattributeset proc_vmallocinfo_33_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_33_0 (proc_vmstat))
+(typeattributeset proc_watermark_boost_factor_33_0 (proc_watermark_boost_factor))
+(typeattributeset proc_watermark_scale_factor_33_0 (proc_watermark_scale_factor))
+(typeattributeset proc_zoneinfo_33_0 (proc_zoneinfo))
+(typeattributeset processinfo_service_33_0 (processinfo_service))
+(typeattributeset procstats_service_33_0 (procstats_service))
+(typeattributeset profman_33_0 (profman))
+(typeattributeset profman_dump_data_file_33_0 (profman_dump_data_file))
+(typeattributeset profman_exec_33_0 (profman_exec))
+(typeattributeset properties_device_33_0 (properties_device))
+(typeattributeset properties_serial_33_0 (properties_serial))
+(typeattributeset property_contexts_file_33_0 (property_contexts_file))
+(typeattributeset property_data_file_33_0 (property_data_file))
+(typeattributeset property_info_33_0 (property_info))
+(typeattributeset property_service_version_prop_33_0 (property_service_version_prop))
+(typeattributeset property_socket_33_0 (property_socket))
+(typeattributeset provisioned_prop_33_0 (provisioned_prop))
+(typeattributeset pstorefs_33_0 (pstorefs))
+(typeattributeset ptmx_device_33_0 (ptmx_device))
+(typeattributeset qemu_hw_prop_33_0 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_33_0 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_33_0 (qtaguid_device))
+(typeattributeset racoon_33_0 (racoon))
+(typeattributeset racoon_exec_33_0 (racoon_exec))
+(typeattributeset racoon_socket_33_0 (racoon_socket))
+(typeattributeset radio_33_0 (radio))
+(typeattributeset radio_control_prop_33_0 (radio_control_prop))
+(typeattributeset radio_core_data_file_33_0 (radio_core_data_file))
+(typeattributeset radio_data_file_33_0 (radio_data_file))
+(typeattributeset radio_device_33_0 (radio_device))
+(typeattributeset radio_prop_33_0 (radio_prop))
+(typeattributeset radio_service_33_0 (radio_service))
+(typeattributeset ram_device_33_0 (ram_device))
+(typeattributeset random_device_33_0 (random_device))
+(typeattributeset reboot_readiness_service_33_0 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_33_0 (rebootescrow_hal_prop))
+(typeattributeset recovery_33_0 (recovery))
+(typeattributeset recovery_block_device_33_0 (recovery_block_device))
+(typeattributeset recovery_config_prop_33_0 (recovery_config_prop))
+(typeattributeset recovery_data_file_33_0 (recovery_data_file))
+(typeattributeset recovery_persist_33_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_33_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_33_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_33_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_33_0 (recovery_service))
+(typeattributeset recovery_socket_33_0 (recovery_socket))
+(typeattributeset registry_service_33_0 (registry_service))
+(typeattributeset remotelyprovisionedkeypool_service_33_0 (remotelyprovisionedkeypool_service))
+(typeattributeset remoteprovisioning_service_33_0 (remoteprovisioning_service))
+(typeattributeset resourcecache_data_file_33_0 (resourcecache_data_file))
+(typeattributeset resources_manager_service_33_0 (resources_manager_service))
+(typeattributeset restorecon_prop_33_0 (restorecon_prop))
+(typeattributeset restrictions_service_33_0 (restrictions_service))
+(typeattributeset retaildemo_prop_33_0 (retaildemo_prop))
+(typeattributeset rild_debug_socket_33_0 (rild_debug_socket))
+(typeattributeset rild_socket_33_0 (rild_socket))
+(typeattributeset ringtone_file_33_0 (ringtone_file))
+(typeattributeset role_service_33_0 (role_service))
+(typeattributeset rollback_service_33_0 (rollback_service))
+(typeattributeset root_block_device_33_0 (root_block_device))
+(typeattributeset rootdisk_sysdev_33_0 (rootdisk_sysdev))
+(typeattributeset rootfs_33_0 (rootfs))
+(typeattributeset rpmsg_device_33_0 (rpmsg_device))
+(typeattributeset rs_33_0 (rs))
+(typeattributeset rs_exec_33_0 (rs_exec))
+(typeattributeset rss_hwm_reset_33_0 (rss_hwm_reset))
+(typeattributeset rtc_device_33_0 (rtc_device))
+(typeattributeset rttmanager_service_33_0 (rttmanager_service))
+(typeattributeset runas_33_0 (runas))
+(typeattributeset runas_app_33_0 (runas_app))
+(typeattributeset runas_exec_33_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_33_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_33_0 (runtime_service))
+(typeattributeset safemode_prop_33_0 (safemode_prop))
+(typeattributeset same_process_hal_file_33_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_33_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_33_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_33_0 (sdcard_block_device))
+(typeattributeset sdcardd_33_0 (sdcardd))
+(typeattributeset sdcardd_exec_33_0 (sdcardd_exec))
+(typeattributeset sdcardfs_33_0 (sdcardfs))
+(typeattributeset sdk_sandbox_service_33_0 (sdk_sandbox_service))
+(typeattributeset seapp_contexts_file_33_0 (seapp_contexts_file))
+(typeattributeset search_service_33_0 (search_service))
+(typeattributeset search_ui_service_33_0 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_33_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_33_0 (secure_element))
+(typeattributeset secure_element_device_33_0 (secure_element_device))
+(typeattributeset secure_element_service_33_0 (secure_element_service))
+(typeattributeset securityfs_33_0 (securityfs))
+(typeattributeset selection_toolbar_service_33_0 (selection_toolbar_service))
+(typeattributeset selinuxfs_33_0 (selinuxfs))
+(typeattributeset sendbug_config_prop_33_0 (sendbug_config_prop))
+(typeattributeset sensor_privacy_service_33_0 (sensor_privacy_service))
+(typeattributeset sensors_device_33_0 (sensors_device))
+(typeattributeset sensorservice_service_33_0 (sensorservice_service))
+(typeattributeset sepolicy_file_33_0 (sepolicy_file))
+(typeattributeset serial_device_33_0 (serial_device))
+(typeattributeset serial_service_33_0 (serial_service))
+(typeattributeset serialno_prop_33_0 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_33_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_33_0 (service_contexts_file))
+(typeattributeset service_manager_service_33_0 (service_manager_service))
+(typeattributeset service_manager_vndservice_33_0 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_33_0 (servicediscovery_service))
+(typeattributeset servicemanager_33_0 (servicemanager))
+(typeattributeset servicemanager_exec_33_0 (servicemanager_exec))
+(typeattributeset settings_service_33_0 (settings_service))
+(typeattributeset sgdisk_33_0 (sgdisk))
+(typeattributeset sgdisk_exec_33_0 (sgdisk_exec))
+(typeattributeset shared_relro_33_0 (shared_relro))
+(typeattributeset shared_relro_file_33_0 (shared_relro_file))
+(typeattributeset shell_33_0 (shell))
+(typeattributeset shell_data_file_33_0 (shell_data_file))
+(typeattributeset shell_exec_33_0 (shell_exec))
+(typeattributeset shell_prop_33_0 (shell_prop))
+(typeattributeset shell_test_data_file_33_0 (shell_test_data_file))
+(typeattributeset shm_33_0 (shm))
+(typeattributeset shortcut_manager_icons_33_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_33_0 (shortcut_service))
+(typeattributeset simpleperf_33_0 (simpleperf))
+(typeattributeset simpleperf_app_runner_33_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_33_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_33_0 (slice_service))
+(typeattributeset slideshow_33_0 (slideshow))
+(typeattributeset smart_idle_maint_enabled_prop_33_0 (smart_idle_maint_enabled_prop))
+(typeattributeset smartspace_service_33_0 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_33_0 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_proxy_socket_33_0 (snapuserd_proxy_socket))
+(typeattributeset snapuserd_socket_33_0 (snapuserd_socket))
+(typeattributeset soc_prop_33_0 (soc_prop))
+(typeattributeset socket_device_33_0 (socket_device))
+(typeattributeset socket_hook_prop_33_0 (socket_hook_prop))
+(typeattributeset sockfs_33_0 (sockfs))
+(typeattributeset sota_prop_33_0 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_33_0 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_33_0 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_33_0 (sqlite_log_prop))
+(typeattributeset staged_install_file_33_0 (staged_install_file))
+(typeattributeset staging_data_file_33_0 (staging_data_file))
+(typeattributeset stats_data_file_33_0 (stats_data_file))
+(typeattributeset statsd_33_0 (statsd))
+(typeattributeset statsd_exec_33_0 (statsd_exec))
+(typeattributeset statsdw_socket_33_0 (statsdw_socket))
+(typeattributeset statusbar_service_33_0 (statusbar_service))
+(typeattributeset storage_config_prop_33_0 (storage_config_prop))
+(typeattributeset storage_file_33_0 (storage_file))
+(typeattributeset storage_stub_file_33_0 (storage_stub_file))
+(typeattributeset storaged_service_33_0 (storaged_service))
+(typeattributeset storagemanager_config_prop_33_0 (storagemanager_config_prop))
+(typeattributeset storagestats_service_33_0 (storagestats_service))
+(typeattributeset su_33_0 (su))
+(typeattributeset su_exec_33_0 (su_exec))
+(typeattributeset super_block_device_33_0 (super_block_device))
+(typeattributeset surfaceflinger_33_0 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_33_0 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_33_0 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_33_0 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_33_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_33_0 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_33_0 (suspend_prop))
+(typeattributeset swap_block_device_33_0 (swap_block_device))
+(typeattributeset sysfs_33_0 (sysfs))
+(typeattributeset sysfs_android_usb_33_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_33_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_33_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devfreq_cur_33_0 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_33_0 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_33_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_33_0 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_33_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_33_0 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_33_0 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_33_0 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_33_0 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_33_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_33_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_33_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_33_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_fuse_bpf_33_0 (sysfs_fs_fuse_bpf))
+(typeattributeset sysfs_fs_incfs_features_33_0 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_33_0 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_gpu_33_0 (sysfs_gpu))
+(typeattributeset sysfs_hwrandom_33_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_33_0 (sysfs_ion))
+(typeattributeset sysfs_ipv4_33_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_33_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_33_0 (sysfs_leds))
+(typeattributeset sysfs_loop_33_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_33_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_lru_gen_enabled_33_0 (sysfs_lru_gen_enabled))
+(typeattributeset sysfs_net_33_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_33_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_33_0 (sysfs_power))
+(typeattributeset sysfs_rtc_33_0 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_33_0 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_33_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_33_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_33_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uhid_33_0 (sysfs_uhid))
+(typeattributeset sysfs_uio_33_0 (sysfs_uio))
+(typeattributeset sysfs_usb_33_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_33_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_33_0 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_33_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_33_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_33_0 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_33_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_33_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_33_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_33_0 (sysfs_zram_uevent))
+(typeattributeset system_app_33_0 (system_app))
+(typeattributeset system_app_data_file_33_0 (system_app_data_file))
+(typeattributeset system_app_service_33_0 (system_app_service))
+(typeattributeset system_asan_options_file_33_0 (system_asan_options_file))
+(typeattributeset system_block_device_33_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_33_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_33_0 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_33_0 (system_config_service))
+(typeattributeset system_data_file_33_0 (system_data_file system_userdir_file))
+(typeattributeset system_data_root_file_33_0 (system_data_root_file))
+(typeattributeset system_dlkm_file_33_0 (system_dlkm_file))
+(typeattributeset system_event_log_tags_file_33_0 (system_event_log_tags_file))
+(typeattributeset system_file_33_0 (system_file))
+(typeattributeset system_group_file_33_0 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_33_0 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_33_0 (system_lib_file))
+(typeattributeset system_linker_config_file_33_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_33_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_33_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_33_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_33_0 (system_net_netd_hwservice))
+(typeattributeset system_passwd_file_33_0 (system_passwd_file))
+(typeattributeset system_prop_33_0 (system_prop))
+(typeattributeset system_seccomp_policy_file_33_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_33_0 (system_security_cacerts_file))
+(typeattributeset system_server_33_0 (system_server))
+(typeattributeset system_server_dumper_service_33_0 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_33_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_33_0 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_33_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_33_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_33_0 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_33_0 (system_unsolzygote_socket))
+(typeattributeset system_update_service_33_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_33_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_33_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_33_0 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_33_0 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_33_0 (systemsound_config_prop))
+(typeattributeset tare_service_33_0 (tare_service))
+(typeattributeset task_profiles_api_file_33_0 (task_profiles_api_file))
+(typeattributeset task_profiles_file_33_0 (task_profiles_file))
+(typeattributeset task_service_33_0 (task_service))
+(typeattributeset tcpdump_exec_33_0 (tcpdump_exec))
+(typeattributeset tee_33_0 (tee))
+(typeattributeset tee_data_file_33_0 (tee_data_file))
+(typeattributeset tee_device_33_0 (tee_device))
+(typeattributeset telecom_service_33_0 (telecom_service))
+(typeattributeset telephony_config_prop_33_0 (telephony_config_prop))
+(typeattributeset telephony_status_prop_33_0 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_33_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_33_0 (test_harness_prop))
+(typeattributeset testharness_service_33_0 (testharness_service))
+(typeattributeset tethering_service_33_0 (tethering_service))
+(typeattributeset textclassification_service_33_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_33_0 (textclassifier_data_file))
+(typeattributeset textservices_service_33_0 (textservices_service))
+(typeattributeset texttospeech_service_33_0 (texttospeech_service))
+(typeattributeset theme_prop_33_0 (theme_prop))
+(typeattributeset thermal_service_33_0 (thermal_service))
+(typeattributeset time_prop_33_0 (time_prop))
+(typeattributeset timedetector_service_33_0 (timedetector_service))
+(typeattributeset timezone_service_33_0 (timezone_service))
+(typeattributeset timezonedetector_service_33_0 (timezonedetector_service))
+(typeattributeset tmpfs_33_0 (tmpfs))
+(typeattributeset tombstone_config_prop_33_0 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_33_0 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_33_0 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_33_0 (tombstoned))
+(typeattributeset tombstoned_crash_socket_33_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_33_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_33_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_33_0 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_33_0 (toolbox))
+(typeattributeset toolbox_exec_33_0 (toolbox_exec))
+(typeattributeset trace_data_file_33_0 (trace_data_file))
+(typeattributeset traced_33_0 (traced))
+(typeattributeset traced_consumer_socket_33_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_33_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_33_0 (traced_lazy_prop))
+(typeattributeset traced_perf_33_0 (traced_perf))
+(typeattributeset traced_perf_socket_33_0 (traced_perf_socket))
+(typeattributeset traced_probes_33_0 (traced_probes))
+(typeattributeset traced_producer_socket_33_0 (traced_producer_socket))
+(typeattributeset traced_tmpfs_33_0 (traced_tmpfs))
+(typeattributeset traceur_app_33_0 (traceur_app))
+(typeattributeset translation_service_33_0 (translation_service))
+(typeattributeset trust_service_33_0 (trust_service))
+(typeattributeset tty_device_33_0 (tty_device))
+(typeattributeset tun_device_33_0 (tun_device))
+(typeattributeset tv_iapp_service_33_0 (tv_iapp_service))
+(typeattributeset tv_input_service_33_0 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_33_0 (tv_tuner_resource_mgr_service))
+(typeattributeset tzdatacheck_33_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_33_0 (tzdatacheck_exec))
+(typeattributeset ueventd_33_0 (ueventd))
+(typeattributeset ueventd_tmpfs_33_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_33_0 (uhid_device))
+(typeattributeset uimode_service_33_0 (uimode_service))
+(typeattributeset uio_device_33_0 (uio_device))
+(typeattributeset uncrypt_33_0 (uncrypt))
+(typeattributeset uncrypt_exec_33_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_33_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_33_0 (unencrypted_data_file))
+(typeattributeset unlabeled_33_0 (unlabeled))
+(typeattributeset untrusted_app_25_33_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_33_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_33_0 (untrusted_app_29))
+(typeattributeset untrusted_app_30_33_0 (untrusted_app_30))
+(typeattributeset untrusted_app_33_0
+ ( untrusted_app
+ untrusted_app_32
+))
+(typeattributeset update_engine_33_0 (update_engine))
+(typeattributeset update_engine_data_file_33_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_33_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_33_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_33_0 (update_engine_service))
+(typeattributeset update_engine_stable_service_33_0 (update_engine_stable_service))
+(typeattributeset update_verifier_33_0 (update_verifier))
+(typeattributeset update_verifier_exec_33_0 (update_verifier_exec))
+(typeattributeset updatelock_service_33_0 (updatelock_service))
+(typeattributeset uri_grants_service_33_0 (uri_grants_service))
+(typeattributeset usagestats_service_33_0 (usagestats_service))
+(typeattributeset usb_config_prop_33_0 (usb_config_prop))
+(typeattributeset usb_control_prop_33_0 (usb_control_prop))
+(typeattributeset usb_device_33_0 (usb_device))
+(typeattributeset usb_prop_33_0 (usb_prop))
+(typeattributeset usb_serial_device_33_0 (usb_serial_device))
+(typeattributeset usb_service_33_0 (usb_service))
+(typeattributeset usbaccessory_device_33_0 (usbaccessory_device))
+(typeattributeset usbd_33_0 (usbd))
+(typeattributeset usbd_exec_33_0 (usbd_exec))
+(typeattributeset usbfs_33_0 (usbfs))
+(typeattributeset use_memfd_prop_33_0 (use_memfd_prop))
+(typeattributeset user_profile_data_file_33_0 (user_profile_data_file))
+(typeattributeset user_profile_root_file_33_0 (user_profile_root_file))
+(typeattributeset user_service_33_0 (user_service))
+(typeattributeset userdata_block_device_33_0 (userdata_block_device))
+(typeattributeset userdata_sysdev_33_0 (userdata_sysdev))
+(typeattributeset usermodehelper_33_0 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_33_0 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_33_0 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_33_0 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_33_0 (uwb_service))
+(typeattributeset vcn_management_service_33_0 (vcn_management_service))
+(typeattributeset vd_device_33_0 (vd_device))
+(typeattributeset vdc_33_0 (vdc))
+(typeattributeset vdc_exec_33_0 (vdc_exec))
+(typeattributeset vehicle_hal_prop_33_0 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_33_0 (vendor_apex_file))
+(typeattributeset vendor_app_file_33_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_33_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_33_0
+ ( vendor_configs_file
+ vendor_apex_metadata_file
+))
+(typeattributeset vendor_data_file_33_0 (vendor_data_file vendor_userdir_file))
+(typeattributeset vendor_default_prop_33_0 (vendor_default_prop))
+(typeattributeset vendor_file_33_0 (vendor_file))
+(typeattributeset vendor_framework_file_33_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_33_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_33_0 (vendor_idc_file))
+(typeattributeset vendor_init_33_0 (vendor_init))
+(typeattributeset vendor_kernel_modules_33_0 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_33_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_33_0 (vendor_keylayout_file))
+(typeattributeset vendor_misc_writer_33_0 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_33_0 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_33_0 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_33_0 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_33_0 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_33_0 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_33_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_33_0 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_33_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_33_0 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_33_0 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_33_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_33_0 (vendor_toolbox_exec))
+(typeattributeset vendor_uuid_mapping_config_file_33_0 (vendor_uuid_mapping_config_file))
+(typeattributeset vendor_vm_data_file_33_0 (vendor_vm_data_file))
+(typeattributeset vendor_vm_file_33_0 (vendor_vm_file))
+(typeattributeset vfat_33_0 (vfat))
+(typeattributeset vibrator_manager_service_33_0 (vibrator_manager_service))
+(typeattributeset vibrator_service_33_0 (vibrator_service))
+(typeattributeset video_device_33_0 (video_device))
+(typeattributeset virtual_ab_prop_33_0 (virtual_ab_prop))
+(typeattributeset virtual_device_service_33_0 (virtual_device_service))
+(typeattributeset virtual_touchpad_33_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_33_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_33_0 (virtual_touchpad_service))
+(typeattributeset virtualization_service_33_0 (virtualization_service))
+(typeattributeset vndbinder_device_33_0 (vndbinder_device))
+(typeattributeset vndk_prop_33_0 (vndk_prop))
+(typeattributeset vndk_sp_file_33_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_33_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_33_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_33_0 (voiceinteraction_service))
+(typeattributeset vold_33_0 (vold))
+(typeattributeset vold_config_prop_33_0 (vold_config_prop))
+(typeattributeset vold_data_file_33_0 (vold_data_file))
+(typeattributeset vold_device_33_0 (vold_device))
+(typeattributeset vold_exec_33_0 (vold_exec))
+(typeattributeset vold_metadata_file_33_0 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_33_0 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_33_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_33_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_33_0 (vold_prop))
+(typeattributeset vold_service_33_0 (vold_service))
+(typeattributeset vold_status_prop_33_0 (vold_status_prop))
+(typeattributeset vpn_data_file_33_0 (vpn_data_file))
+(typeattributeset vpn_management_service_33_0 (vpn_management_service))
+(typeattributeset vr_hwc_service_33_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_33_0 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_33_0 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_33_0 (vts_config_prop))
+(typeattributeset vts_status_prop_33_0 (vts_status_prop))
+(typeattributeset wallpaper_effects_generation_service_33_0 (wallpaper_effects_generation_service))
+(typeattributeset wallpaper_file_33_0 (wallpaper_file))
+(typeattributeset wallpaper_service_33_0 (wallpaper_service))
+(typeattributeset watchdog_device_33_0 (watchdog_device))
+(typeattributeset watchdog_metadata_file_33_0 (watchdog_metadata_file))
+(typeattributeset watchdogd_33_0 (watchdogd))
+(typeattributeset watchdogd_exec_33_0 (watchdogd_exec))
+(typeattributeset webview_zygote_33_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_33_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_33_0 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_33_0 (webviewupdate_service))
+(typeattributeset wifi_config_prop_33_0 (wifi_config_prop))
+(typeattributeset wifi_data_file_33_0 (wifi_data_file))
+(typeattributeset wifi_hal_prop_33_0 (wifi_hal_prop))
+(typeattributeset wifi_key_33_0 (wifi_key))
+(typeattributeset wifi_log_prop_33_0 (wifi_log_prop))
+(typeattributeset wifi_prop_33_0 (wifi_prop))
+(typeattributeset wifi_service_33_0 (wifi_service))
+(typeattributeset wifiaware_service_33_0 (wifiaware_service))
+(typeattributeset wificond_33_0 (wificond))
+(typeattributeset wificond_exec_33_0 (wificond_exec))
+(typeattributeset wifinl80211_service_33_0 (wifinl80211_service))
+(typeattributeset wifip2p_service_33_0 (wifip2p_service))
+(typeattributeset wifiscanner_service_33_0 (wifiscanner_service))
+(typeattributeset window_service_33_0 (window_service))
+(typeattributeset wpa_socket_33_0 (wpa_socket))
+(typeattributeset wpantund_33_0 (wpantund))
+(typeattributeset wpantund_exec_33_0 (wpantund_exec))
+(typeattributeset wpantund_service_33_0 (wpantund_service))
+(typeattributeset zero_device_33_0 (zero_device))
+(typeattributeset zoneinfo_data_file_33_0 (zoneinfo_data_file))
+(typeattributeset zram_config_prop_33_0 (zram_config_prop))
+(typeattributeset zram_control_prop_33_0 (zram_control_prop))
+(typeattributeset zygote_33_0 (zygote))
+(typeattributeset zygote_config_prop_33_0 (zygote_config_prop))
+(typeattributeset zygote_exec_33_0 (zygote_exec))
+(typeattributeset zygote_socket_33_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_33_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/33.0/33.0.compat.cil b/prebuilts/api/202504/private/compat/33.0/33.0.compat.cil
new file mode 100644
index 0000000..f102b02
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/33.0/33.0.compat.cil
@@ -0,0 +1,12 @@
+;; complement CIL file for compatibility between ToT policy and 33.0 vendors.
+;; will be compiled along with other normal policy files, on 33.0 vendors.
+;;
+
+;; This type may or may not already exist in vendor policy. The 202404 sepolicy
+;; (well, the 24Q1 release) added hidraw_device, but existing vendor policy
+;; may still label the relevant devices with the old label.
+(type vendor_hidraw_device)
+(typeattributeset dev_type (vendor_hidraw_device))
+
+(allow system_server vendor_hidraw_device (dir (open getattr read search ioctl lock watch watch_reads)))
+(allow system_server vendor_hidraw_device (chr_file (getattr open read ioctl lock map watch watch_reads append write)))
\ No newline at end of file
diff --git a/prebuilts/api/202504/private/compat/33.0/33.0.ignore.cil b/prebuilts/api/202504/private/compat/33.0/33.0.ignore.cil
new file mode 100644
index 0000000..a9a37a4
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/33.0/33.0.ignore.cil
@@ -0,0 +1,94 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 33.0 policy. Thus, we do not need to map
+;; these types to previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ adaptive_haptics_prop
+ apex_ready_prop
+ art_boot
+ art_boot_exec
+ artd
+ bt_device
+ build_attestation_prop
+ composd_vm_art_prop
+ composd_vm_vendor_prop
+ cpu_monitor_service
+ credential_service
+ device_as_webcam
+ device_config_camera_native_prop
+ device_config_core_experiments_team_internal_prop
+ device_config_edgetpu_native_prop
+ device_config_memory_safety_native_boot_prop
+ device_config_memory_safety_native_prop
+ device_config_updatable_service
+ device_config_vendor_system_native_prop
+ device_config_aconfig_flags_prop
+ devicelock_service
+ fwk_altitude_service
+ fwk_camera_service
+ fwk_sensor_service
+ game_manager_config_prop
+ grammatical_inflection_service
+ graphics_config_writable_prop
+ hal_bluetooth_service
+ hal_bootctl_service
+ hal_cas_service
+ hal_ivn_service
+ hal_remoteaccess_service
+ hal_secure_element_service
+ hal_tetheroffload_service
+ hal_thermal_service
+ hal_usb_gadget_service
+ hal_tv_input_service
+ hal_tv_hdmi_cec_service
+ hal_tv_hdmi_connection_service
+ hal_tv_hdmi_earc_service
+ hal_wifi_service
+ healthconnect_service
+ hypervisor_restricted_prop
+ isolated_compute_app
+ keystore_config_prop
+ ondevicepersonalization_system_service
+ fuseblk
+ fuseblkd_untrusted
+ fuseblkd_untrusted_exec
+ fuseblkd
+ fuseblkd_exec
+ ota_build_prop
+ permissive_mte_prop
+ persist_sysui_builder_extras_prop
+ persist_sysui_ranking_update_prop
+ prng_seeder
+ quick_start_prop
+ recovery_usb_config_prop
+ remote_provisioning_service
+ repair_mode_metadata_file
+ rkpdapp
+ servicemanager_prop
+ shutdown_checkpoints_system_data_file
+ snapuserd_log_data_file
+ stats_config_data_file
+ sysfs_fs_fuse_features
+ system_net_netd_service
+ timezone_metadata_prop
+ traced_oome_heap_session_count_prop
+ tuner_config_prop
+ tuner_server_ctl_prop
+ ublk_block_device
+ ublk_control_device
+ usb_uvc_enabled_prop
+ virtual_face_hal_prop
+ virtual_face_prop
+ virtual_fingerprint_hal_prop
+ virtual_fingerprint_prop
+ hal_gatekeeper_service
+ hal_broadcastradio_service
+ hal_confirmationui_service
+ hal_fastboot_service
+ hal_can_controller_service
+ zoned_block_device
+ future_pm_prop
+ vfio_device
+ ))
diff --git a/prebuilts/api/202504/private/compat/34.0/34.0.cil b/prebuilts/api/202504/private/compat/34.0/34.0.cil
new file mode 100644
index 0000000..7d80433
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/34.0/34.0.cil
@@ -0,0 +1,2716 @@
+;; types removed from current policy
+(type racoon)
+(type racoon_exec)
+(type mtp_exec)
+(type ppp_device)
+(type ppp_exec)
+
+;; mapping information from ToT policy's types to 34.0 policy's types.
+(expandtypeattribute (DockObserver_service_34_0) true)
+(expandtypeattribute (IProxyService_service_34_0) true)
+(expandtypeattribute (aac_drc_prop_34_0) true)
+(expandtypeattribute (aaudio_config_prop_34_0) true)
+(expandtypeattribute (ab_update_gki_prop_34_0) true)
+(expandtypeattribute (accessibility_service_34_0) true)
+(expandtypeattribute (account_service_34_0) true)
+(expandtypeattribute (activity_service_34_0) true)
+(expandtypeattribute (activity_task_service_34_0) true)
+(expandtypeattribute (adaptive_haptics_prop_34_0) true)
+(expandtypeattribute (adb_data_file_34_0) true)
+(expandtypeattribute (adb_keys_file_34_0) true)
+(expandtypeattribute (adb_service_34_0) true)
+(expandtypeattribute (adbd_34_0) true)
+(expandtypeattribute (adbd_config_prop_34_0) true)
+(expandtypeattribute (adbd_exec_34_0) true)
+(expandtypeattribute (adbd_socket_34_0) true)
+(expandtypeattribute (adservices_manager_service_34_0) true)
+(expandtypeattribute (aidl_lazy_test_server_34_0) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_34_0) true)
+(expandtypeattribute (aidl_lazy_test_service_34_0) true)
+(expandtypeattribute (alarm_service_34_0) true)
+(expandtypeattribute (anr_data_file_34_0) true)
+(expandtypeattribute (apc_service_34_0) true)
+(expandtypeattribute (apex_data_file_34_0) true)
+(expandtypeattribute (apex_info_file_34_0) true)
+(expandtypeattribute (apex_metadata_file_34_0) true)
+(expandtypeattribute (apex_mnt_dir_34_0) true)
+(expandtypeattribute (apex_module_data_file_34_0) true)
+(expandtypeattribute (apex_ota_reserved_file_34_0) true)
+(expandtypeattribute (apex_ready_prop_34_0) true)
+(expandtypeattribute (apex_rollback_data_file_34_0) true)
+(expandtypeattribute (apex_service_34_0) true)
+(expandtypeattribute (apex_system_server_data_file_34_0) true)
+(expandtypeattribute (apexd_34_0) true)
+(expandtypeattribute (apexd_config_prop_34_0) true)
+(expandtypeattribute (apexd_exec_34_0) true)
+(expandtypeattribute (apexd_prop_34_0) true)
+(expandtypeattribute (apexd_select_prop_34_0) true)
+(expandtypeattribute (apk_data_file_34_0) true)
+(expandtypeattribute (apk_private_data_file_34_0) true)
+(expandtypeattribute (apk_private_tmp_file_34_0) true)
+(expandtypeattribute (apk_tmp_file_34_0) true)
+(expandtypeattribute (apk_verity_prop_34_0) true)
+(expandtypeattribute (app_binding_service_34_0) true)
+(expandtypeattribute (app_data_file_34_0) true)
+(expandtypeattribute (app_fuse_file_34_0) true)
+(expandtypeattribute (app_fusefs_34_0) true)
+(expandtypeattribute (app_hibernation_service_34_0) true)
+(expandtypeattribute (app_integrity_service_34_0) true)
+(expandtypeattribute (app_prediction_service_34_0) true)
+(expandtypeattribute (app_search_service_34_0) true)
+(expandtypeattribute (app_zygote_34_0) true)
+(expandtypeattribute (app_zygote_tmpfs_34_0) true)
+(expandtypeattribute (appcompat_data_file_34_0) true)
+(expandtypeattribute (appdomain_tmpfs_34_0) true)
+(expandtypeattribute (appops_service_34_0) true)
+(expandtypeattribute (appwidget_service_34_0) true)
+(expandtypeattribute (arm64_memtag_prop_34_0) true)
+(expandtypeattribute (art_apex_dir_34_0) true)
+(expandtypeattribute (artd_34_0) true)
+(expandtypeattribute (artd_service_34_0) true)
+(expandtypeattribute (asec_apk_file_34_0) true)
+(expandtypeattribute (asec_image_file_34_0) true)
+(expandtypeattribute (asec_public_file_34_0) true)
+(expandtypeattribute (ashmem_device_34_0) true)
+(expandtypeattribute (ashmem_libcutils_device_34_0) true)
+(expandtypeattribute (assetatlas_service_34_0) true)
+(expandtypeattribute (atrace_34_0) true)
+(expandtypeattribute (attestation_verification_service_34_0) true)
+(expandtypeattribute (audio_config_prop_34_0) true)
+(expandtypeattribute (audio_data_file_34_0) true)
+(expandtypeattribute (audio_device_34_0) true)
+(expandtypeattribute (audio_prop_34_0) true)
+(expandtypeattribute (audio_service_34_0) true)
+(expandtypeattribute (audiohal_data_file_34_0) true)
+(expandtypeattribute (audioserver_34_0) true)
+(expandtypeattribute (audioserver_data_file_34_0) true)
+(expandtypeattribute (audioserver_service_34_0) true)
+(expandtypeattribute (audioserver_tmpfs_34_0) true)
+(expandtypeattribute (auth_service_34_0) true)
+(expandtypeattribute (authorization_service_34_0) true)
+(expandtypeattribute (autofill_service_34_0) true)
+(expandtypeattribute (backup_data_file_34_0) true)
+(expandtypeattribute (backup_service_34_0) true)
+(expandtypeattribute (battery_service_34_0) true)
+(expandtypeattribute (batteryproperties_service_34_0) true)
+(expandtypeattribute (batterystats_service_34_0) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_34_0) true)
+(expandtypeattribute (binder_cache_system_server_prop_34_0) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_34_0) true)
+(expandtypeattribute (binder_calls_stats_service_34_0) true)
+(expandtypeattribute (binder_device_34_0) true)
+(expandtypeattribute (binderfs_34_0) true)
+(expandtypeattribute (binderfs_features_34_0) true)
+(expandtypeattribute (binderfs_logs_34_0) true)
+(expandtypeattribute (binderfs_logs_proc_34_0) true)
+(expandtypeattribute (binfmt_miscfs_34_0) true)
+(expandtypeattribute (biometric_service_34_0) true)
+(expandtypeattribute (blkid_34_0) true)
+(expandtypeattribute (blkid_untrusted_34_0) true)
+(expandtypeattribute (blob_store_service_34_0) true)
+(expandtypeattribute (block_device_34_0) true)
+(expandtypeattribute (bluetooth_34_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_34_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_34_0) true)
+(expandtypeattribute (bluetooth_config_prop_34_0) true)
+(expandtypeattribute (bluetooth_data_file_34_0) true)
+(expandtypeattribute (bluetooth_efs_file_34_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_34_0) true)
+(expandtypeattribute (bluetooth_manager_service_34_0) true)
+(expandtypeattribute (bluetooth_prop_34_0) true)
+(expandtypeattribute (bluetooth_service_34_0) true)
+(expandtypeattribute (bluetooth_socket_34_0) true)
+(expandtypeattribute (boot_block_device_34_0) true)
+(expandtypeattribute (boot_status_prop_34_0) true)
+(expandtypeattribute (bootanim_34_0) true)
+(expandtypeattribute (bootanim_config_prop_34_0) true)
+(expandtypeattribute (bootanim_exec_34_0) true)
+(expandtypeattribute (bootanim_system_prop_34_0) true)
+(expandtypeattribute (bootchart_data_file_34_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_34_0) true)
+(expandtypeattribute (bootloader_prop_34_0) true)
+(expandtypeattribute (bootstat_34_0) true)
+(expandtypeattribute (bootstat_data_file_34_0) true)
+(expandtypeattribute (bootstat_exec_34_0) true)
+(expandtypeattribute (boottime_prop_34_0) true)
+(expandtypeattribute (boottime_public_prop_34_0) true)
+(expandtypeattribute (boottrace_data_file_34_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_34_0) true)
+(expandtypeattribute (bpfloader_34_0) true)
+(expandtypeattribute (bq_config_prop_34_0) true)
+(expandtypeattribute (broadcastradio_service_34_0) true)
+(expandtypeattribute (bt_device_34_0) true)
+(expandtypeattribute (bufferhubd_34_0) true)
+(expandtypeattribute (bufferhubd_exec_34_0) true)
+(expandtypeattribute (bugreport_service_34_0) true)
+(expandtypeattribute (build_attestation_prop_34_0) true)
+(expandtypeattribute (build_bootimage_prop_34_0) true)
+(expandtypeattribute (build_config_prop_34_0) true)
+(expandtypeattribute (build_odm_prop_34_0) true)
+(expandtypeattribute (build_prop_34_0) true)
+(expandtypeattribute (build_vendor_prop_34_0) true)
+(expandtypeattribute (cache_backup_file_34_0) true)
+(expandtypeattribute (cache_block_device_34_0) true)
+(expandtypeattribute (cache_file_34_0) true)
+(expandtypeattribute (cache_private_backup_file_34_0) true)
+(expandtypeattribute (cache_recovery_file_34_0) true)
+(expandtypeattribute (cacheinfo_service_34_0) true)
+(expandtypeattribute (camera2_extensions_prop_34_0) true)
+(expandtypeattribute (camera_calibration_prop_34_0) true)
+(expandtypeattribute (camera_config_prop_34_0) true)
+(expandtypeattribute (camera_data_file_34_0) true)
+(expandtypeattribute (camera_device_34_0) true)
+(expandtypeattribute (cameraproxy_service_34_0) true)
+(expandtypeattribute (cameraserver_34_0) true)
+(expandtypeattribute (cameraserver_exec_34_0) true)
+(expandtypeattribute (cameraserver_service_34_0) true)
+(expandtypeattribute (cameraserver_tmpfs_34_0) true)
+(expandtypeattribute (camerax_extensions_prop_34_0) true)
+(expandtypeattribute (cgroup_34_0) true)
+(expandtypeattribute (cgroup_desc_api_file_34_0) true)
+(expandtypeattribute (cgroup_desc_file_34_0) true)
+(expandtypeattribute (cgroup_rc_file_34_0) true)
+(expandtypeattribute (cgroup_v2_34_0) true)
+(expandtypeattribute (charger_34_0) true)
+(expandtypeattribute (charger_config_prop_34_0) true)
+(expandtypeattribute (charger_exec_34_0) true)
+(expandtypeattribute (charger_prop_34_0) true)
+(expandtypeattribute (charger_status_prop_34_0) true)
+(expandtypeattribute (charger_vendor_34_0) true)
+(expandtypeattribute (clipboard_service_34_0) true)
+(expandtypeattribute (cloudsearch_service_34_0) true)
+(expandtypeattribute (codec2_config_prop_34_0) true)
+(expandtypeattribute (cold_boot_done_prop_34_0) true)
+(expandtypeattribute (color_display_service_34_0) true)
+(expandtypeattribute (companion_device_service_34_0) true)
+(expandtypeattribute (composd_vm_art_prop_34_0) true)
+(expandtypeattribute (composd_vm_vendor_prop_34_0) true)
+(expandtypeattribute (config_prop_34_0) true)
+(expandtypeattribute (configfs_34_0) true)
+(expandtypeattribute (connectivity_native_service_34_0) true)
+(expandtypeattribute (connectivity_service_34_0) true)
+(expandtypeattribute (connmetrics_service_34_0) true)
+(expandtypeattribute (console_device_34_0) true)
+(expandtypeattribute (consumer_ir_service_34_0) true)
+(expandtypeattribute (content_capture_service_34_0) true)
+(expandtypeattribute (content_service_34_0) true)
+(expandtypeattribute (content_suggestions_service_34_0) true)
+(expandtypeattribute (contexthub_service_34_0) true)
+(expandtypeattribute (coredump_file_34_0) true)
+(expandtypeattribute (country_detector_service_34_0) true)
+(expandtypeattribute (coverage_service_34_0) true)
+(expandtypeattribute (cppreopt_prop_34_0) true)
+(expandtypeattribute (cpu_monitor_service_34_0) true)
+(expandtypeattribute (cpu_variant_prop_34_0) true)
+(expandtypeattribute (cpuinfo_service_34_0) true)
+(expandtypeattribute (crash_dump_34_0) true)
+(expandtypeattribute (crash_dump_exec_34_0) true)
+(expandtypeattribute (credential_service_34_0) true)
+(expandtypeattribute (credstore_34_0) true)
+(expandtypeattribute (credstore_data_file_34_0) true)
+(expandtypeattribute (credstore_exec_34_0) true)
+(expandtypeattribute (credstore_service_34_0) true)
+(expandtypeattribute (crossprofileapps_service_34_0) true)
+(expandtypeattribute (ctl_adbd_prop_34_0) true)
+(expandtypeattribute (ctl_apexd_prop_34_0) true)
+(expandtypeattribute (ctl_bootanim_prop_34_0) true)
+(expandtypeattribute (ctl_bugreport_prop_34_0) true)
+(expandtypeattribute (ctl_console_prop_34_0) true)
+(expandtypeattribute (ctl_default_prop_34_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_34_0) true)
+(expandtypeattribute (ctl_fuse_prop_34_0) true)
+(expandtypeattribute (ctl_gsid_prop_34_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_34_0) true)
+(expandtypeattribute (ctl_interface_start_prop_34_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_34_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_34_0) true)
+(expandtypeattribute (ctl_restart_prop_34_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_34_0) true)
+(expandtypeattribute (ctl_sigstop_prop_34_0) true)
+(expandtypeattribute (ctl_start_prop_34_0) true)
+(expandtypeattribute (ctl_stop_prop_34_0) true)
+(expandtypeattribute (dalvik_config_prop_34_0) true)
+(expandtypeattribute (dalvik_dynamic_config_prop_34_0) true)
+(expandtypeattribute (dalvik_prop_34_0) true)
+(expandtypeattribute (dalvik_runtime_prop_34_0) true)
+(expandtypeattribute (dalvikcache_data_file_34_0) true)
+(expandtypeattribute (dataloader_manager_service_34_0) true)
+(expandtypeattribute (dbinfo_service_34_0) true)
+(expandtypeattribute (dck_prop_34_0) true)
+(expandtypeattribute (debug_prop_34_0) true)
+(expandtypeattribute (debugfs_34_0) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_34_0) true)
+(expandtypeattribute (debugfs_kprobes_34_0) true)
+(expandtypeattribute (debugfs_mm_events_tracing_34_0) true)
+(expandtypeattribute (debugfs_mmc_34_0) true)
+(expandtypeattribute (debugfs_restriction_prop_34_0) true)
+(expandtypeattribute (debugfs_trace_marker_34_0) true)
+(expandtypeattribute (debugfs_tracing_34_0) true)
+(expandtypeattribute (debugfs_tracing_debug_34_0) true)
+(expandtypeattribute (debugfs_tracing_instances_34_0) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_34_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_34_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_34_0) true)
+(expandtypeattribute (debuggerd_prop_34_0) true)
+(expandtypeattribute (default_android_hwservice_34_0) true)
+(expandtypeattribute (default_android_service_34_0) true)
+(expandtypeattribute (default_android_vndservice_34_0) true)
+(expandtypeattribute (default_prop_34_0) true)
+(expandtypeattribute (dev_cpu_variant_34_0) true)
+(expandtypeattribute (device_34_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_boot_count_prop_34_0) true)
+(expandtypeattribute (device_config_camera_native_prop_34_0) true)
+(expandtypeattribute (device_config_edgetpu_native_prop_34_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_media_native_prop_34_0) true)
+(expandtypeattribute (device_config_memory_safety_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_memory_safety_native_prop_34_0) true)
+(expandtypeattribute (device_config_netd_native_prop_34_0) true)
+(expandtypeattribute (device_config_nnapi_native_prop_34_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_34_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_34_0) true)
+(expandtypeattribute (device_config_service_34_0) true)
+(expandtypeattribute (device_config_surface_flinger_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_updatable_service_34_0) true)
+(expandtypeattribute (device_config_vendor_system_native_boot_prop_34_0) true)
+(expandtypeattribute (device_config_vendor_system_native_prop_34_0) true)
+(expandtypeattribute (device_identifiers_service_34_0) true)
+(expandtypeattribute (device_logging_prop_34_0) true)
+(expandtypeattribute (device_policy_service_34_0) true)
+(expandtypeattribute (device_state_service_34_0) true)
+(expandtypeattribute (deviceidle_service_34_0) true)
+(expandtypeattribute (devicelock_service_34_0) true)
+(expandtypeattribute (devicestoragemonitor_service_34_0) true)
+(expandtypeattribute (devpts_34_0) true)
+(expandtypeattribute (dhcp_34_0) true)
+(expandtypeattribute (dhcp_data_file_34_0) true)
+(expandtypeattribute (dhcp_exec_34_0) true)
+(expandtypeattribute (dhcp_prop_34_0) true)
+(expandtypeattribute (diskstats_service_34_0) true)
+(expandtypeattribute (display_service_34_0) true)
+(expandtypeattribute (dm_device_34_0) true)
+(expandtypeattribute (dm_user_device_34_0) true)
+(expandtypeattribute (dmabuf_heap_device_34_0) true)
+(expandtypeattribute (dmabuf_system_heap_device_34_0) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_34_0) true)
+(expandtypeattribute (dnsmasq_34_0) true)
+(expandtypeattribute (dnsmasq_exec_34_0) true)
+(expandtypeattribute (dnsproxyd_socket_34_0) true)
+(expandtypeattribute (dnsresolver_service_34_0) true)
+(expandtypeattribute (domain_verification_service_34_0) true)
+(expandtypeattribute (dreams_service_34_0) true)
+(expandtypeattribute (drm_data_file_34_0) true)
+(expandtypeattribute (drm_service_config_prop_34_0) true)
+(expandtypeattribute (drmserver_34_0) true)
+(expandtypeattribute (drmserver_exec_34_0) true)
+(expandtypeattribute (drmserver_service_34_0) true)
+(expandtypeattribute (drmserver_socket_34_0) true)
+(expandtypeattribute (dropbox_data_file_34_0) true)
+(expandtypeattribute (dropbox_service_34_0) true)
+(expandtypeattribute (dumpstate_34_0) true)
+(expandtypeattribute (dumpstate_exec_34_0) true)
+(expandtypeattribute (dumpstate_options_prop_34_0) true)
+(expandtypeattribute (dumpstate_prop_34_0) true)
+(expandtypeattribute (dumpstate_service_34_0) true)
+(expandtypeattribute (dumpstate_socket_34_0) true)
+(expandtypeattribute (dynamic_system_prop_34_0) true)
+(expandtypeattribute (e2fs_34_0) true)
+(expandtypeattribute (e2fs_exec_34_0) true)
+(expandtypeattribute (efs_file_34_0) true)
+(expandtypeattribute (emergency_affordance_service_34_0) true)
+(expandtypeattribute (ephemeral_app_34_0) true)
+(expandtypeattribute (ethernet_service_34_0) true)
+(expandtypeattribute (evsmanagerd_34_0) true)
+(expandtypeattribute (evsmanagerd_service_34_0) true)
+(expandtypeattribute (exfat_34_0) true)
+(expandtypeattribute (exported3_system_prop_34_0) true)
+(expandtypeattribute (exported_bluetooth_prop_34_0) true)
+(expandtypeattribute (exported_camera_prop_34_0) true)
+(expandtypeattribute (exported_config_prop_34_0) true)
+(expandtypeattribute (exported_default_prop_34_0) true)
+(expandtypeattribute (exported_dumpstate_prop_34_0) true)
+(expandtypeattribute (exported_overlay_prop_34_0) true)
+(expandtypeattribute (exported_pm_prop_34_0) true)
+(expandtypeattribute (exported_secure_prop_34_0) true)
+(expandtypeattribute (exported_system_prop_34_0) true)
+(expandtypeattribute (external_vibrator_service_34_0) true)
+(expandtypeattribute (extra_free_kbytes_34_0) true)
+(expandtypeattribute (extra_free_kbytes_exec_34_0) true)
+(expandtypeattribute (face_service_34_0) true)
+(expandtypeattribute (face_vendor_data_file_34_0) true)
+(expandtypeattribute (fastbootd_34_0) true)
+(expandtypeattribute (ffs_config_prop_34_0) true)
+(expandtypeattribute (ffs_control_prop_34_0) true)
+(expandtypeattribute (file_contexts_file_34_0) true)
+(expandtypeattribute (file_integrity_service_34_0) true)
+(expandtypeattribute (fingerprint_prop_34_0) true)
+(expandtypeattribute (fingerprint_service_34_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_34_0) true)
+(expandtypeattribute (fingerprintd_34_0) true)
+(expandtypeattribute (fingerprintd_data_file_34_0) true)
+(expandtypeattribute (fingerprintd_exec_34_0) true)
+(expandtypeattribute (fingerprintd_service_34_0) true)
+(expandtypeattribute (firstboot_prop_34_0) true)
+(expandtypeattribute (flags_health_check_34_0) true)
+(expandtypeattribute (flags_health_check_exec_34_0) true)
+(expandtypeattribute (font_service_34_0) true)
+(expandtypeattribute (framework_status_prop_34_0) true)
+(expandtypeattribute (framework_watchdog_config_prop_34_0) true)
+(expandtypeattribute (frp_block_device_34_0) true)
+(expandtypeattribute (fs_bpf_34_0) true)
+(expandtypeattribute (fs_bpf_tethering_34_0) true)
+(expandtypeattribute (fs_bpf_vendor_34_0) true)
+(expandtypeattribute (fsck_34_0) true)
+(expandtypeattribute (fsck_exec_34_0) true)
+(expandtypeattribute (fsck_untrusted_34_0) true)
+(expandtypeattribute (fscklogs_34_0) true)
+(expandtypeattribute (functionfs_34_0) true)
+(expandtypeattribute (fuse_34_0) true)
+(expandtypeattribute (fuse_device_34_0) true)
+(expandtypeattribute (fuseblk_34_0) true)
+(expandtypeattribute (fusectlfs_34_0) true)
+(expandtypeattribute (future_pm_prop_34_0) true)
+(expandtypeattribute (fwk_altitude_service_34_0) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_34_0) true)
+(expandtypeattribute (fwk_automotive_display_service_34_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_34_0) true)
+(expandtypeattribute (fwk_camera_hwservice_34_0) true)
+(expandtypeattribute (fwk_camera_service_34_0) true)
+(expandtypeattribute (fwk_display_hwservice_34_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_34_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_34_0) true)
+(expandtypeattribute (fwk_sensor_service_34_0) true)
+(expandtypeattribute (fwk_stats_hwservice_34_0) true)
+(expandtypeattribute (fwk_stats_service_34_0) true)
+(expandtypeattribute (fwmarkd_socket_34_0) true)
+(expandtypeattribute (game_mode_intervention_list_file_34_0) true)
+(expandtypeattribute (game_service_34_0) true)
+(expandtypeattribute (gatekeeper_data_file_34_0) true)
+(expandtypeattribute (gatekeeper_service_34_0) true)
+(expandtypeattribute (gatekeeperd_34_0) true)
+(expandtypeattribute (gatekeeperd_exec_34_0) true)
+(expandtypeattribute (gesture_prop_34_0) true)
+(expandtypeattribute (gfxinfo_service_34_0) true)
+(expandtypeattribute (gmscore_app_34_0) true)
+(expandtypeattribute (gnss_device_34_0) true)
+(expandtypeattribute (gnss_time_update_service_34_0) true)
+(expandtypeattribute (gps_control_34_0) true)
+(expandtypeattribute (gpu_device_34_0) true)
+(expandtypeattribute (gpu_service_34_0) true)
+(expandtypeattribute (gpuservice_34_0) true)
+(expandtypeattribute (grammatical_inflection_service_34_0) true)
+(expandtypeattribute (graphics_config_prop_34_0) true)
+(expandtypeattribute (graphics_config_writable_prop_34_0) true)
+(expandtypeattribute (graphics_device_34_0) true)
+(expandtypeattribute (graphicsstats_service_34_0) true)
+(expandtypeattribute (gsi_data_file_34_0) true)
+(expandtypeattribute (gsi_metadata_file_34_0) true)
+(expandtypeattribute (gsi_public_metadata_file_34_0) true)
+(expandtypeattribute (gwp_asan_prop_34_0) true)
+(expandtypeattribute (hal_atrace_hwservice_34_0) true)
+(expandtypeattribute (hal_audio_hwservice_34_0) true)
+(expandtypeattribute (hal_audio_service_34_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_34_0) true)
+(expandtypeattribute (hal_audiocontrol_service_34_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_34_0) true)
+(expandtypeattribute (hal_authsecret_service_34_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_34_0) true)
+(expandtypeattribute (hal_bluetooth_service_34_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_34_0) true)
+(expandtypeattribute (hal_bootctl_service_34_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_34_0) true)
+(expandtypeattribute (hal_broadcastradio_service_34_0) true)
+(expandtypeattribute (hal_camera_hwservice_34_0) true)
+(expandtypeattribute (hal_camera_service_34_0) true)
+(expandtypeattribute (hal_can_bus_hwservice_34_0) true)
+(expandtypeattribute (hal_can_controller_hwservice_34_0) true)
+(expandtypeattribute (hal_can_controller_service_34_0) true)
+(expandtypeattribute (hal_cas_hwservice_34_0) true)
+(expandtypeattribute (hal_cas_service_34_0) true)
+(expandtypeattribute (hal_codec2_hwservice_34_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_34_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_34_0) true)
+(expandtypeattribute (hal_confirmationui_service_34_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_34_0) true)
+(expandtypeattribute (hal_contexthub_service_34_0) true)
+(expandtypeattribute (hal_drm_hwservice_34_0) true)
+(expandtypeattribute (hal_drm_service_34_0) true)
+(expandtypeattribute (hal_dumpstate_config_prop_34_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_34_0) true)
+(expandtypeattribute (hal_dumpstate_service_34_0) true)
+(expandtypeattribute (hal_evs_hwservice_34_0) true)
+(expandtypeattribute (hal_evs_service_34_0) true)
+(expandtypeattribute (hal_face_hwservice_34_0) true)
+(expandtypeattribute (hal_face_service_34_0) true)
+(expandtypeattribute (hal_fastboot_service_34_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_34_0) true)
+(expandtypeattribute (hal_fingerprint_service_34_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_34_0) true)
+(expandtypeattribute (hal_gatekeeper_service_34_0) true)
+(expandtypeattribute (hal_gnss_hwservice_34_0) true)
+(expandtypeattribute (hal_gnss_service_34_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_34_0) true)
+(expandtypeattribute (hal_graphics_allocator_service_34_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_34_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_34_0) true)
+(expandtypeattribute (hal_graphics_composer_service_34_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_34_0) true)
+(expandtypeattribute (hal_health_hwservice_34_0) true)
+(expandtypeattribute (hal_health_service_34_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_34_0) true)
+(expandtypeattribute (hal_health_storage_service_34_0) true)
+(expandtypeattribute (hal_identity_service_34_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_34_0) true)
+(expandtypeattribute (hal_input_processor_service_34_0) true)
+(expandtypeattribute (hal_instrumentation_prop_34_0) true)
+(expandtypeattribute (hal_ir_hwservice_34_0) true)
+(expandtypeattribute (hal_ir_service_34_0) true)
+(expandtypeattribute (hal_ivn_service_34_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_34_0) true)
+(expandtypeattribute (hal_keymint_service_34_0) true)
+(expandtypeattribute (hal_light_hwservice_34_0) true)
+(expandtypeattribute (hal_light_service_34_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_34_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_34_0) true)
+(expandtypeattribute (hal_memtrack_service_34_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_34_0) true)
+(expandtypeattribute (hal_neuralnetworks_service_34_0) true)
+(expandtypeattribute (hal_nfc_hwservice_34_0) true)
+(expandtypeattribute (hal_nfc_service_34_0) true)
+(expandtypeattribute (hal_nlinterceptor_service_34_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_34_0) true)
+(expandtypeattribute (hal_oemlock_service_34_0) true)
+(expandtypeattribute (hal_omx_hwservice_34_0) true)
+(expandtypeattribute (hal_power_hwservice_34_0) true)
+(expandtypeattribute (hal_power_service_34_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_34_0) true)
+(expandtypeattribute (hal_power_stats_service_34_0) true)
+(expandtypeattribute (hal_radio_service_34_0) true)
+(expandtypeattribute (hal_rebootescrow_service_34_0) true)
+(expandtypeattribute (hal_remoteaccess_service_34_0) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_34_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_34_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_34_0) true)
+(expandtypeattribute (hal_secure_element_service_34_0) true)
+(expandtypeattribute (hal_secureclock_service_34_0) true)
+(expandtypeattribute (hal_sensors_hwservice_34_0) true)
+(expandtypeattribute (hal_sensors_service_34_0) true)
+(expandtypeattribute (hal_sharedsecret_service_34_0) true)
+(expandtypeattribute (hal_system_suspend_service_34_0) true)
+(expandtypeattribute (hal_telephony_hwservice_34_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_34_0) true)
+(expandtypeattribute (hal_tetheroffload_service_34_0) true)
+(expandtypeattribute (hal_thermal_hwservice_34_0) true)
+(expandtypeattribute (hal_thermal_service_34_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_34_0) true)
+(expandtypeattribute (hal_tv_hdmi_cec_service_34_0) true)
+(expandtypeattribute (hal_tv_hdmi_connection_service_34_0) true)
+(expandtypeattribute (hal_tv_hdmi_earc_service_34_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_34_0) true)
+(expandtypeattribute (hal_tv_input_service_34_0) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_34_0) true)
+(expandtypeattribute (hal_tv_tuner_service_34_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_34_0) true)
+(expandtypeattribute (hal_usb_gadget_service_34_0) true)
+(expandtypeattribute (hal_usb_hwservice_34_0) true)
+(expandtypeattribute (hal_usb_service_34_0) true)
+(expandtypeattribute (hal_uwb_service_34_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_34_0) true)
+(expandtypeattribute (hal_vehicle_service_34_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_34_0) true)
+(expandtypeattribute (hal_vibrator_service_34_0) true)
+(expandtypeattribute (hal_vr_hwservice_34_0) true)
+(expandtypeattribute (hal_weaver_hwservice_34_0) true)
+(expandtypeattribute (hal_weaver_service_34_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_34_0) true)
+(expandtypeattribute (hal_wifi_hostapd_service_34_0) true)
+(expandtypeattribute (hal_wifi_hwservice_34_0) true)
+(expandtypeattribute (hal_wifi_service_34_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_34_0) true)
+(expandtypeattribute (hal_wifi_supplicant_service_34_0) true)
+(expandtypeattribute (hardware_properties_service_34_0) true)
+(expandtypeattribute (hardware_service_34_0) true)
+(expandtypeattribute (hci_attach_dev_34_0) true)
+(expandtypeattribute (hdmi_config_prop_34_0) true)
+(expandtypeattribute (hdmi_control_service_34_0) true)
+(expandtypeattribute (healthconnect_service_34_0) true)
+(expandtypeattribute (healthd_34_0) true)
+(expandtypeattribute (heapdump_data_file_34_0) true)
+(expandtypeattribute (heapprofd_34_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_34_0) true)
+(expandtypeattribute (heapprofd_prop_34_0) true)
+(expandtypeattribute (heapprofd_socket_34_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_34_0) true)
+(expandtypeattribute (hidl_base_hwservice_34_0) true)
+(expandtypeattribute (hidl_manager_hwservice_34_0) true)
+(expandtypeattribute (hidl_memory_hwservice_34_0) true)
+(expandtypeattribute (hidl_token_hwservice_34_0) true)
+(expandtypeattribute (hint_service_34_0) true)
+(expandtypeattribute (hw_random_device_34_0) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_34_0) true)
+(expandtypeattribute (hwbinder_device_34_0) true)
+(expandtypeattribute (hwservice_contexts_file_34_0) true)
+(expandtypeattribute (hwservicemanager_34_0) true)
+(expandtypeattribute (hwservicemanager_exec_34_0) true)
+(expandtypeattribute (hwservicemanager_prop_34_0) true)
+(expandtypeattribute (hypervisor_prop_34_0) true)
+(expandtypeattribute (hypervisor_restricted_prop_34_0) true)
+(expandtypeattribute (icon_file_34_0) true)
+(expandtypeattribute (idmap_34_0) true)
+(expandtypeattribute (idmap_exec_34_0) true)
+(expandtypeattribute (idmap_service_34_0) true)
+(expandtypeattribute (iio_device_34_0) true)
+(expandtypeattribute (imms_service_34_0) true)
+(expandtypeattribute (incident_34_0) true)
+(expandtypeattribute (incident_data_file_34_0) true)
+(expandtypeattribute (incident_helper_34_0) true)
+(expandtypeattribute (incident_service_34_0) true)
+(expandtypeattribute (incidentd_34_0) true)
+(expandtypeattribute (incremental_control_file_34_0) true)
+(expandtypeattribute (incremental_prop_34_0) true)
+(expandtypeattribute (incremental_service_34_0) true)
+(expandtypeattribute (init_34_0) true)
+(expandtypeattribute (init_exec_34_0) true)
+(expandtypeattribute (init_service_status_prop_34_0) true)
+(expandtypeattribute (init_tmpfs_34_0) true)
+(expandtypeattribute (inotify_34_0) true)
+(expandtypeattribute (input_device_34_0) true)
+(expandtypeattribute (input_method_service_34_0) true)
+(expandtypeattribute (input_service_34_0) true)
+(expandtypeattribute (inputflinger_34_0) true)
+(expandtypeattribute (inputflinger_exec_34_0) true)
+(expandtypeattribute (inputflinger_service_34_0) true)
+(expandtypeattribute (install_data_file_34_0) true)
+(expandtypeattribute (installd_34_0) true)
+(expandtypeattribute (installd_exec_34_0) true)
+(expandtypeattribute (installd_service_34_0) true)
+(expandtypeattribute (ion_device_34_0) true)
+(expandtypeattribute (ipsec_service_34_0) true)
+(expandtypeattribute (iris_service_34_0) true)
+(expandtypeattribute (iris_vendor_data_file_34_0) true)
+(expandtypeattribute (isolated_app_34_0) true)
+(expandtypeattribute (isolated_compute_app_34_0) true)
+(expandtypeattribute (jobscheduler_service_34_0) true)
+(expandtypeattribute (kernel_34_0) true)
+(expandtypeattribute (keychain_data_file_34_0) true)
+(expandtypeattribute (keychord_device_34_0) true)
+(expandtypeattribute (keyguard_config_prop_34_0) true)
+(expandtypeattribute (keystore2_key_contexts_file_34_0) true)
+(expandtypeattribute (keystore_34_0) true)
+(expandtypeattribute (keystore_compat_hal_service_34_0) true)
+(expandtypeattribute (keystore_config_prop_34_0) true)
+(expandtypeattribute (keystore_data_file_34_0) true)
+(expandtypeattribute (keystore_exec_34_0) true)
+(expandtypeattribute (keystore_maintenance_service_34_0) true)
+(expandtypeattribute (keystore_metrics_service_34_0) true)
+(expandtypeattribute (keystore_service_34_0) true)
+(expandtypeattribute (kmsg_debug_device_34_0) true)
+(expandtypeattribute (kmsg_device_34_0) true)
+(expandtypeattribute (labeledfs_34_0) true)
+(expandtypeattribute (launcherapps_service_34_0) true)
+(expandtypeattribute (legacy_permission_service_34_0) true)
+(expandtypeattribute (legacykeystore_service_34_0) true)
+(expandtypeattribute (libc_debug_prop_34_0) true)
+(expandtypeattribute (light_service_34_0) true)
+(expandtypeattribute (linkerconfig_file_34_0) true)
+(expandtypeattribute (llkd_34_0) true)
+(expandtypeattribute (llkd_exec_34_0) true)
+(expandtypeattribute (llkd_prop_34_0) true)
+(expandtypeattribute (lmkd_34_0) true)
+(expandtypeattribute (lmkd_config_prop_34_0) true)
+(expandtypeattribute (lmkd_exec_34_0) true)
+(expandtypeattribute (lmkd_prop_34_0) true)
+(expandtypeattribute (lmkd_socket_34_0) true)
+(expandtypeattribute (locale_prop_34_0) true)
+(expandtypeattribute (locale_service_34_0) true)
+(expandtypeattribute (location_service_34_0) true)
+(expandtypeattribute (location_time_zone_manager_service_34_0) true)
+(expandtypeattribute (lock_settings_service_34_0) true)
+(expandtypeattribute (log_prop_34_0) true)
+(expandtypeattribute (log_tag_prop_34_0) true)
+(expandtypeattribute (logcat_exec_34_0) true)
+(expandtypeattribute (logd_34_0) true)
+(expandtypeattribute (logd_exec_34_0) true)
+(expandtypeattribute (logd_prop_34_0) true)
+(expandtypeattribute (logd_socket_34_0) true)
+(expandtypeattribute (logdr_socket_34_0) true)
+(expandtypeattribute (logdw_socket_34_0) true)
+(expandtypeattribute (logpersist_34_0) true)
+(expandtypeattribute (logpersistd_logging_prop_34_0) true)
+(expandtypeattribute (loop_control_device_34_0) true)
+(expandtypeattribute (loop_device_34_0) true)
+(expandtypeattribute (looper_stats_service_34_0) true)
+(expandtypeattribute (lowpan_device_34_0) true)
+(expandtypeattribute (lowpan_prop_34_0) true)
+(expandtypeattribute (lpdump_service_34_0) true)
+(expandtypeattribute (lpdumpd_prop_34_0) true)
+(expandtypeattribute (mac_perms_file_34_0) true)
+(expandtypeattribute (mdns_service_34_0) true)
+(expandtypeattribute (mdns_socket_34_0) true)
+(expandtypeattribute (mdnsd_34_0) true)
+(expandtypeattribute (mdnsd_socket_34_0) true)
+(expandtypeattribute (media_communication_service_34_0) true)
+(expandtypeattribute (media_config_prop_34_0) true)
+(expandtypeattribute (media_data_file_34_0) true)
+(expandtypeattribute (media_metrics_service_34_0) true)
+(expandtypeattribute (media_projection_service_34_0) true)
+(expandtypeattribute (media_router_service_34_0) true)
+(expandtypeattribute (media_rw_data_file_34_0) true)
+(expandtypeattribute (media_session_service_34_0) true)
+(expandtypeattribute (media_userdir_file_34_0) true)
+(expandtypeattribute (media_variant_prop_34_0) true)
+(expandtypeattribute (mediadrm_config_prop_34_0) true)
+(expandtypeattribute (mediadrmserver_34_0) true)
+(expandtypeattribute (mediadrmserver_exec_34_0) true)
+(expandtypeattribute (mediadrmserver_service_34_0) true)
+(expandtypeattribute (mediaextractor_34_0) true)
+(expandtypeattribute (mediaextractor_exec_34_0) true)
+(expandtypeattribute (mediaextractor_service_34_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_34_0) true)
+(expandtypeattribute (mediametrics_34_0) true)
+(expandtypeattribute (mediametrics_exec_34_0) true)
+(expandtypeattribute (mediametrics_service_34_0) true)
+(expandtypeattribute (mediaprovider_34_0) true)
+(expandtypeattribute (mediaserver_34_0) true)
+(expandtypeattribute (mediaserver_exec_34_0) true)
+(expandtypeattribute (mediaserver_service_34_0) true)
+(expandtypeattribute (mediaserver_tmpfs_34_0) true)
+(expandtypeattribute (mediaswcodec_34_0) true)
+(expandtypeattribute (mediaswcodec_exec_34_0) true)
+(expandtypeattribute (mediatranscoding_34_0) true)
+(expandtypeattribute (mediatranscoding_service_34_0) true)
+(expandtypeattribute (meminfo_service_34_0) true)
+(expandtypeattribute (memtrackproxy_service_34_0) true)
+(expandtypeattribute (metadata_block_device_34_0) true)
+(expandtypeattribute (metadata_bootstat_file_34_0) true)
+(expandtypeattribute (metadata_file_34_0) true)
+(expandtypeattribute (method_trace_data_file_34_0) true)
+(expandtypeattribute (midi_service_34_0) true)
+(expandtypeattribute (mirror_data_file_34_0) true)
+(expandtypeattribute (misc_block_device_34_0) true)
+(expandtypeattribute (misc_logd_file_34_0) true)
+(expandtypeattribute (misc_user_data_file_34_0) true)
+(expandtypeattribute (mm_events_config_prop_34_0) true)
+(expandtypeattribute (mmc_prop_34_0) true)
+(expandtypeattribute (mnt_expand_file_34_0) true)
+(expandtypeattribute (mnt_media_rw_file_34_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_34_0) true)
+(expandtypeattribute (mnt_pass_through_file_34_0) true)
+(expandtypeattribute (mnt_product_file_34_0) true)
+(expandtypeattribute (mnt_sdcard_file_34_0) true)
+(expandtypeattribute (mnt_user_file_34_0) true)
+(expandtypeattribute (mnt_vendor_file_34_0) true)
+(expandtypeattribute (mock_ota_prop_34_0) true)
+(expandtypeattribute (modprobe_34_0) true)
+(expandtypeattribute (module_sdkextensions_prop_34_0) true)
+(expandtypeattribute (mount_service_34_0) true)
+(expandtypeattribute (mqueue_34_0) true)
+(expandtypeattribute (mtp_34_0) true)
+(expandtypeattribute (mtp_device_34_0) true)
+(expandtypeattribute (mtp_exec_34_0) true)
+(expandtypeattribute (mtpd_socket_34_0) true)
+(expandtypeattribute (music_recognition_service_34_0) true)
+(expandtypeattribute (nativetest_data_file_34_0) true)
+(expandtypeattribute (nearby_service_34_0) true)
+(expandtypeattribute (net_data_file_34_0) true)
+(expandtypeattribute (net_dns_prop_34_0) true)
+(expandtypeattribute (net_radio_prop_34_0) true)
+(expandtypeattribute (netd_34_0) true)
+(expandtypeattribute (netd_exec_34_0) true)
+(expandtypeattribute (netd_listener_service_34_0) true)
+(expandtypeattribute (netd_service_34_0) true)
+(expandtypeattribute (netif_34_0) true)
+(expandtypeattribute (netpolicy_service_34_0) true)
+(expandtypeattribute (netstats_service_34_0) true)
+(expandtypeattribute (netutils_wrapper_34_0) true)
+(expandtypeattribute (netutils_wrapper_exec_34_0) true)
+(expandtypeattribute (network_management_service_34_0) true)
+(expandtypeattribute (network_score_service_34_0) true)
+(expandtypeattribute (network_stack_34_0) true)
+(expandtypeattribute (network_stack_service_34_0) true)
+(expandtypeattribute (network_time_update_service_34_0) true)
+(expandtypeattribute (network_watchlist_data_file_34_0) true)
+(expandtypeattribute (network_watchlist_service_34_0) true)
+(expandtypeattribute (nfc_34_0) true)
+(expandtypeattribute (nfc_data_file_34_0) true)
+(expandtypeattribute (nfc_device_34_0) true)
+(expandtypeattribute (nfc_logs_data_file_34_0) true)
+(expandtypeattribute (nfc_prop_34_0) true)
+(expandtypeattribute (nfc_service_34_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_34_0) true)
+(expandtypeattribute (node_34_0) true)
+(expandtypeattribute (notification_service_34_0) true)
+(expandtypeattribute (null_device_34_0) true)
+(expandtypeattribute (oem_lock_service_34_0) true)
+(expandtypeattribute (oem_unlock_prop_34_0) true)
+(expandtypeattribute (oemfs_34_0) true)
+(expandtypeattribute (ondevicepersonalization_system_service_34_0) true)
+(expandtypeattribute (ota_data_file_34_0) true)
+(expandtypeattribute (ota_metadata_file_34_0) true)
+(expandtypeattribute (ota_package_file_34_0) true)
+(expandtypeattribute (ota_prop_34_0) true)
+(expandtypeattribute (otadexopt_service_34_0) true)
+(expandtypeattribute (otapreopt_chroot_34_0) true)
+(expandtypeattribute (overlay_prop_34_0) true)
+(expandtypeattribute (overlay_service_34_0) true)
+(expandtypeattribute (overlayfs_file_34_0) true)
+(expandtypeattribute (owntty_device_34_0) true)
+(expandtypeattribute (pac_proxy_service_34_0) true)
+(expandtypeattribute (package_native_service_34_0) true)
+(expandtypeattribute (package_service_34_0) true)
+(expandtypeattribute (packagemanager_config_prop_34_0) true)
+(expandtypeattribute (packages_list_file_34_0) true)
+(expandtypeattribute (pan_result_prop_34_0) true)
+(expandtypeattribute (password_slot_metadata_file_34_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_34_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_34_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_34_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_display_dir_34_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_34_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_34_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_34_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_34_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_34_0) true)
+(expandtypeattribute (pdx_performance_dir_34_0) true)
+(expandtypeattribute (people_service_34_0) true)
+(expandtypeattribute (perfetto_34_0) true)
+(expandtypeattribute (performanced_34_0) true)
+(expandtypeattribute (performanced_exec_34_0) true)
+(expandtypeattribute (permission_checker_service_34_0) true)
+(expandtypeattribute (permission_service_34_0) true)
+(expandtypeattribute (permissionmgr_service_34_0) true)
+(expandtypeattribute (permissive_mte_prop_34_0) true)
+(expandtypeattribute (persist_debug_prop_34_0) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_34_0) true)
+(expandtypeattribute (persist_wm_debug_prop_34_0) true)
+(expandtypeattribute (persistent_data_block_service_34_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_34_0) true)
+(expandtypeattribute (pinner_service_34_0) true)
+(expandtypeattribute (pipefs_34_0) true)
+(expandtypeattribute (platform_app_34_0) true)
+(expandtypeattribute (platform_compat_service_34_0) true)
+(expandtypeattribute (pmsg_device_34_0) true)
+(expandtypeattribute (port_34_0) true)
+(expandtypeattribute (port_device_34_0) true)
+(expandtypeattribute (postinstall_34_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_34_0) true)
+(expandtypeattribute (postinstall_file_34_0) true)
+(expandtypeattribute (postinstall_mnt_dir_34_0) true)
+(expandtypeattribute (power_debug_prop_34_0) true)
+(expandtypeattribute (power_service_34_0) true)
+(expandtypeattribute (powerctl_prop_34_0) true)
+(expandtypeattribute (powerstats_service_34_0) true)
+(expandtypeattribute (ppp_34_0) true)
+(expandtypeattribute (ppp_device_34_0) true)
+(expandtypeattribute (ppp_exec_34_0) true)
+(expandtypeattribute (preloads_data_file_34_0) true)
+(expandtypeattribute (preloads_media_file_34_0) true)
+(expandtypeattribute (prereboot_data_file_34_0) true)
+(expandtypeattribute (print_service_34_0) true)
+(expandtypeattribute (priv_app_34_0) true)
+(expandtypeattribute (privapp_data_file_34_0) true)
+(expandtypeattribute (prng_seeder_34_0) true)
+(expandtypeattribute (proc_34_0) true)
+(expandtypeattribute (proc_abi_34_0) true)
+(expandtypeattribute (proc_asound_34_0) true)
+(expandtypeattribute (proc_bluetooth_writable_34_0) true)
+(expandtypeattribute (proc_bootconfig_34_0) true)
+(expandtypeattribute (proc_bpf_34_0) true)
+(expandtypeattribute (proc_buddyinfo_34_0) true)
+(expandtypeattribute (proc_cmdline_34_0) true)
+(expandtypeattribute (proc_cpu_alignment_34_0) true)
+(expandtypeattribute (proc_cpuinfo_34_0) true)
+(expandtypeattribute (proc_dirty_34_0) true)
+(expandtypeattribute (proc_diskstats_34_0) true)
+(expandtypeattribute (proc_drop_caches_34_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_34_0) true)
+(expandtypeattribute (proc_filesystems_34_0) true)
+(expandtypeattribute (proc_fs_verity_34_0) true)
+(expandtypeattribute (proc_hostname_34_0) true)
+(expandtypeattribute (proc_hung_task_34_0) true)
+(expandtypeattribute (proc_interrupts_34_0) true)
+(expandtypeattribute (proc_iomem_34_0) true)
+(expandtypeattribute (proc_kallsyms_34_0) true)
+(expandtypeattribute (proc_keys_34_0) true)
+(expandtypeattribute (proc_kmsg_34_0) true)
+(expandtypeattribute (proc_kpageflags_34_0) true)
+(expandtypeattribute (proc_loadavg_34_0) true)
+(expandtypeattribute (proc_locks_34_0) true)
+(expandtypeattribute (proc_lowmemorykiller_34_0) true)
+(expandtypeattribute (proc_max_map_count_34_0) true)
+(expandtypeattribute (proc_meminfo_34_0) true)
+(expandtypeattribute (proc_min_free_order_shift_34_0) true)
+(expandtypeattribute (proc_misc_34_0) true)
+(expandtypeattribute (proc_modules_34_0) true)
+(expandtypeattribute (proc_mounts_34_0) true)
+(expandtypeattribute (proc_net_34_0) true)
+(expandtypeattribute (proc_net_tcp_udp_34_0) true)
+(expandtypeattribute (proc_overcommit_memory_34_0) true)
+(expandtypeattribute (proc_page_cluster_34_0) true)
+(expandtypeattribute (proc_pagetypeinfo_34_0) true)
+(expandtypeattribute (proc_panic_34_0) true)
+(expandtypeattribute (proc_perf_34_0) true)
+(expandtypeattribute (proc_pid_max_34_0) true)
+(expandtypeattribute (proc_pipe_conf_34_0) true)
+(expandtypeattribute (proc_pressure_cpu_34_0) true)
+(expandtypeattribute (proc_pressure_io_34_0) true)
+(expandtypeattribute (proc_pressure_mem_34_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_34_0) true)
+(expandtypeattribute (proc_qtaguid_stat_34_0) true)
+(expandtypeattribute (proc_random_34_0) true)
+(expandtypeattribute (proc_sched_34_0) true)
+(expandtypeattribute (proc_security_34_0) true)
+(expandtypeattribute (proc_slabinfo_34_0) true)
+(expandtypeattribute (proc_stat_34_0) true)
+(expandtypeattribute (proc_swaps_34_0) true)
+(expandtypeattribute (proc_sysrq_34_0) true)
+(expandtypeattribute (proc_timer_34_0) true)
+(expandtypeattribute (proc_tty_drivers_34_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_34_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_34_0) true)
+(expandtypeattribute (proc_uid_cpupower_34_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_34_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_34_0) true)
+(expandtypeattribute (proc_uid_io_stats_34_0) true)
+(expandtypeattribute (proc_uid_procstat_set_34_0) true)
+(expandtypeattribute (proc_uid_time_in_state_34_0) true)
+(expandtypeattribute (proc_uptime_34_0) true)
+(expandtypeattribute (proc_vendor_sched_34_0) true)
+(expandtypeattribute (proc_version_34_0) true)
+(expandtypeattribute (proc_vmallocinfo_34_0) true)
+(expandtypeattribute (proc_vmstat_34_0) true)
+(expandtypeattribute (proc_watermark_boost_factor_34_0) true)
+(expandtypeattribute (proc_watermark_scale_factor_34_0) true)
+(expandtypeattribute (proc_zoneinfo_34_0) true)
+(expandtypeattribute (processinfo_service_34_0) true)
+(expandtypeattribute (procstats_service_34_0) true)
+(expandtypeattribute (profman_34_0) true)
+(expandtypeattribute (profman_dump_data_file_34_0) true)
+(expandtypeattribute (profman_exec_34_0) true)
+(expandtypeattribute (properties_device_34_0) true)
+(expandtypeattribute (properties_serial_34_0) true)
+(expandtypeattribute (property_contexts_file_34_0) true)
+(expandtypeattribute (property_data_file_34_0) true)
+(expandtypeattribute (property_info_34_0) true)
+(expandtypeattribute (property_service_version_prop_34_0) true)
+(expandtypeattribute (property_socket_34_0) true)
+(expandtypeattribute (provisioned_prop_34_0) true)
+(expandtypeattribute (pstorefs_34_0) true)
+(expandtypeattribute (ptmx_device_34_0) true)
+(expandtypeattribute (qemu_hw_prop_34_0) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_34_0) true)
+(expandtypeattribute (qtaguid_device_34_0) true)
+(expandtypeattribute (quick_start_prop_34_0) true)
+(expandtypeattribute (racoon_34_0) true)
+(expandtypeattribute (racoon_exec_34_0) true)
+(expandtypeattribute (racoon_socket_34_0) true)
+(expandtypeattribute (radio_34_0) true)
+(expandtypeattribute (radio_control_prop_34_0) true)
+(expandtypeattribute (radio_core_data_file_34_0) true)
+(expandtypeattribute (radio_data_file_34_0) true)
+(expandtypeattribute (radio_device_34_0) true)
+(expandtypeattribute (radio_prop_34_0) true)
+(expandtypeattribute (radio_service_34_0) true)
+(expandtypeattribute (ram_device_34_0) true)
+(expandtypeattribute (random_device_34_0) true)
+(expandtypeattribute (reboot_readiness_service_34_0) true)
+(expandtypeattribute (rebootescrow_hal_prop_34_0) true)
+(expandtypeattribute (recovery_34_0) true)
+(expandtypeattribute (recovery_block_device_34_0) true)
+(expandtypeattribute (recovery_config_prop_34_0) true)
+(expandtypeattribute (recovery_data_file_34_0) true)
+(expandtypeattribute (recovery_persist_34_0) true)
+(expandtypeattribute (recovery_persist_exec_34_0) true)
+(expandtypeattribute (recovery_refresh_34_0) true)
+(expandtypeattribute (recovery_refresh_exec_34_0) true)
+(expandtypeattribute (recovery_service_34_0) true)
+(expandtypeattribute (recovery_socket_34_0) true)
+(expandtypeattribute (recovery_usb_config_prop_34_0) true)
+(expandtypeattribute (registry_service_34_0) true)
+(expandtypeattribute (remote_provisioning_service_34_0) true)
+(expandtypeattribute (resourcecache_data_file_34_0) true)
+(expandtypeattribute (resources_manager_service_34_0) true)
+(expandtypeattribute (restorecon_prop_34_0) true)
+(expandtypeattribute (restrictions_service_34_0) true)
+(expandtypeattribute (retaildemo_prop_34_0) true)
+(expandtypeattribute (rild_debug_socket_34_0) true)
+(expandtypeattribute (rild_socket_34_0) true)
+(expandtypeattribute (ringtone_file_34_0) true)
+(expandtypeattribute (rkpdapp_34_0) true)
+(expandtypeattribute (role_service_34_0) true)
+(expandtypeattribute (rollback_service_34_0) true)
+(expandtypeattribute (root_block_device_34_0) true)
+(expandtypeattribute (rootdisk_sysdev_34_0) true)
+(expandtypeattribute (rootfs_34_0) true)
+(expandtypeattribute (rpmsg_device_34_0) true)
+(expandtypeattribute (rs_34_0) true)
+(expandtypeattribute (rs_exec_34_0) true)
+(expandtypeattribute (rss_hwm_reset_34_0) true)
+(expandtypeattribute (rtc_device_34_0) true)
+(expandtypeattribute (rttmanager_service_34_0) true)
+(expandtypeattribute (runas_34_0) true)
+(expandtypeattribute (runas_app_34_0) true)
+(expandtypeattribute (runas_exec_34_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_34_0) true)
+(expandtypeattribute (runtime_service_34_0) true)
+(expandtypeattribute (safemode_prop_34_0) true)
+(expandtypeattribute (same_process_hal_file_34_0) true)
+(expandtypeattribute (samplingprofiler_service_34_0) true)
+(expandtypeattribute (scheduling_policy_service_34_0) true)
+(expandtypeattribute (sdcard_block_device_34_0) true)
+(expandtypeattribute (sdcardd_34_0) true)
+(expandtypeattribute (sdcardd_exec_34_0) true)
+(expandtypeattribute (sdcardfs_34_0) true)
+(expandtypeattribute (sdk_sandbox_service_34_0) true)
+(expandtypeattribute (seapp_contexts_file_34_0) true)
+(expandtypeattribute (search_service_34_0) true)
+(expandtypeattribute (search_ui_service_34_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_34_0) true)
+(expandtypeattribute (secure_element_34_0) true)
+(expandtypeattribute (secure_element_device_34_0) true)
+(expandtypeattribute (secure_element_service_34_0) true)
+(expandtypeattribute (securityfs_34_0) true)
+(expandtypeattribute (selection_toolbar_service_34_0) true)
+(expandtypeattribute (selinuxfs_34_0) true)
+(expandtypeattribute (sendbug_config_prop_34_0) true)
+(expandtypeattribute (sensor_privacy_service_34_0) true)
+(expandtypeattribute (sensors_device_34_0) true)
+(expandtypeattribute (sensorservice_service_34_0) true)
+(expandtypeattribute (sepolicy_file_34_0) true)
+(expandtypeattribute (serial_device_34_0) true)
+(expandtypeattribute (serial_service_34_0) true)
+(expandtypeattribute (serialno_prop_34_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_34_0) true)
+(expandtypeattribute (service_contexts_file_34_0) true)
+(expandtypeattribute (service_manager_service_34_0) true)
+(expandtypeattribute (service_manager_vndservice_34_0) true)
+(expandtypeattribute (servicediscovery_service_34_0) true)
+(expandtypeattribute (servicemanager_34_0) true)
+(expandtypeattribute (servicemanager_exec_34_0) true)
+(expandtypeattribute (servicemanager_prop_34_0) true)
+(expandtypeattribute (settings_service_34_0) true)
+(expandtypeattribute (sgdisk_34_0) true)
+(expandtypeattribute (sgdisk_exec_34_0) true)
+(expandtypeattribute (shared_relro_34_0) true)
+(expandtypeattribute (shared_relro_file_34_0) true)
+(expandtypeattribute (shell_34_0) true)
+(expandtypeattribute (shell_data_file_34_0) true)
+(expandtypeattribute (shell_exec_34_0) true)
+(expandtypeattribute (shell_prop_34_0) true)
+(expandtypeattribute (shell_test_data_file_34_0) true)
+(expandtypeattribute (shm_34_0) true)
+(expandtypeattribute (shortcut_manager_icons_34_0) true)
+(expandtypeattribute (shortcut_service_34_0) true)
+(expandtypeattribute (shutdown_checkpoints_system_data_file_34_0) true)
+(expandtypeattribute (simpleperf_34_0) true)
+(expandtypeattribute (simpleperf_app_runner_34_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_34_0) true)
+(expandtypeattribute (slice_service_34_0) true)
+(expandtypeattribute (slideshow_34_0) true)
+(expandtypeattribute (smart_idle_maint_enabled_prop_34_0) true)
+(expandtypeattribute (smartspace_service_34_0) true)
+(expandtypeattribute (snapshotctl_log_data_file_34_0) true)
+(expandtypeattribute (snapuserd_proxy_socket_34_0) true)
+(expandtypeattribute (snapuserd_socket_34_0) true)
+(expandtypeattribute (soc_prop_34_0) true)
+(expandtypeattribute (socket_device_34_0) true)
+(expandtypeattribute (socket_hook_prop_34_0) true)
+(expandtypeattribute (sockfs_34_0) true)
+(expandtypeattribute (sota_prop_34_0) true)
+(expandtypeattribute (soundtrigger_middleware_service_34_0) true)
+(expandtypeattribute (speech_recognition_service_34_0) true)
+(expandtypeattribute (sqlite_log_prop_34_0) true)
+(expandtypeattribute (staged_install_file_34_0) true)
+(expandtypeattribute (staging_data_file_34_0) true)
+(expandtypeattribute (stats_config_data_file_34_0) true)
+(expandtypeattribute (stats_data_file_34_0) true)
+(expandtypeattribute (statsd_34_0) true)
+(expandtypeattribute (statsd_exec_34_0) true)
+(expandtypeattribute (statsdw_socket_34_0) true)
+(expandtypeattribute (statusbar_service_34_0) true)
+(expandtypeattribute (storage_config_prop_34_0) true)
+(expandtypeattribute (storage_file_34_0) true)
+(expandtypeattribute (storage_stub_file_34_0) true)
+(expandtypeattribute (storaged_service_34_0) true)
+(expandtypeattribute (storagemanager_config_prop_34_0) true)
+(expandtypeattribute (storagestats_service_34_0) true)
+(expandtypeattribute (su_34_0) true)
+(expandtypeattribute (su_exec_34_0) true)
+(expandtypeattribute (super_block_device_34_0) true)
+(expandtypeattribute (surfaceflinger_34_0) true)
+(expandtypeattribute (surfaceflinger_color_prop_34_0) true)
+(expandtypeattribute (surfaceflinger_display_prop_34_0) true)
+(expandtypeattribute (surfaceflinger_prop_34_0) true)
+(expandtypeattribute (surfaceflinger_service_34_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_34_0) true)
+(expandtypeattribute (suspend_prop_34_0) true)
+(expandtypeattribute (swap_block_device_34_0) true)
+(expandtypeattribute (sysfs_34_0) true)
+(expandtypeattribute (sysfs_android_usb_34_0) true)
+(expandtypeattribute (sysfs_batteryinfo_34_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_34_0) true)
+(expandtypeattribute (sysfs_devfreq_cur_34_0) true)
+(expandtypeattribute (sysfs_devfreq_dir_34_0) true)
+(expandtypeattribute (sysfs_devices_block_34_0) true)
+(expandtypeattribute (sysfs_devices_cs_etm_34_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_34_0) true)
+(expandtypeattribute (sysfs_dm_34_0) true)
+(expandtypeattribute (sysfs_dm_verity_34_0) true)
+(expandtypeattribute (sysfs_dma_heap_34_0) true)
+(expandtypeattribute (sysfs_dmabuf_stats_34_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_34_0) true)
+(expandtypeattribute (sysfs_extcon_34_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_34_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_34_0) true)
+(expandtypeattribute (sysfs_fs_fuse_bpf_34_0) true)
+(expandtypeattribute (sysfs_fs_fuse_features_34_0) true)
+(expandtypeattribute (sysfs_fs_incfs_features_34_0) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_34_0) true)
+(expandtypeattribute (sysfs_gpu_34_0) true)
+(expandtypeattribute (sysfs_hwrandom_34_0) true)
+(expandtypeattribute (sysfs_ion_34_0) true)
+(expandtypeattribute (sysfs_ipv4_34_0) true)
+(expandtypeattribute (sysfs_kernel_notes_34_0) true)
+(expandtypeattribute (sysfs_leds_34_0) true)
+(expandtypeattribute (sysfs_loop_34_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_34_0) true)
+(expandtypeattribute (sysfs_lru_gen_enabled_34_0) true)
+(expandtypeattribute (sysfs_net_34_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_34_0) true)
+(expandtypeattribute (sysfs_power_34_0) true)
+(expandtypeattribute (sysfs_rtc_34_0) true)
+(expandtypeattribute (sysfs_suspend_stats_34_0) true)
+(expandtypeattribute (sysfs_switch_34_0) true)
+(expandtypeattribute (sysfs_thermal_34_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_34_0) true)
+(expandtypeattribute (sysfs_uhid_34_0) true)
+(expandtypeattribute (sysfs_uio_34_0) true)
+(expandtypeattribute (sysfs_usb_34_0) true)
+(expandtypeattribute (sysfs_usermodehelper_34_0) true)
+(expandtypeattribute (sysfs_vendor_sched_34_0) true)
+(expandtypeattribute (sysfs_vibrator_34_0) true)
+(expandtypeattribute (sysfs_wake_lock_34_0) true)
+(expandtypeattribute (sysfs_wakeup_34_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_34_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_34_0) true)
+(expandtypeattribute (sysfs_zram_34_0) true)
+(expandtypeattribute (sysfs_zram_uevent_34_0) true)
+(expandtypeattribute (system_app_34_0) true)
+(expandtypeattribute (system_app_data_file_34_0) true)
+(expandtypeattribute (system_app_service_34_0) true)
+(expandtypeattribute (system_asan_options_file_34_0) true)
+(expandtypeattribute (system_block_device_34_0) true)
+(expandtypeattribute (system_boot_reason_prop_34_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_34_0) true)
+(expandtypeattribute (system_config_service_34_0) true)
+(expandtypeattribute (system_data_file_34_0) true)
+(expandtypeattribute (system_data_root_file_34_0) true)
+(expandtypeattribute (system_dlkm_file_34_0) true)
+(expandtypeattribute (system_event_log_tags_file_34_0) true)
+(expandtypeattribute (system_file_34_0) true)
+(expandtypeattribute (system_group_file_34_0) true)
+(expandtypeattribute (system_jvmti_agent_prop_34_0) true)
+(expandtypeattribute (system_lib_file_34_0) true)
+(expandtypeattribute (system_linker_config_file_34_0) true)
+(expandtypeattribute (system_linker_exec_34_0) true)
+(expandtypeattribute (system_lmk_prop_34_0) true)
+(expandtypeattribute (system_ndebug_socket_34_0) true)
+(expandtypeattribute (system_net_netd_hwservice_34_0) true)
+(expandtypeattribute (system_net_netd_service_34_0) true)
+(expandtypeattribute (system_passwd_file_34_0) true)
+(expandtypeattribute (system_prop_34_0) true)
+(expandtypeattribute (system_seccomp_policy_file_34_0) true)
+(expandtypeattribute (system_security_cacerts_file_34_0) true)
+(expandtypeattribute (system_server_34_0) true)
+(expandtypeattribute (system_server_dumper_service_34_0) true)
+(expandtypeattribute (system_server_tmpfs_34_0) true)
+(expandtypeattribute (system_suspend_control_internal_service_34_0) true)
+(expandtypeattribute (system_suspend_control_service_34_0) true)
+(expandtypeattribute (system_suspend_hwservice_34_0) true)
+(expandtypeattribute (system_trace_prop_34_0) true)
+(expandtypeattribute (system_unsolzygote_socket_34_0) true)
+(expandtypeattribute (system_update_service_34_0) true)
+(expandtypeattribute (system_user_mode_emulation_prop_34_0) true)
+(expandtypeattribute (system_userdir_file_34_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_34_0) true)
+(expandtypeattribute (system_wpa_socket_34_0) true)
+(expandtypeattribute (system_zoneinfo_file_34_0) true)
+(expandtypeattribute (systemkeys_data_file_34_0) true)
+(expandtypeattribute (systemsound_config_prop_34_0) true)
+(expandtypeattribute (tare_service_34_0) true)
+(expandtypeattribute (task_profiles_api_file_34_0) true)
+(expandtypeattribute (task_profiles_file_34_0) true)
+(expandtypeattribute (task_service_34_0) true)
+(expandtypeattribute (tcpdump_exec_34_0) true)
+(expandtypeattribute (tee_34_0) true)
+(expandtypeattribute (tee_data_file_34_0) true)
+(expandtypeattribute (tee_device_34_0) true)
+(expandtypeattribute (telecom_service_34_0) true)
+(expandtypeattribute (telephony_config_prop_34_0) true)
+(expandtypeattribute (telephony_status_prop_34_0) true)
+(expandtypeattribute (test_boot_reason_prop_34_0) true)
+(expandtypeattribute (test_harness_prop_34_0) true)
+(expandtypeattribute (testharness_service_34_0) true)
+(expandtypeattribute (tethering_service_34_0) true)
+(expandtypeattribute (textclassification_service_34_0) true)
+(expandtypeattribute (textclassifier_data_file_34_0) true)
+(expandtypeattribute (textservices_service_34_0) true)
+(expandtypeattribute (texttospeech_service_34_0) true)
+(expandtypeattribute (theme_prop_34_0) true)
+(expandtypeattribute (thermal_service_34_0) true)
+(expandtypeattribute (time_prop_34_0) true)
+(expandtypeattribute (timedetector_service_34_0) true)
+(expandtypeattribute (timezone_prop_34_0) true)
+(expandtypeattribute (timezonedetector_service_34_0) true)
+(expandtypeattribute (tmpfs_34_0) true)
+(expandtypeattribute (tombstone_config_prop_34_0) true)
+(expandtypeattribute (tombstone_data_file_34_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_34_0) true)
+(expandtypeattribute (tombstoned_34_0) true)
+(expandtypeattribute (tombstoned_crash_socket_34_0) true)
+(expandtypeattribute (tombstoned_exec_34_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_34_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_34_0) true)
+(expandtypeattribute (toolbox_34_0) true)
+(expandtypeattribute (toolbox_exec_34_0) true)
+(expandtypeattribute (trace_data_file_34_0) true)
+(expandtypeattribute (traced_34_0) true)
+(expandtypeattribute (traced_consumer_socket_34_0) true)
+(expandtypeattribute (traced_enabled_prop_34_0) true)
+(expandtypeattribute (traced_lazy_prop_34_0) true)
+(expandtypeattribute (traced_oome_heap_session_count_prop_34_0) true)
+(expandtypeattribute (traced_perf_34_0) true)
+(expandtypeattribute (traced_perf_socket_34_0) true)
+(expandtypeattribute (traced_probes_34_0) true)
+(expandtypeattribute (traced_producer_socket_34_0) true)
+(expandtypeattribute (traced_tmpfs_34_0) true)
+(expandtypeattribute (traceur_app_34_0) true)
+(expandtypeattribute (translation_service_34_0) true)
+(expandtypeattribute (trust_service_34_0) true)
+(expandtypeattribute (tty_device_34_0) true)
+(expandtypeattribute (tun_device_34_0) true)
+(expandtypeattribute (tuner_config_prop_34_0) true)
+(expandtypeattribute (tv_iapp_service_34_0) true)
+(expandtypeattribute (tv_input_service_34_0) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_34_0) true)
+(expandtypeattribute (ublk_block_device_34_0) true)
+(expandtypeattribute (ublk_control_device_34_0) true)
+(expandtypeattribute (ueventd_34_0) true)
+(expandtypeattribute (ueventd_tmpfs_34_0) true)
+(expandtypeattribute (uhid_device_34_0) true)
+(expandtypeattribute (uimode_service_34_0) true)
+(expandtypeattribute (uio_device_34_0) true)
+(expandtypeattribute (uncrypt_34_0) true)
+(expandtypeattribute (uncrypt_exec_34_0) true)
+(expandtypeattribute (uncrypt_socket_34_0) true)
+(expandtypeattribute (unencrypted_data_file_34_0) true)
+(expandtypeattribute (unlabeled_34_0) true)
+(expandtypeattribute (untrusted_app_25_34_0) true)
+(expandtypeattribute (untrusted_app_27_34_0) true)
+(expandtypeattribute (untrusted_app_29_34_0) true)
+(expandtypeattribute (untrusted_app_30_34_0) true)
+(expandtypeattribute (untrusted_app_32_34_0) true)
+(expandtypeattribute (untrusted_app_34_0) true)
+(expandtypeattribute (update_engine_34_0) true)
+(expandtypeattribute (update_engine_data_file_34_0) true)
+(expandtypeattribute (update_engine_exec_34_0) true)
+(expandtypeattribute (update_engine_log_data_file_34_0) true)
+(expandtypeattribute (update_engine_service_34_0) true)
+(expandtypeattribute (update_engine_stable_service_34_0) true)
+(expandtypeattribute (update_verifier_34_0) true)
+(expandtypeattribute (update_verifier_exec_34_0) true)
+(expandtypeattribute (updatelock_service_34_0) true)
+(expandtypeattribute (uri_grants_service_34_0) true)
+(expandtypeattribute (usagestats_service_34_0) true)
+(expandtypeattribute (usb_config_prop_34_0) true)
+(expandtypeattribute (usb_control_prop_34_0) true)
+(expandtypeattribute (usb_device_34_0) true)
+(expandtypeattribute (usb_prop_34_0) true)
+(expandtypeattribute (usb_serial_device_34_0) true)
+(expandtypeattribute (usb_service_34_0) true)
+(expandtypeattribute (usb_uvc_enabled_prop_34_0) true)
+(expandtypeattribute (usbaccessory_device_34_0) true)
+(expandtypeattribute (usbd_34_0) true)
+(expandtypeattribute (usbd_exec_34_0) true)
+(expandtypeattribute (usbfs_34_0) true)
+(expandtypeattribute (use_memfd_prop_34_0) true)
+(expandtypeattribute (user_profile_data_file_34_0) true)
+(expandtypeattribute (user_profile_root_file_34_0) true)
+(expandtypeattribute (user_service_34_0) true)
+(expandtypeattribute (userdata_block_device_34_0) true)
+(expandtypeattribute (userdata_sysdev_34_0) true)
+(expandtypeattribute (userdebug_or_eng_prop_34_0) true)
+(expandtypeattribute (usermodehelper_34_0) true)
+(expandtypeattribute (userspace_reboot_config_prop_34_0) true)
+(expandtypeattribute (userspace_reboot_exported_prop_34_0) true)
+(expandtypeattribute (userspace_reboot_metadata_file_34_0) true)
+(expandtypeattribute (uwb_service_34_0) true)
+(expandtypeattribute (vcn_management_service_34_0) true)
+(expandtypeattribute (vd_device_34_0) true)
+(expandtypeattribute (vdc_34_0) true)
+(expandtypeattribute (vdc_exec_34_0) true)
+(expandtypeattribute (vehicle_hal_prop_34_0) true)
+(expandtypeattribute (vendor_apex_file_34_0) true)
+(expandtypeattribute (vendor_app_file_34_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_34_0) true)
+(expandtypeattribute (vendor_configs_file_34_0) true)
+(expandtypeattribute (vendor_data_file_34_0) true)
+(expandtypeattribute (vendor_default_prop_34_0) true)
+(expandtypeattribute (vendor_file_34_0) true)
+(expandtypeattribute (vendor_framework_file_34_0) true)
+(expandtypeattribute (vendor_hal_file_34_0) true)
+(expandtypeattribute (vendor_idc_file_34_0) true)
+(expandtypeattribute (vendor_init_34_0) true)
+(expandtypeattribute (vendor_kernel_modules_34_0) true)
+(expandtypeattribute (vendor_keychars_file_34_0) true)
+(expandtypeattribute (vendor_keylayout_file_34_0) true)
+(expandtypeattribute (vendor_misc_writer_34_0) true)
+(expandtypeattribute (vendor_misc_writer_exec_34_0) true)
+(expandtypeattribute (vendor_modprobe_34_0) true)
+(expandtypeattribute (vendor_overlay_file_34_0) true)
+(expandtypeattribute (vendor_public_framework_file_34_0) true)
+(expandtypeattribute (vendor_public_lib_file_34_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_34_0) true)
+(expandtypeattribute (vendor_service_contexts_file_34_0) true)
+(expandtypeattribute (vendor_shell_34_0) true)
+(expandtypeattribute (vendor_shell_exec_34_0) true)
+(expandtypeattribute (vendor_socket_hook_prop_34_0) true)
+(expandtypeattribute (vendor_task_profiles_file_34_0) true)
+(expandtypeattribute (vendor_toolbox_exec_34_0) true)
+(expandtypeattribute (vendor_userdir_file_34_0) true)
+(expandtypeattribute (vendor_uuid_mapping_config_file_34_0) true)
+(expandtypeattribute (vendor_vm_data_file_34_0) true)
+(expandtypeattribute (vendor_vm_file_34_0) true)
+(expandtypeattribute (vfat_34_0) true)
+(expandtypeattribute (vibrator_manager_service_34_0) true)
+(expandtypeattribute (vibrator_service_34_0) true)
+(expandtypeattribute (video_device_34_0) true)
+(expandtypeattribute (virtual_ab_prop_34_0) true)
+(expandtypeattribute (virtual_device_service_34_0) true)
+(expandtypeattribute (virtual_face_hal_prop_34_0) true)
+(expandtypeattribute (virtual_fingerprint_hal_prop_34_0) true)
+(expandtypeattribute (virtual_touchpad_34_0) true)
+(expandtypeattribute (virtual_touchpad_exec_34_0) true)
+(expandtypeattribute (virtual_touchpad_service_34_0) true)
+(expandtypeattribute (virtualization_service_34_0) true)
+(expandtypeattribute (vndbinder_device_34_0) true)
+(expandtypeattribute (vndk_prop_34_0) true)
+(expandtypeattribute (vndk_sp_file_34_0) true)
+(expandtypeattribute (vndservice_contexts_file_34_0) true)
+(expandtypeattribute (vndservicemanager_34_0) true)
+(expandtypeattribute (voiceinteraction_service_34_0) true)
+(expandtypeattribute (vold_34_0) true)
+(expandtypeattribute (vold_config_prop_34_0) true)
+(expandtypeattribute (vold_data_file_34_0) true)
+(expandtypeattribute (vold_device_34_0) true)
+(expandtypeattribute (vold_exec_34_0) true)
+(expandtypeattribute (vold_metadata_file_34_0) true)
+(expandtypeattribute (vold_post_fs_data_prop_34_0) true)
+(expandtypeattribute (vold_prepare_subdirs_34_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_34_0) true)
+(expandtypeattribute (vold_prop_34_0) true)
+(expandtypeattribute (vold_service_34_0) true)
+(expandtypeattribute (vold_status_prop_34_0) true)
+(expandtypeattribute (vpn_data_file_34_0) true)
+(expandtypeattribute (vpn_management_service_34_0) true)
+(expandtypeattribute (vr_hwc_service_34_0) true)
+(expandtypeattribute (vr_manager_service_34_0) true)
+(expandtypeattribute (vrflinger_vsync_service_34_0) true)
+(expandtypeattribute (vts_config_prop_34_0) true)
+(expandtypeattribute (vts_status_prop_34_0) true)
+(expandtypeattribute (wallpaper_effects_generation_service_34_0) true)
+(expandtypeattribute (wallpaper_file_34_0) true)
+(expandtypeattribute (wallpaper_service_34_0) true)
+(expandtypeattribute (watchdog_device_34_0) true)
+(expandtypeattribute (watchdog_metadata_file_34_0) true)
+(expandtypeattribute (watchdogd_34_0) true)
+(expandtypeattribute (watchdogd_exec_34_0) true)
+(expandtypeattribute (webview_zygote_34_0) true)
+(expandtypeattribute (webview_zygote_exec_34_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_34_0) true)
+(expandtypeattribute (webviewupdate_service_34_0) true)
+(expandtypeattribute (wifi_config_prop_34_0) true)
+(expandtypeattribute (wifi_data_file_34_0) true)
+(expandtypeattribute (wifi_hal_prop_34_0) true)
+(expandtypeattribute (wifi_key_34_0) true)
+(expandtypeattribute (wifi_log_prop_34_0) true)
+(expandtypeattribute (wifi_prop_34_0) true)
+(expandtypeattribute (wifi_service_34_0) true)
+(expandtypeattribute (wifiaware_service_34_0) true)
+(expandtypeattribute (wificond_34_0) true)
+(expandtypeattribute (wificond_exec_34_0) true)
+(expandtypeattribute (wifinl80211_service_34_0) true)
+(expandtypeattribute (wifip2p_service_34_0) true)
+(expandtypeattribute (wifiscanner_service_34_0) true)
+(expandtypeattribute (window_service_34_0) true)
+(expandtypeattribute (wpa_socket_34_0) true)
+(expandtypeattribute (zero_device_34_0) true)
+(expandtypeattribute (zoned_block_device_34_0) true)
+(expandtypeattribute (zram_config_prop_34_0) true)
+(expandtypeattribute (zram_control_prop_34_0) true)
+(expandtypeattribute (zygote_34_0) true)
+(expandtypeattribute (zygote_config_prop_34_0) true)
+(expandtypeattribute (zygote_exec_34_0) true)
+(expandtypeattribute (zygote_socket_34_0) true)
+(expandtypeattribute (zygote_tmpfs_34_0) true)
+(typeattributeset DockObserver_service_34_0 (DockObserver_service))
+(typeattributeset IProxyService_service_34_0 (IProxyService_service))
+(typeattributeset aac_drc_prop_34_0 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_34_0 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_34_0 (ab_update_gki_prop))
+(typeattributeset accessibility_service_34_0 (accessibility_service))
+(typeattributeset account_service_34_0 (account_service))
+(typeattributeset activity_service_34_0 (activity_service))
+(typeattributeset activity_task_service_34_0 (activity_task_service))
+(typeattributeset adaptive_haptics_prop_34_0 (adaptive_haptics_prop))
+(typeattributeset adb_data_file_34_0 (adb_data_file))
+(typeattributeset adb_keys_file_34_0 (adb_keys_file))
+(typeattributeset adb_service_34_0 (adb_service))
+(typeattributeset adbd_34_0 (adbd))
+(typeattributeset adbd_config_prop_34_0 (adbd_config_prop))
+(typeattributeset adbd_exec_34_0 (adbd_exec))
+(typeattributeset adbd_socket_34_0 (adbd_socket))
+(typeattributeset adservices_manager_service_34_0 (adservices_manager_service))
+(typeattributeset aidl_lazy_test_server_34_0 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_34_0 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_34_0 (aidl_lazy_test_service))
+(typeattributeset alarm_service_34_0 (alarm_service))
+(typeattributeset anr_data_file_34_0 (anr_data_file))
+(typeattributeset apc_service_34_0 (apc_service))
+(typeattributeset apex_data_file_34_0 (apex_data_file))
+(typeattributeset apex_info_file_34_0 (apex_info_file))
+(typeattributeset apex_metadata_file_34_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_34_0 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_34_0 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_34_0 (apex_ota_reserved_file))
+(typeattributeset apex_ready_prop_34_0 (apex_ready_prop))
+(typeattributeset apex_rollback_data_file_34_0 (apex_rollback_data_file))
+(typeattributeset apex_service_34_0 (apex_service))
+(typeattributeset apex_system_server_data_file_34_0 (apex_system_server_data_file))
+(typeattributeset apexd_34_0 (apexd))
+(typeattributeset apexd_config_prop_34_0 (apexd_config_prop))
+(typeattributeset apexd_exec_34_0 (apexd_exec))
+(typeattributeset apexd_prop_34_0 (apexd_prop))
+(typeattributeset apexd_select_prop_34_0 (apexd_select_prop))
+(typeattributeset apk_data_file_34_0 (apk_data_file))
+(typeattributeset apk_private_data_file_34_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_34_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_34_0 (apk_tmp_file))
+(typeattributeset apk_verity_prop_34_0 (apk_verity_prop))
+(typeattributeset app_binding_service_34_0 (app_binding_service))
+(typeattributeset app_data_file_34_0 (app_data_file))
+(typeattributeset app_fuse_file_34_0 (app_fuse_file))
+(typeattributeset app_fusefs_34_0 (app_fusefs))
+(typeattributeset app_hibernation_service_34_0 (app_hibernation_service))
+(typeattributeset app_integrity_service_34_0 (app_integrity_service))
+(typeattributeset app_prediction_service_34_0 (app_prediction_service))
+(typeattributeset app_search_service_34_0 (app_search_service))
+(typeattributeset app_zygote_34_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_34_0 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_34_0 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_34_0 (appdomain_tmpfs))
+(typeattributeset appops_service_34_0 (appops_service))
+(typeattributeset appwidget_service_34_0 (appwidget_service))
+(typeattributeset arm64_memtag_prop_34_0 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_34_0 (art_apex_dir))
+(typeattributeset artd_34_0 (artd))
+(typeattributeset artd_service_34_0 (artd_service))
+(typeattributeset asec_apk_file_34_0 (asec_apk_file))
+(typeattributeset asec_image_file_34_0 (asec_image_file))
+(typeattributeset asec_public_file_34_0 (asec_public_file))
+(typeattributeset ashmem_device_34_0 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_34_0 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_34_0 (assetatlas_service))
+(typeattributeset atrace_34_0 (atrace))
+(typeattributeset attestation_verification_service_34_0 (attestation_verification_service))
+(typeattributeset audio_config_prop_34_0 (audio_config_prop))
+(typeattributeset audio_data_file_34_0 (audio_data_file))
+(typeattributeset audio_device_34_0 (audio_device))
+(typeattributeset audio_prop_34_0 (audio_prop))
+(typeattributeset audio_service_34_0 (audio_service))
+(typeattributeset audiohal_data_file_34_0 (audiohal_data_file))
+(typeattributeset audioserver_34_0 (audioserver))
+(typeattributeset audioserver_data_file_34_0 (audioserver_data_file))
+(typeattributeset audioserver_service_34_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_34_0 (audioserver_tmpfs))
+(typeattributeset auth_service_34_0 (auth_service))
+(typeattributeset authorization_service_34_0 (authorization_service))
+(typeattributeset autofill_service_34_0 (autofill_service))
+(typeattributeset backup_data_file_34_0 (backup_data_file))
+(typeattributeset backup_service_34_0 (backup_service))
+(typeattributeset battery_service_34_0 (battery_service))
+(typeattributeset batteryproperties_service_34_0 (batteryproperties_service))
+(typeattributeset batterystats_service_34_0 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_34_0 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_34_0 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_34_0 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_34_0 (binder_calls_stats_service))
+(typeattributeset binder_device_34_0 (binder_device))
+(typeattributeset binderfs_34_0 (binderfs))
+(typeattributeset binderfs_features_34_0 (binderfs_features))
+(typeattributeset binderfs_logs_34_0 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_34_0 (binderfs_logs_proc))
+(typeattributeset binfmt_miscfs_34_0 (binfmt_miscfs))
+(typeattributeset biometric_service_34_0 (biometric_service))
+(typeattributeset blkid_34_0 (blkid))
+(typeattributeset blkid_untrusted_34_0 (blkid_untrusted))
+(typeattributeset blob_store_service_34_0 (blob_store_service))
+(typeattributeset block_device_34_0 (block_device))
+(typeattributeset bluetooth_34_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_34_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_34_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_config_prop_34_0 (bluetooth_config_prop))
+(typeattributeset bluetooth_data_file_34_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_34_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_34_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_34_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_34_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_34_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_34_0 (bluetooth_socket))
+(typeattributeset boot_block_device_34_0 (boot_block_device))
+(typeattributeset boot_status_prop_34_0 (boot_status_prop))
+(typeattributeset bootanim_34_0 (bootanim))
+(typeattributeset bootanim_config_prop_34_0 (bootanim_config_prop))
+(typeattributeset bootanim_exec_34_0 (bootanim_exec))
+(typeattributeset bootanim_system_prop_34_0 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_34_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_34_0 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_34_0 (bootloader_prop))
+(typeattributeset bootstat_34_0 (bootstat))
+(typeattributeset bootstat_data_file_34_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_34_0 (bootstat_exec))
+(typeattributeset boottime_prop_34_0 (boottime_prop))
+(typeattributeset boottime_public_prop_34_0 (boottime_public_prop))
+(typeattributeset boottrace_data_file_34_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_34_0 (bpf_progs_loaded_prop))
+(typeattributeset bpfloader_34_0 (bpfloader))
+(typeattributeset bq_config_prop_34_0 (bq_config_prop))
+(typeattributeset broadcastradio_service_34_0 (broadcastradio_service))
+(typeattributeset bt_device_34_0 (bt_device))
+(typeattributeset bufferhubd_34_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_34_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_34_0 (bugreport_service))
+(typeattributeset build_attestation_prop_34_0 (build_attestation_prop))
+(typeattributeset build_bootimage_prop_34_0 (build_bootimage_prop))
+(typeattributeset build_config_prop_34_0 (build_config_prop))
+(typeattributeset build_odm_prop_34_0 (build_odm_prop))
+(typeattributeset build_prop_34_0 (build_prop))
+(typeattributeset build_vendor_prop_34_0 (build_vendor_prop))
+(typeattributeset cache_backup_file_34_0 (cache_backup_file))
+(typeattributeset cache_block_device_34_0 (cache_block_device))
+(typeattributeset cache_file_34_0 (cache_file))
+(typeattributeset cache_private_backup_file_34_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_34_0 (cache_recovery_file))
+(typeattributeset cacheinfo_service_34_0 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_34_0 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_34_0 (camera_calibration_prop))
+(typeattributeset camera_config_prop_34_0 (camera_config_prop))
+(typeattributeset camera_data_file_34_0 (camera_data_file))
+(typeattributeset camera_device_34_0 (camera_device))
+(typeattributeset cameraproxy_service_34_0 (cameraproxy_service))
+(typeattributeset cameraserver_34_0 (cameraserver))
+(typeattributeset cameraserver_exec_34_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_34_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_34_0 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_34_0 (camerax_extensions_prop))
+(typeattributeset cgroup_34_0 (cgroup))
+(typeattributeset cgroup_desc_api_file_34_0 (cgroup_desc_api_file))
+(typeattributeset cgroup_desc_file_34_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_34_0 (cgroup_rc_file))
+(typeattributeset cgroup_v2_34_0 (cgroup_v2))
+(typeattributeset charger_34_0 (charger))
+(typeattributeset charger_config_prop_34_0 (charger_config_prop))
+(typeattributeset charger_exec_34_0 (charger_exec))
+(typeattributeset charger_prop_34_0 (charger_prop))
+(typeattributeset charger_status_prop_34_0 (charger_status_prop))
+(typeattributeset charger_vendor_34_0 (charger_vendor))
+(typeattributeset clipboard_service_34_0 (clipboard_service))
+(typeattributeset cloudsearch_service_34_0 (cloudsearch_service))
+(typeattributeset codec2_config_prop_34_0 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_34_0 (cold_boot_done_prop))
+(typeattributeset color_display_service_34_0 (color_display_service))
+(typeattributeset companion_device_service_34_0 (companion_device_service))
+(typeattributeset composd_vm_art_prop_34_0 (composd_vm_art_prop))
+(typeattributeset composd_vm_vendor_prop_34_0 (composd_vm_vendor_prop))
+(typeattributeset config_prop_34_0 (config_prop))
+(typeattributeset configfs_34_0 (configfs))
+(typeattributeset connectivity_native_service_34_0 (connectivity_native_service))
+(typeattributeset connectivity_service_34_0 (connectivity_service))
+(typeattributeset connmetrics_service_34_0 (connmetrics_service))
+(typeattributeset console_device_34_0 (console_device))
+(typeattributeset consumer_ir_service_34_0 (consumer_ir_service))
+(typeattributeset content_capture_service_34_0 (content_capture_service))
+(typeattributeset content_service_34_0 (content_service))
+(typeattributeset content_suggestions_service_34_0 (content_suggestions_service))
+(typeattributeset contexthub_service_34_0 (contexthub_service))
+(typeattributeset coredump_file_34_0 (coredump_file))
+(typeattributeset country_detector_service_34_0 (country_detector_service))
+(typeattributeset coverage_service_34_0 (coverage_service))
+(typeattributeset cppreopt_prop_34_0 (cppreopt_prop))
+(typeattributeset cpu_monitor_service_34_0 (cpu_monitor_service))
+(typeattributeset cpu_variant_prop_34_0 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_34_0 (cpuinfo_service))
+(typeattributeset crash_dump_34_0 (crash_dump))
+(typeattributeset crash_dump_exec_34_0 (crash_dump_exec))
+(typeattributeset credential_service_34_0 (credential_service))
+(typeattributeset credstore_34_0 (credstore))
+(typeattributeset credstore_data_file_34_0 (credstore_data_file))
+(typeattributeset credstore_exec_34_0 (credstore_exec))
+(typeattributeset credstore_service_34_0 (credstore_service))
+(typeattributeset crossprofileapps_service_34_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_34_0 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_34_0 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_34_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_34_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_34_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_34_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_34_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_34_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_34_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_34_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_34_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_34_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_34_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_34_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_34_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_34_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_34_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_34_0 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_34_0 (dalvik_config_prop))
+(typeattributeset dalvik_dynamic_config_prop_34_0 (dalvik_dynamic_config_prop))
+(typeattributeset dalvik_prop_34_0 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_34_0 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_34_0 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_34_0 (dataloader_manager_service))
+(typeattributeset dbinfo_service_34_0 (dbinfo_service))
+(typeattributeset dck_prop_34_0 (dck_prop))
+(typeattributeset debug_prop_34_0 (debug_prop))
+(typeattributeset debugfs_34_0 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_34_0 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_34_0 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_34_0 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_34_0 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_34_0 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_34_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_34_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_34_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_34_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_34_0 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_34_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_34_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_34_0 (debuggerd_prop))
+(typeattributeset default_android_hwservice_34_0 (default_android_hwservice))
+(typeattributeset default_android_service_34_0 (default_android_service))
+(typeattributeset default_android_vndservice_34_0 (default_android_vndservice))
+(typeattributeset default_prop_34_0 (default_prop))
+(typeattributeset dev_cpu_variant_34_0 (dev_cpu_variant))
+(typeattributeset device_34_0 (device vfio_device))
+(typeattributeset device_config_activity_manager_native_boot_prop_34_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_34_0 (device_config_boot_count_prop))
+(typeattributeset device_config_camera_native_prop_34_0 (device_config_camera_native_prop))
+(typeattributeset device_config_edgetpu_native_prop_34_0 (device_config_edgetpu_native_prop))
+(typeattributeset device_config_input_native_boot_prop_34_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_34_0 (device_config_media_native_prop))
+(typeattributeset device_config_memory_safety_native_boot_prop_34_0 (device_config_memory_safety_native_boot_prop))
+(typeattributeset device_config_memory_safety_native_prop_34_0 (device_config_memory_safety_native_prop))
+(typeattributeset device_config_netd_native_prop_34_0 (device_config_netd_native_prop))
+(typeattributeset device_config_nnapi_native_prop_34_0 (device_config_nnapi_native_prop))
+(typeattributeset device_config_reset_performed_prop_34_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_34_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_34_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_34_0 (device_config_service))
+(typeattributeset device_config_surface_flinger_native_boot_prop_34_0 (device_config_surface_flinger_native_boot_prop))
+(typeattributeset device_config_updatable_service_34_0 (device_config_updatable_service))
+(typeattributeset device_config_vendor_system_native_boot_prop_34_0 (device_config_vendor_system_native_boot_prop))
+(typeattributeset device_config_vendor_system_native_prop_34_0 (device_config_vendor_system_native_prop))
+(typeattributeset device_identifiers_service_34_0 (device_identifiers_service))
+(typeattributeset device_logging_prop_34_0 (device_logging_prop))
+(typeattributeset device_policy_service_34_0 (device_policy_service))
+(typeattributeset device_state_service_34_0 (device_state_service))
+(typeattributeset deviceidle_service_34_0 (deviceidle_service))
+(typeattributeset devicelock_service_34_0 (devicelock_service))
+(typeattributeset devicestoragemonitor_service_34_0 (devicestoragemonitor_service))
+(typeattributeset devpts_34_0 (devpts))
+(typeattributeset dhcp_34_0 (dhcp))
+(typeattributeset dhcp_data_file_34_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_34_0 (dhcp_exec))
+(typeattributeset dhcp_prop_34_0 (dhcp_prop))
+(typeattributeset diskstats_service_34_0 (diskstats_service))
+(typeattributeset display_service_34_0 (display_service))
+(typeattributeset dm_device_34_0 (dm_device))
+(typeattributeset dm_user_device_34_0 (dm_user_device))
+(typeattributeset dmabuf_heap_device_34_0 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_34_0 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_34_0 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_34_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_34_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_34_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_34_0 (dnsresolver_service))
+(typeattributeset domain_verification_service_34_0 (domain_verification_service))
+(typeattributeset dreams_service_34_0 (dreams_service))
+(typeattributeset drm_data_file_34_0 (drm_data_file))
+(typeattributeset drm_service_config_prop_34_0 (drm_service_config_prop))
+(typeattributeset drmserver_34_0 (drmserver))
+(typeattributeset drmserver_exec_34_0 (drmserver_exec))
+(typeattributeset drmserver_service_34_0 (drmserver_service))
+(typeattributeset drmserver_socket_34_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_34_0 (dropbox_data_file))
+(typeattributeset dropbox_service_34_0 (dropbox_service))
+(typeattributeset dumpstate_34_0 (dumpstate))
+(typeattributeset dumpstate_exec_34_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_34_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_34_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_34_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_34_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_34_0 (dynamic_system_prop))
+(typeattributeset e2fs_34_0 (e2fs))
+(typeattributeset e2fs_exec_34_0 (e2fs_exec))
+(typeattributeset efs_file_34_0 (efs_file))
+(typeattributeset emergency_affordance_service_34_0 (emergency_affordance_service))
+(typeattributeset ephemeral_app_34_0 (ephemeral_app))
+(typeattributeset ethernet_service_34_0 (ethernet_service))
+(typeattributeset evsmanagerd_34_0 (evsmanagerd))
+(typeattributeset evsmanagerd_service_34_0 (evsmanagerd_service))
+(typeattributeset exfat_34_0 (exfat))
+(typeattributeset exported3_system_prop_34_0 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_34_0 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_34_0 (exported_camera_prop))
+(typeattributeset exported_config_prop_34_0 (exported_config_prop))
+(typeattributeset exported_default_prop_34_0 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_34_0 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_34_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_34_0 (exported_pm_prop))
+(typeattributeset exported_secure_prop_34_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_34_0 (exported_system_prop))
+(typeattributeset external_vibrator_service_34_0 (external_vibrator_service))
+(typeattributeset extra_free_kbytes_34_0 (extra_free_kbytes))
+(typeattributeset extra_free_kbytes_exec_34_0 (extra_free_kbytes_exec))
+(typeattributeset face_service_34_0 (face_service))
+(typeattributeset face_vendor_data_file_34_0 (face_vendor_data_file))
+(typeattributeset fastbootd_34_0 (fastbootd))
+(typeattributeset ffs_config_prop_34_0 (ffs_config_prop))
+(typeattributeset ffs_control_prop_34_0 (ffs_control_prop))
+(typeattributeset file_contexts_file_34_0 (file_contexts_file))
+(typeattributeset file_integrity_service_34_0 (file_integrity_service))
+(typeattributeset fingerprint_prop_34_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_34_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_34_0 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_34_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_34_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_34_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_34_0 (fingerprintd_service))
+(typeattributeset firstboot_prop_34_0 (firstboot_prop))
+(typeattributeset flags_health_check_34_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_34_0 (flags_health_check_exec))
+(typeattributeset font_service_34_0 (font_service))
+(typeattributeset framework_status_prop_34_0 (framework_status_prop))
+(typeattributeset framework_watchdog_config_prop_34_0 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_34_0 (frp_block_device))
+(typeattributeset fs_bpf_34_0 (fs_bpf))
+(typeattributeset fs_bpf_tethering_34_0 (fs_bpf_tethering))
+(typeattributeset fs_bpf_vendor_34_0 (fs_bpf_vendor))
+(typeattributeset fsck_34_0 (fsck))
+(typeattributeset fsck_exec_34_0 (fsck_exec))
+(typeattributeset fsck_untrusted_34_0 (fsck_untrusted))
+(typeattributeset fscklogs_34_0 (fscklogs))
+(typeattributeset functionfs_34_0 (functionfs))
+(typeattributeset fuse_34_0 (fuse))
+(typeattributeset fuse_device_34_0 (fuse_device))
+(typeattributeset fuseblk_34_0 (fuseblk))
+(typeattributeset fusectlfs_34_0 (fusectlfs))
+(typeattributeset future_pm_prop_34_0 (future_pm_prop))
+(typeattributeset fwk_altitude_service_34_0 (fwk_altitude_service))
+(typeattributeset fwk_automotive_display_hwservice_34_0 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_automotive_display_service_34_0 (fwk_automotive_display_service))
+(typeattributeset fwk_bufferhub_hwservice_34_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_34_0 (fwk_camera_hwservice))
+(typeattributeset fwk_camera_service_34_0 (fwk_camera_service))
+(typeattributeset fwk_display_hwservice_34_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_34_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_34_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_sensor_service_34_0 (fwk_sensor_service))
+(typeattributeset fwk_stats_hwservice_34_0 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_34_0 (fwk_stats_service))
+(typeattributeset fwmarkd_socket_34_0 (fwmarkd_socket))
+(typeattributeset game_mode_intervention_list_file_34_0 (game_mode_intervention_list_file))
+(typeattributeset game_service_34_0 (game_service))
+(typeattributeset gatekeeper_data_file_34_0 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_34_0 (gatekeeper_service))
+(typeattributeset gatekeeperd_34_0 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_34_0 (gatekeeperd_exec))
+(typeattributeset gesture_prop_34_0 (gesture_prop))
+(typeattributeset gfxinfo_service_34_0 (gfxinfo_service))
+(typeattributeset gmscore_app_34_0 (gmscore_app))
+(typeattributeset gnss_device_34_0 (gnss_device))
+(typeattributeset gnss_time_update_service_34_0 (gnss_time_update_service))
+(typeattributeset gps_control_34_0 (gps_control))
+(typeattributeset gpu_device_34_0 (gpu_device))
+(typeattributeset gpu_service_34_0 (gpu_service))
+(typeattributeset gpuservice_34_0 (gpuservice))
+(typeattributeset grammatical_inflection_service_34_0 (grammatical_inflection_service))
+(typeattributeset graphics_config_prop_34_0 (graphics_config_prop))
+(typeattributeset graphics_config_writable_prop_34_0 (graphics_config_writable_prop))
+(typeattributeset graphics_device_34_0 (graphics_device))
+(typeattributeset graphicsstats_service_34_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_34_0 (gsi_data_file))
+(typeattributeset gsi_metadata_file_34_0 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_34_0 (gsi_public_metadata_file))
+(typeattributeset gwp_asan_prop_34_0 (gwp_asan_prop))
+(typeattributeset hal_atrace_hwservice_34_0 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_34_0 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_34_0 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_34_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_34_0 (hal_audiocontrol_service))
+(typeattributeset hal_authsecret_hwservice_34_0 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_34_0 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_34_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bluetooth_service_34_0 (hal_bluetooth_service))
+(typeattributeset hal_bootctl_hwservice_34_0 (hal_bootctl_hwservice))
+(typeattributeset hal_bootctl_service_34_0 (hal_bootctl_service))
+(typeattributeset hal_broadcastradio_hwservice_34_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_broadcastradio_service_34_0 (hal_broadcastradio_service))
+(typeattributeset hal_camera_hwservice_34_0 (hal_camera_hwservice))
+(typeattributeset hal_camera_service_34_0 (hal_camera_service))
+(typeattributeset hal_can_bus_hwservice_34_0 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_34_0 (hal_can_controller_hwservice))
+(typeattributeset hal_can_controller_service_34_0 (hal_can_controller_service))
+(typeattributeset hal_cas_hwservice_34_0 (hal_cas_hwservice))
+(typeattributeset hal_cas_service_34_0 (hal_cas_service))
+(typeattributeset hal_codec2_hwservice_34_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_34_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_34_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_confirmationui_service_34_0 (hal_confirmationui_service))
+(typeattributeset hal_contexthub_hwservice_34_0 (hal_contexthub_hwservice))
+(typeattributeset hal_contexthub_service_34_0 (hal_contexthub_service))
+(typeattributeset hal_drm_hwservice_34_0 (hal_drm_hwservice))
+(typeattributeset hal_drm_service_34_0 (hal_drm_service))
+(typeattributeset hal_dumpstate_config_prop_34_0 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_34_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_dumpstate_service_34_0 (hal_dumpstate_service))
+(typeattributeset hal_evs_hwservice_34_0 (hal_evs_hwservice))
+(typeattributeset hal_evs_service_34_0 (hal_evs_service))
+(typeattributeset hal_face_hwservice_34_0 (hal_face_hwservice))
+(typeattributeset hal_face_service_34_0 (hal_face_service))
+(typeattributeset hal_fastboot_service_34_0 (hal_fastboot_service))
+(typeattributeset hal_fingerprint_hwservice_34_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_34_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_34_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gatekeeper_service_34_0 (hal_gatekeeper_service))
+(typeattributeset hal_gnss_hwservice_34_0 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_34_0 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_34_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_allocator_service_34_0 (hal_graphics_allocator_service))
+(typeattributeset hal_graphics_composer_hwservice_34_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_34_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_composer_service_34_0 (hal_graphics_composer_service))
+(typeattributeset hal_graphics_mapper_hwservice_34_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_34_0 (hal_health_hwservice))
+(typeattributeset hal_health_service_34_0 (hal_health_service))
+(typeattributeset hal_health_storage_hwservice_34_0 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_34_0 (hal_health_storage_service))
+(typeattributeset hal_identity_service_34_0 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_34_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_input_processor_service_34_0 (hal_input_processor_service))
+(typeattributeset hal_instrumentation_prop_34_0 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_34_0 (hal_ir_hwservice))
+(typeattributeset hal_ir_service_34_0 (hal_ir_service))
+(typeattributeset hal_ivn_service_34_0 (hal_ivn_service))
+(typeattributeset hal_keymaster_hwservice_34_0 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_34_0 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_34_0 (hal_light_hwservice))
+(typeattributeset hal_light_service_34_0 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_34_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_34_0 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_34_0 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_34_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_34_0 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_34_0 (hal_nfc_hwservice))
+(typeattributeset hal_nfc_service_34_0 (hal_nfc_service))
+(typeattributeset hal_nlinterceptor_service_34_0 (hal_nlinterceptor_service))
+(typeattributeset hal_oemlock_hwservice_34_0 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_34_0 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_34_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_34_0 (hal_power_hwservice))
+(typeattributeset hal_power_service_34_0 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_34_0 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_34_0 (hal_power_stats_service))
+(typeattributeset hal_radio_service_34_0 (hal_radio_service))
+(typeattributeset hal_rebootescrow_service_34_0 (hal_rebootescrow_service))
+(typeattributeset hal_remoteaccess_service_34_0 (hal_remoteaccess_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_34_0 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_34_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_34_0 (hal_secure_element_hwservice))
+(typeattributeset hal_secure_element_service_34_0 (hal_secure_element_service))
+(typeattributeset hal_secureclock_service_34_0 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_34_0 (hal_sensors_hwservice))
+(typeattributeset hal_sensors_service_34_0 (hal_sensors_service))
+(typeattributeset hal_sharedsecret_service_34_0 (hal_sharedsecret_service))
+(typeattributeset hal_system_suspend_service_34_0 (hal_system_suspend_service))
+(typeattributeset hal_telephony_hwservice_34_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_34_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_tetheroffload_service_34_0 (hal_tetheroffload_service))
+(typeattributeset hal_thermal_hwservice_34_0 (hal_thermal_hwservice))
+(typeattributeset hal_thermal_service_34_0 (hal_thermal_service))
+(typeattributeset hal_tv_cec_hwservice_34_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_hdmi_cec_service_34_0 (hal_tv_hdmi_cec_service))
+(typeattributeset hal_tv_hdmi_connection_service_34_0 (hal_tv_hdmi_connection_service))
+(typeattributeset hal_tv_hdmi_earc_service_34_0 (hal_tv_hdmi_earc_service))
+(typeattributeset hal_tv_input_hwservice_34_0 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_input_service_34_0 (hal_tv_input_service))
+(typeattributeset hal_tv_tuner_hwservice_34_0 (hal_tv_tuner_hwservice))
+(typeattributeset hal_tv_tuner_service_34_0 (hal_tv_tuner_service))
+(typeattributeset hal_usb_gadget_hwservice_34_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_gadget_service_34_0 (hal_usb_gadget_service))
+(typeattributeset hal_usb_hwservice_34_0 (hal_usb_hwservice))
+(typeattributeset hal_usb_service_34_0 (hal_usb_service))
+(typeattributeset hal_uwb_service_34_0 (hal_uwb_service))
+(typeattributeset hal_vehicle_hwservice_34_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vehicle_service_34_0 (hal_vehicle_service))
+(typeattributeset hal_vibrator_hwservice_34_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_34_0 (hal_vibrator_service))
+(typeattributeset hal_vr_hwservice_34_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_34_0 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_34_0 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_34_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hostapd_service_34_0 (hal_wifi_hostapd_service))
+(typeattributeset hal_wifi_hwservice_34_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_service_34_0 (hal_wifi_service))
+(typeattributeset hal_wifi_supplicant_hwservice_34_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hal_wifi_supplicant_service_34_0 (hal_wifi_supplicant_service))
+(typeattributeset hardware_properties_service_34_0 (hardware_properties_service))
+(typeattributeset hardware_service_34_0 (hardware_service))
+(typeattributeset hci_attach_dev_34_0 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_34_0 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_34_0 (hdmi_control_service))
+(typeattributeset healthconnect_service_34_0 (healthconnect_service))
+(typeattributeset healthd_34_0 (healthd))
+(typeattributeset heapdump_data_file_34_0 (heapdump_data_file))
+(typeattributeset heapprofd_34_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_34_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_34_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_34_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_34_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_34_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_34_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_34_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_34_0 (hidl_token_hwservice))
+(typeattributeset hint_service_34_0 (hint_service))
+(typeattributeset hw_random_device_34_0 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_34_0 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_34_0 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_34_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_34_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_34_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_34_0 (hwservicemanager_prop))
+(typeattributeset hypervisor_prop_34_0 (hypervisor_prop))
+(typeattributeset hypervisor_restricted_prop_34_0 (hypervisor_restricted_prop))
+(typeattributeset icon_file_34_0 (icon_file))
+(typeattributeset idmap_34_0 (idmap))
+(typeattributeset idmap_exec_34_0 (idmap_exec))
+(typeattributeset idmap_service_34_0 (idmap_service))
+(typeattributeset iio_device_34_0 (iio_device))
+(typeattributeset imms_service_34_0 (imms_service))
+(typeattributeset incident_34_0 (incident))
+(typeattributeset incident_data_file_34_0 (incident_data_file))
+(typeattributeset incident_helper_34_0 (incident_helper))
+(typeattributeset incident_service_34_0 (incident_service))
+(typeattributeset incidentd_34_0 (incidentd))
+(typeattributeset incremental_control_file_34_0 (incremental_control_file))
+(typeattributeset incremental_prop_34_0 (incremental_prop))
+(typeattributeset incremental_service_34_0 (incremental_service))
+(typeattributeset init_34_0 (init))
+(typeattributeset init_exec_34_0 (init_exec))
+(typeattributeset init_service_status_prop_34_0 (init_service_status_prop))
+(typeattributeset init_tmpfs_34_0 (init_tmpfs))
+(typeattributeset inotify_34_0 (inotify))
+(typeattributeset input_device_34_0 (input_device))
+(typeattributeset input_method_service_34_0 (input_method_service))
+(typeattributeset input_service_34_0 (input_service))
+(typeattributeset inputflinger_34_0 (inputflinger))
+(typeattributeset inputflinger_exec_34_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_34_0 (inputflinger_service))
+(typeattributeset install_data_file_34_0 (install_data_file))
+(typeattributeset installd_34_0 (installd))
+(typeattributeset installd_exec_34_0 (installd_exec))
+(typeattributeset installd_service_34_0 (installd_service))
+(typeattributeset ion_device_34_0 (ion_device))
+(typeattributeset ipsec_service_34_0 (ipsec_service))
+(typeattributeset iris_service_34_0 (iris_service))
+(typeattributeset iris_vendor_data_file_34_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_34_0 (isolated_app))
+(typeattributeset isolated_compute_app_34_0 (isolated_compute_app))
+(typeattributeset jobscheduler_service_34_0 (jobscheduler_service))
+(typeattributeset kernel_34_0 (kernel))
+(typeattributeset keychain_data_file_34_0 (keychain_data_file))
+(typeattributeset keychord_device_34_0 (keychord_device))
+(typeattributeset keyguard_config_prop_34_0 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_34_0 (keystore2_key_contexts_file))
+(typeattributeset keystore_34_0 (keystore))
+(typeattributeset keystore_compat_hal_service_34_0 (keystore_compat_hal_service))
+(typeattributeset keystore_config_prop_34_0 (keystore_config_prop))
+(typeattributeset keystore_data_file_34_0 (keystore_data_file))
+(typeattributeset keystore_exec_34_0 (keystore_exec))
+(typeattributeset keystore_maintenance_service_34_0 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_34_0 (keystore_metrics_service))
+(typeattributeset keystore_service_34_0 (keystore_service))
+(typeattributeset kmsg_debug_device_34_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_34_0 (kmsg_device))
+(typeattributeset labeledfs_34_0 (labeledfs))
+(typeattributeset launcherapps_service_34_0 (launcherapps_service))
+(typeattributeset legacy_permission_service_34_0 (legacy_permission_service))
+(typeattributeset legacykeystore_service_34_0 (legacykeystore_service))
+(typeattributeset libc_debug_prop_34_0 (libc_debug_prop))
+(typeattributeset light_service_34_0 (light_service))
+(typeattributeset linkerconfig_file_34_0 (linkerconfig_file))
+(typeattributeset llkd_34_0 (llkd))
+(typeattributeset llkd_exec_34_0 (llkd_exec))
+(typeattributeset llkd_prop_34_0 (llkd_prop))
+(typeattributeset lmkd_34_0 (lmkd))
+(typeattributeset lmkd_config_prop_34_0 (lmkd_config_prop))
+(typeattributeset lmkd_exec_34_0 (lmkd_exec))
+(typeattributeset lmkd_prop_34_0 (lmkd_prop))
+(typeattributeset lmkd_socket_34_0 (lmkd_socket))
+(typeattributeset locale_prop_34_0 (locale_prop))
+(typeattributeset locale_service_34_0 (locale_service))
+(typeattributeset location_service_34_0 (location_service))
+(typeattributeset location_time_zone_manager_service_34_0 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_34_0 (lock_settings_service))
+(typeattributeset log_prop_34_0 (log_prop))
+(typeattributeset log_tag_prop_34_0 (log_tag_prop))
+(typeattributeset logcat_exec_34_0 (logcat_exec))
+(typeattributeset logd_34_0 (logd))
+(typeattributeset logd_exec_34_0 (logd_exec))
+(typeattributeset logd_prop_34_0 (logd_prop))
+(typeattributeset logd_socket_34_0 (logd_socket))
+(typeattributeset logdr_socket_34_0 (logdr_socket))
+(typeattributeset logdw_socket_34_0 (logdw_socket))
+(typeattributeset logpersist_34_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_34_0 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_34_0 (loop_control_device))
+(typeattributeset loop_device_34_0 (loop_device))
+(typeattributeset looper_stats_service_34_0 (looper_stats_service))
+(typeattributeset lowpan_device_34_0 (lowpan_device))
+(typeattributeset lowpan_prop_34_0 (lowpan_prop))
+(typeattributeset lpdump_service_34_0 (lpdump_service))
+(typeattributeset lpdumpd_prop_34_0 (lpdumpd_prop))
+(typeattributeset mac_perms_file_34_0 (mac_perms_file))
+(typeattributeset mdns_service_34_0 (mdns_service))
+(typeattributeset mdns_socket_34_0 (mdns_socket))
+(typeattributeset mdnsd_34_0 (mdnsd))
+(typeattributeset mdnsd_socket_34_0 (mdnsd_socket))
+(typeattributeset media_communication_service_34_0 (media_communication_service))
+(typeattributeset media_config_prop_34_0 (media_config_prop))
+(typeattributeset media_data_file_34_0 (media_data_file))
+(typeattributeset media_metrics_service_34_0 (media_metrics_service))
+(typeattributeset media_projection_service_34_0 (media_projection_service))
+(typeattributeset media_router_service_34_0 (media_router_service))
+(typeattributeset media_rw_data_file_34_0 (media_rw_data_file))
+(typeattributeset media_session_service_34_0 (media_session_service))
+(typeattributeset media_userdir_file_34_0 (media_userdir_file))
+(typeattributeset media_variant_prop_34_0 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_34_0 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_34_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_34_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_34_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_34_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_34_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_34_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_34_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_34_0 (mediametrics))
+(typeattributeset mediametrics_exec_34_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_34_0 (mediametrics_service))
+(typeattributeset mediaprovider_34_0 (mediaprovider))
+(typeattributeset mediaserver_34_0 (mediaserver))
+(typeattributeset mediaserver_exec_34_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_34_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_34_0 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_34_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_34_0 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_34_0 (mediatranscoding))
+(typeattributeset mediatranscoding_service_34_0 (mediatranscoding_service))
+(typeattributeset meminfo_service_34_0 (meminfo_service))
+(typeattributeset memtrackproxy_service_34_0 (memtrackproxy_service))
+(typeattributeset metadata_block_device_34_0 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_34_0 (metadata_bootstat_file))
+(typeattributeset metadata_file_34_0 (metadata_file))
+(typeattributeset method_trace_data_file_34_0 (method_trace_data_file))
+(typeattributeset midi_service_34_0 (midi_service))
+(typeattributeset mirror_data_file_34_0 (mirror_data_file))
+(typeattributeset misc_block_device_34_0 (misc_block_device))
+(typeattributeset misc_logd_file_34_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_34_0 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_34_0 (mm_events_config_prop))
+(typeattributeset mmc_prop_34_0 (mmc_prop))
+(typeattributeset mnt_expand_file_34_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_34_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_34_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_34_0 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_34_0 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_34_0 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_34_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_34_0 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_34_0 (mock_ota_prop))
+(typeattributeset modprobe_34_0 (modprobe))
+(typeattributeset module_sdkextensions_prop_34_0 (module_sdkextensions_prop))
+(typeattributeset mount_service_34_0 (mount_service))
+(typeattributeset mqueue_34_0 (mqueue))
+(typeattributeset mtp_34_0 (mtp))
+(typeattributeset mtp_device_34_0 (mtp_device))
+(typeattributeset mtp_exec_34_0 (mtp_exec))
+(typeattributeset mtpd_socket_34_0 (mtpd_socket))
+(typeattributeset music_recognition_service_34_0 (music_recognition_service))
+(typeattributeset nativetest_data_file_34_0 (nativetest_data_file))
+(typeattributeset nearby_service_34_0 (nearby_service))
+(typeattributeset net_data_file_34_0 (net_data_file))
+(typeattributeset net_dns_prop_34_0 (net_dns_prop))
+(typeattributeset net_radio_prop_34_0 (net_radio_prop))
+(typeattributeset netd_34_0 (netd))
+(typeattributeset netd_exec_34_0 (netd_exec))
+(typeattributeset netd_listener_service_34_0 (netd_listener_service))
+(typeattributeset netd_service_34_0 (netd_service))
+(typeattributeset netif_34_0 (netif))
+(typeattributeset netpolicy_service_34_0 (netpolicy_service))
+(typeattributeset netstats_service_34_0 (netstats_service))
+(typeattributeset netutils_wrapper_34_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_34_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_34_0 (network_management_service))
+(typeattributeset network_score_service_34_0 (network_score_service))
+(typeattributeset network_stack_34_0 (network_stack))
+(typeattributeset network_stack_service_34_0 (network_stack_service))
+(typeattributeset network_time_update_service_34_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_34_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_34_0 (network_watchlist_service))
+(typeattributeset nfc_34_0 (nfc))
+(typeattributeset nfc_data_file_34_0 (nfc_data_file))
+(typeattributeset nfc_device_34_0 (nfc_device))
+(typeattributeset nfc_logs_data_file_34_0 (nfc_logs_data_file))
+(typeattributeset nfc_prop_34_0 (nfc_prop))
+(typeattributeset nfc_service_34_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_34_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_34_0 (node))
+(typeattributeset notification_service_34_0 (notification_service))
+(typeattributeset null_device_34_0 (null_device))
+(typeattributeset oem_lock_service_34_0 (oem_lock_service))
+(typeattributeset oem_unlock_prop_34_0 (oem_unlock_prop))
+(typeattributeset oemfs_34_0 (oemfs bootanim_oem_file))
+(typeattributeset ondevicepersonalization_system_service_34_0 (ondevicepersonalization_system_service))
+(typeattributeset ota_data_file_34_0 (ota_data_file))
+(typeattributeset ota_metadata_file_34_0 (ota_metadata_file))
+(typeattributeset ota_package_file_34_0 (ota_package_file))
+(typeattributeset ota_prop_34_0 (ota_prop))
+(typeattributeset otadexopt_service_34_0 (otadexopt_service))
+(typeattributeset otapreopt_chroot_34_0 (otapreopt_chroot))
+(typeattributeset overlay_prop_34_0 (overlay_prop))
+(typeattributeset overlay_service_34_0 (overlay_service))
+(typeattributeset overlayfs_file_34_0 (overlayfs_file))
+(typeattributeset owntty_device_34_0 (owntty_device))
+(typeattributeset pac_proxy_service_34_0 (pac_proxy_service))
+(typeattributeset package_native_service_34_0 (package_native_service))
+(typeattributeset package_service_34_0 (package_service))
+(typeattributeset packagemanager_config_prop_34_0 (packagemanager_config_prop))
+(typeattributeset packages_list_file_34_0 (packages_list_file))
+(typeattributeset pan_result_prop_34_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_34_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_34_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_34_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_34_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_34_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_34_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_34_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_34_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_34_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_34_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_34_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_34_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_34_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_34_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_34_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_34_0 (pdx_performance_dir))
+(typeattributeset people_service_34_0 (people_service))
+(typeattributeset perfetto_34_0 (perfetto))
+(typeattributeset performanced_34_0 (performanced))
+(typeattributeset performanced_exec_34_0 (performanced_exec))
+(typeattributeset permission_checker_service_34_0 (permission_checker_service))
+(typeattributeset permission_service_34_0 (permission_service))
+(typeattributeset permissionmgr_service_34_0 (permissionmgr_service))
+(typeattributeset permissive_mte_prop_34_0 (permissive_mte_prop))
+(typeattributeset persist_debug_prop_34_0 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_34_0 (persist_vendor_debug_wifi_prop))
+(typeattributeset persist_wm_debug_prop_34_0 (persist_wm_debug_prop))
+(typeattributeset persistent_data_block_service_34_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_34_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_34_0 (pinner_service))
+(typeattributeset pipefs_34_0 (pipefs))
+(typeattributeset platform_app_34_0 (platform_app))
+(typeattributeset platform_compat_service_34_0 (platform_compat_service))
+(typeattributeset pmsg_device_34_0 (pmsg_device))
+(typeattributeset port_34_0 (port))
+(typeattributeset port_device_34_0 (port_device))
+(typeattributeset postinstall_34_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_34_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_34_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_34_0 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_34_0 (power_debug_prop))
+(typeattributeset power_service_34_0 (power_service))
+(typeattributeset powerctl_prop_34_0 (powerctl_prop))
+(typeattributeset powerstats_service_34_0 (powerstats_service))
+(typeattributeset ppp_34_0 (ppp))
+(typeattributeset ppp_device_34_0 (ppp_device))
+(typeattributeset ppp_exec_34_0 (ppp_exec))
+(typeattributeset preloads_data_file_34_0 (preloads_data_file))
+(typeattributeset preloads_media_file_34_0 (preloads_media_file))
+(typeattributeset prereboot_data_file_34_0 (prereboot_data_file))
+(typeattributeset print_service_34_0 (print_service))
+(typeattributeset priv_app_34_0 (priv_app))
+(typeattributeset privapp_data_file_34_0 (privapp_data_file))
+(typeattributeset prng_seeder_34_0 (prng_seeder))
+(typeattributeset proc_34_0 (proc))
+(typeattributeset proc_abi_34_0 (proc_abi))
+(typeattributeset proc_asound_34_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_34_0 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_34_0 (proc_bootconfig))
+(typeattributeset proc_bpf_34_0 (proc_bpf))
+(typeattributeset proc_buddyinfo_34_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_34_0 (proc_cmdline))
+(typeattributeset proc_cpu_alignment_34_0 (proc_cpu_alignment))
+(typeattributeset proc_cpuinfo_34_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_34_0 (proc_dirty))
+(typeattributeset proc_diskstats_34_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_34_0 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_34_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_34_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_34_0 (proc_fs_verity))
+(typeattributeset proc_hostname_34_0 (proc_hostname))
+(typeattributeset proc_hung_task_34_0 (proc_hung_task))
+(typeattributeset proc_interrupts_34_0 (proc_interrupts))
+(typeattributeset proc_iomem_34_0 (proc_iomem))
+(typeattributeset proc_kallsyms_34_0 (proc_kallsyms))
+(typeattributeset proc_keys_34_0 (proc_keys))
+(typeattributeset proc_kmsg_34_0 (proc_kmsg))
+(typeattributeset proc_kpageflags_34_0 (proc_kpageflags))
+(typeattributeset proc_loadavg_34_0 (proc_loadavg))
+(typeattributeset proc_locks_34_0 (proc_locks))
+(typeattributeset proc_lowmemorykiller_34_0 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_34_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_34_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_34_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_34_0 (proc_misc))
+(typeattributeset proc_modules_34_0 (proc_modules))
+(typeattributeset proc_mounts_34_0 (proc_mounts))
+(typeattributeset proc_net_34_0 (proc_net))
+(typeattributeset proc_net_tcp_udp_34_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_34_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_34_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_34_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_34_0 (proc_panic))
+(typeattributeset proc_perf_34_0 (proc_perf))
+(typeattributeset proc_pid_max_34_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_34_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_34_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_34_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_34_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_34_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_34_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_34_0 (proc_random))
+(typeattributeset proc_sched_34_0 (proc_sched))
+(typeattributeset proc_security_34_0 (proc_security))
+(typeattributeset proc_slabinfo_34_0 (proc_slabinfo))
+(typeattributeset proc_stat_34_0 (proc_stat))
+(typeattributeset proc_swaps_34_0 (proc_swaps))
+(typeattributeset proc_sysrq_34_0 (proc_sysrq))
+(typeattributeset proc_timer_34_0 (proc_timer))
+(typeattributeset proc_tty_drivers_34_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_34_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_34_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_34_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_34_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_34_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_34_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_34_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_34_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_34_0 (proc_uptime))
+(typeattributeset proc_vendor_sched_34_0 (proc_vendor_sched))
+(typeattributeset proc_version_34_0 (proc_version))
+(typeattributeset proc_vmallocinfo_34_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_34_0 (proc_vmstat))
+(typeattributeset proc_watermark_boost_factor_34_0 (proc_watermark_boost_factor))
+(typeattributeset proc_watermark_scale_factor_34_0 (proc_watermark_scale_factor))
+(typeattributeset proc_zoneinfo_34_0 (proc_zoneinfo))
+(typeattributeset processinfo_service_34_0 (processinfo_service))
+(typeattributeset procstats_service_34_0 (procstats_service))
+(typeattributeset profman_34_0 (profman))
+(typeattributeset profman_dump_data_file_34_0 (profman_dump_data_file))
+(typeattributeset profman_exec_34_0 (profman_exec))
+(typeattributeset properties_device_34_0 (properties_device))
+(typeattributeset properties_serial_34_0 (properties_serial))
+(typeattributeset property_contexts_file_34_0 (property_contexts_file))
+(typeattributeset property_data_file_34_0 (property_data_file))
+(typeattributeset property_info_34_0 (property_info))
+(typeattributeset property_service_version_prop_34_0 (property_service_version_prop))
+(typeattributeset property_socket_34_0 (property_socket))
+(typeattributeset provisioned_prop_34_0 (provisioned_prop))
+(typeattributeset pstorefs_34_0 (pstorefs))
+(typeattributeset ptmx_device_34_0 (ptmx_device))
+(typeattributeset qemu_hw_prop_34_0 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_34_0 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_34_0 (qtaguid_device))
+(typeattributeset quick_start_prop_34_0 (quick_start_prop))
+(typeattributeset racoon_34_0 (racoon))
+(typeattributeset racoon_exec_34_0 (racoon_exec))
+(typeattributeset racoon_socket_34_0 (racoon_socket))
+(typeattributeset radio_34_0 (radio))
+(typeattributeset radio_control_prop_34_0 (radio_control_prop))
+(typeattributeset radio_core_data_file_34_0 (radio_core_data_file))
+(typeattributeset radio_data_file_34_0 (radio_data_file))
+(typeattributeset radio_device_34_0 (radio_device))
+(typeattributeset radio_prop_34_0 (radio_prop))
+(typeattributeset radio_service_34_0 (radio_service))
+(typeattributeset ram_device_34_0 (ram_device))
+(typeattributeset random_device_34_0 (random_device))
+(typeattributeset reboot_readiness_service_34_0 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_34_0 (rebootescrow_hal_prop))
+(typeattributeset recovery_34_0 (recovery))
+(typeattributeset recovery_block_device_34_0 (recovery_block_device))
+(typeattributeset recovery_config_prop_34_0 (recovery_config_prop))
+(typeattributeset recovery_data_file_34_0 (recovery_data_file))
+(typeattributeset recovery_persist_34_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_34_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_34_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_34_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_34_0 (recovery_service))
+(typeattributeset recovery_socket_34_0 (recovery_socket))
+(typeattributeset recovery_usb_config_prop_34_0 (recovery_usb_config_prop))
+(typeattributeset registry_service_34_0 (registry_service))
+(typeattributeset remote_provisioning_service_34_0 (remote_provisioning_service))
+(typeattributeset resourcecache_data_file_34_0 (resourcecache_data_file))
+(typeattributeset resources_manager_service_34_0 (resources_manager_service))
+(typeattributeset restorecon_prop_34_0 (restorecon_prop))
+(typeattributeset restrictions_service_34_0 (restrictions_service))
+(typeattributeset retaildemo_prop_34_0 (retaildemo_prop))
+(typeattributeset rild_debug_socket_34_0 (rild_debug_socket))
+(typeattributeset rild_socket_34_0 (rild_socket))
+(typeattributeset ringtone_file_34_0 (ringtone_file))
+(typeattributeset rkpdapp_34_0 (rkpdapp))
+(typeattributeset role_service_34_0 (role_service))
+(typeattributeset rollback_service_34_0 (rollback_service))
+(typeattributeset root_block_device_34_0 (root_block_device))
+(typeattributeset rootdisk_sysdev_34_0 (rootdisk_sysdev))
+(typeattributeset rootfs_34_0 (rootfs))
+(typeattributeset rpmsg_device_34_0 (rpmsg_device))
+(typeattributeset rs_34_0 (rs))
+(typeattributeset rs_exec_34_0 (rs_exec))
+(typeattributeset rss_hwm_reset_34_0 (rss_hwm_reset))
+(typeattributeset rtc_device_34_0 (rtc_device))
+(typeattributeset rttmanager_service_34_0 (rttmanager_service))
+(typeattributeset runas_34_0 (runas))
+(typeattributeset runas_app_34_0 (runas_app))
+(typeattributeset runas_exec_34_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_34_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_34_0 (runtime_service))
+(typeattributeset safemode_prop_34_0 (safemode_prop))
+(typeattributeset same_process_hal_file_34_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_34_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_34_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_34_0 (sdcard_block_device))
+(typeattributeset sdcardd_34_0 (sdcardd))
+(typeattributeset sdcardd_exec_34_0 (sdcardd_exec))
+(typeattributeset sdcardfs_34_0 (sdcardfs))
+(typeattributeset sdk_sandbox_service_34_0 (sdk_sandbox_service))
+(typeattributeset seapp_contexts_file_34_0 (seapp_contexts_file))
+(typeattributeset search_service_34_0 (search_service))
+(typeattributeset search_ui_service_34_0 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_34_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_34_0 (secure_element))
+(typeattributeset secure_element_device_34_0 (secure_element_device))
+(typeattributeset secure_element_service_34_0 (secure_element_service))
+(typeattributeset securityfs_34_0 (securityfs))
+(typeattributeset selection_toolbar_service_34_0 (selection_toolbar_service))
+(typeattributeset selinuxfs_34_0 (selinuxfs))
+(typeattributeset sendbug_config_prop_34_0 (sendbug_config_prop))
+(typeattributeset sensor_privacy_service_34_0 (sensor_privacy_service))
+(typeattributeset sensors_device_34_0 (sensors_device))
+(typeattributeset sensorservice_service_34_0 (sensorservice_service))
+(typeattributeset sepolicy_file_34_0 (sepolicy_file))
+(typeattributeset serial_device_34_0 (serial_device))
+(typeattributeset serial_service_34_0 (serial_service))
+(typeattributeset serialno_prop_34_0 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_34_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_34_0 (service_contexts_file))
+(typeattributeset service_manager_service_34_0 (service_manager_service))
+(typeattributeset service_manager_vndservice_34_0 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_34_0 (servicediscovery_service))
+(typeattributeset servicemanager_34_0 (servicemanager))
+(typeattributeset servicemanager_exec_34_0 (servicemanager_exec))
+(typeattributeset servicemanager_prop_34_0 (servicemanager_prop))
+(typeattributeset settings_service_34_0 (settings_service))
+(typeattributeset sgdisk_34_0 (sgdisk))
+(typeattributeset sgdisk_exec_34_0 (sgdisk_exec))
+(typeattributeset shared_relro_34_0 (shared_relro))
+(typeattributeset shared_relro_file_34_0 (shared_relro_file))
+(typeattributeset shell_34_0 (shell))
+(typeattributeset shell_data_file_34_0 (shell_data_file))
+(typeattributeset shell_exec_34_0 (shell_exec))
+(typeattributeset shell_prop_34_0 (shell_prop))
+(typeattributeset shell_test_data_file_34_0 (shell_test_data_file))
+(typeattributeset shm_34_0 (shm))
+(typeattributeset shortcut_manager_icons_34_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_34_0 (shortcut_service))
+(typeattributeset shutdown_checkpoints_system_data_file_34_0 (shutdown_checkpoints_system_data_file))
+(typeattributeset simpleperf_34_0 (simpleperf))
+(typeattributeset simpleperf_app_runner_34_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_34_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_34_0 (slice_service))
+(typeattributeset slideshow_34_0 (slideshow))
+(typeattributeset smart_idle_maint_enabled_prop_34_0 (smart_idle_maint_enabled_prop))
+(typeattributeset smartspace_service_34_0 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_34_0 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_proxy_socket_34_0 (snapuserd_proxy_socket))
+(typeattributeset snapuserd_socket_34_0 (snapuserd_socket))
+(typeattributeset soc_prop_34_0 (soc_prop))
+(typeattributeset socket_device_34_0 (socket_device))
+(typeattributeset socket_hook_prop_34_0 (socket_hook_prop))
+(typeattributeset sockfs_34_0 (sockfs))
+(typeattributeset sota_prop_34_0 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_34_0 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_34_0 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_34_0 (sqlite_log_prop))
+(typeattributeset staged_install_file_34_0 (staged_install_file))
+(typeattributeset staging_data_file_34_0 (staging_data_file))
+(typeattributeset stats_config_data_file_34_0 (stats_config_data_file))
+(typeattributeset stats_data_file_34_0 (stats_data_file))
+(typeattributeset statsd_34_0 (statsd))
+(typeattributeset statsd_exec_34_0 (statsd_exec))
+(typeattributeset statsdw_socket_34_0 (statsdw_socket))
+(typeattributeset statusbar_service_34_0 (statusbar_service))
+(typeattributeset storage_config_prop_34_0 (storage_config_prop))
+(typeattributeset storage_file_34_0 (storage_file))
+(typeattributeset storage_stub_file_34_0 (storage_stub_file))
+(typeattributeset storaged_service_34_0 (storaged_service))
+(typeattributeset storagemanager_config_prop_34_0 (storagemanager_config_prop))
+(typeattributeset storagestats_service_34_0 (storagestats_service))
+(typeattributeset su_34_0 (su))
+(typeattributeset su_exec_34_0 (su_exec))
+(typeattributeset super_block_device_34_0 (super_block_device))
+(typeattributeset surfaceflinger_34_0 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_34_0 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_34_0 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_34_0 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_34_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_34_0 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_34_0 (suspend_prop))
+(typeattributeset swap_block_device_34_0 (swap_block_device))
+(typeattributeset sysfs_34_0 (sysfs))
+(typeattributeset sysfs_android_usb_34_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_34_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_34_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devfreq_cur_34_0 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_34_0 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_34_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_34_0 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_34_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_34_0 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_34_0 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_34_0 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_34_0 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_34_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_34_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_34_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_34_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_fuse_bpf_34_0 (sysfs_fs_fuse_bpf))
+(typeattributeset sysfs_fs_fuse_features_34_0 (sysfs_fs_fuse_features))
+(typeattributeset sysfs_fs_incfs_features_34_0 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_34_0 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_gpu_34_0 (sysfs_gpu))
+(typeattributeset sysfs_hwrandom_34_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_34_0 (sysfs_ion))
+(typeattributeset sysfs_ipv4_34_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_34_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_34_0 (sysfs_leds))
+(typeattributeset sysfs_loop_34_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_34_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_lru_gen_enabled_34_0 (sysfs_lru_gen_enabled))
+(typeattributeset sysfs_net_34_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_34_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_34_0 (sysfs_power))
+(typeattributeset sysfs_rtc_34_0 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_34_0 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_34_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_34_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_34_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uhid_34_0 (sysfs_uhid))
+(typeattributeset sysfs_uio_34_0 (sysfs_uio))
+(typeattributeset sysfs_usb_34_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_34_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_34_0 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_34_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_34_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_34_0 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_34_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_34_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_34_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_34_0 (sysfs_zram_uevent))
+(typeattributeset system_app_34_0 (system_app))
+(typeattributeset system_app_data_file_34_0 (system_app_data_file))
+(typeattributeset system_app_service_34_0 (system_app_service))
+(typeattributeset system_asan_options_file_34_0 (system_asan_options_file))
+(typeattributeset system_block_device_34_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_34_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_34_0 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_34_0 (system_config_service))
+(typeattributeset system_data_file_34_0 (system_data_file))
+(typeattributeset system_data_root_file_34_0 (system_data_root_file))
+(typeattributeset system_dlkm_file_34_0 (system_dlkm_file))
+(typeattributeset system_event_log_tags_file_34_0 (system_event_log_tags_file))
+(typeattributeset system_file_34_0 (system_file))
+(typeattributeset system_group_file_34_0 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_34_0 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_34_0 (system_lib_file))
+(typeattributeset system_linker_config_file_34_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_34_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_34_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_34_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_34_0 (system_net_netd_hwservice))
+(typeattributeset system_net_netd_service_34_0 (system_net_netd_service))
+(typeattributeset system_passwd_file_34_0 (system_passwd_file))
+(typeattributeset system_prop_34_0 (system_prop))
+(typeattributeset system_seccomp_policy_file_34_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_34_0 (system_security_cacerts_file))
+(typeattributeset system_server_34_0 (system_server))
+(typeattributeset system_server_dumper_service_34_0 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_34_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_34_0 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_34_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_34_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_34_0 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_34_0 (system_unsolzygote_socket))
+(typeattributeset system_update_service_34_0 (system_update_service))
+(typeattributeset system_user_mode_emulation_prop_34_0 (system_user_mode_emulation_prop))
+(typeattributeset system_userdir_file_34_0 (system_userdir_file))
+(typeattributeset system_wifi_keystore_hwservice_34_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_34_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_34_0 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_34_0 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_34_0 (systemsound_config_prop))
+(typeattributeset tare_service_34_0 (tare_service))
+(typeattributeset task_profiles_api_file_34_0 (task_profiles_api_file))
+(typeattributeset task_profiles_file_34_0 (task_profiles_file))
+(typeattributeset task_service_34_0 (task_service))
+(typeattributeset tcpdump_exec_34_0 (tcpdump_exec))
+(typeattributeset tee_34_0 (tee))
+(typeattributeset tee_data_file_34_0 (tee_data_file))
+(typeattributeset tee_device_34_0 (tee_device))
+(typeattributeset telecom_service_34_0 (telecom_service))
+(typeattributeset telephony_config_prop_34_0 (telephony_config_prop))
+(typeattributeset telephony_status_prop_34_0 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_34_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_34_0 (test_harness_prop))
+(typeattributeset testharness_service_34_0 (testharness_service))
+(typeattributeset tethering_service_34_0 (tethering_service))
+(typeattributeset textclassification_service_34_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_34_0 (textclassifier_data_file))
+(typeattributeset textservices_service_34_0 (textservices_service))
+(typeattributeset texttospeech_service_34_0 (texttospeech_service))
+(typeattributeset theme_prop_34_0 (theme_prop))
+(typeattributeset thermal_service_34_0 (thermal_service))
+(typeattributeset time_prop_34_0 (time_prop))
+(typeattributeset timedetector_service_34_0 (timedetector_service))
+(typeattributeset timezone_prop_34_0 (timezone_prop))
+(typeattributeset timezonedetector_service_34_0 (timezonedetector_service))
+(typeattributeset tmpfs_34_0 (tmpfs))
+(typeattributeset tombstone_config_prop_34_0 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_34_0 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_34_0 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_34_0 (tombstoned))
+(typeattributeset tombstoned_crash_socket_34_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_34_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_34_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_34_0 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_34_0 (toolbox))
+(typeattributeset toolbox_exec_34_0 (toolbox_exec))
+(typeattributeset trace_data_file_34_0 (trace_data_file))
+(typeattributeset traced_34_0 (traced))
+(typeattributeset traced_consumer_socket_34_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_34_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_34_0 (traced_lazy_prop))
+(typeattributeset traced_oome_heap_session_count_prop_34_0 (traced_oome_heap_session_count_prop))
+(typeattributeset traced_perf_34_0 (traced_perf))
+(typeattributeset traced_perf_socket_34_0 (traced_perf_socket))
+(typeattributeset traced_probes_34_0 (traced_probes))
+(typeattributeset traced_producer_socket_34_0 (traced_producer_socket))
+(typeattributeset traced_tmpfs_34_0 (traced_tmpfs))
+(typeattributeset traceur_app_34_0 (traceur_app))
+(typeattributeset translation_service_34_0 (translation_service))
+(typeattributeset trust_service_34_0 (trust_service))
+(typeattributeset tty_device_34_0 (tty_device))
+(typeattributeset tun_device_34_0 (tun_device))
+(typeattributeset tuner_config_prop_34_0 (tuner_config_prop))
+(typeattributeset tv_iapp_service_34_0 (tv_iapp_service))
+(typeattributeset tv_input_service_34_0 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_34_0 (tv_tuner_resource_mgr_service))
+(typeattributeset ublk_block_device_34_0 (ublk_block_device))
+(typeattributeset ublk_control_device_34_0 (ublk_control_device))
+(typeattributeset ueventd_34_0 (ueventd))
+(typeattributeset ueventd_tmpfs_34_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_34_0 (uhid_device))
+(typeattributeset uimode_service_34_0 (uimode_service))
+(typeattributeset uio_device_34_0 (uio_device))
+(typeattributeset uncrypt_34_0 (uncrypt))
+(typeattributeset uncrypt_exec_34_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_34_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_34_0 (unencrypted_data_file))
+(typeattributeset unlabeled_34_0 (unlabeled))
+(typeattributeset untrusted_app_25_34_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_34_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_34_0 (untrusted_app_29))
+(typeattributeset untrusted_app_30_34_0 (untrusted_app_30))
+(typeattributeset untrusted_app_32_34_0 (untrusted_app_32))
+(typeattributeset untrusted_app_34_0 (untrusted_app))
+(typeattributeset update_engine_34_0 (update_engine))
+(typeattributeset update_engine_data_file_34_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_34_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_34_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_34_0 (update_engine_service))
+(typeattributeset update_engine_stable_service_34_0 (update_engine_stable_service))
+(typeattributeset update_verifier_34_0 (update_verifier))
+(typeattributeset update_verifier_exec_34_0 (update_verifier_exec))
+(typeattributeset updatelock_service_34_0 (updatelock_service))
+(typeattributeset uri_grants_service_34_0 (uri_grants_service))
+(typeattributeset usagestats_service_34_0 (usagestats_service))
+(typeattributeset usb_config_prop_34_0 (usb_config_prop))
+(typeattributeset usb_control_prop_34_0 (usb_control_prop))
+(typeattributeset usb_device_34_0 (usb_device))
+(typeattributeset usb_prop_34_0 (usb_prop))
+(typeattributeset usb_serial_device_34_0 (usb_serial_device))
+(typeattributeset usb_service_34_0 (usb_service))
+(typeattributeset usb_uvc_enabled_prop_34_0 (usb_uvc_enabled_prop))
+(typeattributeset usbaccessory_device_34_0 (usbaccessory_device))
+(typeattributeset usbd_34_0 (usbd))
+(typeattributeset usbd_exec_34_0 (usbd_exec))
+(typeattributeset usbfs_34_0 (usbfs))
+(typeattributeset use_memfd_prop_34_0 (use_memfd_prop))
+(typeattributeset user_profile_data_file_34_0 (user_profile_data_file))
+(typeattributeset user_profile_root_file_34_0 (user_profile_root_file))
+(typeattributeset user_service_34_0 (user_service))
+(typeattributeset userdata_block_device_34_0 (userdata_block_device))
+(typeattributeset userdata_sysdev_34_0 (userdata_sysdev))
+(typeattributeset userdebug_or_eng_prop_34_0 (userdebug_or_eng_prop))
+(typeattributeset usermodehelper_34_0 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_34_0 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_34_0 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_34_0 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_34_0 (uwb_service))
+(typeattributeset vcn_management_service_34_0 (vcn_management_service))
+(typeattributeset vd_device_34_0 (vd_device))
+(typeattributeset vdc_34_0 (vdc))
+(typeattributeset vdc_exec_34_0 (vdc_exec))
+(typeattributeset vehicle_hal_prop_34_0 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_34_0 (vendor_apex_file))
+(typeattributeset vendor_app_file_34_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_34_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_34_0 (vendor_apex_metadata_file vendor_configs_file))
+(typeattributeset vendor_data_file_34_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_34_0 (vendor_default_prop))
+(typeattributeset vendor_file_34_0 (vendor_file))
+(typeattributeset vendor_framework_file_34_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_34_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_34_0 (vendor_idc_file))
+(typeattributeset vendor_init_34_0 (vendor_init))
+(typeattributeset vendor_kernel_modules_34_0 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_34_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_34_0 (vendor_keylayout_file))
+(typeattributeset vendor_misc_writer_34_0 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_34_0 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_34_0 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_34_0 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_34_0 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_34_0 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_34_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_34_0 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_34_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_34_0 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_34_0 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_34_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_34_0 (vendor_toolbox_exec))
+(typeattributeset vendor_userdir_file_34_0 (vendor_userdir_file))
+(typeattributeset vendor_uuid_mapping_config_file_34_0 (vendor_uuid_mapping_config_file))
+(typeattributeset vendor_vm_data_file_34_0 (vendor_vm_data_file))
+(typeattributeset vendor_vm_file_34_0 (vendor_vm_file))
+(typeattributeset vfat_34_0 (vfat))
+(typeattributeset vibrator_manager_service_34_0 (vibrator_manager_service))
+(typeattributeset vibrator_service_34_0 (vibrator_service))
+(typeattributeset video_device_34_0 (video_device))
+(typeattributeset virtual_ab_prop_34_0 (virtual_ab_prop))
+(typeattributeset virtual_device_service_34_0 (virtual_device_service))
+(typeattributeset virtual_face_hal_prop_34_0 (virtual_face_hal_prop))
+(typeattributeset virtual_fingerprint_hal_prop_34_0 (virtual_fingerprint_hal_prop))
+(typeattributeset virtual_touchpad_34_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_34_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_34_0 (virtual_touchpad_service))
+(typeattributeset virtualization_service_34_0 (virtualization_service))
+(typeattributeset vndbinder_device_34_0 (vndbinder_device))
+(typeattributeset vndk_prop_34_0 (vndk_prop))
+(typeattributeset vndk_sp_file_34_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_34_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_34_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_34_0 (voiceinteraction_service))
+(typeattributeset vold_34_0 (vold))
+(typeattributeset vold_config_prop_34_0 (vold_config_prop))
+(typeattributeset vold_data_file_34_0 (vold_data_file))
+(typeattributeset vold_device_34_0 (vold_device))
+(typeattributeset vold_exec_34_0 (vold_exec))
+(typeattributeset vold_metadata_file_34_0 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_34_0 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_34_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_34_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_34_0 (vold_prop))
+(typeattributeset vold_service_34_0 (vold_service))
+(typeattributeset vold_status_prop_34_0 (vold_status_prop))
+(typeattributeset vpn_data_file_34_0 (vpn_data_file))
+(typeattributeset vpn_management_service_34_0 (vpn_management_service))
+(typeattributeset vr_hwc_service_34_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_34_0 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_34_0 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_34_0 (vts_config_prop))
+(typeattributeset vts_status_prop_34_0 (vts_status_prop))
+(typeattributeset wallpaper_effects_generation_service_34_0 (wallpaper_effects_generation_service))
+(typeattributeset wallpaper_file_34_0 (wallpaper_file))
+(typeattributeset wallpaper_service_34_0 (wallpaper_service))
+(typeattributeset watchdog_device_34_0 (watchdog_device))
+(typeattributeset watchdog_metadata_file_34_0 (watchdog_metadata_file))
+(typeattributeset watchdogd_34_0 (watchdogd))
+(typeattributeset watchdogd_exec_34_0 (watchdogd_exec))
+(typeattributeset webview_zygote_34_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_34_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_34_0 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_34_0 (webviewupdate_service))
+(typeattributeset wifi_config_prop_34_0 (wifi_config_prop))
+(typeattributeset wifi_data_file_34_0 (wifi_data_file))
+(typeattributeset wifi_hal_prop_34_0 (wifi_hal_prop))
+(typeattributeset wifi_key_34_0 (wifi_key))
+(typeattributeset wifi_log_prop_34_0 (wifi_log_prop))
+(typeattributeset wifi_prop_34_0 (wifi_prop))
+(typeattributeset wifi_service_34_0 (wifi_service))
+(typeattributeset wifiaware_service_34_0 (wifiaware_service))
+(typeattributeset wificond_34_0 (wificond))
+(typeattributeset wificond_exec_34_0 (wificond_exec))
+(typeattributeset wifinl80211_service_34_0 (wifinl80211_service))
+(typeattributeset wifip2p_service_34_0 (wifip2p_service))
+(typeattributeset wifiscanner_service_34_0 (wifiscanner_service))
+(typeattributeset window_service_34_0 (window_service))
+(typeattributeset wpa_socket_34_0 (wpa_socket))
+(typeattributeset zero_device_34_0 (zero_device))
+(typeattributeset zoned_block_device_34_0 (zoned_block_device))
+(typeattributeset zram_config_prop_34_0 (zram_config_prop))
+(typeattributeset zram_control_prop_34_0 (zram_control_prop))
+(typeattributeset zygote_34_0 (zygote))
+(typeattributeset zygote_config_prop_34_0 (zygote_config_prop))
+(typeattributeset zygote_exec_34_0 (zygote_exec))
+(typeattributeset zygote_socket_34_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_34_0 (zygote_tmpfs))
diff --git a/prebuilts/api/202504/private/compat/34.0/34.0.compat.cil b/prebuilts/api/202504/private/compat/34.0/34.0.compat.cil
new file mode 100644
index 0000000..18e8ef5
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/34.0/34.0.compat.cil
@@ -0,0 +1,17 @@
+;; complement CIL file for compatibility between ToT policy and 34.0 vendors.
+;; will be compiled along with other normal policy files, on 34.0 vendors.
+;;
+
+;; This type may or may not already exist in vendor policy. The 202404 sepolicy
+;; (well, the 24Q1 release) added hidraw_device, but existing vendor policy
+;; may still label the relevant devices with the old label.
+;;
+;; Re-define it here (duplicate definitions in CIL will be ignored) - so we can
+;; duplicate the new policy for the old label to keep things working.
+;; (Doing this in 34.0.cil ended up being too messy.)
+;; See b/340923653.
+(type vendor_hidraw_device)
+(typeattributeset dev_type (vendor_hidraw_device))
+
+(allow system_server vendor_hidraw_device (dir (open getattr read search ioctl lock watch watch_reads)))
+(allow system_server vendor_hidraw_device (chr_file (getattr open read ioctl lock map watch watch_reads append write)))
diff --git a/prebuilts/api/202504/private/compat/34.0/34.0.ignore.cil b/prebuilts/api/202504/private/compat/34.0/34.0.ignore.cil
new file mode 100644
index 0000000..3f5cb68
--- /dev/null
+++ b/prebuilts/api/202504/private/compat/34.0/34.0.ignore.cil
@@ -0,0 +1,57 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 34.0 policy. Thus, we do not need to map these types to
+;; previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ archive_service
+ artd_pre_reboot_service
+ contextual_search_service
+ dexopt_chroot_setup_service
+ dtbo_block_device
+ ota_build_prop
+ snapuserd_log_data_file
+ fwk_vibrator_control_service
+ ecm_enhanced_confirmation_service
+ hal_authgraph_service
+ hal_graphics_mapper_service
+ hal_secretkeeper_service
+ hal_codec2_service
+ hal_macsec_service
+ hal_mediaquality_service
+ hal_remotelyprovisionedcomponent_avf_service
+ hal_threadnetwork_service
+ hidl_memory_prop
+ hidraw_device
+ input_device_config_prop
+ virtual_camera_service
+ ot_daemon_service
+ ot_daemon_socket
+ pm_archiving_enabled_prop
+ remote_auth_service
+ security_state_service
+ sensitive_content_protection_service
+ setupwizard_mode_prop
+ supervision_service
+ sysfs_sync_on_suspend
+ tv_ad_service
+ threadnetwork_service
+ device_config_aconfig_flags_prop
+ virtual_device_native_service
+ next_boot_prop
+ binderfs_logs_stats
+ drm_forcel3_prop
+ proc_percpu_pagelist_high_fraction
+ vendor_microdroid_file
+ threadnetwork_config_prop
+ profiling_service
+ aconfig_storage_metadata_file
+ aconfig_storage_flags_metadata_file
+ aconfigd
+ aconfigd_exec
+ aconfigd_socket
+ enable_16k_pages_prop
+ proc_cgroups
+ media_quality_service
+ ))
diff --git a/prebuilts/api/202504/private/compos_fd_server.te b/prebuilts/api/202504/private/compos_fd_server.te
new file mode 100644
index 0000000..01504ee
--- /dev/null
+++ b/prebuilts/api/202504/private/compos_fd_server.te
@@ -0,0 +1,26 @@
+# Make ART inputs and outputs available to the CompOS VM
+type compos_fd_server, domain, coredomain;
+
+# Allow access to open fds inherited from composd
+allow compos_fd_server composd:fd use;
+
+# Allow creating new files and directories in the staging directory.
+allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms;
+allow compos_fd_server apex_art_staging_data_file:file create_file_perms;
+
+# Allow creating new files and directories in the artifacts directory.
+allow compos_fd_server apex_art_data_file:dir create_dir_perms;
+allow compos_fd_server apex_art_data_file:file create_file_perms;
+
+# Use a pipe to signal readiness
+allow compos_fd_server composd:fifo_file write;
+
+# TODO(b/196109647) - remove this when no longer needed by minijail
+allow compos_fd_server composd:fifo_file read;
+
+# Create a listening vsock for the VM to connect back to
+allow compos_fd_server self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+
+# Only composd can enter the domain via exec
+neverallow { domain -composd } compos_fd_server:process transition;
+neverallow * compos_fd_server:process dyntransition;
diff --git a/prebuilts/api/202504/private/compos_verify.te b/prebuilts/api/202504/private/compos_verify.te
new file mode 100644
index 0000000..5b3615e
--- /dev/null
+++ b/prebuilts/api/202504/private/compos_verify.te
@@ -0,0 +1,24 @@
+# Run by odsign to verify a CompOS signature
+type compos_verify, domain, coredomain;
+type compos_verify_exec, exec_type, file_type, system_file_type;
+
+# Start a VM
+binder_use(compos_verify);
+virtualizationservice_use(compos_verify);
+
+# Read instance image & write VM logs
+allow compos_verify apex_module_data_file:dir search;
+allow compos_verify apex_compos_data_file:dir rw_dir_perms;
+allow compos_verify apex_compos_data_file:file { rw_file_perms create };
+
+# Read CompOS info & signature files
+allow compos_verify apex_art_data_file:dir search;
+allow compos_verify apex_art_data_file:file r_file_perms;
+
+# Allow odsign to redirect our stdout/stderr to log
+allow compos_verify odsign:fd use;
+allow compos_verify odsign_devpts:chr_file { read write };
+
+# Only odsign can enter the domain via exec
+neverallow { domain -odsign } compos_verify:process transition;
+neverallow * compos_verify:process dyntransition;
diff --git a/prebuilts/api/202504/private/composd.te b/prebuilts/api/202504/private/composd.te
new file mode 100644
index 0000000..409b2cb
--- /dev/null
+++ b/prebuilts/api/202504/private/composd.te
@@ -0,0 +1,45 @@
+type composd, domain, coredomain;
+type composd_exec, system_file_type, exec_type, file_type;
+
+# Host dynamic AIDL services
+init_daemon_domain(composd)
+binder_use(composd)
+add_service(composd, compos_service)
+
+# Call back into system server
+binder_call(composd, system_server)
+
+# Start a VM
+virtualizationservice_use(composd)
+
+# Prepare staging directory for odrefresh
+allow composd apex_art_data_file:dir { create_dir_perms relabelfrom };
+allow composd apex_art_staging_data_file:dir { create_dir_perms relabelto };
+allow composd apex_art_staging_data_file:file { getattr unlink };
+
+# Delete files or enable fs-verity in the odrefresh target directory
+allow composd apex_art_data_file:file { open ioctl read unlink write };
+allowxperm composd apex_art_data_file:file ioctl FS_IOC_ENABLE_VERITY;
+
+# Access our APEX data files
+allow composd apex_module_data_file:dir search;
+allow composd apex_compos_data_file:dir create_dir_perms;
+allow composd apex_compos_data_file:file create_file_perms;
+
+# Run fd_server in its own domain, and send SIGTERM when finished.
+domain_auto_trans(composd, fd_server_exec, compos_fd_server)
+allow composd compos_fd_server:process signal;
+
+# Read properties used to configure the CompOS VM
+get_prop(composd, composd_vm_art_prop)
+get_prop(composd, composd_vm_vendor_prop)
+
+# Read ART's properties
+get_prop(composd, dalvik_config_prop_type)
+get_prop(composd, device_config_runtime_native_boot_prop)
+
+# We never create any artifact files directly
+neverallow composd apex_art_data_file:file create;
+
+# ART sets these properties via init script, nothing else should
+neverallow { domain -init } composd_vm_art_prop:property_service set;
diff --git a/prebuilts/api/202504/private/coredomain.te b/prebuilts/api/202504/private/coredomain.te
new file mode 100644
index 0000000..23ad43a
--- /dev/null
+++ b/prebuilts/api/202504/private/coredomain.te
@@ -0,0 +1,259 @@
+get_prop(coredomain, apex_ready_prop)
+get_prop(coredomain, boot_status_prop)
+get_prop(coredomain, camera_config_prop)
+get_prop(coredomain, dalvik_config_prop_type)
+get_prop(coredomain, dalvik_runtime_prop)
+get_prop(coredomain, exported_pm_prop)
+get_prop(coredomain, ffs_config_prop)
+get_prop(coredomain, graphics_config_prop)
+get_prop(coredomain, graphics_config_writable_prop)
+get_prop(coredomain, hdmi_config_prop)
+get_prop(coredomain, init_service_status_private_prop)
+get_prop(coredomain, lmkd_config_prop)
+get_prop(coredomain, localization_prop)
+get_prop(coredomain, pm_prop)
+get_prop(coredomain, radio_control_prop)
+get_prop(coredomain, rollback_test_prop)
+get_prop(coredomain, setupwizard_prop)
+get_prop(coredomain, setupwizard_mode_prop)
+get_prop(coredomain, sqlite_log_prop)
+get_prop(coredomain, storagemanager_config_prop)
+get_prop(coredomain, surfaceflinger_color_prop)
+get_prop(coredomain, systemsound_config_prop)
+get_prop(coredomain, telephony_config_prop)
+get_prop(coredomain, usb_config_prop)
+get_prop(coredomain, usb_control_prop)
+get_prop(coredomain, userspace_reboot_config_prop)
+get_prop(coredomain, vold_config_prop)
+get_prop(coredomain, vts_status_prop)
+get_prop(coredomain, zygote_config_prop)
+get_prop(coredomain, zygote_wrap_prop)
+
+# TODO(b/170590987): remove this after cleaning up default_prop
+get_prop(coredomain, default_prop)
+
+full_treble_only(`
+neverallow {
+ coredomain
+
+ # for chowning
+ -init
+
+ # generic access to sysfs_type
+ -apexd
+ -ueventd
+ -vold
+} sysfs_leds:file *;
+')
+
+# On TREBLE devices, a limited set of files in /vendor are accessible to
+# only a few allowlisted coredomains to keep system/vendor separation.
+full_treble_only(`
+ # Limit access to /vendor/app
+ neverallow {
+ coredomain
+ -appdomain
+ -artd
+ -dex2oat
+ -idmap
+ -init
+ -installd
+ -heapprofd
+ -postinstall_dexopt
+ -rs # spawned by appdomain, so carryover the exception above
+ -system_server
+ -traced_perf
+ } vendor_app_file:dir { open read getattr search };
+')
+
+full_treble_only(`
+ neverallow {
+ coredomain
+ -appdomain
+ -artd
+ -dex2oat
+ -idmap
+ -init
+ -installd
+ -heapprofd
+ userdebug_or_eng(`-profcollectd')
+ -postinstall_dexopt
+ -profman
+ -rs # spawned by appdomain, so carryover the exception above
+ userdebug_or_eng(`-simpleperf_boot')
+ -system_server
+ -traced_perf
+ -mediaserver
+ } vendor_app_file:file r_file_perms;
+')
+
+full_treble_only(`
+ # Limit access to /vendor/overlay
+ neverallow {
+ coredomain
+ -appdomain
+ -artd
+ -dex2oat
+ -idmap
+ -init
+ -installd
+ -postinstall_dexopt
+ -rs # spawned by appdomain, so carryover the exception above
+ -system_server
+ -traced_perf
+ -app_zygote
+ -webview_zygote
+ -zygote
+ -heapprofd
+ } vendor_overlay_file:dir { getattr open read search };
+')
+
+full_treble_only(`
+ neverallow {
+ coredomain
+ -appdomain
+ -artd
+ -dex2oat
+ -idmap
+ -init
+ -installd
+ -postinstall_dexopt
+ -rs # spawned by appdomain, so carryover the exception above
+ -system_server
+ -traced_perf
+ -app_zygote
+ -webview_zygote
+ -zygote
+ -heapprofd
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+ } vendor_overlay_file:file open;
+')
+
+# Core domains are not permitted to use kernel interfaces which are not
+# explicitly labeled.
+# TODO(b/65643247): Apply these neverallow rules to all coredomain.
+full_treble_only(`
+ # /proc
+ neverallow {
+ coredomain
+ -init
+ -vold
+ } proc:file no_rw_file_perms;
+
+ # /sys
+ neverallow {
+ coredomain
+ -apexd
+ -init
+ -ueventd
+ is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `-vfio_handler')
+ -vold
+ } sysfs:file no_rw_file_perms;
+
+ # /dev
+ neverallow {
+ coredomain
+ -apexd
+ -fsck
+ -init
+ -ueventd
+ } device:{ blk_file file } no_rw_file_perms;
+
+ # debugfs
+ neverallow {
+ coredomain
+ no_debugfs_restriction(`
+ -dumpstate
+ -init
+ -system_server
+ ')
+ } debugfs:file no_rw_file_perms;
+
+ # tracefs
+ neverallow {
+ coredomain
+ -atrace
+ -dumpstate
+ -gpuservice
+ -init
+ -lmkd
+ -traced_perf
+ -traced_probes
+ -shell
+ -system_server
+ -traceur_app
+ -prefetch
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+ } debugfs_tracing:file no_rw_file_perms;
+
+ # inotifyfs
+ neverallow {
+ coredomain
+ -init
+ } inotify:file no_rw_file_perms;
+
+ # pstorefs
+ neverallow {
+ coredomain
+ -bootstat
+ -charger
+ -dumpstate
+ userdebug_or_eng(`-incidentd')
+ -init
+ -logd
+ -logpersist
+ -recovery_persist
+ -recovery_refresh
+ -shell
+ -system_server
+ } pstorefs:file no_rw_file_perms;
+
+ # configfs
+ neverallow {
+ coredomain
+ -init
+ -system_server
+ } configfs:file no_rw_file_perms;
+
+ # functionfs
+ neverallow {
+ coredomain
+ -adbd
+ -adbd_tradeinmode
+ -init
+ -mediaprovider
+ -system_server
+ } functionfs:file no_rw_file_perms;
+
+ # usbfs and binfmt_miscfs
+ neverallow {
+ coredomain
+ -init
+ }{ usbfs binfmt_miscfs }:file no_rw_file_perms;
+
+ # dmabuf heaps
+ neverallow {
+ coredomain
+ -init
+ -ueventd
+ }{
+ dmabuf_heap_device_type
+ -dmabuf_system_heap_device
+ -dmabuf_system_secure_heap_device
+ }:chr_file no_rw_file_perms;
+')
+
+# Following /dev nodes must not be directly accessed by coredomain, but should
+# instead be wrapped by HALs.
+neverallow coredomain {
+ iio_device
+ radio_device
+}:chr_file { open read append write ioctl };
+
+# TODO(b/120243891): HAL permission to tee_device is included into coredomain
+# on non-Treble devices.
+full_treble_only(`
+ neverallow coredomain tee_device:chr_file { open read append write ioctl };
+')
diff --git a/prebuilts/api/202504/private/cppreopts.te b/prebuilts/api/202504/private/cppreopts.te
new file mode 100644
index 0000000..1192ba6
--- /dev/null
+++ b/prebuilts/api/202504/private/cppreopts.te
@@ -0,0 +1,31 @@
+# cppreopts
+#
+# This command copies preopted files from the system_b partition to the data
+# partition. This domain ensures that we are only copying into specific
+# directories.
+
+type cppreopts, domain, mlstrustedsubject, coredomain;
+type cppreopts_exec, system_file_type, exec_type, file_type;
+
+# Technically not a daemon but we do want the transition from init domain to
+# cppreopts to occur.
+init_daemon_domain(cppreopts)
+domain_auto_trans(cppreopts, preopt2cachename_exec, preopt2cachename);
+
+# Allow cppreopts copy files into the dalvik-cache
+allow cppreopts dalvikcache_data_file:dir { add_name remove_name search write };
+allow cppreopts dalvikcache_data_file:file { create getattr open read rename write unlink };
+
+# Allow cppreopts to execute itself using #!/system/bin/sh
+allow cppreopts shell_exec:file rx_file_perms;
+
+# Allow us to run find on /postinstall
+allow cppreopts system_file:dir { open read };
+
+# Allow running the cp command using cppreopts permissions. Needed so we can
+# write into dalvik-cache
+allow cppreopts toolbox_exec:file rx_file_perms;
+
+# Silence the denial when /postinstall cannot be mounted, e.g., system_other
+# is wiped, but cppreopts.sh still runs.
+dontaudit cppreopts postinstall_mnt_dir:dir search;
diff --git a/prebuilts/api/202504/private/crash_dump.te b/prebuilts/api/202504/private/crash_dump.te
new file mode 100644
index 0000000..a9a802c
--- /dev/null
+++ b/prebuilts/api/202504/private/crash_dump.te
@@ -0,0 +1,143 @@
+typeattribute crash_dump coredomain;
+
+# Crash dump does not need to access devices passed across exec().
+dontaudit crash_dump { devpts dev_type }:chr_file { read write };
+
+allow crash_dump {
+ domain
+ -apexd
+ -bpfloader
+ -crash_dump
+ -init
+ -kernel
+ -keystore
+ -llkd
+ -logd
+ -ueventd
+ -vendor_init
+ -vold
+}:process { ptrace signal sigchld sigstop sigkill };
+
+userdebug_or_eng(`
+ allow crash_dump { apexd llkd logd vold }:process { ptrace signal sigchld sigstop sigkill };
+')
+
+# Read ART APEX data directory
+allow crash_dump apex_art_data_file:dir { getattr search };
+allow crash_dump apex_art_data_file:file r_file_perms;
+
+# Allow crash dump to read bootstrap libraries
+allow crash_dump system_bootstrap_lib_file:dir { getattr search };
+allow crash_dump system_bootstrap_lib_file:file r_file_perms;
+
+# Read Vendor APEX directories
+allow crash_dump vendor_apex_metadata_file:dir { getattr search };
+
+# crash_dump might inherit CAP_SYS_PTRACE from a privileged process,
+# which will result in an audit log even when it's allowed to trace.
+dontaudit crash_dump self:global_capability_class_set { sys_ptrace };
+
+userdebug_or_eng(`
+ allow crash_dump logd:process { ptrace signal sigchld sigstop sigkill };
+
+ # Let crash_dump write to /dev/kmsg_debug crashes that happen before logd comes up.
+ allow crash_dump kmsg_debug_device:chr_file { open append };
+')
+
+# Use inherited file descriptors
+allow crash_dump domain:fd use;
+
+# Read/write IPC pipes inherited from crashing processes.
+allow crash_dump domain:fifo_file { read write };
+
+# Append to pipes given to us by processes requesting dumps (e.g. dumpstate)
+allow crash_dump domain:fifo_file { append };
+
+# Read information from /proc/$PID.
+allow crash_dump domain:process getattr;
+
+r_dir_file(crash_dump, domain)
+allow crash_dump exec_type:file r_file_perms;
+
+# Read /data/dalvik-cache.
+allow crash_dump dalvikcache_data_file:dir { search getattr };
+allow crash_dump dalvikcache_data_file:file r_file_perms;
+
+# Read APEX data directories.
+allow crash_dump apex_module_data_file:dir { getattr search };
+
+# Read uptime
+allow crash_dump proc_uptime:file r_file_perms;
+
+# Read APK files.
+r_dir_file(crash_dump, apk_data_file);
+
+# Read all /vendor
+r_dir_file(crash_dump, { vendor_file same_process_hal_file })
+
+# Read all /data/local/tests
+r_dir_file(crash_dump, shell_test_data_file)
+
+# Talk to tombstoned
+unix_socket_connect(crash_dump, tombstoned_crash, tombstoned)
+
+# Talk to ActivityManager.
+unix_socket_connect(crash_dump, system_ndebug, system_server)
+
+# Append to ANR files.
+allow crash_dump anr_data_file:file { append getattr };
+
+# Append to tombstone files.
+allow crash_dump tombstone_data_file:file { append getattr };
+
+# crash_dump writes out logcat logs at the bottom of tombstones,
+# which is super useful in some cases.
+unix_socket_connect(crash_dump, logdr, logd)
+
+# Crash dump is not intended to access the following files. Since these
+# are WAI, suppress the denials to clean up the logs.
+dontaudit crash_dump {
+ core_data_file_type
+ vendor_file_type
+}:dir search;
+# Crash dump might try to read files that are mapped into the crashed process's
+# memory space to extract useful binary information such as the ELF header. See
+# system/core/debuggerd/libdebuggerd/tombstone_proto.cpp:dump_mappings.
+# Ignore these accesses.
+dontaudit crash_dump {
+ app_data_file_type
+ property_type
+ system_data_file
+}:{ lnk_file file } { read open };
+
+get_prop(crash_dump, misctrl_prop)
+
+###
+### neverallow assertions
+###
+
+# A domain transition must occur for crash_dump to get the privileges needed to trace the process.
+# Do not allow the execution of crash_dump without a domain transition.
+neverallow domain crash_dump_exec:file execute_no_trans;
+
+# sigchld not explicitly forbidden since it's part of the
+# domain-transition-on-exec macros, and is by itself not sensitive
+neverallow crash_dump {
+ apexd
+ userdebug_or_eng(`-apexd')
+ bpfloader
+ init
+ kernel
+ keystore
+ llkd
+ userdebug_or_eng(`-llkd')
+ logd
+ userdebug_or_eng(`-logd')
+ ueventd
+ vendor_init
+ vold
+ userdebug_or_eng(`-vold')
+}:process { ptrace signal sigstop sigkill };
+
+neverallow crash_dump self:process ptrace;
+neverallow crash_dump gpu_device:chr_file *;
diff --git a/prebuilts/api/202504/private/credstore.te b/prebuilts/api/202504/private/credstore.te
new file mode 100644
index 0000000..bef5c55
--- /dev/null
+++ b/prebuilts/api/202504/private/credstore.te
@@ -0,0 +1,29 @@
+typeattribute credstore coredomain;
+
+init_daemon_domain(credstore)
+
+# talk to Identity Credential
+hal_client_domain(credstore, hal_identity)
+
+# talk to keymint, specifically for IRemotelyProvisionedComponent/default
+hal_client_domain(credstore, hal_keymint)
+
+# credstore needs to get keys from the RKPD
+get_prop(credstore, remote_prov_prop)
+allow credstore remote_provisioning_service:service_manager find;
+
+binder_use(credstore)
+binder_service(credstore)
+binder_call(credstore, system_server)
+
+allow credstore credstore_data_file:dir create_dir_perms;
+allow credstore credstore_data_file:file create_file_perms;
+
+add_service(credstore, credstore_service)
+allow credstore sec_key_att_app_id_provider_service:service_manager find;
+allow credstore dropbox_service:service_manager find;
+allow credstore authorization_service:service_manager find;
+allow credstore keystore:keystore2 get_auth_token;
+
+r_dir_file(credstore, cgroup)
+r_dir_file(credstore, cgroup_v2)
diff --git a/prebuilts/api/202504/private/crosvm.te b/prebuilts/api/202504/private/crosvm.te
new file mode 100644
index 0000000..a377e7a
--- /dev/null
+++ b/prebuilts/api/202504/private/crosvm.te
@@ -0,0 +1,228 @@
+until_board_api(202504, `
+ type crosvm, domain, coredomain;
+')
+
+type crosvm_exec, system_file_type, exec_type, file_type;
+type crosvm_tmpfs, file_type;
+
+# Let crosvm open VM manager devices such as /dev/kvm.
+allow crosvm vm_manager_device_type:chr_file rw_file_perms;
+
+# Most other domains shouldn't access /dev/kvm.
+neverallow { domain -crosvm -ueventd -shell } kvm_device:chr_file getattr;
+neverallow { domain -crosvm -ueventd } kvm_device:chr_file ~getattr;
+neverallowxperm { domain -crosvm } kvm_device:chr_file ioctl ~{ KVM_CHECK_EXTENSION };
+
+# Most other domains shouldn't access other vm managers either.
+# These restrictions need to be slightly looser than for kvm_device to allow
+# for different implementations.
+neverallow { coredomain appdomain -crosvm -ueventd -shell } vm_manager_device_type:chr_file getattr;
+neverallow { coredomain appdomain -crosvm -ueventd } vm_manager_device_type:chr_file ~getattr;
+
+# Let crosvm create temporary files.
+tmpfs_domain(crosvm)
+
+# Let crosvm receive file descriptors from VirtualizationService.
+allow crosvm {
+ virtualizationmanager
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fd use;
+
+# Allow sending VirtualizationService the failure reason and console/log from the VM via pipe.
+allow crosvm {
+ virtualizationmanager
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fifo_file write;
+
+# Let crosvm read the composite disk images (virtualizationservice_data_file), APEXes
+# (staging_data_file), APKs (apk_data_file and shell_data_file where the latter is for test apks in
+# /data/local/tmp), instance.img (app_data_file), and microdroid vendor image (vendor_microdroid_file).
+# Allow crosvm to read the instance image of the service VM saved in apex_virt_data_file.
+# Note that the open permission is not given as the files are passed as file descriptors.
+allow crosvm {
+ virtualizationservice_data_file
+ staging_data_file
+ apk_data_file
+ app_data_file
+ privapp_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ shell_data_file
+ vendor_microdroid_file
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file')
+}:file { getattr read ioctl lock };
+
+# Allow searching the directory where the composite disk images are.
+allow crosvm {
+ virtualizationservice_data_file
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file')
+}:dir search;
+
+# When running a VM as root we get spurious capability denials.
+# Suppress them.
+userdebug_or_eng(`
+ dontaudit crosvm self:capability ipc_lock;
+')
+
+# Allow crosvm to tune for performance.
+allow crosvm self:global_capability_class_set sys_nice;
+
+# Let crosvm access its control socket as created by VS.
+# read, write, getattr: listener socket polling
+# accept: listener socket accepting new connection
+# Note that the open permission is not given as the socket is passed by FD.
+allow crosvm {
+ virtualizationmanager
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:unix_stream_socket { accept read write getattr getopt };
+
+# Let crosvm open test artifacts under /data/local/tmp with file path. (e.g. custom pvmfw.img)
+userdebug_or_eng(`
+ allow crosvm shell_data_file:dir search;
+ allow crosvm shell_data_file:file open;
+')
+
+# The instance image and the composite image should be writable as well because they could represent
+# mutable disks.
+allow crosvm {
+ virtualizationservice_data_file
+ app_data_file
+ privapp_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file')
+}:file write;
+
+# Allow crosvm to pipe console log to shell or app which could be the owner of a VM.
+allow crosvm adbd:fd use;
+allow crosvm adbd:unix_stream_socket { read write };
+allow crosvm devpts:chr_file { read write getattr ioctl };
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ # Allow crosvm to draw screen in the surface
+ allow crosvm device:dir { read open };
+ allow crosvm same_process_hal_file:file { read open getattr map execute };
+ allow crosvm gpu_device:chr_file { read write open ioctl map open getattr };
+ allow crosvm hal_graphics_allocator:fd use;
+ allow crosvm hal_graphics_allocator_server:binder call;
+ allow crosvm surfaceflinger:fd use;
+ hal_client_domain(crosvm, hal_graphics_allocator)
+
+ # To provide display service to an app to get surface.
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+ allow crosvm vmlauncher_app:binder { transfer call };
+ allow crosvm servicemanager:binder { call transfer };
+ allow crosvm virtualization_service:service_manager find;
+ allow crosvm virtualizationservice:binder { call transfer };
+
+ # Allow crosvm to play sound.
+ binder_call(crosvm, audioserver)
+ allow crosvm audioserver_service:service_manager find;
+
+ # Allow crosvm to mount fuse path in guest VM through virtiofs
+ allow crosvm fuse:file create_file_perms;
+ allow crosvm fuse:dir create_dir_perms;
+ allow crosvm mnt_user_file:dir search;
+
+ # Allow crosvm to create unix socket for vhost-user-fs
+ allow crosvm virtualizationservice_data_file:dir { add_name write remove_name };
+ allow crosvm virtualizationservice_data_file:sock_file { create write unlink };
+')
+
+# crosvm tries to use netlink sockets as part its APCI implementation, but we don't need it for AVF (b/228077254)
+dontaudit crosvm self:netlink_generic_socket create_socket_perms_no_ioctl;
+
+# crosvm can write files in /data/local/tmp which are usually used for instance.img and logging by
+# compliance tests and demo apps. Write access to instance.img is particularily important because
+# the VM has to initialize the disk image on its first boot. Note that open access is still not
+# granted because the files are expected to be opened by the owner of the VM (apps or shell in case
+# when the vm is created by the `vm` tool) and handed over to crosvm as FD.
+allow crosvm shell_data_file:file write;
+
+# crosvm tries to read serial device, including the write-only pipe from virtualizationmanager (to
+# forward console/log to the host logcat).
+# crosvm only needs write permission, so dontaudit read
+dontaudit crosvm {
+ virtualizationmanager
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fifo_file { read getattr };
+
+# Required for crosvm to start gdb-server to enable debugging of guest kernel.
+allow crosvm self:tcp_socket { bind create read setopt write accept listen };
+allow crosvm port:tcp_socket name_bind;
+allow crosvm adbd:unix_stream_socket ioctl;
+allow crosvm node:tcp_socket node_bind;
+
+# Allow crosvm to interact to VFIO device
+allow crosvm vfio_device:chr_file rw_file_perms;
+allow crosvm vfio_device:dir r_dir_perms;
+
+# Allow crosvm to access VM DTBO via a file created by virtualizationmanager.
+allow crosvm virtualizationservice_data_file:file read;
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow crosvm to deal with file descriptors of TAP interfaces.
+ allow crosvm tun_device:chr_file rw_file_perms;
+ allowxperm crosvm tun_device:chr_file ioctl { TUNGETIFF TUNSETOFFLOAD TUNSETVNETHDRSZ };
+ allow crosvm self:udp_socket create_socket_perms;
+ allowxperm crosvm self:udp_socket ioctl SIOCGIFMTU;
+ allow crosvm vmnic:fd use;
+')
+
+# Early VMs may print messages to kmsg_debug_device.
+allow crosvm kmsg_debug_device:chr_file w_file_perms;
+
+# Don't allow crosvm to open files that it doesn't own.
+# This is important because a malicious application could try to start a VM with a composite disk
+# image referring by name to files which it doesn't have permission to open, trying to get crosvm to
+# open them on its behalf. By preventing crosvm from opening any other files we prevent this
+# potential privilege escalation. See http://b/192453819 for more discussion.
+neverallow crosvm {
+ virtualizationservice_data_file
+ staging_data_file
+ apk_data_file
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file')
+ userdebug_or_eng(`-shell_data_file')
+}:file open;
+
+# Don't allow crosvm to have access to ordinary vendor files that are not for VMs.
+full_treble_only(`
+ neverallow crosvm {
+ vendor_file_type
+ -vendor_vm_file
+ -vendor_vm_data_file
+ # These types are not required for crosvm, but the access is granted to globally in domain.te
+ # thus should be exempted here.
+ -vendor_cgroup_desc_file
+ -vendor_configs_file
+ -vendor_microdroid_file
+ -vndk_sp_file
+ -vendor_task_profiles_file
+ -same_process_hal_file
+ }:file *;
+')
+
+# Only allow crosvm to read app data files for clients that can start
+# VMs. Note that the use of app data files is further restricted
+# inside the virtualizationservice by checking the label of all disk
+# image files.
+neverallow crosvm {
+ app_data_file_type
+ -app_data_file
+ -privapp_data_file
+ -shell_data_file
+}:file read;
+
+# Only virtualizationmanager can run crosvm
+# Allow vmlauncher app to launch crosvm for virtiofs
+neverallow {
+ domain
+ -crosvm
+ -virtualizationmanager
+ -vmlauncher_app
+
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr')
+} crosvm_exec:file no_x_file_perms;
diff --git a/prebuilts/api/202504/private/derive_classpath.te b/prebuilts/api/202504/private/derive_classpath.te
new file mode 100644
index 0000000..d7c29c2
--- /dev/null
+++ b/prebuilts/api/202504/private/derive_classpath.te
@@ -0,0 +1,32 @@
+
+# Domain for derive_classpath
+type derive_classpath, domain, coredomain, artd_subprocess_type;
+type derive_classpath_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(derive_classpath)
+
+# Read /apex
+allow derive_classpath apex_mnt_dir:dir r_dir_perms;
+allow derive_classpath vendor_apex_metadata_file:dir r_dir_perms;
+
+# Create /data/system/environ/classpath file
+allow derive_classpath environ_system_data_file:dir rw_dir_perms;
+allow derive_classpath environ_system_data_file:file create_file_perms;
+
+# b/183079517 fails on gphone targets otherwise
+allow derive_classpath unlabeled:dir search;
+
+# Allow derive_classpath to write the classpath into ota dexopt
+# - Read the ota's apex dir
+allow derive_classpath postinstall_apex_mnt_dir:dir r_dir_perms;
+# - Report the BCP to the ota's dexopt
+allow derive_classpath postinstall_dexopt:dir search;
+allow derive_classpath postinstall_dexopt:fd use;
+allow derive_classpath postinstall_dexopt:file read;
+allow derive_classpath postinstall_dexopt:lnk_file read;
+allow derive_classpath postinstall_dexopt_tmpfs:file rw_file_perms;
+
+# Allow to be called by artd in Pre-reboot Dexopt.
+allow derive_classpath artd:fd use;
+
+# Allow writing to Pre-reboot Dexopt temp files.
+allow derive_classpath pre_reboot_dexopt_artd_file:file { open read write };
diff --git a/prebuilts/api/202504/private/derive_sdk.te b/prebuilts/api/202504/private/derive_sdk.te
new file mode 100644
index 0000000..c47f0a5
--- /dev/null
+++ b/prebuilts/api/202504/private/derive_sdk.te
@@ -0,0 +1,21 @@
+
+# Domain for derive_sdk
+type derive_sdk, domain, coredomain;
+type derive_sdk_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(derive_sdk)
+
+# Read /apex
+allow derive_sdk apex_mnt_dir:dir r_dir_perms;
+allow derive_sdk vendor_apex_metadata_file:dir r_dir_perms;
+
+# Prop rules: writable by derive_sdk, readable by bootclasspath (apps)
+set_prop(derive_sdk, module_sdkextensions_prop)
+neverallow { domain -init -derive_sdk } module_sdkextensions_prop:property_service set;
+
+# Allow derive_sdk to write data back to dumpstate when forked from dumpstate.
+# The shell_data_file permissions are needed when a bugreport is taken:
+# dumpstate will redirect its stdout to a temporary shell_data_file:file, and
+# this makes derive_sdk append to that file.
+allow derive_sdk dumpstate:fd use;
+allow derive_sdk dumpstate:unix_stream_socket { read write };
+allow derive_sdk shell_data_file:file { getattr append read write };
diff --git a/prebuilts/api/202504/private/device_as_webcam.te b/prebuilts/api/202504/private/device_as_webcam.te
new file mode 100644
index 0000000..98c91c2
--- /dev/null
+++ b/prebuilts/api/202504/private/device_as_webcam.te
@@ -0,0 +1,21 @@
+# Domain for DeviceAsWebcam Service
+type device_as_webcam, domain, coredomain, mlstrustedsubject;
+
+app_domain(device_as_webcam)
+
+allow device_as_webcam system_app_data_file:dir create_dir_perms;
+allow device_as_webcam system_app_data_file:file create_file_perms;
+
+allow device_as_webcam { app_api_service cameraserver_service }:service_manager find;
+
+# Allow DeviceAsWebcam Service needs to access ro.usb.uvc.enabled property to
+# enale/disable itself
+get_prop(device_as_webcam, usb_uvc_enabled_prop)
+
+# need to access /dev to list all devices
+allow device_as_webcam device:dir r_dir_perms;
+
+# UVC nodes are mounted as V4L2 nodes (/dev/video*) on the device. These need to
+# be accessed by the DeviceAsWebcam Service.
+allow device_as_webcam video_device:dir r_dir_perms;
+allow device_as_webcam video_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/dex2oat.te b/prebuilts/api/202504/private/dex2oat.te
new file mode 100644
index 0000000..3a841ce
--- /dev/null
+++ b/prebuilts/api/202504/private/dex2oat.te
@@ -0,0 +1,115 @@
+# dex2oat
+type dex2oat, domain, coredomain, artd_subprocess_type;
+type dex2oat_exec, system_file_type, exec_type, file_type;
+
+userfaultfd_use(dex2oat)
+
+r_dir_file(dex2oat, apk_data_file)
+# Access to /vendor/app
+r_dir_file(dex2oat, vendor_app_file)
+# Access /vendor/framework
+allow dex2oat vendor_framework_file:dir { getattr search };
+allow dex2oat vendor_framework_file:file { getattr open read map };
+# Access /vendor/overlay
+r_dir_file(dex2oat, vendor_overlay_file);
+# Vendor overlay can be found in vendor apex
+allow dex2oat vendor_apex_metadata_file:dir { getattr search };
+
+allow dex2oat tmpfs:file { read getattr map };
+
+r_dir_file(dex2oat, dalvikcache_data_file)
+allow dex2oat dalvikcache_data_file:file write;
+
+# Acquire advisory lock on /system/framework/arm/*
+allow dex2oat system_file:file lock;
+allow dex2oat postinstall_file:file lock;
+
+# Read already open asec_apk_file file descriptors passed by installd.
+# Also allow reading unlabeled files, to allow for upgrading forward
+# locked APKs.
+allow dex2oat asec_apk_file:file { read map };
+allow dex2oat unlabeled:file { read map };
+allow dex2oat oemfs:file { read map };
+allow dex2oat apk_tmp_file:dir search;
+allow dex2oat apk_tmp_file:file r_file_perms;
+allow dex2oat user_profile_data_file:file { getattr read lock map };
+
+# Allow dex2oat to compile app's secondary dex files which were reported back to
+# the framework.
+allow dex2oat { privapp_data_file app_data_file }:file { getattr read write lock map };
+
+# Allow dex2oat to find files and directories under /data/misc/apexdata/com.android.runtime.
+allow dex2oat apex_module_data_file:dir search;
+
+# Allow dex2oat to use devpts passed from odsign.
+allow dex2oat odsign_devpts:chr_file { read write };
+
+# Allow dex2oat to write to file descriptors from odrefresh for files
+# in the staging area.
+allow dex2oat apex_art_staging_data_file:dir r_dir_perms;
+allow dex2oat apex_art_staging_data_file:file { getattr map read write unlink };
+
+# Allow dex2oat to read artifacts from odrefresh.
+allow dex2oat apex_art_data_file:dir r_dir_perms;
+allow dex2oat apex_art_data_file:file r_file_perms;
+
+# Allow dex2oat to read runtime native flag properties.
+get_prop(dex2oat, device_config_runtime_native_prop)
+get_prop(dex2oat, device_config_runtime_native_boot_prop)
+
+# Allow dex2oat to read /apex/apex-info-list.xml
+allow dex2oat apex_info_file:file r_file_perms;
+
+# Allow dex2oat to use file descriptors passed from privileged programs.
+allow dex2oat { artd installd odrefresh odsign }:fd use;
+
+# Allow dex2oat to read the /proc filesystem for CPU features, etc.
+allow dex2oat proc_filesystems:file r_file_perms;
+
+##################
+# A/B OTA Dexopt #
+##################
+
+# Allow dex2oat to use file descriptors from otapreopt.
+allow dex2oat postinstall_dexopt:fd use;
+
+# Allow dex2oat to read files under /postinstall (e.g. APKs under /system, /system/bin/linker).
+allow dex2oat postinstall_file:dir r_dir_perms;
+allow dex2oat postinstall_file:filesystem getattr;
+allow dex2oat postinstall_file:lnk_file { getattr read };
+allow dex2oat postinstall_file:file read;
+# Allow dex2oat to use libraries under /postinstall/system (e.g. /system/lib/libc.so).
+# TODO(b/120266448): Remove when Bionic libraries are part of the Runtime APEX.
+allow dex2oat postinstall_file:file { execute getattr open };
+
+# Allow dex2oat access to /postinstall/apex.
+allow dex2oat postinstall_apex_mnt_dir:dir { getattr search };
+allow dex2oat postinstall_apex_mnt_dir:{ file lnk_file } r_file_perms;
+
+# Allow dex2oat access to files in /data/ota.
+allow dex2oat ota_data_file:dir ra_dir_perms;
+allow dex2oat ota_data_file:file r_file_perms;
+
+# Create and read symlinks in /data/ota/dalvik-cache. This is required for PIC mode boot images,
+# where the oat file is symlinked to the original file in /system.
+allow dex2oat ota_data_file:lnk_file { create read };
+
+# It would be nice to tie this down, but currently, because of how images are written, we can't
+# pass file descriptors for the preopted boot image to dex2oat. So dex2oat needs to be able to
+# create them itself (and make them world-readable).
+allow dex2oat ota_data_file:file { create w_file_perms setattr };
+
+###############
+# APEX Update #
+###############
+
+# /dev/zero is inherited.
+allow dex2oat apexd:fd use;
+
+# Allow dex2oat to use file descriptors from preinstall.
+
+##############
+# Neverallow #
+##############
+
+neverallow dex2oat app_data_file_type:notdevfile_class_set open;
diff --git a/prebuilts/api/202504/private/dexopt_chroot_setup.te b/prebuilts/api/202504/private/dexopt_chroot_setup.te
new file mode 100644
index 0000000..b4b35dd
--- /dev/null
+++ b/prebuilts/api/202504/private/dexopt_chroot_setup.te
@@ -0,0 +1,158 @@
+# A service that sets up the chroot environment for Pre-reboot Dexopt.
+type dexopt_chroot_setup, domain, coredomain;
+type dexopt_chroot_setup_exec, system_file_type, exec_type, file_type;
+type dexopt_chroot_setup_tmpfs, file_type;
+
+# Allow dexopt_chroot_setup to publish a binder service and make binder calls.
+binder_use(dexopt_chroot_setup)
+add_service(dexopt_chroot_setup, dexopt_chroot_setup_service)
+allow dexopt_chroot_setup dumpstate:fifo_file { getattr write };
+allow dexopt_chroot_setup dumpstate:fd use;
+
+init_daemon_domain(dexopt_chroot_setup)
+
+# Use tmpfs_domain() which will give tmpfs files created by dexopt_chroot_setup
+# their own label, which differs from other labels created by other processes.
+# This allows to distinguish in policy files created by dexopt_chroot_setup vs
+# other processes.
+tmpfs_domain(dexopt_chroot_setup)
+
+# libart (mark_compact.cc) has some intialization code that touches the cache
+# info file and userfaultfd.
+allow dexopt_chroot_setup apex_module_data_file:dir { getattr search };
+r_dir_file(dexopt_chroot_setup, apex_art_data_file)
+userfaultfd_use(dexopt_chroot_setup)
+
+# Allow getting root capabilities to bypass permission checks.
+# - "sys_admin" is for performing mount and umount.
+# - "sys_chroot" is for performing chroot.
+allow dexopt_chroot_setup self:global_capability_class_set { sys_admin sys_chroot };
+
+# Allow managing its own files.
+# The root of the temp dir that dexopt_chroot_setup uses is labeled
+# pre_reboot_dexopt_file.
+allow dexopt_chroot_setup pre_reboot_dexopt_file:dir create_dir_perms;
+allow dexopt_chroot_setup pre_reboot_dexopt_file:file create_file_perms;
+
+# Allow accessing /proc/filesystems.
+allow dexopt_chroot_setup proc_filesystems:file r_file_perms;
+
+# Allow accessing block devices (/dev/block/...).
+allow dexopt_chroot_setup block_device:dir { getattr search };
+
+# Allow mounting file systems, to create a chroot environment.
+# We recursively bind-mount directories under /data, /mnt/expand, /proc, /sys,
+# and /dev. We need some of them (e.g., incremental-fs directories for
+# incremental apps in /data; /dev/cpuctl and /dev/blkio for task profiles), but
+# not necessarily all of them. However, to avoid random crashes and silent
+# fallbacks, we bind-mount all of them. Therefore, we need access to many of the
+# fstypes.
+
+allow dexopt_chroot_setup {
+ apex_mnt_dir
+ apk_data_file
+ binderfs
+ binfmt_miscfs
+ cgroup
+ cgroup_v2
+ userdebug_or_eng(debugfs)
+ debugfs_tracing_debug
+ device
+ devpts
+ fs_bpf
+ functionfs
+ fusectlfs
+ linkerconfig_file
+ metadata_file
+ mnt_expand_file
+ pre_reboot_dexopt_file
+ proc
+ pstorefs
+ rootfs
+ selinuxfs
+ sysfs
+ system_data_file
+ system_data_root_file
+ system_file
+ system_lib_file
+ tmpfs
+ vendor_configs_file
+ vendor_file
+}:dir mounton;
+
+allow dexopt_chroot_setup { tmpfs labeledfs }:filesystem mount;
+
+allow dexopt_chroot_setup {
+ binderfs
+ binfmt_miscfs
+ cgroup
+ cgroup_v2
+ userdebug_or_eng(debugfs)
+ debugfs_tracing_debug
+ devpts
+ fs_bpf
+ functionfs
+ fusectlfs
+ labeledfs
+ proc
+ pstorefs
+ selinuxfs
+ sysfs
+ tmpfs
+}:filesystem unmount;
+
+# Allow reading /apex in chroot.
+r_dir_file(dexopt_chroot_setup, apex_mnt_dir)
+allow dexopt_chroot_setup apex_info_file:file r_file_perms;
+
+# Allow writing an empty linker config in chroot to suppress linker warnings.
+# The empty linker config is used until linkerconfig has run.
+# In chroot, we're reusing the type outside the chroot, to reuse all the rules
+# for it for other domains, even though we're not changing the real linker
+# config outside the chroot.
+allow dexopt_chroot_setup linkerconfig_file:dir { write add_name };
+allow dexopt_chroot_setup linkerconfig_file:file { create write };
+
+# Allow using the `rootcontext=` option when mounting tmpfs, so we can give the
+# right labels to /apex, /linkerconfig, /mnt/artd_tmp in chroot.
+# Combined with `allow file_type tmpfs:filesystem associate;`, this allows
+# giving any labels to any tmpfs filesystems as soon as they are mounted.
+# Note that those tmpfs filesystems are known to be empty at the time where the
+# labels are given, and this rule doesn't allow relabeling any existing tmpfs.
+allow dexopt_chroot_setup tmpfs:filesystem relabelfrom;
+
+# Allow executing art_exec_exec without a domain transition because it is a thin
+# wrapper that executes other binaries on behalf of dexopt_chroot_setup. Domain
+# transition will take place as soon as art_exec_exec executes other binaries.
+allow dexopt_chroot_setup art_exec_exec:file rx_file_perms;
+
+# Allow running other binaries in their own domains.
+domain_auto_trans(dexopt_chroot_setup, apexd_exec, apexd)
+domain_auto_trans(dexopt_chroot_setup, linkerconfig_exec, linkerconfig)
+
+# Allow running snapshotctl through init, to map and unmap block devices.
+set_prop(dexopt_chroot_setup, snapshotctl_prop)
+
+# Allow accessing /data/app/..., to bind-mount dirs for incremental apps.
+allow dexopt_chroot_setup apk_data_file:dir { getattr search };
+
+# Neverallow rules.
+
+# Never allow running other binaries without a domain transition.
+# The exception for art_exec_exec is explained above.
+neverallow dexopt_chroot_setup ~{art_exec_exec}:file execute_no_trans;
+
+# Given how powerful this domain is, it shouldn't be used for other purposes.
+neverallow { domain -init } dexopt_chroot_setup:process transition;
+neverallow * dexopt_chroot_setup:process dyntransition;
+
+# Never allow other processes to access the temp dirs for Pre-reboot Dexopt.
+neverallow {
+ domain
+ -art_exec
+ -artd
+ -dexopt_chroot_setup
+ -init
+ -system_server
+ -vendor_init
+} pre_reboot_dexopt_file:dir *;
diff --git a/prebuilts/api/202504/private/dexoptanalyzer.te b/prebuilts/api/202504/private/dexoptanalyzer.te
new file mode 100644
index 0000000..4c87f99
--- /dev/null
+++ b/prebuilts/api/202504/private/dexoptanalyzer.te
@@ -0,0 +1,3 @@
+# Deprecated file type for the legacy dexoptanalyzer binary, used by Android T-. We need to keep it
+# for compatibility because the file type is burnt into the apex image.
+type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
diff --git a/prebuilts/api/202504/private/dhcp.te b/prebuilts/api/202504/private/dhcp.te
new file mode 100644
index 0000000..ce4fef1
--- /dev/null
+++ b/prebuilts/api/202504/private/dhcp.te
@@ -0,0 +1,33 @@
+typeattribute dhcp coredomain;
+
+init_daemon_domain(dhcp)
+type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
+
+set_prop(dhcp, dhcp_prop)
+set_prop(dhcp, pan_result_prop)
+
+net_domain(dhcp)
+
+allow dhcp cgroup:dir { create write add_name };
+allow dhcp cgroup_v2:dir { create write add_name };
+allow dhcp self:global_capability_class_set { setgid setuid net_admin net_raw net_bind_service };
+allow dhcp self:packet_socket create_socket_perms_no_ioctl;
+allow dhcp self:netlink_route_socket nlmsg_write;
+allow dhcp shell_exec:file rx_file_perms;
+allow dhcp system_file:file rx_file_perms;
+not_full_treble(`allow dhcp vendor_file:file rx_file_perms;')
+
+# dhcpcd runs dhcpcd-hooks/*, which runs getprop / setprop (toolbox_exec)
+allow dhcp toolbox_exec:file rx_file_perms;
+
+# For /proc/sys/net/ipv4/conf/*/promote_secondaries
+allow dhcp proc_net_type:file write;
+
+allow dhcp dhcp_data_file:dir create_dir_perms;
+allow dhcp dhcp_data_file:file create_file_perms;
+
+# PAN connections
+allow dhcp netd:fd use;
+allow dhcp netd:fifo_file rw_file_perms;
+allow dhcp netd:{ dgram_socket_class_set unix_stream_socket } { read write };
+allow dhcp netd:{ netlink_kobject_uevent_socket netlink_route_socket netlink_nflog_socket } { read write };
diff --git a/prebuilts/api/202504/private/display_service_server.te b/prebuilts/api/202504/private/display_service_server.te
new file mode 100644
index 0000000..c5839fa
--- /dev/null
+++ b/prebuilts/api/202504/private/display_service_server.te
@@ -0,0 +1 @@
+add_hwservice(display_service_server, fwk_display_hwservice)
diff --git a/prebuilts/api/202504/private/dmesgd.te b/prebuilts/api/202504/private/dmesgd.te
new file mode 100644
index 0000000..7a12882
--- /dev/null
+++ b/prebuilts/api/202504/private/dmesgd.te
@@ -0,0 +1,15 @@
+type dmesgd, domain, coredomain;
+type dmesgd_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(dmesgd)
+
+allow dmesgd dmesgd_data_file:dir create_dir_perms;
+allow dmesgd dmesgd_data_file:file create_file_perms;
+
+allow dmesgd kernel:system syslog_read;
+allow dmesgd shell_exec:file rx_file_perms;
+allow dmesgd toolbox_exec:file rx_file_perms;
+binder_use(dmesgd)
+binder_call(dmesgd, system_server)
+allow dmesgd dropbox_service:service_manager find;
+allow dmesgd proc_version:file r_file_perms;
diff --git a/prebuilts/api/202504/private/dnsmasq.te b/prebuilts/api/202504/private/dnsmasq.te
new file mode 100644
index 0000000..de6c8d6
--- /dev/null
+++ b/prebuilts/api/202504/private/dnsmasq.te
@@ -0,0 +1,23 @@
+typeattribute dnsmasq coredomain;
+
+net_domain(dnsmasq)
+allowxperm dnsmasq self:udp_socket ioctl priv_sock_ioctls;
+
+# TODO: Run with dhcp group to avoid need for dac_override.
+allow dnsmasq self:global_capability_class_set { dac_override dac_read_search };
+
+allow dnsmasq self:global_capability_class_set { net_admin net_raw net_bind_service setgid setuid };
+
+allow dnsmasq dhcp_data_file:dir w_dir_perms;
+allow dnsmasq dhcp_data_file:file create_file_perms;
+
+# Inherit and use open files from netd.
+allow dnsmasq netd:fd use;
+allow dnsmasq netd:fifo_file { getattr read write };
+# TODO: Investigate whether these inherited sockets should be closed on exec.
+allow dnsmasq netd:netlink_kobject_uevent_socket { read write };
+allow dnsmasq netd:netlink_nflog_socket { read write };
+allow dnsmasq netd:netlink_route_socket { read write };
+allow dnsmasq netd:unix_stream_socket { getattr read write };
+allow dnsmasq netd:unix_dgram_socket { read write };
+allow dnsmasq netd:udp_socket { read write };
diff --git a/prebuilts/api/202504/private/domain.te b/prebuilts/api/202504/private/domain.te
new file mode 100644
index 0000000..31b544b
--- /dev/null
+++ b/prebuilts/api/202504/private/domain.te
@@ -0,0 +1,2278 @@
+# Rules for all domains.
+
+# Allow reaping by init.
+allow domain init:process sigchld;
+
+# Intra-domain accesses.
+allow domain self:process {
+ fork
+ sigchld
+ sigkill
+ sigstop
+ signull
+ signal
+ getsched
+ setsched
+ getsession
+ getpgid
+ getcap
+ setcap
+ getattr
+ setrlimit
+};
+allow { domain -artd_subprocess_type } self:process setpgid;
+allow domain self:fd use;
+allow domain proc:dir r_dir_perms;
+allow domain proc_net_type:dir search;
+r_dir_file(domain, self)
+allow domain self:{ fifo_file file } rw_file_perms;
+allow domain self:unix_dgram_socket { create_socket_perms sendto };
+allow domain self:unix_stream_socket { create_stream_socket_perms connectto };
+
+# Inherit or receive open files from others.
+allow domain init:fd use;
+
+userdebug_or_eng(`
+ allow domain su:fd use;
+ allow domain su:unix_stream_socket { connectto getattr getopt read write shutdown };
+ allow domain su:unix_dgram_socket sendto;
+
+ allow { domain -init } su:binder { call transfer };
+
+ # Running something like "pm dump com.android.bluetooth" requires
+ # fifo writes
+ allow domain su:fifo_file { write getattr };
+
+ # allow "gdbserver --attach" to work for su.
+ allow domain su:process sigchld;
+
+ # Allow writing coredumps to /cores/*
+ allow domain coredump_file:file create_file_perms;
+ allow domain coredump_file:dir ra_dir_perms;
+')
+
+with_native_coverage(`
+ # Allow writing coverage information to /data/misc/trace
+ allow domain method_trace_data_file:dir create_dir_perms;
+ allow domain method_trace_data_file:file create_file_perms;
+')
+
+# Allow everyone to read aconfig flags
+get_prop(domain, device_config_aconfig_flags_prop);
+
+# Root fs.
+allow domain tmpfs:dir { getattr search };
+allow domain rootfs:dir search;
+allow domain rootfs:lnk_file { read getattr };
+
+# Device accesses.
+allow domain device:dir search;
+allow domain dev_type:lnk_file r_file_perms;
+allow domain devpts:dir search;
+allow domain dmabuf_heap_device:dir r_dir_perms;
+allow domain socket_device:dir r_dir_perms;
+allow domain owntty_device:chr_file rw_file_perms;
+allow domain null_device:chr_file rw_file_perms;
+allow domain zero_device:chr_file rw_file_perms;
+
+# /dev/ashmem is being deprecated by means of constraining and eventually
+# removing all "open" permissions. We preserve the other permissions.
+allow domain ashmem_device:chr_file { getattr read ioctl lock map append write };
+# This device is used by libcutils, which is accessible to everyone.
+allow domain ashmem_libcutils_device:chr_file rw_file_perms;
+
+# /dev/binder can be accessed by ... everyone! :)
+allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
+get_prop({domain -hwservicemanager -vndservicemanager }, servicemanager_prop)
+# Checking for the existance of the hwservicemanager binary is done in the client API
+# isHwServiceManagerInstalled
+dontaudit domain hwservicemanager_exec:file r_file_perms;
+
+
+# Restrict binder ioctls to an allowlist. Additional ioctl commands may be
+# added to individual domains, but this sets safe defaults for all processes.
+allowxperm domain binder_device:chr_file ioctl { unpriv_binder_ioctls };
+
+# /dev/binderfs needs to be accessed by everyone too!
+allow domain binderfs:dir { getattr search };
+allow domain binderfs_logs_proc:dir search;
+allow domain binderfs_features:dir search;
+allow domain binderfs_features:file r_file_perms;
+
+allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
+allow domain ptmx_device:chr_file rw_file_perms;
+allow domain random_device:chr_file rw_file_perms;
+allow domain proc_random:dir r_dir_perms;
+allow domain proc_random:file r_file_perms;
+allow domain properties_device:dir { search getattr };
+allow domain properties_serial:file r_file_perms;
+allow domain property_info:file r_file_perms;
+
+# Let everyone read log properties, so that liblog can avoid sending unloggable
+# messages to logd.
+get_prop(domain, log_property_type)
+dontaudit domain property_type:file audit_access;
+allow domain property_contexts_file:file r_file_perms;
+
+allow domain init:key search;
+allow domain vold:key search;
+
+# logd access
+write_logd(domain)
+
+# Directory/link file access for path resolution.
+allow domain {
+ system_file
+ system_lib_file
+ system_seccomp_policy_file
+ system_security_cacerts_file
+}:dir r_dir_perms;
+allow domain system_file:lnk_file { getattr read };
+
+# Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*,
+# /(system|product|system_ext)/etc/(group|passwd), linker and its config.
+allow domain system_seccomp_policy_file:file r_file_perms;
+# cacerts are accessible from public Java API.
+allow domain system_security_cacerts_file:file r_file_perms;
+allow domain system_group_file:file r_file_perms;
+allow domain system_passwd_file:file r_file_perms;
+allow domain system_linker_exec:file { execute read open getattr map };
+allow domain system_linker_config_file:file r_file_perms;
+allow domain system_lib_file:file { execute read open getattr map };
+# To allow following symlinks at /system/bin/linker, /system/lib/libc.so, etc.
+allow domain system_linker_exec:lnk_file { read open getattr };
+allow domain system_lib_file:lnk_file { read open getattr };
+
+allow domain system_event_log_tags_file:file r_file_perms;
+
+allow { appdomain coredomain } system_file:file { execute read open getattr map };
+
+# Make sure system/vendor split doesn not affect non-treble
+# devices
+not_full_treble(`
+ allow domain system_file:file { execute read open getattr map };
+ allow domain vendor_file_type:dir { search getattr };
+ allow domain vendor_file_type:file { execute read open getattr map };
+ allow domain vendor_file_type:lnk_file { getattr read };
+')
+
+# All domains are allowed to open and read directories
+# that contain HAL implementations (e.g. passthrough
+# HALs require clients to have these permissions)
+allow domain vendor_hal_file:dir r_dir_perms;
+
+# Everyone can read and execute all same process HALs
+allow domain same_process_hal_file:dir r_dir_perms;
+allow {
+ domain
+ -coredomain # access is explicitly granted to individual coredomains
+} same_process_hal_file:file { execute read open getattr map };
+
+# Any process can load vndk-sp libraries, which are system libraries
+# used by same process HALs
+allow domain vndk_sp_file:dir r_dir_perms;
+allow domain vndk_sp_file:file { execute read open getattr map };
+
+# All domains get access to /vendor/etc
+allow domain vendor_configs_file:dir r_dir_perms;
+allow domain vendor_configs_file:file { read open getattr map };
+
+full_treble_only(`
+ # Allow all domains to be able to follow /system/vendor and/or
+ # /vendor/odm symlinks.
+ allow domain vendor_file_type:lnk_file { getattr open read };
+
+ # This is required to be able to search & read /vendor/lib64
+ # in order to lookup vendor libraries. The execute permission
+ # for coredomains is granted *only* for same process HALs
+ allow domain vendor_file:dir { getattr search };
+
+ # Allow reading and executing out of /vendor to all vendor domains
+ allow { domain -coredomain } vendor_file_type:dir r_dir_perms;
+ allow { domain -coredomain } vendor_file_type:file { read open getattr execute map };
+ allow { domain -coredomain } vendor_file_type:lnk_file { getattr read };
+')
+
+# read and stat any sysfs symlinks
+allow domain sysfs:lnk_file { getattr read };
+
+# libc references /system/usr/share/zoneinfo for timezone related information.
+# This directory is considered to be a VNDK-stable
+allow domain { system_zoneinfo_file }:file r_file_perms;
+allow domain { system_zoneinfo_file }:dir r_dir_perms;
+
+# Lots of processes access current CPU information
+r_dir_file(domain, sysfs_devices_system_cpu)
+
+r_dir_file(domain, sysfs_usb);
+
+# If kernel CONFIG_TRANSPARENT_HUGEPAGE is enabled, libjemalloc5 (statically
+# included by libc) reads /sys/kernel/mm/transparent_hugepage/enabled.
+allow domain sysfs_transparent_hugepage:dir search;
+allow domain sysfs_transparent_hugepage:file r_file_perms;
+
+# Allow search access, and sometimes getattr access, to various directories
+# under /data. We are fairly lenient in allowing search access to top-level
+# dirs that commonly need to be traversed to get access to the "real" files, as
+# this greatly simplifies the policy and doesn't open up much attack surface.
+not_full_treble(`
+ allow domain system_data_file:dir getattr;
+')
+allow { coredomain appdomain } system_data_file:dir getattr;
+# Anything that accesses anything in /data needs search access to /data itself.
+# This includes vendor components, as they need to access /data/vendor.
+allow domain system_data_root_file:dir { search getattr } ;
+# system_data_file is the default type for directories in /data. Anything
+# accessing data files with a more specific type often has to traverse a
+# system_data_file directory such as /data/misc to get there.
+allow domain system_data_file:dir search;
+# Anything that accesses files in /data/user (and /data/user_de, etc.) needs
+# search access to these directories themselves. getattr access is sometimes
+# needed too.
+allow { coredomain appdomain } system_userdir_file:dir { search getattr };
+# Anything that accesses files in /data/media needs search access to /data/media
+# itself.
+allow { coredomain appdomain } media_userdir_file:dir search;
+# TODO restrict this to non-coredomain
+allow domain vendor_userdir_file:dir { getattr search };
+allow domain vendor_data_file:dir { getattr search };
+
+# required by the dynamic linker
+allow domain proc:lnk_file { getattr read };
+
+# /proc/cpuinfo
+allow domain proc_cpuinfo:file r_file_perms;
+
+# /dev/cpu_variant:.*
+allow domain dev_cpu_variant:file r_file_perms;
+
+# profiling needs to read /proc/sys/kernel/perf_event_max_sample_rate
+allow domain proc_perf:file r_file_perms;
+
+# toybox loads libselinux which stats /sys/fs/selinux/
+allow domain selinuxfs:dir search;
+allow domain selinuxfs:file getattr;
+allow domain sysfs:dir search;
+allow domain selinuxfs:filesystem getattr;
+
+# Almost all processes log tracing information to
+# /sys/kernel/debug/tracing/trace_marker
+# The reason behind this is documented in b/6513400
+allow domain debugfs:dir search;
+allow domain debugfs_tracing:dir search;
+allow domain debugfs_tracing_debug:dir search;
+allow domain debugfs_trace_marker:file w_file_perms;
+
+# Linux lockdown mode offered coarse-grained definitions for access controls. In
+# previous versions of the policy, the integrity permission was neverallowed.
+# It was found that this permission mainly duplicates pre-existing rules in
+# the policy (see b/285443587). Additionally, some access were found to be
+# required (b/269377822). The access vector was removed from kernel 5.16
+# onwards. Grant unconditional access, these rules should be removed from the
+# policy once no kernel <5.16 are supported.
+allow domain self:lockdown { confidentiality integrity };
+
+# Filesystem access.
+allow domain fs_type:filesystem getattr;
+allow domain fs_type:dir getattr;
+
+# Restrict all domains to an allowlist for common socket types. Additional
+# ioctl commands may be added to individual domains, but this sets safe
+# defaults for all processes. Note that granting this allowlist to domain does
+# not grant the ioctl permission on these socket types. That must be granted
+# separately.
+allowxperm domain domain:{ icmp_socket rawip_socket tcp_socket udp_socket }
+ ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
+# default allowlist for unix sockets.
+allowxperm domain { domain pdx_channel_socket_type }:{ unix_dgram_socket unix_stream_socket }
+ ioctl unpriv_unix_sock_ioctls;
+
+# Restrict PTYs to only allowed ioctls.
+# Note that granting this allowlist to domain does
+# not grant the wider ioctl permission. That must be granted
+# separately.
+allowxperm domain devpts:chr_file ioctl unpriv_tty_ioctls;
+
+# All domains must clearly enumerate what ioctls they use
+# on filesystem objects (plain files, directories, symbolic links,
+# named pipes, and named sockets). We start off with a safe set.
+allowxperm domain { file_type fs_type domain dev_type }:{ dir notdevfile_class_set blk_file } ioctl { FIOCLEX FIONCLEX };
+
+# If a domain has ioctl access to tun_device, it must clearly enumerate the
+# ioctls used. Safe defaults are listed below.
+allowxperm domain tun_device:chr_file ioctl { FIOCLEX FIONCLEX };
+
+# Allow a process to make a determination whether a file descriptor
+# for a plain file or pipe (fifo_file) is a tty. Note that granting
+# this allowlist to domain does not grant the ioctl permission to
+# these files. That must be granted separately.
+allowxperm domain { file_type fs_type }:file ioctl { TCGETS };
+allowxperm domain domain:fifo_file ioctl { TCGETS };
+
+# If a domain has access to perform an ioctl on a block device, allow these
+# very common, benign ioctls
+allowxperm domain dev_type:blk_file ioctl { BLKGETSIZE64 BLKSSZGET };
+
+# Support sqlite F2FS specific optimizations
+# ioctl permission on the specific file type is still required
+# TODO: consider only compiling these rules if we know the
+# /data partition is F2FS
+allowxperm domain { file_type sdcard_type }:file ioctl {
+ F2FS_IOC_ABORT_VOLATILE_WRITE
+ F2FS_IOC_COMMIT_ATOMIC_WRITE
+ F2FS_IOC_GET_FEATURES
+ F2FS_IOC_GET_PIN_FILE
+ F2FS_IOC_SET_PIN_FILE
+ F2FS_IOC_START_ATOMIC_WRITE
+};
+
+# Workaround for policy compiler being too aggressive and removing hwservice_manager_type
+# when it's not explicitly used in allow rules
+allow { domain -domain } hwservice_manager_type:hwservice_manager { add find };
+# Workaround for policy compiler being too aggressive and removing vndservice_manager_type
+# when it's not explicitly used in allow rules
+allow { domain -domain } vndservice_manager_type:service_manager { add find };
+
+# Under ASAN, processes will try to read /data, as the sanitized libraries are there.
+with_asan(`allow domain system_data_file:dir getattr;')
+# Under ASAN, /system/asan.options needs to be globally accessible.
+with_asan(`allow domain system_asan_options_file:file r_file_perms;')
+
+# read APEX dir and stat any symlink pointing to APEXs.
+allow domain apex_mnt_dir:dir { getattr search };
+allow domain apex_mnt_dir:lnk_file r_file_perms;
+
+# Allow reading /sys/kernel/mm/pgsize_migration/enabled
+allow domain sysfs_pgsize_migration:dir search;
+allow domain sysfs_pgsize_migration:file r_file_perms;
+
+# Linker is executed from the context of the process requesting the dynamic linking,
+# so this prop must be "world-readable".
+get_prop(domain, bionic_linker_16kb_app_compat_prop)
+
+# Allow everyone to read media server-configurable flags, so that libstagefright can be
+# configured using server-configurable flags
+get_prop(domain, device_config_media_native_prop)
+
+# Transition to crash_dump when /system/bin/crash_dump* is executed.
+# This occurs when the process crashes.
+# We do not apply this to the su domain to avoid interfering with
+# tests (b/114136122)
+domain_auto_trans({ domain userdebug_or_eng(`-su') }, crash_dump_exec, crash_dump);
+allow domain crash_dump:process sigchld;
+
+# Allow every process to check the heapprofd.enable properties to determine
+# whether to load the heap profiling library. This does not necessarily enable
+# heap profiling, as initialization will fail if it does not have the
+# necessary SELinux permissions.
+get_prop(domain, heapprofd_prop);
+
+# See private/crash_dump.te
+define(`dumpable_domain',`{
+ domain
+ -apexd
+ -bpfloader
+ -crash_dump
+ -crosvm # TODO(b/236672526): Remove exception for crosvm
+ -init
+ -kernel
+ -keystore
+ -llkd
+ -logd
+ -ueventd
+ -vendor_init
+ -vold
+}')
+
+# Allow heap profiling by heapprofd.
+# Zygotes are excluded due to potential issues with holding open file
+# descriptors or other state across forks. Other exclusions conflict with
+# neverallows, and are not considered important to profile.
+can_profile_heap({
+ dumpable_domain
+ -app_zygote
+ -hal_configstore_server
+ -logpersist
+ -recovery
+ -recovery_persist
+ -recovery_refresh
+ -webview_zygote
+ -zygote
+})
+
+# Allow profiling using perf_event_open by traced_perf.
+can_profile_perf({
+ dumpable_domain
+ -app_zygote
+ -hal_configstore_server
+ -webview_zygote
+ -zygote
+})
+
+# Everyone can access the IncFS list of features.
+r_dir_file(domain, sysfs_fs_incfs_features);
+
+# Everyone can access the fuse list of features.
+r_dir_file(domain, sysfs_fs_fuse_features);
+
+# Path resolution access in cgroups.
+allow domain cgroup:dir search;
+allow { domain -appdomain -rs } cgroup:dir w_dir_perms;
+allow { domain -appdomain -rs } cgroup:file w_file_perms;
+
+allow domain cgroup_v2:dir search;
+allow { domain -appdomain -rs } cgroup_v2:dir w_dir_perms;
+allow { domain -appdomain -rs } cgroup_v2:file w_file_perms;
+
+allow domain cgroup_desc_file:file r_file_perms;
+allow domain cgroup_rc_file:dir search;
+allow domain cgroup_rc_file:file r_file_perms;
+allow domain task_profiles_file:file r_file_perms;
+allow domain vendor_cgroup_desc_file:file r_file_perms;
+allow domain vendor_task_profiles_file:file r_file_perms;
+allow domain libprocessgroup_metadata_file:dir r_dir_perms;
+allow domain libprocessgroup_metadata_file:file r_file_perms;
+
+# Allow all domains to read sys.use_memfd to determine
+# if memfd support can be used if device supports it
+get_prop(domain, use_memfd_prop);
+
+# Read access to sdkextensions props
+get_prop(domain, module_sdkextensions_prop)
+
+# Read access to bq configuration values
+get_prop(domain, bq_config_prop);
+
+# Allow all domains to check whether MTE is set to permissive mode.
+get_prop(domain, permissive_mte_prop);
+
+# Allow ART to be configurable via device_config properties
+# (ART "runs" inside the app process), and MTE bootloader override to be
+# observed by everything
+get_prop(domain, device_config_memory_safety_native_boot_prop);
+get_prop(domain, device_config_memory_safety_native_prop);
+get_prop(domain, device_config_runtime_native_boot_prop);
+get_prop(domain, device_config_runtime_native_prop);
+
+# For now, everyone can access core property files
+# Device specific properties are not granted by default
+not_compatible_property(`
+ # DO NOT ADD ANY PROPERTIES HERE
+ get_prop(domain, core_property_type)
+ get_prop(domain, exported3_system_prop)
+ get_prop(domain, vendor_default_prop)
+')
+compatible_property_only(`
+ # DO NOT ADD ANY PROPERTIES HERE
+ get_prop({coredomain appdomain shell}, core_property_type)
+ get_prop({coredomain appdomain shell}, exported3_system_prop)
+ get_prop({coredomain appdomain shell}, exported_camera_prop)
+ get_prop({coredomain shell}, userspace_reboot_exported_prop)
+ get_prop({coredomain shell}, userspace_reboot_log_prop)
+ get_prop({coredomain shell}, userspace_reboot_test_prop)
+ get_prop({domain -coredomain -appdomain}, vendor_default_prop)
+')
+
+# Public readable properties
+get_prop(domain, aaudio_config_prop)
+get_prop(domain, apexd_select_prop)
+get_prop(domain, arm64_memtag_prop)
+get_prop(domain, bluetooth_config_prop)
+get_prop(domain, bootloader_prop)
+get_prop(domain, build_odm_prop)
+get_prop(domain, build_prop)
+get_prop(domain, build_vendor_prop)
+get_prop(domain, debug_prop)
+get_prop(domain, exported_config_prop)
+get_prop(domain, exported_default_prop)
+get_prop(domain, exported_dumpstate_prop)
+get_prop(domain, exported_secure_prop)
+get_prop(domain, exported_system_prop)
+get_prop(domain, fingerprint_prop)
+get_prop(domain, framework_status_prop)
+get_prop(domain, gwp_asan_prop)
+get_prop(domain, hal_instrumentation_prop)
+get_prop(domain, hw_timeout_multiplier_prop)
+get_prop(domain, init_service_status_prop)
+get_prop(domain, libc_debug_prop)
+get_prop(domain, locale_prop)
+get_prop(domain, logd_prop)
+get_prop(domain, mediadrm_config_prop)
+get_prop(domain, property_service_version_prop)
+get_prop(domain, soc_prop)
+get_prop(domain, socket_hook_prop)
+get_prop(domain, surfaceflinger_prop)
+get_prop(domain, telephony_status_prop)
+get_prop(domain, timezone_prop)
+get_prop({domain -untrusted_app_all -isolated_app_all -ephemeral_app -app_zygote }, userdebug_or_eng_prop)
+get_prop(domain, vendor_socket_hook_prop)
+get_prop(domain, vndk_prop)
+get_prop(domain, vold_status_prop)
+get_prop(domain, vts_config_prop)
+
+# Binder cache properties are world-readable
+get_prop(domain, binder_cache_bluetooth_server_prop)
+get_prop(domain, binder_cache_system_server_prop)
+get_prop(domain, binder_cache_telephony_server_prop)
+
+# Binderfs logs contain sensitive information about other processes.
+neverallow {
+ domain
+ -init
+ -vendor_init
+ userdebug_or_eng(`-dumpstate')
+ userdebug_or_eng(`-system_server')
+} binderfs_logs_transactions:file no_rw_file_perms;
+
+# Binderfs transaction history is less sensitive than transactions, but it
+# still contains global information about the system.
+neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_transaction_history:file no_rw_file_perms;
+
+# Needed for loading kernel modules.
+# TODO(384942085): Reduce the scope.
+allow domain kernel:key search;
+
+# For testing purposes, allow access to keys installed with su.
+# TODO(277916185): Remove since this shouldn't be needed anymore.
+userdebug_or_eng(`
+ allow domain su:key search;
+')
+
+# Allow access to linkerconfig file
+allow domain linkerconfig_file:dir search;
+allow domain linkerconfig_file:file r_file_perms;
+
+# Allow all processes to check for the existence of the boringssl_self_test_marker files.
+allow domain boringssl_self_test_marker:dir search;
+
+# Allow all processes to read the file_logger property that liblog uses to check if file_logger
+# should be used.
+get_prop(domain, log_file_logger_prop)
+
+# Allow all processes to connect to PRNG seeder daemon.
+unix_socket_connect(domain, prng_seeder, prng_seeder)
+
+# Allow calls to system(3), popen(3), ...
+allow {
+ domain
+ # Except domains that explicitly neverallow it.
+ -kernel
+ -init
+ -vendor_init
+ -app_zygote
+ -webview_zygote
+ -system_server
+ -artd
+ -dexopt_chroot_setup
+ -audioserver
+ -cameraserver
+ -mediadrmserver
+ -mediaextractor
+ -mediametrics
+ -mediaserver
+ -mediatuner
+ -mediatranscoding
+ -ueventd
+ -hal_audio_server
+ -hal_camera_server
+ -hal_cas_server
+ -hal_codec2_server
+ -hal_configstore_server
+ -hal_drm_server
+ -hal_omx_server
+} {shell_exec toolbox_exec}:file rx_file_perms;
+
+# Allow all processes to read aconfig flag storage files. The format is hidden behind
+# code-generated APIs, but since the libraries are executed in the context of the caller,
+# all processes need access to the underlying files.
+is_flag_enabled(RELEASE_READ_FROM_NEW_STORAGE, `
+ r_dir_file(domain, aconfig_storage_metadata_file);
+')
+
+r_dir_file({ coredomain appdomain }, system_aconfig_storage_file);
+
+# processes needs to access storage file stored at /metadata/aconfig/boot, require search
+# permission on /metadata dir
+allow domain metadata_file:dir search;
+
+###
+### neverallow rules
+###
+
+# All ioctls on file-like objects (except chr_file and blk_file) and
+# sockets must be restricted to an allowlist.
+neverallowxperm * *:{ dir notdevfile_class_set socket_class_set blk_file } ioctl { 0 };
+
+# b/68014825 and https://android-review.googlesource.com/516535
+# rfc6093 says that processes should not use the TCP urgent mechanism
+neverallowxperm domain domain:socket_class_set ioctl { SIOCATMARK };
+
+# TIOCSTI is only ever used for exploits. Block it.
+# b/33073072, b/7530569
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+neverallowxperm * devpts:chr_file ioctl TIOCSTI;
+
+# Do not allow any domain other than init to create unlabeled files.
+neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
+
+# Limit device node creation to these allowed domains.
+neverallow {
+ domain
+ -kernel
+ -init
+ -ueventd
+ -vold
+} self:global_capability_class_set mknod;
+
+# No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
+neverallow * self:memprotect mmap_zero;
+
+# No domain needs mac_override as it is unused by SELinux.
+neverallow * self:global_capability2_class_set mac_override;
+
+# Disallow attempts to set contexts not defined in current policy
+# This helps guarantee that unknown or dangerous contents will not ever
+# be set.
+neverallow * self:global_capability2_class_set mac_admin;
+
+# Once the policy has been loaded there shall be none to modify the policy.
+# It is sealed.
+neverallow * kernel:security load_policy;
+
+# Only init prior to switching context should be able to set enforcing mode.
+# init starts in kernel domain and switches to init domain via setcon in
+# the init.rc, so the setenforce occurs while still in kernel. After
+# switching domains, there is never any need to setenforce again by init.
+neverallow * kernel:security setenforce;
+neverallow { domain -kernel } kernel:security setcheckreqprot;
+
+# No booleans in AOSP policy, so no need to ever set them.
+neverallow * kernel:security setbool;
+
+# Adjusting the AVC cache threshold.
+# Not presently allowed to anything in policy, but possibly something
+# that could be set from init.rc.
+neverallow { domain -init } kernel:security setsecparam;
+
+# Only the kernel hwrng thread should be able to read from the HW RNG.
+neverallow {
+ domain
+ -prng_seeder # PRNG seeder daemon periodically reseeds itself from HW RNG
+ -shell # For CTS, restricted to just getattr in shell.te
+ -ueventd # To create the /dev/hw_random file
+} hw_random_device:chr_file *;
+# b/78174219 b/64114943
+neverallow {
+ domain
+ -shell # stat of /dev, getattr only
+ -ueventd
+} keychord_device:chr_file *;
+
+# Ensure that all entrypoint executables are in exec_type or postinstall_file.
+neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
+
+# The dynamic linker always calls access(2) on the path. Don't generate SElinux
+# denials since the linker does not actually access the path in case the path
+# does not exist or isn't accessible for the process.
+dontaudit domain postinstall_mnt_dir:dir audit_access;
+
+#Ensure that nothing in userspace can access /dev/port
+neverallow {
+ domain
+ -shell # Shell user should not have any abilities outside of getattr
+ -ueventd
+} port_device:chr_file *;
+neverallow * port_device:chr_file ~{ create relabelto unlink setattr getattr };
+# Only init should be able to configure kernel usermodehelpers or
+# security-sensitive proc settings.
+neverallow { domain -init } usermodehelper:file { append write };
+neverallow { domain -init -ueventd } sysfs_usermodehelper:file { append write };
+neverallow { domain -init -vendor_init } proc_security:file { append open read write };
+
+# Init can't do anything with binder calls. If this neverallow rule is being
+# triggered, it's probably due to a service with no SELinux domain.
+neverallow * init:binder *;
+neverallow * vendor_init:binder *;
+
+# Binderfs logs contain sensitive information about other processes.
+neverallow { domain -dumpstate -init -vendor_init userdebug_or_eng(`-domain') } { binderfs_logs binderfs_logs_proc }:file no_rw_file_perms;
+neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_stats:file no_rw_file_perms;
+
+# Don't allow raw read/write/open access to block_device
+# Rather force a relabel to a more specific type
+neverallow { domain -kernel -init -recovery } block_device:blk_file { open read write };
+
+# Do not allow renaming of block files or character files
+# Ability to do so can lead to possible use in an exploit chain
+# e.g. https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html
+neverallow * *:{ blk_file chr_file } rename;
+
+# Don't allow raw read/write/open access to generic devices.
+# Rather force a relabel to a more specific type.
+neverallow domain device:chr_file { open read write };
+
+# Files from cache should never be executed
+neverallow domain { cache_file cache_backup_file cache_private_backup_file cache_recovery_file }:file execute;
+
+# The test files and executables MUST not be accessible to any domain
+neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
+neverallow domain nativetest_data_file:dir no_w_dir_perms;
+neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
+
+neverallow { domain -shell -init -adbd } shell_test_data_file:file_class_set no_w_file_perms;
+neverallow { domain -shell -init -adbd } shell_test_data_file:dir no_w_dir_perms;
+neverallow { domain -shell -init -adbd -heapprofd -crash_dump } shell_test_data_file:file *;
+neverallow heapprofd shell_test_data_file:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -shell -init -adbd } shell_test_data_file:sock_file *;
+
+# Only the init property service should write to /data/property and /dev/__properties__
+neverallow { domain -init } property_data_file:dir no_w_dir_perms;
+neverallow { domain -init } property_data_file:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init } property_type:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init } properties_device:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init } properties_serial:file { no_w_file_perms no_x_file_perms };
+
+# Nobody should be doing writes to /system & /vendor
+# These partitions are intended to be read-only and must never be
+# modified. Doing so would violate important Android security guarantees
+# and invalidate dm-verity signatures.
+neverallow {
+ domain
+ with_asan(`-asan_extract')
+ recovery_only(`userdebug_or_eng(`-fastbootd')')
+} {
+ system_file_type
+ vendor_file_type
+ exec_type
+}:dir_file_class_set { create write setattr relabelfrom append unlink link rename };
+
+neverallow { domain -kernel with_asan(`-asan_extract') } { system_file_type vendor_file_type exec_type }:dir_file_class_set relabelto;
+
+# Don't allow mounting on top of /system files or directories
+neverallow * exec_type:dir_file_class_set mounton;
+
+# Nothing should be writing to files in the rootfs.
+neverallow * rootfs:file { create write setattr relabelto append unlink link rename };
+
+# Restrict context mounts to specific types marked with
+# the contextmount_type attribute.
+neverallow * {fs_type -contextmount_type}:filesystem relabelto;
+
+# Ensure that context mount types are not writable, to ensure that
+# the write to /system restriction above is not bypassed via context=
+# mount to another type.
+neverallow * contextmount_type:dir_file_class_set
+ { create setattr relabelfrom relabelto append link rename };
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } contextmount_type:dir_file_class_set { write unlink };
+
+# Do not allow service_manager add for default service labels.
+# Instead domains should use a more specific type such as
+# system_app_service rather than the generic type.
+# New service_types are defined in {,hw,vnd}service.te and new mappings
+# from service name to service_type are defined in {,hw,vnd}service_contexts.
+neverallow * default_android_service:service_manager *;
+neverallow * default_android_vndservice:service_manager *;
+neverallow * default_android_hwservice:hwservice_manager *;
+
+# Looking up the base class/interface of all HwBinder services is a bad idea.
+# hwservicemanager currently offer such lookups only to make it so that security
+# decisions are expressed in SELinux policy. However, it's unclear whether this
+# lookup has security implications. If it doesn't, hwservicemanager should be
+# modified to not offer this lookup.
+# This rule can be removed if hwservicemanager is modified to not permit these
+# lookups.
+neverallow * hidl_base_hwservice:hwservice_manager find;
+
+# Require that domains explicitly label unknown properties, and do not allow
+# anyone but init to modify unknown properties.
+neverallow { domain -init -vendor_init } mmc_prop:property_service set;
+neverallow { domain -init -vendor_init } vndk_prop:property_service set;
+
+compatible_property_only(`
+ neverallow { domain -init } mmc_prop:property_service set;
+ neverallow { domain -init -vendor_init } exported_default_prop:property_service set;
+ neverallow { domain -init } exported_secure_prop:property_service set;
+ neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
+ neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
+ neverallow { domain -init -vendor_init } hw_timeout_multiplier_prop:property_service set;
+')
+
+compatible_property_only(`
+ neverallow { domain -init -system_server -vendor_init } exported_pm_prop:property_service set;
+ neverallow { domain -coredomain -vendor_init } exported_pm_prop:file no_rw_file_perms;
+')
+
+# New "pm.dexopt." sysprops should be explicitly listed as exported_pm_prop.
+neverallow { domain -init -dumpstate -vendor_init } future_pm_prop:property_service set;
+neverallow { domain -init -dumpstate -vendor_init } future_pm_prop:file no_rw_file_perms;
+
+# ART may introduce new sysprops. SELinux denials due to reading new sysprops on
+# old platforms shouldn't be regarded as a problem.
+dontaudit domain future_pm_prop:file read;
+
+neverallow { domain -init } aac_drc_prop:property_service set;
+neverallow { domain -init } build_prop:property_service set;
+neverallow { domain -init } userdebug_or_eng_prop:property_service set;
+
+# Do not allow reading device's serial number from system properties except form
+# a few allowed domains.
+neverallow {
+ domain
+ -adbd
+ -adbd_tradeinmode
+ -dumpstate
+ -fastbootd
+ -hal_camera_server
+ -hal_cas_server
+ -hal_drm_server
+ -hal_keymint_server
+ userdebug_or_eng(`-incidentd')
+ -init
+ -mediadrmserver
+ -mediaserver
+ -recovery
+ -shell
+ -system_server
+ -vendor_init
+} serialno_prop:file r_file_perms;
+
+neverallow {
+ domain
+ -init
+ -recovery
+ -system_server
+ -ueventd # Further restricted in ueventd.te
+} frp_block_device:blk_file no_rw_file_perms;
+
+# The metadata block device is set aside for device encryption and
+# verified boot metadata. It may be reset at will and should not
+# be used by other domains.
+neverallow {
+ domain
+ -init
+ -recovery
+ -vold
+ -e2fs
+ -fsck
+ -fastbootd
+ -hal_fastboot_server
+} metadata_block_device:blk_file { append link rename write open read ioctl lock };
+
+# No domain other than recovery, update_engine and fastbootd can write to system partition(s).
+neverallow {
+ domain
+ -fastbootd
+ userdebug_or_eng(`-fsck')
+ userdebug_or_eng(`-init')
+ -recovery
+ userdebug_or_eng(`-remount')
+ -update_engine
+} system_block_device:blk_file { write append };
+
+# Only (hw|vnd|)servicemanager should be able to register with binder as the context manager
+neverallow { domain -servicemanager -hwservicemanager -vndservicemanager } *:binder set_context_mgr;
+# The service managers are only allowed to access their own device node
+neverallow servicemanager hwbinder_device:chr_file no_rw_file_perms;
+neverallow servicemanager vndbinder_device:chr_file no_rw_file_perms;
+neverallow hwservicemanager binder_device:chr_file no_rw_file_perms;
+neverallow hwservicemanager vndbinder_device:chr_file no_rw_file_perms;
+neverallow vndservicemanager binder_device:chr_file no_rw_file_perms;
+neverallow vndservicemanager hwbinder_device:chr_file no_rw_file_perms;
+
+full_treble_only(`
+ # Vendor apps are permited to use only stable public services. If they were to use arbitrary
+ # services which can change any time framework/core is updated, breakage is likely.
+ #
+ # Note, this same logic applies to untrusted apps, but neverallows for these are separate.
+ neverallow {
+ appdomain
+ -coredomain
+ } {
+ service_manager_type
+
+ -app_api_service
+ -ephemeral_app_api_service
+
+ -hal_service_type # see app_neverallows.te
+
+ -apc_service
+ -audioserver_service # TODO(b/36783122) remove exemptions below once app_api_service is fixed
+ -cameraserver_service
+ -drmserver_service
+ -credstore_service
+ -keystore_maintenance_service
+ -keystore_service
+ -legacykeystore_service
+ -mediadrmserver_service
+ -mediaextractor_service
+ -mediametrics_service
+ -mediaserver_service
+ -nfc_service
+ -radio_service
+ -virtual_touchpad_service
+ -vr_manager_service
+ userdebug_or_eng(`-hal_face_service')
+ }:service_manager find;
+')
+
+# On full TREBLE devices, only vendor components, shell, and su can use VendorBinder.
+full_treble_only(`
+ neverallow {
+ coredomain
+ -shell
+ userdebug_or_eng(`-su')
+ -ueventd # uevent is granted create for this device, but we still neverallow I/O below
+ } vndbinder_device:chr_file rw_file_perms;
+')
+full_treble_only(`
+ neverallow ueventd vndbinder_device:chr_file { read write append ioctl };
+')
+full_treble_only(`
+ neverallow {
+ coredomain
+ -shell
+ userdebug_or_eng(`-su')
+ } vndservice_manager_type:service_manager *;
+')
+full_treble_only(`
+ neverallow {
+ coredomain
+ -shell
+ userdebug_or_eng(`-su')
+ } vndservicemanager:binder *;
+')
+
+# On full TREBLE devices, socket communications between core components and vendor components are
+# not permitted.
+ # Most general rules first, more specific rules below.
+
+ # Core domains are not permitted to initiate communications to vendor domain sockets.
+ # We are not restricting the use of already established sockets because it is fine for a process
+ # to obtain an already established socket via some public/official/stable API and then exchange
+ # data with its peer over that socket. The wire format in this scenario is dicatated by the API
+ # and thus does not break the core-vendor separation.
+full_treble_only(`
+ neverallow_establish_socket_comms({
+ coredomain
+ -init
+ -adbd
+ }, {
+ domain
+ -coredomain
+ -socket_between_core_and_vendor_violators
+ });
+')
+
+ # Vendor domains are not permitted to initiate create/open sockets owned by core domains
+full_treble_only(`
+ neverallow {
+ domain
+ -coredomain
+ -appdomain # appdomain restrictions below
+ -data_between_core_and_vendor_violators # b/70393317
+ -socket_between_core_and_vendor_violators
+ -vendor_init
+ } {
+ coredomain_socket
+ core_data_file_type
+ unlabeled # used only by core domains
+ }:sock_file ~{ append getattr ioctl read write };
+')
+full_treble_only(`
+ neverallow {
+ appdomain
+ -coredomain
+ } {
+ coredomain_socket
+ unlabeled # used only by core domains
+ core_data_file_type
+ -app_data_file
+ -privapp_data_file
+ -pdx_endpoint_socket_type # used by VR layer
+ -pdx_channel_socket_type # used by VR layer
+ }:sock_file ~{ append getattr ioctl read write };
+')
+
+ # Core domains are not permitted to create/open sockets owned by vendor domains
+full_treble_only(`
+ neverallow {
+ coredomain
+ -init
+ -ueventd
+ -socket_between_core_and_vendor_violators
+ } {
+ file_type
+ dev_type
+ -coredomain_socket
+ -core_data_file_type
+ -app_data_file_type
+ -unlabeled
+ }:sock_file ~{ append getattr ioctl read write };
+')
+
+# On TREBLE devices, vendor and system components are only allowed to share
+# files by passing open FDs over hwbinder. Ban all directory access and all file
+# accesses other than what can be applied to an open FD such as
+# ioctl/stat/read/write/append. This is enforced by segregating /data.
+# Vendor domains may directly access file in /data/vendor by path, but may only
+# access files outside of /data/vendor via an open FD passed over hwbinder.
+# Likewise, core domains may only directly access files outside /data/vendor by
+# path and files in /data/vendor by open FD.
+full_treble_only(`
+ # only coredomains may only access core_data_file_type, particularly not
+ # /data/vendor
+ neverallow {
+ coredomain
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+ -data_between_core_and_vendor_violators
+ -init
+ -vold_prepare_subdirs
+ } {
+ data_file_type
+ -core_data_file_type
+ -app_data_file_type
+ }:file_class_set ~{ append getattr ioctl read write map };
+')
+full_treble_only(`
+ neverallow {
+ coredomain
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+ -data_between_core_and_vendor_violators
+ -init
+ -vold_prepare_subdirs
+ } {
+ data_file_type
+ -core_data_file_type
+ -app_data_file_type
+ # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
+ # neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+ }:dir *;
+
+')
+full_treble_only(`
+ # vendor domains may only access files in /data/vendor, never core_data_file_types
+ neverallow {
+ domain
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+ -coredomain
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+ -vendor_init
+ } {
+ core_data_file_type
+ with_native_coverage(`-method_trace_data_file')
+ }:file_class_set ~{ append getattr ioctl read write map };
+ neverallow {
+ vendor_init
+ -data_between_core_and_vendor_violators
+ } {
+ core_data_file_type
+ -unencrypted_data_file
+ with_native_coverage(`-method_trace_data_file')
+ }:file_class_set ~{ append getattr ioctl read write map };
+ # vendor init needs to be able to read unencrypted_data_file to create directories with FBE.
+ # The vendor init binary lives on the system partition so there is not a concern with stability.
+ neverallow vendor_init unencrypted_data_file:file ~r_file_perms;
+')
+full_treble_only(`
+ # vendor domains may only access dirs in /data/vendor, never core_data_file_types
+ neverallow {
+ domain
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+ -coredomain
+ -data_between_core_and_vendor_violators
+ -vendor_init
+ } {
+ core_data_file_type
+ -system_data_file # default label for files on /data. Covered below...
+ -system_data_root_file
+ -vendor_userdir_file
+ -vendor_data_file
+ with_native_coverage(`-method_trace_data_file')
+ }:dir *;
+ neverallow {
+ vendor_init
+ -data_between_core_and_vendor_violators
+ } {
+ core_data_file_type
+ -unencrypted_data_file
+ -system_data_file
+ -system_data_root_file
+ -vendor_userdir_file
+ -vendor_data_file
+ with_native_coverage(`-method_trace_data_file')
+ }:dir *;
+ # vendor init needs to be able to read unencrypted_data_file to create directories with FBE.
+ # The vendor init binary lives on the system partition so there is not a concern with stability.
+ neverallow vendor_init unencrypted_data_file:dir ~search;
+')
+full_treble_only(`
+ # vendor domains may only access dirs in /data/vendor, never core_data_file_types
+ neverallow {
+ domain
+ -appdomain # TODO(b/34980020) remove exemption for appdomain
+ -coredomain
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+ } {
+ system_data_file # default label for files on /data. Covered below
+ }:dir ~{ getattr search };
+')
+
+full_treble_only(`
+ # coredomains may not access dirs in /data/vendor.
+ neverallow {
+ coredomain
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+ -init
+ -vold # vold creates per-user storage for both system and vendor
+ -vold_prepare_subdirs
+ } {
+ vendor_data_file # default label for files on /data. Covered below
+ }:dir ~{ getattr search };
+')
+
+full_treble_only(`
+ # coredomains may not access dirs in /data/vendor.
+ neverallow {
+ coredomain
+ -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
+ -init
+ } {
+ vendor_data_file # default label for files on /data/vendor{,_ce,_de}.
+ }:file_class_set ~{ append getattr ioctl read write map };
+')
+
+full_treble_only(`
+ # Non-vendor domains are not allowed to file execute shell
+ # from vendor
+ neverallow {
+ coredomain
+ -init
+ -shell
+ -ueventd
+ } vendor_shell_exec:file { execute execute_no_trans };
+')
+
+full_treble_only(`
+ # Do not allow vendor components to execute files from system
+ # except for the ones allowed here.
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_executes_system_violators
+ -vendor_init
+ } {
+ system_file_type
+ -system_lib_file
+ -system_bootstrap_lib_file
+ -system_linker_exec
+ -crash_dump_exec
+ -netutils_wrapper_exec
+ userdebug_or_eng(`-tcpdump_exec')
+ # Vendor components still can invoke shell commands via /system/bin/sh
+ -shell_exec
+ -toolbox_exec
+ -virtualizationmanager_exec
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr_exec')
+ }:file { entrypoint execute execute_no_trans };
+')
+
+full_treble_only(`
+ # Do not allow coredomain to access entrypoint for files other
+ # than system_file_type and postinstall_file
+ neverallow coredomain {
+ file_type
+ -system_file_type
+ -postinstall_file
+ }:file entrypoint;
+ # Do not allow domains other than coredomain to access entrypoint
+ # for anything but vendor_file_type and init_exec for vendor_init.
+ neverallow { domain -coredomain } {
+ file_type
+ -vendor_file_type
+ -init_exec
+ }:file entrypoint;
+')
+
+full_treble_only(`
+ # Do not allow system components to execute files from vendor
+ # except for the ones allowed here.
+ neverallow {
+ coredomain
+ -init
+ -shell
+ -system_executes_vendor_violators
+ -ueventd
+ } {
+ vendor_file_type
+ -same_process_hal_file
+ -vndk_sp_file
+ -vendor_app_file
+ -vendor_public_framework_file
+ -vendor_public_lib_file
+ }:file execute;
+')
+
+full_treble_only(`
+ neverallow {
+ coredomain
+ -shell
+ -system_executes_vendor_violators
+ } {
+ vendor_file_type
+ -same_process_hal_file
+ }:file execute_no_trans;
+')
+
+full_treble_only(`
+ # Do not allow vendor components access to /system files except for the
+ # ones allowed here.
+ neverallow {
+ domain
+ -appdomain
+ -coredomain
+ -vendor_executes_system_violators
+ # vendor_init needs access to init_exec for domain transition. vendor_init
+ # neverallows are covered in public/vendor_init.te
+ -vendor_init
+ } {
+ system_file_type
+ -cgroup_desc_file
+ -crash_dump_exec
+ -file_contexts_file
+ -netutils_wrapper_exec
+ -property_contexts_file
+ -system_event_log_tags_file
+ -system_group_file
+ -system_lib_file
+ -system_bootstrap_lib_file
+ with_asan(`-system_asan_options_file')
+ -system_linker_exec
+ -system_linker_config_file
+ -system_passwd_file
+ -system_seccomp_policy_file
+ -system_security_cacerts_file
+ -system_zoneinfo_file
+ -task_profiles_file
+ userdebug_or_eng(`-tcpdump_exec')
+ # Vendor components still can invoke shell commands via /system/bin/sh
+ -shell_exec
+ -toolbox_exec
+ -virtualizationmanager_exec
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr_exec')
+ }:file *;
+')
+
+# Only system_server should be able to send commands via the zygote socket
+neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
+neverallow { domain -system_server } zygote_socket:sock_file write;
+
+neverallow { domain -system_server -webview_zygote -app_zygote } webview_zygote:unix_stream_socket connectto;
+neverallow { domain -system_server } webview_zygote:sock_file write;
+neverallow { domain -system_server } app_zygote:sock_file write;
+
+neverallow domain tombstoned_crash_socket:unix_stream_socket connectto;
+
+# Never allow anyone except dumpstate, incidentd, or the system server to connect or write to
+# the tombstoned intercept socket.
+neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:sock_file write;
+neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:unix_stream_socket connectto;
+
+# Never allow anyone but system_server to read heapdumps in /data/system/heapdump.
+neverallow { domain -init -system_server } heapdump_data_file:file read;
+
+# Android does not support System V IPCs.
+#
+# The reason for this is due to the fact that, by design, they lead to global
+# kernel resource leakage.
+#
+# For example, there is no way to automatically release a SysV semaphore
+# allocated in the kernel when:
+#
+# - a buggy or malicious process exits
+# - a non-buggy and non-malicious process crashes or is explicitly killed.
+#
+# Killing processes automatically to make room for new ones is an
+# important part of Android's application lifecycle implementation. This means
+# that, even assuming only non-buggy and non-malicious code, it is very likely
+# that over time, the kernel global tables used to implement SysV IPCs will fill
+# up.
+neverallow * *:{ shm sem msg msgq } *;
+
+# Do not mount on top of symlinks, fifos, or sockets.
+# Feature parity with Chromium LSM.
+neverallow * { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
+
+# Nobody should be able to execute su on user builds.
+# On userdebug/eng builds, only dumpstate, shell, and
+# su itself execute su.
+neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
+
+# Do not allow the introduction of new execmod rules. Text relocations
+# and modification of executable pages are unsafe.
+# The only exceptions are for NDK text relocations associated with
+# https://code.google.com/p/android/issues/detail?id=23203
+# which, long term, need to go away.
+neverallow * {
+ file_type
+ -apk_data_file
+ -app_data_file
+ -asec_public_file
+}:file execmod;
+
+# Do not allow making the stack or heap executable.
+# We would also like to minimize execmem but it seems to be
+# required by some device-specific service domains.
+neverallow * self:process { execstack execheap };
+
+# Do not allow the introduction of new execmod rules. Text relocations
+# and modification of executable pages are unsafe.
+neverallow { domain -untrusted_app_25 -untrusted_app_27 } file_type:file execmod;
+
+# Ensure that all types assigned to processes are included
+# in the domain attribute, so that all allow and neverallow rules
+# written on domain are applied to all processes.
+# This is achieved by ensuring that it is impossible to transition
+# from a domain to a non-domain type and vice versa.
+# TODO - rework this: neverallow domain ~domain:process { transition dyntransition };
+neverallow ~domain domain:process { transition dyntransition };
+
+#
+# Only system_app and system_server should be creating or writing
+# their files. The proper way to share files is to setup
+# type transitions to a more specific type or assigning a type
+# to its parent directory via a file_contexts entry.
+# Example type transition:
+# mydomain.te:file_type_auto_trans(mydomain, system_data_file, new_file_type)
+#
+neverallow {
+ domain
+ -system_server
+ -system_app
+ -init
+ -toolbox # TODO(b/141108496) We want to remove toolbox
+ -installd # for relabelfrom and unlink, check for this in explicit neverallow
+ -vold_prepare_subdirs # For unlink
+ with_asan(`-asan_extract')
+} system_data_file:file no_w_file_perms;
+# do not grant anything greater than r_file_perms and relabelfrom unlink
+# to installd
+neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
+
+#
+# Only these domains should transition to shell domain. This domain is
+# permissible for the "shell user". If you need a process to exec a shell
+# script with differing privilege, define a domain and set up a transition.
+#
+neverallow {
+ domain
+ -adbd
+ -init
+ -runas
+ -zygote
+} shell:process { transition dyntransition };
+
+# Only domains spawned from zygote, runas and simpleperf_app_runner may have
+# the appdomain attribute.
+#
+# simpleperf is excluded as a domain transitioned to when running an app-scoped
+# profiling session.
+#
+# tradeinmode is excluded; it is only run when adbd is in trade-in mode,
+# transitioned from the limited adbd_tradeinmode context. It is a wrapper
+# around "am" to avoid exposing the shell context when adbd is in trade-in
+# mode.
+neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
+ appdomain -shell -simpleperf userdebug_or_eng(`-su') -tradeinmode
+}:process { transition dyntransition };
+
+# Minimize read access to shell- or app-writable symlinks.
+# This is to prevent malicious symlink attacks.
+neverallow {
+ domain
+ -appdomain
+ -artd
+ -installd
+} { app_data_file privapp_data_file }:lnk_file read;
+
+neverallow {
+ domain
+ -shell
+ userdebug_or_eng(`-uncrypt')
+ -installd
+} shell_data_file:lnk_file read;
+
+# servicemanager and vndservicemanager are the only processes which handle the
+# service_manager list request
+neverallow * ~{
+ servicemanager
+ vndservicemanager
+ }:service_manager list;
+
+# hwservicemanager is the only process which handles hw list requests
+neverallow * ~{
+ hwservicemanager
+ }:hwservice_manager list;
+
+# only service_manager_types can be added to service_manager
+# TODO - rework this: neverallow * ~service_manager_type:service_manager { add find };
+
+# Prevent assigning non property types to properties
+# TODO - rework this: neverallow * ~property_type:property_service set;
+
+# Domain types should never be assigned to any files other
+# than the /proc/pid files associated with a process. The
+# executable file used to enter a domain should be labeled
+# with its own _exec type, not with the domain type.
+# Conventionally, this looks something like:
+# $ cat mydaemon.te
+# type mydaemon, domain;
+# type mydaemon_exec, exec_type, file_type;
+# init_daemon_domain(mydaemon)
+# $ grep mydaemon file_contexts
+# /system/bin/mydaemon -- u:object_r:mydaemon_exec:s0
+neverallow * domain:file { execute execute_no_trans entrypoint };
+
+# Do not allow access to the generic debugfs label. This is too broad.
+# Instead, if access to part of debugfs is desired, it should have a
+# more specific label.
+# TODO: fix dumpstate
+neverallow { domain -init -vendor_init -dumpstate } debugfs:{ file lnk_file } no_rw_file_perms;
+
+# Do not allow executable files in debugfs.
+neverallow domain debugfs_type:file { execute execute_no_trans };
+
+# Don't allow access to the FUSE control filesystem, except to vold and init's
+neverallow { domain -vold -init -vendor_init } fusectlfs:file no_rw_file_perms;
+
+# Profiles contain untrusted data and profman parses that. We should only run
+# it from installd and artd forked processes.
+neverallow {
+ domain
+ -installd
+ -profman
+ -artd
+} profman_exec:file no_x_file_perms;
+
+# Enforce restrictions on kernel module origin.
+# Do not allow kernel module loading except from system,
+# vendor, boot, and system_dlkm partitions.
+# TODO(b/218951883): Remove usage of system and rootfs as origin
+neverallow * ~{ system_file_type vendor_file_type rootfs system_dlkm_file_type }:system module_load;
+
+# Only allow filesystem caps to be set at build time. Runtime changes
+# to filesystem capabilities are not permitted.
+neverallow * self:global_capability_class_set setfcap;
+
+# Enforce AT_SECURE for executing crash_dump.
+neverallow domain crash_dump:process noatsecure;
+
+# Do not permit non-core domains to register HwBinder services which are
+# guaranteed to be provided by core domains only.
+neverallow ~coredomain coredomain_hwservice:hwservice_manager add;
+
+# Do not permit the registeration of HwBinder services which are guaranteed to
+# be passthrough only (i.e., run in the process of their clients instead of a
+# separate server process).
+neverallow * same_process_hwservice:hwservice_manager add;
+
+# If an already existing file is opened with O_CREAT, the kernel might generate
+# a false report of a create denial. Silence these denials and make sure that
+# inappropriate permissions are not granted.
+
+# These filesystems don't allow files or directories to be created, so the permission
+# to do so should never be granted.
+neverallow domain {
+ proc_type
+ sysfs_type
+}:dir { add_name create link remove_name rename reparent rmdir write };
+
+# cgroupfs directories can be created, but not files within them.
+neverallow domain cgroup:file create;
+neverallow domain cgroup_v2:file create;
+
+dontaudit domain proc_type:dir write;
+dontaudit domain sysfs_type:dir write;
+dontaudit domain cgroup:file create;
+dontaudit domain cgroup_v2:file create;
+
+# These are only needed in permissive mode - in enforcing mode the
+# directory write check fails and so these are never attempted.
+userdebug_or_eng(`
+ dontaudit domain proc_type:dir add_name;
+ dontaudit domain sysfs_type:dir add_name;
+ dontaudit domain proc_type:file create;
+ dontaudit domain sysfs_type:file create;
+')
+
+# Platform must not have access to /mnt/vendor.
+neverallow {
+ coredomain
+ -init
+ -ueventd
+ -vold
+ -system_writes_mnt_vendor_violators
+} mnt_vendor_file:dir *;
+
+# Only apps are allowed access to vendor public libraries.
+full_treble_only(`
+ neverallow {
+ coredomain
+ -appdomain
+ } {vendor_public_framework_file vendor_public_lib_file}:file { execute execute_no_trans };
+')
+
+# Vendor domian must not have access to /mnt/product.
+neverallow {
+ domain
+ -coredomain
+} mnt_product_file:dir *;
+
+# Platform must not have access to sysfs_batteryinfo, but should do it via health HAL
+full_treble_only(`
+ neverallow {
+ coredomain
+ -shell
+ # For access to block device information under /sys/class/block.
+ -apexd
+ # Read sysfs block device information.
+ -init
+ # Generate uevents for health info
+ -ueventd
+ # Recovery uses health HAL passthrough implementation.
+ -recovery
+ # Charger uses health HAL passthrough implementation.
+ -charger
+ # TODO(b/110891300): remove this exception
+ -incidentd
+ } sysfs_batteryinfo:file { open read };
+')
+
+neverallow {
+ domain
+ -hal_codec2_server
+ -hal_omx_server
+} hal_codec2_hwservice:hwservice_manager add;
+
+# Only apps targetting < Q are allowed to open /dev/ashmem directly.
+# Apps must use ASharedMemory NDK API. Native code must use libcutils API.
+neverallow {
+ domain
+ -ephemeral_app # We don't distinguish ephemeral apps based on target API.
+ -untrusted_app_25
+ -untrusted_app_27
+} ashmem_device:chr_file open;
+
+neverallow { domain -traced_probes -init -vendor_init } debugfs_tracing_printk_formats:file *;
+
+# No domains other than a select few can access the misc_block_device. This
+# block device is reserved for OTA use.
+# Do not assert this rule on userdebug/eng builds, due to some devices using
+# this partition for testing purposes.
+neverallow {
+ domain
+ userdebug_or_eng(`-domain') # exclude debuggable builds
+ -fastbootd
+ -hal_bootctl_server
+ -init
+ -uncrypt
+ -update_engine
+ -vendor_init
+ -vendor_misc_writer
+ -vold
+ -recovery
+ -ueventd
+ -mtectrl
+ -misctrl
+ -kcmdlinectrl
+} misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
+
+# Limit ability to ptrace or read sensitive /proc/pid files of processes
+# with other UIDs to these allowlisted domains.
+neverallow {
+ domain
+ -vold
+ userdebug_or_eng(`-llkd')
+ -dumpstate
+ userdebug_or_eng(`-incidentd')
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+ -storaged
+ -system_server
+} self:global_capability_class_set sys_ptrace;
+
+# Limit ability to generate hardware unique device ID attestations to priv_apps
+neverallow { domain -priv_app -gmscore_app } *:keystore2_key gen_unique_id;
+neverallow { domain -system_server } *:keystore2_key use_dev_id;
+neverallow { domain -system_server } keystore:keystore2 { clear_ns lock reset unlock };
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ userdebug_or_eng(`-domain')
+} debugfs_tracing_debug:file no_rw_file_perms;
+
+# System_server owns dropbox data, and init creates/restorecons the directory
+# Disallow direct access by other processes.
+neverallow {
+ domain
+ -init
+ -system_server
+ userdebug_or_eng(`-dumpstate')
+} dropbox_data_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_server
+ userdebug_or_eng(`-dumpstate')
+} dropbox_data_file:file ~{ getattr read };
+
+###
+# Services should respect app sandboxes
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd # creation of sandbox
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir_file_class_set { create unlink };
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ domain
+ -artd # compile secondary dex files
+ -installd # creation of sandbox
+ -vold_prepare_subdirs # creation of storage area directories
+ } {storage_area_app_dir storage_area_dir }:dir { create unlink };
+')
+
+# Only the following processes should be directly accessing private app
+# directories.
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -app_zygote
+ -artd # compile secondary dex files
+ -installd
+ -profman
+ -rs # spawned by appdomain, so carryover the exception above
+ -runas
+ -system_server
+ -zygote
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir *;
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ domain
+ -appdomain
+ -app_zygote
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+ -system_server
+ -vold # encryption of storage area directories
+ -vold_prepare_subdirs # creation of storage area directories
+ -zygote
+ } { storage_area_dir storage_area_app_dir }:dir *;
+')
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ # only vold and installd can access the storage area key files
+ # (and init, in case of a recursive restorecon)
+ neverallow {
+ domain
+ -init
+ -vold
+ -vold_prepare_subdirs
+ -installd
+ } { storage_area_key_file }:dir_file_class_set *;
+')
+
+# Only apps should be modifying app data. installd is exempted for
+# restorecon and package install/uninstall.
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir ~r_dir_perms;
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+ -vold_prepare_subdirs # creation of storage area directories
+ } { storage_area_dir storage_area_app_dir }:dir ~r_dir_perms;
+')
+
+neverallow {
+ domain
+ -appdomain
+ -app_zygote
+ -artd # compile secondary dex files
+ -installd
+ -rs # spawned by appdomain, so carryover the exception above
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:file_class_set open;
+
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -installd # creation of sandbox
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir_file_class_set { create unlink };
+
+neverallow {
+ domain
+ -artd # compile secondary dex files
+ -installd
+} {
+ privapp_data_file
+ app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir_file_class_set { relabelfrom relabelto };
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ domain
+ -artd # compile secondary dex files
+ -installd
+ -vold_prepare_subdirs
+ } { storage_area_dir storage_area_app_dir }:dir { relabelfrom relabelto };
+')
+
+# The staging directory contains APEX and APK files. It is important to ensure
+# that these files cannot be accessed by other domains to ensure that the files
+# do not change between system_server staging the files and apexd processing
+# the files.
+# The update_provider can also stage files before apexd processes them.
+neverallow {
+ domain
+ -init
+ -system_server
+ -apexd
+ -installd
+ -priv_app
+ -virtualizationmanager
+ -update_provider # WARNING: USING THIS ATTRIBUTE WILL CAUSE CTS TO FAIL!
+} staging_data_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_app
+ -system_server
+ -apexd
+ -adbd
+ -kernel
+ -installd
+ -priv_app
+ -shell
+ -virtualizationmanager
+ -crosvm
+ -update_provider # WARNING: USING THIS ATTRIBUTE WILL CAUSE CTS TO FAIL!
+} staging_data_file:file *;
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -system_server -installd -update_provider } staging_data_file:dir no_w_dir_perms;
+# apexd needs the link/unlink/rename permissions
+# WARNING: USING THE update_provider ATTRIBUTE WILL CAUSE CTS TO FAIL!
+neverallow { domain -init -system_server -installd -apexd -update_provider } staging_data_file:file {
+ no_w_file_perms no_x_file_perms
+};
+neverallow apexd staging_data_file:file {
+ append create relabelfrom setattr write # no_w_file_perms -link -unlink -rename
+ no_x_file_perms
+};
+
+neverallow {
+ domain
+ -appdomain # for oemfs
+ -bootanim # for oemfs
+ -recovery # for /tmp/update_binary in tmpfs
+} { fs_type -rootfs }:file execute;
+
+#
+# Assert that, to the extent possible, we're not loading executable content from
+# outside the rootfs or /system partition except for a few allowlisted domains.
+# Executable files loaded from /data is a persistence vector
+# we want to avoid. See
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
+#
+neverallow {
+ domain
+ -appdomain
+ with_asan(`-asan_extract')
+ -shell
+ userdebug_or_eng(`-su')
+ -system_server_startup # for memfd backed executable regions
+ -app_zygote
+ -webview_zygote
+ -zygote
+ userdebug_or_eng(`-mediaextractor')
+ userdebug_or_eng(`-mediaswcodec')
+} {
+ file_type
+ -system_file_type
+ -system_lib_file
+ -system_bootstrap_lib_file
+ -system_linker_exec
+ -vendor_file_type
+ -exec_type
+ -postinstall_file
+}:file execute;
+
+# Only init is allowed to write cgroup.rc file
+neverallow {
+ domain
+ -init
+ -vendor_init
+} cgroup_rc_file:file no_w_file_perms;
+
+# Only authorized processes should be writing to files in /data/dalvik-cache
+neverallow {
+ domain
+ -init # TODO: limit init to relabelfrom for files
+ -zygote
+ -installd
+ -postinstall_dexopt
+ -cppreopts
+ -dex2oat
+ -otapreopt_slot
+ -artd
+} dalvikcache_data_file:file no_w_file_perms;
+
+neverallow {
+ domain
+ -init
+ -installd
+ -postinstall_dexopt
+ -cppreopts
+ -dex2oat
+ -zygote
+ -otapreopt_slot
+ -artd
+} dalvikcache_data_file:dir no_w_dir_perms;
+
+# Only authorized processes should be writing to /data/misc/apexdata/com.android.art as it
+# contains boot class path and system server AOT artifacts following an ART APEX Mainline update.
+neverallow {
+ domain
+ # art-related processes
+ -composd
+ -compos_fd_server
+ -odrefresh
+ -odsign
+ # others
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_art_data_file:file no_w_file_perms;
+
+neverallow {
+ domain
+ # art-related processes
+ -composd
+ -compos_fd_server
+ -odrefresh
+ -odsign
+ # others
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_art_data_file:dir no_w_dir_perms;
+
+# Protect most domains from executing arbitrary content from /data.
+neverallow {
+ domain
+ -appdomain
+} {
+ data_file_type
+ -apex_art_data_file
+ -dalvikcache_data_file
+ -system_data_file # shared libs in apks
+ -apk_data_file
+}:file no_x_file_perms;
+
+# Minimize dac_override and dac_read_search.
+# Instead of granting them it is usually better to add the domain to
+# a Unix group or change the permissions of a file.
+define(`dac_override_allowed', `{
+ apexd
+ artd
+ dnsmasq
+ dumpstate
+ init
+ installd
+ userdebug_or_eng(`llkd')
+ lmkd
+ migrate_legacy_obb_data
+ netd
+ postinstall_dexopt
+ recovery
+ rss_hwm_reset
+ sdcardd
+ tee
+ ueventd
+ uncrypt
+ vendor_init
+ vold
+ vold_prepare_subdirs
+ zygote
+}')
+neverallow ~dac_override_allowed self:global_capability_class_set dac_override;
+# Since the kernel checks dac_read_search before dac_override, domains that
+# have dac_override should also have dac_read_search to eliminate spurious
+# denials. Some domains have dac_read_search without having dac_override, so
+# this list should be a superset of the one above.
+neverallow ~{
+ dac_override_allowed
+ traced_perf
+ traced_probes
+ heapprofd
+} self:global_capability_class_set dac_read_search;
+
+# Limit what domains can mount filesystems or change their mount flags.
+# sdcard_type (including vfat and exfat) and fusefs_type are exempt as a larger
+# set of domains need this capability, including device-specific domains.
+neverallow {
+ domain
+ -apexd
+ -dexopt_chroot_setup
+ recovery_only(`-fastbootd')
+ -init
+ -kernel
+ -otapreopt_chroot
+ -recovery
+ -update_engine
+ -vold
+ -zygote
+} { fs_type
+ -sdcard_type
+ -fusefs_type
+}:filesystem { mount remount relabelfrom relabelto };
+
+enforce_debugfs_restriction(`
+ neverallow {
+ domain userdebug_or_eng(`-init')
+ } { debugfs_type -debugfs_tracing_debug }:filesystem { mount remount relabelfrom relabelto };
+')
+
+# Limit raw I/O to these allowlisted domains. Do not apply to debug builds.
+neverallow {
+ domain
+ userdebug_or_eng(`-domain')
+ -kernel
+ -gsid
+ -init
+ -recovery
+ -ueventd
+ -uncrypt
+ -tee
+ -hal_bootctl_server
+ -fastbootd
+} self:global_capability_class_set sys_rawio;
+
+# Limit directory operations that doesn't need to do app data isolation.
+neverallow {
+ domain
+ -fsck
+ -init
+ -installd
+ -zygote
+} mirror_data_file:dir *;
+
+# This property is being removed. Remove remaining access.
+neverallow { domain -init -system_server -vendor_init } net_dns_prop:property_service set;
+neverallow { domain -dumpstate -init -system_server -vendor_init } net_dns_prop:file read;
+
+# Only core domains are allowed to access package_manager properties
+neverallow { domain -init -system_server } pm_prop:property_service set;
+neverallow { domain -coredomain } pm_prop:file no_rw_file_perms;
+
+# Do not allow reading the last boot timestamp from system properties
+neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
+
+# Allow ART to set its config properties in its oneshot boot service, in
+# addition to the common init and vendor_init access.
+neverallow { domain -art_boot -init -vendor_init } dalvik_config_prop:property_service set;
+
+# Kprobes should only be used by adb root
+neverallow { domain -init -vendor_init } debugfs_kprobes:file *;
+
+# On TREBLE devices, most coredomains should not access vendor_files.
+# TODO(b/71553434): Remove exceptions here.
+full_treble_only(`
+ neverallow {
+ coredomain
+ -appdomain
+ -bootanim
+ -crash_dump
+ -heapprofd
+ userdebug_or_eng(`-profcollectd')
+ -init
+ -kernel
+ userdebug_or_eng(`-simpleperf_boot')
+ -traced_perf
+ -ueventd
+ } vendor_file:file { no_w_file_perms no_x_file_perms open };
+')
+
+# Vendor domains are not permitted to initiate communications to core domain sockets
+full_treble_only(`
+ neverallow_establish_socket_comms({
+ domain
+ -coredomain
+ -appdomain
+ -socket_between_core_and_vendor_violators
+ }, {
+ coredomain
+ -logd # Logging by writing to logd Unix domain socket is public API
+ -netd # netdomain needs this
+ -mdnsd # netdomain needs this
+ -prng_seeder # Any process using libcrypto needs this
+ userdebug_or_eng(`-su') # communications with su are permitted only on userdebug or eng builds
+ -init
+ -tombstoned # linker to tombstoned
+ -heapprofd
+ -traced
+ -traced_perf
+ });
+')
+
+full_treble_only(`
+ # Do not allow system components access to /vendor files except for the
+ # ones allowed here.
+ neverallow {
+ coredomain
+ # TODO(b/37168747): clean up fwk access to /vendor
+ -crash_dump
+ -crosvm # loads vendor-specific disk images
+ -init # starts vendor executables
+ -kernel # loads /vendor/firmware
+ -heapprofd
+ userdebug_or_eng(`-profcollectd')
+ -shell
+ userdebug_or_eng(`-simpleperf_boot')
+ -system_executes_vendor_violators
+ -traced_perf # library/binary access for symbolization
+ -ueventd # reads /vendor/ueventd.rc
+ -vold # loads incremental fs driver
+ } {
+ vendor_file_type
+ -same_process_hal_file
+ -vendor_app_file
+ -vendor_apex_file
+ -vendor_apex_metadata_file
+ -vendor_boot_ota_file
+ -vendor_cgroup_desc_file
+ -vendor_configs_file
+ -vendor_microdroid_file
+ -vendor_service_contexts_file
+ -vendor_framework_file
+ -vendor_idc_file
+ -vendor_keychars_file
+ -vendor_keylayout_file
+ -vendor_overlay_file
+ -vendor_public_framework_file
+ -vendor_public_lib_file
+ -vendor_task_profiles_file
+ -vendor_uuid_mapping_config_file
+ -vndk_sp_file
+ -vendor_aconfig_storage_file
+ }:file *;
+')
+
+# mlsvendorcompat is only for compatibility support for older vendor
+# images, and should not be granted to any domain in current policy.
+# (Every domain is allowed self:fork, so this will trigger if the
+# intsersection of domain & mlsvendorcompat is not empty.)
+neverallow domain mlsvendorcompat:process fork;
+
+# Only init and otapreopt_chroot should be mounting filesystems on locations
+# labeled system or vendor (/product and /vendor respectively).
+neverallow { domain -dexopt_chroot_setup -init -otapreopt_chroot } { system_file_type vendor_file_type }:dir_file_class_set mounton;
+
+# Only allow init and vendor_init to read/write mm_events properties
+# NOTE: dumpstate is allowed to read any system property
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+} mm_events_config_prop:file no_rw_file_perms;
+
+# Allow init to open /proc/kallsyms while kernel address mappings are still
+# visible, and later share it with tracing daemons (traced_probes,
+# traced_perf). These daemons are allowed to read from the shared fd, but also
+# to separately open the file (which will always have zeroed out addresses due
+# to init raising kptr_restrict) for locking to coordinate access to the shared
+# fd. The performance traces contain only the referenced kernel symbols, and
+# never the raw addresses (i.e. KASLR is not disclosed).
+# On debuggable builds, performance tools are allowed to open and read the file
+# directly because init is allowed to temporarily unrestrict systemwide address
+# visibility.
+neverallow {
+ domain
+ -init
+ -traced_probes
+ -traced_perf
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+} proc_kallsyms:file *;
+
+# debugfs_kcov type is not included in this neverallow statement since the KCOV
+# tool uses it for kernel fuzzing.
+# vendor_modprobe is also exempted since the kernel modules it loads may create
+# debugfs files in its context.
+enforce_debugfs_restriction(`
+ neverallow {
+ domain
+ -vendor_modprobe
+ userdebug_or_eng(`
+ -init
+ -hal_dumpstate
+ -incidentd
+ ')
+ } { debugfs_type
+ userdebug_or_eng(`-debugfs_kcov')
+ -tracefs_type
+ }:file no_rw_file_perms;
+')
+
+# Restrict write access to etm sysfs interface.
+neverallow { domain -ueventd -vendor_init } sysfs_devices_cs_etm:file no_w_file_perms;
+
+# Restrict CAP_PERFMON.
+neverallow {
+ domain
+ -init
+ -vendor_modprobe
+ userdebug_or_eng(`-simpleperf_boot')
+ -kernel
+ -uprobestats
+} self:capability2 perfmon;
+
+# Restrict direct access to shell owned files. The /data/local/tmp directory is
+# untrustworthy, and non-allowed domains should not be trusting any content in
+# those directories. We allow shell files to be passed around by file
+# descriptor, but not directly opened.
+# artd doesn't need to access /data/local/tmp, but it needs to access
+# /data/{user,user_de}/<user-id>/com.android.shell/... for compiling secondary
+# dex files.
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -installd
+ userdebug_or_eng(`-uncrypt')
+ userdebug_or_eng(`-virtualizationmanager')
+ userdebug_or_eng(`-virtualizationservice')
+ userdebug_or_eng(`-crosvm')
+} shell_data_file:file open;
+
+# In addition to the symlink reading restrictions above, restrict
+# write access to shell owned directories. The /data/local/tmp
+# directory is untrustworthy, and non-allowed domains should
+# not be trusting any content in those directories.
+# artd doesn't need to access /data/local/tmp, but it needs to access
+# /data/{user,user_de}/<user-id>/com.android.shell/... for compiling secondary
+# dex files.
+neverallow {
+ domain
+ -adbd
+ -artd
+ -dumpstate
+ -installd
+ -init
+ -shell
+ -vold
+} shell_data_file:dir no_w_dir_perms;
+
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -init
+ -installd
+ -simpleperf_app_runner
+ -system_server # why?
+ userdebug_or_eng(`-uncrypt')
+} shell_data_file:dir open;
+
+neverallow {
+ domain
+ -adbd
+ -appdomain
+ -artd
+ -dumpstate
+ -init
+ -installd
+ -simpleperf_app_runner
+ -system_server # why?
+ userdebug_or_eng(`-uncrypt')
+ userdebug_or_eng(`-virtualizationmanager')
+ userdebug_or_eng(`-crosvm')
+} shell_data_file:dir search;
+
+# respect system_app sandboxes
+neverallow {
+ domain
+ -appdomain
+ -artd # compile secondary dex files
+ -system_server #populate com.android.providers.settings/databases/settings.db.
+ -installd # creation of app sandbox
+ -traced_probes # resolve inodes for i/o tracing.
+ # only needs open and read, the rest is neverallow in
+ # traced_probes.te.
+} system_app_data_file:dir_file_class_set { create unlink open };
+neverallow {
+ isolated_app_all
+ ephemeral_app
+ priv_app
+ sdk_sandbox_all
+ untrusted_app_all
+} system_app_data_file:dir_file_class_set { create unlink open };
+
+neverallow { domain -init } mtectrl:process { dyntransition transition };
+neverallow { domain -init } kcmdlinectrl:process { dyntransition transition };
+
+# For now, don't allow processes other than gmscore to access /data/misc_ce/<userid>/checkin
+neverallow { domain -gmscore_app -init -vold_prepare_subdirs } checkin_data_file:{dir file} *;
+
+neverallow { domain -dexopt_chroot_setup -init } proc:{ file dir } mounton;
+neverallow { domain -dexopt_chroot_setup -init -zygote } proc_type:{ file dir } mounton;
+
+# Only init/vendor are allowed to write sysfs_pgsize_migration;
+# ueventd needs write access to all sysfs files.
+neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file no_w_file_perms;
+
+# We need to be able to rely on vsock labels, so disallow changing them.
+neverallow domain *:vsock_socket { relabelfrom relabelto };
diff --git a/prebuilts/api/202504/private/drmserver.te b/prebuilts/api/202504/private/drmserver.te
new file mode 100644
index 0000000..dfbf3b8
--- /dev/null
+++ b/prebuilts/api/202504/private/drmserver.te
@@ -0,0 +1,69 @@
+typeattribute drmserver coredomain;
+
+init_daemon_domain(drmserver)
+
+type_transition drmserver apk_data_file:sock_file drmserver_socket;
+
+typeattribute drmserver_socket coredomain_socket;
+
+get_prop(drmserver, drm_service_config_prop)
+
+typeattribute drmserver mlstrustedsubject;
+
+net_domain(drmserver)
+
+# Perform Binder IPC to system server.
+binder_use(drmserver)
+binder_call(drmserver, system_server)
+binder_call(drmserver, appdomain)
+binder_call(drmserver, mediametrics)
+binder_service(drmserver)
+# Inherit or receive open files from system_server.
+allow drmserver system_server:fd use;
+
+# Perform Binder IPC to mediaserver
+binder_call(drmserver, mediaserver)
+
+allow drmserver { sdcard_type fuse }:dir search;
+allow drmserver drm_data_file:dir create_dir_perms;
+allow drmserver drm_data_file:file create_file_perms;
+allow drmserver { app_data_file privapp_data_file }:file { read write getattr map };
+allow drmserver { sdcard_type fuse }:file { read write getattr map };
+r_dir_file(drmserver, efs_file)
+
+# /data/app/tlcd_sock socket file.
+# Clearly, /data/app is the most logical place to create a socket. Not.
+allow drmserver apk_data_file:dir rw_dir_perms;
+auditallow drmserver apk_data_file:dir { add_name write };
+allow drmserver drmserver_socket:sock_file create_file_perms;
+auditallow drmserver drmserver_socket:sock_file create;
+# Delete old socket file if present.
+allow drmserver apk_data_file:sock_file unlink;
+
+# After taking a video, drmserver looks at the video file.
+r_dir_file(drmserver, media_rw_data_file)
+
+# Read resources from open apk files passed over Binder.
+allow drmserver apk_data_file:file { read getattr map };
+allow drmserver asec_apk_file:file { read getattr map };
+allow drmserver ringtone_file:file { read getattr map };
+
+# Read /data/data/com.android.providers.telephony files passed over Binder.
+allow drmserver radio_data_file:file { read getattr map };
+
+# /oem access
+allow drmserver oemfs:dir search;
+allow drmserver oemfs:file r_file_perms;
+
+# overlay package access
+allow drmserver vendor_overlay_file:file { read map };
+
+add_service(drmserver, drmserver_service)
+allow drmserver permission_service:service_manager find;
+allow drmserver mediametrics_service:service_manager find;
+
+selinux_check_access(drmserver)
+
+r_dir_file(drmserver, cgroup)
+r_dir_file(drmserver, cgroup_v2)
+r_dir_file(drmserver, system_file)
diff --git a/prebuilts/api/202504/private/dumpstate.te b/prebuilts/api/202504/private/dumpstate.te
new file mode 100644
index 0000000..501d829
--- /dev/null
+++ b/prebuilts/api/202504/private/dumpstate.te
@@ -0,0 +1,604 @@
+typeattribute dumpstate coredomain;
+type dumpstate_tmpfs, file_type;
+
+init_daemon_domain(dumpstate)
+
+# Execute and transition to the vdc domain
+domain_auto_trans(dumpstate, vdc_exec, vdc)
+
+# Create tmpfs files for using memfd descriptors to get output from child
+# processes.
+tmpfs_domain(dumpstate)
+
+# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables
+allow dumpstate system_file:file lock;
+
+allow dumpstate storaged_exec:file rx_file_perms;
+
+# /data/misc/a11ytrace for accessibility traces
+userdebug_or_eng(`
+ allow dumpstate accessibility_trace_data_file:dir r_dir_perms;
+ allow dumpstate accessibility_trace_data_file:file r_file_perms;
+')
+
+# /data/misc/wmtrace for wm traces
+userdebug_or_eng(`
+ allow dumpstate wm_trace_data_file:dir r_dir_perms;
+ allow dumpstate wm_trace_data_file:file r_file_perms;
+')
+
+# /data/system/dropbox for dropbox entries
+userdebug_or_eng(`
+ allow dumpstate dropbox_data_file:dir r_dir_perms;
+ allow dumpstate dropbox_data_file:file r_file_perms;
+')
+
+r_dir_file(dumpstate, aconfig_storage_metadata_file);
+
+# Allow dumpstate to make binder calls to incidentd
+binder_call(dumpstate, incidentd)
+
+# Kill incident in case of a timeout
+allow dumpstate incident:process { signal sigkill };
+
+# Allow dumpstate to make binder calls to storaged service
+binder_call(dumpstate, storaged)
+
+# Allow dumpstate to make binder calls to statsd
+binder_call(dumpstate, statsd)
+
+# Allow dumpstate to talk to gpuservice over binder
+binder_call(dumpstate, gpuservice);
+
+# Allow dumpstate to talk to idmap over binder
+binder_call(dumpstate, idmap);
+
+# Allow dumpstate to talk to profcollectd over binder
+userdebug_or_eng(`
+ binder_call(dumpstate, profcollectd)
+')
+
+# Allow dumpstate to talk to automotive_display_service over binder
+binder_call(dumpstate, automotive_display_service)
+
+# Allow dumpstate to talk to virtual_camera service over binder
+binder_call(dumpstate, virtual_camera)
+
+# Allow dumpstate to talk to ot_daemon service over binder
+binder_call(dumpstate, ot_daemon)
+
+# Collect metrics on boot time created by init
+get_prop(dumpstate, boottime_prop)
+
+get_prop(dumpstate, misctrl_prop)
+
+# Signal native processes to dump their stack.
+allow dumpstate {
+ mediatranscoding
+ statsd
+ netd
+ virtual_camera
+ ot_daemon
+}:process signal;
+
+# Only allow dumpstate to dump Keystore on debuggable builds.
+userdebug_or_eng(`
+ allow dumpstate keystore:process signal;
+')
+dontaudit dumpstate keystore:process { signal };
+
+# For collecting bugreports.
+no_debugfs_restriction(`
+ allow dumpstate debugfs_wakeup_sources:file r_file_perms;
+')
+
+allow dumpstate dev_type:blk_file getattr;
+allow dumpstate webview_zygote:process signal;
+allow dumpstate sysfs_dmabuf_stats:file r_file_perms;
+dontaudit dumpstate update_engine:binder call;
+
+# Read files in /proc
+allow dumpstate {
+ config_gz
+ proc_net_tcp_udp
+ proc_pid_max
+}:file r_file_perms;
+
+# For comminucating with the system process to do confirmation ui.
+binder_call(dumpstate, incidentcompanion_service)
+
+# Set properties.
+# dumpstate_prop is used to share state with the Shell app.
+set_prop(dumpstate, dumpstate_prop)
+set_prop(dumpstate, exported_dumpstate_prop)
+
+# dumpstate_options_prop is used to pass extra command-line args.
+set_prop(dumpstate, dumpstate_options_prop)
+
+# Allow dumpstate to kill vendor dumpstate service by init
+set_prop(dumpstate, ctl_dumpstate_prop)
+
+# For dumping dynamic partition information.
+set_prop(dumpstate, lpdumpd_prop)
+binder_call(dumpstate, lpdumpd)
+
+# For dumping hypervisor information.
+get_prop(dumpstate, hypervisor_prop)
+
+# For dumping device-mapper and snapshot information.
+allow dumpstate gsid_exec:file rx_file_perms;
+set_prop(dumpstate, ctl_gsid_prop)
+binder_call(dumpstate, gsid)
+
+#Allow access to /dev/binderfs/binder_logs
+userdebug_or_eng(`
+ allow dumpstate binderfs_logs_transactions:file r_file_perms;
+')
+dontaudit dumpstate binderfs_logs_transactions:file r_file_perms;
+allow dumpstate binderfs_logs_transaction_history:file r_file_perms;
+
+r_dir_file(dumpstate, ota_metadata_file)
+
+# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace
+# is being recorded, the command above will serialize it into
+# /data/misc/perfetto-traces/bugreport/*.pftrace .
+domain_auto_trans(dumpstate, perfetto_exec, perfetto)
+allow dumpstate perfetto:process signal;
+allow dumpstate perfetto_traces_data_file:dir { search };
+allow dumpstate perfetto_traces_bugreport_data_file:dir rw_dir_perms;
+allow dumpstate perfetto_traces_bugreport_data_file:file { r_file_perms unlink };
+
+# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null
+# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport
+# zip file. These rules are to allow perfetto.te to inherit dumpstate's
+# /dev/null.
+allow perfetto dumpstate_tmpfs:file rw_file_perms;
+allow perfetto dumpstate:fd use;
+
+# system_dlkm_file for /system_dlkm partition
+allow dumpstate system_dlkm_file:dir getattr;
+
+# Allow dumpstate to execute derive_sdk in its own domain
+domain_auto_trans(dumpstate, derive_sdk_exec, derive_sdk)
+
+net_domain(dumpstate)
+binder_use(dumpstate)
+wakelock_use(dumpstate)
+
+# Allow setting process priority, protect from OOM killer, and dropping
+# privileges by switching UID / GID
+allow dumpstate self:global_capability_class_set { setuid setgid sys_resource };
+
+# Allow dumpstate to scan through /proc/pid for all processes
+r_dir_file(dumpstate, domain)
+
+allow dumpstate self:global_capability_class_set {
+ # Send signals to processes
+ kill
+ # Run iptables
+ net_raw
+ net_admin
+};
+
+# Allow executing files on system, such as:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow dumpstate system_file:file execute_no_trans;
+not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;')
+allow dumpstate toolbox_exec:file rx_file_perms;
+
+# hidl searches for files in /system/lib(64)/hw/
+allow dumpstate system_file:dir r_dir_perms;
+
+# Create and write into /data/anr/
+allow dumpstate self:global_capability_class_set { dac_override dac_read_search chown fowner fsetid };
+allow dumpstate anr_data_file:dir rw_dir_perms;
+allow dumpstate anr_data_file:file create_file_perms;
+
+# Allow reading /data/system/uiderrors.txt
+# TODO: scope this down.
+allow dumpstate system_data_file:file r_file_perms;
+
+# Allow dumpstate to append into apps' private files.
+allow dumpstate app_data_file_type:file append;
+
+# Read dmesg
+allow dumpstate self:global_capability2_class_set syslog;
+allow dumpstate kernel:system syslog_read;
+
+# Read /sys/fs/pstore/console-ramoops
+allow dumpstate pstorefs:dir r_dir_perms;
+allow dumpstate pstorefs:file r_file_perms;
+
+# Get process attributes
+allow dumpstate domain:process getattr;
+
+# Signal java processes to dump their stack
+allow dumpstate { appdomain system_server zygote app_zygote }:process signal;
+
+# Signal native processes to dump their stack.
+allow dumpstate {
+ # This list comes from native_processes_to_dump in dumputils/dump_utils.c
+ audioserver
+ cameraserver
+ drmserver
+ inputflinger
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ mediaswcodec
+ sdcardd
+ surfaceflinger
+ vold
+
+ # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.c
+ evsmanagerd
+ hal_audio_server
+ hal_audiocontrol_server
+ hal_bluetooth_server
+ hal_broadcastradio_server
+ hal_camera_server
+ hal_codec2_server
+ hal_drm_server
+ hal_evs_server
+ hal_face_server
+ hal_fingerprint_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_input_processor_server
+ hal_neuralnetworks_server
+ hal_omx_server
+ hal_power_server
+ hal_power_stats_server
+ hal_sensors_server
+ hal_thermal_server
+ hal_vehicle_server
+ hal_vr_server
+ system_suspend_server
+}:process signal;
+
+# On userdebug, dumpstate may fork and execute a command as su. Make sure the
+# timeout logic is allowed to terminate the child process if necessary.
+userdebug_or_eng(`
+ allow dumpstate su:process { signal sigkill };
+')
+
+# Connect to tombstoned to intercept dumps.
+unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
+
+# Access to /sys
+allow dumpstate sysfs_type:dir r_dir_perms;
+
+allow dumpstate {
+ sysfs_devices_block
+ sysfs_dm
+ sysfs_loop
+ sysfs_usb
+ sysfs_zram
+}:file r_file_perms;
+
+# Ignore other file access under /sys.
+dontaudit dumpstate sysfs:file r_file_perms;
+
+# Other random bits of data we want to collect
+no_debugfs_restriction(`
+ allow dumpstate debugfs:file r_file_perms;
+ auditallow dumpstate debugfs:file r_file_perms;
+
+ allow dumpstate debugfs_mmc:file r_file_perms;
+')
+
+# df for
+allow dumpstate {
+ block_device
+ cache_file
+ metadata_file
+ rootfs
+ selinuxfs
+ storage_file
+ tmpfs
+}:dir { search getattr };
+allow dumpstate fuse_device:chr_file getattr;
+allow dumpstate { dm_device cache_block_device }:blk_file getattr;
+allow dumpstate { cache_file rootfs }:lnk_file { getattr read };
+
+# Read /dev/cpuctl and /dev/cpuset
+r_dir_file(dumpstate, cgroup)
+r_dir_file(dumpstate, cgroup_v2)
+
+# Allow dumpstate to make binder calls to any binder service
+binder_call(dumpstate, binderservicedomain)
+binder_call(dumpstate, { appdomain artd netd wificond })
+
+# Allow dumpstate to call dump() on specific hals.
+dump_hal(hal_audio)
+dump_hal(hal_audiocontrol)
+dump_hal(hal_authgraph)
+dump_hal(hal_authsecret)
+dump_hal(hal_bluetooth)
+dump_hal(hal_broadcastradio)
+dump_hal(hal_camera)
+dump_hal(hal_codec2)
+dump_hal(hal_contexthub)
+dump_hal(hal_drm)
+dump_hal(hal_dumpstate)
+dump_hal(hal_evs)
+dump_hal(hal_face)
+dump_hal(hal_fingerprint)
+dump_hal(hal_gnss)
+dump_hal(hal_graphics_allocator)
+dump_hal(hal_graphics_composer)
+dump_hal(hal_health)
+dump_hal(hal_identity)
+dump_hal(hal_input_processor)
+dump_hal(hal_keymint)
+dump_hal(hal_light)
+dump_hal(hal_memtrack)
+dump_hal(hal_neuralnetworks)
+dump_hal(hal_nfc)
+dump_hal(hal_oemlock)
+dump_hal(hal_power)
+dump_hal(hal_power_stats)
+dump_hal(hal_rebootescrow)
+dump_hal(hal_secretkeeper)
+dump_hal(hal_sensors)
+dump_hal(hal_thermal)
+dump_hal(hal_vehicle)
+dump_hal(hal_vm_capabilities)
+dump_hal(hal_weaver)
+dump_hal(hal_wifi)
+
+# Vibrate the device after we are done collecting the bugreport
+hal_client_domain(dumpstate, hal_vibrator)
+
+# Reading /proc/PID/maps of other processes
+allow dumpstate self:global_capability_class_set sys_ptrace;
+
+# Allow the bugreport service to create a file in
+# /data/data/com.android.shell/files/bugreports/bugreport
+allow dumpstate shell_data_file:dir create_dir_perms;
+allow dumpstate shell_data_file:file create_file_perms;
+
+# Run a shell.
+allow dumpstate shell_exec:file rx_file_perms;
+
+# For running am and similar framework commands.
+# Run /system/bin/app_process.
+allow dumpstate zygote_exec:file rx_file_perms;
+
+# For Bluetooth
+allow dumpstate bluetooth_data_file:dir search;
+allow dumpstate bluetooth_logs_data_file:dir r_dir_perms;
+allow dumpstate bluetooth_logs_data_file:file r_file_perms;
+
+# For Nfc
+allow dumpstate nfc_logs_data_file:dir r_dir_perms;
+allow dumpstate nfc_logs_data_file:file r_file_perms;
+
+# For uwb
+allow dumpstate apex_module_data_file:dir search;
+allow dumpstate apex_system_server_data_file:dir search;
+allow dumpstate apex_uwb_data_file:dir r_dir_perms;
+allow dumpstate apex_uwb_data_file:file r_file_perms;
+
+# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
+allow dumpstate gpu_device:chr_file rw_file_perms;
+allow dumpstate gpu_device:dir r_dir_perms;
+
+# logd access
+read_logd(dumpstate)
+control_logd(dumpstate)
+read_runtime_log_tags(dumpstate)
+
+# Read files in /proc
+allow dumpstate {
+ proc_allocinfo
+ proc_bootconfig
+ proc_buddyinfo
+ proc_cmdline
+ proc_meminfo
+ proc_modules
+ proc_net_type
+ proc_pipe_conf
+ proc_pagetypeinfo
+ proc_qtaguid_ctrl
+ proc_qtaguid_stat
+ proc_slabinfo
+ proc_version
+ proc_vmallocinfo
+ proc_vmstat
+}:file r_file_perms;
+
+# Read network state info files.
+allow dumpstate net_data_file:dir search;
+allow dumpstate net_data_file:file r_file_perms;
+
+# List sockets via ss.
+allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
+
+# Access /data/tombstones.
+allow dumpstate tombstone_data_file:dir r_dir_perms;
+allow dumpstate tombstone_data_file:file r_file_perms;
+
+# Access /cache/recovery
+allow dumpstate cache_recovery_file:dir r_dir_perms;
+allow dumpstate cache_recovery_file:file r_file_perms;
+
+# Access /data/misc/recovery
+allow dumpstate recovery_data_file:dir r_dir_perms;
+allow dumpstate recovery_data_file:file r_file_perms;
+
+# Access /data/misc/update_engine & /data/misc/update_engine_log
+allow dumpstate { update_engine_data_file update_engine_log_data_file }:dir r_dir_perms;
+allow dumpstate { update_engine_data_file update_engine_log_data_file }:file r_file_perms;
+# Access /data/misc/snapuserd_log
+allow dumpstate snapuserd_log_data_file:dir r_dir_perms;
+allow dumpstate snapuserd_log_data_file:file r_file_perms;
+
+# Access /data/misc/profiles/{cur,ref}/
+userdebug_or_eng(`
+ allow dumpstate { user_profile_root_file user_profile_data_file}:dir r_dir_perms;
+ allow dumpstate user_profile_data_file:file r_file_perms;
+')
+
+# Access /data/misc/logd
+allow dumpstate misc_logd_file:dir r_dir_perms;
+allow dumpstate misc_logd_file:file r_file_perms;
+
+# Access /data/misc/prereboot
+allow dumpstate prereboot_data_file:dir r_dir_perms;
+allow dumpstate prereboot_data_file:file r_file_perms;
+
+allow dumpstate app_fuse_file:dir r_dir_perms;
+allow dumpstate overlayfs_file:dir r_dir_perms;
+
+allow dumpstate {
+ service_manager_type
+ -apex_service
+ -dumpstate_service
+ -gatekeeper_service
+ -hal_service_type
+ -virtual_touchpad_service
+ -vold_service
+ -fwk_vold_service
+ -default_android_service
+}:service_manager find;
+# suppress denials for services dumpstate should not be accessing.
+dontaudit dumpstate {
+ apex_service
+ dumpstate_service
+ gatekeeper_service
+ hal_service_type
+ virtual_touchpad_service
+ vold_service
+ fwk_vold_service
+}:service_manager find;
+
+# Most of these are neverallowed.
+dontaudit dumpstate hwservice_manager_type:hwservice_manager find;
+
+allow dumpstate servicemanager:service_manager list;
+allow dumpstate hwservicemanager:hwservice_manager list;
+
+allow dumpstate devpts:chr_file rw_file_perms;
+
+# Read any system properties
+get_prop(dumpstate, property_type)
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow dumpstate media_rw_data_file:dir getattr;
+allow dumpstate proc_interrupts:file r_file_perms;
+allow dumpstate proc_zoneinfo:file r_file_perms;
+
+# Create a service for talking back to system_server
+add_service(dumpstate, dumpstate_service)
+
+# use /dev/ion for screen capture
+allow dumpstate ion_device:chr_file r_file_perms;
+
+# Allow dumpstate to run top
+allow dumpstate proc_stat:file r_file_perms;
+
+allow dumpstate proc_pressure_cpu:file r_file_perms;
+allow dumpstate proc_pressure_mem:file r_file_perms;
+allow dumpstate proc_pressure_io:file r_file_perms;
+
+# Allow dumpstate to run ps
+allow dumpstate proc_pid_max:file r_file_perms;
+
+# Allow dumpstate to talk to installd over binder
+binder_call(dumpstate, installd);
+
+# Allow dumpstate to run ip xfrm policy
+allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read };
+
+# Allow dumpstate to run iotop
+allow dumpstate self:netlink_socket create_socket_perms_no_ioctl;
+# newer kernels (e.g. 4.4) have a new class for sockets
+allow dumpstate self:netlink_generic_socket create_socket_perms_no_ioctl;
+
+# Allow dumpstate to run ss
+allow dumpstate { domain pdx_channel_socket_type pdx_endpoint_socket_type }:socket_class_set getattr;
+
+# Allow dumpstate to read linkerconfig directory
+allow dumpstate linkerconfig_file:dir { read open };
+
+# For when dumpstate runs df
+dontaudit dumpstate {
+ mnt_vendor_file
+ mirror_data_file
+ mnt_user_file
+ mnt_product_file
+}:dir search;
+dontaudit dumpstate {
+ apex_mnt_dir
+ linkerconfig_file
+ mirror_data_file
+ mnt_user_file
+ vm_data_file
+}:dir getattr;
+
+#suppress denials for dumpstate to call vitualizationservice.
+dontaudit dumpstate virtualizationservice:binder { call };
+
+# Allow dumpstate to talk to bufferhubd over binder
+binder_call(dumpstate, bufferhubd);
+
+# Allow dumpstate to talk to mediaswcodec over binder
+binder_call(dumpstate, mediaswcodec);
+
+#Access /data/misc/snapshotctl_log
+allow dumpstate snapshotctl_log_data_file:dir r_dir_perms;
+allow dumpstate snapshotctl_log_data_file:file r_file_perms;
+
+#Allow access to /dev/binderfs/binder_logs
+allow dumpstate binderfs_logs:dir r_dir_perms;
+allow dumpstate binderfs_logs:file r_file_perms;
+allow dumpstate binderfs_logs_proc:file r_file_perms;
+allow dumpstate binderfs_logs_stats:file r_file_perms;
+
+use_apex_info(dumpstate)
+
+# Allow reading files under /data/system/shutdown-checkpoints/
+allow dumpstate shutdown_checkpoints_system_data_file:dir r_dir_perms;
+allow dumpstate shutdown_checkpoints_system_data_file:file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# dumpstate has capability sys_ptrace, but should only use that capability for
+# accessing sensitive /proc/PID files, never for using ptrace attach.
+neverallow dumpstate *:process ptrace;
+
+# only system_server, dumpstate, traceur_app and shell can find the dumpstate service
+neverallow {
+ domain
+ -system_server
+ -shell
+ -traceur_app
+ -dumpstate
+} dumpstate_service:service_manager find;
+
+# only dumpstate, system_server and related others to access apex_uwb_data_file
+neverallow {
+ domain
+ -dumpstate
+ -system_server
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_uwb_data_file:dir no_rw_file_perms;
+neverallow {
+ domain
+ -dumpstate
+ -system_server
+ -apexd
+ -init
+ -vold_prepare_subdirs
+} apex_uwb_data_file:file no_rw_file_perms;
diff --git a/prebuilts/api/202504/private/e2fs.te b/prebuilts/api/202504/private/e2fs.te
new file mode 100644
index 0000000..3316ce2
--- /dev/null
+++ b/prebuilts/api/202504/private/e2fs.te
@@ -0,0 +1,30 @@
+allow e2fs devpts:chr_file { read write getattr ioctl };
+
+allow e2fs dev_type:blk_file getattr;
+allow e2fs block_device:dir search;
+allow e2fs userdata_block_device:blk_file rw_file_perms;
+allow e2fs metadata_block_device:blk_file rw_file_perms;
+allow e2fs dm_device:blk_file rw_file_perms;
+allow e2fs zoned_block_device:blk_file rw_file_perms;
+# Vold needs to capture mkfs.ext4's output
+allow e2fs vold:fd use;
+# Need to be able to format a partition
+allow e2fs sysfs_dm:dir r_dir_perms;
+allow e2fs sysfs_dm:file r_file_perms;
+
+allowxperm e2fs { userdata_block_device metadata_block_device dm_device zoned_block_device }:blk_file ioctl {
+ BLKSECDISCARD BLKDISCARD BLKPBSZGET BLKDISCARDZEROES BLKROGET BLKREPORTZONE BLKRESETZONE
+};
+
+allow e2fs {
+ proc_filesystems
+ proc_mounts
+ proc_swaps
+}:file r_file_perms;
+
+# access /sys/fs/ext4/features
+allow e2fs sysfs_fs_ext4_features:dir search;
+allow e2fs sysfs_fs_ext4_features:file r_file_perms;
+
+# access SELinux context files
+allow e2fs file_contexts_file:file r_file_perms;
diff --git a/prebuilts/api/202504/private/early_virtmgr.te b/prebuilts/api/202504/private/early_virtmgr.te
new file mode 100644
index 0000000..d1579fe
--- /dev/null
+++ b/prebuilts/api/202504/private/early_virtmgr.te
@@ -0,0 +1,75 @@
+is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `
+ until_board_api(202504, `
+ type early_virtmgr, domain, coredomain;
+ type early_virtmgr_exec, system_file_type, exec_type, file_type;
+ ')
+
+ use_bootstrap_libs(early_virtmgr)
+
+ # Let early_virtmgr create files and directories inside /mnt/vm/early.
+ allow early_virtmgr vm_data_file:dir create_dir_perms;
+ allow early_virtmgr vm_data_file:file create_file_perms;
+ allow early_virtmgr vm_data_file:sock_file create_file_perms;
+
+ # Allow early_virtmgr to communicate use, read and write over the adb connection.
+ allow early_virtmgr adbd:fd use;
+ allow early_virtmgr adbd:unix_stream_socket { getattr read write };
+
+ # Allow writing VM logs to the shell console
+ allow early_virtmgr devpts:chr_file { read write getattr ioctl };
+
+ # Let the early_virtmgr domain use Binder.
+ binder_use(early_virtmgr)
+
+ # When early_virtmgr execs a file with the crosvm_exec label, run it in the crosvm domain.
+ domain_auto_trans(early_virtmgr, crosvm_exec, crosvm)
+
+ # Let early_virtmgr kill crosvm.
+ allow early_virtmgr crosvm:process sigkill;
+
+ # Allow early_virtmgr to read apex-info-list.xml and access the APEX files listed there.
+ allow early_virtmgr apex_info_file:file r_file_perms;
+ allow early_virtmgr apex_data_file:dir search;
+
+ # Ignore harmless denials on /proc/self/fd
+ dontaudit early_virtmgr self:dir write;
+
+ # Let early_virtmgr to accept vsock connection from the guest VMs
+ allow early_virtmgr self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+
+ # Allow early_virtmgr to inspect all hypervisor capabilities.
+ get_prop(early_virtmgr, hypervisor_prop)
+ get_prop(early_virtmgr, hypervisor_pvmfw_prop)
+ get_prop(early_virtmgr, hypervisor_restricted_prop)
+ get_prop(early_virtmgr, hypervisor_virtualizationmanager_prop)
+
+ # Allow early_virtmgr to read file system DT for VM reference DT and AVF debug policy
+ r_dir_file(early_virtmgr, proc_dt_avf)
+ r_dir_file(early_virtmgr, sysfs_dt_avf)
+
+ # early_virtmgr to be client of secretkeeper HAL. It ferries SecretManagement messages from pVM
+ # to HAL.
+ hal_client_domain(early_virtmgr, hal_secretkeeper);
+
+ # Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
+ r_dir_file(early_virtmgr, crosvm);
+
+ # Allow early_virtmgr to:
+ # 1) bind to a vsock port less than 1024, because early VMs use static CIDs less than 1024
+ # 2) call RLIMIT_MEMLOCK for itself
+ allow early_virtmgr self:global_capability_class_set { net_bind_service ipc_lock sys_resource };
+
+ # early_virtmgr may print messages to kmsg_debug_device.
+ allow early_virtmgr kmsg_debug_device:chr_file w_file_perms;
+
+ ###
+ ### Neverallow rules
+ ###
+
+ # Only crosvm and early_virtmgr can access vm_data_file
+ neverallow { domain -crosvm -early_virtmgr -init } vm_data_file:dir no_w_dir_perms;
+ neverallow { domain -crosvm -early_virtmgr } vm_data_file:file no_rw_file_perms;
+
+ # No other domains can accept vsock connection from the guest VMs
+ neverallow { domain -early_virtmgr } early_virtmgr:vsock_socket { accept bind create connect listen };
+')
diff --git a/prebuilts/api/202504/private/ephemeral_app.te b/prebuilts/api/202504/private/ephemeral_app.te
new file mode 100644
index 0000000..4e1417b
--- /dev/null
+++ b/prebuilts/api/202504/private/ephemeral_app.te
@@ -0,0 +1,87 @@
+###
+### Ephemeral apps.
+###
+### This file defines the security policy for apps with the ephemeral
+### feature.
+###
+### The ephemeral_app domain is a reduced permissions sandbox allowing
+### ephemeral applications to be safely installed and run. Non ephemeral
+### applications may also opt-in to ephemeral to take advantage of the
+### additional security features.
+###
+### PackageManager flags an app as ephemeral at install time.
+
+typeattribute ephemeral_app coredomain;
+
+net_domain(ephemeral_app)
+app_domain(ephemeral_app)
+
+# Allow ephemeral apps to read/write files in visible storage if provided fds
+allow ephemeral_app { sdcard_type fuse media_rw_data_file }:file {read write getattr ioctl lock append};
+
+# Some apps ship with shared libraries and binaries that they write out
+# to their sandbox directory and then execute.
+allow ephemeral_app privapp_data_file:file { r_file_perms execute };
+allow ephemeral_app app_data_file:file { r_file_perms execute };
+
+# Follow priv-app symlinks. This is used for dynamite functionality.
+allow ephemeral_app privapp_data_file:lnk_file r_file_perms;
+
+# Allow the renderscript compiler to be run.
+domain_auto_trans(ephemeral_app, rs_exec, rs)
+
+# Allow loading and deleting shared libraries created by trusted system
+# components within an application home directory.
+allow ephemeral_app app_exec_data_file:file { r_file_perms execute unlink };
+
+# services
+allow ephemeral_app audioserver_service:service_manager find;
+allow ephemeral_app cameraserver_service:service_manager find;
+allow ephemeral_app mediaserver_service:service_manager find;
+allow ephemeral_app mediaextractor_service:service_manager find;
+allow ephemeral_app mediametrics_service:service_manager find;
+allow ephemeral_app mediadrmserver_service:service_manager find;
+allow ephemeral_app drmserver_service:service_manager find;
+allow ephemeral_app radio_service:service_manager find;
+allow ephemeral_app ephemeral_app_api_service:service_manager find;
+
+# allow ephemeral apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow ephemeral_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+allow ephemeral_app ashmem_device:chr_file rw_file_perms;
+
+###
+### neverallow rules
+###
+
+neverallow ephemeral_app app_data_file_type:file execute_no_trans;
+
+# Receive or send uevent messages.
+neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow ephemeral_app domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow ephemeral_app debugfs_type:file read;
+
+# execute gpu_device
+neverallow ephemeral_app gpu_device:chr_file execute;
+
+# access files in /sys with the default sysfs label
+neverallow ephemeral_app sysfs:file *;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
+
+# Directly access external storage
+neverallow ephemeral_app { sdcard_type fuse media_rw_data_file }:file {open create};
+neverallow ephemeral_app { sdcard_type fuse media_rw_data_file }:dir search;
+
+# Avoid reads to proc_net, it contains too much device wide information about
+# ongoing connections.
+neverallow ephemeral_app proc_net:file no_rw_file_perms;
diff --git a/prebuilts/api/202504/private/evsmanagerd.te b/prebuilts/api/202504/private/evsmanagerd.te
new file mode 100644
index 0000000..3772628
--- /dev/null
+++ b/prebuilts/api/202504/private/evsmanagerd.te
@@ -0,0 +1,39 @@
+# evsmanager
+typeattribute evsmanagerd coredomain;
+typeattribute evsmanagerd evsmanager_service_server;
+
+type evsmanagerd_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(evsmanagerd);
+
+# Declares as a binder service
+binder_service(evsmanagerd)
+
+# Allows to add a service to service_manager
+add_service(evsmanagerd, evsmanagerd_service)
+
+# Allows to use the binder IPC
+binder_use(evsmanagerd)
+
+# Allows binder IPCs to the various system services
+binder_call(evsmanagerd, system_server)
+
+# Allows to use EVS HAL implementations
+hal_client_domain(evsmanagerd, hal_evs)
+
+# Allows to write messages to the shell
+allow evsmanagerd shell:fd use;
+allow evsmanagerd shell:fifo_file write;
+
+# Allows to use the graphics allocator
+allow evsmanagerd hal_graphics_allocator:fd use;
+
+# Allows to use a bootstrap statsd
+allow evsmanagerd statsbootstrap_service:service_manager find;
+
+# Allows binder IPCs to the CarService
+binder_call(evsmanagerd, appdomain)
+
+# For HIDL evs manager implementation
+allow evsmanagerd hal_evs_hwservice:hwservice_manager add;
+allow evsmanagerd hidl_base_hwservice:hwservice_manager add;
diff --git a/prebuilts/api/202504/private/extra_free_kbytes.te b/prebuilts/api/202504/private/extra_free_kbytes.te
new file mode 100644
index 0000000..f24340d
--- /dev/null
+++ b/prebuilts/api/202504/private/extra_free_kbytes.te
@@ -0,0 +1,16 @@
+typeattribute extra_free_kbytes coredomain;
+
+init_daemon_domain(extra_free_kbytes)
+
+# Only extra_free_kbytes script is allowed to store these properties
+set_prop(extra_free_kbytes, init_storage_prop)
+
+# required permissions to run the script from init
+allow extra_free_kbytes shell_exec:file rx_file_perms;
+allow extra_free_kbytes system_file:file x_file_perms;
+allow extra_free_kbytes toolbox_exec:file rx_file_perms;
+
+# files used by the script
+allow extra_free_kbytes proc_extra_free_kbytes:file rw_file_perms;
+allow extra_free_kbytes proc_watermark_scale_factor:file rw_file_perms;
+allow extra_free_kbytes proc_zoneinfo:file r_file_perms;
diff --git a/prebuilts/api/202504/private/fastbootd.te b/prebuilts/api/202504/private/fastbootd.te
new file mode 100644
index 0000000..a62cc47
--- /dev/null
+++ b/prebuilts/api/202504/private/fastbootd.te
@@ -0,0 +1,180 @@
+typeattribute fastbootd coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise fastbootd is only allowed the domain rules.
+recovery_only(`
+ # Reboot the device
+ set_prop(fastbootd, powerctl_prop)
+
+ # Read serial number of the device from system properties
+ get_prop(fastbootd, serialno_prop)
+
+ # Set sys.usb.ffs.ready.
+ get_prop(fastbootd, ffs_config_prop)
+ set_prop(fastbootd, ffs_control_prop)
+
+ userdebug_or_eng(`
+ get_prop(fastbootd, persistent_properties_ready_prop)
+ ')
+
+ set_prop(fastbootd, gsid_prop)
+
+ # Determine allocation scheme (whether B partitions needs to be
+ # at the second half of super.
+ get_prop(fastbootd, virtual_ab_prop)
+ get_prop(fastbootd, snapuserd_prop)
+
+ # Needed for TCP protocol
+ allow fastbootd node:tcp_socket node_bind;
+ allow fastbootd port:tcp_socket name_bind;
+ allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
+
+ # Start snapuserd for merging VABC updates
+ set_prop(fastbootd, ctl_snapuserd_prop)
+
+ # Needed to communicate with snapuserd to complete merges.
+ allow fastbootd snapuserd_socket:sock_file write;
+ allow fastbootd snapuserd:unix_stream_socket connectto;
+ allow fastbootd dm_user_device:dir r_dir_perms;
+
+ # Get fastbootd protocol property
+ get_prop(fastbootd, fastbootd_protocol_prop)
+
+ # Mount /metadata to interact with Virtual A/B snapshots.
+ allow fastbootd labeledfs:filesystem { mount unmount };
+ set_prop(fastbootd, boottime_prop)
+
+ # Needed for reading boot properties.
+ allow fastbootd proc_bootconfig:file r_file_perms;
+ # Let this domain use the hal fastboot service
+ binder_use(fastbootd)
+ hal_client_domain(fastbootd, hal_fastboot)
+
+ # fastbootd can only use HALs in passthrough mode
+ passthrough_hal_client_domain(fastbootd, hal_bootctl)
+
+ # fastbootd can use AIDL HALs in binder mode
+ binder_use(fastbootd)
+ hal_client_domain(fastbootd, hal_health)
+ hal_client_domain(fastbootd, hal_fastboot)
+
+ # Access /dev/usb-ffs/fastbootd/ep0
+ allow fastbootd functionfs:dir search;
+ allow fastbootd functionfs:file rw_file_perms;
+
+ allowxperm fastbootd functionfs:file ioctl { FUNCTIONFS_ENDPOINT_DESC };
+ # Log to serial
+ allow fastbootd kmsg_device:chr_file { open getattr write };
+
+ # battery info
+ allow fastbootd sysfs_batteryinfo:file r_file_perms;
+
+ allow fastbootd device:dir r_dir_perms;
+
+ # For dev/block/by-name dir
+ allow fastbootd block_device:dir r_dir_perms;
+
+ # Needed for DM_DEV_CREATE ioctl call
+ allow fastbootd self:capability sys_admin;
+
+ unix_socket_connect(fastbootd, recovery, recovery)
+
+ # Required for flashing
+ allow fastbootd dm_device:chr_file rw_file_perms;
+ allow fastbootd dm_device:blk_file rw_file_perms;
+
+ allow fastbootd cache_block_device:blk_file rw_file_perms;
+ allow fastbootd super_block_device_type:blk_file rw_file_perms;
+ allow fastbootd {
+ boot_block_device
+ metadata_block_device
+ system_block_device
+ userdata_block_device
+ }:blk_file { w_file_perms getattr ioctl };
+
+ # For disabling/wiping GSI, and for modifying/deleting files created via
+ # libfiemap.
+ allow fastbootd metadata_block_device:blk_file r_file_perms;
+ allow fastbootd {rootfs tmpfs}:dir mounton;
+ allow fastbootd metadata_file:dir { search getattr mounton };
+ allow fastbootd gsi_metadata_file_type:dir rw_dir_perms;
+ allow fastbootd gsi_metadata_file_type:file create_file_perms;
+
+ allowxperm fastbootd super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
+
+ allowxperm fastbootd {
+ metadata_block_device
+ userdata_block_device
+ dm_device
+ cache_block_device
+ }:blk_file ioctl { BLKSECDISCARD BLKDISCARD };
+
+ allow fastbootd misc_block_device:blk_file rw_file_perms;
+
+ allow fastbootd proc_cmdline:file r_file_perms;
+ allow fastbootd rootfs:dir r_dir_perms;
+
+ # Needed to read fstab node from device tree.
+ allow fastbootd sysfs_dt_firmware_android:file r_file_perms;
+ allow fastbootd sysfs_dt_firmware_android:dir r_dir_perms;
+
+ # Needed because libdm reads sysfs to validate when a dm path is ready.
+ r_dir_file(fastbootd, sysfs_dm)
+
+ # Needed for realpath() call to resolve symlinks.
+ allow fastbootd block_device:dir getattr;
+ userdebug_or_eng(`
+ # Refined manipulation of /mnt/scratch, without these perms resorts
+ # to deleting scratch partition when partition(s) are flashed.
+ allow fastbootd self:process setfscreate;
+ allow fastbootd cache_file:dir search;
+ allow fastbootd proc_filesystems:file { getattr open read };
+ allow fastbootd self:capability sys_rawio;
+ allowxperm fastbootd dev_type:blk_file ioctl BLKROSET;
+ allow fastbootd overlayfs_file:dir { create_dir_perms mounton };
+ allow fastbootd {
+ system_file_type
+ unlabeled
+ vendor_file_type
+ }:dir { remove_name rmdir search write };
+ allow fastbootd {
+ overlayfs_file
+ system_file_type
+ unlabeled
+ vendor_file_type
+ }:{ file lnk_file } unlink;
+ allow fastbootd tmpfs:dir rw_dir_perms;
+ # Fetch vendor_boot partition
+ allow fastbootd boot_block_device:blk_file r_file_perms;
+
+ # popen(/system/bin/dmesg) and associated permissions. We only allow this
+ # on unlocked devices running userdebug builds.
+ allow fastbootd rootfs:file execute_no_trans;
+ allow fastbootd system_file:file execute_no_trans;
+ allow fastbootd kmsg_device:chr_file read;
+ allow fastbootd kernel:system syslog_read;
+ ')
+
+ # Allow using libfiemap/gsid directly (no binder in recovery).
+ allow fastbootd gsi_metadata_file_type:dir search;
+ allow fastbootd ota_metadata_file:dir rw_dir_perms;
+ allow fastbootd ota_metadata_file:file create_file_perms;
+
+ # Fastbootd uses liblogwrap to write mke2fs logs to kmsg, liblogwrap requires devpts.
+ allow fastbootd devpts:chr_file rw_file_perms;
+')
+
+# This capability allows fastbootd to circumvent memlock rlimits while using
+# io_uring. An Alternative would be to up the memlock rlimit for the fastbootd service.
+allow fastbootd self:capability ipc_lock;
+io_uring_use(fastbootd)
+
+###
+### neverallow rules
+###
+
+# Write permission is required to wipe userdata
+# until recovery supports vold.
+neverallow fastbootd {
+ data_file_type
+}:file { no_x_file_perms };
diff --git a/prebuilts/api/202504/private/file.te b/prebuilts/api/202504/private/file.te
new file mode 100644
index 0000000..3a66143
--- /dev/null
+++ b/prebuilts/api/202504/private/file.te
@@ -0,0 +1,269 @@
+# /proc/allocinfo
+type proc_allocinfo, fs_type, proc_type;
+
+# /proc/config.gz
+type config_gz, fs_type, proc_type;
+
+# /sys/fs/bpf/<dir> for mainline tethering use
+# TODO: move S+ fs_bpf_tethering here from public/file.te
+type fs_bpf_net_private, fs_type, bpffs_type;
+type fs_bpf_net_shared, fs_type, bpffs_type;
+type fs_bpf_netd_readonly, fs_type, bpffs_type;
+type fs_bpf_netd_shared, fs_type, bpffs_type;
+type fs_bpf_loader, fs_type, bpffs_type;
+type fs_bpf_uprobestats, fs_type, bpffs_type;
+type fs_bpf_memevents, fs_type, bpffs_type;
+
+# /data/misc/storaged
+type storaged_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/wmtrace for wm traces
+type wm_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+
+# /data/misc/a11ytrace for accessibility traces
+type accessibility_trace_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces for perfetto traces
+type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports.
+type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-traces/profiling for perfetto traces from profiling apis.
+type perfetto_traces_profiling_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/perfetto-configs for perfetto configs
+type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
+
+# /system/etc/perfetto for perfetto configs
+type system_perfetto_config_file, file_type, system_file_type;
+
+# /data/misc/uprobestats-configs for uprobestats configs
+type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type;
+
+# /apex/com.android.art/bin/oatdump
+# TODO (b/350628688): Remove this once it's safe to do so.
+type oatdump_exec, system_file_type, exec_type, file_type;
+
+# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
+type sdk_sandbox_system_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc_{ce/de}/<user>/sdksandbox/<app-name>/* subdirectory for sdk sandbox processes
+type sdk_sandbox_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+
+# /sys/kernel/debug/kcov for coverage guided kernel fuzzing in userdebug builds.
+type debugfs_kcov, fs_type, debugfs_type;
+
+# App executable files in /data/data directories
+type app_exec_data_file, file_type, data_file_type, core_data_file_type;
+typealias app_exec_data_file alias rs_data_file;
+
+# /data/misc_[ce|de]/rollback : Used by installd to store snapshots
+# of application data.
+type rollback_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc_ce/checkin for checkin apps.
+type checkin_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/gsi/ota
+type ota_image_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/gsi_persistent_data
+type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/emergencynumberdb
+type emergency_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/profcollectd
+type profcollectd_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/apexdata/com.android.art
+type apex_art_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.art/staging
+type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/apexdata/com.android.compos
+type apex_compos_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.virt
+type apex_virt_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.tethering
+type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/misc/apexdata/com.android.uwb
+type apex_uwb_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# legacy labels for various /data/misc[_ce|_de]/*/apexdata directories - retained
+# for backward compatibility b/217581286
+type apex_appsearch_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_permission_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_scheduling_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_wifi_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
+# /data/font/files
+type font_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/dmesgd
+type dmesgd_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odrefresh
+type odrefresh_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odsign
+type odsign_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/odsign_metrics
+type odsign_metrics_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/virtualizationservice
+# The type needs to be mlstrustedobject to allow for being accessed from
+# virtualizationmanager, which runs at a more constrained MLS level.
+type virtualizationservice_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+
+# /mnt/vm
+type vm_data_file, file_type, core_data_file_type;
+
+# /data/system/environ
+type environ_system_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/bootanim
+type bootanim_data_file, file_type, data_file_type, core_data_file_type;
+
+# /dev/kvm
+# The type needs to be mlstrustedobject to allow for being accessed from
+# crosvm, which runs at a more constrained MLS level.
+type kvm_device, dev_type, mlstrustedobject, vm_manager_device_type;
+
+# /apex/com.android.virt/bin/fd_server
+type fd_server_exec, system_file_type, exec_type, file_type;
+
+# /apex/com.android.compos/bin/compsvc
+type compos_exec, exec_type, file_type, system_file_type;
+# /apex/com.android.compos/bin/compos_key_helper
+type compos_key_helper_exec, exec_type, file_type, system_file_type;
+
+# Filesystem entry for for PRNG seeder socket. Processes require
+# write permission on this to connect, and needs to be mlstrustedobject
+# in to satisfy MLS constraints for trusted domains.
+type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# /proc/device-tree/avf and /sys/firmware/devicetree/base/avf
+type sysfs_dt_avf, fs_type, sysfs_type;
+type proc_dt_avf, fs_type, proc_type;
+
+# Type for /system/fonts/font_fallback.xm
+type system_font_fallback_file, system_file_type, file_type;
+
+# Type for /sys/devices/uprobe.
+type sysfs_uprobe, fs_type, sysfs_type;
+
+# Type for aconfig daemon socket
+type aconfigd_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# Type for aconfig mainline daemon socket
+type aconfigd_mainline_socket, file_type, coredomain_socket, mlstrustedobject;
+
+# Type for /(system|system_ext|product)/etc/aconfig
+type system_aconfig_storage_file, system_file_type, file_type;
+
+# Type for /vendor/etc/aconfig
+type vendor_aconfig_storage_file, vendor_file_type, file_type;
+
+# /data/misc/connectivityblobdb
+type connectivityblob_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/wifi/mainline_supplicant
+type mainline_supplicant_data_file, file_type, data_file_type, core_data_file_type;
+
+# Type for /mnt/pre_reboot_dexopt
+type pre_reboot_dexopt_file, file_type;
+
+# Type for /mnt/artd_tmp in the Pre-reboot Dexopt chroot
+# This type is set on the directory through the `rootcontext=` mount option.
+type pre_reboot_dexopt_artd_file, file_type;
+
+# /data/app-metadata - extracted app metadata bundles from APKs
+type apk_metadata_file, file_type, data_file_type, core_data_file_type;
+
+# Type for /sys/kernel/mm/pgsize_migration/enabled
+type sysfs_pgsize_migration, fs_type, sysfs_type;
+
+# /sys/firmware/acpi/tables
+type sysfs_firmware_acpi_tables, fs_type, sysfs_type;
+
+# Allow files to be created in their appropriate filesystems.
+allow fs_type self:filesystem associate;
+allow cgroup tmpfs:filesystem associate;
+allow cgroup_v2 tmpfs:filesystem associate;
+allow cgroup_rc_file tmpfs:filesystem associate;
+allow sysfs_type sysfs:filesystem associate;
+allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate;
+allow file_type labeledfs:filesystem associate;
+allow file_type tmpfs:filesystem associate;
+allow file_type rootfs:filesystem associate;
+allow dev_type tmpfs:filesystem associate;
+allow app_fuse_file app_fusefs:filesystem associate;
+allow postinstall_file self:filesystem associate;
+allow proc_net proc:filesystem associate;
+
+# It's a bug to assign the file_type attribute and fs_type attribute
+# to any type. Do not allow it.
+#
+# For example, the following is a bug:
+# type apk_data_file, file_type, data_file_type, fs_type;
+# Should be:
+# type apk_data_file, file_type, data_file_type;
+neverallow fs_type file_type:filesystem associate;
+# app directories of storage areas: /data/storage_area/userId/pkgName -- apps cannot write to it
+type storage_area_app_dir, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# app storage areas: /data/storage_area/userId/pkgName/storageAreaName
+type storage_area_dir, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# contents of app storage areas: /data/storage_area/userId/pkgName/storageAreaName/*
+type storage_area_content_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+
+# /data/misc_ce/userId/storage_area_keys
+type storage_area_key_file, file_type, data_file_type, core_data_file_type;
+
+# /metadata/tradeinmode files
+type tradeinmode_metadata_file, file_type;
+
+# /metadata/prefetch files
+type prefetch_metadata_file, file_type;
+
+# /metadata/libprocessgroup files
+type libprocessgroup_metadata_file, file_type;
+
+# Types added in 202504 in public/file.te
+until_board_api(202504, `
+ type binderfs_logs_transactions, fs_type;
+ type binderfs_logs_transaction_history, fs_type;
+')
+
+until_board_api(202504, `
+ type proc_cgroups, fs_type, proc_type;
+')
+
+until_board_api(202504, `
+ type sysfs_udc, fs_type, sysfs_type;
+')
+
+until_board_api(202504, `
+ type fs_bpf_lmkd_memevents_rb, fs_type, bpffs_type;
+ type fs_bpf_lmkd_memevents_prog, fs_type, bpffs_type;
+')
+
+until_board_api(202504, `
+ # boot otas for 16KB developer option
+ type vendor_boot_ota_file, vendor_file_type, file_type;
+')
+
+until_board_api(202504, `
+ type tee_service_contexts_file, system_file_type, file_type;
+')
+
+until_board_api(202504, `
+ type sysfs_mem_sleep, fs_type, sysfs_type;
+')
+
+## END Types added in 202504 in public/file.te
diff --git a/prebuilts/api/202504/private/file_contexts b/prebuilts/api/202504/private/file_contexts
new file mode 100644
index 0000000..7ef3226
--- /dev/null
+++ b/prebuilts/api/202504/private/file_contexts
@@ -0,0 +1,954 @@
+###########################################
+# Entries in this file describe the security context associated with a file
+# path. They are used when building the device image, to include the security
+# context within the extended file attributes of the file system. They are also
+# used at runtime when calling restorecon.
+#
+# Entries are merged with other file_contexts from other partitions (e.g.,
+# vendor or odm, see the full list at libselinux/src/android/android.c).
+#
+# The entries are evaluated by the following rules:
+# - Static entries (that is, not using regular expressions) are always
+# evaluated first.
+# - The first matching entry is used.
+# - Entries are evaluated from the bottom to the top.
+#
+# Based on these rules, it is recommended that the less specific entries appear
+# first. For instance:
+# /dev(/.*)? u:object_r:device:s0
+# /dev/block(/.*)? u:object_r:block_device:s0
+# /dev/block/my_dev u:object_r:my_dev:s0
+#
+
+# Root
+/ u:object_r:rootfs:s0
+
+# Data files
+/adb_keys u:object_r:system_file:s0
+/build\.prop u:object_r:rootfs:s0
+/default\.prop u:object_r:rootfs:s0
+/fstab\..* u:object_r:rootfs:s0
+/init\..* u:object_r:rootfs:s0
+/res(/.*)? u:object_r:rootfs:s0
+/selinux_version u:object_r:rootfs:s0
+/ueventd\..* u:object_r:rootfs:s0
+/verity_key u:object_r:rootfs:s0
+
+# Executables
+/init u:object_r:init_exec:s0
+/sbin(/.*)? u:object_r:rootfs:s0
+
+# For kernel modules
+/lib(/.*)? u:object_r:rootfs:s0
+/system_dlkm(/.*)? u:object_r:system_dlkm_file:s0
+
+# Empty directories
+/lost\+found u:object_r:rootfs:s0
+/acct u:object_r:cgroup:s0
+/config u:object_r:rootfs:s0
+/data_mirror u:object_r:mirror_data_file:s0
+/debug_ramdisk u:object_r:tmpfs:s0
+/mnt u:object_r:tmpfs:s0
+/proc u:object_r:rootfs:s0
+/second_stage_resources u:object_r:tmpfs:s0
+/sys u:object_r:sysfs:s0
+/apex u:object_r:apex_mnt_dir:s0
+/bootstrap-apex u:object_r:apex_mnt_dir:s0
+/tmp u:object_r:shell_data_file:s0
+
+# Postinstall directories
+/postinstall u:object_r:postinstall_mnt_dir:s0
+/postinstall/apex u:object_r:postinstall_apex_mnt_dir:s0
+
+/apex/(\.(bootstrap|default)-)?apex-info-list.xml u:object_r:apex_info_file:s0
+
+# Symlinks
+/bin u:object_r:rootfs:s0
+/bugreports u:object_r:rootfs:s0
+/charger u:object_r:rootfs:s0
+/d u:object_r:rootfs:s0
+/etc u:object_r:rootfs:s0
+/sdcard u:object_r:rootfs:s0
+
+# SELinux policy files
+/vendor_file_contexts u:object_r:file_contexts_file:s0
+/plat_file_contexts u:object_r:file_contexts_file:s0
+/product_file_contexts u:object_r:file_contexts_file:s0
+/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
+/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
+/plat_property_contexts u:object_r:property_contexts_file:s0
+/product_property_contexts u:object_r:property_contexts_file:s0
+/vendor_property_contexts u:object_r:property_contexts_file:s0
+/seapp_contexts u:object_r:seapp_contexts_file:s0
+/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
+/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
+/sepolicy u:object_r:sepolicy_file:s0
+/plat_tee_service_contexts u:object_r:tee_service_contexts_file:s0
+/plat_service_contexts u:object_r:service_contexts_file:s0
+/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
+/vendor_service_contexts u:object_r:vendor_service_contexts_file:s0
+/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/vndservice_contexts u:object_r:vndservice_contexts_file:s0
+
+##########################
+# Devices
+#
+/dev(/.*)? u:object_r:device:s0
+/dev/adf[0-9]* u:object_r:graphics_device:s0
+/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
+/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
+/dev/ashmem u:object_r:ashmem_device:s0
+/dev/ashmem(.*)? u:object_r:ashmem_libcutils_device:s0
+/dev/audio.* u:object_r:audio_device:s0
+/dev/binder u:object_r:binder_device:s0
+/dev/block(/.*)? u:object_r:block_device:s0
+/dev/block/by-name/zoned_device u:object_r:zoned_block_device:s0
+/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
+/dev/block/ublkb[0-9]+ u:object_r:ublk_block_device:s0
+/dev/block/loop[0-9]* u:object_r:loop_device:s0
+/dev/block/vd[a-z][0-9]* u:object_r:vd_device:s0
+/dev/block/vold/.+ u:object_r:vold_device:s0
+/dev/block/ram[0-9]* u:object_r:ram_device:s0
+/dev/block/zram[0-9]* u:object_r:ram_device:s0
+/dev/boringssl/selftest(/.*)? u:object_r:boringssl_self_test_marker:s0
+/dev/bus/usb(.*)? u:object_r:usb_device:s0
+/dev/console u:object_r:console_device:s0
+/dev/cpu_variant:.* u:object_r:dev_cpu_variant:s0
+/dev/dma_heap(/.*)? u:object_r:dmabuf_heap_device:s0
+/dev/dma_heap/system u:object_r:dmabuf_system_heap_device:s0
+/dev/dma_heap/system-uncached u:object_r:dmabuf_system_heap_device:s0
+/dev/dma_heap/system-secure(.*) u:object_r:dmabuf_system_secure_heap_device:s0
+/dev/dm-user(/.*)? u:object_r:dm_user_device:s0
+/dev/ublk-control u:object_r:ublk_control_device:s0
+/dev/device-mapper u:object_r:dm_device:s0
+/dev/eac u:object_r:audio_device:s0
+/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
+/dev/cgroup_info(/.*)? u:object_r:cgroup_rc_file:s0
+/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
+/dev/fuse u:object_r:fuse_device:s0
+/dev/gnss[0-9]+ u:object_r:gnss_device:s0
+/dev/graphics(/.*)? u:object_r:graphics_device:s0
+/dev/hidraw[0-9]+ u:object_r:hidraw_device:s0
+/dev/hw_random u:object_r:hw_random_device:s0
+/dev/hwbinder u:object_r:hwbinder_device:s0
+/dev/input(/.*)? u:object_r:input_device:s0
+/dev/iio:device[0-9]+ u:object_r:iio_device:s0
+/dev/ion u:object_r:ion_device:s0
+/dev/keychord u:object_r:keychord_device:s0
+/dev/loop-control u:object_r:loop_control_device:s0
+/dev/modem.* u:object_r:radio_device:s0
+/dev/mtp_usb u:object_r:mtp_device:s0
+/dev/pmsg0 u:object_r:pmsg_device:s0
+/dev/pn544 u:object_r:nfc_device:s0
+/dev/port u:object_r:port_device:s0
+/dev/ptmx u:object_r:ptmx_device:s0
+/dev/pvrsrvkm u:object_r:gpu_device:s0
+/dev/kmsg u:object_r:kmsg_device:s0
+/dev/kmsg_debug u:object_r:kmsg_debug_device:s0
+/dev/kvm u:object_r:kvm_device:s0
+/dev/null u:object_r:null_device:s0
+/dev/nvhdcp1 u:object_r:video_device:s0
+/dev/random u:object_r:random_device:s0
+/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
+/dev/rproc_user u:object_r:rpmsg_device:s0
+/dev/rtc[0-9] u:object_r:rtc_device:s0
+/dev/snd(/.*)? u:object_r:audio_device:s0
+/dev/socket(/.*)? u:object_r:socket_device:s0
+/dev/socket/adbd u:object_r:adbd_socket:s0
+/dev/socket/aconfigd_mainline u:object_r:aconfigd_mainline_socket:s0
+/dev/socket/aconfigd_system u:object_r:aconfigd_socket:s0
+/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
+/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
+/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
+/dev/socket/lmkd u:object_r:lmkd_socket:s0
+/dev/socket/logd u:object_r:logd_socket:s0
+/dev/socket/logdr u:object_r:logdr_socket:s0
+/dev/socket/logdw u:object_r:logdw_socket:s0
+/dev/socket/statsdw u:object_r:statsdw_socket:s0
+/dev/socket/mdns u:object_r:mdns_socket:s0
+/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
+/dev/socket/ot-daemon(/.*)? u:object_r:ot_daemon_socket:s0
+/dev/socket/pdx/system/buffer_hub u:object_r:pdx_bufferhub_dir:s0
+/dev/socket/pdx/system/buffer_hub/client u:object_r:pdx_bufferhub_client_endpoint_socket:s0
+/dev/socket/pdx/system/performance u:object_r:pdx_performance_dir:s0
+/dev/socket/pdx/system/performance/client u:object_r:pdx_performance_client_endpoint_socket:s0
+/dev/socket/pdx/system/vr/display u:object_r:pdx_display_dir:s0
+/dev/socket/pdx/system/vr/display/client u:object_r:pdx_display_client_endpoint_socket:s0
+/dev/socket/pdx/system/vr/display/manager u:object_r:pdx_display_manager_endpoint_socket:s0
+/dev/socket/pdx/system/vr/display/screenshot u:object_r:pdx_display_screenshot_endpoint_socket:s0
+/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
+/dev/socket/prng_seeder u:object_r:prng_seeder_socket:s0
+/dev/socket/property_service u:object_r:property_socket:s0
+/dev/socket/property_service_for_system u:object_r:property_socket:s0
+/dev/socket/recovery u:object_r:recovery_socket:s0
+/dev/socket/rild u:object_r:rild_socket:s0
+/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
+/dev/socket/snapuserd u:object_r:snapuserd_socket:s0
+/dev/socket/snapuserd_proxy u:object_r:snapuserd_proxy_socket:s0
+/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
+/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
+/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
+/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0
+/dev/socket/traced_perf u:object_r:traced_perf_socket:s0
+/dev/socket/traced_producer u:object_r:traced_producer_socket:s0
+/dev/socket/heapprofd u:object_r:heapprofd_socket:s0
+/dev/socket/uncrypt u:object_r:uncrypt_socket:s0
+/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
+/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
+/dev/socket/zygote u:object_r:zygote_socket:s0
+/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
+/dev/socket/usap_pool_primary u:object_r:zygote_socket:s0
+/dev/socket/usap_pool_secondary u:object_r:zygote_socket:s0
+/dev/spdif_out.* u:object_r:audio_device:s0
+/dev/sys/block/by-name/rootdisk(/.*)? u:object_r:rootdisk_sysdev:s0
+/dev/sys/block/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0
+/dev/sys/fs/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0
+/dev/tty u:object_r:owntty_device:s0
+/dev/tty[0-9]* u:object_r:tty_device:s0
+/dev/ttyS[0-9]* u:object_r:serial_device:s0
+/dev/ttyUSB[0-9]* u:object_r:usb_serial_device:s0
+/dev/ttyACM[0-9]* u:object_r:usb_serial_device:s0
+/dev/tun u:object_r:tun_device:s0
+/dev/uhid u:object_r:uhid_device:s0
+/dev/uinput u:object_r:uhid_device:s0
+/dev/uio[0-9]* u:object_r:uio_device:s0
+/dev/urandom u:object_r:random_device:s0
+/dev/usb_accessory u:object_r:usbaccessory_device:s0
+/dev/v4l-touch[0-9]* u:object_r:input_device:s0
+/dev/vfio(/.*)? u:object_r:vfio_device:s0
+/dev/vhost-vsock u:object_r:kvm_device:s0
+/dev/video[0-9]* u:object_r:video_device:s0
+/dev/vndbinder u:object_r:vndbinder_device:s0
+/dev/watchdog u:object_r:watchdog_device:s0
+/dev/xt_qtaguid u:object_r:qtaguid_device:s0
+/dev/zero u:object_r:zero_device:s0
+/dev/__properties__ u:object_r:properties_device:s0
+/dev/__properties__/appcompat_override u:object_r:properties_device:s0
+/dev/__properties__/property_info u:object_r:property_info:s0
+/dev/__properties__/appcompat_override/property_info u:object_r:property_info:s0
+#############################
+# Linker configuration
+#
+/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
+
+#############################
+# System files
+#
+/system(/.*)? u:object_r:system_file:s0
+/system/apex/com.android.art u:object_r:art_apex_dir:s0
+/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0
+/system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0
+/system/bin/mm_events u:object_r:mm_events_exec:s0
+/system/bin/atrace u:object_r:atrace_exec:s0
+/system/bin/auditctl u:object_r:auditctl_exec:s0
+/system/bin/bcc u:object_r:rs_exec:s0
+/system/bin/blank_screen u:object_r:blank_screen_exec:s0
+/system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
+/system/bin/prng_seeder u:object_r:prng_seeder_exec:s0
+/system/bin/charger u:object_r:charger_exec:s0
+/system/bin/e2fsdroid u:object_r:e2fs_exec:s0
+/system/bin/mke2fs u:object_r:e2fs_exec:s0
+/system/bin/e2fsck -- u:object_r:fsck_exec:s0
+/system/bin/extra_free_kbytes\.sh u:object_r:extra_free_kbytes_exec:s0
+/system/bin/fsck\.exfat -- u:object_r:fsck_exec:s0
+/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
+/system/bin/init u:object_r:init_exec:s0
+# TODO(/123600489): merge mini-keyctl into toybox
+/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
+/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
+/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
+/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
+/system/bin/tcpdump -- u:object_r:tcpdump_exec:s0
+/system/bin/tune2fs -- u:object_r:fsck_exec:s0
+/system/bin/resize2fs -- u:object_r:fsck_exec:s0
+/system/bin/toolbox -- u:object_r:toolbox_exec:s0
+/system/bin/toybox -- u:object_r:toolbox_exec:s0
+/system/bin/ld\.mc u:object_r:rs_exec:s0
+/system/bin/logcat -- u:object_r:logcat_exec:s0
+/system/bin/logcatd -- u:object_r:logcat_exec:s0
+/system/bin/sh -- u:object_r:shell_exec:s0
+/system/bin/run-as -- u:object_r:runas_exec:s0
+/system/bin/bootanimation u:object_r:bootanim_exec:s0
+/system/bin/bootstat u:object_r:bootstat_exec:s0
+/system/bin/app_process32 u:object_r:zygote_exec:s0
+/system/bin/app_process64 u:object_r:zygote_exec:s0
+/system/bin/servicemanager u:object_r:servicemanager_exec:s0
+/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
+/system/bin/gpuservice u:object_r:gpuservice_exec:s0
+/system/bin/bufferhubd u:object_r:bufferhubd_exec:s0
+/system/bin/performanced u:object_r:performanced_exec:s0
+/system/bin/drmserver u:object_r:drmserver_exec:s0
+/system/bin/drmserver32 u:object_r:drmserver_exec:s0
+/system/bin/drmserver64 u:object_r:drmserver_exec:s0
+/system/bin/dumpstate u:object_r:dumpstate_exec:s0
+/system/bin/incident u:object_r:incident_exec:s0
+/system/bin/incidentd u:object_r:incidentd_exec:s0
+/system/bin/incident_helper u:object_r:incident_helper_exec:s0
+/system/bin/iw u:object_r:iw_exec:s0
+/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
+/system/bin/vold u:object_r:vold_exec:s0
+/system/bin/netd u:object_r:netd_exec:s0
+/system/bin/wificond u:object_r:wificond_exec:s0
+/system/bin/ot-ctl u:object_r:ot_ctl_exec:s0
+/system/bin/audioserver u:object_r:audioserver_exec:s0
+/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
+/system/bin/mediaserver u:object_r:mediaserver_exec:s0
+/system/bin/mediaserver32 u:object_r:mediaserver_exec:s0
+/system/bin/mediaserver64 u:object_r:mediaserver_exec:s0
+/system/bin/mediametrics u:object_r:mediametrics_exec:s0
+/system/bin/cameraserver u:object_r:cameraserver_exec:s0
+/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
+/system/bin/mediaswcodec u:object_r:mediaswcodec_exec:s0
+/system/bin/mediatranscoding u:object_r:mediatranscoding_exec:s0
+/system/bin/mediatuner u:object_r:mediatuner_exec:s0
+/system/bin/mdnsd u:object_r:mdnsd_exec:s0
+/system/bin/installd u:object_r:installd_exec:s0
+/system/bin/otapreopt_chroot u:object_r:otapreopt_chroot_exec:s0
+/system/bin/otapreopt_slot u:object_r:otapreopt_slot_exec:s0
+/system/bin/credstore u:object_r:credstore_exec:s0
+/system/bin/keystore u:object_r:keystore_exec:s0
+/system/bin/keystore2 u:object_r:keystore_exec:s0
+/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
+/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
+/system/bin/tombstoned u:object_r:tombstoned_exec:s0
+/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
+/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
+/system/bin/sdcard u:object_r:sdcardd_exec:s0
+/system/bin/snapshotctl u:object_r:snapshotctl_exec:s0
+/system/bin/remount u:object_r:remount_exec:s0
+/system/bin/dhcpcd u:object_r:dhcp_exec:s0
+/system/bin/dhcpcd-6\.8\.2 u:object_r:dhcp_exec:s0
+/system/bin/dmesgd u:object_r:dmesgd_exec:s0
+/system/xbin/su u:object_r:su_exec:s0
+/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
+/system/bin/linker(64)? u:object_r:system_linker_exec:s0
+/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
+/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
+/system/bin/bootstrap/linkerconfig u:object_r:linkerconfig_exec:s0
+/system/bin/llkd u:object_r:llkd_exec:s0
+/system/bin/lmkd u:object_r:lmkd_exec:s0
+/system/bin/mmd u:object_r:mmd_exec:s0
+/system/bin/usbd u:object_r:usbd_exec:s0
+/system/bin/inputflinger u:object_r:inputflinger_exec:s0
+/system/bin/logd u:object_r:logd_exec:s0
+/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
+/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
+/system/bin/perfetto u:object_r:perfetto_exec:s0
+/system/bin/mtectrl u:object_r:mtectrl_exec:s0
+/system/bin/misctrl u:object_r:misctrl_exec:s0
+/system/bin/kcmdlinectrl u:object_r:kcmdlinectrl_exec:s0
+/system/bin/traced u:object_r:traced_exec:s0
+/system/bin/traced_perf u:object_r:traced_perf_exec:s0
+/system/bin/traced_probes u:object_r:traced_probes_exec:s0
+/system/bin/traced_relay u:object_r:traced_exec:s0
+/system/bin/trace_redactor u:object_r:trace_redactor_exec:s0
+/system/bin/heapprofd u:object_r:heapprofd_exec:s0
+/system/bin/uncrypt u:object_r:uncrypt_exec:s0
+/system/bin/update_verifier u:object_r:update_verifier_exec:s0
+/system/bin/logwrapper u:object_r:system_file:s0
+/system/bin/vdc u:object_r:vdc_exec:s0
+/system/bin/cppreopts\.sh u:object_r:cppreopts_exec:s0
+/system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
+/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
+/system/bin/sgdisk u:object_r:sgdisk_exec:s0
+/system/bin/blkid u:object_r:blkid_exec:s0
+/system/bin/flags_health_check -- u:object_r:flags_health_check_exec:s0
+/system/bin/idmap2(d)? u:object_r:idmap_exec:s0
+/system/bin/update_engine u:object_r:update_engine_exec:s0
+/system/bin/update_engine_nostats u:object_r:update_engine_exec:s0
+/system/bin/profcollectd u:object_r:profcollectd_exec:s0
+/system/bin/profcollectctl u:object_r:profcollectd_exec:s0
+/system/bin/storaged u:object_r:storaged_exec:s0
+/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
+/system/bin/virtual_camera u:object_r:virtual_camera_exec:s0
+/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
+/system/bin/hw/android\.system\.suspend-service u:object_r:system_suspend_exec:s0
+/system/bin/memcgv2_activation_depth\.sh u:object_r:memcgv2_activation_depth_exec:s0
+/system/etc/aconfig(/.*)? u:object_r:system_aconfig_storage_file:s0
+/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
+/system/etc/task_profiles/cgroups_[0-9]+\.json u:object_r:cgroup_desc_file:s0
+/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0
+/system/etc/font_fallback.xml u:object_r:system_font_fallback_file:s0
+/system/etc/group u:object_r:system_group_file:s0
+/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0
+/system/etc/passwd u:object_r:system_passwd_file:s0
+/system/etc/perfetto(/.*)? u:object_r:system_perfetto_config_file:s0
+/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
+/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
+/system/etc/selinux/mapping/[0-9]+\.[0-9]+(\.compat)?\.cil u:object_r:sepolicy_file:s0
+/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
+/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
+/system/etc/selinux/plat_tee_service_contexts u:object_r:tee_service_contexts_file:s0
+/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
+/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/system/etc/selinux/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
+/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0
+/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
+/system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
+/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
+/system/etc/task_profiles\.json u:object_r:task_profiles_file:s0
+/system/etc/task_profiles/task_profiles_[0-9]+\.json u:object_r:task_profiles_file:s0
+/system/usr/share/zoneinfo(/.*)? u:object_r:system_zoneinfo_file:s0
+/system/bin/adbd u:object_r:adbd_exec:s0
+/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
+/system/bin/stats u:object_r:stats_exec:s0
+/system/bin/statsd u:object_r:statsd_exec:s0
+/system/bin/bpfloader u:object_r:bpfloader_exec:s0
+/system/bin/netbpfload u:object_r:bpfloader_exec:s0
+/system/bin/watchdogd u:object_r:watchdogd_exec:s0
+/system/bin/aconfigd-system u:object_r:aconfigd_exec:s0
+/system/bin/apexd u:object_r:apexd_exec:s0
+/system/bin/gsid u:object_r:gsid_exec:s0
+/system/bin/simpleperf u:object_r:simpleperf_exec:s0
+/system/bin/simpleperf_app_runner u:object_r:simpleperf_app_runner_exec:s0
+/system/bin/migrate_legacy_obb_data u:object_r:migrate_legacy_obb_data_exec:s0
+/system/bin/android\.frameworks\.automotive\.display@1\.0-service u:object_r:automotive_display_service_exec:s0
+/system/bin/snapuserd u:object_r:snapuserd_exec:s0
+/system/bin/odsign u:object_r:odsign_exec:s0
+/system/bin/vehicle_binding_util u:object_r:vehicle_binding_util_exec:s0
+/system/bin/cardisplayproxyd u:object_r:automotive_display_service_exec:s0
+/system/bin/evsmanagerd u:object_r:evsmanagerd_exec:s0
+/system/bin/android\.automotive\.evs\.manager@1\.[0-9]+ u:object_r:evsmanagerd_exec:s0
+/system/bin/uprobestats u:object_r:uprobestats_exec:s0
+/system/bin/bert_collector u:object_r:bert_collector_exec:s0
+/system/bin/linux_vm_setup u:object_r:linux_vm_setup_exec:s0
+/system/bin/tradeinmode u:object_r:tradeinmode_exec:s0
+/system/bin/prefetch u:object_r:prefetch_exec:s0
+
+#############################
+# Vendor files
+#
+/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
+/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
+/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
+/(vendor|system/vendor)/bin/toolbox u:object_r:vendor_toolbox_exec:s0
+/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
+/(vendor|system/vendor)/etc/cgroups\.json u:object_r:vendor_cgroup_desc_file:s0
+/(vendor|system/vendor)/etc/task_profiles\.json u:object_r:vendor_task_profiles_file:s0
+/(vendor|system/vendor)/etc/avf/microdroid(/.*)? u:object_r:vendor_microdroid_file:s0
+
+/(vendor|system/vendor)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
+
+/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
+
+/(vendor|system/vendor)/manifest\.xml u:object_r:vendor_configs_file:s0
+/(vendor|system/vendor)/compatibility_matrix\.xml u:object_r:vendor_configs_file:s0
+/(vendor|system/vendor)/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0
+/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
+/(vendor|system/vendor)/priv-app(/.*)? u:object_r:vendor_app_file:s0
+/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
+/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
+
+/(vendor|system/vendor)/bin/misc_writer u:object_r:vendor_misc_writer_exec:s0
+/(vendor|system/vendor)/bin/boringssl_self_test(32|64) u:object_r:vendor_boringssl_self_test_exec:s0
+
+/(vendor|system/vendor)/etc/aconfig(/.*)? u:object_r:vendor_aconfig_storage_file:s0
+
+/vendor/boot_otas(/.*)? u:object_r:vendor_boot_ota_file:s0
+
+# HAL location
+/(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0
+
+/(vendor|system/vendor)/etc/selinux/vendor_service_contexts u:object_r:vendor_service_contexts_file:s0
+
+#############################
+# OEM and ODM files
+#
+/(odm|vendor/odm)(/.*)? u:object_r:vendor_file:s0
+/(odm|vendor/odm)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
+/(odm|vendor/odm)/lib(64)?/hw u:object_r:vendor_hal_file:s0
+/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
+/(odm|vendor/odm)/bin/sh u:object_r:vendor_shell_exec:s0
+/(odm|vendor/odm)/etc(/.*)? u:object_r:vendor_configs_file:s0
+/(odm|vendor/odm)/app(/.*)? u:object_r:vendor_app_file:s0
+/(odm|vendor/odm)/priv-app(/.*)? u:object_r:vendor_app_file:s0
+/(odm|vendor/odm)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
+/(odm|vendor/odm)/framework(/.*)? u:object_r:vendor_framework_file:s0
+
+# secure-element service: vendor uuid mapping config file
+/(odm|vendor/odm|vendor|system/vendor)/etc/hal_uuid_map_(.*)?\.xml u:object_r:vendor_uuid_mapping_config_file:s0
+
+# APEX packages
+/(odm|vendor/odm|vendor|system/vendor)/apex(/[^/]+){0,2} u:object_r:vendor_apex_file:s0
+
+# Input configuration
+/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)? u:object_r:vendor_keylayout_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)?\.kl u:object_r:vendor_keylayout_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)? u:object_r:vendor_keychars_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)?\.kcm u:object_r:vendor_keychars_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)? u:object_r:vendor_idc_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)?\.idc u:object_r:vendor_idc_file:s0
+
+/oem(/.*)? u:object_r:oemfs:s0
+/oem/overlay(/.*)? u:object_r:vendor_overlay_file:s0
+/oem/media/bootanimation.zip u:object_r:bootanim_oem_file:s0
+/oem/media/shutdownanimation.zip u:object_r:bootanim_oem_file:s0
+/oem/media/userspace-reboot.zip u:object_r:bootanim_oem_file:s0
+
+# The precompiled monolithic sepolicy will be under /odm only when
+# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
+/odm/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
+/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
+
+/(odm|vendor/odm)/etc/selinux/odm_sepolicy\.cil u:object_r:sepolicy_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_file_contexts u:object_r:file_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts u:object_r:seapp_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_property_contexts u:object_r:property_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_service_contexts u:object_r:vendor_service_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_mac_permissions\.xml u:object_r:mac_perms_file:s0
+/(odm|vendor/odm)/etc/selinux/odm_tee_service_contexts u:object_r:tee_service_contexts_file:s0
+
+#############################
+# Product files
+#
+/(product|system/product)(/.*)? u:object_r:system_file:s0
+/(product|system/product)/etc/group u:object_r:system_group_file:s0
+/(product|system/product)/etc/passwd u:object_r:system_passwd_file:s0
+/(product|system/product)/overlay(/.*)? u:object_r:system_file:s0
+
+/(product|system/product)/etc/selinux/product_file_contexts u:object_r:file_contexts_file:s0
+/(product|system/product)/etc/selinux/product_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/(product|system/product)/etc/selinux/product_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
+/(product|system/product)/etc/selinux/product_property_contexts u:object_r:property_contexts_file:s0
+/(product|system/product)/etc/selinux/product_seapp_contexts u:object_r:seapp_contexts_file:s0
+/(product|system/product)/etc/selinux/product_service_contexts u:object_r:service_contexts_file:s0
+/(product|system/product)/etc/selinux/product_mac_permissions\.xml u:object_r:mac_perms_file:s0
+/(product|system/product)/etc/selinux/product_tee_service_contexts u:object_r:tee_service_contexts_file:s0
+
+/(product|system/product)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
+
+/(product|system/product)/etc/security/adb_keys u:object_r:adb_keys_file:s0
+/(product|system/product)/etc/aconfig(/.*)? u:object_r:system_aconfig_storage_file:s0
+
+#############################
+# SystemExt files
+#
+/(system_ext|system/system_ext)(/.*)? u:object_r:system_file:s0
+/(system_ext|system/system_ext)/etc/group u:object_r:system_group_file:s0
+/(system_ext|system/system_ext)/etc/passwd u:object_r:system_passwd_file:s0
+/(system_ext|system/system_ext)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
+
+/(system_ext|system/system_ext)/etc/selinux/system_ext_file_contexts u:object_r:file_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_hwservice_contexts u:object_r:hwservice_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_property_contexts u:object_r:property_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_seapp_contexts u:object_r:seapp_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_service_contexts u:object_r:service_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
+/(system_ext|system/system_ext)/etc/selinux/userdebug_plat_sepolicy\.cil u:object_r:sepolicy_file:s0
+
+/(system_ext|system/system_ext)/bin/aidl_lazy_test_server u:object_r:aidl_lazy_test_server_exec:s0
+/(system_ext|system/system_ext)/bin/aidl_lazy_cb_test_server u:object_r:aidl_lazy_test_server_exec:s0
+/(system_ext|system/system_ext)/bin/hidl_lazy_test_server u:object_r:hidl_lazy_test_server_exec:s0
+/(system_ext|system/system_ext)/bin/hidl_lazy_cb_test_server u:object_r:hidl_lazy_test_server_exec:s0
+/(system_ext|system/system_ext)/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0
+/(system_ext|system/system_ext)/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
+/(system_ext|system/system_ext)/bin/rkp_cert_processor u:object_r:rkp_cert_processor_exec:s0
+
+/(system_ext|system/system_ext)/bin/canhalconfigurator(-aidl)? u:object_r:canhalconfigurator_exec:s0
+
+/(system_ext|system/system_ext)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
+
+/(system_ext|system/system_ext)/etc/aconfig(/.*)? u:object_r:system_aconfig_storage_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_tee_service_contexts u:object_r:tee_service_contexts_file:s0
+
+#############################
+# VendorDlkm files
+# This includes VENDOR Dynamically Loadable Kernel Modules and other misc files.
+#
+/(vendor_dlkm|vendor/vendor_dlkm|system/vendor/vendor_dlkm)(/.*)? u:object_r:vendor_file:s0
+/(vendor_dlkm|vendor/vendor_dlkm|system/vendor/vendor_dlkm)/etc(/.*)? u:object_r:vendor_configs_file:s0
+
+#############################
+# OdmDlkm files
+# This includes ODM Dynamically Loadable Kernel Modules and other misc files.
+#
+/(odm_dlkm|vendor/odm_dlkm|system/vendor/odm_dlkm)(/.*)? u:object_r:vendor_file:s0
+/(odm_dlkm|vendor/odm_dlkm|system/vendor/odm_dlkm)/etc(/.*)? u:object_r:vendor_configs_file:s0
+
+#############################
+# Vendor files from /(product|system/product)/vendor_overlay
+#
+# NOTE: For additional vendor file contexts for vendor overlay files,
+# use device specific file_contexts.
+#
+/(product|system/product)/vendor_overlay/[0-9]+/.* u:object_r:vendor_file:s0
+
+#############################
+# Data files
+#
+# NOTE: When modifying existing label rules, changes may also need to
+# propagate to the "Expanded data files" section.
+#
+/data u:object_r:system_data_root_file:s0
+/data/(.*)? u:object_r:system_data_file:s0
+/data/system/environ(/.*)? u:object_r:environ_system_data_file:s0
+/data/system/packages\.list u:object_r:packages_list_file:s0
+/data/system/game_mode_intervention\.list u:object_r:game_mode_intervention_list_file:s0
+/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
+/data/backup(/.*)? u:object_r:backup_data_file:s0
+/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
+/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
+/data/system/unsolzygotesocket u:object_r:system_unsolzygote_socket:s0
+/data/drm(/.*)? u:object_r:drm_data_file:s0
+/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
+/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
+/data/ota(/.*)? u:object_r:ota_data_file:s0
+/data/ota_package(/.*)? u:object_r:ota_package_file:s0
+/data/adb(/.*)? u:object_r:adb_data_file:s0
+/data/anr(/.*)? u:object_r:anr_data_file:s0
+/data/apex(/.*)? u:object_r:apex_data_file:s0
+/data/apex/active/(.*)? u:object_r:staging_data_file:s0
+/data/apex/backup/(.*)? u:object_r:staging_data_file:s0
+/data/apex/decompressed/(.*)? u:object_r:staging_data_file:s0
+/data/apex/ota_reserved(/.*)? u:object_r:apex_ota_reserved_file:s0
+/data/app(/.*)? u:object_r:apk_data_file:s0
+/data/app-metadata(/.*)? u:object_r:apk_metadata_file:s0
+# Traditional /data/app/[packageName]-[randomString]/base.apk location
+/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+# /data/app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
+/data/app/[^/]+/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
+/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
+/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
+/data/gsi(/.*)? u:object_r:gsi_data_file:s0
+/data/gsi_persistent_data u:object_r:gsi_persistent_data_file:s0
+/data/gsi/ota(/.*)? u:object_r:ota_image_data_file:s0
+/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
+/data/local/tests(/.*)? u:object_r:shell_test_data_file:s0
+/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
+/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
+/data/local/traces(/.*)? u:object_r:trace_data_file:s0
+/data/media u:object_r:media_userdir_file:s0
+/data/media/.* u:object_r:media_rw_data_file:s0
+/data/mediadrm(/.*)? u:object_r:media_data_file:s0
+/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
+/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
+# This directory was removed after Q Beta 2, but we need to preserve labels for upgrading devices.
+/data/pkg_staging(/.*)? u:object_r:staging_data_file:s0
+/data/property(/.*)? u:object_r:property_data_file:s0
+/data/preloads(/.*)? u:object_r:preloads_data_file:s0
+/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
+/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
+/data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
+/data/app-staging(/.*)? u:object_r:staging_data_file:s0
+# Ensure we have the same labels as /data/app or /data/apex/active
+# to avoid restorecon conflicts
+/data/rollback/\d+/[^/]+/.*\.apk u:object_r:apk_data_file:s0
+/data/rollback/\d+/[^/]+/.*\.apex u:object_r:staging_data_file:s0
+/data/fonts/files(/.*)? u:object_r:font_data_file:s0
+/data/misc_ce u:object_r:system_userdir_file:s0
+/data/misc_de u:object_r:system_userdir_file:s0
+/data/system_ce u:object_r:system_userdir_file:s0
+/data/system_de u:object_r:system_userdir_file:s0
+/data/user u:object_r:system_userdir_file:s0
+/data/user_de u:object_r:system_userdir_file:s0
+/data/storage_area u:object_r:system_userdir_file:s0
+
+# Misc data
+/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
+/data/misc/a11ytrace(/.*)? u:object_r:accessibility_trace_data_file:s0
+/data/misc/apexdata(/.*)? u:object_r:apex_module_data_file:s0
+/data/misc/apexdata/com\.android\.art(/.*)? u:object_r:apex_art_data_file:s0
+/data/misc/apexdata/com\.android\.compos(/.*)? u:object_r:apex_compos_data_file:s0
+/data/misc/apexdata/com\.android\.virt(/.*)? u:object_r:apex_virt_data_file:s0
+/data/misc/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc/apexdata/com\.android\.scheduling(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc/apexdata/com\.android\.tethering(/.*)? u:object_r:apex_tethering_data_file:s0
+/data/misc/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_uwb_data_file:s0
+/data/misc/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
+/data/misc/apns(/.*)? u:object_r:radio_data_file:s0
+/data/misc/appcompat(/.*)? u:object_r:appcompat_data_file:s0
+/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
+/data/misc/audioserver(/.*)? u:object_r:audioserver_data_file:s0
+/data/misc/audiohal(/.*)? u:object_r:audiohal_data_file:s0
+/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
+/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
+/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
+/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
+/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
+/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
+/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
+/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
+/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
+/data/misc/connectivityblobdb(/.*)? u:object_r:connectivityblob_data_file:s0
+/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
+/data/misc/dhcp-6\.8\.2(/.*)? u:object_r:dhcp_data_file:s0
+/data/misc/dmesgd(/.*)? u:object_r:dmesgd_data_file:s0
+/data/misc/emergencynumberdb(/.*)? u:object_r:emergency_data_file:s0
+/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
+/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
+/data/misc/installd(/.*)? u:object_r:install_data_file:s0
+/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
+/data/misc/credstore(/.*)? u:object_r:credstore_data_file:s0
+/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
+/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
+/data/misc/media(/.*)? u:object_r:media_data_file:s0
+/data/misc/net(/.*)? u:object_r:net_data_file:s0
+/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
+/data/misc/telephonyconfig(/.*)? u:object_r:radio_data_file:s0
+/data/misc/nfc/logs(/.*)? u:object_r:nfc_logs_data_file:s0
+/data/misc/odrefresh(/.*)? u:object_r:odrefresh_data_file:s0
+/data/misc/odsign(/.*)? u:object_r:odsign_data_file:s0
+/data/misc/odsign/metrics(/.*)? u:object_r:odsign_metrics_file:s0
+/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
+/data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
+/data/misc/perfetto-traces/profiling(/.*)? u:object_r:perfetto_traces_profiling_data_file:s0
+/data/misc/perfetto-configs(/.*)? u:object_r:perfetto_configs_data_file:s0
+/data/misc/uprobestats-configs(/.*)? u:object_r:uprobestats_configs_data_file:s0
+/data/misc/prereboot(/.*)? u:object_r:prereboot_data_file:s0
+/data/misc/profcollectd(/.*)? u:object_r:profcollectd_data_file:s0
+/data/misc/radio(/.*)? u:object_r:radio_core_data_file:s0
+/data/misc/recovery(/.*)? u:object_r:recovery_data_file:s0
+/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
+/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
+/data/misc/snapshotctl_log(/.*)? u:object_r:snapshotctl_log_data_file:s0
+/data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
+/data/misc/stats-data(/.*)? u:object_r:stats_data_file:s0
+/data/misc/stats-service(/.*)? u:object_r:stats_config_data_file:s0
+/data/misc/stats-metadata(/.*)? u:object_r:stats_data_file:s0
+/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
+/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
+/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
+/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
+/data/misc/virtualizationservice(/.*)? u:object_r:virtualizationservice_data_file:s0
+/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
+/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
+/data/misc_ce/[0-9]+/wifi(/.*)? u:object_r:wifi_data_file:s0
+/data/misc/wifi/mainline_supplicant(/.*)? u:object_r:mainline_supplicant_data_file:s0
+/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
+/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
+/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
+/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
+/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
+/data/misc/snapuserd_log(/.*)? u:object_r:snapuserd_log_data_file:s0
+/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
+/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
+/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
+/data/misc/wmtrace(/.*)? u:object_r:wm_trace_data_file:s0
+# TODO(calin) label profile reference differently so that only
+# profman run as a special user can write to them
+/data/misc/profiles/cur(/[0-9]+)? u:object_r:user_profile_root_file:s0
+/data/misc/profiles/cur/[0-9]+/.* u:object_r:user_profile_data_file:s0
+/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
+/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0
+/data/vendor(/.*)? u:object_r:vendor_data_file:s0
+/data/vendor_ce u:object_r:vendor_userdir_file:s0
+/data/vendor_ce/.* u:object_r:vendor_data_file:s0
+/data/vendor_de u:object_r:vendor_userdir_file:s0
+/data/vendor_de/.* u:object_r:vendor_data_file:s0
+/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
+
+# storaged proto files
+/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
+/data/misc_ce/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
+
+# checkin data files
+/data/misc_ce/[0-9]+/checkin(/.*)? u:object_r:checkin_data_file:s0
+
+# Fingerprint data
+/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
+
+# Fingerprint vendor data file
+/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
+
+# Face vendor data file
+/data/vendor_de/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
+/data/vendor_ce/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
+
+# Iris vendor data file
+/data/vendor_de/[0-9]+/irisdata(/.*)? u:object_r:iris_vendor_data_file:s0
+
+# Bootchart data
+/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
+
+# Sandbox sdk data (managed by installd)
+/data/misc_de/[0-9]+/sdksandbox u:object_r:sdk_sandbox_system_data_file:s0
+/data/misc_ce/[0-9]+/sdksandbox u:object_r:sdk_sandbox_system_data_file:s0
+
+# App data snapshots (managed by installd).
+/data/misc_de/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
+/data/misc_ce/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
+
+# Apex data directories
+/data/misc_de/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
+/data/misc_ce/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com\.android\.appsearch(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_de/[0-9]+/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_de/[0-9]+/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_de/[0-9]+/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
+
+# Apex rollback directories
+/data/misc_de/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
+/data/misc_ce/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
+
+# Incremental directories
+/data/incremental(/.*)? u:object_r:apk_data_file:s0
+/data/incremental/MT_[^/]+/mount/.pending_reads u:object_r:incremental_control_file:s0
+/data/incremental/MT_[^/]+/mount/.log u:object_r:incremental_control_file:s0
+/data/incremental/MT_[^/]+/mount/.blocks_written u:object_r:incremental_control_file:s0
+
+# Boot animation data
+/data/misc/bootanim(/.*)? u:object_r:bootanim_data_file:s0
+#############################
+# Expanded data files
+#
+/mnt/expand u:object_r:mnt_expand_file:s0
+/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
+/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
+/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+# /mnt/expand/..../app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
+/mnt/expand/[^/]+/app/[^/]+/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
+/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
+/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
+/mnt/expand/[^/]+/media u:object_r:media_userdir_file:s0
+/mnt/expand/[^/]+/media/.* u:object_r:media_rw_data_file:s0
+/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
+/mnt/expand/[^/]+/misc_ce u:object_r:system_userdir_file:s0
+/mnt/expand/[^/]+/misc_de u:object_r:system_userdir_file:s0
+/mnt/expand/[^/]+/user u:object_r:system_userdir_file:s0
+/mnt/expand/[^/]+/user_de u:object_r:system_userdir_file:s0
+
+# coredump directory for userdebug/eng devices
+/cores(/.*)? u:object_r:coredump_file:s0
+
+# Wallpaper files
+/data/system/users/[0-9]+/wallpaper_lock_orig u:object_r:wallpaper_file:s0
+/data/system/users/[0-9]+/wallpaper_lock u:object_r:wallpaper_file:s0
+/data/system/users/[0-9]+/wallpaper_orig u:object_r:wallpaper_file:s0
+/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
+
+# Ringtone files
+/data/system_de/[0-9]+/ringtones(/.*)? u:object_r:ringtone_file:s0
+
+# ShortcutManager icons, e.g.
+# /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
+/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
+
+# User icon files
+/data/system/users/[0-9]+/photo\.png u:object_r:icon_file:s0
+
+# Shutdown-checkpoints files
+/data/system/shutdown-checkpoints(/.*)? u:object_r:shutdown_checkpoints_system_data_file:s0
+
+# vold per-user data
+/data/misc_de/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
+/data/misc_ce/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
+
+# storage area keys
+/data/misc_ce/[0-9]+/storage_area_keys(/.*)? u:object_r:storage_area_key_file:s0
+
+# Backup service persistent per-user bookkeeping
+/data/system_ce/[0-9]+/backup(/.*)? u:object_r:backup_data_file:s0
+# Backup service temporary per-user data for inter-change with apps
+/data/system_ce/[0-9]+/backup_stage(/.*)? u:object_r:backup_data_file:s0
+
+#############################
+# efs files
+#
+/efs(/.*)? u:object_r:efs_file:s0
+
+#############################
+# Cache files
+#
+/cache(/.*)? u:object_r:cache_file:s0
+/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
+# General backup/restore interchange with apps
+/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
+# LocalTransport (backup) uses this subtree
+/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
+
+#############################
+# Overlayfs support directories
+#
+/cache/overlay(/.*)? u:object_r:overlayfs_file:s0
+/mnt/scratch(/.*)? u:object_r:overlayfs_file:s0
+
+/data/cache(/.*)? u:object_r:cache_file:s0
+/data/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
+# General backup/restore interchange with apps
+/data/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
+# LocalTransport (backup) uses this subtree
+/data/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
+
+#############################
+# Metadata files
+#
+/metadata(/.*)? u:object_r:metadata_file:s0
+/metadata/apex(/.*)? u:object_r:apex_metadata_file:s0
+/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
+/metadata/gsi(/.*)? u:object_r:gsi_metadata_file:s0
+/metadata/gsi/dsu/active u:object_r:gsi_public_metadata_file:s0
+/metadata/gsi/dsu/booted u:object_r:gsi_public_metadata_file:s0
+/metadata/gsi/dsu/lp_names u:object_r:gsi_public_metadata_file:s0
+/metadata/gsi/dsu/[^/]+/metadata_encryption_dir u:object_r:gsi_public_metadata_file:s0
+/metadata/gsi/ota(/.*)? u:object_r:ota_metadata_file:s0
+/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
+/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
+/metadata/bootstat(/.*)? u:object_r:metadata_bootstat_file:s0
+/metadata/staged-install(/.*)? u:object_r:staged_install_file:s0
+/metadata/watchdog(/.*)? u:object_r:watchdog_metadata_file:s0
+/metadata/repair-mode(/.*)? u:object_r:repair_mode_metadata_file:s0
+/metadata/aconfig(/.*)? u:object_r:aconfig_storage_metadata_file:s0
+/metadata/aconfig/flags(/.*)? u:object_r:aconfig_storage_flags_metadata_file:s0
+/metadata/tradeinmode(/.*)? u:object_r:tradeinmode_metadata_file:s0
+/metadata/prefetch(/.*)? u:object_r:prefetch_metadata_file:s0
+/metadata/libprocessgroup(/.*)? u:object_r:libprocessgroup_metadata_file:s0
+
+############################
+# mount point for ota metadata
+/mnt/scratch_ota_metadata_super(/.*)? u:object_r:ota_metadata_file:s0
+/mnt/scratch_ota_metadata_super/ota(/.*)? u:object_r:ota_metadata_file:s0
+/mnt/scratch_ota_metadata_super/ota/snapshots(/.*)? u:object_r:ota_metadata_file:s0
+
+#############################
+# asec containers
+/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
+/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
+/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
+/data/app-asec(/.*)? u:object_r:asec_image_file:s0
+
+#############################
+# external storage
+/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
+/mnt/user(/.*)? u:object_r:mnt_user_file:s0
+/mnt/pass_through(/.*)? u:object_r:mnt_pass_through_file:s0
+/mnt/sdcard u:object_r:mnt_sdcard_file:s0
+/mnt/runtime(/.*)? u:object_r:storage_file:s0
+/storage(/.*)? u:object_r:storage_file:s0
+
+#############################
+# mount point for read-write vendor partitions
+/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0
+
+#############################
+# mount point for read-write product partitions
+/mnt/product(/.*)? u:object_r:mnt_product_file:s0
+
+#############################
+# /postinstall file contexts
+/(system|product)/bin/check_dynamic_partitions u:object_r:postinstall_exec:s0
+/(system|product)/bin/otapreopt_script u:object_r:postinstall_exec:s0
+/(system|product)/bin/otapreopt u:object_r:postinstall_dexopt_exec:s0
+
+#############################
+# For Pre-reboot Dexopt (see art/dexopt_chroot_setup/README.md)
+
+# Managed by dexopt_chroot_setup.
+# Note that pre_reboot_dexopt_file also applies to any tmpfs mounted by
+# dexopt_chroot_setup inside chroot, in addition to the files and directories
+# matching the pattern below.
+/mnt/pre_reboot_dexopt(/.*)? u:object_r:pre_reboot_dexopt_file:s0
+
+#############################
+# For early boot VM
+/mnt/vm u:object_r:vm_data_file:s0
diff --git a/prebuilts/api/202504/private/file_contexts_asan b/prebuilts/api/202504/private/file_contexts_asan
new file mode 100644
index 0000000..9554a76
--- /dev/null
+++ b/prebuilts/api/202504/private/file_contexts_asan
@@ -0,0 +1,16 @@
+/data/asan/system/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/system/lib64(/.*)? u:object_r:system_lib_file:s0
+/data/asan/vendor/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/vendor/lib64(/.*)? u:object_r:system_lib_file:s0
+/data/asan/odm/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/odm/lib64(/.*)? u:object_r:system_lib_file:s0
+/data/asan/product/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/product/lib64(/.*)? u:object_r:system_lib_file:s0
+/data/asan/(system_ext|system/system_ext)/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/(system_ext|system/system_ext)/lib64(/.*)? u:object_r:system_lib_file:s0
+/system/asan.options u:object_r:system_asan_options_file:s0
+/system/bin/asan_extract u:object_r:asan_extract_exec:s0
+/system/bin/asanwrapper u:object_r:asanwrapper_exec:s0
+/system/bin/asan/app_process u:object_r:zygote_exec:s0
+/system/bin/asan/app_process32 u:object_r:zygote_exec:s0
+/system/bin/asan/app_process64 u:object_r:zygote_exec:s0
diff --git a/prebuilts/api/202504/private/file_contexts_overlayfs b/prebuilts/api/202504/private/file_contexts_overlayfs
new file mode 100644
index 0000000..e472fad
--- /dev/null
+++ b/prebuilts/api/202504/private/file_contexts_overlayfs
@@ -0,0 +1,9 @@
+#############################
+# Overlayfs support directories for userdebug/eng devices
+#
+/cache/overlay/(system|product)/upper u:object_r:system_file:s0
+/cache/overlay/(vendor|odm)/upper u:object_r:vendor_file:s0
+/cache/overlay/oem/upper u:object_r:vendor_file:s0
+/mnt/scratch/overlay/(system|product)/upper u:object_r:system_file:s0
+/mnt/scratch/overlay/(vendor|odm)/upper u:object_r:vendor_file:s0
+/mnt/scratch/overlay/oem/upper u:object_r:vendor_file:s0
diff --git a/prebuilts/api/202504/private/fingerprintd.te b/prebuilts/api/202504/private/fingerprintd.te
new file mode 100644
index 0000000..949f9ea
--- /dev/null
+++ b/prebuilts/api/202504/private/fingerprintd.te
@@ -0,0 +1,27 @@
+typeattribute fingerprintd coredomain;
+
+init_daemon_domain(fingerprintd)
+
+binder_use(fingerprintd)
+
+# Scan through /system/lib64/hw looking for installed HALs
+allow fingerprintd system_file:dir r_dir_perms;
+
+# need to find KeyStore and add self
+add_service(fingerprintd, fingerprintd_service)
+
+# allow HAL module to read dir contents
+allow fingerprintd fingerprintd_data_file:file { create_file_perms };
+
+# allow HAL module to read/write/unlink contents of this dir
+allow fingerprintd fingerprintd_data_file:dir rw_dir_perms;
+
+# Need to add auth tokens to KeyStore
+use_keystore(fingerprintd)
+allow fingerprintd keystore:keystore2 { add_auth };
+
+# For permissions checking
+binder_call(fingerprintd, system_server);
+allow fingerprintd permission_service:service_manager find;
+
+allow fingerprintd ion_device:chr_file r_file_perms;
diff --git a/prebuilts/api/202504/private/flags_health_check.te b/prebuilts/api/202504/private/flags_health_check.te
new file mode 100644
index 0000000..db7f08f
--- /dev/null
+++ b/prebuilts/api/202504/private/flags_health_check.te
@@ -0,0 +1,61 @@
+typeattribute flags_health_check coredomain;
+
+init_daemon_domain(flags_health_check)
+
+set_prop(flags_health_check, device_config_boot_count_prop)
+set_prop(flags_health_check, device_config_core_experiments_team_internal_prop)
+set_prop(flags_health_check, device_config_edgetpu_native_prop)
+set_prop(flags_health_check, device_config_reset_performed_prop)
+set_prop(flags_health_check, device_config_runtime_native_boot_prop)
+set_prop(flags_health_check, device_config_runtime_native_prop)
+set_prop(flags_health_check, device_config_input_native_boot_prop)
+set_prop(flags_health_check, device_config_lmkd_native_prop)
+set_prop(flags_health_check, device_config_netd_native_prop)
+set_prop(flags_health_check, device_config_nnapi_native_prop)
+set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
+set_prop(flags_health_check, device_config_media_native_prop)
+set_prop(flags_health_check, device_config_mglru_native_prop)
+set_prop(flags_health_check, device_config_profcollect_native_boot_prop)
+set_prop(flags_health_check, device_config_statsd_native_prop)
+set_prop(flags_health_check, device_config_statsd_native_boot_prop)
+set_prop(flags_health_check, device_config_storage_native_boot_prop)
+set_prop(flags_health_check, device_config_swcodec_native_prop)
+set_prop(flags_health_check, device_config_sys_traced_prop)
+set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
+set_prop(flags_health_check, device_config_configuration_prop)
+set_prop(flags_health_check, device_config_connectivity_prop)
+set_prop(flags_health_check, device_config_surface_flinger_native_boot_prop)
+set_prop(flags_health_check, device_config_aconfig_flags_prop)
+set_prop(flags_health_check, device_config_vendor_system_native_prop)
+set_prop(flags_health_check, device_config_vendor_system_native_boot_prop)
+set_prop(flags_health_check, device_config_virtualization_framework_native_prop)
+set_prop(flags_health_check, device_config_memory_safety_native_boot_prop)
+set_prop(flags_health_check, device_config_memory_safety_native_prop)
+set_prop(flags_health_check, device_config_remote_key_provisioning_native_prop)
+set_prop(flags_health_check, device_config_camera_native_prop)
+set_prop(flags_health_check, device_config_tethering_u_or_later_native_prop)
+set_prop(flags_health_check, device_config_mmd_native_prop)
+set_prop(flags_health_check, next_boot_prop)
+
+allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
+allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
+
+###
+### Neverallow rules
+###
+
+# server_configurable_flags_data_file is used for storing whether server configurable flags which
+# have been reset during current booting. Mistakenly modified by unrelated components can
+# cause bad server configurable flags synced back to device.
+neverallow { domain -init -flags_health_check } server_configurable_flags_data_file:file no_w_file_perms;
+
+# system property device_config_boot_count_prop is used for deciding when to perform server
+# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
+# wrong timing, trigger server configurable flag related disaster recovery, which will override
+# server configured values of all flags with default values.
+neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
+
+# system property device_config_reset_performed_prop is used for indicating whether server
+# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
+# cause bad server configurable flags synced back to device.
+neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
diff --git a/prebuilts/api/202504/private/fs_use b/prebuilts/api/202504/private/fs_use
new file mode 100644
index 0000000..93d7f1b
--- /dev/null
+++ b/prebuilts/api/202504/private/fs_use
@@ -0,0 +1,27 @@
+# Label inodes via getxattr.
+fs_use_xattr yaffs2 u:object_r:labeledfs:s0;
+fs_use_xattr jffs2 u:object_r:labeledfs:s0;
+fs_use_xattr ext2 u:object_r:labeledfs:s0;
+fs_use_xattr ext3 u:object_r:labeledfs:s0;
+fs_use_xattr ext4 u:object_r:labeledfs:s0;
+fs_use_xattr xfs u:object_r:labeledfs:s0;
+fs_use_xattr btrfs u:object_r:labeledfs:s0;
+fs_use_xattr f2fs u:object_r:labeledfs:s0;
+fs_use_xattr squashfs u:object_r:labeledfs:s0;
+fs_use_xattr overlay u:object_r:labeledfs:s0;
+fs_use_xattr erofs u:object_r:labeledfs:s0;
+fs_use_xattr incremental-fs u:object_r:labeledfs:s0;
+fs_use_xattr virtiofs u:object_r:labeledfs:s0;
+
+# Label inodes from task label.
+fs_use_task pipefs u:object_r:pipefs:s0;
+fs_use_task sockfs u:object_r:sockfs:s0;
+
+# Label inodes from combination of task label and fs label.
+# Define type_transition rules if you want per-domain types.
+fs_use_trans devpts u:object_r:devpts:s0;
+fs_use_trans tmpfs u:object_r:tmpfs:s0;
+fs_use_trans devtmpfs u:object_r:device:s0;
+fs_use_trans shm u:object_r:shm:s0;
+fs_use_trans mqueue u:object_r:mqueue:s0;
+
diff --git a/prebuilts/api/202504/private/fsck.te b/prebuilts/api/202504/private/fsck.te
new file mode 100644
index 0000000..90f7e51
--- /dev/null
+++ b/prebuilts/api/202504/private/fsck.te
@@ -0,0 +1,82 @@
+typeattribute fsck coredomain;
+
+init_daemon_domain(fsck)
+
+# fsck can run before apex is ready.
+use_bootstrap_libs(fsck)
+
+allow fsck metadata_block_device:blk_file rw_file_perms;
+
+# /dev/__null__ created by init prior to policy load,
+# open fd inherited by fsck.
+allow fsck tmpfs:chr_file { read write ioctl };
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow fsck devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow fsck vold:fd use;
+allow fsck vold:fifo_file { read write getattr };
+
+# Run fsck on certain block devices
+allow fsck userdata_block_device:blk_file rw_file_perms;
+allow fsck cache_block_device:blk_file rw_file_perms;
+allow fsck dm_device:blk_file rw_file_perms;
+allow fsck zoned_block_device:blk_file rw_file_perms;
+userdebug_or_eng(`
+allow fsck system_block_device:blk_file rw_file_perms;
+')
+
+# e2fsck performs a comprehensive search of /proc/mounts to check whether the
+# checked filesystem is currently mounted.
+allow fsck metadata_file:dir getattr;
+allow fsck block_device:dir search;
+allow fsck mirror_data_file:dir search;
+
+# For the block devices where we have ioctl access,
+# allow at a minimum the following common fsck ioctls.
+allowxperm fsck dev_type:blk_file ioctl {
+ BLKDISCARDZEROES
+ BLKROGET
+ BLKREPORTZONE
+};
+
+# To determine if it is safe to run fsck on a filesystem, e2fsck
+# must first determine if the filesystem is mounted. To do that,
+# e2fsck scans through /proc/mounts and collects all the mounted
+# block devices. With that information, it runs stat() on each block
+# device, comparing the major and minor numbers to the filesystem
+# passed in on the command line. If there is a match, then the filesystem
+# is currently mounted and running fsck is dangerous.
+# Allow stat access to all block devices so that fsck can compare
+# major/minor values.
+allow fsck dev_type:blk_file getattr;
+
+allow fsck {
+ proc_mounts
+ proc_swaps
+ sysfs_dm
+}:file r_file_perms;
+allow fsck rootfs:dir r_dir_perms;
+allow fsck sysfs_dm:dir r_dir_perms;
+
+###
+### neverallow rules
+###
+
+# fsck should never be run on these block devices
+neverallow fsck {
+ boot_block_device
+ frp_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdebug_or_eng(`-system_block_device')
+ vold_device
+}:blk_file no_rw_file_perms;
+
+# Only allow entry from init or vold via fsck binaries
+neverallow { domain -init -vold } fsck:process transition;
+neverallow * fsck:process dyntransition;
+neverallow fsck { file_type fs_type -fsck_exec }:file entrypoint;
diff --git a/prebuilts/api/202504/private/fsck_untrusted.te b/prebuilts/api/202504/private/fsck_untrusted.te
new file mode 100644
index 0000000..4b55a57
--- /dev/null
+++ b/prebuilts/api/202504/private/fsck_untrusted.te
@@ -0,0 +1,68 @@
+typeattribute fsck_untrusted coredomain;
+
+use_bootstrap_libs(fsck)
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow fsck_untrusted devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow fsck_untrusted vold:fd use;
+allow fsck_untrusted vold:fifo_file { read write getattr };
+
+# Run fsck on vold block devices
+allow fsck_untrusted block_device:dir search;
+allow fsck_untrusted vold_device:blk_file rw_file_perms;
+
+allow fsck_untrusted proc_mounts:file r_file_perms;
+
+# To determine if it is safe to run fsck on a filesystem, e2fsck
+# must first determine if the filesystem is mounted. To do that,
+# e2fsck scans through /proc/mounts and collects all the mounted
+# block devices. With that information, it runs stat() on each block
+# device, comparing the major and minor numbers to the filesystem
+# passed in on the command line. If there is a match, then the filesystem
+# is currently mounted and running fsck is dangerous.
+# Allow stat access to all block devices so that fsck can compare
+# major/minor values.
+allow fsck_untrusted dev_type:blk_file getattr;
+
+###
+### neverallow rules
+###
+
+# Untrusted fsck should never be run on block devices holding sensitive data
+neverallow fsck_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file no_rw_file_perms;
+
+# Only allow entry from vold via fsck binaries
+neverallow { domain -vold } fsck_untrusted:process transition;
+neverallow * fsck_untrusted:process dyntransition;
+neverallow fsck_untrusted { file_type fs_type -fsck_exec }:file entrypoint;
+
+# fsck_untrusted should never have sys_admin permissions. If it requires sys_admin
+# permissions, that is a code mistake that needs to be fixed, not a permission that
+# should be granted. Same with setgid and setuid.
+neverallow fsck_untrusted self:global_capability_class_set { setgid setuid sys_admin };
+
+###
+### dontaudit rules
+###
+
+# Ignores attempts to access sysfs. fsck binaries seem to like trying to go
+# here, but nothing bad happens if they can't, and they shouldn't be allowed.
+dontaudit fsck_untrusted sysfs:file rw_file_perms;
+dontaudit fsck_untrusted sysfs_dm:file rw_file_perms;
+dontaudit fsck_untrusted sysfs_dm:dir rw_dir_perms;
+
+# Ignore attempts to access tmpfs. fsck don't need to do this.
+dontaudit fsck_untrusted tmpfs:lnk_file read;
diff --git a/prebuilts/api/202504/private/fuseblkd.te b/prebuilts/api/202504/private/fuseblkd.te
new file mode 100644
index 0000000..4423913
--- /dev/null
+++ b/prebuilts/api/202504/private/fuseblkd.te
@@ -0,0 +1,31 @@
+# Compartmentalized domain specifically for mounting fuseblk filesystems.
+# We need this to not grant fuseblkd_untrusted sys_admin permissions.
+type fuseblkd_exec, system_file_type, exec_type, file_type;
+type fuseblkd, domain;
+
+typeattribute fuseblkd coredomain;
+
+# Required for mount and unmounting. We can't minimize this permission,
+# even though we only allow mount/unmount.
+allow fuseblkd self:global_capability_class_set sys_admin;
+
+# Permissions for the fuseblk filesystem.
+allow fuseblkd fuse_device:chr_file rw_file_perms;
+allow fuseblkd fuseblk:filesystem { mount unmount };
+allow fuseblkd fuseblkd_untrusted:fd use;
+
+# Look through block devices to find the correct one.
+allow fuseblkd block_device:dir search;
+
+# Permissions to mount on the media_rw directory for USB drives.
+allow fuseblkd mnt_media_rw_file:dir search;
+allow fuseblkd mnt_media_rw_stub_file:dir mounton;
+
+###
+### neverallow rules
+###
+
+# Only allow entry from fuseblkd_untrusted, and only through fuseblkd_exec binary.
+neverallow { domain -fuseblkd_untrusted } fuseblkd:process transition;
+neverallow * fuseblkd:process dyntransition;
+neverallow fuseblkd { file_type fs_type -fuseblkd_exec }:file entrypoint;
diff --git a/prebuilts/api/202504/private/fuseblkd_untrusted.te b/prebuilts/api/202504/private/fuseblkd_untrusted.te
new file mode 100644
index 0000000..b99a49c
--- /dev/null
+++ b/prebuilts/api/202504/private/fuseblkd_untrusted.te
@@ -0,0 +1,82 @@
+# Fuseblk is a Filesystem in USErspace for block device. It should only be used
+# to mount untrusted blocks like USB drives.
+type fuseblkd_untrusted_exec, system_file_type, exec_type, file_type;
+type fuseblkd_untrusted, domain;
+
+typeattribute fuseblkd_untrusted coredomain;
+
+domain_auto_trans(fuseblkd_untrusted, fuseblkd_exec, fuseblkd);
+
+# Allow stdin/out back to vold.
+allow fuseblkd_untrusted vold:fd use;
+
+# Allows fuseblk to read block devices.
+allow fuseblkd_untrusted block_device:dir search;
+
+# Permissions to read dynamic partitions blocks.
+allow fuseblkd_untrusted super_block_device:blk_file getattr;
+
+# Permissions to access FUSE character devices.
+allow fuseblkd_untrusted fuse_device:chr_file { getattr open read write };
+
+# Permissions to access /mnt/media_rw/.
+allow fuseblkd_untrusted mnt_media_rw_file:dir { getattr search };
+allow fuseblkd_untrusted mnt_media_rw_stub_file:dir getattr;
+
+# Permissions to read device mappers.
+allow fuseblkd_untrusted sysfs_dm:dir search;
+allow fuseblkd_untrusted sysfs_dm:file { getattr open read };
+allow fuseblkd_untrusted dm_device:blk_file getattr;
+
+# Permissions to read links in tmpfs.
+allow fuseblkd_untrusted tmpfs:lnk_file read;
+
+# Permissions to read loop device blocks.
+allow fuseblkd_untrusted loop_device:blk_file getattr;
+
+# Permissions to access the /proc/filesystems file.
+allow fuseblkd_untrusted proc_filesystems:file { open read getattr };
+
+###
+### dontaudit rules
+###
+
+# ntfs-3g wants this permission to read a fork return code, for some reason.
+# It's unclear why, because it still reads the fork return code correctly,
+# and nothing breaks. If enforce is set to permissive, the audit goes away.
+dontaudit fuseblkd_untrusted self:capability sys_admin;
+
+###
+### neverallow rules
+###
+
+# Fuseblk should never be run on block devices holding sensitive data.
+neverallow fuseblkd_untrusted {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+ userdata_block_device
+ cache_block_device
+ dm_device
+}:blk_file no_rw_file_perms;
+
+# Only allow entry from vold, and only through fuseblkd_untrusted_exec binaries.
+neverallow { domain -vold } fuseblkd_untrusted:process transition;
+neverallow * fuseblkd_untrusted:process dyntransition;
+neverallow fuseblkd_untrusted { file_type fs_type -fuseblkd_untrusted_exec }:file entrypoint;
+
+# Under no circumstances should fuseblkd_untrusted or any other fuseblk filesystem be
+# given sys_admin access. They are fundementally untrusted, insecure filesystems.
+# The correct solution here is to compartmentalize permissions correctly so that
+# a smaller binary can get the required permissions. See fuseblkd.te.
+# Similar to above, we don't need setgid or setuid permissions.
+neverallow fuseblkd_untrusted self:capability { setgid setuid sys_admin };
+neverallow fuseblkd_untrusted self:global_capability_class_set { setgid setuid sys_admin };
+
+# Since we can't have sys_admin permissions, we definitely can't have mount/unmount
+# permissions, since we won't be able to use them. Same with relabel permissions.
+neverallow fuseblkd_untrusted fuseblk:filesystem { mount unmount relabelto relabelfrom};
diff --git a/prebuilts/api/202504/private/fwk_bufferhub.te b/prebuilts/api/202504/private/fwk_bufferhub.te
new file mode 100644
index 0000000..5286f3e
--- /dev/null
+++ b/prebuilts/api/202504/private/fwk_bufferhub.te
@@ -0,0 +1,7 @@
+type fwk_bufferhub, domain, coredomain;
+type fwk_bufferhub_exec, system_file_type, exec_type, file_type;
+
+hal_client_domain(fwk_bufferhub, hal_graphics_allocator)
+allow fwk_bufferhub ion_device:chr_file r_file_perms;
+
+init_daemon_domain(fwk_bufferhub)
diff --git a/prebuilts/api/202504/private/gatekeeperd.te b/prebuilts/api/202504/private/gatekeeperd.te
new file mode 100644
index 0000000..045294f
--- /dev/null
+++ b/prebuilts/api/202504/private/gatekeeperd.te
@@ -0,0 +1,45 @@
+typeattribute gatekeeperd coredomain;
+
+init_daemon_domain(gatekeeperd)
+
+# For checking whether GSI is running
+get_prop(gatekeeperd, gsid_prop)
+
+# gatekeeperd
+binder_service(gatekeeperd)
+binder_use(gatekeeperd)
+
+### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.
+### These rules should eventually be granted only when needed.
+allow gatekeeperd ion_device:chr_file r_file_perms;
+# Load HAL implementation
+allow gatekeeperd system_file:dir r_dir_perms;
+###
+
+### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.
+### These rules should eventually be granted only when needed.
+hal_client_domain(gatekeeperd, hal_gatekeeper)
+###
+
+# need to find KeyStore and add self
+add_service(gatekeeperd, gatekeeper_service)
+
+# Need to add auth tokens to KeyStore
+use_keystore(gatekeeperd)
+allow gatekeeperd keystore:keystore2 { add_auth };
+allow gatekeeperd authorization_service:service_manager find;
+
+
+# For permissions checking
+allow gatekeeperd system_server:binder call;
+allow gatekeeperd permission_service:service_manager find;
+
+# for SID file access
+allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms;
+allow gatekeeperd gatekeeper_data_file:file create_file_perms;
+
+# For hardware properties retrieval
+allow gatekeeperd hardware_properties_service:service_manager find;
+
+r_dir_file(gatekeeperd, cgroup)
+r_dir_file(gatekeeperd, cgroup_v2)
diff --git a/prebuilts/api/202504/private/genfs_contexts b/prebuilts/api/202504/private/genfs_contexts
new file mode 100644
index 0000000..a872a04
--- /dev/null
+++ b/prebuilts/api/202504/private/genfs_contexts
@@ -0,0 +1,345 @@
+# Label inodes with the fs label.
+genfscon rootfs / u:object_r:rootfs:s0
+# proc labeling can be further refined (longest matching prefix).
+genfscon proc / u:object_r:proc:s0
+genfscon proc /allocinfo u:object_r:proc_allocinfo:s0
+genfscon proc /asound u:object_r:proc_asound:s0
+genfscon proc /bootconfig u:object_r:proc_bootconfig:s0
+genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
+genfscon proc /cgroups u:object_r:proc_cgroups:s0
+genfscon proc /cmdline u:object_r:proc_cmdline:s0
+genfscon proc /config.gz u:object_r:config_gz:s0
+genfscon proc /cpu/alignment u:object_r:proc_cpu_alignment:s0
+genfscon proc /device-tree/avf u:object_r:proc_dt_avf:s0
+genfscon proc /diskstats u:object_r:proc_diskstats:s0
+genfscon proc /filesystems u:object_r:proc_filesystems:s0
+genfscon proc /interrupts u:object_r:proc_interrupts:s0
+genfscon proc /iomem u:object_r:proc_iomem:s0
+genfscon proc /kallsyms u:object_r:proc_kallsyms:s0
+genfscon proc /keys u:object_r:proc_keys:s0
+genfscon proc /kmsg u:object_r:proc_kmsg:s0
+genfscon proc /loadavg u:object_r:proc_loadavg:s0
+genfscon proc /locks u:object_r:proc_locks:s0
+genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
+genfscon proc /meminfo u:object_r:proc_meminfo:s0
+genfscon proc /misc u:object_r:proc_misc:s0
+genfscon proc /modules u:object_r:proc_modules:s0
+genfscon proc /mounts u:object_r:proc_mounts:s0
+genfscon proc /net u:object_r:proc_net:s0
+genfscon proc /net/tcp u:object_r:proc_net_tcp_udp:s0
+genfscon proc /net/udp u:object_r:proc_net_tcp_udp:s0
+genfscon proc /net/xt_qtaguid/ctrl u:object_r:proc_qtaguid_ctrl:s0
+genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
+genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
+genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
+genfscon proc /pressure/cpu u:object_r:proc_pressure_cpu:s0
+genfscon proc /pressure/io u:object_r:proc_pressure_io:s0
+genfscon proc /pressure/memory u:object_r:proc_pressure_mem:s0
+genfscon proc /slabinfo u:object_r:proc_slabinfo:s0
+genfscon proc /softirqs u:object_r:proc_timer:s0
+genfscon proc /stat u:object_r:proc_stat:s0
+genfscon proc /swaps u:object_r:proc_swaps:s0
+genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
+genfscon proc /kpageflags u:object_r:proc_kpageflags:s0
+genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
+genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
+genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
+genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
+genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
+genfscon proc /sys/kernel/bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
+genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
+genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
+genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/hung_task_ u:object_r:proc_hung_task:s0
+genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
+genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
+genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
+genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_cpu_time_max_percent u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/perf_event_mlock_kb u:object_r:proc_perf:s0
+genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
+genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
+genfscon proc /sys/kernel/random u:object_r:proc_random:s0
+genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
+genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_max u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_min u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_util_clamp_min_rt_default u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
+genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
+genfscon proc /sys/kernel/unprivileged_bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
+genfscon proc /sys/net u:object_r:proc_net:s0
+genfscon proc /sys/net/core/bpf_ u:object_r:proc_bpf:s0
+genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
+genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
+genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
+genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
+genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
+genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
+genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
+genfscon proc /sys/vm/watermark_boost_factor u:object_r:proc_watermark_boost_factor:s0
+genfscon proc /sys/vm/watermark_scale_factor u:object_r:proc_watermark_scale_factor:s0
+genfscon proc /sys/vm/percpu_pagelist_high_fraction u:object_r:proc_percpu_pagelist_high_fraction:s0
+genfscon proc /timer_list u:object_r:proc_timer:s0
+genfscon proc /timer_stats u:object_r:proc_timer:s0
+genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
+genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
+genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
+genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
+genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
+genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
+genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
+genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
+genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
+genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
+genfscon proc /uptime u:object_r:proc_uptime:s0
+genfscon proc /version u:object_r:proc_version:s0
+genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
+genfscon proc /vmstat u:object_r:proc_vmstat:s0
+genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
+genfscon proc /vendor_sched u:object_r:proc_vendor_sched:s0
+
+genfscon fusectl / u:object_r:fusectlfs:s0
+
+# selinuxfs booleans can be individually labeled.
+genfscon selinuxfs / u:object_r:selinuxfs:s0
+genfscon cgroup / u:object_r:cgroup:s0
+genfscon cgroup2 / u:object_r:cgroup_v2:s0
+# sysfs labels can be set by userspace.
+genfscon sysfs / u:object_r:sysfs:s0
+genfscon sysfs /devices/cs_etm u:object_r:sysfs_devices_cs_etm:s0
+genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
+genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0
+genfscon sysfs /class/extcon u:object_r:sysfs_extcon:s0
+genfscon sysfs /class/gpu u:object_r:sysfs_gpu:s0
+genfscon sysfs /class/leds u:object_r:sysfs_leds:s0
+genfscon sysfs /class/net u:object_r:sysfs_net:s0
+genfscon sysfs /class/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill1/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rfkill/rfkill3/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
+genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
+genfscon sysfs /class/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
+genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
+genfscon sysfs /devices/virtual/block/ u:object_r:sysfs_devices_block:s0
+genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0
+genfscon sysfs /devices/virtual/block/loop u:object_r:sysfs_loop:s0
+genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0
+genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0
+genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0
+genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0
+genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
+genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0
+genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
+genfscon sysfs /devices/virtual/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /firmware/acpi/tables u:object_r:sysfs_firmware_acpi_tables:s0
+genfscon sysfs /firmware/devicetree/base/avf u:object_r:sysfs_dt_avf:s0
+genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
+genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
+genfscon sysfs /fs/f2fs u:object_r:sysfs_fs_f2fs:s0
+genfscon sysfs /fs/fuse/bpf_prog_type_fuse u:object_r:sysfs_fs_fuse_bpf:s0
+genfscon sysfs /fs/fuse/features u:object_r:sysfs_fs_fuse_features:s0
+genfscon sysfs /fs/incremental-fs/features u:object_r:sysfs_fs_incfs_features:s0
+genfscon sysfs /fs/incremental-fs/instances u:object_r:sysfs_fs_incfs_metrics:s0
+genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
+genfscon sysfs /power/state u:object_r:sysfs_power:s0
+genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0
+genfscon sysfs /power/sync_on_suspend u:object_r:sysfs_sync_on_suspend:s0
+genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
+genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
+genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
+genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
+genfscon sysfs /kernel/dma_heap u:object_r:sysfs_dma_heap:s0
+genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0
+genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
+starting_at_board_api(202504, `
+genfscon sysfs /kernel/mm/cma u:object_r:sysfs_cma:s0
+')
+genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0
+genfscon sysfs /kernel/mm/lru_gen/enabled u:object_r:sysfs_lru_gen_enabled:s0
+genfscon sysfs /kernel/mm/pgsize_migration/enabled u:object_r:sysfs_pgsize_migration:s0
+genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
+genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
+genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
+genfscon sysfs /kernel/dmabuf/buffers u:object_r:sysfs_dmabuf_stats:s0
+genfscon sysfs /module/dm_bufio/parameters/max_age_seconds u:object_r:sysfs_dm_verity:s0
+genfscon sysfs /module/dm_verity/parameters/prefetch_cluster u:object_r:sysfs_dm_verity:s0
+genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
+genfscon sysfs /module/tcp_cubic/parameters u:object_r:sysfs_net:s0
+genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
+genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/virtual/misc/uhid u:object_r:sysfs_uhid:s0
+genfscon sysfs /kernel/vendor_sched u:object_r:sysfs_vendor_sched:s0
+genfscon sysfs /devices/uprobe u:object_r:sysfs_uprobe:s0
+
+genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0
+genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
+genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
+genfscon tracefs / u:object_r:debugfs_tracing_debug:s0
+genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0
+genfscon tracefs /trace u:object_r:debugfs_tracing:s0
+genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /hyp u:object_r:debugfs_tracing:s0
+
+genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0
+genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0
+genfscon debugfs /tracing/instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
+genfscon tracefs /instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
+genfscon debugfs /tracing/instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
+genfscon tracefs /instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
+genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0
+genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0
+genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0
+genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0
+genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0
+genfscon debugfs /tracing/printk_formats u:object_r:debugfs_tracing_printk_formats:s0
+genfscon tracefs /printk_formats u:object_r:debugfs_tracing_printk_formats:s0
+
+genfscon tracefs /events/header_page u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /synthetic_events u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /events/synthetic/rss_stat_throttled u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/synthetic/suspend_resume_minimal u:object_r:debugfs_tracing:s0
+
+genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0
+genfscon tracefs /buffer_percent u:object_r:debugfs_tracing:s0
+genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0
+genfscon tracefs /options/record-tgid u:object_r:debugfs_tracing:s0
+genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_wakeup_new/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_waking/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_process_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_process_free/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_pi_setprio/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_enable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_disable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/gpu_work_period/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_command/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_return/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/dma_fence/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/filemap/mm_filemap_add_to_page_cache/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/filemap/mm_filemap_delete_from_page_cache/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/rss_stat/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_grow/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_shrink/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ion/ion_stat/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/mm_event/mm_event_record/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/oom/oom_score_adj_update/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/oom/mark_victim/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_rename/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_newtask/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ftrace/print/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/gpu_mem/gpu_mem_total u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/thermal/thermal_temperature/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/thermal/cdev_update/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_enter/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_exit/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_pause/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/irq/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_enable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_disable/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/clk/clk_set_rate/ u:object_r:debugfs_tracing:s0
+
+genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
+
+genfscon securityfs / u:object_r:securityfs:s0
+
+genfscon binder /binder u:object_r:binder_device:s0
+genfscon binder /hwbinder u:object_r:hwbinder_device:s0
+genfscon binder /vndbinder u:object_r:vndbinder_device:s0
+genfscon binder /binder_logs u:object_r:binderfs_logs:s0
+genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
+genfscon binder /binder_logs/stats u:object_r:binderfs_logs_stats:s0
+genfscon binder /binder_logs/transactions u:object_r:binderfs_logs_transactions:s0
+genfscon binder /binder_logs/transaction_log u:object_r:binderfs_logs_transaction_history:s0
+genfscon binder /binder_logs/failed_transaction_log u:object_r:binderfs_logs_transaction_history:s0
+genfscon binder /features u:object_r:binderfs_features:s0
+
+genfscon inotifyfs / u:object_r:inotify:s0
+genfscon vfat / u:object_r:vfat:s0
+genfscon binder / u:object_r:binderfs:s0
+genfscon exfat / u:object_r:exfat:s0
+genfscon debugfs / u:object_r:debugfs:s0
+genfscon fuse / u:object_r:fuse:s0
+genfscon fuseblk / u:object_r:fuseblk:s0
+genfscon configfs / u:object_r:configfs:s0
+genfscon sdcardfs / u:object_r:sdcardfs:s0
+genfscon esdfs / u:object_r:sdcardfs:s0
+genfscon pstore / u:object_r:pstorefs:s0
+genfscon functionfs / u:object_r:functionfs:s0
+genfscon usbfs / u:object_r:usbfs:s0
+genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
+
+genfscon bpf / u:object_r:fs_bpf:s0
+genfscon bpf /loader u:object_r:fs_bpf_loader:s0
+genfscon bpf /memevents u:object_r:fs_bpf_memevents:s0
+genfscon bpf /net_private u:object_r:fs_bpf_net_private:s0
+genfscon bpf /net_shared u:object_r:fs_bpf_net_shared:s0
+genfscon bpf /netd_readonly u:object_r:fs_bpf_netd_readonly:s0
+genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
+genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
+genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
+genfscon bpf /uprobestats u:object_r:fs_bpf_uprobestats:s0
diff --git a/prebuilts/api/202504/private/gki_apex_prepostinstall.te b/prebuilts/api/202504/private/gki_apex_prepostinstall.te
new file mode 100644
index 0000000..1155389
--- /dev/null
+++ b/prebuilts/api/202504/private/gki_apex_prepostinstall.te
@@ -0,0 +1,23 @@
+# GKI pre- & post-install hooks.
+#
+# Allow to run pre- and post-install hooks for GKI APEXes
+
+type gki_apex_prepostinstall, domain, coredomain;
+type gki_apex_prepostinstall_exec, system_file_type, exec_type, file_type;
+
+# Execute /system/bin/sh.
+allow gki_apex_prepostinstall shell_exec:file rx_file_perms;
+
+# Execute various toolsbox utilities.
+allow gki_apex_prepostinstall toolbox_exec:file rx_file_perms;
+
+# Allow preinstall.sh to execute update_engine_stable_client binary.
+allow gki_apex_prepostinstall gki_apex_prepostinstall_exec:file execute_no_trans;
+
+# Allow preinstall hook to communicate with update_engine to execute update.
+binder_use(gki_apex_prepostinstall)
+allow gki_apex_prepostinstall update_engine_stable_service:service_manager find;
+binder_call(gki_apex_prepostinstall, update_engine)
+
+# /dev/zero is inherited although it is not used. See b/126787589.
+allow gki_apex_prepostinstall apexd:fd use;
diff --git a/prebuilts/api/202504/private/gmscore_app.te b/prebuilts/api/202504/private/gmscore_app.te
new file mode 100644
index 0000000..148cb7e
--- /dev/null
+++ b/prebuilts/api/202504/private/gmscore_app.te
@@ -0,0 +1,183 @@
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+typeattribute gmscore_app coredomain;
+
+app_domain(gmscore_app)
+
+allow gmscore_app sysfs_type:dir search;
+# Read access to /sys/block/zram*/mm_stat
+r_dir_file(gmscore_app, sysfs_zram)
+
+r_dir_file(gmscore_app, rootfs)
+
+# Allow GMS core to open kernel config for OTA matching through libvintf
+allow gmscore_app config_gz:file { open read getattr };
+
+# Allow GMS core to communicate with update_engine for A/B update.
+binder_call(gmscore_app, update_engine)
+allow gmscore_app update_engine_service:service_manager find;
+
+# Allow GMS core to communicate with dumpsys storaged.
+binder_call(gmscore_app, storaged)
+allow gmscore_app storaged_service:service_manager find;
+
+# Allow GMS core to access system_update_service (e.g. to publish pending
+# system update info).
+allow gmscore_app system_update_service:service_manager find;
+
+# Allow GMS core to communicate with statsd.
+binder_call(gmscore_app, statsd)
+
+# Allow GMS core to receive Perfetto traces through the framework
+# (i.e. TracingServiceProxy) and sendfile them into its private directory
+# for reporting when network and battery conditions are appropriate.
+allow gmscore_app perfetto:fd use;
+allow gmscore_app perfetto_traces_data_file:file { read getattr };
+
+# Allow GMS core to generate unique hardware IDs
+allow gmscore_app keystore:keystore2_key gen_unique_id;
+
+# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
+allow gmscore_app selinuxfs:file r_file_perms;
+
+# suppress denials for non-API accesses.
+dontaudit gmscore_app exec_type:file r_file_perms;
+dontaudit gmscore_app device:dir r_dir_perms;
+dontaudit gmscore_app fs_bpf:dir r_dir_perms;
+dontaudit gmscore_app kernel:security *;
+dontaudit gmscore_app net_dns_prop:file r_file_perms;
+dontaudit gmscore_app proc:file r_file_perms;
+dontaudit gmscore_app proc_interrupts:file r_file_perms;
+dontaudit gmscore_app proc_modules:file r_file_perms;
+dontaudit gmscore_app proc_net:file r_file_perms;
+dontaudit gmscore_app proc_stat:file r_file_perms;
+dontaudit gmscore_app proc_version:file r_file_perms;
+dontaudit gmscore_app sysfs:dir r_dir_perms;
+dontaudit gmscore_app sysfs:file r_file_perms;
+dontaudit gmscore_app sysfs_android_usb:file r_file_perms;
+dontaudit gmscore_app sysfs_dm:file r_file_perms;
+dontaudit gmscore_app sysfs_loop:file r_file_perms;
+dontaudit gmscore_app sysfs_net:file r_file_perms;
+dontaudit gmscore_app sysfs_net:dir r_dir_perms;
+dontaudit gmscore_app { wifi_prop wifi_hal_prop }:file r_file_perms;
+dontaudit gmscore_app mirror_data_file:dir search;
+dontaudit gmscore_app mnt_vendor_file:dir search;
+
+# Access the network
+net_domain(gmscore_app)
+
+# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
+allow gmscore_app self:process ptrace;
+
+# Allow loading executable code from writable priv-app home
+# directories. This is a W^X violation, however, it needs
+# to be supported for now for the following reasons.
+# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
+# 1) com.android.opengl.shaders_cache
+# 2) com.android.skia.shaders_cache
+# 3) com.android.renderscript.cache
+# * /data/user_de/0/com.google.android.gms/app_chimera
+# TODO: Tighten (b/112357170)
+allow gmscore_app privapp_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow gmscore_app system_linker_exec:file execute_no_trans;
+
+allow gmscore_app privapp_data_file:lnk_file create_file_perms;
+
+# /proc access
+allow gmscore_app proc_vmstat:file r_file_perms;
+
+# Allow interaction with gpuservice
+binder_call(gmscore_app, gpuservice)
+allow gmscore_app gpu_service:service_manager find;
+
+# find services that expose both @SystemAPI and normal APIs.
+allow gmscore_app app_api_service:service_manager find;
+allow gmscore_app system_api_service:service_manager find;
+allow gmscore_app audioserver_service:service_manager find;
+allow gmscore_app cameraserver_service:service_manager find;
+allow gmscore_app drmserver_service:service_manager find;
+allow gmscore_app mediadrmserver_service:service_manager find;
+allow gmscore_app mediaextractor_service:service_manager find;
+allow gmscore_app mediametrics_service:service_manager find;
+allow gmscore_app mediaserver_service:service_manager find;
+allow gmscore_app network_watchlist_service:service_manager find;
+allow gmscore_app nfc_service:service_manager find;
+allow gmscore_app oem_lock_service:service_manager find;
+allow gmscore_app persistent_data_block_service:service_manager find;
+allow gmscore_app radio_service:service_manager find;
+allow gmscore_app recovery_service:service_manager find;
+allow gmscore_app stats_service:service_manager find;
+
+# Write to /cache.
+allow gmscore_app { cache_file cache_recovery_file }:dir create_dir_perms;
+allow gmscore_app { cache_file cache_recovery_file }:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow gmscore_app cache_file:lnk_file r_file_perms;
+
+# Write to /data/ota_package for OTA packages.
+allow gmscore_app ota_package_file:dir create_dir_perms;
+allow gmscore_app ota_package_file:file create_file_perms;
+
+# Write the checkin metadata to /data/misc_ce/<userid>/checkin
+allow gmscore_app checkin_data_file:dir rw_dir_perms;
+allow gmscore_app checkin_data_file:file create_file_perms;
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow gmscore_app shell_data_file:file r_file_perms;
+allow gmscore_app shell_data_file:dir r_dir_perms;
+
+# allow gms core app write to aconfigd socket
+unix_socket_connect(gmscore_app, aconfigd, aconfigd);
+
+# allow gms core app write to aconfigd_mainline socket
+unix_socket_connect(gmscore_app, aconfigd_mainline, aconfigd_mainline);
+
+# b/18504118: Allow reads from /data/anr/traces.txt
+allow gmscore_app anr_data_file:file r_file_perms;
+
+# b/148974132: com.android.vending needs this
+allow gmscore_app priv_app:tcp_socket { read write };
+
+# b/168059475 Allow GMSCore to read Virtual AB properties to determine
+# if device supports VAB.
+get_prop(gmscore_app, virtual_ab_prop)
+
+# b/186488185: Allow GMSCore to read dck properties
+get_prop(gmscore_app, dck_prop)
+
+# Allow GMSCore to read RKP properties for the purpose of GTS testing.
+get_prop(gmscore_app, remote_prov_prop)
+
+# Allow GmsCore to read Quick Start properties and prevent access from other
+# policies.
+get_prop(gmscore_app, quick_start_prop)
+neverallow { domain -init -dumpstate -vendor_init -gmscore_app } quick_start_prop:file no_rw_file_perms;
+
+# Allow GmsCore to read Bluetotoh Power Off Finder property
+get_prop(gmscore_app, bluetooth_finder_prop)
+
+# Do not allow getting permission-protected network information from sysfs.
+neverallow gmscore_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm gmscore_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow gmscore_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow gmscore_app *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
diff --git a/prebuilts/api/202504/private/gpuservice.te b/prebuilts/api/202504/private/gpuservice.te
new file mode 100644
index 0000000..5638543
--- /dev/null
+++ b/prebuilts/api/202504/private/gpuservice.te
@@ -0,0 +1,72 @@
+# gpuservice - server for gpu stats and other gpu related services
+typeattribute gpuservice coredomain;
+typeattribute gpuservice bpfdomain;
+
+type gpuservice_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(gpuservice)
+
+binder_call(gpuservice, adbd)
+binder_call(gpuservice, shell)
+binder_call(gpuservice, system_server)
+binder_use(gpuservice)
+
+# Access the GPU.
+allow gpuservice gpu_device:chr_file rw_file_perms;
+
+# GPU service will need to load GPU driver, for example Vulkan driver in order
+# to get the capability of the driver.
+allow gpuservice same_process_hal_file:file { open read getattr execute map };
+allow gpuservice ion_device:chr_file r_file_perms;
+get_prop(gpuservice, hwservicemanager_prop)
+hwbinder_use(gpuservice)
+
+# Access /dev/graphics/fb0.
+allow gpuservice graphics_device:dir search;
+allow gpuservice graphics_device:chr_file rw_file_perms;
+
+# Allow shell access
+allow gpuservice adbd:fd use;
+allow gpuservice adbd:unix_stream_socket { getattr read write };
+allow gpuservice shell:fifo_file { getattr read write };
+
+# Needed for perfetto producer.
+perfetto_producer(gpuservice)
+
+# Needed for interactive shell
+allow gpuservice devpts:chr_file { read write getattr };
+
+# Needed for dumpstate to dumpsys gpu.
+allow gpuservice dumpstate:fd use;
+allow gpuservice dumpstate:fifo_file write;
+
+# Needed for stats callback registration to statsd.
+allow gpuservice stats_service:service_manager find;
+allow gpuservice statsmanager_service:service_manager find;
+# TODO(b/146461633): remove this once native pullers talk to StatsManagerService
+binder_call(gpuservice, statsd);
+
+# Needed for reading tracepoint ids in order to attach bpf programs.
+allow gpuservice debugfs_tracing:file r_file_perms;
+allow gpuservice self:perf_event { cpu kernel open write };
+neverallow gpuservice self:perf_event ~{ cpu kernel open write };
+
+# Needed for interact with bpf fs.
+# Write is needed to open read/write bpf maps.
+allow gpuservice fs_bpf:file { read write };
+
+# Needed for enabling bpf programs and accessing bpf maps (read-only and read/write).
+allow gpuservice bpfloader:bpf { map_read map_write prog_run };
+
+add_service(gpuservice, gpu_service)
+
+# Needed for enabling write access to persist.graphics.egl from developer option switch UI, through gpuservice.
+set_prop(gpuservice, graphics_config_writable_prop)
+
+neverallow { domain -init -vendor_init -gpuservice } graphics_config_writable_prop:property_service set;
+
+# Needed for querying permission
+allow gpuservice permission_service:service_manager find;
+
+# Only uncomment below line when in development
+# userdebug_or_eng(`permissive gpuservice;')
diff --git a/prebuilts/api/202504/private/gsid.te b/prebuilts/api/202504/private/gsid.te
new file mode 100644
index 0000000..9391016
--- /dev/null
+++ b/prebuilts/api/202504/private/gsid.te
@@ -0,0 +1,207 @@
+# gsid - Manager for GSI Installation
+
+type gsid, domain;
+type gsid_exec, exec_type, file_type, system_file_type;
+typeattribute gsid coredomain;
+
+init_daemon_domain(gsid)
+
+binder_use(gsid)
+binder_service(gsid)
+add_service(gsid, gsi_service)
+
+# Manage DSU metadata encryption key through vold.
+allow gsid vold_service:service_manager find;
+binder_call(gsid, vold)
+
+set_prop(gsid, gsid_prop)
+
+# Needed to create/delete device-mapper nodes, and read/write to them.
+allow gsid dm_device:chr_file rw_file_perms;
+allow gsid dm_device:blk_file rw_file_perms;
+allow gsid self:global_capability_class_set sys_admin;
+dontaudit gsid self:global_capability_class_set dac_override;
+
+# On FBE devices (not using dm-default-key), gsid will use loop devices to map
+# images rather than device-mapper.
+allow gsid loop_control_device:chr_file rw_file_perms;
+allow gsid loop_device:blk_file rw_file_perms;
+allowxperm gsid loop_device:blk_file ioctl {
+ LOOP_GET_STATUS64
+ LOOP_SET_STATUS64
+ LOOP_SET_FD
+ LOOP_SET_BLOCK_SIZE
+ LOOP_SET_DIRECT_IO
+ LOOP_CLR_FD
+ BLKFLSBUF
+};
+
+# libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
+# This requires traversing /sys/block/dm-N/slaves/* and reading the list of
+# file names.
+r_dir_file(gsid, sysfs_dm)
+
+# libfiemap_writer needs to read /sys/fs/f2fs/<dev>/features to determine
+# whether pin_file support is enabled.
+r_dir_file(gsid, sysfs_fs_f2fs)
+
+# Needed to read fstab, which is used to validate that system verity does not
+# use check_once_at_most for sdcard installs. (Note: proc_cmdline is needed
+# to get the A/B slot suffix).
+read_fstab(gsid)
+allow gsid sysfs_dt_firmware_android:dir r_dir_perms;
+allow gsid sysfs_dt_firmware_android:file r_file_perms;
+
+# Needed to stat /data/gsi/* and realpath on /dev/block/by-name/*
+allow gsid block_device:dir r_dir_perms;
+
+# Allow querying the size of super_block_device_type.
+allow gsid super_block_device_type:blk_file r_file_perms;
+
+# liblp queries these block alignment properties.
+allowxperm gsid {
+ userdata_block_device
+ sdcard_block_device
+ super_block_device_type
+}:blk_file ioctl {
+ BLKIOMIN
+ BLKALIGNOFF
+};
+
+# When installing images to an sdcard, gsid needs to be able to stat() the
+# block device. gsid also calls realpath() to remove symlinks.
+allow gsid mnt_media_rw_file:dir r_dir_perms;
+allow gsid mnt_media_rw_stub_file:dir r_dir_perms;
+
+# When installing images to an sdcard, gsid must bypass sdcardfs and install
+# directly to vfat, which supports the FIBMAP ioctl.
+allow gsid vfat:dir create_dir_perms;
+allow gsid vfat:file create_file_perms;
+allow gsid sdcard_block_device:blk_file r_file_perms;
+# This is needed for FIBMAP unfortunately. Oddly FIEMAP does not carry this
+# requirement, but the kernel does not implement FIEMAP support for VFAT.
+allow gsid self:global_capability_class_set sys_rawio;
+
+# Allow rules for gsi_tool.
+userdebug_or_eng(`
+ # gsi_tool passes the system image over the adb connection, via stdin.
+ allow gsid adbd:fd use;
+ # Needed when running gsi_tool through "su root" rather than adb root.
+ allow gsid adbd:unix_stream_socket rw_socket_perms;
+ # gsi_tool passes a FIFO to gsid if invoked with pipe redirection.
+ allow gsid { shell su }:fifo_file r_file_perms;
+ # Allow installing images from /storage/emulated/...
+ allow gsid { sdcard_type fuse }:file r_file_perms;
+')
+
+neverallow {
+ domain
+ -gsid
+ -init
+ -update_engine_common
+ -recovery
+ -fastbootd
+} gsid_prop:property_service set;
+
+# gsid needs to store images on /data, but cannot use file I/O. If it did, the
+# underlying blocks would be encrypted, and we couldn't mount the GSI image in
+# first-stage init. So instead of directly writing to /data, we:
+#
+# 1. fallocate a file large enough to hold the signed GSI
+# 2. extract its block layout with FIEMAP
+# 3. create a dm-linear device using the FIEMAP, targeting /dev/block/by-name/userdata
+# 4. write system_gsi into that dm device
+#
+# To make this process work, we need to unwrap the device-mapper stacking for
+# userdata to reach the underlying block device. To verify the result we use
+# stat(), which requires read access.
+allow gsid userdata_block_device:blk_file r_file_perms;
+
+# gsid uses /metadata/gsi to communicate GSI boot information to first-stage
+# init. It cannot use userdata since data cannot be decrypted during this
+# stage.
+#
+# gsid uses /metadata/gsi to store three files:
+# install_status - A short string indicating whether a GSI image is bootable.
+# lp_metadata - LpMetadata blob describing the block ranges on userdata
+# where system_gsi resides.
+# booted - An empty file that, if exists, indicates that a GSI is
+# currently running.
+#
+allow gsid metadata_file:dir { search getattr };
+allow gsid {
+ gsi_metadata_file_type
+}:dir create_dir_perms;
+
+allow gsid {
+ ota_metadata_file
+}:dir rw_dir_perms;
+
+allow gsid {
+ gsi_metadata_file_type
+ ota_metadata_file
+}:file create_file_perms;
+
+# Allow restorecon to fix context of gsi_public_metadata_file.
+allow gsid file_contexts_file:file r_file_perms;
+allow gsid gsi_metadata_file:file relabelfrom;
+allow gsid gsi_public_metadata_file:file relabelto;
+
+allow gsid {
+ gsi_data_file
+ ota_image_data_file
+}:dir create_dir_perms;
+allow gsid {
+ gsi_data_file
+ ota_image_data_file
+}:file create_file_perms;
+allowxperm gsid {
+ gsi_data_file
+ ota_image_data_file
+}:file ioctl {
+ FS_IOC_FIEMAP
+ FS_IOC_GETFLAGS
+};
+
+allow gsid system_server:binder call;
+
+# Prevent most processes from writing to gsi_metadata_file_type, but allow
+# adding rules for path resolution of gsi_public_metadata_file and reading
+# gsi_public_metadata_file.
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} gsi_metadata_file_type:dir no_w_dir_perms;
+
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} { gsi_metadata_file_type -gsi_public_metadata_file }:file_class_set *;
+
+neverallow {
+ domain
+ -init
+ -gsid
+ -fastbootd
+} gsi_public_metadata_file:file_class_set ~{ r_file_perms };
+
+# Prevent apps from accessing gsi_metadata_file_type.
+neverallow {
+ appdomain
+ -shell
+} gsi_metadata_file_type:dir_file_class_set *;
+
+neverallow {
+ domain
+ -init
+ -gsid
+} gsi_data_file:dir_file_class_set *;
+
+neverallow {
+ domain
+ -gsid
+} gsi_data_file:file_class_set ~{ relabelto getattr };
diff --git a/prebuilts/api/202504/private/hal_allocator.te b/prebuilts/api/202504/private/hal_allocator.te
new file mode 100644
index 0000000..6417b62
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_allocator.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server
+binder_call(hal_allocator_client, hal_allocator_server)
+
+hal_attribute_hwservice(hal_allocator, hidl_allocator_hwservice)
+allow hal_allocator_client hidl_memory_hwservice:hwservice_manager find;
+allow hal_allocator_client same_process_hal_file:file { execute read open getattr map };
diff --git a/prebuilts/api/202504/private/hal_allocator_default.te b/prebuilts/api/202504/private/hal_allocator_default.te
new file mode 100644
index 0000000..6ab7eb8
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_allocator_default.te
@@ -0,0 +1,8 @@
+type hal_allocator_default, domain, coredomain;
+hal_server_domain(hal_allocator_default, hal_allocator)
+
+type hal_allocator_default_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(hal_allocator_default)
+
+# to force stop the service when it's not supported
+set_prop(hal_allocator_default, hidl_memory_prop)
diff --git a/prebuilts/api/202504/private/hal_atrace.te b/prebuilts/api/202504/private/hal_atrace.te
new file mode 100644
index 0000000..51d9237
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_atrace.te
@@ -0,0 +1,4 @@
+# HwBinder IPC from client to server
+binder_call(hal_atrace_client, hal_atrace_server)
+
+hal_attribute_hwservice(hal_atrace, hal_atrace_hwservice)
diff --git a/prebuilts/api/202504/private/hal_audio.te b/prebuilts/api/202504/private/hal_audio.te
new file mode 100644
index 0000000..237ffcd
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_audio.te
@@ -0,0 +1,46 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_audio_client, hal_audio_server)
+binder_call(hal_audio_server, hal_audio_client)
+
+hal_attribute_hwservice(hal_audio, hal_audio_hwservice)
+hal_attribute_service(hal_audio, hal_audio_service)
+
+allow hal_audio ion_device:chr_file r_file_perms;
+
+binder_call(hal_audio_server, servicemanager)
+
+r_dir_file(hal_audio, proc)
+r_dir_file(hal_audio, proc_asound)
+allow hal_audio_server audio_device:dir r_dir_perms;
+allow hal_audio_server audio_device:chr_file rw_file_perms;
+
+# Needed to provide debug dump output via dumpsys' pipes.
+allow hal_audio shell:fd use;
+allow hal_audio shell:fifo_file write;
+allow hal_audio dumpstate:fd use;
+allow hal_audio dumpstate:fifo_file write;
+
+# Needed to allow sound trigger hal to access shared memory from apps.
+allow hal_audio_server appdomain:fd use;
+# Allow sound trigger hal to access shared memory from system server.
+allow hal_audio_server system_server_tmpfs:file { getattr map read };
+
+# allow self to set scheduler (and allows Binder RT PI)
+allow hal_audio_server self:global_capability_class_set sys_nice;
+
+# allow hal audio to use vnbinder
+vndbinder_use(hal_audio)
+
+###
+### neverallow rules
+###
+
+# Should never execute any executable without a domain transition
+neverallow hal_audio_server { file_type fs_type }:file execute_no_trans;
+
+# Only audio HAL may directly access the audio hardware
+neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *;
+
+get_prop(hal_audio, audio_config_prop)
+get_prop(hal_audio, bluetooth_a2dp_offload_prop)
+get_prop(hal_audio, bluetooth_audio_hal_prop)
diff --git a/prebuilts/api/202504/private/hal_audiocontrol.te b/prebuilts/api/202504/private/hal_audiocontrol.te
new file mode 100644
index 0000000..6f45b0e
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_audiocontrol.te
@@ -0,0 +1,8 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_audiocontrol_client, hal_audiocontrol_server)
+binder_call(hal_audiocontrol_server, hal_audiocontrol_client)
+
+hal_attribute_hwservice(hal_audiocontrol, hal_audiocontrol_hwservice)
+hal_attribute_service(hal_audiocontrol, hal_audiocontrol_service)
+
+binder_call(hal_audiocontrol_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_authgraph.te b/prebuilts/api/202504/private/hal_authgraph.te
new file mode 100644
index 0000000..f053cb0
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_authgraph.te
@@ -0,0 +1,7 @@
+binder_call(hal_authgraph_client, hal_authgraph_server)
+
+hal_attribute_service(hal_authgraph, hal_authgraph_service)
+binder_call(hal_authgraph_server, servicemanager)
+
+allow hal_authgraph_server tee_device:chr_file rw_file_perms;
+allow hal_authgraph_server ion_device:chr_file r_file_perms;
diff --git a/prebuilts/api/202504/private/hal_authsecret.te b/prebuilts/api/202504/private/hal_authsecret.te
new file mode 100644
index 0000000..bbcdb9a
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_authsecret.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_authsecret_client, hal_authsecret_server)
+
+hal_attribute_hwservice(hal_authsecret, hal_authsecret_hwservice)
+hal_attribute_service(hal_authsecret, hal_authsecret_service)
+
+binder_call(hal_authsecret_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_bluetooth.te b/prebuilts/api/202504/private/hal_bluetooth.te
new file mode 100644
index 0000000..2e03ea2
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_bluetooth.te
@@ -0,0 +1,35 @@
+# HwBinder IPC from clients into server, and callbacks
+binder_call(hal_bluetooth_client, hal_bluetooth_server)
+binder_call(hal_bluetooth_server, hal_bluetooth_client)
+binder_call(hal_bluetooth_server, servicemanager)
+
+hal_attribute_hwservice(hal_bluetooth, hal_bluetooth_hwservice)
+hal_attribute_service(hal_bluetooth, hal_bluetooth_service)
+
+wakelock_use(hal_bluetooth);
+
+# The HAL toggles rfkill to power the chip off/on.
+allow hal_bluetooth self:global_capability_class_set net_admin;
+
+# bluetooth factory file accesses.
+r_dir_file(hal_bluetooth, bluetooth_efs_file)
+
+allow hal_bluetooth { uhid_device hci_attach_dev }:chr_file rw_file_perms;
+
+# sysfs access.
+r_dir_file(hal_bluetooth, sysfs_type)
+allow hal_bluetooth sysfs_bluetooth_writable:file rw_file_perms;
+allow hal_bluetooth self:global_capability2_class_set wake_alarm;
+
+# Allow write access to bluetooth-specific properties
+set_prop(hal_bluetooth, bluetooth_a2dp_offload_prop)
+set_prop(hal_bluetooth, bluetooth_audio_hal_prop)
+set_prop(hal_bluetooth, bluetooth_finder_prop)
+set_prop(hal_bluetooth, bluetooth_prop)
+set_prop(hal_bluetooth, exported_bluetooth_prop)
+
+# /proc access (bluesleep etc.).
+allow hal_bluetooth proc_bluetooth_writable:file rw_file_perms;
+
+# allow to run with real-time scheduling policy
+allow hal_bluetooth self:global_capability_class_set sys_nice;
diff --git a/prebuilts/api/202504/private/hal_bootctl.te b/prebuilts/api/202504/private/hal_bootctl.te
new file mode 100644
index 0000000..f9b50b0
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_bootctl.te
@@ -0,0 +1,10 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_bootctl_client, hal_bootctl_server)
+binder_call(hal_bootctl_server, hal_bootctl_client)
+binder_use(hal_bootctl_server)
+
+hal_attribute_hwservice(hal_bootctl, hal_bootctl_hwservice)
+allow hal_bootctl_server proc_bootconfig:file r_file_perms;
+
+# Needed to wait for AIDL hal services
+hal_attribute_service(hal_bootctl, hal_bootctl_service);
diff --git a/prebuilts/api/202504/private/hal_broadcastradio.te b/prebuilts/api/202504/private/hal_broadcastradio.te
new file mode 100644
index 0000000..bb882c9
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_broadcastradio.te
@@ -0,0 +1,7 @@
+binder_call(hal_broadcastradio_client, hal_broadcastradio_server)
+binder_call(hal_broadcastradio_server, hal_broadcastradio_client)
+
+hal_attribute_hwservice(hal_broadcastradio, hal_broadcastradio_hwservice)
+hal_attribute_service(hal_broadcastradio, hal_broadcastradio_service)
+
+binder_call(hal_broadcastradio_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_camera.te b/prebuilts/api/202504/private/hal_camera.te
new file mode 100644
index 0000000..df70ab6
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_camera.te
@@ -0,0 +1,42 @@
+# HwBinder IPC from clients to server and callbacks
+binder_call(hal_camera_client, hal_camera_server)
+binder_call(hal_camera_server, hal_camera_client)
+
+#binder IPC from client to service manager and callbacks
+binder_use(hal_camera_server)
+
+hal_attribute_hwservice(hal_camera, hal_camera_hwservice)
+hal_attribute_service(hal_camera, hal_camera_service)
+
+allow hal_camera device:dir r_dir_perms;
+allow hal_camera video_device:dir r_dir_perms;
+allow hal_camera video_device:chr_file rw_file_perms;
+allow hal_camera camera_device:chr_file rw_file_perms;
+allow hal_camera ion_device:chr_file rw_file_perms;
+allow hal_camera dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Both the client and the server need to use the graphics allocator
+allow { hal_camera_client hal_camera_server } hal_graphics_allocator:fd use;
+
+# Allow hal_camera to use fd from app,gralloc,and ashmem HAL
+allow hal_camera { appdomain -isolated_app }:fd use;
+allow hal_camera surfaceflinger:fd use;
+allow hal_camera hal_allocator_server:fd use;
+
+# Needed to provide debug dump output via dumpsys' pipes.
+allow hal_camera shell:fd use;
+allow hal_camera shell:fifo_file write;
+
+###
+### neverallow rules
+###
+
+# hal_camera should never execute any executable without a
+# domain transition
+neverallow hal_camera_server { file_type fs_type }:file execute_no_trans;
+
+# hal_camera should never need network access. Disallow network sockets.
+neverallow hal_camera_server { domain userdebug_or_eng(`-su') }:{ tcp_socket udp_socket rawip_socket } *;
+
+# Only camera HAL may directly access the camera hardware
+neverallow { halserverdomain -hal_camera_server } camera_device:chr_file *;
diff --git a/prebuilts/api/202504/private/hal_can.te b/prebuilts/api/202504/private/hal_can.te
new file mode 100644
index 0000000..d48c43f
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_can.te
@@ -0,0 +1,13 @@
+# CAN controller
+binder_call(hal_can_controller_client, hal_can_controller_server)
+binder_call(hal_can_controller_server, hal_can_controller_client)
+hal_attribute_hwservice(hal_can_controller, hal_can_controller_hwservice)
+
+# CAN bus
+binder_call(hal_can_bus_client, hal_can_bus_server)
+binder_call(hal_can_bus_server, hal_can_bus_client)
+hal_attribute_hwservice(hal_can_bus, hal_can_bus_hwservice)
+
+# AIDL HAL for CAN buses (ICanController)
+hal_attribute_service(hal_can_controller, hal_can_controller_service)
+binder_use(hal_can_controller)
diff --git a/prebuilts/api/202504/private/hal_cas.te b/prebuilts/api/202504/private/hal_cas.te
new file mode 100644
index 0000000..056b4c9
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_cas.te
@@ -0,0 +1,43 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_cas_client, hal_cas_server)
+binder_call(hal_cas_server, hal_cas_client)
+
+hal_attribute_hwservice(hal_cas, hal_cas_hwservice)
+allow hal_cas_server hidl_memory_hwservice:hwservice_manager find;
+
+hal_attribute_service(hal_cas, hal_cas_service)
+
+binder_call(hal_cas_server, servicemanager)
+binder_call(hal_cas_client, servicemanager)
+
+# Permit reading device's serial number from system properties
+get_prop(hal_cas_server, serialno_prop)
+
+# Read files already opened under /data
+allow hal_cas system_data_file:file { getattr read };
+
+# Read access to pseudo filesystems
+r_dir_file(hal_cas, cgroup)
+allow hal_cas cgroup:dir { search write };
+allow hal_cas cgroup:file w_file_perms;
+
+r_dir_file(hal_cas, cgroup_v2)
+allow hal_cas cgroup_v2:dir { search write };
+allow hal_cas cgroup_v2:file w_file_perms;
+
+# Allow access to ion memory allocation device
+allow hal_cas ion_device:chr_file rw_file_perms;
+allow hal_cas hal_graphics_allocator:fd use;
+
+allow hal_cas tee_device:chr_file rw_file_perms;
+
+###
+### neverallow rules
+###
+
+# hal_cas should never execute any executable without a
+# domain transition
+neverallow hal_cas_server { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm hal_cas_server domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
diff --git a/prebuilts/api/202504/private/hal_codec2.te b/prebuilts/api/202504/private/hal_codec2.te
new file mode 100644
index 0000000..df36ff8
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_codec2.te
@@ -0,0 +1,34 @@
+get_prop(hal_codec2_client, media_variant_prop)
+get_prop(hal_codec2_server, media_variant_prop)
+get_prop(hal_codec2_client, codec2_config_prop)
+get_prop(hal_codec2_server, codec2_config_prop)
+
+binder_call(hal_codec2_client, hal_codec2_server)
+binder_call(hal_codec2_server, hal_codec2_client)
+
+hal_attribute_hwservice(hal_codec2, hal_codec2_hwservice)
+hal_attribute_service(hal_codec2, hal_codec2_service)
+
+# The following permissions are added to hal_codec2_server because vendor and
+# vndk libraries provided for Codec2 implementation need them.
+
+# Allow server access to composer sync fences
+allow hal_codec2_server hal_graphics_composer:fd use;
+
+# Allow both server and client access to ion
+allow hal_codec2_server ion_device:chr_file r_file_perms;
+
+# Allow server access to camera HAL's fences
+allow hal_codec2_server hal_camera:fd use;
+
+# Receive gralloc buffer FDs from bufferhubd.
+allow hal_codec2_server bufferhubd:fd use;
+
+allow hal_codec2_client ion_device:chr_file r_file_perms;
+
+allow { hal_codec2_client -isolated_app_all } surfaceflinger_service:service_manager find;
+
+# codec2 aidl graphic buffer allocation waitable object
+allow hal_codec2_server su:fifo_file read;
+allow hal_codec2_server hal_codec2_client:fifo_file read;
+allow hal_codec2_server { appdomain -isolated_app_all }:fifo_file read;
diff --git a/prebuilts/api/202504/private/hal_configstore.te b/prebuilts/api/202504/private/hal_configstore.te
new file mode 100644
index 0000000..d26e1db
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_configstore.te
@@ -0,0 +1,67 @@
+# HwBinder IPC from client to server
+binder_call(hal_configstore_client, hal_configstore_server)
+
+hal_attribute_hwservice(hal_configstore, hal_configstore_ISurfaceFlingerConfigs)
+
+# hal_configstore runs with a strict seccomp filter. Use crash_dump's
+# fallback path to collect crash data.
+crash_dump_fallback(hal_configstore_server)
+
+###
+### neverallow rules
+###
+
+# Should never execute an executable without a domain transition
+neverallow hal_configstore_server { file_type fs_type }:file execute_no_trans;
+
+# Should never need network access. Disallow sockets except for
+# for unix stream/dgram sockets used for logging/debugging.
+neverallow hal_configstore_server domain:{
+ rawip_socket tcp_socket udp_socket
+ netlink_route_socket netlink_selinux_socket
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket
+} *;
+neverallow hal_configstore_server {
+ domain
+ -hal_configstore_server
+ -logd
+ -prng_seeder
+ userdebug_or_eng(`-su')
+ -tombstoned
+}:{ unix_dgram_socket unix_stream_socket } *;
+
+# Should never need access to anything on /data
+neverallow hal_configstore_server {
+ data_file_type
+ -anr_data_file # for crash dump collection
+ -tombstone_data_file # for crash dump collection
+ with_native_coverage(`-method_trace_data_file')
+}:{ file fifo_file sock_file } *;
+
+# Should never need sdcard access
+neverallow hal_configstore_server {
+ sdcard_type
+ fuse sdcardfs vfat exfat fuseblk # manual expansion for completeness
+}:dir ~getattr;
+neverallow hal_configstore_server {
+ sdcard_type
+ fuse sdcardfs vfat exfat fuseblk # manual expansion for completeness
+}:file *;
+
+# Do not permit access to service_manager and vndservice_manager
+neverallow hal_configstore_server *:service_manager *;
+
+# No privileged capabilities
+neverallow hal_configstore_server self:capability_class_set *;
+
+# No ptracing other processes
+neverallow hal_configstore_server *:process ptrace;
+
+# no relabeling
+neverallow hal_configstore_server *:dir_file_class_set { relabelfrom relabelto };
diff --git a/prebuilts/api/202504/private/hal_confirmationui.te b/prebuilts/api/202504/private/hal_confirmationui.te
new file mode 100644
index 0000000..9896e35
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_confirmationui.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server
+binder_call(hal_confirmationui_client, hal_confirmationui_server)
+
+hal_attribute_hwservice(hal_confirmationui, hal_confirmationui_hwservice)
+hal_attribute_service(hal_confirmationui, hal_confirmationui_service)
+binder_call(hal_confirmationui_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_contexthub.te b/prebuilts/api/202504/private/hal_contexthub.te
new file mode 100644
index 0000000..14c2dbc
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_contexthub.te
@@ -0,0 +1,10 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_contexthub_client, hal_contexthub_server)
+binder_call(hal_contexthub_server, hal_contexthub_client)
+
+add_service(hal_contexthub_server, hal_contexthub_service)
+binder_call(hal_contexthub_server, servicemanager)
+
+allow hal_contexthub_client hal_contexthub_service:service_manager find;
+
+hal_attribute_hwservice(hal_contexthub, hal_contexthub_hwservice)
diff --git a/prebuilts/api/202504/private/hal_drm.te b/prebuilts/api/202504/private/hal_drm.te
new file mode 100644
index 0000000..211fbb7
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_drm.te
@@ -0,0 +1,64 @@
+# HwBinder IPC from client to server, and callbacks
+binder_use(hal_drm_server)
+binder_call(hal_drm_client, hal_drm_server)
+binder_call(hal_drm_server, hal_drm_client)
+
+hal_attribute_hwservice(hal_drm, hal_drm_hwservice)
+hal_attribute_service(hal_drm, hal_drm_service)
+
+allow hal_drm hidl_memory_hwservice:hwservice_manager find;
+
+# Required by Widevine DRM (b/22990512)
+allow hal_drm self:process execmem;
+
+# Permit reading device's serial number from system properties
+get_prop(hal_drm_server, serialno_prop)
+# Permit reading force L3 system property
+get_prop(hal_drm_server, drm_forcel3_prop)
+
+# Read files already opened under /data
+allow hal_drm system_data_file:file { getattr read };
+
+# Read access to pseudo filesystems
+r_dir_file(hal_drm, cgroup)
+allow hal_drm cgroup:dir { search write };
+allow hal_drm cgroup:file w_file_perms;
+
+r_dir_file(hal_drm, cgroup_v2)
+allow hal_drm cgroup_v2:dir { search write };
+allow hal_drm cgroup_v2:file w_file_perms;
+
+# Allow dumpsys Widevine without root
+allow hal_drm_server shell:fd use;
+allow hal_drm_server shell:fifo_file write;
+
+# Allow access to ion memory allocation device
+allow hal_drm ion_device:chr_file rw_file_perms;
+allow hal_drm hal_graphics_allocator:fd use;
+
+# Allow access to hidl_memory allocation service
+allow hal_drm hal_allocator_server:fd use;
+
+# Allow access to fds allocated by mediaserver
+allow hal_drm mediaserver:fd use;
+
+allow hal_drm sysfs:file r_file_perms;
+
+allow hal_drm tee_device:chr_file rw_file_perms;
+
+allow hal_drm_server { appdomain -isolated_app }:fd use;
+
+# only allow unprivileged socket ioctl commands
+allowxperm hal_drm self:{ rawip_socket tcp_socket udp_socket }
+ ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
+
+###
+### neverallow rules
+###
+
+# hal_drm should never execute any executable without a
+# domain transition
+neverallow hal_drm_server { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm hal_drm_server domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
diff --git a/prebuilts/api/202504/private/hal_dumpstate.te b/prebuilts/api/202504/private/hal_dumpstate.te
new file mode 100644
index 0000000..eaa223b
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_dumpstate.te
@@ -0,0 +1,20 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_dumpstate_client, hal_dumpstate_server)
+binder_call(hal_dumpstate_server, hal_dumpstate_client)
+
+set_prop(hal_dumpstate_server, hal_dumpstate_config_prop)
+
+hal_attribute_hwservice(hal_dumpstate, hal_dumpstate_hwservice)
+hal_attribute_service(hal_dumpstate, hal_dumpstate_service)
+
+binder_call(hal_dumpstate_server, servicemanager)
+
+binder_use(hal_dumpstate_server)
+
+# write bug reports in /data/data/com.android.shell/files/bugreports/bugreport
+allow hal_dumpstate shell_data_file:file write;
+# allow reading /proc/interrupts for all hal impls
+allow hal_dumpstate proc_interrupts:file r_file_perms;
+
+# Log fsck results
+r_dir_file(hal_dumpstate, fscklogs)
diff --git a/prebuilts/api/202504/private/hal_evs.te b/prebuilts/api/202504/private/hal_evs.te
new file mode 100644
index 0000000..09a40d8
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_evs.te
@@ -0,0 +1,15 @@
+hwbinder_use(hal_evs_client)
+hwbinder_use(hal_evs_server)
+
+binder_call(hal_evs_client, hal_evs_server)
+binder_call(hal_evs_server, hal_evs_client)
+
+# Below lines are equivalent to hal_attribute_hwservice(hal_evs, hal_evs_hwservice)
+# except it allows evsmanagerd to add hal_evs_hwservice.
+allow hal_evs_client hal_evs_hwservice:hwservice_manager find;
+allow hal_evs_server hal_evs_hwservice:hwservice_manager { add find };
+allow hal_evs_server hidl_base_hwservice:hwservice_manager add;
+neverallow { domain -hal_evs_server -evsmanagerd } hal_evs_hwservice:hwservice_manager add;
+
+# Allows to add a service
+hal_attribute_service(hal_evs, hal_evs_service)
diff --git a/prebuilts/api/202504/private/hal_face.te b/prebuilts/api/202504/private/hal_face.te
new file mode 100644
index 0000000..5e43953
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_face.te
@@ -0,0 +1,15 @@
+# Allow HwBinder IPC from client to server, and vice versa for callbacks.
+binder_call(hal_face_client, hal_face_server)
+binder_call(hal_face_server, hal_face_client)
+
+hal_attribute_hwservice(hal_face, hal_face_hwservice)
+hal_attribute_service(hal_face, hal_face_service)
+
+binder_use(hal_face_server)
+
+# Allow access to the ion memory allocation device.
+allow hal_face ion_device:chr_file r_file_perms;
+
+# Allow read/write access to the face template directory.
+allow {hal_face -coredomain} face_vendor_data_file:file create_file_perms;
+allow {hal_face -coredomain} face_vendor_data_file:dir rw_dir_perms;
diff --git a/prebuilts/api/202504/private/hal_fastboot.te b/prebuilts/api/202504/private/hal_fastboot.te
new file mode 100644
index 0000000..7aecac1
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_fastboot.te
@@ -0,0 +1,7 @@
+# allow binder connection from client to server
+binder_call(hal_fastboot_client, hal_fastboot_server)
+# allow client to find the service, allow server to register the service
+hal_attribute_service(hal_fastboot, hal_fastboot_service)
+# allow binder communication from server to service_manager
+binder_call(hal_fastboot_server, servicemanager)
+
diff --git a/prebuilts/api/202504/private/hal_fingerprint.te b/prebuilts/api/202504/private/hal_fingerprint.te
new file mode 100644
index 0000000..3295cc7
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_fingerprint.te
@@ -0,0 +1,20 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_fingerprint_client, hal_fingerprint_server)
+binder_call(hal_fingerprint_server, hal_fingerprint_client)
+
+hal_attribute_hwservice(hal_fingerprint, hal_fingerprint_hwservice)
+hal_attribute_service(hal_fingerprint, hal_fingerprint_service)
+
+binder_use(hal_fingerprint_server)
+
+# For memory allocation
+allow hal_fingerprint ion_device:chr_file r_file_perms;
+
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:file { create_file_perms };
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:dir rw_dir_perms;
+
+r_dir_file(hal_fingerprint, cgroup)
+r_dir_file(hal_fingerprint, cgroup_v2)
+r_dir_file({hal_fingerprint -coredomain}, sysfs)
+
+
diff --git a/prebuilts/api/202504/private/hal_gatekeeper.te b/prebuilts/api/202504/private/hal_gatekeeper.te
new file mode 100644
index 0000000..fc23e64
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_gatekeeper.te
@@ -0,0 +1,9 @@
+binder_call(hal_gatekeeper_client, hal_gatekeeper_server)
+
+hal_attribute_hwservice(hal_gatekeeper, hal_gatekeeper_hwservice)
+hal_attribute_service(hal_gatekeeper, hal_gatekeeper_service)
+binder_call(hal_gatekeeper_server, servicemanager)
+
+# TEE access.
+allow hal_gatekeeper tee_device:chr_file rw_file_perms;
+allow hal_gatekeeper ion_device:chr_file r_file_perms;
diff --git a/prebuilts/api/202504/private/hal_gnss.te b/prebuilts/api/202504/private/hal_gnss.te
new file mode 100644
index 0000000..59a6df8
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_gnss.te
@@ -0,0 +1,9 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_gnss_client, hal_gnss_server)
+binder_call(hal_gnss_server, hal_gnss_client)
+
+hal_attribute_hwservice(hal_gnss, hal_gnss_hwservice)
+hal_attribute_service(hal_gnss, hal_gnss_service)
+binder_use(hal_gnss_server)
+binder_use(hal_gnss_client)
+
diff --git a/prebuilts/api/202504/private/hal_graphics_allocator.te b/prebuilts/api/202504/private/hal_graphics_allocator.te
new file mode 100644
index 0000000..39ba46e
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_graphics_allocator.te
@@ -0,0 +1,24 @@
+# HwBinder IPC from client to server
+binder_call(hal_graphics_allocator_client, hal_graphics_allocator_server)
+
+hal_attribute_hwservice(hal_graphics_allocator, hal_graphics_allocator_hwservice)
+allow hal_graphics_allocator_client hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_graphics_allocator_client hal_graphics_mapper_service:service_manager find;
+allow hal_graphics_allocator_client same_process_hal_file:file { execute read open getattr map };
+
+# GPU device access
+allow hal_graphics_allocator gpu_device:chr_file rw_file_perms;
+allow hal_graphics_allocator gpu_device:dir r_dir_perms;
+allow hal_graphics_allocator ion_device:chr_file r_file_perms;
+allow hal_graphics_allocator dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Access the secure heap
+allow hal_graphics_allocator dmabuf_system_secure_heap_device:chr_file r_file_perms;
+
+# allow to run with real-time scheduling policy
+allow hal_graphics_allocator self:global_capability_class_set sys_nice;
+
+# IAllocator stable-aidl
+hal_attribute_service(hal_graphics_allocator, hal_graphics_allocator_service)
+binder_call(hal_graphics_allocator_server, servicemanager)
+binder_call(hal_graphics_allocator_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_graphics_composer.te b/prebuilts/api/202504/private/hal_graphics_composer.te
new file mode 100644
index 0000000..3250564
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_graphics_composer.te
@@ -0,0 +1,38 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_graphics_composer_client, hal_graphics_composer_server)
+binder_call(hal_graphics_composer_server, hal_graphics_composer_client)
+allow hal_graphics_composer_client hal_graphics_composer_server_tmpfs:file { getattr map read write };
+allow hal_graphics_composer_server hal_graphics_composer_client_tmpfs:file { getattr map read write };
+
+hal_attribute_hwservice(hal_graphics_composer, hal_graphics_composer_hwservice)
+
+# Coordinate with hal_graphics_mapper
+allow hal_graphics_composer_server hal_graphics_mapper_hwservice:hwservice_manager find;
+
+# GPU device access
+allow hal_graphics_composer gpu_device:chr_file rw_file_perms;
+allow hal_graphics_composer gpu_device:dir r_dir_perms;
+allow hal_graphics_composer ion_device:chr_file r_file_perms;
+allow hal_graphics_composer dmabuf_system_heap_device:chr_file r_file_perms;
+allow hal_graphics_composer hal_graphics_allocator:fd use;
+
+# Access /dev/graphics/fb0.
+allow hal_graphics_composer graphics_device:dir search;
+allow hal_graphics_composer graphics_device:chr_file rw_file_perms;
+
+# Fences
+allow hal_graphics_composer system_server:fd use;
+allow hal_graphics_composer bootanim:fd use;
+allow hal_graphics_composer appdomain:fd use;
+
+# allow self to set SCHED_FIFO
+allow hal_graphics_composer self:global_capability_class_set sys_nice;
+
+# allow surfaceflinger to use a pipe for dumpsys output
+allow hal_graphics_composer_server hal_graphics_composer_client:fifo_file write;
+
+
+binder_call(hal_graphics_composer_client, servicemanager)
+binder_call(hal_graphics_composer_server, servicemanager)
+
+hal_attribute_service(hal_graphics_composer, hal_graphics_composer_service)
diff --git a/prebuilts/api/202504/private/hal_health.te b/prebuilts/api/202504/private/hal_health.te
new file mode 100644
index 0000000..5d7aff5
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_health.te
@@ -0,0 +1,33 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_health_client, hal_health_server)
+binder_call(hal_health_server, hal_health_client)
+
+hal_attribute_hwservice(hal_health, hal_health_hwservice)
+hal_attribute_service(hal_health, hal_health_service)
+
+# Common rules for a health service.
+
+# Allow to listen to uevents for updates
+allow hal_health_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# Allow to read /sys/class/power_supply directory
+allow hal_health_server sysfs:dir r_dir_perms;
+
+# Allow to read files under /sys/class/power_supply. Implementations typically have symlinks
+# to vendor specific files. Vendors should mark sysfs_batteryinfo on all files read by health
+# HAL service.
+r_dir_file(hal_health_server, sysfs_batteryinfo)
+
+# Allow to wake up to send periodic events
+wakelock_use(hal_health_server)
+
+# Write to /dev/kmsg
+allow hal_health_server kmsg_device:chr_file { getattr w_file_perms };
+
+# Allow to use timerfd to wake itself up periodically to send health info.
+allow hal_health_server self:capability2 wake_alarm;
+
+# Use bpf programs
+allow hal_health_server fs_bpf_vendor:dir search;
+allow hal_health_server fs_bpf_vendor:file read;
+allow hal_health_server bpfloader:bpf prog_run;
diff --git a/prebuilts/api/202504/private/hal_health_storage.te b/prebuilts/api/202504/private/hal_health_storage.te
new file mode 100644
index 0000000..4938a16
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_health_storage.te
@@ -0,0 +1,11 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_health_storage_client, hal_health_storage_server)
+binder_call(hal_health_storage_server, hal_health_storage_client)
+
+binder_use(hal_health_storage_server)
+
+hal_attribute_hwservice(hal_health_storage, hal_health_storage_hwservice)
+hal_attribute_service(hal_health_storage, hal_health_storage_service)
+
+# Allow ReadDefaultFstab().
+read_fstab(hal_health_storage_server)
diff --git a/prebuilts/api/202504/private/hal_identity.te b/prebuilts/api/202504/private/hal_identity.te
new file mode 100644
index 0000000..8d558ad
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_identity.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server
+binder_call(hal_identity_client, hal_identity_server)
+
+hal_attribute_service(hal_identity, hal_identity_service)
+
+binder_call(hal_identity_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_input_classifier.te b/prebuilts/api/202504/private/hal_input_classifier.te
new file mode 100644
index 0000000..70a4b7d
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_input_classifier.te
@@ -0,0 +1,4 @@
+# HwBinder IPC from client to server
+binder_call(hal_input_classifier_client, hal_input_classifier_server)
+
+hal_attribute_hwservice(hal_input_classifier, hal_input_classifier_hwservice)
diff --git a/prebuilts/api/202504/private/hal_input_processor.te b/prebuilts/api/202504/private/hal_input_processor.te
new file mode 100644
index 0000000..b59b15f
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_input_processor.te
@@ -0,0 +1,8 @@
+# HwBinder IPC from client to server
+binder_call(hal_input_processor_client, hal_input_processor_server)
+binder_call(hal_input_processor_server, servicemanager)
+
+hal_attribute_service(hal_input_processor, hal_input_processor_service)
+
+# Allow dumping of the HAL
+allow hal_input_processor_server dumpstate:fifo_file write;
diff --git a/prebuilts/api/202504/private/hal_ir.te b/prebuilts/api/202504/private/hal_ir.te
new file mode 100644
index 0000000..452127a
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_ir.te
@@ -0,0 +1,8 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_ir_client, hal_ir_server)
+binder_call(hal_ir_server, hal_ir_client)
+
+hal_attribute_service(hal_ir, hal_ir_service)
+binder_call(hal_ir_server, servicemanager)
+
+hal_attribute_hwservice(hal_ir, hal_ir_hwservice)
diff --git a/prebuilts/api/202504/private/hal_ivn.te b/prebuilts/api/202504/private/hal_ivn.te
new file mode 100644
index 0000000..617effe
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_ivn.te
@@ -0,0 +1,4 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_ivn_client, hal_ivn_server)
+
+hal_attribute_service(hal_ivn, hal_ivn_service)
diff --git a/prebuilts/api/202504/private/hal_keymaster.te b/prebuilts/api/202504/private/hal_keymaster.te
new file mode 100644
index 0000000..3e164ad
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_keymaster.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_keymaster_client, hal_keymaster_server)
+
+hal_attribute_hwservice(hal_keymaster, hal_keymaster_hwservice)
+
+allow hal_keymaster tee_device:chr_file rw_file_perms;
+allow hal_keymaster ion_device:chr_file r_file_perms;
diff --git a/prebuilts/api/202504/private/hal_keymint.te b/prebuilts/api/202504/private/hal_keymint.te
new file mode 100644
index 0000000..6c7b577
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_keymint.te
@@ -0,0 +1,8 @@
+binder_call(hal_keymint_client, hal_keymint_server)
+
+hal_attribute_service(hal_keymint, hal_keymint_service)
+hal_attribute_service(hal_keymint, hal_remotelyprovisionedcomponent_service)
+binder_call(hal_keymint_server, servicemanager)
+
+allow { hal_keymint_server -coredomain } tee_device:chr_file rw_file_perms;
+allow { hal_keymint_server -coredomain } ion_device:chr_file r_file_perms;
diff --git a/prebuilts/api/202504/private/hal_keymint_system.te b/prebuilts/api/202504/private/hal_keymint_system.te
new file mode 100644
index 0000000..0a20870
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_keymint_system.te
@@ -0,0 +1,7 @@
+type hal_keymint_system, domain, coredomain;
+hal_server_domain(hal_keymint_system, hal_keymint)
+
+type hal_keymint_system_exec, exec_type, system_file_type, file_type;
+init_daemon_domain(hal_keymint_system)
+
+allow hal_keymint_system self:vsock_socket { create_socket_perms_no_ioctl };
diff --git a/prebuilts/api/202504/private/hal_lazy_test.te b/prebuilts/api/202504/private/hal_lazy_test.te
new file mode 100644
index 0000000..93cf235
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_lazy_test.te
@@ -0,0 +1,3 @@
+userdebug_or_eng(`
+ hal_attribute_hwservice(hal_lazy_test, hal_lazy_test_hwservice)
+')
diff --git a/prebuilts/api/202504/private/hal_light.te b/prebuilts/api/202504/private/hal_light.te
new file mode 100644
index 0000000..40829b6
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_light.te
@@ -0,0 +1,15 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_light_client, hal_light_server)
+binder_call(hal_light_server, hal_light_client)
+
+hal_attribute_hwservice(hal_light, hal_light_hwservice)
+hal_attribute_service(hal_light, hal_light_service)
+
+binder_call(hal_light_server, servicemanager)
+binder_use(hal_light_client)
+
+allow hal_light_server dumpstate:fifo_file write;
+
+allow hal_light sysfs_leds:lnk_file read;
+allow hal_light sysfs_leds:file rw_file_perms;
+allow hal_light sysfs_leds:dir r_dir_perms;
diff --git a/prebuilts/api/202504/private/hal_lowpan.te b/prebuilts/api/202504/private/hal_lowpan.te
new file mode 100644
index 0000000..6fb95e9
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_lowpan.te
@@ -0,0 +1,20 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_lowpan_client, hal_lowpan_server)
+binder_call(hal_lowpan_server, hal_lowpan_client)
+
+
+# Allow hal_lowpan_client to be able to find the hal_lowpan_server
+hal_attribute_hwservice(hal_lowpan, hal_lowpan_hwservice)
+
+# hal_lowpan domain can write/read to/from lowpan_prop
+set_prop(hal_lowpan_server, lowpan_prop)
+
+# Allow hal_lowpan_server to open lowpan_devices
+allow hal_lowpan_server lowpan_device:chr_file rw_file_perms;
+
+###
+### neverallow rules
+###
+
+# Only LoWPAN HAL may directly access LoWPAN hardware
+neverallow { domain -hal_lowpan_server -init -ueventd } lowpan_device:chr_file ~getattr;
diff --git a/prebuilts/api/202504/private/hal_macsec.te b/prebuilts/api/202504/private/hal_macsec.te
new file mode 100644
index 0000000..27225db
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_macsec.te
@@ -0,0 +1,7 @@
+# Binder IPC from client to server, and callbacks
+binder_call(hal_macsec_client, hal_macsec_server)
+binder_call(hal_macsec_server, hal_macsec_client)
+
+hal_attribute_service(hal_macsec, hal_macsec_service)
+
+binder_use(hal_macsec_server)
diff --git a/prebuilts/api/202504/private/hal_mediaquality.te b/prebuilts/api/202504/private/hal_mediaquality.te
new file mode 100644
index 0000000..5bcdbbc
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_mediaquality.te
@@ -0,0 +1,9 @@
+starting_at_board_api(202504, `
+ binder_call(hal_mediaquality_client, hal_mediaquality_server)
+ binder_call(hal_mediaquality_server, hal_mediaquality_client)
+
+ hal_attribute_service(hal_mediaquality, hal_mediaquality_service)
+
+ binder_call(hal_mediaquality_server, servicemanager)
+ binder_call(hal_mediaquality_client, servicemanager)
+')
diff --git a/prebuilts/api/202504/private/hal_memtrack.te b/prebuilts/api/202504/private/hal_memtrack.te
new file mode 100644
index 0000000..30a4480
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_memtrack.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_memtrack_client, hal_memtrack_server)
+
+hal_attribute_hwservice(hal_memtrack, hal_memtrack_hwservice)
+
+hal_attribute_service(hal_memtrack, hal_memtrack_service)
+binder_call(hal_memtrack_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_neuralnetworks.te b/prebuilts/api/202504/private/hal_neuralnetworks.te
new file mode 100644
index 0000000..c7049fd
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_neuralnetworks.te
@@ -0,0 +1,47 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_neuralnetworks_client, hal_neuralnetworks_server)
+binder_call(hal_neuralnetworks_server, hal_neuralnetworks_client)
+
+hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice)
+allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_allocator:fd use;
+allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_graphics_allocator:fd use;
+allow hal_neuralnetworks gpu_device:chr_file rw_file_perms;
+allow hal_neuralnetworks gpu_device:dir r_dir_perms;
+
+# Allow NN HAL service to use a client-provided fd residing in /data/data/.
+allow hal_neuralnetworks_server app_data_file:file { read write getattr map };
+allow hal_neuralnetworks_server privapp_data_file:file { read write getattr map };
+
+# Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/.
+allow hal_neuralnetworks_server shell_data_file:file { read write getattr map };
+
+# Allow NN HAL service to read a client-provided ION memory fd.
+allow hal_neuralnetworks_server ion_device:chr_file r_file_perms;
+
+# Allow NN HAL service to use a client-provided fd residing in /storage
+allow hal_neuralnetworks_server storage_file:file { getattr map read };
+
+# Allow NN HAL service to read a client-provided fd residing in /data/app/.
+allow hal_neuralnetworks_server apk_data_file:file { getattr map read };
+
+# Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product
+# property to determine whether to deny NNAPI extensions use for apps
+# on product partition (apps in GSI are not allowed to use NNAPI extensions).
+get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop);
+
+# Allow NN HAL client to read device_config_nnapi_native_prop.
+get_prop(hal_neuralnetworks_client, device_config_nnapi_native_prop)
+
+# This property is only expected to be found in /product/build.prop,
+# allow to be set only by init.
+neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set;
+
+# Define sepolicy for NN AIDL HAL service
+hal_attribute_service(hal_neuralnetworks, hal_neuralnetworks_service)
+binder_call(hal_neuralnetworks_server, servicemanager)
+
+binder_use(hal_neuralnetworks_server)
+
+allow hal_neuralnetworks_server dumpstate:fifo_file write;
diff --git a/prebuilts/api/202504/private/hal_neverallows.te b/prebuilts/api/202504/private/hal_neverallows.te
new file mode 100644
index 0000000..3562888
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_neverallows.te
@@ -0,0 +1,103 @@
+# only HALs responsible for network hardware should have privileged
+# network capabilities
+neverallow {
+ halserverdomain
+ -hal_bluetooth_server
+ -hal_can_controller_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_uwb_server
+ # TODO(b/196225233): Remove hal_uwb_vendor_server
+ -hal_uwb_vendor_server
+ -hal_nlinterceptor_server
+ -hal_tv_tuner_server
+} self:global_capability_class_set { net_admin net_raw };
+
+# Unless a HAL's job is to communicate over the network, or control network
+# hardware, it should not be using network sockets.
+# NOTE: HALs for automotive devices have an exemption from this rule because in
+# a car it is common to have external modules and HALs need to communicate to
+# those modules using network. Using this exemption for non-automotive builds
+# will result in CTS failure.
+neverallow {
+ halserverdomain
+ -hal_automotive_socket_exemption
+ -hal_can_controller_server
+ -hal_tetheroffload_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_uwb_server
+ # TODO(b/196225233): Remove hal_uwb_vendor_server
+ -hal_uwb_vendor_server
+ -hal_nlinterceptor_server
+ -hal_bluetooth_server
+ -hal_tv_tuner_server
+} domain:{ udp_socket rawip_socket } *;
+
+neverallow {
+ halserverdomain
+ -hal_automotive_socket_exemption
+ -hal_can_controller_server
+ -hal_tetheroffload_server
+ -hal_wifi_server
+ -hal_wifi_hostapd_server
+ -hal_wifi_supplicant_server
+ -hal_telephony_server
+ -hal_nlinterceptor_server
+ -hal_bluetooth_server
+ -hal_tv_tuner_server
+} {
+ domain
+ userdebug_or_eng(`-su')
+}:tcp_socket *;
+
+# The UWB HAL is not actually a networking HAL but may need to bring up and down
+# interfaces. Restrict it to only these networking operations.
+neverallow hal_uwb_vendor_server self:global_capability_class_set { net_raw };
+
+# Subset of socket_class_set likely to be usable for communication or accessible through net_admin.
+# udp_socket is required to use interface ioctls.
+neverallow hal_uwb_vendor_server domain:{ socket rawip_socket netlink_socket packet_socket key_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket qipcrtr_socket xdp_socket } *;
+
+###
+# HALs are defined as an attribute and so a given domain could hypothetically
+# have multiple HALs in it (or even all of them) with the subsequent policy of
+# the domain comprised of the union of all the HALs.
+#
+# This is a problem because
+# 1) Security sensitive components should only be accessed by specific HALs.
+# 2) hwbinder_call and the restrictions it provides cannot be reasoned about in
+# the platform.
+# 3) The platform cannot reason about defense in depth if there are
+# monolithic domains etc.
+#
+# As an example, hal_keymaster and hal_gatekeeper can access the TEE and while
+# its OK for them to share a process its not OK with them to share processes
+# with other hals.
+#
+# The following neverallow rules, in conjuntion with CTS tests, assert that
+# these security principles are adhered to.
+#
+# Do not allow a hal to exec another process without a domain transition.
+# TODO remove exemptions.
+neverallow {
+ halserverdomain
+ -hal_dumpstate_server
+ -hal_telephony_server
+} {
+ file_type
+ fs_type
+ # May invoke shell commands via /system/bin/sh
+ -shell_exec
+ -toolbox_exec
+}:file execute_no_trans;
+# Do not allow a process other than init to transition into a HAL domain.
+neverallow { domain -init } halserverdomain:process transition;
+# Only allow transitioning to a domain by running its executable. Do not
+# allow transitioning into a HAL domain by use of seclabel in an
+# init.*.rc script.
+neverallow * halserverdomain:process dyntransition;
diff --git a/prebuilts/api/202504/private/hal_nfc.te b/prebuilts/api/202504/private/hal_nfc.te
new file mode 100644
index 0000000..3d0202b
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_nfc.te
@@ -0,0 +1,13 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_nfc_client, hal_nfc_server)
+binder_call(hal_nfc_server, hal_nfc_client)
+binder_call(hal_nfc_server, servicemanager)
+
+hal_attribute_hwservice(hal_nfc, hal_nfc_hwservice)
+hal_attribute_service(hal_nfc, hal_nfc_service)
+
+# Set NFC properties (used by bcm2079x HAL).
+set_prop(hal_nfc, nfc_prop)
+
+# NFC device access.
+allow hal_nfc nfc_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/hal_nlinterceptor.te b/prebuilts/api/202504/private/hal_nlinterceptor.te
new file mode 100644
index 0000000..1a738a5
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_nlinterceptor.te
@@ -0,0 +1,8 @@
+binder_call(hal_nlinterceptor_client, hal_nlinterceptor_server)
+
+hal_attribute_service(hal_nlinterceptor, hal_nlinterceptor_service)
+binder_call(hal_nlinterceptor, servicemanager)
+
+allow hal_nlinterceptor self:global_capability_class_set net_admin;
+allow hal_nlinterceptor self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_nlinterceptor self:netlink_route_socket { create_socket_perms_no_ioctl nlmsg_readpriv nlmsg_write };
diff --git a/prebuilts/api/202504/private/hal_oemlock.te b/prebuilts/api/202504/private/hal_oemlock.te
new file mode 100644
index 0000000..9f38fa5
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_oemlock.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_oemlock_client, hal_oemlock_server)
+
+hal_attribute_hwservice(hal_oemlock, hal_oemlock_hwservice)
+hal_attribute_service(hal_oemlock, hal_oemlock_service)
+
+binder_call(hal_oemlock_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_omx.te b/prebuilts/api/202504/private/hal_omx.te
new file mode 100644
index 0000000..2611dcd
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_omx.te
@@ -0,0 +1,50 @@
+# applies all permissions to hal_omx NOT hal_omx_server
+# since OMX must always be in its own process.
+
+binder_call(hal_omx_server, binderservicedomain)
+binder_call(hal_omx_server, { appdomain -isolated_app })
+
+# Allow hal_omx_server access to composer sync fences
+allow hal_omx_server hal_graphics_composer:fd use;
+
+allow hal_omx_server ion_device:chr_file rw_file_perms;
+allow hal_omx_server hal_camera:fd use;
+
+crash_dump_fallback(hal_omx_server)
+
+# Recieve gralloc buffer FDs from bufferhubd. Note that hal_omx_server never
+# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge
+# between those two: it talks to hal_omx_server via Binder and talks to bufferhubd
+# via PDX. Thus, there is no need to use pdx_client macro.
+allow hal_omx_server bufferhubd:fd use;
+
+hal_attribute_hwservice(hal_omx, hal_omx_hwservice)
+
+allow hal_omx_client hidl_token_hwservice:hwservice_manager find;
+
+get_prop(hal_omx_client, media_variant_prop)
+get_prop(hal_omx_server, media_variant_prop)
+
+binder_call(hal_omx_client, hal_omx_server)
+binder_call(hal_omx_server, hal_omx_client)
+
+###
+### neverallow rules
+###
+
+# hal_omx_server should never execute any executable without a
+# domain transition
+neverallow hal_omx_server { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow hal_omx_server domain:{ udp_socket rawip_socket } *;
+neverallow hal_omx_server { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/hal_power.te b/prebuilts/api/202504/private/hal_power.te
new file mode 100644
index 0000000..1eb10a1
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_power.te
@@ -0,0 +1,12 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_power_client, hal_power_server)
+binder_call(hal_power_server, hal_power_client)
+
+hal_attribute_hwservice(hal_power, hal_power_hwservice)
+hal_attribute_service(hal_power, hal_power_service)
+
+binder_call(hal_power_server, servicemanager)
+binder_call(hal_power_client, servicemanager)
+
+# power HAL sets dex2oat performance tuning properties
+set_prop(hal_power_server, dalvik_dynamic_config_prop)
diff --git a/prebuilts/api/202504/private/hal_power_stats.te b/prebuilts/api/202504/private/hal_power_stats.te
new file mode 100644
index 0000000..4076eff
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_power_stats.te
@@ -0,0 +1,9 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_power_stats_client, hal_power_stats_server)
+binder_call(hal_power_stats_server, hal_power_stats_client)
+
+hal_attribute_hwservice(hal_power_stats, hal_power_stats_hwservice)
+hal_attribute_service(hal_power_stats, hal_power_stats_service)
+
+binder_call(hal_power_stats_server, servicemanager)
+binder_call(hal_power_stats_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_rebootescrow.te b/prebuilts/api/202504/private/hal_rebootescrow.te
new file mode 100644
index 0000000..d16333b
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_rebootescrow.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server
+binder_call(hal_rebootescrow_client, hal_rebootescrow_server)
+
+hal_attribute_service(hal_rebootescrow, hal_rebootescrow_service)
+
+binder_use(hal_rebootescrow_server)
diff --git a/prebuilts/api/202504/private/hal_remoteaccess.te b/prebuilts/api/202504/private/hal_remoteaccess.te
new file mode 100644
index 0000000..8a55529
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_remoteaccess.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_remoteaccess_client, hal_remoteaccess_server)
+binder_call(hal_remoteaccess_server, hal_remoteaccess_client)
+
+hal_attribute_service(hal_remoteaccess, hal_remoteaccess_service)
+
diff --git a/prebuilts/api/202504/private/hal_remotelyprovisionedcomponent_avf.te b/prebuilts/api/202504/private/hal_remotelyprovisionedcomponent_avf.te
new file mode 100644
index 0000000..8cc7ce5
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_remotelyprovisionedcomponent_avf.te
@@ -0,0 +1,8 @@
+# allow binder connection from client to server
+binder_call(hal_remotelyprovisionedcomponent_avf_client, hal_remotelyprovisionedcomponent_avf_server)
+
+# allow client to find the service, allow server to register the service
+hal_attribute_service(hal_remotelyprovisionedcomponent_avf, hal_remotelyprovisionedcomponent_avf_service)
+
+# allow binder communication from server to service_manager
+binder_use(hal_remotelyprovisionedcomponent_avf_server)
diff --git a/prebuilts/api/202504/private/hal_secretkeeper.te b/prebuilts/api/202504/private/hal_secretkeeper.te
new file mode 100644
index 0000000..359159f
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_secretkeeper.te
@@ -0,0 +1,12 @@
+# Domains for the Secretkeeper HAL, which provides secure (tamper evident, rollback protected)
+# storage of secrets guarded by DICE policies.
+binder_call(hal_secretkeeper_client, hal_secretkeeper_server)
+
+hal_attribute_service(hal_secretkeeper, hal_secretkeeper_service)
+
+binder_use(hal_secretkeeper_server)
+binder_use(hal_secretkeeper_client)
+
+# The Secretkeeper HAL service needs to communicate with a trusted application running
+# in the TEE, which is represented by the tee_device permission.
+allow hal_secretkeeper_server tee_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/hal_secure_element.te b/prebuilts/api/202504/private/hal_secure_element.te
new file mode 100644
index 0000000..8d3e15c
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_secure_element.te
@@ -0,0 +1,10 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_secure_element_client, hal_secure_element_server)
+binder_call(hal_secure_element_server, hal_secure_element_client)
+
+hal_attribute_hwservice(hal_secure_element, hal_secure_element_hwservice)
+hal_attribute_service(hal_secure_element, hal_secure_element_service)
+
+binder_use(hal_secure_element_server)
+
+allow hal_secure_element_client hal_secure_element_service:service_manager find;
diff --git a/prebuilts/api/202504/private/hal_sensors.te b/prebuilts/api/202504/private/hal_sensors.te
new file mode 100644
index 0000000..f25a2ea
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_sensors.te
@@ -0,0 +1,19 @@
+# HwBinder IPC from client to server
+binder_call(hal_sensors_client, hal_sensors_server)
+
+hal_attribute_hwservice(hal_sensors, hal_sensors_hwservice)
+
+# Allow sensor hals to access ashmem memory allocated by apps
+allow hal_sensors { appdomain -isolated_app }:fd use;
+
+# Allow sensor hals to access ashmem memory allocated by android.hidl.allocator
+# fd is passed in from framework sensorservice HAL.
+allow hal_sensors hal_allocator:fd use;
+
+# allow to run with real-time scheduling policy
+allow hal_sensors self:global_capability_class_set sys_nice;
+
+add_service(hal_sensors_server, hal_sensors_service)
+binder_call(hal_sensors_server, servicemanager)
+
+allow hal_sensors_client hal_sensors_service:service_manager find;
diff --git a/prebuilts/api/202504/private/hal_telephony.te b/prebuilts/api/202504/private/hal_telephony.te
new file mode 100644
index 0000000..306d459
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_telephony.te
@@ -0,0 +1,47 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_telephony_client, hal_telephony_server)
+binder_call(hal_telephony_server, hal_telephony_client)
+
+hal_attribute_hwservice(hal_telephony, hal_telephony_hwservice)
+hal_attribute_service(hal_telephony, hal_radio_service)
+
+allowxperm hal_telephony_server self:udp_socket ioctl priv_sock_ioctls;
+
+allow hal_telephony_server self:netlink_route_socket nlmsg_write;
+allow hal_telephony_server self:global_capability_class_set { setpcap setgid setuid net_admin net_raw };
+allow hal_telephony_server cgroup:dir create_dir_perms;
+allow hal_telephony_server cgroup:{ file lnk_file } r_file_perms;
+allow hal_telephony_server cgroup_v2:dir create_dir_perms;
+allow hal_telephony_server cgroup_v2:{ file lnk_file } r_file_perms;
+allow hal_telephony_server radio_device:chr_file rw_file_perms;
+allow hal_telephony_server radio_device:blk_file r_file_perms;
+allow hal_telephony_server efs_file:dir create_dir_perms;
+allow hal_telephony_server efs_file:file create_file_perms;
+allow hal_telephony_server vendor_shell_exec:file rx_file_perms;
+allow hal_telephony_server bluetooth_efs_file:file r_file_perms;
+allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms;
+
+# property service
+get_prop(hal_telephony_server, telephony_config_prop)
+set_prop(hal_telephony_server, radio_control_prop)
+set_prop(hal_telephony_server, radio_prop)
+set_prop(hal_telephony_server, telephony_status_prop)
+
+allow hal_telephony_server tty_device:chr_file rw_file_perms;
+
+# Allow hal_telephony_server to create and use netlink sockets.
+allow hal_telephony_server self:netlink_socket create_socket_perms_no_ioctl;
+allow hal_telephony_server self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_telephony_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# Access to wake locks
+wakelock_use(hal_telephony_server)
+
+r_dir_file(hal_telephony_server, proc_net_type)
+r_dir_file(hal_telephony_server, sysfs_type)
+
+# granting the ioctl permission for hal_telephony_server should be device specific
+allow hal_telephony_server self:socket create_socket_perms_no_ioctl;
+
+# Allow AIDL HAL shim to call HIDL HAL implementation
+binder_call(hal_telephony_server, hal_telephony_server)
diff --git a/prebuilts/api/202504/private/hal_tetheroffload.te b/prebuilts/api/202504/private/hal_tetheroffload.te
new file mode 100644
index 0000000..c9553dc
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tetheroffload.te
@@ -0,0 +1,11 @@
+## HwBinder IPC from client to server, and callbacks
+binder_call(hal_tetheroffload_client, hal_tetheroffload_server)
+binder_call(hal_tetheroffload_server, hal_tetheroffload_client)
+
+hal_attribute_hwservice(hal_tetheroffload, hal_tetheroffload_hwservice)
+hal_attribute_service(hal_tetheroffload, hal_tetheroffload_service)
+
+binder_use(hal_tetheroffload_server)
+
+# allow the client to pass the server already open netlink sockets
+allow hal_tetheroffload_server hal_tetheroffload_client:netlink_netfilter_socket { getattr read setopt write };
diff --git a/prebuilts/api/202504/private/hal_thermal.te b/prebuilts/api/202504/private/hal_thermal.te
new file mode 100644
index 0000000..13fed00
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_thermal.te
@@ -0,0 +1,10 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_thermal_client, hal_thermal_server)
+binder_call(hal_thermal_server, hal_thermal_client)
+
+hal_attribute_hwservice(hal_thermal, hal_thermal_hwservice)
+hal_attribute_service(hal_thermal, hal_thermal_service)
+
+add_service(hal_thermal_server, hal_thermal_service)
+binder_call(hal_thermal_server, servicemanager)
+binder_call(hal_thermal_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_threadnetwork.te b/prebuilts/api/202504/private/hal_threadnetwork.te
new file mode 100644
index 0000000..1f0745b
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_threadnetwork.te
@@ -0,0 +1,7 @@
+binder_call(hal_threadnetwork_client, hal_threadnetwork_server)
+binder_call(hal_threadnetwork_server, hal_threadnetwork_client)
+
+hal_attribute_service(hal_threadnetwork, hal_threadnetwork_service)
+
+binder_call(hal_threadnetwork_server, servicemanager)
+binder_call(hal_threadnetwork_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_tv_cec.te b/prebuilts/api/202504/private/hal_tv_cec.te
new file mode 100644
index 0000000..6584904
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_cec.te
@@ -0,0 +1,5 @@
+# HwBinder IPC from clients into server, and callbacks
+binder_call(hal_tv_cec_client, hal_tv_cec_server)
+binder_call(hal_tv_cec_server, hal_tv_cec_client)
+
+hal_attribute_hwservice(hal_tv_cec, hal_tv_cec_hwservice)
diff --git a/prebuilts/api/202504/private/hal_tv_hdmi_cec.te b/prebuilts/api/202504/private/hal_tv_hdmi_cec.te
new file mode 100644
index 0000000..eb01b67
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_hdmi_cec.te
@@ -0,0 +1,7 @@
+# Binder IPC from clients into server, and callbacks
+binder_call(hal_tv_hdmi_cec_client, hal_tv_hdmi_cec_server)
+binder_call(hal_tv_hdmi_cec_server, hal_tv_hdmi_cec_client)
+binder_use(hal_tv_hdmi_cec_client)
+binder_use(hal_tv_hdmi_cec_server)
+
+hal_attribute_service(hal_tv_hdmi_cec, hal_tv_hdmi_cec_service)
diff --git a/prebuilts/api/202504/private/hal_tv_hdmi_connection.te b/prebuilts/api/202504/private/hal_tv_hdmi_connection.te
new file mode 100644
index 0000000..f6de27d
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_hdmi_connection.te
@@ -0,0 +1,7 @@
+# Binder IPC from clients into server, and callbacks
+binder_call(hal_tv_hdmi_connection_client, hal_tv_hdmi_connection_server)
+binder_call(hal_tv_hdmi_connection_server, hal_tv_hdmi_connection_client)
+binder_use(hal_tv_hdmi_connection_client)
+binder_use(hal_tv_hdmi_connection_server)
+
+hal_attribute_service(hal_tv_hdmi_connection, hal_tv_hdmi_connection_service)
diff --git a/prebuilts/api/202504/private/hal_tv_hdmi_earc.te b/prebuilts/api/202504/private/hal_tv_hdmi_earc.te
new file mode 100644
index 0000000..2d76fc6
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_hdmi_earc.te
@@ -0,0 +1,7 @@
+# Binder IPC from clients into server, and callbacks
+binder_call(hal_tv_hdmi_earc_client, hal_tv_hdmi_earc_server)
+binder_call(hal_tv_hdmi_earc_server, hal_tv_hdmi_earc_client)
+binder_use(hal_tv_hdmi_earc_client)
+binder_use(hal_tv_hdmi_earc_server)
+
+hal_attribute_service(hal_tv_hdmi_earc, hal_tv_hdmi_earc_service)
diff --git a/prebuilts/api/202504/private/hal_tv_input.te b/prebuilts/api/202504/private/hal_tv_input.te
new file mode 100644
index 0000000..b345189
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_input.te
@@ -0,0 +1,9 @@
+# HwBinder IPC from clients into server, and callbacks
+binder_call(hal_tv_input_client, hal_tv_input_server)
+binder_call(hal_tv_input_server, hal_tv_input_client)
+
+hal_attribute_hwservice(hal_tv_input, hal_tv_input_hwservice)
+hal_attribute_service(hal_tv_input, hal_tv_input_service)
+
+binder_call(hal_tv_input_server, servicemanager)
+binder_call(hal_tv_input_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_tv_tuner.te b/prebuilts/api/202504/private/hal_tv_tuner.te
new file mode 100644
index 0000000..4b7c030
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_tv_tuner.te
@@ -0,0 +1,8 @@
+binder_call(hal_tv_tuner_client, hal_tv_tuner_server)
+binder_call(hal_tv_tuner_server, hal_tv_tuner_client)
+
+hal_attribute_hwservice(hal_tv_tuner, hal_tv_tuner_hwservice)
+hal_attribute_service(hal_tv_tuner, hal_tv_tuner_service)
+
+binder_call(hal_tv_tuner_server, servicemanager)
+binder_call(hal_tv_tuner_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_usb.te b/prebuilts/api/202504/private/hal_usb.te
new file mode 100644
index 0000000..45cafaa
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_usb.te
@@ -0,0 +1,21 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_usb_client, hal_usb_server)
+binder_call(hal_usb_server, hal_usb_client)
+
+hal_attribute_service(hal_usb, hal_usb_service)
+binder_call(hal_usb_server, servicemanager)
+
+hal_attribute_hwservice(hal_usb, hal_usb_hwservice)
+
+allow hal_usb self:netlink_kobject_uevent_socket create;
+allow hal_usb self:netlink_kobject_uevent_socket setopt;
+allow hal_usb self:netlink_kobject_uevent_socket getopt;
+allow hal_usb self:netlink_kobject_uevent_socket bind;
+allow hal_usb self:netlink_kobject_uevent_socket read;
+allow hal_usb sysfs:dir open;
+allow hal_usb sysfs:dir read;
+allow hal_usb sysfs:file read;
+allow hal_usb sysfs:file open;
+allow hal_usb sysfs:file write;
+allow hal_usb sysfs:file getattr;
+
diff --git a/prebuilts/api/202504/private/hal_usb_gadget.te b/prebuilts/api/202504/private/hal_usb_gadget.te
new file mode 100644
index 0000000..c0df9a9
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_usb_gadget.te
@@ -0,0 +1,19 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_usb_gadget_client, hal_usb_gadget_server)
+binder_call(hal_usb_gadget_server, hal_usb_gadget_client)
+
+hal_attribute_service(hal_usb_gadget, hal_usb_gadget_service)
+binder_call(hal_usb_gadget_server, servicemanager)
+
+hal_attribute_hwservice(hal_usb_gadget, hal_usb_gadget_hwservice)
+
+# Configuring usb gadget functions
+allow hal_usb_gadget_server configfs:lnk_file { read create unlink};
+allow hal_usb_gadget_server configfs:dir rw_dir_perms;
+allow hal_usb_gadget_server configfs:file create_file_perms;
+allow hal_usb_gadget_server functionfs:dir { read search };
+allow hal_usb_gadget_server functionfs:file read;
+allow hal_usb_gadget_server proc_interrupts:file r_file_perms;
+
+# Read access to ro.usb.uvc.enabled
+get_prop(hal_usb_gadget_server, usb_uvc_enabled_prop)
diff --git a/prebuilts/api/202504/private/hal_uwb.te b/prebuilts/api/202504/private/hal_uwb.te
new file mode 100644
index 0000000..dc334fc
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_uwb.te
@@ -0,0 +1,8 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_uwb_client, hal_uwb_server)
+binder_call(hal_uwb_server, hal_uwb_client)
+
+hal_attribute_service(hal_uwb, hal_uwb_service)
+
+binder_call(hal_uwb_server, servicemanager)
+binder_call(hal_uwb_client, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_vehicle.te b/prebuilts/api/202504/private/hal_vehicle.te
new file mode 100644
index 0000000..c9eff55
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_vehicle.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_vehicle_client, hal_vehicle_server)
+binder_call(hal_vehicle_server, hal_vehicle_client)
+
+
+hal_attribute_hwservice(hal_vehicle, hal_vehicle_hwservice)
+hal_attribute_service(hal_vehicle, hal_vehicle_service)
diff --git a/prebuilts/api/202504/private/hal_vibrator.te b/prebuilts/api/202504/private/hal_vibrator.te
new file mode 100644
index 0000000..6909ff2
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_vibrator.te
@@ -0,0 +1,17 @@
+# HwBinder IPC client/server
+binder_call(hal_vibrator_client, hal_vibrator_server)
+binder_call(hal_vibrator_server, hal_vibrator_client);
+
+hal_attribute_hwservice(hal_vibrator, hal_vibrator_hwservice)
+hal_attribute_service(hal_vibrator, hal_vibrator_service)
+
+binder_call(hal_vibrator_server, servicemanager)
+
+allow hal_vibrator_server dumpstate:fifo_file write;
+
+# vibrator sysfs rw access
+allow hal_vibrator sysfs_vibrator:file rw_file_perms;
+allow hal_vibrator sysfs_vibrator:dir search;
+
+# Allow HAL vibrator to control some parameters of a vibration, such as scaling.
+allow hal_vibrator fwk_vibrator_control_service:service_manager find;
diff --git a/prebuilts/api/202504/private/hal_vm_capabilities.te b/prebuilts/api/202504/private/hal_vm_capabilities.te
new file mode 100644
index 0000000..3197784
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_vm_capabilities.te
@@ -0,0 +1,9 @@
+# Domain for the VM capability HAL, which is used to allow some pVMs to issue
+# vendor-specific SMCs.
+
+binder_call(hal_vm_capabilities_client, hal_vm_capabilities_server)
+
+hal_attribute_service(hal_vm_capabilities, hal_vm_capabilities_service)
+
+binder_use(hal_vm_capabilities_client)
+binder_use(hal_vm_capabilities_server)
diff --git a/prebuilts/api/202504/private/hal_vr.te b/prebuilts/api/202504/private/hal_vr.te
new file mode 100644
index 0000000..e52c77f
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_vr.te
@@ -0,0 +1,5 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_vr_client, hal_vr_server)
+binder_call(hal_vr_server, hal_vr_client)
+
+hal_attribute_hwservice(hal_vr, hal_vr_hwservice)
diff --git a/prebuilts/api/202504/private/hal_weaver.te b/prebuilts/api/202504/private/hal_weaver.te
new file mode 100644
index 0000000..2b34989
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_weaver.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_weaver_client, hal_weaver_server)
+
+hal_attribute_hwservice(hal_weaver, hal_weaver_hwservice)
+hal_attribute_service(hal_weaver, hal_weaver_service)
+
+binder_call(hal_weaver_server, servicemanager)
diff --git a/prebuilts/api/202504/private/hal_wifi.te b/prebuilts/api/202504/private/hal_wifi.te
new file mode 100644
index 0000000..a0826bb
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_wifi.te
@@ -0,0 +1,35 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_wifi_client, hal_wifi_server)
+binder_call(hal_wifi_server, hal_wifi_client)
+
+hal_attribute_hwservice(hal_wifi, hal_wifi_hwservice)
+hal_attribute_service(hal_wifi, hal_wifi_service)
+
+binder_use(hal_wifi_server)
+
+r_dir_file(hal_wifi, proc_net_type)
+r_dir_file(hal_wifi, sysfs_type)
+
+set_prop(hal_wifi_server, wifi_hal_prop)
+set_prop(hal_wifi, wifi_prop)
+userdebug_or_eng(`get_prop(hal_wifi, persist_vendor_debug_wifi_prop)')
+
+# allow hal wifi set interfaces up and down and get the factory MAC
+allow hal_wifi self:udp_socket create_socket_perms;
+allowxperm hal_wifi self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFHWADDR SIOCETHTOOL };
+
+allow hal_wifi self:global_capability_class_set { net_admin net_raw };
+# allow hal_wifi to speak to nl80211 in the kernel
+allow hal_wifi self:netlink_socket create_socket_perms_no_ioctl;
+# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
+allow hal_wifi self:netlink_generic_socket create_socket_perms_no_ioctl;
+# hal_wifi writes firmware paths to this file.
+allow hal_wifi sysfs_wlan_fwpath:file { w_file_perms };
+# allow hal_wifi to access /proc/modules to check if Wi-Fi driver is loaded
+allow hal_wifi proc_modules:file { getattr open read };
+# Allow hal_wifi to send dump info to dumpstate
+allow hal_wifi dumpstate:fifo_file write;
+
+# allow hal_wifi to write into /data/vendor/tombstones/wifi
+allow hal_wifi_server tombstone_wifi_data_file:dir rw_dir_perms;
+allow hal_wifi_server tombstone_wifi_data_file:file create_file_perms;
diff --git a/prebuilts/api/202504/private/hal_wifi_hostapd.te b/prebuilts/api/202504/private/hal_wifi_hostapd.te
new file mode 100644
index 0000000..eeb72ba
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_wifi_hostapd.te
@@ -0,0 +1,32 @@
+# HwBinder IPC from client to server
+binder_call(hal_wifi_hostapd_client, hal_wifi_hostapd_server)
+binder_call(hal_wifi_hostapd_server, hal_wifi_hostapd_client)
+
+hal_attribute_hwservice(hal_wifi_hostapd, hal_wifi_hostapd_hwservice)
+hal_attribute_service(hal_wifi_hostapd, hal_wifi_hostapd_service)
+
+binder_use(hal_wifi_hostapd_server)
+
+allow hal_wifi_hostapd_server dumpstate:fifo_file write;
+
+allow hal_wifi_hostapd_server self:global_capability_class_set { net_admin net_raw };
+
+allow hal_wifi_hostapd_server sysfs_net:dir search;
+
+# Allow hal_wifi_hostapd to access /proc/net/psched
+allow hal_wifi_hostapd_server proc_net_type:file { getattr open read };
+
+# Various socket permissions.
+allowxperm hal_wifi_hostapd_server self:udp_socket ioctl priv_sock_ioctls;
+allow hal_wifi_hostapd_server self:netlink_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:packet_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:netlink_route_socket nlmsg_write;
+
+###
+### neverallow rules
+###
+
+# hal_wifi_hostapd should not trust any data from sdcards
+neverallow hal_wifi_hostapd_server { sdcard_type fuse }:dir ~getattr;
+neverallow hal_wifi_hostapd_server { sdcard_type fuse }:file *;
diff --git a/prebuilts/api/202504/private/hal_wifi_supplicant.te b/prebuilts/api/202504/private/hal_wifi_supplicant.te
new file mode 100644
index 0000000..498469d
--- /dev/null
+++ b/prebuilts/api/202504/private/hal_wifi_supplicant.te
@@ -0,0 +1,38 @@
+# HwBinder IPC from client to server
+binder_call(hal_wifi_supplicant_client, hal_wifi_supplicant_server)
+binder_call(hal_wifi_supplicant_server, hal_wifi_supplicant_client)
+
+hal_attribute_hwservice(hal_wifi_supplicant, hal_wifi_supplicant_hwservice)
+hal_attribute_service(hal_wifi_supplicant, hal_wifi_supplicant_service)
+
+# in addition to ioctls allowlisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
+allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls;
+
+r_dir_file(hal_wifi_supplicant, sysfs_type)
+r_dir_file(hal_wifi_supplicant, proc_net_type)
+
+allow hal_wifi_supplicant self:global_capability_class_set { setuid net_admin setgid net_raw };
+allow hal_wifi_supplicant cgroup:dir create_dir_perms;
+allow hal_wifi_supplicant cgroup_v2:dir create_dir_perms;
+allow hal_wifi_supplicant self:netlink_route_socket nlmsg_write;
+allow hal_wifi_supplicant self:netlink_socket create_socket_perms_no_ioctl;
+allow hal_wifi_supplicant self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_wifi_supplicant self:packet_socket create_socket_perms;
+allowxperm hal_wifi_supplicant self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
+
+use_keystore(hal_wifi_supplicant)
+binder_use(hal_wifi_supplicant_server)
+
+# Allow the WI-FI HAL to use keys in the keystore namespace wifi_key.
+allow hal_wifi_supplicant wifi_key:keystore2_key {
+ get_info
+ use
+};
+
+###
+### neverallow rules
+###
+
+# wpa_supplicant should not trust any data from sdcards
+neverallow hal_wifi_supplicant_server { sdcard_type fuse }:dir ~getattr;
+neverallow hal_wifi_supplicant_server { sdcard_type fuse }:file *;
diff --git a/prebuilts/api/202504/private/halclientdomain.te b/prebuilts/api/202504/private/halclientdomain.te
new file mode 100644
index 0000000..9dcd3ee
--- /dev/null
+++ b/prebuilts/api/202504/private/halclientdomain.te
@@ -0,0 +1,13 @@
+###
+### Rules for all domains which are clients of a HAL
+###
+
+# Find out whether a HAL in passthrough/in-process mode or
+# binderized/out-of-process mode
+hwbinder_use(halclientdomain)
+
+# Used to wait for hwservicemanager
+get_prop(halclientdomain, hwservicemanager_prop)
+
+# Wait for HAL server to be up (used by getService)
+allow halclientdomain hidl_manager_hwservice:hwservice_manager find;
diff --git a/prebuilts/api/202504/private/halserverdomain.te b/prebuilts/api/202504/private/halserverdomain.te
new file mode 100644
index 0000000..f36e0e7
--- /dev/null
+++ b/prebuilts/api/202504/private/halserverdomain.te
@@ -0,0 +1,12 @@
+###
+### Rules for all domains which offer a HAL service over HwBinder
+###
+
+# Register the HAL service with hwservicemanager
+hwbinder_use(halserverdomain)
+
+# Find HAL implementations
+allow halserverdomain system_file:dir r_dir_perms;
+
+# Used to wait for hwservicemanager
+get_prop(halserverdomain, hwservicemanager_prop)
diff --git a/prebuilts/api/202504/private/healthd.te b/prebuilts/api/202504/private/healthd.te
new file mode 100644
index 0000000..cf422ed
--- /dev/null
+++ b/prebuilts/api/202504/private/healthd.te
@@ -0,0 +1 @@
+typeattribute healthd coredomain;
diff --git a/prebuilts/api/202504/private/heapprofd.te b/prebuilts/api/202504/private/heapprofd.te
new file mode 100644
index 0000000..39d0bbb
--- /dev/null
+++ b/prebuilts/api/202504/private/heapprofd.te
@@ -0,0 +1,75 @@
+# Android heap profiling daemon. go/heapprofd.
+type heapprofd_exec, exec_type, file_type, system_file_type;
+type heapprofd_tmpfs, file_type;
+
+init_daemon_domain(heapprofd)
+tmpfs_domain(heapprofd)
+
+# Allow apps in other MLS contexts (for multi-user) to access
+# shared memory buffers created by heapprofd.
+typeattribute heapprofd_tmpfs mlstrustedobject;
+
+set_prop(heapprofd, heapprofd_prop);
+
+# Necessary for /proc/[pid]/cmdline access & sending signals.
+typeattribute heapprofd mlstrustedsubject;
+
+# Allow sending signals to processes. This excludes SIGKILL, SIGSTOP and
+# SIGCHLD, which are controlled by separate permissions.
+allow heapprofd self:capability kill;
+
+# When scanning /proc/[pid]/cmdline to find matching processes for by-name
+# profiling, only allowlisted domains will be allowed by SELinux. Avoid
+# spamming logs with denials for entries that we can not access.
+dontaudit heapprofd domain:dir { search open };
+
+# Write trace data to the Perfetto traced daemon. This requires connecting to
+# its producer socket and obtaining a (per-process) tmpfs fd.
+perfetto_producer(heapprofd)
+
+# When handling profiling for all processes, heapprofd needs to read
+# executables/libraries/etc to do stack unwinding.
+r_dir_file(heapprofd, nativetest_data_file)
+r_dir_file(heapprofd, system_file_type)
+r_dir_file(heapprofd, apk_data_file)
+r_dir_file(heapprofd, dalvikcache_data_file)
+r_dir_file(heapprofd, vendor_file_type)
+r_dir_file(heapprofd, shell_test_data_file)
+# ART apex files and directory access to the containing /data/misc/apexdata.
+r_dir_file(heapprofd, apex_art_data_file)
+allow heapprofd apex_module_data_file:dir { getattr search };
+
+# Some dex files are not world-readable.
+# We are still constrained by the SELinux rules above.
+allow heapprofd self:global_capability_class_set dac_read_search;
+
+# For checking profileability.
+allow heapprofd packages_list_file:file r_file_perms;
+
+# Never allow profiling privileged or otherwise incompatible domains.
+# Corresponding allow-rule is in private/domain.te.
+never_profile_heap(`{
+ apexd
+ app_zygote
+ bpfloader
+ hal_configstore_server
+ init
+ kernel
+ keystore
+ llkd
+ logd
+ logpersist
+ recovery
+ recovery_persist
+ recovery_refresh
+ ueventd
+ vendor_init
+ vold
+ webview_zygote
+ zygote
+}')
+
+full_treble_only(`
+ neverallow heapprofd vendor_file_type:file no_w_file_perms;
+ neverallow heapprofd { vendor_file_type -vndk_sp_file }:file no_x_file_perms;
+')
diff --git a/prebuilts/api/202504/private/hidl_lazy_test_server.te b/prebuilts/api/202504/private/hidl_lazy_test_server.te
new file mode 100644
index 0000000..04e8c9f
--- /dev/null
+++ b/prebuilts/api/202504/private/hidl_lazy_test_server.te
@@ -0,0 +1,8 @@
+type hidl_lazy_test_server, domain;
+type hidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+userdebug_or_eng(`
+ typeattribute hidl_lazy_test_server coredomain;
+ init_daemon_domain(hidl_lazy_test_server)
+ hal_server_domain(hidl_lazy_test_server, hal_lazy_test)
+')
diff --git a/prebuilts/api/202504/private/hwservice.te b/prebuilts/api/202504/private/hwservice.te
new file mode 100644
index 0000000..1a56eb7
--- /dev/null
+++ b/prebuilts/api/202504/private/hwservice.te
@@ -0,0 +1,10 @@
+type hal_lazy_test_hwservice, hwservice_manager_type, protected_hwservice;
+
+###
+### Neverallow rules
+###
+
+# hwservicemanager handles registering or looking up named services.
+# It does not make sense to register or lookup something which is not a
+# hwservice. Trigger a compile error if this occurs.
+neverallow domain ~hwservice_manager_type:hwservice_manager { add find };
diff --git a/prebuilts/api/202504/private/hwservice_contexts b/prebuilts/api/202504/private/hwservice_contexts
new file mode 100644
index 0000000..4a44dc5
--- /dev/null
+++ b/prebuilts/api/202504/private/hwservice_contexts
@@ -0,0 +1,86 @@
+android.frameworks.automotive.display::IAutomotiveDisplayProxyService u:object_r:fwk_automotive_display_hwservice:s0
+android.frameworks.bufferhub::IBufferHub u:object_r:fwk_bufferhub_hwservice:s0
+android.frameworks.cameraservice.service::ICameraService u:object_r:fwk_camera_hwservice:s0
+android.frameworks.displayservice::IDisplayService u:object_r:fwk_display_hwservice:s0
+android.frameworks.schedulerservice::ISchedulingPolicyService u:object_r:fwk_scheduler_hwservice:s0
+android.frameworks.sensorservice::ISensorManager u:object_r:fwk_sensor_hwservice:s0
+android.frameworks.stats::IStats u:object_r:fwk_stats_hwservice:s0
+android.hardware.atrace::IAtraceDevice u:object_r:hal_atrace_hwservice:s0
+android.hardware.audio.effect::IEffectsFactory u:object_r:hal_audio_hwservice:s0
+android.hardware.audio::IDevicesFactory u:object_r:hal_audio_hwservice:s0
+android.hardware.authsecret::IAuthSecret u:object_r:hal_authsecret_hwservice:s0
+android.hardware.automotive.audiocontrol::IAudioControl u:object_r:hal_audiocontrol_hwservice:s0
+android.hardware.automotive.can::ICanController u:object_r:hal_can_controller_hwservice:s0
+android.hardware.automotive.can::ICanBus u:object_r:hal_can_bus_hwservice:s0
+android.hardware.automotive.evs::IEvsEnumerator u:object_r:hal_evs_hwservice:s0
+android.hardware.automotive.vehicle::IVehicle u:object_r:hal_vehicle_hwservice:s0
+android.hardware.biometrics.face::IBiometricsFace u:object_r:hal_face_hwservice:s0
+android.hardware.biometrics.fingerprint::IBiometricsFingerprint u:object_r:hal_fingerprint_hwservice:s0
+android.hardware.bluetooth::IBluetoothHci u:object_r:hal_bluetooth_hwservice:s0
+android.hardware.bluetooth.a2dp::IBluetoothAudioOffload u:object_r:hal_audio_hwservice:s0
+android.hardware.bluetooth.audio::IBluetoothAudioProvidersFactory u:object_r:hal_audio_hwservice:s0
+android.hardware.boot::IBootControl u:object_r:hal_bootctl_hwservice:s0
+android.hardware.broadcastradio::IBroadcastRadio u:object_r:hal_broadcastradio_hwservice:s0
+android.hardware.broadcastradio::IBroadcastRadioFactory u:object_r:hal_broadcastradio_hwservice:s0
+android.hardware.camera.provider::ICameraProvider u:object_r:hal_camera_hwservice:s0
+android.hardware.configstore::ISurfaceFlingerConfigs u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0
+android.hardware.confirmationui::IConfirmationUI u:object_r:hal_confirmationui_hwservice:s0
+android.hardware.contexthub::IContexthub u:object_r:hal_contexthub_hwservice:s0
+android.hardware.cas::IMediaCasService u:object_r:hal_cas_hwservice:s0
+android.hardware.drm::ICryptoFactory u:object_r:hal_drm_hwservice:s0
+android.hardware.drm::IDrmFactory u:object_r:hal_drm_hwservice:s0
+android.hardware.dumpstate::IDumpstateDevice u:object_r:hal_dumpstate_hwservice:s0
+android.hardware.gatekeeper::IGatekeeper u:object_r:hal_gatekeeper_hwservice:s0
+android.hardware.gnss::IGnss u:object_r:hal_gnss_hwservice:s0
+android.hardware.graphics.allocator::IAllocator u:object_r:hal_graphics_allocator_hwservice:s0
+android.hardware.graphics.composer::IComposer u:object_r:hal_graphics_composer_hwservice:s0
+android.hardware.graphics.mapper::IMapper u:object_r:hal_graphics_mapper_hwservice:s0
+android.hardware.health::IHealth u:object_r:hal_health_hwservice:s0
+android.hardware.health.storage::IStorage u:object_r:hal_health_storage_hwservice:s0
+android.hardware.input.classifier::IInputClassifier u:object_r:hal_input_classifier_hwservice:s0
+android.hardware.ir::IConsumerIr u:object_r:hal_ir_hwservice:s0
+android.hardware.keymaster::IKeymasterDevice u:object_r:hal_keymaster_hwservice:s0
+android.hardware.tests.lazy::ILazy u:object_r:hal_lazy_test_hwservice:s0
+android.hardware.tests.lazy_cb::ILazyCb u:object_r:hal_lazy_test_hwservice:s0
+android.hardware.light::ILight u:object_r:hal_light_hwservice:s0
+android.hardware.lowpan::ILowpanDevice u:object_r:hal_lowpan_hwservice:s0
+android.hardware.media.omx::IOmx u:object_r:hal_omx_hwservice:s0
+android.hardware.media.omx::IOmxStore u:object_r:hal_omx_hwservice:s0
+android.hardware.media.c2::IComponentStore u:object_r:hal_codec2_hwservice:s0
+android.hardware.memtrack::IMemtrack u:object_r:hal_memtrack_hwservice:s0
+android.hardware.neuralnetworks::IDevice u:object_r:hal_neuralnetworks_hwservice:s0
+android.hardware.nfc::INfc u:object_r:hal_nfc_hwservice:s0
+android.hardware.oemlock::IOemLock u:object_r:hal_oemlock_hwservice:s0
+android.hardware.power::IPower u:object_r:hal_power_hwservice:s0
+android.hardware.power.stats::IPowerStats u:object_r:hal_power_stats_hwservice:s0
+android.hardware.radio.config::IRadioConfig u:object_r:hal_telephony_hwservice:s0
+android.hardware.radio.deprecated::IOemHook u:object_r:hal_telephony_hwservice:s0
+android.hardware.radio::IRadio u:object_r:hal_telephony_hwservice:s0
+android.hardware.radio::ISap u:object_r:hal_telephony_hwservice:s0
+android.hardware.renderscript::IDevice u:object_r:hal_renderscript_hwservice:s0
+android.hardware.secure_element::ISecureElement u:object_r:hal_secure_element_hwservice:s0
+android.hardware.sensors::ISensors u:object_r:hal_sensors_hwservice:s0
+android.hardware.soundtrigger::ISoundTriggerHw u:object_r:hal_audio_hwservice:s0
+android.hardware.tetheroffload.config::IOffloadConfig u:object_r:hal_tetheroffload_hwservice:s0
+android.hardware.tetheroffload.control::IOffloadControl u:object_r:hal_tetheroffload_hwservice:s0
+android.hardware.thermal::IThermal u:object_r:hal_thermal_hwservice:s0
+android.hardware.tv.cec::IHdmiCec u:object_r:hal_tv_cec_hwservice:s0
+android.hardware.tv.input::ITvInput u:object_r:hal_tv_input_hwservice:s0
+android.hardware.tv.tuner::ITuner u:object_r:hal_tv_tuner_hwservice:s0
+android.hardware.usb::IUsb u:object_r:hal_usb_hwservice:s0
+android.hardware.usb.gadget::IUsbGadget u:object_r:hal_usb_gadget_hwservice:s0
+android.hardware.vibrator::IVibrator u:object_r:hal_vibrator_hwservice:s0
+android.hardware.vr::IVr u:object_r:hal_vr_hwservice:s0
+android.hardware.weaver::IWeaver u:object_r:hal_weaver_hwservice:s0
+android.hardware.wifi::IWifi u:object_r:hal_wifi_hwservice:s0
+android.hardware.wifi.hostapd::IHostapd u:object_r:hal_wifi_hostapd_hwservice:s0
+android.hardware.wifi.supplicant::ISupplicant u:object_r:hal_wifi_supplicant_hwservice:s0
+android.hidl.allocator::IAllocator u:object_r:hidl_allocator_hwservice:s0
+android.hidl.base::IBase u:object_r:hidl_base_hwservice:s0
+android.hidl.manager::IServiceManager u:object_r:hidl_manager_hwservice:s0
+android.hidl.memory::IMapper u:object_r:hidl_memory_hwservice:s0
+android.hidl.token::ITokenManager u:object_r:hidl_token_hwservice:s0
+android.system.net.netd::INetd u:object_r:system_net_netd_hwservice:s0
+android.system.suspend::ISystemSuspend u:object_r:system_suspend_hwservice:s0
+android.system.wifi.keystore::IKeystore u:object_r:system_wifi_keystore_hwservice:s0
+* u:object_r:default_android_hwservice:s0
diff --git a/prebuilts/api/202504/private/hwservicemanager.te b/prebuilts/api/202504/private/hwservicemanager.te
new file mode 100644
index 0000000..5605c4d
--- /dev/null
+++ b/prebuilts/api/202504/private/hwservicemanager.te
@@ -0,0 +1,32 @@
+typeattribute hwservicemanager coredomain;
+
+init_daemon_domain(hwservicemanager)
+
+add_hwservice(hwservicemanager, hidl_manager_hwservice)
+add_hwservice(hwservicemanager, hidl_token_hwservice)
+
+set_prop(hwservicemanager, ctl_interface_start_prop)
+set_prop(hwservicemanager, hwservicemanager_prop)
+
+# hwservicemanager is using bootstrap bionic
+use_bootstrap_libs(hwservicemanager)
+
+# hwservicemanager is using apex_info via libvintf
+use_apex_info(hwservicemanager)
+
+# Note that we do not use the binder_* macros here.
+# hwservicemanager provides name service (aka context manager)
+# for hwbinder.
+# Additionally, it initiates binder IPC calls to
+# clients who request service notifications. The permission
+# to do this is granted in the hwbinder_use macro.
+allow hwservicemanager self:binder set_context_mgr;
+
+# Scan through /system/lib64/hw looking for installed HALs
+allow hwservicemanager system_file:dir r_dir_perms;
+
+# Read hwservice_contexts
+allow hwservicemanager hwservice_contexts_file:file r_file_perms;
+
+# Check SELinux permissions.
+selinux_check_access(hwservicemanager)
diff --git a/prebuilts/api/202504/private/idmap.te b/prebuilts/api/202504/private/idmap.te
new file mode 100644
index 0000000..2c32b91
--- /dev/null
+++ b/prebuilts/api/202504/private/idmap.te
@@ -0,0 +1,26 @@
+typeattribute idmap coredomain;
+
+init_daemon_domain(idmap)
+
+# Allow read + write access to /data/resource-cache
+allow idmap resourcecache_data_file:file create_file_perms;
+allow idmap resourcecache_data_file:dir rw_dir_perms;
+
+# Open and read from target and overlay apk files passed by argument.
+allow idmap apk_data_file:file r_file_perms;
+allow idmap apk_data_file:dir search;
+
+# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
+allow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
+allow idmap { apk_tmp_file apk_private_tmp_file }:dir search;
+
+# Allow apps access to /vendor/app
+r_dir_file(idmap, vendor_app_file)
+
+# Allow apps access to /vendor/overlay
+r_dir_file(idmap, vendor_overlay_file)
+
+# Allow the idmap2d binary to register as a service and communicate via AIDL
+binder_use(idmap)
+binder_service(idmap)
+add_service(idmap, idmap_service)
diff --git a/prebuilts/api/202504/private/incident.te b/prebuilts/api/202504/private/incident.te
new file mode 100644
index 0000000..db9ae86
--- /dev/null
+++ b/prebuilts/api/202504/private/incident.te
@@ -0,0 +1,37 @@
+typeattribute incident coredomain;
+
+type incident_exec, system_file_type, exec_type, file_type;
+
+# switch to incident domain for incident command
+domain_auto_trans(shell, incident_exec, incident)
+domain_auto_trans(dumpstate, incident_exec, incident)
+
+# allow incident access to stdout from its parent shell.
+allow incident shell:fd use;
+
+# allow incident to communicate with dumpstate, and write incident report to
+# /data/data/com.android.shell/files/bugreports/tmp_incident_report
+allow incident dumpstate:fd use;
+allow incident dumpstate:unix_stream_socket { read write };
+allow incident shell_data_file:file write;
+
+# allow incident be able to output data for CTS to fetch.
+allow incident devpts:chr_file { read write };
+
+# allow incident to communicate use, read and write over the adb
+# connection.
+allow incident adbd:fd use;
+allow incident adbd:unix_stream_socket { read write };
+
+# allow adbd to reap incident
+allow incident adbd:process { sigchld };
+
+# Allow the incident command to talk to the incidentd over the binder, and get
+# back the incident report data from a ParcelFileDescriptor.
+binder_use(incident)
+allow incident incident_service:service_manager find;
+binder_call(incident, incidentd)
+allow incident incidentd:fifo_file write;
+
+# only allow incident being called by shell or dumpstate
+neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };
diff --git a/prebuilts/api/202504/private/incident_helper.te b/prebuilts/api/202504/private/incident_helper.te
new file mode 100644
index 0000000..b453855
--- /dev/null
+++ b/prebuilts/api/202504/private/incident_helper.te
@@ -0,0 +1,14 @@
+typeattribute incident_helper coredomain;
+
+type incident_helper_exec, system_file_type, exec_type, file_type;
+
+# switch to incident_helper domain for incident_helper command
+domain_auto_trans(incidentd, incident_helper_exec, incident_helper)
+
+# use pipe to transmit data from/to incidentd/incident_helper for parsing
+allow incident_helper { shell incident incidentd dumpstate }:fd use;
+allow incident_helper { shell incident incidentd dumpstate }:fifo_file { getattr read write };
+allow incident_helper incidentd:unix_stream_socket { read write };
+
+# only allow incidentd and shell to call incident_helper
+neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };
diff --git a/prebuilts/api/202504/private/incidentd.te b/prebuilts/api/202504/private/incidentd.te
new file mode 100644
index 0000000..bf98d31
--- /dev/null
+++ b/prebuilts/api/202504/private/incidentd.te
@@ -0,0 +1,217 @@
+typeattribute incidentd coredomain;
+typeattribute incidentd mlstrustedsubject;
+
+init_daemon_domain(incidentd)
+type incidentd_exec, system_file_type, exec_type, file_type;
+binder_use(incidentd)
+wakelock_use(incidentd)
+
+# Allow incidentd to scan through /proc/pid for all processes
+r_dir_file(incidentd, domain)
+
+# Allow incidentd to kill incident_helper when timeout
+allow incidentd incident_helper:process sigkill;
+
+# Allow executing files on system, such as:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow incidentd system_file:file execute_no_trans;
+allow incidentd toolbox_exec:file rx_file_perms;
+
+# section id 1002, allow reading kernel version /proc/version
+allow incidentd proc_version:file r_file_perms;
+
+# section id 1116, allow accessing statsd socket
+unix_socket_send(incidentd, statsdw, statsd)
+
+# section id 2001, allow reading /proc/pagetypeinfo
+allow incidentd proc_pagetypeinfo:file r_file_perms;
+
+# section id 2002, allow reading /d/wakeup_sources
+userdebug_or_eng(`allow incidentd debugfs_wakeup_sources:file r_file_perms');
+
+# section id 2003, allow executing top
+allow incidentd proc_meminfo:file { open read };
+
+# section id 2004, allow reading /sys/devices/system/cpu/cpufreq/all_time_in_state
+allow incidentd sysfs_devices_system_cpu:file r_file_perms;
+
+# section id 2005, allow reading ps dump in full
+allow incidentd domain:process getattr;
+
+# section id 2006, allow reading /sys/class/power_supply/bms/battery_type
+allow incidentd sysfs_batteryinfo:dir { search };
+allow incidentd sysfs_batteryinfo:file r_file_perms;
+
+# section id 2007, allow reading LAST_KMSG /sys/fs/pstore/console-ramoops
+userdebug_or_eng(`allow incidentd pstorefs:dir search');
+userdebug_or_eng(`allow incidentd pstorefs:file r_file_perms');
+
+# section id 3023, allow obtaining stats report
+allow incidentd stats_service:service_manager find;
+binder_call(incidentd, statsd)
+
+# section id 3026, allow reading /data/misc/perfetto-traces.
+allow incidentd perfetto_traces_data_file:dir r_dir_perms;
+allow incidentd perfetto_traces_data_file:file r_file_perms;
+
+# section id 3052, allow accessing nfc_service
+allow incidentd nfc_service:service_manager find;
+
+# Create and write into /data/misc/incidents
+allow incidentd incident_data_file:dir rw_dir_perms;
+allow incidentd incident_data_file:file create_file_perms;
+
+# Enable incidentd to get stack traces.
+binder_use(incidentd)
+hwbinder_use(incidentd)
+allow incidentd hwservicemanager:hwservice_manager { list };
+get_prop(incidentd, hwservicemanager_prop)
+allow incidentd hidl_manager_hwservice:hwservice_manager { find };
+
+# Read files in /proc
+allow incidentd {
+ proc_cmdline
+ proc_pid_max
+ proc_pipe_conf
+ proc_stat
+}:file r_file_perms;
+
+# Signal java processes to dump their stack and get the results
+allow incidentd { appdomain ephemeral_app system_server }:process signal;
+
+# Signal native processes to dump their stack.
+# This list comes from native_processes_to_dump in incidentd/utils.c
+allow incidentd {
+ # This list comes from native_processes_to_dump in dumputils/dump_utils.cpp
+ audioserver
+ cameraserver
+ drmserver
+ inputflinger
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ sdcardd
+ statsd
+ surfaceflinger
+
+ # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.cpp
+ hal_audio_server
+ hal_bluetooth_server
+ hal_camera_server
+ hal_codec2_server
+ hal_face_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_omx_server
+ hal_sensors_server
+ hal_vr_server
+}:process signal;
+
+# Allow incidentd to make binder calls to any binder service
+binder_call(incidentd, system_server)
+binder_call(incidentd, appdomain)
+
+# Reading /proc/PID/maps of other processes
+userdebug_or_eng(`allow incidentd self:global_capability_class_set { sys_ptrace }');
+# incidentd has capability sys_ptrace, but should only use that capability for
+# accessing sensitive /proc/PID files, never for using ptrace attach.
+neverallow incidentd *:process ptrace;
+
+allow incidentd self:global_capability_class_set {
+ # Send signals to processes
+ kill
+};
+
+# Connect to tombstoned to intercept dumps.
+unix_socket_connect(incidentd, tombstoned_intercept, tombstoned)
+
+# Run a shell.
+allow incidentd shell_exec:file rx_file_perms;
+
+# For running am, incident-helper-cmd and similar framework commands.
+# Run /system/bin/app_process.
+allow incidentd zygote_exec:file { rx_file_perms };
+# Access the runtime feature flag properties.
+get_prop(incidentd, device_config_runtime_native_prop)
+get_prop(incidentd, device_config_runtime_native_boot_prop)
+# Access odsign verification status.
+get_prop(incidentd, odsign_prop)
+# ART locks profile files.
+allow incidentd system_file:file lock;
+# Incidentd should never exec from the memory (e.g. JIT cache). These denials are expected.
+dontaudit incidentd dalvikcache_data_file:dir r_dir_perms;
+dontaudit incidentd apex_module_data_file:dir r_dir_perms;
+dontaudit incidentd apex_art_data_file:dir r_dir_perms;
+dontaudit incidentd tmpfs:file rwx_file_perms;
+
+# Allow incidentd to read /apex/apex-info-list.xml
+allow incidentd apex_info_file:file r_file_perms;
+
+# logd access - work to be done is a PII safe log (possibly an event log?)
+userdebug_or_eng(`read_logd(incidentd)')
+# TODO control_logd(incidentd)
+
+# Access /data/misc/logd
+r_dir_file(incidentd, misc_logd_file)
+
+# Allow incidentd to find these standard groups of services.
+# Others can be allowlisted individually.
+allow incidentd {
+ system_server_service
+ app_api_service
+ system_api_service
+ -tracingproxy_service
+}:service_manager find;
+
+# Only incidentd can publish the binder service
+add_service(incidentd, incident_service)
+
+# Allow pipes only from dumpstate and incident
+allow incidentd { dumpstate incident }:fd use;
+allow incidentd { dumpstate incident }:fifo_file write;
+
+# Allow incident to call back to incident with status updates.
+binder_call(incidentd, incident)
+
+# Read device serial number from system properties
+# This is used to track reports from lab testing devices
+userdebug_or_eng(`
+ get_prop(incidentd, serialno_prop)
+')
+
+# Read ro.boot.bootreason, persist.sys.boot.bootreason
+# This is used to track reports from lab testing devices
+userdebug_or_eng(`
+ get_prop(incidentd, bootloader_boot_reason_prop);
+ get_prop(incidentd, system_boot_reason_prop);
+ get_prop(incidentd, last_boot_reason_prop);
+')
+
+# Allow incident to read the build properties for attestation feature
+get_prop(incidentd, build_attestation_prop);
+
+###
+### neverallow rules
+###
+# only incidentd and the other root services in limited circumstances
+# can get to the files in /data/misc/incidents
+#
+# write, execute, append are forbidden almost everywhere
+neverallow { domain -incidentd -init -vold } incident_data_file:file {
+ w_file_perms
+ x_file_perms
+ create
+ rename
+ setattr
+ unlink
+ append
+};
+# read is also allowed by system_server, for when the file is handed to dropbox
+neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
+# limited access to the directory itself
+neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
+
diff --git a/prebuilts/api/202504/private/init.te b/prebuilts/api/202504/private/init.te
new file mode 100644
index 0000000..35d7647
--- /dev/null
+++ b/prebuilts/api/202504/private/init.te
@@ -0,0 +1,878 @@
+typeattribute init coredomain;
+
+tmpfs_domain(init)
+
+# Transitions to seclabel processes in init.rc
+domain_trans(init, rootfs, slideshow)
+domain_auto_trans(init, charger_exec, charger)
+domain_auto_trans(init, e2fs_exec, e2fs)
+domain_auto_trans(init, bpfloader_exec, bpfloader)
+
+recovery_only(`
+ # Files in recovery image are labeled as rootfs.
+ domain_trans(init, rootfs, adbd)
+ domain_trans(init, rootfs, hal_bootctl_server)
+ domain_trans(init, rootfs, charger)
+ domain_trans(init, rootfs, fastbootd)
+ domain_trans(init, rootfs, hal_fastboot_server)
+ domain_trans(init, rootfs, hal_health_server)
+ domain_trans(init, rootfs, recovery)
+ domain_trans(init, rootfs, linkerconfig)
+ domain_trans(init, rootfs, servicemanager)
+ domain_trans(init, rootfs, snapuserd)
+')
+domain_trans(init, shell_exec, shell)
+domain_trans(init, init_exec, ueventd)
+domain_trans(init, init_exec, vendor_init)
+domain_trans(init, { rootfs toolbox_exec }, modprobe)
+userdebug_or_eng(`
+ # case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+ domain_auto_trans(init, logcat_exec, logpersist)
+
+ # allow init to execute services marked with seclabel u:r:su:s0 in userdebug/eng
+ allow init su:process transition;
+ dontaudit init su:process noatsecure;
+ allow init su:process { siginh rlimitinh };
+')
+
+# Allow init to figure out name of dm-device from it's /dev/block/dm-XX path.
+# This is useful in case of remounting ext4 userdata into checkpointing mode,
+# since it potentially requires tearing down dm-devices (e.g. dm-bow, dm-crypto)
+# that userdata is mounted onto.
+allow init sysfs_dm:file read;
+
+# Allow init to modify the properties of loop devices.
+allow init sysfs_loop:dir r_dir_perms;
+allow init sysfs_loop:file rw_file_perms;
+
+# Allow init to examine the properties of block devices.
+allow init sysfs_type:file { getattr read };
+# Allow init get the attributes of block devices in /dev/block.
+allow init dev_type:dir r_dir_perms;
+allow init dev_type:blk_file getattr;
+
+# Allow init to write to the drop_caches file.
+allow init proc_drop_caches:file rw_file_perms;
+
+# Allow the BoringSSL self test to request a reboot upon failure
+set_prop(init, powerctl_prop)
+
+set_prop(init, userspace_reboot_exported_prop)
+
+# Second-stage init performs a test for whether the kernel has SELinux hooks
+# for the perf_event_open() syscall. This is done by testing for the syscall
+# outcomes corresponding to this policy.
+# TODO(b/137092007): this can be removed once the platform stops supporting
+# kernels that precede the perf_event_open hooks (Android common kernels 4.4
+# and 4.9).
+allow init self:perf_event { open cpu };
+allow init self:global_capability2_class_set perfmon;
+
+# Allow opening /proc/kallsyms so that on boot, init can create and retain an
+# fd with the full address visibility (which is evaluated on open and persists
+# for the lifetime of the open file description). This fd can then be shared
+# with other privileged processes.
+allow init proc_kallsyms:file r_file_perms;
+
+# Allow init to communicate with snapuserd to transition Virtual A/B devices
+# from the first-stage daemon to the second-stage.
+allow init snapuserd_socket:sock_file write;
+allow init snapuserd:unix_stream_socket connectto;
+# Allow for libsnapshot's use of flock() on /metadata/ota.
+allow init ota_metadata_file:dir lock;
+
+# Allow init to restore contexts of vd_device(/dev/block/vd[..]) when labeling
+# /dev/block.
+allow init vd_device:blk_file relabelto;
+
+set_prop(init, init_perf_lsm_hooks_prop)
+set_prop(init, vts_status_prop)
+
+# Allow init to set 16kb app compatibility props
+set_prop(init, bionic_linker_16kb_app_compat_prop)
+set_prop(init, pm_16kb_app_compat_prop)
+
+
+# Allow init to set/get prefetch boot prop to initiate record/replay
+set_prop(init, ctl_prefetch_prop);
+
+# Allow accessing /sys/kernel/tracing/instances/bootreceiver to set up tracing.
+allow init debugfs_bootreceiver_tracing:file w_file_perms;
+
+# PRNG seeder daemon socket is created and listened on by init before forking.
+allow init prng_seeder:unix_stream_socket { create bind listen };
+
+# Devices with kernels where CONFIG_HIST_TRIGGERS isn't enabled will
+# attempt to write a non exisiting 'synthetic_events' file, when setting
+# up synthetic events. This is a no-op in tracefs.
+dontaudit init debugfs_tracing_debug:dir { write add_name };
+
+# chown/chmod on devices.
+allow init {
+ dev_type
+ -hw_random_device
+ -keychord_device
+ -vm_manager_device_type
+ -port_device
+}:chr_file setattr;
+
+# /dev/__null__ node created by init.
+allow init tmpfs:chr_file { create setattr unlink rw_file_perms };
+
+#
+# init direct restorecon calls.
+#
+# /dev/kmsg
+allow init tmpfs:chr_file relabelfrom;
+allow init kmsg_device:chr_file { getattr write relabelto };
+# /dev/kmsg_debug
+userdebug_or_eng(`
+ allow init kmsg_debug_device:chr_file { open write relabelto };
+')
+# /mnt/vm, also permissions to mkdir / mount / chmod / chown
+allow init vm_data_file:dir { add_name create search write getattr setattr relabelto mounton };
+
+# allow init to mount and unmount debugfs in debug builds
+userdebug_or_eng(`
+ allow init debugfs:dir mounton;
+')
+
+# /dev/__properties__
+allow init properties_device:dir relabelto;
+allow init properties_serial:file { write relabelto };
+allow init property_type:file { append create getattr map open read relabelto rename setattr unlink write };
+# /dev/__properties__/property_info and /dev/__properties/appcompat_override/property_info
+allow init properties_device:file create_file_perms;
+allow init property_info:file relabelto;
+# /dev/event-log-tags
+allow init device:file relabelfrom;
+allow init runtime_event_log_tags_file:file { open write setattr relabelto create };
+# /dev/socket
+allow init { device socket_device dm_user_device }:dir relabelto;
+# allow init to establish connection and communicate with lmkd
+unix_socket_connect(init, lmkd, lmkd)
+# Relabel /dev nodes created in first stage init: /dev/console, /dev/null, /dev/ptmx, /dev/random
+# and /dev/urandom
+allow init { console_device null_device ptmx_device random_device } : chr_file relabelto;
+# /dev/device-mapper, /dev/block(/.*)?
+allow init tmpfs:{ chr_file blk_file } relabelfrom;
+allow init tmpfs:blk_file getattr;
+allow init block_device:{ dir blk_file lnk_file } relabelto;
+allow init dm_device:{ chr_file blk_file } relabelto;
+allow init dm_user_device:chr_file relabelto;
+allow init kernel:fd use;
+# restorecon for early mount device symlinks
+allow init tmpfs:lnk_file { getattr read relabelfrom };
+allow init {
+ metadata_block_device
+ misc_block_device
+ recovery_block_device
+ system_block_device
+ userdata_block_device
+}:{ blk_file lnk_file } relabelto;
+
+allow init dtbo_block_device:lnk_file relabelto;
+allow init super_block_device:lnk_file relabelto;
+
+# Create /mnt/sdcard -> /storage/self/primary symlink.
+allow init mnt_sdcard_file:lnk_file create;
+
+# setrlimit
+allow init self:global_capability_class_set sys_resource;
+
+# Remove /dev/.booting and load /debug_ramdisk/* files
+allow init tmpfs:file { getattr unlink };
+
+# Access pty created for fsck.
+allow init devpts:chr_file { read write open };
+
+# Create /dev/fscklogs files.
+allow init fscklogs:file create_file_perms;
+
+# Access /dev/__null__ node created prior to initial policy load.
+allow init tmpfs:chr_file write;
+
+# Access /dev/console.
+allow init console_device:chr_file rw_file_perms;
+
+# Access /dev/tty0.
+allow init tty_device:chr_file rw_file_perms;
+
+# Call mount(2).
+allow init self:global_capability_class_set sys_admin;
+
+# Call setns(2).
+allow init self:global_capability_class_set sys_chroot;
+
+# Create and mount on directories in /.
+allow init rootfs:dir create_dir_perms;
+allow init {
+ rootfs
+ cache_file
+ cgroup
+ linkerconfig_file
+ storage_file
+ mnt_user_file
+ system_data_file
+ system_data_root_file
+ system_dlkm_file
+ system_file
+ vendor_file
+ postinstall_mnt_dir
+ mirror_data_file
+ shell_data_file
+}:dir mounton;
+
+# Mount bpf fs on sys/fs/bpf
+allow init fs_bpf:dir mounton;
+
+# Mount on /dev/usb-ffs/adb.
+allow init device:dir mounton;
+
+# Mount tmpfs on /apex
+allow init apex_mnt_dir:dir mounton;
+
+# Bind-mount on /system/apex/com.android.art
+allow init art_apex_dir:dir mounton;
+
+# Create and remove symlinks in /.
+allow init rootfs:lnk_file { create unlink };
+
+# Mount debugfs on /sys/kernel/debug.
+allow init sysfs:dir mounton;
+
+# Create cgroups mount points in tmpfs and mount cgroups on them.
+allow init tmpfs:dir create_dir_perms;
+allow init tmpfs:dir mounton;
+allow init cgroup:dir create_dir_perms;
+allow init cgroup:file rw_file_perms;
+allow init cgroup_rc_file:file rw_file_perms;
+allow init cgroup_desc_file:file r_file_perms;
+allow init vendor_cgroup_desc_file:file r_file_perms;
+allow init cgroup_v2:dir { mounton create_dir_perms};
+allow init cgroup_v2:file rw_file_perms;
+
+# /config
+allow init configfs:dir mounton;
+allow init configfs:dir create_dir_perms;
+allow init configfs:{ file lnk_file } create_file_perms;
+
+# /metadata
+allow init metadata_file:dir mounton;
+
+# Run restorecon on /dev
+allow init tmpfs:dir relabelfrom;
+
+# Create directories under /dev/cpuctl after chowning it to system.
+allow init self:global_capability_class_set { dac_override dac_read_search };
+
+# Set system clock.
+allow init self:global_capability_class_set sys_time;
+
+allow init self:global_capability_class_set { sys_rawio mknod };
+
+# Mounting filesystems from block devices.
+allow init dev_type:blk_file r_file_perms;
+allowxperm init dev_type:blk_file ioctl BLKROSET;
+allowxperm init system_data_root_file:dir ioctl F2FS_IOC_SHUTDOWN;
+
+# Mounting filesystems.
+# Only allow relabelto for types used in context= mount options,
+# which should all be assigned the contextmount_type attribute.
+# This can be done in device-specific policy via type or typeattribute
+# declarations.
+allow init {
+ fs_type
+ enforce_debugfs_restriction(`-debugfs_type')
+}:filesystem ~relabelto;
+
+# Allow init to mount/unmount debugfs in non-user builds.
+enforce_debugfs_restriction(`
+ userdebug_or_eng(`allow init debugfs_type:filesystem { mount unmount };')
+')
+
+# Allow init to mount tracefs in /sys/kernel/tracing
+allow init debugfs_tracing_debug:filesystem mount;
+
+allow init unlabeled:filesystem ~relabelto;
+allow init contextmount_type:filesystem relabelto;
+
+# Allow read-only access to context= mounted filesystems.
+allow init contextmount_type:dir r_dir_perms;
+allow init contextmount_type:notdevfile_class_set r_file_perms;
+
+# restorecon /adb_keys or any other rootfs files and directories to a more
+# specific type.
+allow init rootfs:{ dir file } relabelfrom;
+
+# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
+# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
+# system/core/init.rc requires at least cache_file and data_file_type.
+# init.<board>.rc files often include device-specific types, so
+# we just allow all file types except /system files here.
+allow init self:global_capability_class_set { chown fowner fsetid };
+
+allow init {
+ file_type
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+}:dir { create search getattr open read setattr ioctl };
+
+allow init {
+ file_type
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -bpffs_type
+ -credstore_data_file
+ -exec_type
+ -keystore_data_file
+ -media_userdir_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -system_userdir_file
+ -vendor_file_type
+ -vendor_userdir_file
+ -vold_data_file
+}:dir { write add_name remove_name rmdir relabelfrom };
+
+allow init {
+ file_type
+ -apex_info_file
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -runtime_event_log_tags_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+ enforce_debugfs_restriction(`-debugfs_type')
+}:file { create getattr open read write setattr relabelfrom unlink map };
+
+allow init tracefs_type:file { create_file_perms relabelfrom };
+
+# Allow init to read /apex/apex-info-list.xml for preinstalled paths of APEXes to determine
+# subcontext for action/service defined in APEXes.
+allow init apex_info_file:file r_file_perms;
+
+allow init {
+ file_type
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
+
+allow init {
+ file_type
+ -apex_mnt_dir
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -bpffs_type
+ -exec_type
+ -gsi_data_file
+ -credstore_data_file
+ -keystore_data_file
+ -misc_logd_file
+ -nativetest_data_file
+ -privapp_data_file
+ -shell_data_file
+ -system_app_data_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_data_file
+}:lnk_file { create getattr setattr relabelfrom unlink };
+
+allow init cache_file:lnk_file r_file_perms;
+
+allow init {
+ file_type
+ -bpffs_type
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -exec_type
+ -app_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ -storage_area_dir
+ -storage_area_app_dir
+ -storage_area_content_file
+ ')
+ -vm_data_file
+ -privapp_data_file
+}:dir_file_class_set relabelto;
+
+allow init { sysfs no_debugfs_restriction(`debugfs') debugfs_tracing debugfs_tracing_debug }:{ dir file lnk_file } { getattr relabelfrom };
+allow init { sysfs_type no_debugfs_restriction(`debugfs_type') tracefs_type }:{ dir file lnk_file } { relabelto getattr };
+allow init dev_type:dir create_dir_perms;
+allow init dev_type:lnk_file create;
+
+# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
+allow init debugfs_tracing:file w_file_perms;
+
+# Setup and control wifi event tracing (see wifi-events.rc)
+allow init debugfs_tracing_instances:dir create_dir_perms;
+allow init debugfs_tracing_instances:file w_file_perms;
+allow init debugfs_wifi_tracing:file w_file_perms;
+allow init debugfs_wifi_tracing:dir create_dir_perms;
+
+# chown/chmod on pseudo files.
+allow init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -keychord_device
+ -proc_type
+ -sdcard_type
+ -fusefs_type
+ -sysfs_type
+ -rootfs
+ enforce_debugfs_restriction(`-debugfs_type')
+}:file { open read setattr };
+allow init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+}:dir { open read setattr search };
+
+allow init {
+ binder_device
+ console_device
+ devpts
+ dm_device
+ hwbinder_device
+ input_device
+ kmsg_device
+ null_device
+ owntty_device
+ pmsg_device
+ ptmx_device
+ random_device
+ tty_device
+ zero_device
+}:chr_file { read open };
+
+# Unlabeled file access for upgrades from 4.2.
+allow init unlabeled:dir { create_dir_perms relabelfrom };
+allow init unlabeled:notdevfile_class_set { create_file_perms relabelfrom };
+
+# Any operation that can modify the kernel ring buffer, e.g. clear
+# or a read that consumes the messages that were read.
+allow init kernel:system syslog_mod;
+allow init self:global_capability2_class_set syslog;
+
+# init access to /proc.
+r_dir_file(init, proc_net_type)
+allow init proc_filesystems:file r_file_perms;
+
+userdebug_or_eng(`
+ # Overlayfs workdir write access check during mount to permit remount,rw
+ allow init overlayfs_file:dir { relabelfrom mounton write };
+ allow init overlayfs_file:file { append rename };
+ allow init overlayfs_file:chr_file unlink;
+ allow init system_block_device:blk_file { write };
+')
+
+allow init {
+ proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
+ proc_allocinfo
+ proc_bootconfig
+ proc_cmdline
+ proc_diskstats
+ proc_kmsg # Open /proc/kmsg for logd service.
+ proc_meminfo
+ proc_stat # Read /proc/stat for bootchart.
+ proc_uptime
+ proc_version
+}:file r_file_perms;
+
+allow init {
+ proc_abi
+ proc_cpu_alignment
+ proc_dirty
+ proc_hostname
+ proc_hung_task
+ proc_extra_free_kbytes
+ proc_net_type
+ proc_max_map_count
+ proc_min_free_order_shift
+ proc_overcommit_memory # /proc/sys/vm/overcommit_memory
+ proc_panic
+ proc_page_cluster
+ proc_perf
+ proc_sched
+ proc_sysrq
+ proc_watermark_boost_factor
+}:file w_file_perms;
+
+allow init {
+ proc_security
+}:file rw_file_perms;
+
+# init chmod/chown access to /proc files.
+allow init {
+ proc_allocinfo
+ proc_cmdline
+ proc_bootconfig
+ proc_kmsg
+ proc_net
+ proc_pagetypeinfo
+ proc_qtaguid_stat
+ proc_slabinfo
+ proc_sysrq
+ proc_qtaguid_ctrl
+ proc_vmallocinfo
+}:file setattr;
+
+# init access to /sys files.
+allow init {
+ sysfs_android_usb
+ sysfs_dm_verity
+ sysfs_leds
+ sysfs_power
+ sysfs_fs_f2fs
+ sysfs_dm
+ sysfs_lru_gen_enabled
+ sysfs_pgsize_migration
+}:file w_file_perms;
+
+allow init {
+ sysfs_dt_firmware_android
+ sysfs_fs_ext4_features
+}:file r_file_perms;
+
+allow init {
+ sysfs_zram
+}:file rw_file_perms;
+
+# allow init to create loop devices with /dev/loop-control
+allow init loop_control_device:chr_file rw_file_perms;
+allow init loop_device:blk_file rw_file_perms;
+allowxperm init loop_device:blk_file ioctl {
+ LOOP_SET_FD
+ LOOP_CLR_FD
+ LOOP_CTL_GET_FREE
+ LOOP_SET_BLOCK_SIZE
+ LOOP_SET_DIRECT_IO
+ LOOP_GET_STATUS
+ LOOP_SET_STATUS64
+};
+
+# Allow init to write to vibrator/trigger
+allow init sysfs_vibrator:file w_file_perms;
+
+# init chmod/chown access to /sys files.
+allow init {
+ sysfs_android_usb
+ sysfs_devices_system_cpu
+ sysfs_firmware_acpi_tables
+ sysfs_ipv4
+ sysfs_leds
+ sysfs_lowmemorykiller
+ sysfs_power
+ sysfs_vibrator
+ sysfs_wake_lock
+ sysfs_zram
+}:file setattr;
+
+# Set usermodehelpers.
+allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms;
+
+allow init self:global_capability_class_set net_admin;
+
+# Reboot.
+allow init self:global_capability_class_set sys_boot;
+
+# Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd".
+# Init will also walk through the directory as part of a recursive restorecon.
+allow init misc_logd_file:dir { add_name open create read getattr setattr search write };
+allow init misc_logd_file:file { open create getattr setattr write };
+
+# Support "adb shell stop"
+allow init self:global_capability_class_set kill;
+allow init domain:process { getpgid sigkill signal };
+
+# Init creates credstore's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init credstore_data_file:dir { open create read getattr setattr search };
+allow init credstore_data_file:file { getattr };
+
+# Init creates keystore's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init keystore_data_file:dir { open create read getattr setattr search };
+allow init keystore_data_file:file { getattr };
+
+# Init creates vold's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init vold_data_file:dir { open create read getattr setattr search };
+allow init vold_data_file:file { getattr };
+
+# Init creates /data/local/tmp at boot
+allow init shell_data_file:dir { open create read getattr setattr search };
+allow init shell_data_file:file { getattr };
+
+# Set UID, GID, and adjust capability bounding set for services.
+allow init self:global_capability_class_set { setuid setgid setpcap };
+
+# For bootchart to read the /proc/$pid/cmdline file of each process,
+# we need to have following line to allow init to have access
+# to different domains.
+r_dir_file(init, domain)
+
+# Use setexeccon(), setfscreatecon(), and setsockcreatecon().
+# setexec is for services with seclabel options.
+# setfscreate is for labeling directories and socket files.
+# setsockcreate is for labeling local/unix domain sockets.
+allow init self:process { setexec setfscreate setsockcreate };
+
+# Get file context
+allow init file_contexts_file:file r_file_perms;
+
+# sepolicy access
+allow init sepolicy_file:file r_file_perms;
+
+# Perform SELinux access checks on setting properties.
+selinux_check_access(init)
+
+# Ask the kernel for the new context on services to label their sockets.
+allow init kernel:security compute_create;
+
+# Create sockets for the services.
+allow init domain:unix_stream_socket { create bind setopt };
+allow init domain:unix_dgram_socket { create bind setopt };
+
+# Create /data/property and files within it.
+allow init property_data_file:dir create_dir_perms;
+allow init property_data_file:file create_file_perms;
+
+# Set any property.
+allow init property_type:property_service set;
+
+# Send an SELinux userspace denial to the kernel audit subsystem,
+# so it can be picked up and processed by logd. These denials are
+# generated when an attempt to set a property is denied by policy.
+allow init self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_relay };
+allow init self:global_capability_class_set audit_write;
+
+# Run "ifup lo" to bring up the localhost interface
+allow init self:udp_socket { create ioctl };
+# in addition to unpriv ioctls granted to all domains, init also needs:
+allowxperm init self:udp_socket ioctl SIOCSIFFLAGS;
+allow init self:global_capability_class_set net_raw;
+
+# Set scheduling info for psi monitor thread.
+# TODO: delete or revise this line b/131761776
+allow init kernel:process { getsched setsched };
+
+# swapon() needs write access to swap device
+# system/core/fs_mgr/fs_mgr.c - fs_mgr_swapon_all
+allow init swap_block_device:blk_file rw_file_perms;
+# Allow to change group owner and permissions for new swap setup in mmd
+allow init swap_block_device:blk_file setattr;
+
+# Create and access /dev files without a specific type,
+# e.g. /dev/.coldboot_done, /dev/.booting
+# TODO: Move these files into their own type unless they are
+# only ever accessed by init.
+allow init device:file create_file_perms;
+
+# keychord retrieval from /dev/input/ devices
+allow init input_device:dir r_dir_perms;
+allow init input_device:chr_file rw_file_perms;
+
+# Access device mapper for setting up dm-verity
+allow init dm_device:chr_file rw_file_perms;
+allow init dm_device:blk_file rw_file_perms;
+
+# Access dm-user for OTA boot
+allow init dm_user_device:chr_file rw_file_perms;
+
+# Access metadata block device for storing dm-verity state
+allow init metadata_block_device:blk_file rw_file_perms;
+
+# Read /sys/fs/pstore/console-ramoops to detect restarts caused
+# by dm-verity detecting corrupted blocks
+allow init pstorefs:dir search;
+allow init pstorefs:file r_file_perms;
+allow init kernel:system syslog_read;
+
+# linux keyring configuration
+allow init init:key { write search setattr };
+
+# Allow init to create /data/unencrypted
+allow init unencrypted_data_file:dir create_dir_perms;
+
+# Set encryption policy on dirs in /data
+allowxperm init { data_file_type unlabeled }:dir ioctl {
+ FS_IOC_GET_ENCRYPTION_POLICY
+ FS_IOC_SET_ENCRYPTION_POLICY
+};
+
+# Raw writes to misc block device
+allow init misc_block_device:blk_file w_file_perms;
+
+r_dir_file(init, system_file)
+r_dir_file(init, system_dlkm_file_type)
+r_dir_file(init, vendor_file_type)
+
+allow init system_data_file:file { getattr read };
+allow init system_data_file:lnk_file r_file_perms;
+
+# For init to be able to run shell scripts from vendor
+allow init vendor_shell_exec:file execute;
+
+# Metadata setup
+allow init vold_metadata_file:dir create_dir_perms;
+allow init vold_metadata_file:file getattr;
+allow init metadata_bootstat_file:dir create_dir_perms;
+allow init metadata_bootstat_file:file w_file_perms;
+allow init userspace_reboot_metadata_file:file w_file_perms;
+
+# Allow init to touch PSI monitors
+allow init proc_pressure_mem:file { rw_file_perms setattr };
+
+# init is using bootstrap bionic
+use_bootstrap_libs(init)
+
+# stat the root dir of fuse filesystems (for the mount handler)
+allow init fuse:dir { search getattr };
+
+# allow filesystem tuning
+allow init userdata_sysdev:file create_file_perms;
+
+# allow disk tuning
+allow init rootdisk_sysdev:file create_file_perms;
+
+###
+### neverallow rules
+###
+
+# The init domain is only entered via an exec based transition from the
+# kernel domain, never via setcon().
+neverallow domain init:process dyntransition;
+neverallow { domain -kernel } init:process transition;
+neverallow init { file_type fs_type -init_exec }:file entrypoint;
+
+# Never read/follow symlinks created by shell or untrusted apps.
+neverallow init shell_data_file:lnk_file read;
+neverallow init app_data_file_type:lnk_file read;
+
+# init should never execute a program without changing to another domain.
+neverallow init { file_type fs_type }:file execute_no_trans;
+
+# The use of sensitive environment variables, such as LD_PRELOAD, is disallowed
+# when init is executing other binaries. The use of LD_PRELOAD for init spawned
+# services is generally considered a no-no, as it injects libraries which the
+# binary was not expecting. This is especially problematic for APEXes. The use
+# of LD_PRELOAD via APEXes is a layering violation, and inappropriately loads
+# code into a process which wasn't expecting that code, with potentially
+# unexpected side effects. (b/140789528)
+neverallow init *:process noatsecure;
+
+# init can never add binder services
+neverallow init service_manager_type:service_manager { add find };
+# init can never list binder services
+neverallow init servicemanager:service_manager list;
+
+# Init should not be creating subdirectories in /data/local/tmp
+neverallow init shell_data_file:dir { write add_name remove_name };
+
+# Init should not access sysfs node that are not explicitly labeled.
+neverallow init sysfs:file { open write };
+
+# No domain should be allowed to ptrace init.
+neverallow * init:process ptrace;
+
+# init owns the root of /data
+# TODO(b/140259336) We want to remove vendor_init
+# TODO(b/141108496) We want to remove toolbox
+neverallow { domain -init -toolbox -vendor_init -vold } system_data_root_file:dir { write add_name remove_name };
+
+# Only init is allowed to set userspace reboot related properties.
+neverallow { domain -init } userspace_reboot_exported_prop:property_service set;
+
+neverallow init self:perf_event { kernel tracepoint read write };
+dontaudit init self:perf_event { kernel tracepoint read write };
+
+# Only init is allowed to set the sysprop indicating whether perf_event_open()
+# SELinux hooks were detected.
+neverallow { domain -init } init_perf_lsm_hooks_prop:property_service set;
+
+# Only init can write vts.native_server.on
+neverallow { domain -init } vts_status_prop:property_service set;
+
+# Only init can write normal ro.boot. properties
+neverallow { domain -init } bootloader_prop:property_service set;
+
+# Only init can write hal.instrumentation.enable
+neverallow { domain -init } hal_instrumentation_prop:property_service set;
+
+# Only init can write ro.property_service.version
+neverallow { domain -init } property_service_version_prop:property_service set;
+
+# Only init can set keystore.boot_level
+neverallow { domain -init } keystore_listen_prop:property_service set;
diff --git a/prebuilts/api/202504/private/initial_sid_contexts b/prebuilts/api/202504/private/initial_sid_contexts
new file mode 100644
index 0000000..9819051
--- /dev/null
+++ b/prebuilts/api/202504/private/initial_sid_contexts
@@ -0,0 +1,27 @@
+sid kernel u:r:kernel:s0
+sid security u:object_r:kernel:s0
+sid unlabeled u:object_r:unlabeled:s0
+sid fs u:object_r:labeledfs:s0
+sid file u:object_r:unlabeled:s0
+sid file_labels u:object_r:unlabeled:s0
+sid init u:object_r:unlabeled:s0
+sid any_socket u:object_r:unlabeled:s0
+sid port u:object_r:port:s0
+sid netif u:object_r:netif:s0
+sid netmsg u:object_r:unlabeled:s0
+sid node u:object_r:node:s0
+sid igmp_packet u:object_r:unlabeled:s0
+sid icmp_socket u:object_r:unlabeled:s0
+sid tcp_socket u:object_r:unlabeled:s0
+sid sysctl_modprobe u:object_r:unlabeled:s0
+sid sysctl u:object_r:proc:s0
+sid sysctl_fs u:object_r:unlabeled:s0
+sid sysctl_kernel u:object_r:unlabeled:s0
+sid sysctl_net u:object_r:unlabeled:s0
+sid sysctl_net_unix u:object_r:unlabeled:s0
+sid sysctl_vm u:object_r:unlabeled:s0
+sid sysctl_dev u:object_r:unlabeled:s0
+sid kmod u:object_r:unlabeled:s0
+sid policy u:object_r:unlabeled:s0
+sid scmp_packet u:object_r:unlabeled:s0
+sid devnull u:object_r:null_device:s0
diff --git a/prebuilts/api/202504/private/initial_sids b/prebuilts/api/202504/private/initial_sids
new file mode 100644
index 0000000..91ac816
--- /dev/null
+++ b/prebuilts/api/202504/private/initial_sids
@@ -0,0 +1,35 @@
+# FLASK
+
+#
+# Define initial security identifiers
+#
+
+sid kernel
+sid security
+sid unlabeled
+sid fs
+sid file
+sid file_labels
+sid init
+sid any_socket
+sid port
+sid netif
+sid netmsg
+sid node
+sid igmp_packet
+sid icmp_socket
+sid tcp_socket
+sid sysctl_modprobe
+sid sysctl
+sid sysctl_fs
+sid sysctl_kernel
+sid sysctl_net
+sid sysctl_net_unix
+sid sysctl_vm
+sid sysctl_dev
+sid kmod
+sid policy
+sid scmp_packet
+sid devnull
+
+# FLASK
diff --git a/prebuilts/api/202504/private/inputflinger.te b/prebuilts/api/202504/private/inputflinger.te
new file mode 100644
index 0000000..9e8e35b
--- /dev/null
+++ b/prebuilts/api/202504/private/inputflinger.te
@@ -0,0 +1,16 @@
+typeattribute inputflinger coredomain;
+
+init_daemon_domain(inputflinger)
+
+binder_use(inputflinger)
+binder_service(inputflinger)
+
+binder_call(inputflinger, system_server)
+
+wakelock_use(inputflinger)
+
+allow inputflinger input_device:dir r_dir_perms;
+allow inputflinger input_device:chr_file rw_file_perms;
+
+r_dir_file(inputflinger, cgroup)
+r_dir_file(inputflinger, cgroup_v2)
diff --git a/prebuilts/api/202504/private/installd.te b/prebuilts/api/202504/private/installd.te
new file mode 100644
index 0000000..50c378a
--- /dev/null
+++ b/prebuilts/api/202504/private/installd.te
@@ -0,0 +1,248 @@
+typeattribute installd coredomain;
+
+init_daemon_domain(installd)
+
+# Run migrate_legacy_obb_data.sh in its own sandbox.
+domain_auto_trans(installd, migrate_legacy_obb_data_exec, migrate_legacy_obb_data)
+allow installd shell_exec:file rx_file_perms;
+
+# Run dex2oat in its own sandbox.
+domain_auto_trans(installd, dex2oat_exec, dex2oat)
+
+# Run profman in its own sandbox.
+domain_auto_trans(installd, profman_exec, profman)
+
+# Run idmap in its own sandbox.
+domain_auto_trans(installd, idmap_exec, idmap)
+
+# For collecting bugreports.
+allow installd dumpstate:fd use;
+allow installd dumpstate:fifo_file r_file_perms;
+
+# Delete /system/bin/bcc generated artifacts
+allow installd app_exec_data_file:file unlink;
+
+# Capture userdata snapshots to /data/misc_[ce|de]/rollback and
+# subsequently restore them.
+allow installd rollback_data_file:dir create_dir_perms;
+allow installd rollback_data_file:file create_file_perms;
+
+# Allow installd to access the runtime feature flag properties.
+get_prop(installd, device_config_runtime_native_prop)
+get_prop(installd, device_config_runtime_native_boot_prop)
+
+# Allow installd to access apk verity feature flag (for legacy case).
+get_prop(installd, apk_verity_prop)
+
+# Allow installd to access odsign verification status
+get_prop(installd, odsign_prop)
+
+# Allow installd to delete files in /data/staging
+allow installd staging_data_file:file unlink;
+allow installd staging_data_file:dir { open read add_name remove_name rename rmdir search write getattr };
+
+# Allow installd manage dirs in /data/misc_ce/0/sdksandbox
+allow installd sdk_sandbox_system_data_file:dir { create_dir_perms relabelfrom };
+
+# Allow installd to enable fs-verity for app file passed as FD;
+allow installd { untrusted_app_all priv_app gmscore_app }:fd use;
+allowxperm installd app_data_file_type:file ioctl FS_IOC_ENABLE_VERITY;
+
+typeattribute installd mlstrustedsubject;
+allow installd self:global_capability_class_set { chown dac_override dac_read_search fowner fsetid setgid setuid sys_admin kill };
+
+# Allow labeling of files under /data/app/com.example/oat/
+allow installd dalvikcache_data_file:dir relabelto;
+allow installd dalvikcache_data_file:file { relabelto link };
+
+# Allow movement of APK files between volumes
+allow installd apk_data_file:dir { create_dir_perms relabelfrom };
+allow installd apk_data_file:file { create_file_perms relabelfrom link };
+allow installd apk_data_file:lnk_file { create r_file_perms unlink };
+
+allow installd asec_apk_file:file r_file_perms;
+allow installd apk_tmp_file:file { r_file_perms unlink };
+allow installd apk_tmp_file:dir { relabelfrom create_dir_perms };
+allow installd oemfs:dir r_dir_perms;
+allow installd oemfs:file r_file_perms;
+allow installd cgroup:dir create_dir_perms;
+allow installd cgroup_v2:dir create_dir_perms;
+allow installd mnt_expand_file:dir { search getattr };
+# Check validity of SELinux context before use.
+selinux_check_context(installd)
+
+r_dir_file(installd, rootfs)
+# Scan through APKs in /system/app and /system/priv-app
+r_dir_file(installd, system_file)
+# Scan through APKs in /vendor/app
+r_dir_file(installd, vendor_app_file)
+# Scan through JARs in /vendor/framework
+r_dir_file(installd, vendor_framework_file)
+# Scan through Runtime Resource Overlay APKs in /vendor/overlay
+r_dir_file(installd, vendor_overlay_file)
+# Vendor overlay can be found in vendor apex
+allow installd vendor_apex_metadata_file:dir { getattr search };
+# Get file context
+allow installd file_contexts_file:file r_file_perms;
+# Get seapp_context
+allow installd seapp_contexts_file:file r_file_perms;
+
+# Search /data/app-asec and stat files in it.
+allow installd asec_image_file:dir search;
+allow installd asec_image_file:file getattr;
+
+# Required to initially create subdirectories of /data/user/$userId
+# and lib symlinks before the setfilecon call. May want to
+# move symlink creation after setfilecon in installd.
+allow installd system_data_file:dir create_dir_perms;
+# Also, allow read for lnk_file so that we can process symlinks within
+# /data/user/$userId when optimizing application code.
+allow installd system_data_file:lnk_file { create getattr read setattr unlink };
+
+# Manage lower filesystem via pass_through mounts
+allow installd mnt_pass_through_file:dir r_dir_perms;
+
+# Upgrade /data/media for multi-user if necessary.
+allow installd media_rw_data_file:dir create_dir_perms;
+allow installd media_rw_data_file:file { getattr unlink };
+# restorecon new /data/media directory.
+allow installd system_data_file:dir relabelfrom;
+allow installd media_rw_data_file:dir relabelto;
+
+# Delete /data/media files through sdcardfs, instead of going behind its back
+allow installd media_userdir_file:dir r_dir_perms;
+allow installd tmpfs:dir r_dir_perms;
+allow installd storage_file:dir search;
+allow installd { sdcard_type fuse }:dir { search open read write remove_name getattr rmdir };
+allow installd { sdcard_type fuse }:file { getattr unlink };
+
+# Create app's mirror data directory in /data_mirror, and bind mount the real directory to it
+allow installd mirror_data_file:dir { create_dir_perms mounton };
+
+# Upgrade /data/misc/keychain for multi-user if necessary.
+allow installd system_userdir_file:dir r_dir_perms;
+allow installd misc_user_data_file:dir create_dir_perms;
+allow installd misc_user_data_file:file create_file_perms;
+allow installd keychain_data_file:dir create_dir_perms;
+allow installd keychain_data_file:file {r_file_perms unlink};
+
+# Create /data/misc/installd/layout_version.* file
+allow installd install_data_file:file create_file_perms;
+allow installd install_data_file:dir rw_dir_perms;
+
+# Create files under /data/dalvik-cache.
+allow installd dalvikcache_data_file:dir create_dir_perms;
+allow installd dalvikcache_data_file:file create_file_perms;
+allow installd dalvikcache_data_file:lnk_file getattr;
+
+# Create files under /data/resource-cache.
+allow installd resourcecache_data_file:dir rw_dir_perms;
+allow installd resourcecache_data_file:file create_file_perms;
+
+# Upgrade from unlabeled userdata.
+# Just need enough to remove and/or relabel it.
+allow installd unlabeled:dir { getattr search relabelfrom rw_dir_perms rmdir };
+allow installd unlabeled:notdevfile_class_set { getattr relabelfrom rename unlink setattr };
+# Read pkg.apk file for input during dexopt.
+allow installd unlabeled:file r_file_perms;
+
+# Upgrade from before system_app_data_file was used for system UID apps.
+# Just need enough to relabel it and to unlink removed package files.
+# Directory access covered by earlier rule above.
+allow installd system_data_file:notdevfile_class_set { getattr relabelfrom unlink };
+
+# Manage /data/data subdirectories, including initially labeling them
+# upon creation via setfilecon or running restorecon_recursive,
+# setting owner/mode, creating symlinks within them, and deleting them
+# upon package uninstall.
+allow installd app_data_file_type:dir { create_dir_perms relabelfrom relabelto };
+allow installd app_data_file_type:notdevfile_class_set { create_file_perms relabelfrom relabelto };
+
+# Allow setting extended attributes (for project quota IDs) on dirs and files
+# and to enable project ID inheritance through FS_IOC_SETFLAGS
+# Added install_data_file to be able to create file under /data/misc/installd/ioctl_check
+allowxperm installd { app_data_file_type system_data_file install_data_file}:{ dir file } ioctl {
+ FS_IOC_FSGETXATTR
+ FS_IOC_FSSETXATTR
+ FS_IOC_GETFLAGS
+ FS_IOC_SETFLAGS
+};
+
+# Similar for the files under /data/misc/profiles/
+allow installd user_profile_root_file:dir { create_dir_perms relabelfrom };
+allow installd user_profile_data_file:dir { create_dir_perms relabelto };
+allow installd user_profile_data_file:file create_file_perms;
+allow installd user_profile_data_file:file unlink;
+
+# Allow zygote to unmount mirror directories
+allow installd labeledfs:filesystem unmount;
+
+# Files created/updated by profman dumps.
+allow installd profman_dump_data_file:dir { search add_name write };
+allow installd profman_dump_data_file:file { create setattr open write };
+
+# Create and use pty created by android_fork_execvp().
+allow installd devpts:chr_file rw_file_perms;
+
+# execute toybox for app relocation
+allow installd toolbox_exec:file rx_file_perms;
+
+# Allow installd to publish a binder service and make binder calls.
+binder_use(installd)
+add_service(installd, installd_service)
+allow installd dumpstate:fifo_file { getattr write };
+
+# Allow installd to call into the system server so it can check permissions.
+binder_call(installd, system_server)
+allow installd permission_service:service_manager find;
+
+# Allow installd to read and write quotas
+allow installd block_device:dir { search };
+allow installd labeledfs:filesystem { quotaget quotamod };
+
+# Allow installd to delete from /data/preloads when trimming data caches
+# TODO b/34690396 Remove when time-based purge policy for preloads is implemented in system_server
+allow installd preloads_data_file:file { r_file_perms unlink };
+allow installd preloads_data_file:dir { r_dir_perms write remove_name rmdir };
+allow installd preloads_media_file:file { r_file_perms unlink };
+allow installd preloads_media_file:dir { r_dir_perms write remove_name rmdir };
+
+# Allow installd to read /proc/filesystems
+allow installd proc_filesystems:file r_file_perms;
+
+#add for move app to sd card
+get_prop(installd, storage_config_prop)
+
+# Allow installd to access apps installed on the Incremental File System
+# Accessing files on the Incremental File System uses fds opened in the context of vold.
+allow installd vold:fd use;
+
+# on app uninstall, installd deletes the storage area keys for the app
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ allow installd storage_area_key_file:dir {
+ open search write remove_name
+ lock read getattr rmdir
+ };
+ allow installd storage_area_key_file:file unlink;
+')
+
+# Allow installd to delete the terminal app's data file.
+# `virtualizationservice_data_file` was used for a while, but it needs to be
+# deleted when terminal feature is disabled.
+# TODO(b/383026786): Remove this rule once the there is no
+# `virtualizationservice_data_file` in terminal app anymore..
+allow installd virtualizationservice_data_file:file unlink;
+
+###
+### Neverallow rules
+###
+
+# only system_server, installd, dumpstate, and servicemanager may interact with installd over binder
+neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
+neverallow { domain -system_server -dumpstate -servicemanager } installd:binder call;
+neverallow installd {
+ domain
+ -system_server
+ -servicemanager
+ userdebug_or_eng(`-su')
+}:binder call;
diff --git a/prebuilts/api/202504/private/isolated_app.te b/prebuilts/api/202504/private/isolated_app.te
new file mode 100644
index 0000000..9d0fd73
--- /dev/null
+++ b/prebuilts/api/202504/private/isolated_app.te
@@ -0,0 +1,36 @@
+###
+### isolated_apps.
+###
+### This file defines the rules for isolated apps that does not wish to use
+### service managers and does not require extra computational resources.
+###
+
+typeattribute isolated_app coredomain;
+
+app_domain(isolated_app)
+isolated_app_domain(isolated_app)
+
+allow isolated_app webviewupdate_service:service_manager find;
+
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl };
+
+# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps
+# by other processes. Open should never be allowed, and is blocked by
+# neverallow rules in isolated_app_all attribute.
+# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs
+# is modified to change the secontext when accessing the lower filesystem.
+allow isolated_app { sdcard_type fuse media_rw_data_file }:file { read write append getattr lock map };
+
+# For webviews, isolated_app processes can be forked from the webview_zygote
+# in addition to the zygote. Allow access to resources inherited from the
+# webview_zygote process. These rules are specialized copies of the ones in app.te.
+# Inherit FDs from the webview_zygote.
+allow isolated_app webview_zygote:fd use;
+# Notify webview_zygote of child death.
+allow isolated_app webview_zygote:process sigchld;
+# Inherit logd write socket.
+allow isolated_app webview_zygote:unix_dgram_socket write;
+# Read system properties managed by webview_zygote.
+allow isolated_app webview_zygote_tmpfs:file read;
diff --git a/prebuilts/api/202504/private/isolated_app_all.te b/prebuilts/api/202504/private/isolated_app_all.te
new file mode 100644
index 0000000..43f1ac6
--- /dev/null
+++ b/prebuilts/api/202504/private/isolated_app_all.te
@@ -0,0 +1,125 @@
+###
+### isolated_app_all.
+###
+### Services with isolatedProcess=true in their manifest.
+###
+### This file defines the rules shared by all isolated apps. An "isolated
+### app" is an APP with UID between AID_ISOLATED_START (99000)
+### and AID_ISOLATED_END (99999).
+###
+
+# Access already open app data files received over Binder or local socket IPC.
+allow isolated_app_all { app_data_file privapp_data_file sdk_sandbox_data_file}:file { append read write getattr lock map };
+
+allow isolated_app_all activity_service:service_manager find;
+allow isolated_app_all display_service:service_manager find;
+
+# Google Breakpad (crash reporter for Chrome) relies on ptrace
+# functionality. Without the ability to ptrace, the crash reporter
+# tool is broken.
+# b/20150694
+# https://code.google.com/p/chromium/issues/detail?id=475270
+allow isolated_app_all self:process ptrace;
+
+# Inherit FDs from the app_zygote.
+allow isolated_app_all app_zygote:fd use;
+# Notify app_zygote of child death.
+allow isolated_app_all app_zygote:process sigchld;
+# Inherit logd write socket.
+allow isolated_app_all app_zygote:unix_dgram_socket write;
+
+# TODO (b/63631799) fix this access
+# suppress denials to /data/local/tmp
+dontaudit isolated_app_all shell_data_file:dir search;
+
+# Allow to read, map (but not open) staged apks.
+allow isolated_app_all { apk_tmp_file apk_private_tmp_file }:file { read getattr map };
+
+#####
+##### Neverallow
+#####
+
+# Isolated apps should not directly open app data files themselves.
+neverallow isolated_app_all app_data_file_type:file open;
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+# TODO: are there situations where isolated_apps write to this file?
+# TODO: should we tighten these restrictions further?
+neverallow isolated_app_all anr_data_file:file ~{ open append };
+neverallow isolated_app_all anr_data_file:dir ~search;
+
+# Isolated apps must not be permitted to use HwBinder
+neverallow { isolated_app_all -isolated_compute_app } hwbinder_device:chr_file *;
+neverallow { isolated_app_all -isolated_compute_app } *:hwservice_manager *;
+
+# Isolated apps must not be permitted to use VndBinder
+neverallow isolated_app_all vndbinder_device:chr_file *;
+
+# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager
+# except the find actions for services allowlisted below.
+neverallow { isolated_app_all -isolated_compute_app } *:service_manager ~find;
+
+# b/17487348
+# Isolated apps can only access three services,
+# activity_service, display_service, webviewupdate_service.
+neverallow { isolated_app_all -isolated_compute_app } {
+ service_manager_type
+ -activity_service
+ -display_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps shouldn't be able to access the driver directly.
+neverallow { isolated_app_all -isolated_compute_app } gpu_device:chr_file { rw_file_perms execute };
+
+# Do not allow isolated_apps access to /cache
+neverallow isolated_app_all cache_file:dir ~{ r_dir_perms };
+neverallow isolated_app_all cache_file:file ~{ read getattr };
+
+# Do not allow isolated_app_all to access external storage, except for files passed
+# via file descriptors (b/32896414).
+neverallow isolated_app_all { storage_file mnt_user_file sdcard_type fuse }:dir ~getattr;
+neverallow isolated_app_all { storage_file mnt_user_file }:file_class_set *;
+neverallow isolated_app_all { sdcard_type fuse }:{ devfile_class_set lnk_file sock_file fifo_file } *;
+neverallow isolated_app_all { sdcard_type fuse }:file ~{ read write append getattr lock map };
+
+# Do not allow USB access
+neverallow isolated_app_all { usb_device usbaccessory_device }:chr_file *;
+
+# Restrict the webview_zygote control socket.
+neverallow isolated_app_all webview_zygote:sock_file write;
+
+# Limit the /sys files which isolated_app_all can access. This is important
+# for controlling isolated_app_all attack surface.
+# TODO (b/266555480): The permission should be guarded by compliance test.
+# Remove the negation for member domains when refactorization is done.
+neverallow { isolated_app_all -isolated_compute_app } {
+ sysfs_type
+ -sysfs_devices_system_cpu
+ -sysfs_transparent_hugepage
+ -sysfs_usb # TODO: check with audio team if needed for isolated_apps (b/28417852)
+ -sysfs_fs_fuse_features
+ -sysfs_fs_incfs_features
+ -sysfs_pgsize_migration
+}:file no_rw_file_perms;
+
+# No creation of sockets families other than AF_UNIX sockets.
+# List taken from system/sepolicy/public/global_macros - socket_class_set
+# excluding unix_stream_socket and unix_dgram_socket.
+# Many of these are socket families which have never and will never
+# be compiled into the Android kernel.
+neverallow isolated_app_all { self ephemeral_app priv_app sdk_sandbox_all untrusted_app_all }:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket
+ key_socket appletalk_socket netlink_route_socket
+ netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket
+ netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket
+ netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket
+ netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket
+ netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket
+ rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket
+ ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket
+ qipcrtr_socket smc_socket xdp_socket
+} create;
diff --git a/prebuilts/api/202504/private/isolated_compute_app.te b/prebuilts/api/202504/private/isolated_compute_app.te
new file mode 100644
index 0000000..f34850e
--- /dev/null
+++ b/prebuilts/api/202504/private/isolated_compute_app.te
@@ -0,0 +1,56 @@
+###
+### isolated_compute_apps.
+###
+### This file defines the rules for isolated apps that requires the permission
+### to gather data with service manager and require computational resources to
+### improve the performance to process data under a sandbox. This
+### isolated_compute_app restricts data egress to protect the privacy.
+###
+### TODO(b/266923392): Clean rules for isolated_compute_app characteristics
+###
+
+typeattribute isolated_compute_app coredomain;
+
+app_domain(isolated_compute_app)
+isolated_app_domain(isolated_compute_app)
+
+allow isolated_compute_app isolated_compute_allowed_service:service_manager find;
+allow isolated_compute_app isolated_compute_allowed_device:chr_file { read write ioctl map };
+
+# Enable access to hardware services for camera functionalilites
+hal_client_domain(isolated_compute_app, hal_allocator)
+hwbinder_use(isolated_compute_app)
+
+hal_client_domain(isolated_compute_app, hal_codec2)
+
+allow isolated_compute_app dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_compute_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl };
+
+# Allow access to the toybox: b/275024392
+allow isolated_compute_app toolbox_exec:file rx_file_perms;
+
+# Grant GPU access to isolated_compute_app as it is required for acceleration.
+allow isolated_compute_app gpu_device:chr_file rw_file_perms;
+allow isolated_compute_app gpu_device:dir r_dir_perms;
+allow isolated_compute_app sysfs_gpu:file r_file_perms;
+
+
+#####
+##### Neverallow
+#####
+
+# Do not allow isolated_compute_app to access hardware service except for the
+# ones necessary for camera service.
+# TODO (b/266555480): The permission should be guarded by compliance test.
+# Remove the negation for member domains when refactorization is done.
+# neverallow isolated_compute_app {
+# hwservice_manager_type
+# -hal_graphics_allocator_hwservice
+# -hal_graphics_mapper_hwservice
+# -hidl_allocator_hwservice
+# -hidl_manager_hwservice
+# -hidl_memory_hwservice
+# }:hwservice_manager *;
diff --git a/prebuilts/api/202504/private/iw.te b/prebuilts/api/202504/private/iw.te
new file mode 100644
index 0000000..adc8c96
--- /dev/null
+++ b/prebuilts/api/202504/private/iw.te
@@ -0,0 +1,4 @@
+type iw, domain, coredomain;
+type iw_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(iw)
diff --git a/prebuilts/api/202504/private/kcmdlinectrl.te b/prebuilts/api/202504/private/kcmdlinectrl.te
new file mode 100644
index 0000000..d569dc0
--- /dev/null
+++ b/prebuilts/api/202504/private/kcmdlinectrl.te
@@ -0,0 +1,22 @@
+# kcmdlinectrl is a tool to have the bootloader send kernel commandline flags
+# for enabling dogfood features in the kernel
+type kcmdlinectrl, domain, coredomain;
+type kcmdlinectrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(kcmdlinectrl)
+
+# for setting kcmdline properties to match the bootloader state.
+set_prop(kcmdlinectrl, kcmdline_prop)
+
+# kcmdlinectrl communicates the request to the bootloader via the misc partition.
+# needs to write to update the request in misc partition, and read to sync
+# back to the property.
+allow kcmdlinectrl misc_block_device:blk_file rw_file_perms;
+allow kcmdlinectrl block_device:dir r_dir_perms;
+read_fstab(kcmdlinectrl)
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit kcmdlinectrl sysfs_dt_firmware_android:dir search;
+dontaudit kcmdlinectrl vendor_property_type:file read;
diff --git a/prebuilts/api/202504/private/kernel.te b/prebuilts/api/202504/private/kernel.te
new file mode 100644
index 0000000..1b82c66
--- /dev/null
+++ b/prebuilts/api/202504/private/kernel.te
@@ -0,0 +1,190 @@
+typeattribute kernel coredomain;
+
+domain_auto_trans(kernel, init_exec, init)
+domain_auto_trans(kernel, snapuserd_exec, snapuserd)
+
+# Allow the kernel to read otapreopt_chroot's file descriptors and files under
+# /postinstall, as it uses apexd logic to mount APEX packages in /postinstall/apex.
+allow kernel otapreopt_chroot:fd use;
+allow kernel postinstall_file:file read;
+
+# The following sections are for the transition period during a Virtual A/B
+# OTA. Once sepolicy is loaded, snapuserd must be re-launched in the correct
+# context, and with properly labelled devices. This must be done before
+# enabling enforcement, eg, in permissive mode while still in the kernel
+# context.
+allow kernel tmpfs:blk_file { getattr relabelfrom };
+allow kernel tmpfs:chr_file { getattr relabelfrom };
+allow kernel tmpfs:lnk_file { getattr relabelfrom };
+allow kernel tmpfs:dir { open read relabelfrom };
+
+allow kernel block_device:blk_file relabelto;
+allow kernel block_device:lnk_file relabelto;
+allow kernel dm_device:chr_file relabelto;
+allow kernel dm_device:blk_file relabelto;
+allow kernel dm_user_device:dir { read open search relabelto };
+allow kernel dm_user_device:chr_file relabelto;
+allow kernel kmsg_device:chr_file relabelto;
+allow kernel null_device:chr_file relabelto;
+allow kernel random_device:chr_file relabelto;
+allow kernel snapuserd_exec:file relabelto;
+
+allow kernel kmsg_device:chr_file write;
+allow kernel gsid:fd use;
+
+allow kernel self:global_capability_class_set sys_nice;
+
+# Root fs.
+r_dir_file(kernel, rootfs)
+
+# Used to read androidboot.selinux property
+allow kernel {
+ proc_bootconfig
+ proc_cmdline
+}:file r_file_perms;
+
+# Get SELinux enforcing status.
+allow kernel selinuxfs:dir r_dir_perms;
+allow kernel selinuxfs:file r_file_perms;
+
+# Get file contexts during first stage
+allow kernel file_contexts_file:file r_file_perms;
+
+# Allow init relabel itself.
+allow kernel rootfs:file relabelfrom;
+allow kernel init_exec:file relabelto;
+# TODO: investigate why we need this.
+allow kernel init:process share;
+
+# cgroup filesystem initialization prior to setting the cgroup root directory label.
+allow kernel unlabeled:dir search;
+
+# Mount usbfs.
+allow kernel usbfs:filesystem mount;
+allow kernel usbfs:dir search;
+
+# Initial setenforce by init prior to switching to init domain.
+# We use dontaudit instead of allow to prevent a kernel spawned userspace
+# process from turning off SELinux once enabled.
+dontaudit kernel self:security setenforce;
+
+# Write to /proc/1/oom_adj prior to switching to init domain.
+allow kernel self:global_capability_class_set sys_resource;
+
+# Init reboot before switching selinux domains under certain error
+# conditions. Allow it.
+# As part of rebooting, init writes "u" to /proc/sysrq-trigger to
+# remount filesystems read-only. /data is not mounted at this point,
+# so we could ignore this. For now, we allow it.
+allow kernel self:global_capability_class_set sys_boot;
+allow kernel proc_sysrq:file w_file_perms;
+
+# Allow writing to /dev/kmsg which was created prior to loading policy.
+allow kernel tmpfs:chr_file write;
+
+# Set checkreqprot by init.rc prior to switching to init domain.
+allow kernel selinuxfs:file write;
+allow kernel self:security setcheckreqprot;
+
+# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
+allow kernel { sdcard_type fuse }:file { read write };
+
+# f_mtp driver accesses files from kernel context.
+allow kernel mediaprovider:fd use;
+
+# Allow the kernel to read OBB files from app directories. (b/17428116)
+# Kernel thread "loop0" reads a vold supplied file descriptor.
+# Fixes CTS tests:
+# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountObbNormal
+# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountTwoObbs
+allow kernel vold:fd use;
+allow kernel { app_data_file privapp_data_file }:file read;
+allow kernel asec_image_file:file read;
+
+# Allow mounting loop device in update_engine_unittests. (b/28319454)
+# and for LTP kernel tests (b/73220071)
+userdebug_or_eng(`
+ allow kernel update_engine_data_file:file { read write };
+ allow kernel nativetest_data_file:file { read write };
+')
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow kernel media_rw_data_file:dir create_dir_perms;
+allow kernel media_rw_data_file:file create_file_perms;
+
+# Access to /data/misc/vold/virtual_disk.
+allow kernel vold_data_file:file { read write };
+
+# Allow the kernel to read APEX file descriptors and (staged) data files;
+# Needed because APEX uses the loopback driver, which issues requests from
+# a kernel thread in earlier kernel version.
+allow kernel apexd:fd use;
+allow kernel {
+ apex_data_file
+ staging_data_file
+ vendor_apex_file
+}:file read;
+# Also allow the kernel to read/write /data/local/tmp files via loop device
+# for ApexTestCases and fiemap_image_test.
+userdebug_or_eng(`
+ allow kernel shell_data_file:file { read write };
+')
+
+# Allow the first-stage init (which is running in the kernel domain) to execute the
+# dynamic linker when it re-executes /init to switch into the second stage.
+# Until Linux 4.8, the program interpreter (dynamic linker in this case) is executed
+# before the domain is switched to the target domain. So, we need to allow the kernel
+# domain (the source domain) to execute the dynamic linker (system_file type).
+# TODO(b/110147943) remove these allow rules when we no longer need to support Linux
+# kernel older than 4.8.
+allow kernel system_file:file execute;
+# The label for the dynamic linker is rootfs in the recovery partition. This is because
+# the recovery partition which is rootfs does not support xattr and thus labeling can't be
+# done at build-time. All files are by default labeled as rootfs upon booting.
+recovery_only(`
+ allow kernel rootfs:file execute;
+')
+
+# required by VTS lidbm unit test
+allow kernel appdomain_tmpfs:file { read write };
+
+dontaudit kernel metadata_file:dir search;
+dontaudit kernel ota_metadata_file:dir rw_dir_perms;
+dontaudit kernel sysfs:dir r_dir_perms;
+dontaudit kernel sysfs:file { open read write };
+dontaudit kernel sysfs:chr_file { open read write };
+dontaudit kernel dm_device:chr_file ioctl;
+dontaudit kernel self:capability { sys_admin setgid mknod };
+
+dontaudit kernel dm_user_device:dir { write add_name };
+dontaudit kernel dm_user_device:chr_file { create setattr };
+dontaudit kernel tmpfs:lnk_file read;
+dontaudit kernel tmpfs:blk_file { open read };
+
+###
+### neverallow rules
+###
+
+# The initial task starts in the kernel domain (assigned via
+# initial_sid_contexts), but nothing ever transitions to it.
+neverallow * kernel:process { transition dyntransition };
+
+# The kernel domain is never entered via an exec, nor should it
+# ever execute a program outside the rootfs without changing to another domain.
+# If you encounter an execute_no_trans denial on the kernel domain, then
+# possible causes include:
+# - The program is a kernel usermodehelper. In this case, define a domain
+# for the program and domain_auto_trans() to it.
+# - You are running an exploit which switched to the init task credentials
+# and is then trying to exec a shell or other program. You lose!
+neverallow kernel *:file { entrypoint execute_no_trans };
+
+# the kernel should not be accessing files owned by other users.
+# Instead of adding dac_{read_search,override}, fix the unix permissions
+# on files being accessed.
+neverallow kernel self:global_capability_class_set { dac_override dac_read_search };
+
+# Nobody should be ptracing kernel threads
+neverallow * kernel:process ptrace;
diff --git a/prebuilts/api/202504/private/keys.conf b/prebuilts/api/202504/private/keys.conf
new file mode 100644
index 0000000..fc50ef3
--- /dev/null
+++ b/prebuilts/api/202504/private/keys.conf
@@ -0,0 +1,37 @@
+#
+# Maps an arbitrary tag [TAGNAME] with the string contents found in
+# TARGET_BUILD_VARIANT. Common convention is to start TAGNAME with an @ and
+# name it after the base file name of the pem file.
+#
+# Each tag (section) then allows one to specify any string found in
+# TARGET_BUILD_VARIANT. Typcially this is user, eng, and userdebug. Another
+# option is to use ALL which will match ANY TARGET_BUILD_VARIANT string.
+#
+
+[@PLATFORM]
+ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem
+
+[@SDK_SANDBOX]
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/sdk_sandbox.x509.pem
+
+[@BLUETOOTH]
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/bluetooth.x509.pem
+
+[@MEDIA]
+ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
+
+[@NETWORK_STACK]
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/networkstack.x509.pem
+
+[@NFC]
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/nfc.x509.pem
+
+[@SHARED]
+ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
+
+# Example of ALL TARGET_BUILD_VARIANTS
+[@RELEASE]
+ENG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
+USER : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
+USERDEBUG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
+
diff --git a/prebuilts/api/202504/private/keystore.te b/prebuilts/api/202504/private/keystore.te
new file mode 100644
index 0000000..41c29db
--- /dev/null
+++ b/prebuilts/api/202504/private/keystore.te
@@ -0,0 +1,107 @@
+typeattribute keystore coredomain;
+
+init_daemon_domain(keystore)
+
+# talk to keymaster
+hal_client_domain(keystore, hal_keymaster)
+
+# talk to confirmationui
+hal_client_domain(keystore, hal_confirmationui)
+
+# talk to keymint
+hal_client_domain(keystore, hal_keymint)
+
+# This is used for the ConfirmationUI async callback.
+allow keystore platform_app:binder call;
+
+# Allow to check whether security logging is enabled.
+get_prop(keystore, device_logging_prop)
+
+# Allow keystore to check if the system is rkp only.
+get_prop(keystore, remote_prov_prop)
+
+# Allow keystore to check whether to post-process RKP certificates
+get_prop(keystore, remote_prov_cert_prop)
+
+# Allow keystore to check rkpd feature flags
+get_prop(keystore, device_config_remote_key_provisioning_native_prop)
+
+# Allow keystore to write to statsd.
+unix_socket_send(keystore, statsdw, statsd)
+
+# Keystore need access to the keystore2_key_contexts file to load the keystore key backend.
+allow keystore keystore2_key_contexts_file:file r_file_perms;
+
+# Allow keystore to listen to changing boot levels
+get_prop(keystore, keystore_listen_prop)
+
+# Keystore needs to transfer binder references to vold so that it
+# can call keystore methods on those references.
+allow keystore vold:binder transfer;
+
+set_prop(keystore, keystore_diagnostics_prop)
+
+# Allow keystore to monitor the `apexd.status` property.
+get_prop(keystore, apexd_prop)
+
+# keystore is using apex_info via libvintf
+use_apex_info(keystore)
+
+typeattribute keystore mlstrustedsubject;
+binder_use(keystore)
+binder_service(keystore)
+binder_call(keystore, remote_provisioning_service_server)
+binder_call(keystore, rkp_cert_processor)
+binder_call(keystore, system_server)
+binder_call(keystore, wificond)
+
+allow keystore keystore_data_file:dir create_dir_perms;
+allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
+allow keystore keystore_exec:file { getattr };
+
+add_service(keystore, keystore_service)
+allow keystore sec_key_att_app_id_provider_service:service_manager find;
+allow keystore remote_provisioning_service:service_manager find;
+allow keystore rkp_cert_processor_service:service_manager find;
+
+# Allow keystore to communicate to apexd
+allow keystore apex_service:service_manager find;
+allow keystore apexd:binder call;
+
+add_service(keystore, apc_service)
+add_service(keystore, keystore_compat_hal_service)
+add_service(keystore, authorization_service)
+add_service(keystore, keystore_maintenance_service)
+add_service(keystore, keystore_metrics_service)
+add_service(keystore, legacykeystore_service)
+
+# Check SELinux permissions.
+selinux_check_access(keystore)
+
+r_dir_file(keystore, cgroup)
+r_dir_file(keystore, cgroup_v2)
+
+# The software KeyMint implementation used in km_compat needs
+# to read the vendor security patch level.
+get_prop(keystore, vendor_security_patch_level_prop);
+
+# Allow keystore to read its vendor configuration
+get_prop(keystore, keystore_config_prop)
+
+###
+### Neverallow rules
+###
+### Protect ourself from others
+###
+
+neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
+
+neverallow { domain -keystore -init } keystore_data_file:dir *;
+neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
+
+neverallow * keystore:process ptrace;
+
+# Only keystore can set keystore_diagnostics_prop system properties. Since init is allowed to set
+# any system property, an exception is added for init as well.
+neverallow { domain -keystore -init } keystore_diagnostics_prop:property_service set;
diff --git a/prebuilts/api/202504/private/keystore2_key_contexts b/prebuilts/api/202504/private/keystore2_key_contexts
new file mode 100644
index 0000000..868bf15
--- /dev/null
+++ b/prebuilts/api/202504/private/keystore2_key_contexts
@@ -0,0 +1,28 @@
+# Keystore 2.0 key contexts.
+# This file defines Keystore 2.0 namespaces and maps them to labels.
+# Format:
+# <namespace> <label>
+#
+# <namespace> must be an integer in the interval [0 ... 2^31)
+# su_key is a keystore2_key namespace for the su domain intended for native tests.
+0 u:object_r:su_key:s0
+
+# shell_key is a keystore2_key namespace for the shell domain intended for native tests.
+1 u:object_r:shell_key:s0
+
+# vold_key is a keystore2_key namespace for vold. It allows using raw Keymint blobs.
+100 u:object_r:vold_key:s0
+
+# odsign_key is a keystore2_key namespace for the on-device signing daemon.
+101 u:object_r:odsign_key:s0
+
+# wifi_key is a keystore2_key namespace for the WI-FI subsystem. It replaces the WIFI_UID
+# namespace in keystore.
+102 u:object_r:wifi_key:s0
+
+# locksettings_key is a keystore2_key namespace for the LockSettingsService.
+103 u:object_r:locksettings_key:s0
+
+# resume_on_reboot_key is a keystore2_key namespace intended for resume on reboot.
+120 u:object_r:resume_on_reboot_key:s0
+
diff --git a/prebuilts/api/202504/private/keystore_keys.te b/prebuilts/api/202504/private/keystore_keys.te
new file mode 100644
index 0000000..2f97608
--- /dev/null
+++ b/prebuilts/api/202504/private/keystore_keys.te
@@ -0,0 +1,22 @@
+# Specify keystore2_key namespaces in this file.
+# Please keep the names in alphabetical order and comment each new entry.
+
+# A keystore2_key namespace for the shell domain. Mainly used for native tests.
+type shell_key, keystore2_key_type;
+
+# A keystore2 namespace for the su domain. Mainly used for native tests.
+type su_key, keystore2_key_type;
+
+# A keystore2 namespace for vold. Vold need special permission to handle
+# its own Keymint blobs.
+type vold_key, keystore2_key_type;
+
+# A keystore2 namespace for the on-device signing daemon.
+type odsign_key, keystore2_key_type;
+
+# A keystore2 namespace for LockSettingsService.
+type locksettings_key, keystore2_key_type;
+
+# A keystore2 namespace for resume on reboot.
+type resume_on_reboot_key, keystore2_key_type;
+
diff --git a/prebuilts/api/202504/private/linkerconfig.te b/prebuilts/api/202504/private/linkerconfig.te
new file mode 100644
index 0000000..ce26fd2
--- /dev/null
+++ b/prebuilts/api/202504/private/linkerconfig.te
@@ -0,0 +1,39 @@
+type linkerconfig, domain, coredomain;
+type linkerconfig_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(linkerconfig)
+
+## Read and write linkerconfig subdirectory.
+allow linkerconfig linkerconfig_file:dir create_dir_perms;
+allow linkerconfig linkerconfig_file:file create_file_perms;
+
+# Allow linkerconfig to log to the kernel.
+allow linkerconfig kmsg_device:chr_file w_file_perms;
+
+# Allow linkerconfig to be invoked with logwrapper from init.
+allow linkerconfig devpts:chr_file { getattr ioctl read write };
+
+# Allow linkerconfig to scan for apex modules
+allow linkerconfig apex_mnt_dir:dir r_dir_perms;
+
+# Allow linkerconfig to read apex-info-list.xml
+allow linkerconfig apex_info_file:file r_file_perms;
+
+# Allow linkerconfig to read apex_manifest.pb file from vendor apex
+r_dir_file(linkerconfig, vendor_apex_metadata_file)
+
+# Allow linkerconfig to be called in the otapreopt_chroot
+allow linkerconfig otapreopt_chroot:fd use;
+allow linkerconfig postinstall_apex_mnt_dir:dir r_dir_perms;
+allow linkerconfig postinstall_apex_mnt_dir:file r_file_perms;
+
+# Allow for use in Pre-reboot Dexopt.
+allow linkerconfig dexopt_chroot_setup:fd use;
+
+neverallow {
+ domain
+ -dexopt_chroot_setup
+ -init
+ -linkerconfig
+ -otapreopt_chroot
+} linkerconfig_exec:file no_x_file_perms;
diff --git a/prebuilts/api/202504/private/linux_vm_setup.te b/prebuilts/api/202504/private/linux_vm_setup.te
new file mode 100644
index 0000000..ba483e8
--- /dev/null
+++ b/prebuilts/api/202504/private/linux_vm_setup.te
@@ -0,0 +1,6 @@
+type linux_vm_setup, domain, coredomain;
+type linux_vm_setup_exec, system_file_type, exec_type, file_type;
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ init_daemon_domain(linux_vm_setup)
+')
diff --git a/prebuilts/api/202504/private/llkd.te b/prebuilts/api/202504/private/llkd.te
new file mode 100644
index 0000000..9c96dfb
--- /dev/null
+++ b/prebuilts/api/202504/private/llkd.te
@@ -0,0 +1,53 @@
+# llkd Live LocK Daemon
+typeattribute llkd coredomain;
+
+init_daemon_domain(llkd)
+
+get_prop(llkd, llkd_prop)
+
+allow llkd self:global_capability_class_set kill;
+userdebug_or_eng(`
+ allow llkd self:global_capability_class_set { sys_ptrace sys_admin };
+ allow llkd self:global_capability_class_set { dac_override dac_read_search };
+')
+
+# llkd optionally locks itself in memory, to prevent it from being
+# swapped out and unable to discover a kernel in live-lock state.
+allow llkd self:global_capability_class_set ipc_lock;
+
+# Send kill signals to _anyone_ suffering from Live Lock
+allow llkd domain:process sigkill;
+
+# read stack to check for Live Lock
+userdebug_or_eng(`
+ allow llkd {
+ domain
+ -apexd
+ -kernel
+ -keystore
+ -init
+ -llkd
+ -ueventd
+ -vendor_init
+ }:process ptrace;
+')
+
+# live lock watchdog process allowed to look through /proc/
+allow llkd domain:dir r_dir_perms;
+allow llkd domain:file r_file_perms;
+allow llkd domain:lnk_file read;
+# Set /proc/sys/kernel/hung_task_*
+allow llkd proc_hung_task:file rw_file_perms;
+
+# live lock watchdog process allowed to dump process trace and
+# reboot because orderly shutdown may not be possible.
+allow llkd proc_sysrq:file rw_file_perms;
+allow llkd kmsg_device:chr_file w_file_perms;
+
+### neverallow rules
+
+neverallow { domain -init } llkd:process { dyntransition transition };
+neverallow { domain userdebug_or_eng(`-crash_dump') } llkd:process ptrace;
+
+# never honor LD_PRELOAD
+neverallow * llkd:process noatsecure;
diff --git a/prebuilts/api/202504/private/lmkd.te b/prebuilts/api/202504/private/lmkd.te
new file mode 100644
index 0000000..97dc398
--- /dev/null
+++ b/prebuilts/api/202504/private/lmkd.te
@@ -0,0 +1,95 @@
+typeattribute lmkd coredomain;
+typeattribute lmkd bpfdomain;
+
+init_daemon_domain(lmkd)
+
+# Set sys.lmk.* properties.
+set_prop(lmkd, system_lmk_prop)
+
+# Set lmkd.* properties.
+set_prop(lmkd, lmkd_prop)
+
+# Get persist.device_config.lmk_native.* properties.
+get_prop(lmkd, device_config_lmkd_native_prop)
+
+# Needed for reading tracepoint ids in order to attach bpf programs.
+allow lmkd debugfs_tracing:file r_file_perms;
+allow lmkd self:perf_event { cpu kernel open write };
+
+allow lmkd fs_bpf:file read;
+allow lmkd bpfloader:bpf { map_read map_write prog_run };
+
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow lmkd fs_bpf_memevents:file { read write };
+allow lmkd fs_bpf_memevents:dir search;
+
+allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_resource kill };
+
+# lmkd locks itself in memory, to prevent it from being
+# swapped out and unable to kill other memory hogs.
+# system/core commit b28ff9131363f7b4a698990da5748b2a88c3ed35
+# b/16236289
+allow lmkd self:global_capability_class_set ipc_lock;
+
+## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns
+## TODO: maybe scope this down?
+r_dir_file(lmkd, domain)
+allow lmkd domain:file write;
+
+## Writes to /sys/module/lowmemorykiller/parameters/minfree
+r_dir_file(lmkd, sysfs_lowmemorykiller)
+allow lmkd sysfs_lowmemorykiller:file w_file_perms;
+
+# setsched and send kill signals to any registered process
+allow lmkd domain:process { setsched sigkill };
+# TODO: delete this line b/131761776
+allow lmkd kernel:process { setsched };
+
+# Clean up old cgroups
+allow lmkd cgroup:dir { remove_name rmdir };
+allow lmkd cgroup_v2:dir { remove_name rmdir };
+
+# Allow to read memcg stats
+allow lmkd cgroup:file r_file_perms;
+allow lmkd cgroup_v2:file r_file_perms;
+
+# Set self to SCHED_FIFO
+allow lmkd self:global_capability_class_set sys_nice;
+
+allow lmkd proc_zoneinfo:file r_file_perms;
+allow lmkd proc_vmstat:file r_file_perms;
+
+# live lock watchdog process allowed to look through /proc/
+allow lmkd domain:dir { search open read };
+allow lmkd domain:file { open read };
+
+# live lock watchdog process allowed to dump process trace and
+# reboot because orderly shutdown may not be possible.
+allow lmkd proc_sysrq:file rw_file_perms;
+
+# Read /proc/lowmemorykiller
+allow lmkd proc_lowmemorykiller:file r_file_perms;
+
+# Read /proc/meminfo
+allow lmkd proc_meminfo:file r_file_perms;
+
+# Read /proc/pressure/cpu and /proc/pressure/io
+allow lmkd proc_pressure_cpu:file r_file_perms;
+allow lmkd proc_pressure_io:file r_file_perms;
+
+# Read/Write /proc/pressure/memory
+allow lmkd proc_pressure_mem:file rw_file_perms;
+
+# Allow lmkd to connect during reinit.
+allow lmkd lmkd_socket:sock_file write;
+
+# Allow lmkd to write to statsd.
+unix_socket_send(lmkd, statsdw, statsd)
+
+### neverallow rules
+
+# never honor LD_PRELOAD
+neverallow * lmkd:process noatsecure;
+neverallow lmkd self:global_capability_class_set sys_ptrace;
+neverallow { domain -init -lmkd -vendor_init } lmkd_prop:property_service set;
+neverallow lmkd self:perf_event ~{ cpu kernel open write };
diff --git a/prebuilts/api/202504/private/logd.te b/prebuilts/api/202504/private/logd.te
new file mode 100644
index 0000000..b6e8b27
--- /dev/null
+++ b/prebuilts/api/202504/private/logd.te
@@ -0,0 +1,127 @@
+typeattribute logd coredomain;
+
+init_daemon_domain(logd)
+
+# Access device logging gating property
+get_prop(logd, device_logging_prop)
+
+# logd is not allowed to write anywhere other than /data/misc/logd, and then
+# only on userdebug or eng builds
+neverallow logd {
+ file_type
+ -runtime_event_log_tags_file
+ # shell_data_file access is needed to dump bugreports
+ -shell_data_file
+ userdebug_or_eng(`-coredump_file -misc_logd_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file { create write append };
+
+# protect the event-log-tags file
+neverallow {
+ domain
+ -appdomain # covered below
+ -bootstat
+ -dumpstate
+ -init
+ -logd
+ userdebug_or_eng(`-logpersist')
+ -servicemanager
+ -system_server
+ -surfaceflinger
+ -zygote
+} runtime_event_log_tags_file:file no_rw_file_perms;
+
+neverallow {
+ appdomain
+ -bluetooth
+ -platform_app
+ -priv_app
+ -radio
+ -shell
+ userdebug_or_eng(`-su')
+ -system_app
+} runtime_event_log_tags_file:file no_rw_file_perms;
+
+# Only binder communication between logd and system_server is allowed
+binder_use(logd)
+binder_service(logd)
+binder_call(logd, system_server)
+
+add_service(logd, logd_service)
+allow logd logcat_service:service_manager find;
+
+# Read access to pseudo filesystems.
+r_dir_file(logd, cgroup)
+r_dir_file(logd, cgroup_v2)
+r_dir_file(logd, proc_kmsg)
+r_dir_file(logd, proc_meminfo)
+
+allow logd self:global_capability_class_set { setuid setgid setpcap sys_nice audit_control };
+allow logd self:global_capability2_class_set syslog;
+allow logd self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write };
+allow logd kernel:system syslog_read;
+allow logd kmsg_device:chr_file { getattr w_file_perms };
+allow logd system_data_file:{ file lnk_file } r_file_perms;
+allow logd packages_list_file:file r_file_perms;
+allow logd pstorefs:dir search;
+allow logd pstorefs:file r_file_perms;
+userdebug_or_eng(`
+ # Access to /data/misc/logd/event-log-tags
+ allow logd misc_logd_file:dir r_dir_perms;
+ allow logd misc_logd_file:file rw_file_perms;
+')
+allow logd runtime_event_log_tags_file:file rw_file_perms;
+
+r_dir_file(logd, domain)
+
+allow logd kernel:system syslog_mod;
+
+control_logd(logd)
+read_runtime_log_tags(logd)
+
+allow runtime_event_log_tags_file tmpfs:filesystem associate;
+# Typically harmlessly blindly trying to access via liblog
+# event tag mapping while in the untrusted_app domain.
+# Access for that domain is controlled and gated via the
+# event log tag service (albeit at a performance penalty,
+# expected to be locally cached).
+dontaudit domain runtime_event_log_tags_file:file { map open read };
+
+# Logd sets defaults if certain properties are empty.
+set_prop(logd, logd_prop)
+
+###
+### Neverallow rules
+###
+### logd should NEVER do any of this
+
+# Block device access.
+neverallow logd dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow logd domain:process ptrace;
+
+# ... and nobody may ptrace me (except on userdebug or eng builds)
+neverallow { domain userdebug_or_eng(`-crash_dump -llkd') } logd:process ptrace;
+
+# Write to /system.
+neverallow logd system_file_type:dir_file_class_set write;
+
+# Write to files in /data/data or system files on /data
+neverallow logd {
+ app_data_file_type
+ system_data_file
+ packages_list_file
+ -shell_data_file # for bugreports
+}:dir_file_class_set write;
+
+# Only init is allowed to enter the logd domain via exec()
+neverallow { domain -init } logd:process transition;
+neverallow * logd:process dyntransition;
+
+# protect the event-log-tags file
+neverallow {
+ domain
+ -init
+ -logd
+} runtime_event_log_tags_file:file no_w_file_perms;
diff --git a/prebuilts/api/202504/private/logpersist.te b/prebuilts/api/202504/private/logpersist.te
new file mode 100644
index 0000000..34022d6
--- /dev/null
+++ b/prebuilts/api/202504/private/logpersist.te
@@ -0,0 +1,64 @@
+typeattribute logpersist coredomain;
+
+# android debug log storage in logpersist domains (eng and userdebug only)
+userdebug_or_eng(`
+
+ r_dir_file(logpersist, cgroup)
+ r_dir_file(logpersist, cgroup_v2)
+
+ allow logpersist misc_logd_file:file create_file_perms;
+ allow logpersist misc_logd_file:dir rw_dir_perms;
+
+ allow logpersist self:global_capability_class_set sys_nice;
+ allow logpersist pstorefs:dir search;
+ allow logpersist pstorefs:file r_file_perms;
+
+ control_logd(logpersist)
+ unix_socket_connect(logpersist, logdr, logd)
+ get_prop(logpersist, logd_prop)
+ read_runtime_log_tags(logpersist)
+
+')
+
+# logcatd is a shell script that execs logcat with various parameters.
+allow logpersist shell_exec:file rx_file_perms;
+allow logpersist logcat_exec:file rx_file_perms;
+
+allowxperm logpersist misc_logd_file:file ioctl {
+ F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+ FS_IOC_SETFLAGS
+};
+
+###
+### Neverallow rules
+###
+### logpersist should NEVER do any of this
+
+# Block device access.
+neverallow logpersist dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow logpersist domain:process ptrace;
+
+# Write to files in /data/data or system files on /data except misc_logd_file
+neverallow logpersist { app_data_file_type system_data_file }:dir_file_class_set write;
+
+# Only init should be allowed to enter the logpersist domain via exec()
+# Following is a list of debug domains we know that transition to logpersist
+# neverallow_with_undefined_domains {
+# domain
+# -init # goldfish, logcatd, raft
+# -mmi # bat, mtp8996, msmcobalt
+# -system_app # Smith.apk
+# } logpersist:process transition;
+neverallow * logpersist:process dyntransition;
+
+# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
+neverallow logpersist {
+ file_type
+ userdebug_or_eng(`-misc_logd_file -coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file { create write append };
+neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
+neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
+neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
diff --git a/prebuilts/api/202504/private/lpdumpd.te b/prebuilts/api/202504/private/lpdumpd.te
new file mode 100644
index 0000000..09ba079
--- /dev/null
+++ b/prebuilts/api/202504/private/lpdumpd.te
@@ -0,0 +1,47 @@
+type lpdumpd, domain, coredomain;
+type lpdumpd_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(lpdumpd)
+
+# Allow lpdumpd to register itself as a service.
+binder_use(lpdumpd)
+add_service(lpdumpd, lpdump_service)
+
+# Allow lpdumpd to find the super partition block device.
+allow lpdumpd block_device:dir r_dir_perms;
+
+# Allow lpdumpd to read super partition metadata.
+allow lpdumpd super_block_device_type:blk_file r_file_perms;
+
+# Allow lpdumpd to read fstab.
+allow lpdumpd sysfs_dt_firmware_android:dir r_dir_perms;
+allow lpdumpd sysfs_dt_firmware_android:file r_file_perms;
+read_fstab(lpdumpd)
+
+# Allow to get A/B slot suffix from device tree or kernel cmdline.
+r_dir_file(lpdumpd, sysfs_dt_firmware_android);
+allow lpdumpd proc_cmdline:file r_file_perms;
+
+# Allow reading Virtual A/B status information.
+get_prop(lpdumpd, virtual_ab_prop)
+allow lpdumpd metadata_file:dir search;
+allow lpdumpd ota_metadata_file:dir { r_dir_perms lock };
+allow lpdumpd ota_metadata_file:file r_file_perms;
+
+### Neverallow rules
+
+# Disallow other domains to get lpdump_service and call lpdumpd.
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+} lpdump_service:service_manager find;
+
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+ -servicemanager
+} lpdumpd:binder call;
diff --git a/prebuilts/api/202504/private/mac_permissions.xml b/prebuilts/api/202504/private/mac_permissions.xml
new file mode 100644
index 0000000..fa8ffcf
--- /dev/null
+++ b/prebuilts/api/202504/private/mac_permissions.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy>
+
+<!--
+
+ * A signature is a hex encoded X.509 certificate or a tag defined in
+ keys.conf and is required for each signer tag. The signature can
+ either appear as a set of attached cert child tags or as an attribute.
+ * A signer tag must contain a seinfo tag XOR multiple package stanzas.
+ * Each signer/package tag is allowed to contain one seinfo tag. This tag
+ represents additional info that each app can use in setting a SELinux security
+ context on the eventual process as well as the apps data directory.
+ * seinfo assignments are made according to the following rules:
+ - Stanzas with package name refinements will be checked first.
+ - Stanzas w/o package name refinements will be checked second.
+ - The "default" seinfo label is automatically applied.
+
+ * valid stanzas can take one of the following forms:
+
+ // single cert protecting seinfo
+ <signer signature="@PLATFORM" >
+ <seinfo value="platform" />
+ </signer>
+
+ // multiple certs protecting seinfo (all contained certs must match)
+ <signer>
+ <cert signature="@PLATFORM1"/>
+ <cert signature="@PLATFORM2"/>
+ <seinfo value="platform" />
+ </signer>
+
+ // single cert protecting explicitly named app
+ <signer signature="@PLATFORM" >
+ <package name="com.android.foo">
+ <seinfo value="bar" />
+ </package>
+ </signer>
+
+ // multiple certs protecting explicitly named app (all certs must match)
+ <signer>
+ <cert signature="@PLATFORM1"/>
+ <cert signature="@PLATFORM2"/>
+ <package name="com.android.foo">
+ <seinfo value="bar" />
+ </package>
+ </signer>
+-->
+
+ <!-- Platform dev key in AOSP -->
+ <signer signature="@PLATFORM" >
+ <seinfo value="platform" />
+ </signer>
+
+ <!-- Sdk Sandbox key -->
+ <signer signature="@SDK_SANDBOX" >
+ <seinfo value="sdk_sandbox" />
+ </signer>
+
+ <!-- Bluetooth key in AOSP -->
+ <signer signature="@BLUETOOTH" >
+ <seinfo value="bluetooth" />
+ </signer>
+
+ <!-- Media key in AOSP -->
+ <signer signature="@MEDIA" >
+ <seinfo value="media" />
+ </signer>
+
+ <signer signature="@NETWORK_STACK" >
+ <seinfo value="network_stack" />
+ </signer>
+
+ <!-- NFC key in AOSP -->
+ <signer signature="@NFC" >
+ <seinfo value="nfc" />
+ </signer>
+</policy>
diff --git a/prebuilts/api/202504/private/mdnsd.te b/prebuilts/api/202504/private/mdnsd.te
new file mode 100644
index 0000000..98e95da
--- /dev/null
+++ b/prebuilts/api/202504/private/mdnsd.te
@@ -0,0 +1,12 @@
+# mdns daemon
+
+typeattribute mdnsd coredomain;
+typeattribute mdnsd mlstrustedsubject;
+
+type mdnsd_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(mdnsd)
+
+net_domain(mdnsd)
+
+# Read from /proc/net
+r_dir_file(mdnsd, proc_net_type)
diff --git a/prebuilts/api/202504/private/mediadrmserver.te b/prebuilts/api/202504/private/mediadrmserver.te
new file mode 100644
index 0000000..fdc7681
--- /dev/null
+++ b/prebuilts/api/202504/private/mediadrmserver.te
@@ -0,0 +1,37 @@
+typeattribute mediadrmserver coredomain;
+
+init_daemon_domain(mediadrmserver)
+
+# allocate and use graphic buffers
+hal_client_domain(mediadrmserver, hal_graphics_allocator)
+auditallow mediadrmserver hal_graphics_allocator_server:binder call;
+
+typeattribute mediadrmserver mlstrustedsubject;
+
+net_domain(mediadrmserver)
+binder_use(mediadrmserver)
+binder_call(mediadrmserver, binderservicedomain)
+binder_call(mediadrmserver, appdomain)
+binder_service(mediadrmserver)
+hal_client_domain(mediadrmserver, hal_drm)
+
+add_service(mediadrmserver, mediadrmserver_service)
+allow mediadrmserver mediaserver_service:service_manager find;
+allow mediadrmserver mediametrics_service:service_manager find;
+allow mediadrmserver processinfo_service:service_manager find;
+allow mediadrmserver surfaceflinger_service:service_manager find;
+allow mediadrmserver system_file:dir r_dir_perms;
+
+# TODO(b/80317992): remove
+binder_call(mediadrmserver, hal_omx_server)
+
+###
+### neverallow rules
+###
+
+# mediadrmserver should never execute any executable without a
+# domain transition
+neverallow mediadrmserver { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
diff --git a/prebuilts/api/202504/private/mediaextractor.te b/prebuilts/api/202504/private/mediaextractor.te
new file mode 100644
index 0000000..c800d89
--- /dev/null
+++ b/prebuilts/api/202504/private/mediaextractor.te
@@ -0,0 +1,78 @@
+typeattribute mediaextractor coredomain;
+
+init_daemon_domain(mediaextractor)
+tmpfs_domain(mediaextractor)
+allow mediaextractor appdomain_tmpfs:file { getattr map read write };
+allow mediaextractor mediaserver_tmpfs:file { getattr map read write };
+allow mediaextractor system_server_tmpfs:file { getattr map read write };
+
+get_prop(mediaextractor, device_config_media_native_prop)
+get_prop(mediaextractor, device_config_swcodec_native_prop)
+
+typeattribute mediaextractor mlstrustedsubject;
+
+binder_use(mediaextractor)
+binder_call(mediaextractor, binderservicedomain)
+binder_call(mediaextractor, appdomain)
+binder_service(mediaextractor)
+
+add_service(mediaextractor, mediaextractor_service)
+allow mediaextractor mediametrics_service:service_manager find;
+allow mediaextractor hidl_token_hwservice:hwservice_manager find;
+
+allow mediaextractor system_server:fd use;
+
+hal_client_domain(mediaextractor, hal_cas)
+hal_client_domain(mediaextractor, hal_allocator)
+
+r_dir_file(mediaextractor, cgroup)
+r_dir_file(mediaextractor, cgroup_v2)
+allow mediaextractor proc_meminfo:file r_file_perms;
+
+crash_dump_fallback(mediaextractor)
+
+# allow mediaextractor read permissions for file sources
+allow mediaextractor { sdcard_type fuse }:file { getattr read };
+allow mediaextractor media_rw_data_file:file { getattr read };
+allow mediaextractor { app_data_file privapp_data_file }:file { getattr read };
+
+# Read resources from open apk files passed over Binder
+allow mediaextractor apk_data_file:file { read getattr };
+allow mediaextractor asec_apk_file:file { read getattr };
+allow mediaextractor ringtone_file:file { read getattr };
+
+# overlay package access
+allow mediaextractor vendor_overlay_file:file { read map };
+
+# scan extractor library directory to dynamically load extractors
+allow mediaextractor system_file:dir { read open };
+
+###
+### neverallow rules
+###
+
+# mediaextractor should never execute any executable without a
+# domain transition
+neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediaextractor domain:{ udp_socket rawip_socket } *;
+neverallow mediaextractor { domain userdebug_or_eng(`-su') }:tcp_socket *;
+
+# mediaextractor should not be opening /data files directly. Any files
+# it touches (with a few exceptions) need to be passed to it via a file
+# descriptor opened outside the process.
+neverallow mediaextractor {
+ data_file_type
+ userdebug_or_eng(`-apk_data_file') # for loading media extractor plugins
+ with_native_coverage(`-method_trace_data_file')
+}:file open;
diff --git a/prebuilts/api/202504/private/mediametrics.te b/prebuilts/api/202504/private/mediametrics.te
new file mode 100644
index 0000000..bb12900
--- /dev/null
+++ b/prebuilts/api/202504/private/mediametrics.te
@@ -0,0 +1,50 @@
+typeattribute mediametrics coredomain;
+
+init_daemon_domain(mediametrics)
+
+# Needed for stats callback registration to statsd.
+allow mediametrics stats_service:service_manager find;
+allow mediametrics statsmanager_service:service_manager find;
+binder_call(mediametrics, statsd)
+
+binder_use(mediametrics)
+binder_call(mediametrics, binderservicedomain)
+binder_service(mediametrics)
+
+add_service(mediametrics, mediametrics_service)
+
+allow mediametrics system_server:fd use;
+
+r_dir_file(mediametrics, cgroup)
+r_dir_file(mediametrics, cgroup_v2)
+allow mediametrics proc_meminfo:file r_file_perms;
+
+# allows interactions with dumpsys to GMScore
+allow mediametrics { app_data_file privapp_data_file }:file write;
+
+# allow access to package manager for uid->apk mapping
+allow mediametrics package_native_service:service_manager find;
+
+# Allow metrics service to send information to statsd socket.
+unix_socket_send(mediametrics, statsdw, statsd)
+
+###
+### neverallow rules
+###
+
+# mediametrics should never execute any executable without a
+# domain transition
+neverallow mediametrics { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediametrics domain:{ udp_socket rawip_socket } *;
+neverallow mediametrics { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/mediaprovider.te b/prebuilts/api/202504/private/mediaprovider.te
new file mode 100644
index 0000000..545d9ea
--- /dev/null
+++ b/prebuilts/api/202504/private/mediaprovider.te
@@ -0,0 +1,49 @@
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+typeattribute mediaprovider coredomain;
+app_domain(mediaprovider)
+
+# DownloadProvider accesses the network.
+net_domain(mediaprovider)
+
+# DownloadProvider uses /cache.
+allow mediaprovider cache_file:dir create_dir_perms;
+allow mediaprovider cache_file:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow mediaprovider cache_file:lnk_file r_file_perms;
+# mediaprovider searches through /cache looking for orphans
+# Ignore denials to /cache/recovery and /cache/backup.
+dontaudit mediaprovider cache_private_backup_file:dir getattr;
+dontaudit mediaprovider cache_recovery_file:dir getattr;
+
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider { mnt_media_rw_file }:dir search;
+
+allow mediaprovider app_api_service:service_manager find;
+allow mediaprovider audioserver_service:service_manager find;
+allow mediaprovider cameraserver_service:service_manager find;
+allow mediaprovider drmserver_service:service_manager find;
+allow mediaprovider mediaextractor_service:service_manager find;
+allow mediaprovider mediaserver_service:service_manager find;
+
+# Allow MediaProvider to read/write cached ringtones (opened by system).
+allow mediaprovider ringtone_file:file { getattr read write };
+
+# MtpServer uses /dev/mtp_usb
+allow mediaprovider mtp_device:chr_file rw_file_perms;
+
+# MtpServer uses /dev/usb-ffs/mtp
+allow mediaprovider functionfs:dir search;
+allow mediaprovider functionfs:file rw_file_perms;
+allowxperm mediaprovider functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC;
+allowxperm mediaprovider functionfs:file ioctl FUNCTIONFS_ENDPOINT_ALLOC;
+
+# MtpServer sets sys.usb.ffs.mtp.ready
+get_prop(mediaprovider, ffs_config_prop)
+set_prop(mediaprovider, ffs_control_prop)
+
+# DownloadManager may retrieve DRM status
+get_prop(mediaprovider, drm_service_config_prop)
diff --git a/prebuilts/api/202504/private/mediaprovider_app.te b/prebuilts/api/202504/private/mediaprovider_app.te
new file mode 100644
index 0000000..064d0d9
--- /dev/null
+++ b/prebuilts/api/202504/private/mediaprovider_app.te
@@ -0,0 +1,78 @@
+###
+### A domain for further sandboxing the MediaProvider mainline module.
+###
+type mediaprovider_app, domain, coredomain, bpfdomain;
+
+app_domain(mediaprovider_app)
+
+# Access to /mnt/pass_through.
+r_dir_file(mediaprovider_app, mnt_pass_through_file)
+
+# Allow MediaProvider to host a FUSE daemon for external storage
+allow mediaprovider_app fuse_device:chr_file { read write ioctl getattr };
+
+# Allow MediaProvider to access fuseblk devices for external storage.
+allow mediaprovider_app fuseblk:dir create_dir_perms;
+allow mediaprovider_app fuseblk:file create_file_perms;
+
+# Allow MediaProvider to read/write media_rw_data_file files and dirs
+allow mediaprovider_app media_userdir_file:dir r_dir_perms;
+allow mediaprovider_app media_rw_data_file:file create_file_perms;
+allow mediaprovider_app media_rw_data_file:dir create_dir_perms;
+
+# Talk to the DRM service
+allow mediaprovider_app drmserver_service:service_manager find;
+
+# Talk to the MediaServer service
+allow mediaprovider_app mediaserver_service:service_manager find;
+
+# Talk to the AudioServer service
+allow mediaprovider_app audioserver_service:service_manager find;
+
+# Talk to the MediaCodec APIs that log media metrics
+allow mediaprovider_app mediametrics_service:service_manager find;
+
+# Talk to regular app services
+allow mediaprovider_app app_api_service:service_manager find;
+
+# Talk to the GPU service
+binder_call(mediaprovider_app, gpuservice)
+
+# Talk to statsd
+allow mediaprovider_app statsmanager_service:service_manager find;
+binder_call(mediaprovider_app, statsd)
+
+# read pipe-max-size configuration
+allow mediaprovider_app proc_pipe_conf:file r_file_perms;
+
+# Allow MediaProvider to set extended attributes (such as quota project ID)
+# on media files.
+allowxperm mediaprovider_app media_rw_data_file:{ dir file } ioctl {
+ FS_IOC_FSGETXATTR
+ FS_IOC_FSSETXATTR
+ FS_IOC_GETFLAGS
+ FS_IOC_SETFLAGS
+};
+
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider_app { mnt_media_rw_file }:dir search;
+
+allow mediaprovider_app proc_filesystems:file r_file_perms;
+
+#Allow MediaProvider to see if sdcardfs is in use
+get_prop(mediaprovider_app, storage_config_prop)
+
+get_prop(mediaprovider_app, drm_service_config_prop)
+
+allow mediaprovider_app gpu_device:chr_file rw_file_perms;
+allow mediaprovider_app gpu_device:dir r_dir_perms;
+
+dontaudit mediaprovider_app sysfs_vendor_sched:dir search;
+dontaudit mediaprovider_app sysfs_vendor_sched:file w_file_perms;
+
+# bpfprog access for FUSE BPF
+allow mediaprovider_app fs_bpf:file read;
+allow mediaprovider_app bpfloader:bpf { map_read map_write prog_run };
+
+# boot animations on oem are stored with specific label
+allow mediaprovider_app bootanim_oem_file:file r_file_perms;
diff --git a/prebuilts/api/202504/private/mediaserver.te b/prebuilts/api/202504/private/mediaserver.te
new file mode 100644
index 0000000..d72caf6
--- /dev/null
+++ b/prebuilts/api/202504/private/mediaserver.te
@@ -0,0 +1,189 @@
+typeattribute mediaserver coredomain;
+
+init_daemon_domain(mediaserver)
+tmpfs_domain(mediaserver)
+allow mediaserver appdomain_tmpfs:file { getattr map read write };
+
+# allocate and use graphic buffers
+hal_client_domain(mediaserver, hal_graphics_allocator)
+hal_client_domain(mediaserver, hal_configstore)
+hal_client_domain(mediaserver, hal_drm)
+hal_client_domain(mediaserver, hal_omx)
+hal_client_domain(mediaserver, hal_codec2)
+
+set_prop(mediaserver, audio_prop)
+
+get_prop(mediaserver, drm_service_config_prop)
+get_prop(mediaserver, media_config_prop)
+
+# Allow MediaCodec running on mediaserver to read media_native flags
+get_prop(mediaserver, device_config_media_native_prop)
+
+# Allow mediaserver to start media.transcoding service via ctl.start.
+set_prop(mediaserver, ctl_mediatranscoding_prop);
+
+# Allow mediaserver to read SDK sandbox data files
+allow mediaserver sdk_sandbox_data_file:file { getattr read };
+
+# Needed for stats callback registration to statsd.
+allow mediaserver stats_service:service_manager find;
+allow mediaserver statsmanager_service:service_manager find;
+binder_call(mediaserver, statsd)
+
+# Allow mediaserver to communicate with Surface provided
+# by virtual camera.
+binder_call(mediaserver, virtual_camera)
+
+typeattribute mediaserver mlstrustedsubject;
+
+net_domain(mediaserver)
+
+r_dir_file(mediaserver, sdcard_type)
+r_dir_file(mediaserver, fuse)
+r_dir_file(mediaserver, cgroup)
+r_dir_file(mediaserver, cgroup_v2)
+
+# stat /proc/self
+allow mediaserver proc:lnk_file getattr;
+
+# open /vendor/lib/mediadrm
+allow mediaserver system_file:dir r_dir_perms;
+
+userdebug_or_eng(`
+ # ptrace to processes in the same domain for memory leak detection
+ allow mediaserver self:process ptrace;
+')
+
+binder_use(mediaserver)
+binder_call(mediaserver, binderservicedomain)
+binder_call(mediaserver, appdomain)
+binder_service(mediaserver)
+
+allow mediaserver media_data_file:dir create_dir_perms;
+allow mediaserver media_data_file:file create_file_perms;
+allow mediaserver { app_data_file privapp_data_file }:file { append getattr ioctl lock map read write };
+allow mediaserver { sdcard_type fuse }:file write;
+allow mediaserver gpu_device:chr_file rw_file_perms;
+allow mediaserver gpu_device:dir r_dir_perms;
+allow mediaserver video_device:dir r_dir_perms;
+allow mediaserver video_device:chr_file rw_file_perms;
+
+# Read resources from open apk files passed over Binder.
+allow mediaserver apk_data_file:file { read getattr };
+allow mediaserver asec_apk_file:file { read getattr };
+allow mediaserver ringtone_file:file { read getattr };
+
+# Read /data/data/com.android.providers.telephony files passed over Binder.
+allow mediaserver radio_data_file:file { read getattr };
+
+# Use pipes passed over Binder from app domains.
+allow mediaserver appdomain:fifo_file { getattr read write };
+
+allow mediaserver rpmsg_device:chr_file rw_file_perms;
+
+# Inter System processes communicate over named pipe (FIFO)
+allow mediaserver system_server:fifo_file r_file_perms;
+
+r_dir_file(mediaserver, media_rw_data_file)
+
+# Grant access to read files on appfuse.
+allow mediaserver app_fuse_file:file { read getattr };
+
+# Needed on some devices for playing DRM protected content,
+# but seems expected and appropriate for all devices.
+unix_socket_connect(mediaserver, drmserver, drmserver)
+
+# Needed on some devices for playing audio on paired BT device,
+# but seems appropriate for all devices.
+unix_socket_connect(mediaserver, bluetooth, bluetooth)
+
+# Needed for mediaserver to send information to statsd socket.
+unix_socket_send(mediaserver, statsdw, statsd)
+
+add_service(mediaserver, mediaserver_service)
+allow mediaserver activity_service:service_manager find;
+allow mediaserver appops_service:service_manager find;
+allow mediaserver audio_service:service_manager find;
+allow mediaserver audioserver_service:service_manager find;
+allow mediaserver cameraserver_service:service_manager find;
+allow mediaserver batterystats_service:service_manager find;
+allow mediaserver drmserver_service:service_manager find;
+allow mediaserver mediaextractor_service:service_manager find;
+allow mediaserver mediametrics_service:service_manager find;
+allow mediaserver media_session_service:service_manager find;
+allow mediaserver package_native_service:service_manager find;
+allow mediaserver permission_service:service_manager find;
+allow mediaserver permission_checker_service:service_manager find;
+allow mediaserver power_service:service_manager find;
+allow mediaserver processinfo_service:service_manager find;
+allow mediaserver scheduling_policy_service:service_manager find;
+allow mediaserver surfaceflinger_service:service_manager find;
+
+# for ModDrm/MediaPlayer
+allow mediaserver mediadrmserver_service:service_manager find;
+
+# For hybrid interfaces
+allow mediaserver hidl_token_hwservice:hwservice_manager find;
+
+# /oem access
+allow mediaserver oemfs:dir search;
+allow mediaserver oemfs:file r_file_perms;
+
+# /oem boot animation file
+allow mediaserver bootanim_oem_file:file r_file_perms;
+
+# /vendor apk access
+allow mediaserver vendor_app_file:file { read map getattr };
+
+use_drmservice(mediaserver)
+allow mediaserver drmserver:drmservice {
+ consumeRights
+ setPlaybackStatus
+ openDecryptSession
+ closeDecryptSession
+ initializeDecryptUnit
+ decrypt
+ finalizeDecryptUnit
+ pread
+};
+
+# only allow unprivileged socket ioctl commands
+allowxperm mediaserver self:{ rawip_socket tcp_socket udp_socket }
+ ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
+
+# Access to /data/media.
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow mediaserver media_rw_data_file:dir create_dir_perms;
+allow mediaserver media_rw_data_file:file create_file_perms;
+
+# Access to media in /data/preloads
+allow mediaserver preloads_media_file:file { getattr read ioctl };
+
+allow mediaserver ion_device:chr_file r_file_perms;
+allow mediaserver dmabuf_system_heap_device:chr_file r_file_perms;
+allow mediaserver dmabuf_system_secure_heap_device:chr_file r_file_perms;
+allow mediaserver hal_graphics_allocator:fd use;
+allow mediaserver hal_graphics_composer:fd use;
+allow mediaserver hal_camera:fd use;
+
+allow mediaserver system_server:fd use;
+
+# b/120491318 allow mediaserver to access void:fd
+allow mediaserver vold:fd use;
+
+# overlay package access
+allow mediaserver vendor_overlay_file:file { read getattr map };
+
+hal_client_domain(mediaserver, hal_allocator)
+
+###
+### neverallow rules
+###
+
+# mediaserver should never execute any executable without a
+# domain transition
+neverallow mediaserver { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediaserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
diff --git a/prebuilts/api/202504/private/mediaswcodec.te b/prebuilts/api/202504/private/mediaswcodec.te
new file mode 100644
index 0000000..c96c9dd
--- /dev/null
+++ b/prebuilts/api/202504/private/mediaswcodec.te
@@ -0,0 +1,41 @@
+typeattribute mediaswcodec coredomain;
+
+init_daemon_domain(mediaswcodec)
+
+get_prop(mediaswcodec, device_config_media_native_prop)
+get_prop(mediaswcodec, device_config_swcodec_native_prop)
+
+hal_server_domain(mediaswcodec, hal_codec2)
+
+# mediaswcodec may use an input surface from a different Codec2 service or an
+# OMX service
+hal_client_domain(mediaswcodec, hal_codec2)
+hal_client_domain(mediaswcodec, hal_omx)
+
+hal_client_domain(mediaswcodec, hal_allocator)
+hal_client_domain(mediaswcodec, hal_graphics_allocator)
+
+# get aac_drc_* properties
+get_prop(mediaswcodec, aac_drc_prop)
+
+crash_dump_fallback(mediaswcodec)
+
+allow mediaswcodec dmabuf_system_heap_device:chr_file r_file_perms;
+allow mediaswcodec dmabuf_system_secure_heap_device:chr_file r_file_perms;
+allow mediaswcodec gpu_device:chr_file rw_file_perms;
+allow mediaswcodec gpu_device:dir r_dir_perms;
+
+###
+### Neverallow rules
+###
+
+# mediaswcodec_server should never execute any executable without a
+# domain transition
+neverallow mediaswcodec { file_type fs_type }:file execute_no_trans;
+
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediaswcodec domain:{ udp_socket rawip_socket } *;
+neverallow mediaswcodec { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/mediatranscoding.te b/prebuilts/api/202504/private/mediatranscoding.te
new file mode 100644
index 0000000..829d948
--- /dev/null
+++ b/prebuilts/api/202504/private/mediatranscoding.te
@@ -0,0 +1,66 @@
+# mediatranscoding - daemon for transcoding video and image.
+type mediatranscoding_exec, system_file_type, exec_type, file_type;
+type mediatranscoding_tmpfs, file_type;
+typeattribute mediatranscoding coredomain;
+
+init_daemon_domain(mediatranscoding)
+tmpfs_domain(mediatranscoding)
+allow mediatranscoding appdomain_tmpfs:file { getattr map read write };
+
+binder_use(mediatranscoding)
+binder_call(mediatranscoding, binderservicedomain)
+binder_call(mediatranscoding, appdomain)
+binder_service(mediatranscoding)
+
+add_service(mediatranscoding, mediatranscoding_service)
+
+hal_client_domain(mediatranscoding, hal_graphics_allocator)
+hal_client_domain(mediatranscoding, hal_configstore)
+hal_client_domain(mediatranscoding, hal_omx)
+hal_client_domain(mediatranscoding, hal_codec2)
+hal_client_domain(mediatranscoding, hal_allocator)
+
+allow mediatranscoding mediaserver_service:service_manager find;
+allow mediatranscoding mediametrics_service:service_manager find;
+allow mediatranscoding mediaextractor_service:service_manager find;
+allow mediatranscoding package_native_service:service_manager find;
+allow mediatranscoding thermal_service:service_manager find;
+
+allow mediatranscoding system_server:fd use;
+allow mediatranscoding activity_service:service_manager find;
+
+# allow mediatranscoding service read/write permissions for file sources
+allow mediatranscoding sdcardfs:file { getattr read write };
+allow mediatranscoding media_rw_data_file:file { getattr read write };
+allow mediatranscoding apk_data_file:file { getattr read };
+allow mediatranscoding app_data_file:file { getattr read write };
+allow mediatranscoding shell_data_file:file { getattr read write };
+
+# allow mediatranscoding service write permission to statsd socket
+unix_socket_send(mediatranscoding, statsdw, statsd)
+
+# Allow mediatranscoding to access the DMA-BUF system heap
+allow mediatranscoding dmabuf_system_heap_device:chr_file r_file_perms;
+
+allow mediatranscoding gpu_device:chr_file rw_file_perms;
+allow mediatranscoding gpu_device:dir r_dir_perms;
+
+# Allow mediatranscoding service to access media-related system properties
+get_prop(mediatranscoding, media_config_prop)
+
+# mediatranscoding should never execute any executable without a
+# domain transition
+neverallow mediatranscoding { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediatranscoding domain:{ udp_socket rawip_socket } *;
+neverallow mediatranscoding { domain userdebug_or_eng(`-su') }:tcp_socket *;
diff --git a/prebuilts/api/202504/private/mediatuner.te b/prebuilts/api/202504/private/mediatuner.te
new file mode 100644
index 0000000..5871bea
--- /dev/null
+++ b/prebuilts/api/202504/private/mediatuner.te
@@ -0,0 +1,36 @@
+# mediatuner - mediatuner daemon
+type mediatuner, domain;
+type mediatuner_exec, system_file_type, exec_type, file_type;
+
+typeattribute mediatuner coredomain;
+
+init_daemon_domain(mediatuner)
+hal_client_domain(mediatuner, hal_tv_tuner)
+
+binder_use(mediatuner)
+binder_call(mediatuner, appdomain)
+binder_service(mediatuner)
+
+add_service(mediatuner, mediatuner_service)
+allow mediatuner system_server:fd use;
+allow mediatuner tv_tuner_resource_mgr_service:service_manager find;
+allow mediatuner package_native_service:service_manager find;
+binder_call(mediatuner, system_server)
+
+# Read ro.tuner.lazyhal
+get_prop(mediatuner, tuner_config_prop)
+
+# Read tuner.server.enable
+get_prop(mediatuner, tuner_server_ctl_prop)
+
+###
+### neverallow rules
+###
+
+# mediatuner should never execute any executable without a
+# domain transition
+neverallow mediatuner { file_type fs_type }:file execute_no_trans;
+
+# do not allow privileged socket ioctl commands
+neverallowxperm mediatuner domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+
diff --git a/prebuilts/api/202504/private/memcgv2_activation_depth.te b/prebuilts/api/202504/private/memcgv2_activation_depth.te
new file mode 100644
index 0000000..80378d3
--- /dev/null
+++ b/prebuilts/api/202504/private/memcgv2_activation_depth.te
@@ -0,0 +1,26 @@
+# The memcgv2_activation_depth.sh script run by init.
+
+type memcgv2_activation_depth, domain, coredomain;
+type memcgv2_activation_depth_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(memcgv2_activation_depth)
+
+# required permissions to run the script from init
+allow memcgv2_activation_depth shell_exec:file rx_file_perms;
+allow memcgv2_activation_depth system_file:file x_file_perms;
+allow memcgv2_activation_depth toolbox_exec:file rx_file_perms;
+
+# for system default max activation depth
+allow memcgv2_activation_depth cgroup_desc_file:file r_file_perms;
+
+# /metadata/libprocessgroup/*
+allow memcgv2_activation_depth libprocessgroup_metadata_file:dir rw_dir_perms;
+allow memcgv2_activation_depth libprocessgroup_metadata_file:file create_file_perms;
+
+# /sys/fs/cgroup/cgroup.controllers
+# /sys/fs/cgroup/**/cgroup.subtree_control
+allow memcgv2_activation_depth cgroup_v2:dir r_dir_perms;
+allow memcgv2_activation_depth cgroup_v2:file rw_file_perms;
+
+# For reboot, when reducing the depth override
+set_prop(memcgv2_activation_depth, powerctl_prop)
diff --git a/prebuilts/api/202504/private/microfuchsiad.te b/prebuilts/api/202504/private/microfuchsiad.te
new file mode 100644
index 0000000..f02acaf
--- /dev/null
+++ b/prebuilts/api/202504/private/microfuchsiad.te
@@ -0,0 +1,18 @@
+is_flag_enabled(RELEASE_AVF_ENABLE_MICROFUCHSIA, `
+ type microfuchsiad, domain, coredomain;
+ type microfuchsiad_exec, system_file_type, exec_type, file_type;
+
+ # Host dynamic AIDL services
+ init_daemon_domain(microfuchsiad)
+ binder_use(microfuchsiad)
+ add_service(microfuchsiad, microfuchsia_service)
+
+ # Call back into system server
+ binder_call(microfuchsiad, system_server)
+
+ # Start a VM
+ virtualizationservice_use(microfuchsiad)
+
+ # Create pty devices
+ allow microfuchsiad devpts:chr_file { read write open getattr ioctl };
+')
diff --git a/prebuilts/api/202504/private/migrate_legacy_obb_data.te b/prebuilts/api/202504/private/migrate_legacy_obb_data.te
new file mode 100644
index 0000000..b2a1fb1
--- /dev/null
+++ b/prebuilts/api/202504/private/migrate_legacy_obb_data.te
@@ -0,0 +1,28 @@
+type migrate_legacy_obb_data, domain, coredomain;
+type migrate_legacy_obb_data_exec, system_file_type, exec_type, file_type;
+
+allow migrate_legacy_obb_data media_rw_data_file:dir create_dir_perms;
+allow migrate_legacy_obb_data media_rw_data_file:file create_file_perms;
+
+allow migrate_legacy_obb_data shell_exec:file rx_file_perms;
+
+allow migrate_legacy_obb_data toolbox_exec:file rx_file_perms;
+
+allow migrate_legacy_obb_data self:capability { chown dac_override dac_read_search fowner fsetid };
+
+allow migrate_legacy_obb_data mnt_user_file:dir search;
+allow migrate_legacy_obb_data mnt_user_file:lnk_file read;
+allow migrate_legacy_obb_data storage_file:dir search;
+allow migrate_legacy_obb_data storage_file:lnk_file read;
+
+allow migrate_legacy_obb_data sdcard_type:dir create_dir_perms;
+allow migrate_legacy_obb_data sdcard_type:file create_file_perms;
+
+# TODO: This should not be necessary. We don't deliberately hand over
+# any open file descriptors to this domain, so anything that triggers this
+# should be a candidate for O_CLOEXEC.
+allow migrate_legacy_obb_data installd:fd use;
+
+# This rule is required to let this process read /proc/{parent_pid}/mount.
+# TODO: Why is this required ?
+allow migrate_legacy_obb_data installd:file read;
diff --git a/prebuilts/api/202504/private/misctrl.te b/prebuilts/api/202504/private/misctrl.te
new file mode 100644
index 0000000..2352067
--- /dev/null
+++ b/prebuilts/api/202504/private/misctrl.te
@@ -0,0 +1,17 @@
+# binary for generic misc partition management
+type misctrl, domain, coredomain;
+type misctrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(misctrl)
+
+allow misctrl misc_block_device:blk_file rw_file_perms;
+allow misctrl block_device:dir r_dir_perms;
+read_fstab(misctrl)
+
+set_prop(misctrl, misctrl_prop)
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit misctrl sysfs_dt_firmware_android:dir search;
+dontaudit misctrl vendor_property_type:file read;
diff --git a/prebuilts/api/202504/private/mls b/prebuilts/api/202504/private/mls
new file mode 100644
index 0000000..955c27b
--- /dev/null
+++ b/prebuilts/api/202504/private/mls
@@ -0,0 +1,116 @@
+#################################################
+# MLS policy constraints
+#
+
+#
+# Process constraints
+#
+
+# Process transition: Require equivalence unless the subject is trusted.
+mlsconstrain process { transition dyntransition }
+ ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
+
+# Process read operations: No read up unless trusted.
+mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
+ (l1 dom l2 or t1 == mlstrustedsubject);
+
+# Process write operations: Require equivalence unless trusted.
+mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share }
+ (l1 eq l2 or t1 == mlstrustedsubject);
+
+#
+# Socket constraints
+#
+
+# Create/relabel operations: Subject must be equivalent to object unless
+# the subject is trusted. Sockets inherit the range of their creator.
+mlsconstrain socket_class_set { create relabelfrom relabelto }
+ ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
+
+# Datagram send: Sender must be equivalent to the receiver unless one of them
+# is trusted.
+mlsconstrain unix_dgram_socket { sendto }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
+
+# Stream connect: Client must be equivalent to server unless one of them
+# is trusted.
+mlsconstrain unix_stream_socket { connectto }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
+
+#
+# Directory/file constraints
+#
+
+# Create/relabel operations: Subject must be equivalent to object unless
+# the subject is trusted. Also, files should always be single-level.
+# Do NOT exempt mlstrustedobject types from this constraint.
+mlsconstrain dir_file_class_set { create relabelfrom relabelto }
+ (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject));
+
+#
+# Userfaultfd constraints
+#
+# To enforce that anonymous inodes are self contained in the application's process.
+mlsconstrain anon_inode { ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute open execmod }
+ (l1 eq l2);
+
+#
+# Constraints for app data files only.
+#
+
+# Only constrain open, not read/write, so already open fds can be used.
+# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc.
+# Subject must dominate object unless the subject is trusted.
+mlsconstrain dir { open search getattr setattr rename add_name remove_name reparent rmdir }
+ (t2 != app_data_file_type or l1 dom l2 or t1 == mlstrustedsubject);
+mlsconstrain { file sock_file } { open setattr unlink link rename }
+ ( (t2 != app_data_file_type and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+
+# For symlinks in app data files, require equivalence in order to manipulate or follow (read).
+mlsconstrain { lnk_file } { open setattr unlink link rename read }
+ ( (t2 != app_data_file_type or t2 == privapp_data_file) or l1 eq l2 or t1 == mlstrustedsubject);
+# But for priv_app_data_file, continue to use dominance for symlinks because dynamite relies on this.
+# TODO: Migrate to equivalence when it's no longer needed.
+mlsconstrain { lnk_file } { open setattr unlink link rename read }
+ ( (t2 != privapp_data_file and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+
+#
+# Constraints for file types other than app data files.
+#
+
+# Read operations: Subject must dominate object unless the subject
+# or the object is trusted.
+mlsconstrain dir { read getattr search }
+ (t2 == app_data_file_type or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject
+ or (t1 == mlsvendorcompat and (t2 == system_data_file or t2 == user_profile_root_file) ) );
+
+mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute }
+ (t2 == app_data_file_type or t2 == appdomain_tmpfs or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+# Write operations: Subject must be equivalent to the object unless the
+# subject or the object is trusted.
+mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir }
+ (t2 == app_data_file_type or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename }
+ (t2 == app_data_file_type or t2 == appdomain_tmpfs or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+
+# Special case for FIFOs.
+# These can be unnamed pipes, in which case they will be labeled with the
+# creating process' label. Thus we also have an exemption when the "object"
+# is a domain type, so that processes can communicate via unnamed pipes
+# passed by binder or local socket IPC.
+mlsconstrain fifo_file { read getattr }
+ (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
+
+mlsconstrain fifo_file { write setattr append unlink link rename }
+ (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
+
+#
+# Binder IPC constraints
+#
+# Presently commented out, as apps are expected to call one another.
+# This would only make sense if apps were assigned categories
+# based on allowable communications rather than per-app categories.
+#mlsconstrain binder call
+# (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
diff --git a/prebuilts/api/202504/private/mls_decl b/prebuilts/api/202504/private/mls_decl
new file mode 100644
index 0000000..dd53bea
--- /dev/null
+++ b/prebuilts/api/202504/private/mls_decl
@@ -0,0 +1,10 @@
+#########################################
+# MLS declarations
+#
+
+# Generate the desired number of sensitivities and categories.
+gen_sens(mls_num_sens)
+gen_cats(mls_num_cats)
+
+# Generate level definitions for each sensitivity and category.
+gen_levels(mls_num_sens,mls_num_cats)
diff --git a/prebuilts/api/202504/private/mls_macros b/prebuilts/api/202504/private/mls_macros
new file mode 100644
index 0000000..83e0542
--- /dev/null
+++ b/prebuilts/api/202504/private/mls_macros
@@ -0,0 +1,54 @@
+########################################
+#
+# gen_cats(N)
+#
+# declares categores c0 to c(N-1)
+#
+define(`decl_cats',`dnl
+category c$1;
+ifelse(`$1',`$2',,`decl_cats(incr($1),$2)')dnl
+')
+
+define(`gen_cats',`decl_cats(0,decr($1))')
+
+########################################
+#
+# gen_sens(N)
+#
+# declares sensitivites s0 to s(N-1) with dominance
+# in increasing numeric order with s0 lowest, s(N-1) highest
+#
+define(`decl_sens',`dnl
+sensitivity s$1;
+ifelse(`$1',`$2',,`decl_sens(incr($1),$2)')dnl
+')
+
+define(`gen_dominance',`s$1 ifelse(`$1',`$2',,`gen_dominance(incr($1),$2)')')
+
+define(`gen_sens',`
+# Each sensitivity has a name and zero or more aliases.
+decl_sens(0,decr($1))
+
+# Define the ordering of the sensitivity levels (least to greatest)
+dominance { gen_dominance(0,decr($1)) }
+')
+
+########################################
+#
+# gen_levels(N,M)
+#
+# levels from s0 to (N-1) with categories c0 to (M-1)
+#
+define(`decl_levels',`dnl
+level s$1:c0.c$3;
+ifelse(`$1',`$2',,`decl_levels(incr($1),$2,$3)')dnl
+')
+
+define(`gen_levels',`decl_levels(0,decr($1),decr($2))')
+
+########################################
+#
+# Basic level names for system low and high
+#
+define(`mls_systemlow',`s0')
+define(`mls_systemhigh',`s`'decr(mls_num_sens):c0.c`'decr(mls_num_cats)')
diff --git a/prebuilts/api/202504/private/mlstrustedsubject.te b/prebuilts/api/202504/private/mlstrustedsubject.te
new file mode 100644
index 0000000..8fcc1d4
--- /dev/null
+++ b/prebuilts/api/202504/private/mlstrustedsubject.te
@@ -0,0 +1,63 @@
+# MLS override can't be used to access private app data.
+
+# Apps should not normally be mlstrustedsubject, but if they must be
+# they cannot use this to access app private data files; their own app
+# data files must use a different label.
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+} {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:file ~{ read write map getattr ioctl lock append };
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+} {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir ~{ read getattr search };
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+ -vold # encryption of storage areas
+ -vold_prepare_subdirs # creation of storage area directories
+ } { storage_area_dir storage_area_app_dir }:dir ~{ read getattr search };
+')
+
+neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+ -system_server
+ -adbd
+ -runas
+ -zygote
+} {
+ app_data_file
+ privapp_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
+}:dir { read getattr search };
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallow {
+ mlstrustedsubject
+ -artd # compile secondary dex files
+ -installd
+ -system_server
+ -adbd
+ -runas
+ -vold # encryption of storage area directories
+ -vold_prepare_subdirs # creation of storage area directories
+ -zygote
+ } { storage_area_dir storage_area_app_dir }:dir { read getattr search };
+')
diff --git a/prebuilts/api/202504/private/mm_events.te b/prebuilts/api/202504/private/mm_events.te
new file mode 100644
index 0000000..4875d40
--- /dev/null
+++ b/prebuilts/api/202504/private/mm_events.te
@@ -0,0 +1,14 @@
+type mm_events, domain, coredomain;
+type mm_events_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mm_events)
+
+allow mm_events shell_exec:file rx_file_perms;
+
+# Allow running the sleep command to rate limit attempts
+# to arm mm_events on failure.
+allow mm_events toolbox_exec:file rx_file_perms;
+
+allow mm_events perfetto_exec:file rx_file_perms;
+
+domain_auto_trans(mm_events, perfetto_exec, perfetto)
diff --git a/prebuilts/api/202504/private/mmd.te b/prebuilts/api/202504/private/mmd.te
new file mode 100644
index 0000000..90510f1
--- /dev/null
+++ b/prebuilts/api/202504/private/mmd.te
@@ -0,0 +1,31 @@
+# mmd memory management daemon
+type mmd, domain;
+typeattribute mmd coredomain;
+type mmd_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mmd)
+
+# Set mmd.enabled_aconfig properties.
+set_prop(mmd, mmd_prop)
+get_prop(mmd, device_config_mmd_native_prop)
+
+# mmd binder setup
+add_service(mmd, mmd_service)
+binder_use(mmd)
+
+# Read /proc/swaps
+allow mmd proc_swaps:file r_file_perms;
+
+# zram sysfs access
+allow mmd sysfs_zram:dir search;
+allow mmd sysfs_zram:file rw_file_perms;
+
+# procfs
+allow mmd proc_meminfo:file r_file_perms;
+
+# mkswap /dev/block/zram command
+allow mmd block_device:dir search;
+allow mmd swap_block_device:blk_file rw_file_perms;
+
+# swapon syscall
+allow mmd self:capability sys_admin;
diff --git a/prebuilts/api/202504/private/modprobe.te b/prebuilts/api/202504/private/modprobe.te
new file mode 100644
index 0000000..d7b2fc3
--- /dev/null
+++ b/prebuilts/api/202504/private/modprobe.te
@@ -0,0 +1,13 @@
+typeattribute modprobe coredomain;
+
+allow modprobe proc_modules:file r_file_perms;
+allow modprobe proc_cmdline:file r_file_perms;
+allow modprobe self:global_capability_class_set sys_module;
+allow modprobe kernel:key search;
+allow modprobe system_dlkm_file:dir search;
+allow modprobe system_dlkm_file:file r_file_perms;
+allow modprobe system_dlkm_file:system module_load;
+recovery_only(`
+ allow modprobe rootfs:system module_load;
+ allow modprobe rootfs:file r_file_perms;
+')
diff --git a/prebuilts/api/202504/private/mtectrl.te b/prebuilts/api/202504/private/mtectrl.te
new file mode 100644
index 0000000..e0418bc
--- /dev/null
+++ b/prebuilts/api/202504/private/mtectrl.te
@@ -0,0 +1,21 @@
+# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader.
+type mtectrl, domain, coredomain;
+type mtectrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mtectrl)
+
+# to set the sys prop to match the bootloader message state.
+set_prop(mtectrl, arm64_memtag_prop)
+
+# mtectrl communicates the request to the bootloader via the misc partition.
+# needs to write to update the request in misc partition, and read to sync
+# back to the property.
+allow mtectrl misc_block_device:blk_file rw_file_perms;
+allow mtectrl block_device:dir r_dir_perms;
+read_fstab(mtectrl)
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit mtectrl sysfs_dt_firmware_android:dir search;
+dontaudit mtectrl vendor_property_type:file read;
diff --git a/prebuilts/api/202504/private/net.te b/prebuilts/api/202504/private/net.te
new file mode 100644
index 0000000..2c2f091
--- /dev/null
+++ b/prebuilts/api/202504/private/net.te
@@ -0,0 +1,37 @@
+# Bind to ports.
+allow {netdomain -ephemeral_app -sdk_sandbox_all} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind;
+allow {netdomain -ephemeral_app -sdk_sandbox_all} port_type:udp_socket name_bind;
+allow {netdomain -ephemeral_app -sdk_sandbox_all} port_type:tcp_socket name_bind;
+
+# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
+# untrusted_apps.
+# b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from
+# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere
+# to avoid app-compat breakage.
+allow {
+ netdomain
+ -ephemeral_app
+ -mediaprovider
+ -priv_app
+ -sdk_sandbox_all
+ -untrusted_app_all
+} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };
+
+###
+### Domain with network access
+###
+
+# Use network sockets.
+allow netdomain self:tcp_socket create_stream_socket_perms;
+allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms;
+
+# Connect to ports.
+allow netdomain port_type:tcp_socket name_connect;
+# See changes to the routing table.
+allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
+
+# Talks to netd via dnsproxyd socket.
+unix_socket_connect(netdomain, dnsproxyd, netd)
+
+# Talks to netd via fwmarkd socket.
+unix_socket_connect(netdomain, fwmarkd, netd)
diff --git a/prebuilts/api/202504/private/netd.te b/prebuilts/api/202504/private/netd.te
new file mode 100644
index 0000000..3b3c697
--- /dev/null
+++ b/prebuilts/api/202504/private/netd.te
@@ -0,0 +1,225 @@
+typeattribute netd coredomain;
+typeattribute netd bpfdomain;
+
+init_daemon_domain(netd)
+
+# Allow netd to spawn dnsmasq in it's own domain
+domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
+
+allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:dir search;
+allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read };
+allow netd { fs_bpf fs_bpf_netd_shared }:file write;
+
+# give netd permission to setup iptables rule with xt_bpf, attach program to cgroup,
+# create maps, and read/write maps created by bpfloader, itself and NS/SS mainline networking
+allow netd bpfloader:bpf prog_run;
+allow netd self:bpf map_create;
+allow netd { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
+# TODO: Remove this after we remove all bpf interactions from netd.
+allow netd self:key_socket create;
+
+set_prop(netd, ctl_mdnsd_prop)
+set_prop(netd, netd_stable_secret_prop)
+
+get_prop(netd, adbd_config_prop)
+get_prop(netd, hwservicemanager_prop)
+get_prop(netd, device_config_netd_native_prop)
+
+# Allow netd to write to statsd.
+unix_socket_send(netd, statsdw, statsd)
+
+# Allow netd to send callbacks to network_stack
+binder_call(netd, network_stack)
+
+# Allow netd to send dump info to dumpstate
+allow netd dumpstate:fd use;
+allow netd dumpstate:fifo_file { getattr write };
+
+net_domain(netd)
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(netd, mdnsd, mdnsd)
+# in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls.
+allowxperm netd self:udp_socket ioctl priv_sock_ioctls;
+
+r_dir_file(netd, cgroup)
+
+allow netd system_server:fd use;
+
+allow netd self:global_capability_class_set { net_admin net_raw net_bind_service kill };
+# Note: fsetid is deliberately not included above. fsetid checks are
+# triggered by chmod on a directory or file owned by a group other
+# than one of the groups assigned to the current process to see if
+# the setgid bit should be cleared, regardless of whether the setgid
+# bit was even set. We do not appear to truly need this capability
+# for netd to operate.
+dontaudit netd self:global_capability_class_set fsetid;
+
+# Allow netd to open /dev/tun, set it up and pass it to clatd
+allow netd tun_device:chr_file rw_file_perms;
+allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
+allow netd self:tun_socket create;
+
+allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow netd self:netlink_route_socket nlmsg_write;
+allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl;
+allow netd self:netlink_socket create_socket_perms_no_ioctl;
+allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
+allow netd self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl;
+allow netd shell_exec:file rx_file_perms;
+allow netd system_file:file x_file_perms;
+not_full_treble(`allow netd vendor_file:file x_file_perms;')
+allow netd devpts:chr_file rw_file_perms;
+
+# Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't
+# exist, suppress the denial.
+allow netd system_file:file lock;
+dontaudit netd system_file:dir write;
+
+r_dir_file(netd, proc_net_type)
+# For /proc/sys/net/ipv[46]/route/flush.
+allow netd proc_net_type:file rw_file_perms;
+
+# Enables PppController and interface enumeration (among others)
+allow netd sysfs:dir r_dir_perms;
+r_dir_file(netd, sysfs_net)
+
+# Allows setting interface MTU
+allow netd sysfs_net:file w_file_perms;
+
+# TODO: added to match above sysfs rule. Remove me?
+allow netd sysfs_usb:file write;
+
+r_dir_file(netd, cgroup_v2)
+
+# TODO: netd previously thought it needed these permissions to do WiFi related
+# work. However, after all the WiFi stuff is gone, we still need them.
+# Why?
+allow netd self:global_capability_class_set { dac_override dac_read_search chown };
+
+# Needed to update /data/misc/net/rt_tables
+allow netd net_data_file:file create_file_perms;
+allow netd net_data_file:dir rw_dir_perms;
+allow netd self:global_capability_class_set fowner;
+
+# Needed to lock the iptables lock.
+allow netd system_file:file lock;
+
+# Allow netd to spawn dnsmasq in it's own domain
+allow netd dnsmasq:process { sigkill signal };
+
+# Allow netd to publish a binder service and make binder calls.
+binder_use(netd)
+add_service(netd, netd_service)
+add_service(netd, dnsresolver_service)
+add_service(netd, mdns_service)
+allow netd dumpstate:fifo_file { getattr write };
+
+# Allow netd to call into the system server so it can check permissions.
+allow netd system_server:binder call;
+allow netd permission_service:service_manager find;
+
+# Allow netd to talk to the framework service which collects netd events.
+allow netd netd_listener_service:service_manager find;
+
+# Allow netd to operate on sockets that are passed to it.
+allow netd netdomain:{
+ icmp_socket
+ tcp_socket
+ udp_socket
+ rawip_socket
+ tun_socket
+} { read write getattr setattr getopt setopt };
+allow netd netdomain:fd use;
+
+# give netd permission to read and write netlink xfrm
+allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
+
+# Allow netd to register as hal server.
+add_hwservice(netd, system_net_netd_hwservice)
+hwbinder_use(netd)
+
+# AIDL hal server
+binder_call(system_net_netd_service, servicemanager)
+add_service(netd, system_net_netd_service)
+
+###
+### Neverallow rules
+###
+### netd should NEVER do any of this
+
+# Block device access.
+neverallow netd dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow netd { domain }:process ptrace;
+
+# Write to /system.
+neverallow netd system_file_type:dir_file_class_set write;
+
+# Write to files in /data/data or system files on /data
+neverallow netd { app_data_file_type system_data_file }:dir_file_class_set write;
+
+# only system_server, dumpstate and network stack app may find netd service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} netd_service:service_manager find;
+
+# only system_server, dumpstate and network stack app may find dnsresolver service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} dnsresolver_service:service_manager find;
+
+# only system_server, dumpstate and network stack app may find mdns service
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -network_stack
+ -netd
+ -netutils_wrapper
+} mdns_service:service_manager find;
+
+# apps may not interact with netd over binder.
+neverallow { appdomain -network_stack } netd:binder call;
+neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
+
+# If an already existing file is opened with O_CREATE, the kernel might generate
+# a false report of a create denial. Silence these denials and make sure that
+# inappropriate permissions are not granted.
+neverallow netd proc_net:dir no_w_dir_perms;
+dontaudit netd proc_net:dir write;
+
+neverallow netd sysfs_net:dir no_w_dir_perms;
+dontaudit netd sysfs_net:dir write;
+
+# Netd should not have SYS_ADMIN privs.
+neverallow netd self:capability sys_admin;
+dontaudit netd self:capability sys_admin;
+
+# Netd should not have SYS_MODULE privs, nor should it be requesting module loads
+# (things it requires should be built directly into the kernel)
+dontaudit netd self:capability sys_module;
+
+dontaudit netd appdomain:unix_stream_socket { read write };
+
+# persist.netd.stable_secret contains RFC 7217 secret key which should never be
+# leaked to other processes. Make sure it never leaks.
+neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
+
+# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
+# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
+neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
diff --git a/prebuilts/api/202504/private/netutils_wrapper.te b/prebuilts/api/202504/private/netutils_wrapper.te
new file mode 100644
index 0000000..37a2c47
--- /dev/null
+++ b/prebuilts/api/202504/private/netutils_wrapper.te
@@ -0,0 +1,53 @@
+typeattribute netutils_wrapper coredomain;
+typeattribute netutils_wrapper bpfdomain;
+
+r_dir_file(netutils_wrapper, system_file);
+
+# For netutils (ip, iptables, tc)
+allow netutils_wrapper self:global_capability_class_set net_raw;
+
+allow netutils_wrapper system_file:file { execute execute_no_trans };
+allow netutils_wrapper proc_net_type:file { open read getattr };
+allow netutils_wrapper self:rawip_socket create_socket_perms;
+allow netutils_wrapper self:udp_socket create_socket_perms;
+allow netutils_wrapper self:global_capability_class_set net_admin;
+# ip utils need everything but ioctl
+allow netutils_wrapper self:netlink_route_socket ~ioctl;
+allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
+
+# For netutils (ndc) to be able to talk to netd
+allow netutils_wrapper netd_service:service_manager find;
+allow netutils_wrapper dnsresolver_service:service_manager find;
+allow netutils_wrapper mdns_service:service_manager find;
+binder_use(netutils_wrapper);
+binder_call(netutils_wrapper, netd);
+
+# For vendor code that update the iptables rules at runtime. They need to reload
+# the whole chain including the xt_bpf rules. They need to access to the pinned
+# program when reloading the rule.
+allow netutils_wrapper { fs_bpf fs_bpf_netd_shared fs_bpf_vendor }:dir search;
+allow netutils_wrapper { fs_bpf fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read };
+allow netutils_wrapper { fs_bpf }:file write;
+allow netutils_wrapper bpfloader:bpf prog_run;
+
+# For /data/misc/net access to ndc and ip
+r_dir_file(netutils_wrapper, net_data_file)
+
+domain_auto_trans({
+ domain
+ -coredomain
+ -appdomain
+}, netutils_wrapper_exec, netutils_wrapper)
+
+###
+### Neverallow rules
+###
+
+# suppress spurious denials
+dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
+dontaudit netutils_wrapper sysfs_type:file read;
+
+# netutils wrapper may only use the following capabilities.
+neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
+
+neverallow domain netutils_wrapper_exec:file execute_no_trans;
diff --git a/prebuilts/api/202504/private/network_stack.te b/prebuilts/api/202504/private/network_stack.te
new file mode 100644
index 0000000..4450e02
--- /dev/null
+++ b/prebuilts/api/202504/private/network_stack.te
@@ -0,0 +1,108 @@
+# Networking service app
+typeattribute network_stack coredomain;
+typeattribute network_stack mlstrustedsubject;
+typeattribute network_stack bpfdomain;
+
+app_domain(network_stack);
+net_domain(network_stack);
+
+allow network_stack self:global_capability_class_set {
+ net_admin
+ net_bind_service
+ net_broadcast
+ net_raw
+};
+
+allow network_stack self:global_capability2_class_set wake_alarm;
+
+# Allow access to net_admin ioctl, DHCP server uses SIOCSARP
+allowxperm network_stack self:udp_socket ioctl priv_sock_ioctls;
+
+# The DhcpClient uses packet_sockets
+allow network_stack self:packet_socket create_socket_perms_no_ioctl;
+
+# Monitor neighbors via netlink.
+allow network_stack self:netlink_route_socket nlmsg_write;
+
+# Use netlink uevent sockets.
+allow network_stack self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# give network_stack the same netlink permissions as netd
+allow network_stack self:netlink_nflog_socket create_socket_perms_no_ioctl;
+allow network_stack self:netlink_socket create_socket_perms_no_ioctl;
+allow network_stack self:netlink_generic_socket create_socket_perms_no_ioctl;
+
+allow network_stack app_api_service:service_manager find;
+allow network_stack dnsresolver_service:service_manager find;
+allow network_stack mdns_service:service_manager find;
+allow network_stack netd_service:service_manager find;
+allow network_stack network_watchlist_service:service_manager find;
+allow network_stack radio_service:service_manager find;
+allow network_stack system_config_service:service_manager find;
+allow network_stack radio_data_file:dir create_dir_perms;
+allow network_stack radio_data_file:file create_file_perms;
+
+binder_call(network_stack, netd);
+
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
+allow network_stack self:key_socket create;
+# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
+# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
+dontaudit network_stack self:key_socket getopt;
+
+# Grant read permission of connectivity namespace system property prefix.
+get_prop(network_stack, device_config_connectivity_prop)
+
+# Create/use netlink_tcpdiag_socket to get tcp info
+allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
+############### Tethering Service app - Tethering.apk ##############
+hal_client_domain(network_stack, hal_tetheroffload)
+# Create and share netlink_netfilter_sockets for tetheroffload.
+allow network_stack self:netlink_netfilter_socket create_socket_perms_no_ioctl;
+allow network_stack network_stack_service:service_manager find;
+# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF.
+allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search;
+allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write };
+allow network_stack bpfloader:bpf prog_run;
+allow network_stack self:bpf map_create;
+allow network_stack { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+
+# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace
+get_prop(network_stack, device_config_tethering_u_or_later_native_prop)
+
+# Use XFRM (IPsec) netlink sockets
+allow network_stack self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
+
+# tun device used for 3rd party vpn apps and test network manager
+allow network_stack tun_device:chr_file rw_file_perms;
+allowxperm network_stack tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETLINK TUNSETCARRIER };
+
+############### NEVER ALLOW RULES
+# This place is as good as any for these rules,
+# and it is probably the most appropriate because
+# network_stack itself is entirely mainline code.
+
+# T+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_net_private' programs/maps.
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file *;
+
+# T+: Only the bpfloader, network_stack and system_server should ever touch 'fs_bpf_net_shared' programs/maps.
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~getattr;
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file *;
+
+# T+: Only the bpfloader, netd, network_stack and system_server should ever touch 'fs_bpf_netd_readonly' programs/maps.
+# netd's access should be readonly
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~getattr;
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file *;
+neverallow netd fs_bpf_netd_readonly:file write;
+
+# T+: Only the bpfloader, netd, netutils_wrapper, network_stack and system_server should ever touch 'fs_bpf_netd_shared' programs/maps.
+# netutils_wrapper requires access to be able to run iptables and only needs readonly access
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~getattr;
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file *;
+neverallow netutils_wrapper fs_bpf_netd_shared:file write;
+
+# S+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps.
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file *;
diff --git a/prebuilts/api/202504/private/nfc.te b/prebuilts/api/202504/private/nfc.te
new file mode 100644
index 0000000..7050d5a
--- /dev/null
+++ b/prebuilts/api/202504/private/nfc.te
@@ -0,0 +1,38 @@
+# nfc subsystem
+typeattribute nfc coredomain, mlstrustedsubject;
+app_domain(nfc)
+net_domain(nfc)
+
+binder_service(nfc)
+add_service(nfc, nfc_service)
+
+hal_client_domain(nfc, hal_nfc)
+
+# Data file accesses.
+allow nfc nfc_data_file:dir create_dir_perms;
+allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
+allow nfc nfc_logs_data_file:dir rw_dir_perms;
+allow nfc nfc_logs_data_file:file create_file_perms;
+
+# SoundPool loading and playback
+allow nfc audioserver_service:service_manager find;
+allow nfc drmserver_service:service_manager find;
+allow nfc mediametrics_service:service_manager find;
+allow nfc mediaextractor_service:service_manager find;
+allow nfc mediaserver_service:service_manager find;
+
+allow nfc radio_service:service_manager find;
+allow nfc app_api_service:service_manager find;
+allow nfc system_api_service:service_manager find;
+allow nfc vr_manager_service:service_manager find;
+allow nfc secure_element_service:service_manager find;
+
+set_prop(nfc, nfc_prop);
+
+# already open bugreport file descriptors may be shared with
+# the nfc process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow nfc shell_data_file:file read;
+
+# Allow to check whether security logging is enabled.
+get_prop(nfc, device_logging_prop)
diff --git a/prebuilts/api/202504/private/odrefresh.te b/prebuilts/api/202504/private/odrefresh.te
new file mode 100644
index 0000000..97205c2
--- /dev/null
+++ b/prebuilts/api/202504/private/odrefresh.te
@@ -0,0 +1,72 @@
+# odrefresh
+type odrefresh, domain, coredomain, artd_subprocess_type;
+type odrefresh_exec, system_file_type, exec_type, file_type;
+
+# Allow odrefresh to create files and directories for on device signing.
+allow odrefresh apex_module_data_file:dir { getattr search };
+allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
+allow odrefresh apex_art_data_file:file { create_file_perms relabelto } ;
+
+# Allow odrefresh to create data files (typically for metrics before statsd starts).
+allow odrefresh odrefresh_data_file:dir create_dir_perms;
+allow odrefresh odrefresh_data_file:file create_file_perms;
+
+userfaultfd_use(odrefresh)
+
+# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
+# sets up files here and passes file descriptors for dex2oat to write to.
+allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto };
+allow odrefresh apex_art_staging_data_file:file { create_file_perms relabelfrom };
+
+# Run dex2oat in its own sandbox.
+domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
+
+# Allow odrefresh to kill dex2oat if compilation times out.
+allow odrefresh dex2oat:process sigkill;
+
+# Use devpts and fd from odsign (which exec()'s odrefresh)
+allow odrefresh odsign_devpts:chr_file { read write };
+allow odrefresh odsign:fd use;
+
+# Allow odrefresh to read /apex/apex-info-list.xml to determine
+# whether current apex is in /system or /data.
+allow odrefresh apex_info_file:file r_file_perms;
+
+# Allow updating boot animation status.
+set_prop(odrefresh, bootanim_system_prop)
+
+# Allow query ART device config properties
+get_prop(odrefresh, device_config_runtime_native_prop)
+get_prop(odrefresh, device_config_runtime_native_boot_prop)
+
+# Do not audit unused resources from parent processes (adb, shell, su).
+# These appear to be unnecessary for odrefresh.
+dontaudit odrefresh { adbd shell }:fd use;
+dontaudit odrefresh devpts:chr_file rw_file_perms;
+dontaudit odrefresh adbd:unix_stream_socket { getattr read write };
+
+# Read access to SELinux context files, for restorecon.
+allow odrefresh file_contexts_file:file r_file_perms;
+allow odrefresh seapp_contexts_file:file r_file_perms;
+
+# Check validity of SELinux context, for restorecon.
+selinux_check_context(odrefresh)
+
+# odrefresh iterates over all properties to find the ones that it's interested
+# in. It's okay to ignore denials on other properties.
+dontaudit odrefresh property_type:file r_file_perms;
+
+# Allow to be called by artd in Pre-reboot Dexopt.
+allow odrefresh artd:fd use;
+
+# Neverallow rules.
+
+# No other processes should be creating files in the staging area.
+neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_file:file open;
+
+# No processes other than init, odrefresh, system_server, and artd access
+# odrefresh_data_files.
+# Among those, artd only needs to bind-mount /data/misc/odrefresh, but doesn't
+# need to access the files.
+neverallow { domain -init -odrefresh -system_server -artd } odrefresh_data_file:dir *;
+neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
diff --git a/prebuilts/api/202504/private/odsign.te b/prebuilts/api/202504/private/odsign.te
new file mode 100644
index 0000000..4af0708
--- /dev/null
+++ b/prebuilts/api/202504/private/odsign.te
@@ -0,0 +1,66 @@
+# odsign - on-device signing.
+type odsign, domain;
+
+# odsign - Binary for signing ART artifacts.
+typeattribute odsign coredomain;
+
+type odsign_exec, exec_type, file_type, system_file_type;
+
+# Allow init to start odsign
+init_daemon_domain(odsign)
+
+# Allow using persistent storage in /data/odsign
+allow odsign odsign_data_file:dir create_dir_perms;
+allow odsign odsign_data_file:file create_file_perms;
+
+# Allow using persistent storage in /data/odsign/metrics - to add metrics related files
+allow odsign odsign_metrics_file:dir rw_dir_perms;
+allow odsign odsign_metrics_file:file create_file_perms;
+
+# Create and use pty created by android_fork_execvp().
+create_pty(odsign)
+
+# FS_IOC_ENABLE_VERITY and FS_IOC_MEASURE_VERITY on ART data files
+allowxperm odsign apex_art_data_file:file ioctl {
+ FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY FS_IOC_GETFLAGS
+};
+
+# talk to binder services (for keystore)
+binder_use(odsign);
+
+# talk to keystore specifically
+use_keystore(odsign);
+
+# Use our dedicated keystore key
+allow odsign odsign_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ use
+};
+
+# talk to keymaster
+hal_client_domain(odsign, hal_keymaster)
+
+# For ART apex data dir access
+allow odsign apex_module_data_file:dir { getattr search };
+
+allow odsign apex_art_data_file:dir { rw_dir_perms rmdir rename };
+allow odsign apex_art_data_file:file { rw_file_perms unlink };
+
+# Run odrefresh to refresh ART artifacts
+domain_auto_trans(odsign, odrefresh_exec, odrefresh)
+
+# Run compos_verify to verify CompOs signatures
+domain_auto_trans(odsign, compos_verify_exec, compos_verify)
+
+# only odsign can set odsign sysprop
+set_prop(odsign, odsign_prop)
+neverallow { domain -odsign -init } odsign_prop:property_service set;
+
+# Allow odsign to stop itself
+set_prop(odsign, ctl_odsign_prop)
+
+# Neverallows
+neverallow { domain -odsign -init} odsign_data_file:dir ~search;
+neverallow { domain -odsign -init} odsign_data_file:file *;
diff --git a/prebuilts/api/202504/private/ot_ctl.te b/prebuilts/api/202504/private/ot_ctl.te
new file mode 100644
index 0000000..7325ce5
--- /dev/null
+++ b/prebuilts/api/202504/private/ot_ctl.te
@@ -0,0 +1,12 @@
+#
+# ot-ctl is a command line tool for controlling ot-daemon
+#
+
+type ot_ctl, domain, coredomain;
+type ot_ctl_exec, exec_type, file_type, system_file_type;
+
+# ot-ctl is available in only userdebug or eng build
+userdebug_or_eng(`
+ # ot-ctl connects to ot-daemon via the socket
+ allow ot_ctl ot_daemon_socket:sock_file rw_file_perms;
+')
diff --git a/prebuilts/api/202504/private/ot_daemon.te b/prebuilts/api/202504/private/ot_daemon.te
new file mode 100644
index 0000000..04cb70f
--- /dev/null
+++ b/prebuilts/api/202504/private/ot_daemon.te
@@ -0,0 +1,53 @@
+#
+# ot_daemon is the native Thread network stack on the host (Android) side.
+# Refer to https://www.threadgroup.org for Thread network knowledge.
+#
+
+# ot_daemon
+type ot_daemon, domain, coredomain;
+type ot_daemon_exec, exec_type, file_type, system_file_type;
+
+# Allow init ot_daemon
+init_daemon_domain(ot_daemon)
+# Allow the ot_daemon to use the net domain.
+net_domain(ot_daemon)
+
+# Allow ot_daemon to find /data/misc/apexdata/com.android.tethering
+allow ot_daemon apex_module_data_file:dir search;
+
+# Allow the ot_daemon to access files and subdirectories under
+# /data/misc/apexdata/com\.android\.tethering
+allow ot_daemon apex_tethering_data_file:dir {create rw_dir_perms};
+allow ot_daemon apex_tethering_data_file:file create_file_perms;
+
+# Allow OT daemon to read/write the Thread tunnel interface
+allow ot_daemon tun_device:chr_file {read write};
+
+# Allow OT daemon to read/write on the socket created by System Server
+allow ot_daemon system_server:rawip_socket rw_socket_perms_no_ioctl;
+
+# Allow OT daemon to read/write on the UDP sockets created by system server
+allow ot_daemon system_server:udp_socket rw_socket_perms;
+
+hal_client_domain(ot_daemon, hal_threadnetwork)
+
+# Only ot_daemon can publish the binder service
+binder_use(ot_daemon)
+add_service(ot_daemon, ot_daemon_service)
+binder_call(ot_daemon, system_server)
+
+# Allow OT daemon to write to statsd
+unix_socket_send(ot_daemon, statsdw, statsd)
+
+# For collecting bugreports.
+allow ot_daemon dumpstate:fd use;
+allow ot_daemon dumpstate:fifo_file write;
+
+# ot-daemon socket is for only ot-daemon and ot-ctl
+neverallow {
+ domain
+ -ot_daemon
+ userdebug_or_eng(`-ot_ctl')
+ -init
+ -vendor_init
+} ot_daemon_socket:sock_file *;
diff --git a/prebuilts/api/202504/private/otapreopt_chroot.te b/prebuilts/api/202504/private/otapreopt_chroot.te
new file mode 100644
index 0000000..2aeab0b
--- /dev/null
+++ b/prebuilts/api/202504/private/otapreopt_chroot.te
@@ -0,0 +1,100 @@
+# otapreopt_chroot executable
+starting_at_board_api(202504, `type otapreopt_chroot, domain;')
+typeattribute otapreopt_chroot coredomain;
+type otapreopt_chroot_exec, exec_type, file_type, system_file_type;
+
+# Chroot preparation and execution.
+# We need to create an unshared mount namespace, and then mount /data.
+allow otapreopt_chroot postinstall_file:dir { search mounton };
+allow otapreopt_chroot apex_mnt_dir:dir mounton;
+allow otapreopt_chroot device:dir mounton;
+allow otapreopt_chroot linkerconfig_file:dir mounton;
+allow otapreopt_chroot rootfs:dir mounton;
+allow otapreopt_chroot sysfs:dir mounton;
+allow otapreopt_chroot system_data_root_file:dir mounton;
+allow otapreopt_chroot system_file:dir mounton;
+allow otapreopt_chroot vendor_file:dir mounton;
+allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot };
+
+# This is required to mount /vendor and mount/unmount ext4 images from
+# APEX packages in /postinstall/apex.
+allow otapreopt_chroot block_device:dir search;
+allow otapreopt_chroot labeledfs:filesystem { mount unmount };
+# This is required for dynamic partitions.
+allow otapreopt_chroot dm_device:chr_file rw_file_perms;
+
+# This is required to unmount flattened APEX packages under
+# /postinstall/system/apex (which are bind-mounted in /postinstall/apex).
+allow otapreopt_chroot postinstall_file:filesystem unmount;
+# Mounting /vendor can have this side-effect. Ignore denial.
+dontaudit otapreopt_chroot kernel:process setsched;
+
+# Allow otapreopt_chroot to read SELinux policy files.
+allow otapreopt_chroot file_contexts_file:file r_file_perms;
+
+# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex.
+allow otapreopt_chroot postinstall_file:dir r_dir_perms;
+# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property.
+get_prop(otapreopt_chroot, apexd_prop)
+
+# Allow otapreopt to use file descriptors from update-engine and the postinstall
+# script. It will read dexopt commands from stdin and write progress to stdout.
+allow otapreopt_chroot postinstall:fd use;
+allow otapreopt_chroot postinstall:fifo_file { read write getattr };
+allow otapreopt_chroot update_engine:fd use;
+allow otapreopt_chroot update_engine:fifo_file write;
+
+# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
+domain_auto_trans(otapreopt_chroot, postinstall_dexopt_exec, postinstall_dexopt)
+domain_auto_trans(otapreopt_chroot, linkerconfig_exec, linkerconfig)
+domain_auto_trans(otapreopt_chroot, apexd_exec, apexd)
+
+# Allow otapreopt_chroot to control linkerconfig
+allow otapreopt_chroot linkerconfig_file:dir { create_dir_perms relabelto };
+allow otapreopt_chroot linkerconfig_file:file create_file_perms;
+
+# Allow otapreopt_chroot to create loop devices with /dev/loop-control.
+allow otapreopt_chroot loop_control_device:chr_file rw_file_perms;
+# Allow otapreopt_chroot to access loop devices.
+allow otapreopt_chroot loop_device:blk_file rw_file_perms;
+allowxperm otapreopt_chroot loop_device:blk_file ioctl {
+ LOOP_CONFIGURE
+ LOOP_GET_STATUS64
+ LOOP_SET_STATUS64
+ LOOP_SET_FD
+ LOOP_SET_BLOCK_SIZE
+ LOOP_SET_DIRECT_IO
+ LOOP_CLR_FD
+ BLKFLSBUF
+};
+
+# Allow otapreopt_chroot to configure read-ahead of loop devices.
+allow otapreopt_chroot sysfs_loop:dir r_dir_perms;
+allow otapreopt_chroot sysfs_loop:file rw_file_perms;
+
+# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
+allow otapreopt_chroot tmpfs:filesystem mount;
+# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
+allow otapreopt_chroot tmpfs:dir relabelfrom;
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
+
+# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms;
+allow otapreopt_chroot postinstall_apex_mnt_dir:file create_file_perms;
+# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
+
+# Allow otapreopt_chroot to access /dev/block (needed to detach loop
+# devices used by ext4 images from APEX packages).
+allow otapreopt_chroot block_device:dir r_dir_perms;
+
+# Allow to access the linker through the symlink.
+allow otapreopt_chroot postinstall_file:lnk_file r_file_perms;
+
+# Allow otapreopt_chroot to read ro.cold_boot_done prop.
+# This is a temporary solution to make sure that otapreopt_chroot doesn't block indefinetelly.
+# TODO(b/165948777): remove this once otapreopt_chroot is migrated to libapexmount.
+get_prop(otapreopt_chroot, cold_boot_done_prop)
+
+# allow otapreopt_chroot to run the linkerconfig from the new image.
+allow otapreopt_chroot linkerconfig_exec:file rx_file_perms;
diff --git a/prebuilts/api/202504/private/otapreopt_slot.te b/prebuilts/api/202504/private/otapreopt_slot.te
new file mode 100644
index 0000000..27a3b0e
--- /dev/null
+++ b/prebuilts/api/202504/private/otapreopt_slot.te
@@ -0,0 +1,28 @@
+# This command set moves the artifact corresponding to the current slot
+# from /data/ota to /data/dalvik-cache.
+
+type otapreopt_slot, domain, mlstrustedsubject, coredomain;
+type otapreopt_slot_exec, system_file_type, exec_type, file_type;
+
+# Technically not a daemon but we do want the transition from init domain to
+# cppreopts to occur.
+init_daemon_domain(otapreopt_slot)
+
+# The otapreopt_slot renames the OTA dalvik-cache to the regular dalvik-cache, and cleans up
+# the directory afterwards. For logging of aggregate size, we need getattr.
+allow otapreopt_slot ota_data_file:dir { rw_dir_perms rename reparent rmdir };
+allow otapreopt_slot ota_data_file:{ file lnk_file } getattr;
+# (du follows symlinks)
+allow otapreopt_slot ota_data_file:lnk_file read;
+
+# Delete old content of the dalvik-cache.
+allow otapreopt_slot dalvikcache_data_file:dir { add_name getattr open read remove_name rmdir search write };
+allow otapreopt_slot dalvikcache_data_file:file { getattr unlink };
+allow otapreopt_slot dalvikcache_data_file:lnk_file { getattr read unlink };
+
+# Allow cppreopts to execute itself using #!/system/bin/sh
+allow otapreopt_slot shell_exec:file rx_file_perms;
+
+# Allow running the mv and rm/rmdir commands using otapreopt_slot permissions.
+# Needed so we can move artifacts into /data/dalvik-cache/dalvik-cache.
+allow otapreopt_slot toolbox_exec:file rx_file_perms;
diff --git a/prebuilts/api/202504/private/perfetto.te b/prebuilts/api/202504/private/perfetto.te
new file mode 100644
index 0000000..07d4399
--- /dev/null
+++ b/prebuilts/api/202504/private/perfetto.te
@@ -0,0 +1,152 @@
+# Perfetto command-line client. Can be used only from the domains that are
+# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto).
+# This command line client accesses the privileged socket of the traced
+# daemon.
+
+type perfetto_exec, system_file_type, exec_type, file_type;
+type perfetto_tmpfs, file_type;
+
+tmpfs_domain(perfetto);
+
+# Allow init to start a trace (for perfetto_boottrace).
+init_daemon_domain(perfetto)
+
+# Allow to access traced's privileged consumer socket.
+unix_socket_connect(perfetto, traced_consumer, traced)
+
+# Connect to the Perfetto traced daemon as a producer. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+perfetto_producer(perfetto)
+
+# Allow to write and unlink traces into /data/misc/perfetto-traces.
+allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
+allow perfetto perfetto_traces_data_file:file create_file_perms;
+
+# Allow to write and unlink trace into /data/misc/perfetto-traces/bugreport*
+allow perfetto perfetto_traces_bugreport_data_file:file create_file_perms;
+allow perfetto perfetto_traces_bugreport_data_file:dir rw_dir_perms;
+
+# Allow to write and unlink traces into /data/misc/perfetto-traces/profiling.
+allow perfetto perfetto_traces_profiling_data_file:dir rw_dir_perms;
+allow perfetto perfetto_traces_profiling_data_file:file create_file_perms;
+
+# Allow perfetto to access the proxy service for reporting traces.
+allow perfetto tracingproxy_service:service_manager find;
+binder_use(perfetto)
+binder_call(perfetto, system_server)
+
+# Allow perfetto to read the trace config from /data/misc/perfetto-configs.
+# shell and adb can write files into that directory.
+allow perfetto perfetto_configs_data_file:dir r_dir_perms;
+allow perfetto perfetto_configs_data_file:file r_file_perms;
+
+# Allow perfetto to read the trace config from /system/etc/perfetto.
+allow perfetto system_perfetto_config_file:dir r_dir_perms;
+allow perfetto system_perfetto_config_file:file r_file_perms;
+
+# Allow perfetto to read the trace config from statsd, mm_events and shell
+# (both root and non-root) on stdin and also to write the resulting trace to
+# stdout.
+allow perfetto { statsd mm_events shell su }:fd use;
+allow perfetto { statsd mm_events shell su system_server }:fifo_file { getattr read write ioctl };
+
+# Allow to communicate use, read and write over the adb connection.
+allow perfetto adbd:fd use;
+allow perfetto adbd:unix_stream_socket { read write };
+
+# Allow adbd to reap perfetto.
+allow perfetto adbd:process { sigchld };
+
+# Allow perfetto to write to statsd.
+unix_socket_send(perfetto, statsdw, statsd)
+
+# Allow to access /dev/pts when launched in an adb shell.
+allow perfetto devpts:chr_file rw_file_perms;
+
+# Allow perfetto to ask incidentd to start a report.
+# TODO(lalitm): remove all incidentd rules when proxy service is stable.
+allow perfetto incident_service:service_manager find;
+binder_call(perfetto, incidentd)
+
+# perfetto log formatter calls isatty() on its stderr. Denial when running
+# under adbd is harmless. Avoid generating denial logs.
+dontaudit perfetto adbd:unix_stream_socket getattr;
+dontauditxperm perfetto adbd:unix_stream_socket ioctl unpriv_tty_ioctls;
+# As above, when adbd is running in "su" domain (only the ioctl is denied in
+# practice).
+dontauditxperm perfetto su:unix_stream_socket ioctl unpriv_tty_ioctls;
+# Similarly, CTS tests end up hitting a denial on shell pipes.
+dontauditxperm perfetto shell:fifo_file ioctl unpriv_tty_ioctls;
+
+###
+### Neverallow rules
+###
+
+# Disallow anyone else from being able to handle traces except selected system
+# components.
+neverallow {
+ domain
+ -init # The creator of the folder.
+ -perfetto # The owner of the folder.
+ -adbd # For pulling traces.
+ -shell # For devepment purposes.
+ -traced # For write_into_file traces.
+ -dumpstate # For attaching traces to bugreports.
+ -incidentd # For receiving reported traces. TODO(lalitm): remove this.
+ -priv_app # For stating traces for bug-report UI.
+ -system_server # For accessing traces started by profiling apis.
+ -trace_redactor # For accessing traces to be redacted.
+} perfetto_traces_data_file:dir *;
+neverallow {
+ domain
+ -init # The creator of the folder.
+ -perfetto # The owner of the folder.
+ -adbd # For pulling traces.
+ -shell # For devepment purposes.
+ -traced # For write_into_file traces.
+ -incidentd # For receiving reported traces. TODO(lalitm): remove this.
+ -trace_redactor # For redacting trace files.
+} perfetto_traces_data_file:file ~{ getattr read };
+
+### perfetto should NEVER do any of the following
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow perfetto self:process execmem;
+
+# Block device access.
+neverallow perfetto dev_type:blk_file { read write };
+
+# ptrace any other process
+neverallow perfetto domain:process ptrace;
+
+# Disallows access to other /data files.
+neverallow perfetto {
+ data_file_type
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
+ # neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+ -perfetto_traces_data_file
+ -perfetto_traces_bugreport_data_file
+ -perfetto_traces_profiling_data_file
+ -perfetto_configs_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:dir *;
+neverallow perfetto {
+ system_data_file
+ -perfetto_traces_data_file
+ -perfetto_traces_profiling_data_file
+}:dir ~{ getattr search };
+neverallow perfetto {
+ data_file_type
+ -perfetto_traces_data_file
+ -perfetto_traces_bugreport_data_file
+ -perfetto_traces_profiling_data_file
+ -perfetto_configs_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:file ~write;
diff --git a/prebuilts/api/202504/private/performanced.te b/prebuilts/api/202504/private/performanced.te
new file mode 100644
index 0000000..98107ca
--- /dev/null
+++ b/prebuilts/api/202504/private/performanced.te
@@ -0,0 +1,31 @@
+typeattribute performanced coredomain;
+
+init_daemon_domain(performanced)
+
+# Needed to check for app permissions.
+binder_use(performanced)
+binder_call(performanced, system_server)
+allow performanced permission_service:service_manager find;
+
+pdx_server(performanced, performance_client)
+
+# TODO: use file caps to obtain sys_nice instead of setuid / setgid.
+allow performanced self:global_capability_class_set { setuid setgid sys_nice };
+
+# Access /proc to validate we're only affecting threads in the same thread group.
+# Performanced also shields unbound kernel threads. It scans every task in the
+# root cpu set, but only affects the kernel threads.
+r_dir_file(performanced, { appdomain bufferhubd kernel surfaceflinger })
+dontaudit performanced domain:dir read;
+allow performanced { appdomain bufferhubd kernel surfaceflinger }:process setsched;
+
+# These /proc accesses only show up in permissive mode but they
+# generate a lot of noise in the log.
+userdebug_or_eng(`
+ dontaudit performanced domain:dir open;
+ dontaudit performanced domain:file { open read getattr };
+')
+
+# Access /dev/cpuset/cpuset.cpus
+r_dir_file(performanced, cgroup)
+r_dir_file(performanced, cgroup_v2)
diff --git a/prebuilts/api/202504/private/permissioncontroller_app.te b/prebuilts/api/202504/private/permissioncontroller_app.te
new file mode 100644
index 0000000..5f81875
--- /dev/null
+++ b/prebuilts/api/202504/private/permissioncontroller_app.te
@@ -0,0 +1,22 @@
+###
+### A domain for further sandboxing the GooglePermissionController app.
+###
+type permissioncontroller_app, domain, coredomain;
+
+app_domain(permissioncontroller_app)
+
+allow permissioncontroller_app app_api_service:service_manager find;
+allow permissioncontroller_app system_api_service:service_manager find;
+
+# Allow interaction with gpuservice
+binder_call(permissioncontroller_app, gpuservice)
+
+allow permissioncontroller_app radio_service:service_manager find;
+
+# Allow the app to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow permissioncontroller_app incident_service:service_manager find;
+binder_call(permissioncontroller_app, incidentd)
+allow permissioncontroller_app incidentd:fifo_file { read write };
+
+allow permissioncontroller_app gpu_device:dir search;
diff --git a/prebuilts/api/202504/private/platform_app.te b/prebuilts/api/202504/private/platform_app.te
new file mode 100644
index 0000000..e60dcdd
--- /dev/null
+++ b/prebuilts/api/202504/private/platform_app.te
@@ -0,0 +1,154 @@
+###
+### Apps signed with the platform key.
+###
+
+typeattribute platform_app coredomain;
+
+app_domain(platform_app)
+
+# Access the network.
+net_domain(platform_app)
+# Access bluetooth.
+bluetooth_domain(platform_app)
+# Read from /data/local/tmp or /data/data/com.android.shell.
+allow platform_app shell_data_file:dir search;
+allow platform_app shell_data_file:file { open getattr read };
+allow platform_app icon_file:file { open getattr read };
+# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
+# created by system server.
+allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
+allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
+allow platform_app apk_private_data_file:dir search;
+# ASEC
+allow platform_app asec_apk_file:dir create_dir_perms;
+allow platform_app asec_apk_file:file create_file_perms;
+
+# Access to /data/media.
+allow platform_app media_rw_data_file:dir create_dir_perms;
+allow platform_app media_rw_data_file:file create_file_perms;
+
+# Write to /cache.
+allow platform_app cache_file:dir create_dir_perms;
+allow platform_app cache_file:file create_file_perms;
+
+# Direct access to vold-mounted storage under /mnt/media_rw
+# This is a performance optimization that allows platform apps to bypass the FUSE layer
+allow platform_app mnt_media_rw_file:dir r_dir_perms;
+allow platform_app sdcard_type:dir create_dir_perms;
+allow platform_app sdcard_type:file create_file_perms;
+
+# com.android.systemui
+allow platform_app rootfs:dir getattr;
+get_prop(platform_app, radio_cdma_ecm_prop)
+userdebug_or_eng(`
+ set_prop(platform_app, persist_wm_debug_prop)
+')
+neverallow { domain -init -dumpstate userdebug_or_eng(`-domain') } persist_wm_debug_prop:property_service set;
+
+userdebug_or_eng(`
+ set_prop(platform_app, persist_sysui_builder_extras_prop)
+')
+userdebug_or_eng(`
+ set_prop(platform_app, persist_sysui_ranking_update_prop)
+')
+set_prop(platform_app, debug_tracing_desktop_mode_visible_tasks_prop)
+
+# com.android.captiveportallogin reads /proc/vmstat
+allow platform_app {
+ proc_vmstat
+}:file r_file_perms;
+
+# /proc/net access.
+# TODO(b/9496886) Audit access for removal.
+r_dir_file(platform_app, proc_net_type)
+userdebug_or_eng(`
+ auditallow platform_app proc_net_type:{ dir file lnk_file } { getattr open read };
+')
+
+# Allow sharing traces to betterbug from /data/misc/wmtrace.
+userdebug_or_eng(`
+ allow platform_app trace_data_file:file create_file_perms;
+ allow platform_app trace_data_file:dir rw_dir_perms;
+')
+
+# Allow writing and removing wmshell protolog in /data/misc/wmtrace.
+userdebug_or_eng(`
+ allow platform_app wm_trace_data_file:dir rw_dir_perms;
+ allow platform_app wm_trace_data_file:file { getattr setattr create unlink rw_file_perms };
+')
+
+
+# To exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe. Allow to access traced's privileged consumer socket.
+userdebug_or_eng(`
+ allow platform_app perfetto_exec:file rx_file_perms;
+ unix_socket_connect(platform_app, traced_consumer, traced);
+')
+
+allow platform_app audioserver_service:service_manager find;
+allow platform_app cameraserver_service:service_manager find;
+allow platform_app drmserver_service:service_manager find;
+allow platform_app mediaserver_service:service_manager find;
+allow platform_app mediametrics_service:service_manager find;
+allow platform_app mediaextractor_service:service_manager find;
+allow platform_app mediadrmserver_service:service_manager find;
+allow platform_app persistent_data_block_service:service_manager find;
+allow platform_app radio_service:service_manager find;
+allow platform_app thermal_service:service_manager find;
+allow platform_app app_api_service:service_manager find;
+allow platform_app system_api_service:service_manager find;
+allow platform_app vr_manager_service:service_manager find;
+allow platform_app stats_service:service_manager find;
+allow platform_app tradeinmode_service:service_manager find;
+
+# Allow platform apps to log via statsd.
+binder_call(platform_app, statsd)
+
+# Allow platform applications to find and call artd for testing
+userdebug_or_eng(`
+ allow platform_app artd_service:service_manager find;
+ binder_call(platform_app, artd)
+')
+
+# Access to /data/preloads
+allow platform_app preloads_data_file:file r_file_perms;
+allow platform_app preloads_data_file:dir r_dir_perms;
+allow platform_app preloads_media_file:file r_file_perms;
+allow platform_app preloads_media_file:dir r_dir_perms;
+
+read_runtime_log_tags(platform_app)
+
+# allow platform apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow platform_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow platform apps to connect to the property service
+set_prop(platform_app, test_boot_reason_prop)
+
+# allow platform apps to read keyguard.no_require_sim
+get_prop(platform_app, keyguard_config_prop)
+
+# allow platform apps to read qemu.hw.mainkeys
+get_prop(platform_app, qemu_hw_prop)
+
+# allow platform apps to read sys.boot.reason.last
+get_prop(platform_app, last_boot_reason_prop)
+
+# allow platform apps to create symbolic link
+allow platform_app app_data_file:lnk_file create_file_perms;
+
+# suppress denials caused by debugfs_tracing
+dontaudit platform_app debugfs_tracing:file rw_file_perms;
+
+# Allow platform apps to create VMs
+virtualizationservice_use(platform_app)
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -init userdebug_or_eng(`-shell -platform_app') } persist_sysui_builder_extras_prop:property_service set;
+
+# app domains which access /dev/fuse should not run as platform_app
+neverallow platform_app fuse_device:chr_file *;
diff --git a/prebuilts/api/202504/private/policy_capabilities b/prebuilts/api/202504/private/policy_capabilities
new file mode 100644
index 0000000..9290e3a
--- /dev/null
+++ b/prebuilts/api/202504/private/policy_capabilities
@@ -0,0 +1,20 @@
+# Enable new networking controls.
+policycap network_peer_controls;
+
+# Enable open permission check.
+policycap open_perms;
+
+# Enable separate security classes for
+# all network address families previously
+# mapped to the socket class and for
+# ICMP and SCTP sockets previously mapped
+# to the rawip_socket class.
+policycap extended_socket_class;
+
+# Enable NoNewPrivileges support. Requires libsepol 2.7+
+# and kernel 4.14 (estimated).
+#
+# Checks enabled;
+# process2: nnp_transition, nosuid_transition
+#
+policycap nnp_nosuid_transition;
diff --git a/prebuilts/api/202504/private/port_contexts b/prebuilts/api/202504/private/port_contexts
new file mode 100644
index 0000000..b473c0c
--- /dev/null
+++ b/prebuilts/api/202504/private/port_contexts
@@ -0,0 +1,3 @@
+# portcon statements go here, e.g.
+# portcon tcp 80 u:object_r:http_port:s0
+
diff --git a/prebuilts/api/202504/private/postinstall.te b/prebuilts/api/202504/private/postinstall.te
new file mode 100644
index 0000000..5a2804b
--- /dev/null
+++ b/prebuilts/api/202504/private/postinstall.te
@@ -0,0 +1,53 @@
+typeattribute postinstall coredomain;
+type postinstall_exec, system_file_type, exec_type, file_type;
+domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)
+
+allow postinstall rootfs:dir r_dir_perms;
+
+# Allow invoking `pm` shell commands.
+allow postinstall package_service:service_manager find;
+
+# Allow postinstall to write to its stdout/stderr when redirected via pipes to
+# update_engine.
+allow postinstall update_engine_common:fd use;
+allow postinstall update_engine_common:fifo_file rw_file_perms;
+
+# Allow postinstall to read and execute directories and files in the same
+# mounted location.
+allow postinstall postinstall_file:file rx_file_perms;
+allow postinstall postinstall_file:lnk_file r_file_perms;
+allow postinstall postinstall_file:dir r_dir_perms;
+
+# Allow postinstall to execute the shell or other system executables.
+allow postinstall shell_exec:file rx_file_perms;
+allow postinstall system_file:file rx_file_perms;
+allow postinstall toolbox_exec:file rx_file_perms;
+
+# Allow postinstall to execute shell in recovery.
+recovery_only(`
+ allow postinstall rootfs:file rx_file_perms;
+')
+
+#
+# For OTA dexopt.
+#
+
+# Allow postinstall scripts to talk to the system server.
+binder_use(postinstall)
+binder_call(postinstall, system_server)
+
+# Need to talk to the otadexopt service.
+allow postinstall otadexopt_service:service_manager find;
+
+# Allow postinstall scripts to trigger f2fs garbage collection
+allow postinstall sysfs_fs_f2fs:file rw_file_perms;
+allow postinstall sysfs_fs_f2fs:dir r_dir_perms;
+
+###
+### Neverallow rules
+###
+
+# No domain other than update_engine and recovery (via update_engine_sideload)
+# should transition to postinstall, as it is only meant to run during the
+# update.
+neverallow { domain -update_engine -recovery } postinstall:process { transition dyntransition };
diff --git a/prebuilts/api/202504/private/postinstall_dexopt.te b/prebuilts/api/202504/private/postinstall_dexopt.te
new file mode 100644
index 0000000..cdf403c
--- /dev/null
+++ b/prebuilts/api/202504/private/postinstall_dexopt.te
@@ -0,0 +1,90 @@
+# Domain for the otapreopt executable, running under postinstall_dexopt
+#
+# Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such,
+# this is derived and adapted from installd.te.
+
+type postinstall_dexopt, domain, coredomain, mlstrustedsubject;
+type postinstall_dexopt_exec, system_file_type, exec_type, file_type;
+type postinstall_dexopt_tmpfs, file_type;
+
+# Run dex2oat/patchoat in its own sandbox.
+# We have to manually transition, as we don't have an entrypoint.
+# - Case where dex2oat is in a non-flattened APEX, which has retained
+# the correct type (`dex2oat_exec`).
+domain_auto_trans(postinstall_dexopt, dex2oat_exec, dex2oat)
+# - Case where dex2oat is in a flattened APEX, which has been tagged
+# with the `postinstall_file` type by update_engine.
+domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)
+
+# Run derive_classpath to get the current BCP.
+domain_auto_trans(postinstall_dexopt, derive_classpath_exec, derive_classpath)
+# Allow postinstall_dexopt to make a tempfile for derive_classpath to write into
+tmpfs_domain(postinstall_dexopt);
+allow postinstall_dexopt postinstall_dexopt_tmpfs:file open;
+
+allow postinstall_dexopt self:global_capability_class_set { chown dac_override dac_read_search fowner fsetid setgid setuid };
+
+allow postinstall_dexopt postinstall_file:filesystem getattr;
+allow postinstall_dexopt postinstall_file:dir { getattr read search };
+allow postinstall_dexopt postinstall_file:lnk_file { getattr read };
+allow postinstall_dexopt proc_filesystems:file { getattr open read };
+allow postinstall_dexopt rootfs:file r_file_perms;
+
+allow postinstall_dexopt tmpfs:file read;
+
+# Allow access odsign verification status
+get_prop(postinstall_dexopt, odsign_prop)
+
+# Allow access to /postinstall/apex.
+allow postinstall_dexopt postinstall_apex_mnt_dir:dir { getattr search };
+
+# Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
+# here and having to relabel the directory.
+
+# Read app data (APKs) as input to dex2oat.
+r_dir_file(postinstall_dexopt, apk_data_file)
+# Read vendor app data (APKs) as input to dex2oat.
+r_dir_file(postinstall_dexopt, vendor_app_file)
+# Read vendor overlay files (APKs) as input to dex2oat.
+r_dir_file(postinstall_dexopt, vendor_overlay_file)
+# Vendor overlay can be found in vendor apex
+allow postinstall_dexopt vendor_apex_metadata_file:dir { getattr search };
+# Access to app oat directory.
+r_dir_file(postinstall_dexopt, dalvikcache_data_file)
+
+# Read profile data.
+allow postinstall_dexopt { user_profile_root_file user_profile_data_file }:dir { getattr search };
+allow postinstall_dexopt user_profile_data_file:file r_file_perms;
+# Suppress deletion denial (we do not want to update the profile).
+dontaudit postinstall_dexopt user_profile_data_file:file { write };
+
+# Write to /data/ota(/*). Create symlinks in /data/ota(/*)
+allow postinstall_dexopt ota_data_file:dir create_dir_perms;
+allow postinstall_dexopt ota_data_file:file create_file_perms;
+allow postinstall_dexopt ota_data_file:lnk_file create_file_perms;
+
+# Need to write .b files, which are dalvikcache_data_file, not ota_data_file.
+# TODO: See whether we can apply ota_data_file?
+allow postinstall_dexopt dalvikcache_data_file:dir rw_dir_perms;
+allow postinstall_dexopt dalvikcache_data_file:file create_file_perms;
+
+# Allow labeling of files under /data/app/com.example/oat/
+# TODO: Restrict to .b suffix?
+allow postinstall_dexopt dalvikcache_data_file:dir relabelto;
+allow postinstall_dexopt dalvikcache_data_file:file { relabelto link };
+
+# Check validity of SELinux context before use.
+selinux_check_context(postinstall_dexopt)
+selinux_check_access(postinstall_dexopt)
+
+
+# Postinstall wants to know about our child.
+allow postinstall_dexopt postinstall:process sigchld;
+
+# Allow otapreopt to use file descriptors from otapreopt_chroot.
+# TODO: Probably we can actually close file descriptors...
+allow postinstall_dexopt otapreopt_chroot:fd use;
+
+# Allow postinstall_dexopt to access the runtime feature flag properties.
+get_prop(postinstall_dexopt, device_config_runtime_native_prop)
+get_prop(postinstall_dexopt, device_config_runtime_native_boot_prop)
diff --git a/prebuilts/api/202504/private/prefetch.te b/prebuilts/api/202504/private/prefetch.te
new file mode 100644
index 0000000..21287f3
--- /dev/null
+++ b/prebuilts/api/202504/private/prefetch.te
@@ -0,0 +1,24 @@
+type prefetch, coredomain, domain;
+type prefetch_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(prefetch)
+
+# Allow prefetch to start recording by enabling tracing event under
+# /sys/kernel/tracing/events/filemap/mm_filemap_add_to_page_cache
+allow prefetch debugfs_tracing_instances:dir create_dir_perms;
+allow prefetch debugfs_tracing_instances:file rw_file_perms;
+
+# Allow to read/write/create/delete to storage prefetch record files
+allow prefetch metadata_file:dir search;
+allow prefetch prefetch_metadata_file:dir rw_dir_perms;
+allow prefetch prefetch_metadata_file:file create_file_perms;
+
+get_prop(prefetch, prefetch_boot_prop);
+set_prop(prefetch, prefetch_service_prop);
+
+# Disallow other domains controlling prefetch service.
+neverallow {
+ domain
+ -init
+ -shell
+} ctl_prefetch_prop:property_service set;
diff --git a/prebuilts/api/202504/private/preloads_copy.te b/prebuilts/api/202504/private/preloads_copy.te
new file mode 100644
index 0000000..ba54b70
--- /dev/null
+++ b/prebuilts/api/202504/private/preloads_copy.te
@@ -0,0 +1,18 @@
+type preloads_copy, domain, coredomain;
+type preloads_copy_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(preloads_copy)
+
+allow preloads_copy shell_exec:file rx_file_perms;
+allow preloads_copy toolbox_exec:file rx_file_perms;
+allow preloads_copy preloads_data_file:dir create_dir_perms;
+allow preloads_copy preloads_data_file:file create_file_perms;
+allow preloads_copy preloads_media_file:dir create_dir_perms;
+allow preloads_copy preloads_media_file:file create_file_perms;
+
+# Allow to copy from /postinstall
+allow preloads_copy system_file:dir r_dir_perms;
+
+# Silence the denial when /postinstall cannot be mounted, e.g., system_other
+# is wiped, but preloads_copy.sh still runs.
+dontaudit preloads_copy postinstall_mnt_dir:dir search;
diff --git a/prebuilts/api/202504/private/preopt2cachename.te b/prebuilts/api/202504/private/preopt2cachename.te
new file mode 100644
index 0000000..dcfba14
--- /dev/null
+++ b/prebuilts/api/202504/private/preopt2cachename.te
@@ -0,0 +1,17 @@
+# preopt2cachename executable
+#
+# This executable translates names from the preopted versions the build system
+# creates to the names the runtime expects in the data directory.
+
+type preopt2cachename, domain, coredomain;
+type preopt2cachename_exec, system_file_type, exec_type, file_type;
+
+# Allow write to stdout.
+allow preopt2cachename cppreopts:fd use;
+allow preopt2cachename cppreopts:fifo_file { getattr read write };
+
+# Allow write to logcat.
+allow preopt2cachename proc_net_type:file r_file_perms;
+userdebug_or_eng(`
+ auditallow preopt2cachename proc_net_type:{ dir file lnk_file } { getattr open read };
+')
diff --git a/prebuilts/api/202504/private/priv_app.te b/prebuilts/api/202504/private/priv_app.te
new file mode 100644
index 0000000..1ef5be1
--- /dev/null
+++ b/prebuilts/api/202504/private/priv_app.te
@@ -0,0 +1,299 @@
+###
+### A domain for further sandboxing privileged apps.
+###
+
+typeattribute priv_app coredomain;
+app_domain(priv_app)
+
+# Access the network.
+net_domain(priv_app)
+# Access bluetooth.
+bluetooth_domain(priv_app)
+
+# Allow the allocation and use of ptys
+# Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
+create_pty(priv_app)
+
+# Allow loading executable code from writable priv-app home
+# directories. This is a W^X violation, however, it needs
+# to be supported for now for the following reasons.
+# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
+# 1) com.android.opengl.shaders_cache
+# 2) com.android.skia.shaders_cache
+# 3) com.android.renderscript.cache
+# * /data/user_de/0/com.google.android.gms/app_chimera
+# TODO: Tighten (b/112357170)
+allow priv_app privapp_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow priv_app system_linker_exec:file execute_no_trans;
+
+allow priv_app privapp_data_file:lnk_file create_file_perms;
+
+# Priv apps can find services that expose both @SystemAPI and normal APIs.
+allow priv_app app_api_service:service_manager find;
+allow priv_app system_api_service:service_manager find;
+
+allow priv_app audioserver_service:service_manager find;
+allow priv_app cameraserver_service:service_manager find;
+allow priv_app drmserver_service:service_manager find;
+allow priv_app mediadrmserver_service:service_manager find;
+allow priv_app mediaextractor_service:service_manager find;
+allow priv_app mediametrics_service:service_manager find;
+allow priv_app mediaserver_service:service_manager find;
+allow priv_app music_recognition_service:service_manager find;
+allow priv_app network_watchlist_service:service_manager find;
+allow priv_app nfc_service:service_manager find;
+allow priv_app oem_lock_service:service_manager find;
+allow priv_app persistent_data_block_service:service_manager find;
+allow priv_app radio_service:service_manager find;
+allow priv_app recovery_service:service_manager find;
+allow priv_app stats_service:service_manager find;
+
+# Write to /cache.
+allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
+allow priv_app { cache_file cache_recovery_file }:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow priv_app cache_file:lnk_file r_file_perms;
+
+# Access to /data/media.
+allow priv_app media_rw_data_file:dir create_dir_perms;
+allow priv_app media_rw_data_file:file create_file_perms;
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow priv_app shell_data_file:file r_file_perms;
+allow priv_app shell_data_file:dir r_dir_perms;
+
+# Allow traceur to pass file descriptors through a content provider to betterbug
+allow priv_app trace_data_file:file { getattr read };
+
+# Allow betterbug to read profile reports generated by profcollect.
+userdebug_or_eng(`
+ allow priv_app profcollectd_data_file:file r_file_perms;
+')
+
+# Allow the bug reporting frontend to read the presence and timestamp of the
+# trace attached to the bugreport (but not its contents, which will go in the
+# usual bugreport .zip file). This is used by the bug reporting UI to tell if
+# the bugreport will contain a system trace or not while the bugreport is still
+# in progress.
+allow priv_app wm_trace_data_file:dir r_dir_perms;
+allow priv_app wm_trace_data_file:file getattr;
+allow priv_app perfetto_traces_bugreport_data_file:dir r_dir_perms;
+allow priv_app perfetto_traces_bugreport_data_file:file { getattr };
+# Required to traverse the parent dir (/data/misc/perfetto-traces).
+allow priv_app perfetto_traces_data_file:dir { search };
+
+# Allow priv apps (e.g. BetterBug) to receive Perfetto traces through
+# the framework (i.e. TracingServiceProxy) and sendfile them into their private
+# directories for reporting when network and battery conditions are
+# appropriate.
+allow priv_app perfetto:fd use;
+allow priv_app perfetto_traces_data_file:file { read getattr };
+
+# Allow verifier to access staged apks.
+allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
+allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
+allowxperm priv_app { apk_tmp_file apk_private_tmp_file }:file ioctl FS_IOC_MEASURE_VERITY;
+
+# For AppFuse.
+allow priv_app vold:fd use;
+allow priv_app fuse_device:chr_file { read write };
+
+# /proc access
+allow priv_app {
+ proc_vmstat
+}:file r_file_perms;
+
+allow priv_app sysfs_type:dir search;
+# Read access to /sys/block/zram*/mm_stat
+r_dir_file(priv_app, sysfs_zram)
+
+r_dir_file(priv_app, rootfs)
+
+# Allow com.android.vending to communicate with statsd.
+binder_call(priv_app, statsd)
+
+# Allow Phone to read/write cached ringtones (opened by system).
+allow priv_app ringtone_file:file { getattr read write };
+
+# Access to /data/preloads
+allow priv_app preloads_data_file:file r_file_perms;
+allow priv_app preloads_data_file:dir r_dir_perms;
+allow priv_app preloads_media_file:file r_file_perms;
+allow priv_app preloads_media_file:dir r_dir_perms;
+
+read_runtime_log_tags(priv_app)
+
+# Allow priv_apps to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow priv_app incident_service:service_manager find;
+binder_call(priv_app, incidentd)
+allow priv_app incidentd:fifo_file { read write };
+
+# Allow priv_apps to check whether Dynamic System Update is enabled
+get_prop(priv_app, dynamic_system_prop)
+
+# Allow privileged apps to read trade in mode property
+get_prop(priv_app, adbd_tradeinmode_prop)
+
+# suppress denials for non-API accesses.
+dontaudit priv_app exec_type:file getattr;
+dontaudit priv_app device:dir read;
+dontaudit priv_app fs_bpf:dir search;
+dontaudit priv_app net_dns_prop:file read;
+dontaudit priv_app proc:file read;
+dontaudit priv_app proc_interrupts:file read;
+dontaudit priv_app proc_modules:file read;
+dontaudit priv_app proc_net:file read;
+dontaudit priv_app proc_stat:file read;
+dontaudit priv_app proc_version:file read;
+dontaudit priv_app sysfs:dir read;
+dontaudit priv_app sysfs:file read;
+dontaudit priv_app sysfs_android_usb:file read;
+dontaudit priv_app sysfs_dm:file r_file_perms;
+dontaudit priv_app { wifi_prop wifi_config_prop wifi_hal_prop }:file read;
+
+# allow privileged apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow priv_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow apps like Phonesky to check the file signature of an apk installed on
+# the Incremental File System, fill missing blocks and get the app status and loading progress
+allowxperm priv_app apk_data_file:file ioctl {
+ INCFS_IOCTL_READ_SIGNATURE
+ INCFS_IOCTL_FILL_BLOCKS
+ INCFS_IOCTL_GET_BLOCK_COUNT
+ INCFS_IOCTL_GET_FILLED_BLOCKS
+};
+
+# allow privileged data loader apps (e.g. com.android.vending) to read logs from Incremental File System
+allow priv_app incremental_control_file:file { read getattr ioctl };
+
+# allow apps like Phonesky to request permission to fill blocks of an apk file
+# on the Incremental File System.
+allowxperm priv_app incremental_control_file:file ioctl INCFS_IOCTL_PERMIT_FILL;
+
+# allow privileged apps to read the vendor property that indicates if Incremental File System is enabled
+get_prop(priv_app, incremental_prop)
+
+# allow privileged apps to read the device config flags.
+get_prop(priv_app, device_config_aconfig_flags_prop)
+
+# allow privileged apps to read boot reason property
+get_prop(priv_app, system_boot_reason_prop)
+
+# Required for Phonesky to be able to read APEX files under /data/apex/active/.
+allow priv_app apex_data_file:dir search;
+allow priv_app staging_data_file:file r_file_perms;
+# Required for Phonesky to be able to read staged files under /data/app-staging.
+allow priv_app staging_data_file:dir r_dir_perms;
+
+# Allow com.android.vending to access files under vendor/apex as well as system apex files.
+# This is required for com.android.vending to handle APEXes for e.g. delta patch optimization.
+allow priv_app vendor_apex_file:dir r_dir_perms;
+allow priv_app vendor_apex_file:file r_file_perms;
+
+# allow priv app to access the system app data files for ContentProvider case.
+allow priv_app system_app_data_file:file { read getattr };
+
+# Allow the renderscript compiler to be run.
+domain_auto_trans(priv_app, rs_exec, rs)
+
+# Allow loading and deleting executable shared libraries
+# within an application home directory. Such shared libraries would be
+# created by things like renderscript or via other mechanisms.
+allow priv_app app_exec_data_file:file { r_file_perms execute unlink };
+
+# Allow privileged apps to create a VM. Note that access is still
+# guarded with the `android.permission.MANAGE_VIRTUAL_MACHINE`
+# permission.
+virtualizationservice_use(priv_app)
+
+###
+### neverallow rules
+###
+
+# Receive or send uevent messages.
+neverallow priv_app domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow priv_app domain:netlink_socket *;
+
+# Read or write kernel printk buffer
+neverallow priv_app kmsg_device:chr_file no_rw_file_perms;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow priv_app debugfs_type:file read;
+
+# Do not allow privileged apps to register services.
+# Only trusted components of Android should be registering
+# services.
+neverallow priv_app service_manager_type:service_manager add;
+
+# Do not allow privileged apps to connect to the property service
+# or set properties. b/10243159
+neverallow priv_app property_socket:sock_file write;
+neverallow priv_app init:unix_stream_socket connectto;
+neverallow priv_app property_type:property_service set;
+
+# Do not allow priv_app to be assigned mlstrustedsubject.
+# This would undermine the per-user isolation model being
+# enforced via levelFrom=user in seapp_contexts and the mls
+# constraints. As there is no direct way to specify a neverallow
+# on attribute assignment, this relies on the fact that fork
+# permission only makes sense within a domain (hence should
+# never be granted to any other domain within mlstrustedsubject)
+# and priv_app is allowed fork permission to itself.
+neverallow priv_app mlstrustedsubject:process fork;
+
+# Do not allow priv_app to hard link to any files.
+# In particular, if priv_app links to other app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure priv_app never has this
+# capability.
+neverallow priv_app file_type:file link;
+
+# priv apps should not be able to open trace data files, they should depend
+# upon traceur to pass a file descriptor which they can then read
+neverallow priv_app trace_data_file:dir *;
+neverallow priv_app trace_data_file:file { no_w_file_perms open };
+
+# Do not allow priv_app access to cgroups.
+neverallow priv_app cgroup:file *;
+neverallow priv_app cgroup_v2:file *;
+
+# Do not allow loading executable code from non-privileged
+# application home directories. Code loading across a security boundary
+# is dangerous and allows a full compromise of a privileged process
+# by an unprivileged process. b/112357170
+neverallow priv_app { app_data_file_type -privapp_data_file }:file no_x_file_perms;
+
+# Do not follow any app provided symlinks
+neverallow priv_app { app_data_file_type -privapp_data_file }:lnk_file { open read getattr };
+
+# Do not allow getting permission-protected network information from sysfs.
+neverallow priv_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm priv_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow priv_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow priv_app *:{
+ socket netlink_socket packet_socket key_socket appletalk_socket
+ netlink_tcpdiag_socket netlink_nflog_socket
+ netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+ netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+ netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+ netlink_rdma_socket netlink_crypto_socket sctp_socket
+ ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+ atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+ bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
diff --git a/prebuilts/api/202504/private/prng_seeder.te b/prebuilts/api/202504/private/prng_seeder.te
new file mode 100644
index 0000000..299e37b
--- /dev/null
+++ b/prebuilts/api/202504/private/prng_seeder.te
@@ -0,0 +1,17 @@
+# PRNG seeder daemon
+# Started from early init, maintains a FIPS approved DRBG which it periodically reseeds from
+# /dev/hw_random. When BoringSSL (libcrypto) in other processes needs seeding data for its
+# internal DRBGs it will connect to /dev/socket/prng_seeder and the daemon will write a
+# fixed size block of entropy then disconnect. No other IO is performed.
+typeattribute prng_seeder coredomain;
+
+# mlstrustedsubject required in order to allow connections from trusted app domains.
+typeattribute prng_seeder mlstrustedsubject;
+
+type prng_seeder_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(prng_seeder)
+
+# Socket open and listen are performed by init.
+allow prng_seeder prng_seeder:unix_stream_socket { read write getattr accept };
+allow prng_seeder hw_random_device:chr_file { read open };
+allow prng_seeder kmsg_debug_device:chr_file { w_file_perms getattr ioctl };
diff --git a/prebuilts/api/202504/private/profcollectd.te b/prebuilts/api/202504/private/profcollectd.te
new file mode 100644
index 0000000..8dc2d89
--- /dev/null
+++ b/prebuilts/api/202504/private/profcollectd.te
@@ -0,0 +1,69 @@
+# profcollectd - hardware profile collection daemon
+type profcollectd, domain, coredomain, mlstrustedsubject;
+type profcollectd_exec, system_file_type, exec_type, file_type;
+
+userdebug_or_eng(`
+ init_daemon_domain(profcollectd)
+
+ # profcollectd opens a file for writing in /data/misc/profcollectd.
+ allow profcollectd profcollectd_data_file:file create_file_perms;
+ allow profcollectd profcollectd_data_file:dir create_dir_perms;
+
+ # Allow profcollectd full use of perf_event_open(2), to enable system wide profiling.
+ allow profcollectd self:perf_event { cpu kernel open read write };
+
+ # Allow profcollectd to scan through /proc/pid for all processes.
+ r_dir_file(profcollectd, domain)
+
+ # Allow profcollectd to read executable binaries.
+ allow profcollectd system_file_type:file r_file_perms;
+ allow profcollectd vendor_file_type:file r_file_perms;
+
+ # Allow profcollectd to search for and read kernel modules.
+ allow profcollectd vendor_file:dir r_dir_perms;
+ allow profcollectd vendor_kernel_modules:file r_file_perms;
+
+ # Allow profcollectd to read (but not execute) system bootstrap libs.
+ allow profcollectd system_bootstrap_lib_file:dir search;
+ allow profcollectd system_bootstrap_lib_file:file r_file_perms;
+
+ # Allow profcollectd to access tracefs.
+ allow profcollectd debugfs_tracing:dir r_dir_perms;
+ allow profcollectd debugfs_tracing:file rw_file_perms;
+ allow profcollectd debugfs_tracing_debug:dir r_dir_perms;
+ allow profcollectd debugfs_tracing_debug:file rw_file_perms;
+
+ # Allow profcollectd to write to perf_event_paranoid under /proc.
+ allow profcollectd proc_perf:file write;
+
+ # Allow profcollectd to access cs_etm sysfs.
+ r_dir_file(profcollectd, sysfs_devices_cs_etm)
+
+ # Allow profcollectd to ptrace.
+ allow profcollectd self:global_capability_class_set sys_ptrace;
+
+ # Allow profcollectd to read its system properties.
+ get_prop(profcollectd, device_config_profcollect_native_boot_prop)
+ set_prop(profcollectd, profcollectd_node_id_prop)
+
+ # Allow profcollectd to trigger manual probe of coresight etr.
+ set_prop(profcollectd, profcollectd_etr_prop)
+
+ # Allow profcollectd to publish a binder service and make binder calls.
+ binder_use(profcollectd)
+ # Allow profcollectd to call callbacks registered by system_server when ETM is ready.
+ binder_call(profcollectd, system_server)
+ add_service(profcollectd, profcollectd_service)
+
+ # Allow profcollectd to request wakelock from system-suspend.
+ wakelock_use(profcollectd)
+
+ # Allow to temporarily lift the kptr_restrict setting and get kernel start address
+ # by reading /proc/kallsyms, get module start address by reading /proc/modules.
+ set_prop(profcollectd, lower_kptr_restrict_prop)
+ allow profcollectd proc_kallsyms:file r_file_perms;
+ allow profcollectd proc_modules:file r_file_perms;
+
+ # Allow profcollectd to read kernel build id.
+ allow profcollectd sysfs_kernel_notes:file r_file_perms;
+')
diff --git a/prebuilts/api/202504/private/profman.te b/prebuilts/api/202504/private/profman.te
new file mode 100644
index 0000000..d1ce926
--- /dev/null
+++ b/prebuilts/api/202504/private/profman.te
@@ -0,0 +1,48 @@
+typeattribute profman coredomain;
+typeattribute profman artd_subprocess_type;
+
+# Allow profman to read APKs and profile files next to them by FDs passed from
+# other programs. In addition, allow profman to acquire flocks on those files.
+allow profman {
+ system_file
+ apk_data_file
+ apk_tmp_file
+ vendor_app_file
+}:file { getattr read map lock };
+
+# Allow profman to use file descriptors passed from privileged programs.
+allow profman { artd installd }:fd use;
+
+# Allow profman to read from memfd created by artd.
+# profman needs to read the embedded profile that artd extracts from an APK,
+# which is passed by a memfd.
+allow profman artd_tmpfs:file { getattr read map lock };
+
+allow profman user_profile_data_file:file { getattr read write lock map };
+
+# Dumping profile info opens the application APK file for pretty printing.
+allow profman asec_apk_file:file { read map };
+allow profman apk_data_file:file { getattr read map };
+allow profman apk_data_file:dir { getattr read search };
+allow profman apk_tmp_file:dir { getattr read search };
+
+allow profman oemfs:file { read map };
+# Reading an APK opens a ZipArchive, which unpack to tmpfs.
+allow profman tmpfs:file { read map };
+allow profman profman_dump_data_file:file { write map };
+
+# Allow profman to analyze profiles for the secondary dex files. These
+# are application dex files reported back to the framework when using
+# BaseDexClassLoader.
+allow profman { privapp_data_file app_data_file }:file { getattr read write lock map };
+allow profman { privapp_data_file app_data_file }:dir { getattr read search };
+
+# Allow query ART device config properties
+get_prop(profman, device_config_runtime_native_prop)
+get_prop(profman, device_config_runtime_native_boot_prop)
+
+###
+### neverallow rules
+###
+
+neverallow profman app_data_file_type:notdevfile_class_set open;
diff --git a/prebuilts/api/202504/private/property.te b/prebuilts/api/202504/private/property.te
new file mode 100644
index 0000000..dec43e1
--- /dev/null
+++ b/prebuilts/api/202504/private/property.te
@@ -0,0 +1,889 @@
+# Properties used only in /system
+system_internal_prop(adbd_prop)
+system_internal_prop(adbd_tradeinmode_prop)
+system_internal_prop(apexd_payload_metadata_prop)
+system_internal_prop(ctl_snapuserd_prop)
+system_internal_prop(ctl_prefetch_prop)
+system_internal_prop(ctl_uprobestats_prop)
+system_internal_prop(crashrecovery_prop)
+system_internal_prop(debug_tracing_desktop_mode_visible_tasks_prop)
+system_internal_prop(device_config_core_experiments_team_internal_prop)
+system_internal_prop(device_config_lmkd_native_prop)
+system_internal_prop(device_config_mglru_native_prop)
+system_internal_prop(device_config_mmd_native_prop)
+system_internal_prop(device_config_profcollect_native_boot_prop)
+system_internal_prop(device_config_remote_key_provisioning_native_prop)
+system_internal_prop(device_config_statsd_native_prop)
+system_internal_prop(device_config_statsd_native_boot_prop)
+system_internal_prop(device_config_storage_native_boot_prop)
+system_internal_prop(device_config_sys_traced_prop)
+system_internal_prop(device_config_window_manager_native_boot_prop)
+system_internal_prop(device_config_configuration_prop)
+system_internal_prop(device_config_connectivity_prop)
+system_internal_prop(device_config_swcodec_native_prop)
+system_internal_prop(device_config_tethering_u_or_later_native_prop)
+system_internal_prop(dmesgd_start_prop)
+system_internal_prop(fastbootd_protocol_prop)
+system_internal_prop(gsid_prop)
+system_internal_prop(init_perf_lsm_hooks_prop)
+system_internal_prop(init_service_status_private_prop)
+system_internal_prop(init_storage_prop)
+system_internal_prop(init_svc_debug_prop)
+system_internal_prop(kcmdline_prop)
+system_internal_prop(keystore_diagnostics_prop)
+system_internal_prop(keystore_listen_prop)
+system_internal_prop(last_boot_reason_prop)
+system_internal_prop(localization_prop)
+system_internal_prop(logd_auditrate_prop)
+system_internal_prop(lower_kptr_restrict_prop)
+system_internal_prop(mmd_prop)
+system_internal_prop(net_464xlat_fromvendor_prop)
+system_internal_prop(net_connectivity_prop)
+system_internal_prop(netd_stable_secret_prop)
+system_internal_prop(next_boot_prop)
+system_internal_prop(odsign_prop)
+system_internal_prop(misctrl_prop)
+system_internal_prop(perf_drop_caches_prop)
+system_internal_prop(pm_prop)
+system_internal_prop(prefetch_service_prop)
+system_internal_prop(profcollectd_node_id_prop)
+system_internal_prop(radio_cdma_ecm_prop)
+system_internal_prop(remote_prov_prop)
+system_internal_prop(remote_prov_cert_prop)
+system_internal_prop(rollback_test_prop)
+system_internal_prop(setupwizard_prop)
+system_internal_prop(snapshotctl_prop)
+system_internal_prop(snapuserd_prop)
+system_internal_prop(system_adbd_prop)
+system_internal_prop(system_audio_config_prop)
+system_internal_prop(timezone_metadata_prop)
+system_internal_prop(traced_perf_enabled_prop)
+system_internal_prop(uprobestats_start_with_config_prop)
+system_internal_prop(tuner_server_ctl_prop)
+system_internal_prop(userspace_reboot_log_prop)
+system_internal_prop(userspace_reboot_test_prop)
+system_internal_prop(verity_status_prop)
+system_internal_prop(zygote_wrap_prop)
+system_internal_prop(ctl_mediatranscoding_prop)
+system_internal_prop(ctl_odsign_prop)
+system_internal_prop(virtualizationservice_prop)
+system_internal_prop(ctl_apex_load_prop)
+system_internal_prop(sensors_config_prop)
+system_internal_prop(hypervisor_pvmfw_prop)
+system_internal_prop(hypervisor_virtualizationmanager_prop)
+system_internal_prop(game_manager_config_prop)
+system_internal_prop(hidl_memory_prop)
+system_internal_prop(suspend_debug_prop)
+system_internal_prop(system_service_enable_prop)
+system_internal_prop(ctl_artd_pre_reboot_prop)
+system_internal_prop(trusty_security_vm_sys_prop)
+system_internal_prop(hint_manager_config_prop)
+
+# Properties which can't be written outside system
+system_restricted_prop(bionic_linker_16kb_app_compat_prop)
+system_restricted_prop(device_config_virtualization_framework_native_prop)
+system_restricted_prop(fstype_prop)
+system_restricted_prop(log_file_logger_prop)
+system_restricted_prop(persist_sysui_builder_extras_prop)
+system_restricted_prop(persist_sysui_ranking_update_prop)
+system_restricted_prop(page_size_prop)
+system_restricted_prop(pm_16kb_app_compat_prop)
+
+
+# Properties with no restrictions
+until_board_api(202504, `
+ system_public_prop(bluetooth_finder_prop)
+ system_public_prop(virtual_fingerprint_prop)
+ system_public_prop(virtual_face_prop)
+')
+
+# These types will be public starting at board api 202504
+until_board_api(202504, `
+ system_restricted_prop(enable_16k_pages_prop)
+ system_restricted_prop(profcollectd_etr_prop)
+')
+
+# These types will be public starting at board api 202504
+until_board_api(202504, `
+ system_vendor_config_prop(trusty_security_vm_sys_vendor_prop)
+')
+
+# Properties which should only be written by vendor_init
+system_vendor_config_prop(avf_virtualizationservice_prop)
+system_vendor_config_prop(high_barometer_quality_prop)
+system_vendor_config_prop(prefetch_boot_prop)
+system_vendor_config_prop(widevine_sys_vendor_prop)
+
+typeattribute log_prop log_property_type;
+typeattribute log_tag_prop log_property_type;
+typeattribute wifi_log_prop log_property_type;
+
+allow property_type tmpfs:filesystem associate;
+
+# core_property_type should not be used for new properties or
+# device specific properties. Properties with this attribute
+# are readable to everyone, which is overly broad and should
+# be avoided.
+# New properties should have appropriate read / write access
+# control rules written.
+
+typeattribute audio_prop core_property_type;
+typeattribute config_prop core_property_type;
+typeattribute cppreopt_prop core_property_type;
+typeattribute dalvik_prop core_property_type;
+typeattribute debuggerd_prop core_property_type;
+typeattribute debug_prop core_property_type;
+typeattribute dhcp_prop core_property_type;
+typeattribute dumpstate_prop core_property_type;
+typeattribute logd_prop core_property_type;
+typeattribute net_radio_prop core_property_type;
+typeattribute nfc_prop core_property_type;
+typeattribute ota_prop core_property_type;
+typeattribute pan_result_prop core_property_type;
+typeattribute persist_debug_prop core_property_type;
+typeattribute powerctl_prop core_property_type;
+typeattribute radio_prop core_property_type;
+typeattribute restorecon_prop core_property_type;
+typeattribute shell_prop core_property_type;
+typeattribute system_prop core_property_type;
+typeattribute usb_prop core_property_type;
+typeattribute vold_prop core_property_type;
+
+typeattribute dalvik_config_prop dalvik_config_prop_type;
+typeattribute dalvik_dynamic_config_prop dalvik_config_prop_type;
+
+###
+### Neverallow rules
+###
+
+treble_sysprop_neverallow(`
+
+enforce_sysprop_owner(`
+ neverallow domain {
+ property_type
+ -system_property_type
+ -product_property_type
+ -vendor_property_type
+ }:file no_rw_file_perms;
+')
+
+neverallow { domain -coredomain } {
+ system_property_type
+ system_internal_property_type
+ -system_restricted_property_type
+ -system_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { domain -coredomain } {
+ system_property_type
+ -system_public_property_type
+}:property_service set;
+
+# init is in coredomain, but should be able to read/write all props.
+# dumpstate is also in coredomain, but should be able to read all props.
+neverallow { coredomain -init -dumpstate } {
+ vendor_property_type
+ vendor_internal_property_type
+ -vendor_restricted_property_type
+ -vendor_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { coredomain -init } {
+ vendor_property_type
+ -vendor_public_property_type
+}:property_service set;
+
+')
+
+# There is no need to perform ioctl or advisory locking operations on
+# property files. If this neverallow is being triggered, it is
+# likely that the policy is using r_file_perms directly instead of
+# the get_prop() macro.
+neverallow domain property_type:file { ioctl lock };
+
+neverallow * {
+ core_property_type
+ -audio_prop
+ -config_prop
+ -cppreopt_prop
+ -dalvik_prop
+ -debuggerd_prop
+ -debug_prop
+ -dhcp_prop
+ -dumpstate_prop
+ -fingerprint_prop
+ -logd_prop
+ -net_radio_prop
+ -nfc_prop
+ -ota_prop
+ -pan_result_prop
+ -persist_debug_prop
+ -powerctl_prop
+ -radio_prop
+ -restorecon_prop
+ -shell_prop
+ -system_prop
+ -usb_prop
+ -vold_prop
+}:file no_rw_file_perms;
+
+# sigstop property is only used for debugging; should only be set by su which is permissive
+# for userdebug/eng
+neverallow {
+ domain
+ -init
+ -vendor_init
+} ctl_sigstop_prop:property_service set;
+
+# Don't audit legacy ctl. property handling. We only want the newer permission check to appear
+# in the audit log
+dontaudit domain {
+ ctl_bootanim_prop
+ ctl_bugreport_prop
+ ctl_console_prop
+ ctl_default_prop
+ ctl_dumpstate_prop
+ ctl_fuse_prop
+ ctl_mdnsd_prop
+ ctl_rildaemon_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -extra_free_kbytes
+} init_storage_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} init_svc_debug_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-su')
+} init_svc_debug_prop:file no_rw_file_perms;
+
+# DO NOT ADD: compat risk
+neverallow {
+ domain
+ -init
+ -crash_dump
+ -dumpstate
+ -misctrl
+ -statsd
+ userdebug_or_eng(`-su')
+} misctrl_prop:file no_rw_file_perms;
+neverallow {
+ domain
+ -init
+ -misctrl
+ userdebug_or_eng(`-su')
+} misctrl_prop:property_service set;
+
+compatible_property_only(`
+# Prevent properties from being set
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_init
+ } {
+ core_property_type
+ extended_core_property_type
+ exported_config_prop
+ exported_default_prop
+ exported_dumpstate_prop
+ exported_system_prop
+ exported3_system_prop
+ usb_control_prop
+ -nfc_prop
+ -powerctl_prop
+ -radio_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -hal_nfc_server
+ } {
+ nfc_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -hal_telephony_server
+ -vendor_init
+ } {
+ radio_control_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -hal_telephony_server
+ } {
+ radio_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -bluetooth
+ -hal_bluetooth_server
+ } {
+ bluetooth_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -bluetooth
+ -hal_bluetooth_server
+ -vendor_init
+ } {
+ exported_bluetooth_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -hal_camera_server
+ -cameraserver
+ -vendor_init
+ } {
+ exported_camera_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -coredomain
+ -hal_wifi_server
+ -wificond
+ } {
+ wifi_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -init
+ -dumpstate
+ -hal_wifi_server
+ -wificond
+ -vendor_init
+ } {
+ wifi_hal_prop
+ }:property_service set;
+
+# Prevent properties from being read
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_init
+ } {
+ core_property_type
+ dalvik_config_prop_type
+ extended_core_property_type
+ exported3_system_prop
+ systemsound_config_prop
+ -debug_prop
+ -logd_prop
+ -nfc_prop
+ -powerctl_prop
+ -radio_prop
+ -dalvik_dynamic_config_prop
+ }:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_init
+ -hal_power_server
+ } dalvik_dynamic_config_prop:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -hal_nfc_server
+ } {
+ nfc_prop
+ }:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -hal_telephony_server
+ } {
+ radio_prop
+ }:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -bluetooth
+ -hal_bluetooth_server
+ } {
+ bluetooth_prop
+ }:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -hal_wifi_server
+ -wificond
+ } {
+ wifi_prop
+ }:file no_rw_file_perms;
+
+ neverallow {
+ domain
+ -coredomain
+ -vendor_init
+ } {
+ suspend_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -init
+ } {
+ suspend_debug_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -init
+ -vendor_init
+ } {
+ high_barometer_quality_prop
+ }:property_service set;
+
+ neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-system_suspend')
+ } {
+ suspend_debug_prop
+ }:file no_rw_file_perms;
+')
+
+dontaudit system_suspend suspend_debug_prop:file r_file_perms;
+
+compatible_property_only(`
+ # Neverallow coredomain to set vendor properties
+ neverallow {
+ coredomain
+ -init
+ -system_writes_vendor_properties_violators
+ } {
+ property_type
+ -system_property_type
+ -extended_core_property_type
+ }:property_service set;
+')
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ ffs_config_prop
+ ffs_control_prop
+}:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -system_server
+} {
+ userspace_reboot_log_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init and system_server to set system_adbd_prop
+ domain
+ -init
+ -system_server
+} {
+ system_adbd_prop
+}:property_service set;
+
+# Let (vendor_)init, adbd, and system_server set service.adb.tcp.port
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -adbd
+ -adbd_tradeinmode
+ -system_server
+} {
+ adbd_config_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init and adbd to set adbd_prop
+ domain
+ -init
+ -adbd
+ -adbd_tradeinmode
+} {
+ adbd_prop
+}:property_service set;
+
+neverallow {
+ # Only allow init to set apexd_payload_metadata_prop
+ domain
+ -init
+} {
+ apexd_payload_metadata_prop
+}:property_service set;
+
+
+neverallow {
+ # Only allow init and shell to set userspace_reboot_test_prop
+ domain
+ -init
+ -shell
+} {
+ userspace_reboot_test_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} {
+ surfaceflinger_color_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+} {
+ libc_debug_prop
+}:property_service set;
+
+# Allow the shell to set MTE & GWP-ASan props, so that non-root users with adb
+# shell access can control the settings on their device. Allow system apps to
+# set MTE props, so Developer Options can set them.
+neverallow {
+ domain
+ -init
+ -shell
+ -system_app
+ -system_server
+ -mtectrl
+} {
+ arm64_memtag_prop
+ gwp_asan_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+ -kcmdlinectrl
+} {
+ kcmdline_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} zram_control_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+ -vendor_init
+} dalvik_runtime_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ usb_config_prop
+ usb_control_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -system_server
+} {
+ provisioned_prop
+ retaildemo_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} {
+ provisioned_prop
+ retaildemo_prop
+}:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+} {
+ init_service_status_private_prop
+ init_service_status_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -radio
+ -appdomain
+ -hal_telephony_server
+ not_compatible_property(`-vendor_init')
+} telephony_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} {
+ graphics_config_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -surfaceflinger
+} {
+ surfaceflinger_display_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -appdomain
+ -vendor_init
+} packagemanager_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} keyguard_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+} {
+ localization_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_app
+} oem_unlock_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -coredomain
+ -vendor_init
+} storagemanager_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -appdomain
+} sendbug_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -appdomain
+} camera_calibration_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -hal_dumpstate_server
+ not_compatible_property(`-vendor_init')
+} hal_dumpstate_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+ userdebug_or_eng(`-traced_probes')
+ userdebug_or_eng(`-traced_perf')
+} {
+ lower_kptr_restrict_prop
+}:property_service set;
+
+neverallow {
+ domain
+ -init
+} zygote_wrap_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} verity_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} setupwizard_mode_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} setupwizard_prop:property_service set;
+
+# ro.product.property_source_order is useless after initialization of ro.product.* props.
+# So making it accessible only from init and vendor_init.
+neverallow {
+ domain
+ -init
+ -dumpstate
+ -vendor_init
+} build_config_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -shell
+} sqlite_log_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -appdomain
+} sqlite_log_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+} default_prop:property_service set;
+
+# Only one of system_property_type and vendor_property_type can be assigned.
+# Property types having both attributes won't be accessible from anywhere.
+neverallow domain system_and_vendor_property_type:{file property_service} *;
+
+neverallow {
+ domain
+ -init
+ -keystore
+ -shell
+ -system_server
+ -rkpdapp
+} remote_prov_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+} remote_prov_cert_prop:property_service set;
+
+neverallow {
+ # Only allow init and shell to set rollback_test_prop
+ domain
+ -init
+ -shell
+} rollback_test_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -apexd
+} ctl_apex_load_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -init
+ -dumpstate
+ -apexd
+} ctl_apex_load_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -apexd
+} apex_ready_prop:property_service set;
+
+neverallow {
+ domain
+ -coredomain
+ -dumpstate
+ -apexd
+ -vendor_init
+} apex_ready_prop:file no_rw_file_perms;
+
+neverallow {
+ # Only allow init and profcollectd to access profcollectd_node_id_prop
+ domain
+ -init
+ -dumpstate
+ -profcollectd
+} profcollectd_node_id_prop:file r_file_perms;
+
+neverallow {
+ domain
+ -init
+} log_file_logger_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} usb_uvc_enabled_prop:property_service set;
+
+# Disallow non system apps from reading ro.usb.uvc.enabled
+neverallow {
+ appdomain
+ -system_app
+ -device_as_webcam
+} usb_uvc_enabled_prop:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+} pm_archiving_enabled_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+ userdebug_or_eng(`-su')
+} bionic_linker_16kb_app_compat_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -shell
+ userdebug_or_eng(`-su')
+} pm_16kb_app_compat_prop:property_service set;
diff --git a/prebuilts/api/202504/private/property_contexts b/prebuilts/api/202504/private/property_contexts
new file mode 100644
index 0000000..fa82e29
--- /dev/null
+++ b/prebuilts/api/202504/private/property_contexts
@@ -0,0 +1,1821 @@
+##########################
+# property service keys
+#
+#
+net.rmnet u:object_r:net_radio_prop:s0
+net.gprs u:object_r:net_radio_prop:s0
+net.ppp u:object_r:net_radio_prop:s0
+net.qmi u:object_r:net_radio_prop:s0
+net.lte u:object_r:net_radio_prop:s0
+net.cdma u:object_r:net_radio_prop:s0
+net.dns u:object_r:net_dns_prop:s0
+ril. u:object_r:radio_prop:s0
+ro.ril. u:object_r:radio_prop:s0
+gsm. u:object_r:radio_prop:s0
+persist.radio u:object_r:radio_prop:s0
+
+net. u:object_r:system_prop:s0
+dev. u:object_r:system_prop:s0
+ro.runtime. u:object_r:system_prop:s0
+ro.runtime.firstboot u:object_r:firstboot_prop:s0
+hw. u:object_r:system_prop:s0
+ro.hw. u:object_r:system_prop:s0
+sys. u:object_r:system_prop:s0
+sys.audio. u:object_r:audio_prop:s0
+sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0
+sys.cppreopt u:object_r:cppreopt_prop:s0
+sys.lpdumpd u:object_r:lpdumpd_prop:s0
+sys.powerctl u:object_r:powerctl_prop:s0
+service. u:object_r:system_prop:s0
+dhcp. u:object_r:dhcp_prop:s0
+dhcp.bt-pan.result u:object_r:pan_result_prop:s0
+bluetooth. u:object_r:bluetooth_prop:s0
+
+debug. u:object_r:debug_prop:s0
+debug.db. u:object_r:debuggerd_prop:s0
+debug.tracing.desktop_mode_visible_tasks u:object_r:debug_tracing_desktop_mode_visible_tasks_prop:s0 exact uint
+dumpstate. u:object_r:dumpstate_prop:s0
+dumpstate.options u:object_r:dumpstate_options_prop:s0
+init.svc_debug_pid. u:object_r:init_svc_debug_prop:s0
+llk. u:object_r:llkd_prop:s0
+khungtask. u:object_r:llkd_prop:s0
+ro.llk. u:object_r:llkd_prop:s0
+ro.khungtask. u:object_r:llkd_prop:s0
+log. u:object_r:log_prop:s0
+log.tag u:object_r:log_tag_prop:s0
+log.tag.WifiHAL u:object_r:wifi_log_prop:s0
+ro.log.file_logger.path u:object_r:log_file_logger_prop:s0 exact string
+security.perf_harden u:object_r:shell_prop:s0
+persist.simpleperf.profile_app_uid u:object_r:shell_prop:s0
+persist.simpleperf.profile_app_expiration_time u:object_r:shell_prop:s0
+security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
+service.adb.root u:object_r:shell_prop:s0
+service.adb.tls.port u:object_r:adbd_prop:s0
+persist.adb.tradeinmode u:object_r:adbd_tradeinmode_prop:s0
+persist.adb.test_tradeinmode u:object_r:adbd_tradeinmode_prop:s0
+persist.adb.wifi. u:object_r:adbd_prop:s0
+persist.adb.tls_server.enable u:object_r:system_adbd_prop:s0
+
+persist.audio. u:object_r:audio_prop:s0
+persist.bluetooth. u:object_r:bluetooth_prop:s0
+persist.nfc. u:object_r:nfc_prop:s0
+persist.nfc_cfg. u:object_r:nfc_prop:s0
+persist.debug. u:object_r:persist_debug_prop:s0
+persist.debug.user_mode_emulation u:object_r:system_user_mode_emulation_prop:s0
+logd. u:object_r:logd_prop:s0
+persist.logd. u:object_r:logd_prop:s0
+ro.logd. u:object_r:logd_prop:s0
+persist.logd.audit.rate u:object_r:logd_auditrate_prop:s0
+persist.logd.security u:object_r:device_logging_prop:s0
+persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
+logd.logpersistd u:object_r:logpersistd_logging_prop:s0
+persist.log.tag u:object_r:log_tag_prop:s0
+persist.mmc. u:object_r:mmc_prop:s0
+persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0
+persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
+persist.profcollectd.node_id u:object_r:profcollectd_node_id_prop:s0 exact string
+persist.sys. u:object_r:system_prop:s0
+persist.sys.safemode u:object_r:safemode_prop:s0
+persist.sys.tap_gesture u:object_r:gesture_prop:s0
+persist.sys.theme u:object_r:theme_prop:s0
+persist.sys.fflag.override.settings_dynamic_system u:object_r:dynamic_system_prop:s0
+dynamic_system.data_transfer.shared_memory.size u:object_r:dynamic_system_prop:s0 exact uint
+ro.sys.safemode u:object_r:safemode_prop:s0
+persist.sys.audit_safemode u:object_r:safemode_prop:s0
+persist.sys.dalvik.jvmtiagent u:object_r:system_jvmti_agent_prop:s0
+persist.service. u:object_r:system_prop:s0
+persist.service.bdroid. u:object_r:bluetooth_prop:s0
+persist.security. u:object_r:system_prop:s0
+persist.traced.enable u:object_r:traced_enabled_prop:s0
+traced.lazy. u:object_r:traced_lazy_prop:s0
+persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
+persist.traced_perf.enable u:object_r:traced_perf_enabled_prop:s0
+uprobestats.start_with_config u:object_r:uprobestats_start_with_config_prop:s0
+persist.vendor.debug.wifi. u:object_r:persist_vendor_debug_wifi_prop:s0
+persist.vendor.overlay. u:object_r:overlay_prop:s0
+ril.cdma.inecmmode u:object_r:radio_cdma_ecm_prop:s0 exact bool
+ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
+ro.boottime. u:object_r:boottime_prop:s0
+ro.serialno u:object_r:serialno_prop:s0
+ro.boot.btmacaddr u:object_r:bluetooth_prop:s0
+ro.boot.serialno u:object_r:serialno_prop:s0
+ro.bt. u:object_r:bluetooth_prop:s0
+ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
+ro.misctrl. u:object_r:misctrl_prop:s0
+persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
+sys.boot.reason u:object_r:system_boot_reason_prop:s0
+sys.boot.reason.last u:object_r:last_boot_reason_prop:s0
+pm. u:object_r:pm_prop:s0
+test.sys.boot.reason u:object_r:test_boot_reason_prop:s0
+test.userspace_reboot.requested u:object_r:userspace_reboot_test_prop:s0
+sys.lmk. u:object_r:system_lmk_prop:s0
+sys.trace. u:object_r:system_trace_prop:s0
+wrap. u:object_r:zygote_wrap_prop:s0 prefix string
+persist.wm.debug. u:object_r:persist_wm_debug_prop:s0
+profcollectd.etr.probe u:object_r:profcollectd_etr_prop:s0
+
+# Suspend service properties
+suspend.max_sleep_time_millis u:object_r:suspend_prop:s0 exact uint
+suspend.base_sleep_time_millis u:object_r:suspend_prop:s0 exact uint
+suspend.backoff_threshold_count u:object_r:suspend_prop:s0 exact uint
+suspend.short_suspend_threshold_millis u:object_r:suspend_prop:s0 exact uint
+suspend.sleep_time_scale_factor u:object_r:suspend_prop:s0 exact double
+suspend.failed_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
+suspend.short_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
+suspend.disable_sync_on_suspend u:object_r:suspend_prop:s0 exact bool
+
+# Suspend service debug properties
+suspend.debug.wakestats_log.enabled u:object_r:suspend_debug_prop:s0 exact bool
+
+# Fastbootd protocol control property
+fastbootd.protocol u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
+
+# adbd protoctl configuration property
+service.adb.tcp.port u:object_r:adbd_config_prop:s0 exact int
+service.adb.transport u:object_r:adbd_config_prop:s0 exact string
+
+# Boolean property set by system server upon boot indicating
+# if device is fully owned by organization instead of being
+# a personal device.
+ro.organization_owned u:object_r:device_logging_prop:s0
+
+# selinux non-persistent properties
+selinux.restorecon_recursive u:object_r:restorecon_prop:s0
+
+# default property context
+* u:object_r:default_prop:s0
+
+# data partition encryption properties
+vold. u:object_r:vold_prop:s0
+ro.crypto. u:object_r:vold_prop:s0
+
+# ro.build.fingerprint is either set in /system/build.prop, or is
+# set at runtime by system_server.
+ro.build.fingerprint u:object_r:fingerprint_prop:s0 exact string
+
+ro.persistent_properties.ready u:object_r:persistent_properties_ready_prop:s0
+
+# ctl properties
+ctl.bootanim u:object_r:ctl_bootanim_prop:s0
+ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
+ctl.fuse_ u:object_r:ctl_fuse_prop:s0
+ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
+ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
+ctl.bugreport u:object_r:ctl_bugreport_prop:s0
+ctl.console u:object_r:ctl_console_prop:s0
+ctl. u:object_r:ctl_default_prop:s0
+
+# Don't allow uncontrolled access to all services
+ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
+ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
+ctl.start$ u:object_r:ctl_start_prop:s0
+ctl.stop$ u:object_r:ctl_stop_prop:s0
+ctl.restart$ u:object_r:ctl_restart_prop:s0
+ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
+ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
+ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
+ctl.apex_load$ u:object_r:ctl_apex_load_prop:s0
+ctl.apex_unload$ u:object_r:ctl_apex_load_prop:s0
+
+ # Restrict access to starting/stopping adbd
+ctl.start$adbd u:object_r:ctl_adbd_prop:s0
+ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
+ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
+
+# Restrict access to starting/stopping gsid.
+ctl.start$gsid u:object_r:ctl_gsid_prop:s0
+ctl.stop$gsid u:object_r:ctl_gsid_prop:s0
+ctl.restart$gsid u:object_r:ctl_gsid_prop:s0
+
+# Restrict access to stopping apexd.
+ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
+
+# Restrict access to stopping odsign
+ctl.stop$odsign u:object_r:ctl_odsign_prop:s0
+
+# Restrict access to starting media.transcoding.
+ctl.start$media.transcoding u:object_r:ctl_mediatranscoding_prop:s0
+
+# Restrict access to restart dumpstate
+ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
+
+# Restrict access to control snapuserd
+ctl.start$snapuserd u:object_r:ctl_snapuserd_prop:s0
+ctl.stop$snapuserd u:object_r:ctl_snapuserd_prop:s0
+ctl.restart$snapuserd u:object_r:ctl_snapuserd_prop:s0
+
+# Restrict access to control prefetch
+ctl.start$prefetch u:object_r:ctl_prefetch_prop:s0
+ctl.stop$prefetch u:object_r:ctl_prefetch_prop:s0
+ctl.restart$prefetch u:object_r:ctl_prefetch_prop:s0
+
+# Restrict access to control uprobestats
+ctl.start$uprobestats u:object_r:ctl_uprobestats_prop:s0
+ctl.stop$uprobestats u:object_r:ctl_uprobestats_prop:s0
+ctl.restart$uprobestats u:object_r:ctl_uprobestats_prop:s0
+
+# Restrict access to starting/stopping artd_pre_reboot.
+ctl.start$artd_pre_reboot u:object_r:ctl_artd_pre_reboot_prop:s0
+ctl.stop$artd_pre_reboot u:object_r:ctl_artd_pre_reboot_prop:s0
+ctl.restart$artd_pre_reboot u:object_r:ctl_artd_pre_reboot_prop:s0
+
+# NFC properties
+nfc. u:object_r:nfc_prop:s0
+
+# These properties are not normally set by processes other than init.
+# They are only distinguished here for setting by qemu-props on the
+# emulator/goldfish.
+config. u:object_r:config_prop:s0
+ro.config. u:object_r:config_prop:s0
+dalvik. u:object_r:dalvik_prop:s0
+ro.dalvik. u:object_r:dalvik_prop:s0
+
+# qemu_hw_prop is read/written by both system and vendor.
+qemu.hw.mainkeys u:object_r:qemu_hw_prop:s0 exact string
+
+# qemu_sf_lcd_density_prop is read/written by both system and vendor.
+qemu.sf.lcd_density u:object_r:qemu_sf_lcd_density_prop:s0 exact int
+
+# Shared between system server and wificond
+wifi. u:object_r:wifi_prop:s0
+wlan. u:object_r:wifi_prop:s0
+
+# Lowpan properties
+lowpan. u:object_r:lowpan_prop:s0
+ro.lowpan. u:object_r:lowpan_prop:s0
+
+# heapprofd properties
+heapprofd. u:object_r:heapprofd_prop:s0
+
+# traced properties
+traced.oome_heap_session.count u:object_r:traced_oome_heap_session_count_prop:s0 exact uint
+
+# servicemanager properties
+servicemanager.ready u:object_r:servicemanager_prop:s0 exact bool
+servicemanager.installed u:object_r:servicemanager_prop:s0 exact bool
+
+# hwservicemanager properties
+hwservicemanager. u:object_r:hwservicemanager_prop:s0
+
+# hidl_memory properties to intentionally force a shutdown
+hidl_memory. u:object_r:hidl_memory_prop:s0
+
+# Common default properties for vendor, odm, vendor_dlkm, and odm_dlkm.
+init.svc.odm. u:object_r:vendor_default_prop:s0
+init.svc.vendor. u:object_r:vendor_default_prop:s0
+ro.hardware. u:object_r:vendor_default_prop:s0
+ro.odm. u:object_r:vendor_default_prop:s0
+ro.vendor. u:object_r:vendor_default_prop:s0
+ro.vendor_dlkm. u:object_r:vendor_default_prop:s0
+ro.odm_dlkm. u:object_r:vendor_default_prop:s0
+odm. u:object_r:vendor_default_prop:s0
+persist.odm. u:object_r:vendor_default_prop:s0
+persist.vendor. u:object_r:vendor_default_prop:s0
+vendor. u:object_r:vendor_default_prop:s0
+
+# Properties that relate to time / time zone detection behavior.
+persist.time. u:object_r:time_prop:s0
+
+# Properties that relate to server configurable flags
+device_config.reset_performed u:object_r:device_config_reset_performed_prop:s0
+persist.device_config.activity_manager_native_boot. u:object_r:device_config_activity_manager_native_boot_prop:s0
+persist.device_config.attempted_boot_count u:object_r:device_config_boot_count_prop:s0
+persist.device_config.camera_native. u:object_r:device_config_camera_native_prop:s0
+persist.device_config.configuration. u:object_r:device_config_configuration_prop:s0
+persist.device_config.connectivity. u:object_r:device_config_connectivity_prop:s0
+persist.device_config.core_experiments_team_internal. u:object_r:device_config_core_experiments_team_internal_prop:s0
+persist.device_config.edgetpu_native. u:object_r:device_config_edgetpu_native_prop:s0
+persist.device_config.input_native_boot. u:object_r:device_config_input_native_boot_prop:s0
+persist.device_config.lmkd_native. u:object_r:device_config_lmkd_native_prop:s0
+persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0
+persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0
+persist.device_config.nnapi_native. u:object_r:device_config_nnapi_native_prop:s0
+persist.device_config.profcollect_native_boot. u:object_r:device_config_profcollect_native_boot_prop:s0
+persist.device_config.remote_key_provisioning_native. u:object_r:device_config_remote_key_provisioning_native_prop:s0
+persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0
+persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0
+persist.device_config.statsd_native. u:object_r:device_config_statsd_native_prop:s0
+persist.device_config.statsd_native_boot. u:object_r:device_config_statsd_native_boot_prop:s0
+persist.device_config.storage_native_boot. u:object_r:device_config_storage_native_boot_prop:s0
+persist.device_config.surface_flinger_native_boot. u:object_r:device_config_surface_flinger_native_boot_prop:s0
+persist.device_config.swcodec_native. u:object_r:device_config_swcodec_native_prop:s0
+persist.device_config.aconfig_flags. u:object_r:device_config_aconfig_flags_prop:s0
+persist.device_config.vendor_system_native. u:object_r:device_config_vendor_system_native_prop:s0
+persist.device_config.vendor_system_native_boot. u:object_r:device_config_vendor_system_native_boot_prop:s0
+persist.device_config.virtualization_framework_native. u:object_r:device_config_virtualization_framework_native_prop:s0
+persist.device_config.window_manager_native_boot. u:object_r:device_config_window_manager_native_boot_prop:s0
+persist.device_config.memory_safety_native_boot. u:object_r:device_config_memory_safety_native_boot_prop:s0
+persist.device_config.memory_safety_native. u:object_r:device_config_memory_safety_native_prop:s0
+persist.device_config.tethering_u_or_later_native. u:object_r:device_config_tethering_u_or_later_native_prop:s0
+persist.device_config.mmd_native. u:object_r:device_config_mmd_native_prop:s0
+
+# Prop indicates the apex that bundles input configuration files (*.idc,*.kl,*.kcm)
+input_device.config_file.apex u:object_r:input_device_config_prop:s0 exact string
+
+# Properties that is for staging
+next_boot. u:object_r:next_boot_prop:s0
+
+# F2FS smart idle maint prop
+persist.device_config.storage_native_boot.smart_idle_maint_enabled u:object_r:smart_idle_maint_enabled_prop:s0 exact bool
+
+# MGLRU experiment prop
+persist.device_config.mglru_native.lru_gen_config u:object_r:device_config_mglru_native_prop:s0 exact enum none core core_and_mm_walk core_and_nonleaf_young all
+
+# MM Events config props
+persist.mm_events.enabled u:object_r:mm_events_config_prop:s0 exact bool
+
+# Properties that relate to legacy server configurable flags
+persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
+
+apexd. u:object_r:apexd_prop:s0
+apexd.config. u:object_r:apexd_config_prop:s0
+apexd.config.dm_delete.timeout u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.dm_create.timeout u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.loop_wait.attempts u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.boot_activation.threads u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.loopback.readahead u:object_r:apexd_config_prop:s0 exact uint
+persist.apexd. u:object_r:apexd_prop:s0
+persist.vendor.apex. u:object_r:apexd_select_prop:s0
+ro.boot.vendor.apex. u:object_r:apexd_select_prop:s0
+
+# Property that indicates if an apex is ready: apex.<apex-name>.ready
+apex. u:object_r:apex_ready_prop:s0 prefix bool
+
+bpf.progs_loaded u:object_r:bpf_progs_loaded_prop:s0 exact bool
+
+gsid. u:object_r:gsid_prop:s0
+ro.gsid. u:object_r:gsid_prop:s0
+
+# Property for disabling NNAPI vendor extensions on product image (used on GSI /product image,
+# which can't use NNAPI vendor extensions).
+ro.nnapi.extensions.deny_on_product u:object_r:nnapi_ext_deny_product_prop:s0
+
+# Property that is set once ueventd finishes cold boot.
+ro.cold_boot_done u:object_r:cold_boot_done_prop:s0
+
+# Properties that control performance operations.
+# Leave space to later set drop_caches to 1, 2, and 4.
+perf.drop_caches u:object_r:perf_drop_caches_prop:s0 exact enum 0 3
+
+# Charger properties
+ro.charger. u:object_r:charger_prop:s0
+sys.boot_from_charger_mode u:object_r:charger_status_prop:s0 exact int
+ro.enable_boot_charger_mode u:object_r:charger_config_prop:s0 exact bool
+ro.product.charger.unplugged_shutdown_time u:object_r:charger_config_prop:s0 exact int
+
+# Prefetch boot properties which are tunables
+ro.prefetch_boot.enabled u:object_r:prefetch_boot_prop:s0 exact bool
+ro.prefetch_boot.trace_buffer_size_kib u:object_r:prefetch_boot_prop:s0 exact int
+ro.prefetch_boot.duration_s u:object_r:prefetch_boot_prop:s0 exact int
+ro.prefetch_boot.io_depth u:object_r:prefetch_boot_prop:s0 exact int
+ro.prefetch_boot.max_fds u:object_r:prefetch_boot_prop:s0 exact int
+# Prefetch property to start and stop the record/replay
+prefetch_boot.record u:object_r:prefetch_service_prop:s0 exact bool
+prefetch_boot.record_stop u:object_r:prefetch_boot_prop:s0 exact bool
+prefetch_boot.replay u:object_r:prefetch_service_prop:s0 exact bool
+
+# Virtual A/B and snapuserd properties
+ro.virtual_ab.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.retrofit u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.compression.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.compression.xor.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.userspace.snapshots.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.io_uring.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.compression.threads u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.batch_writes u:object_r:virtual_ab_prop:s0 exact bool
+
+# Virtual A/B device configurations
+ro.virtual_ab.read_ahead_size u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.o_direct.enabled u:object_r:virtual_ab_prop:s0 exact bool
+ro.virtual_ab.merge_thread_priority u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.worker_thread_priority u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.num_worker_threads u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.num_merge_threads u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.num_verify_threads u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.cow_op_merge_size u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.verify_threshold_size u:object_r:virtual_ab_prop:s0 exact int
+ro.virtual_ab.verify_block_size u:object_r:virtual_ab_prop:s0 exact int
+
+# OEMs can set this prop at build time to configure how many seconds to delay
+# merge after installing a Virtual AB OTA. The default behavior is to start
+# merge immediately.
+ro.virtual_ab.merge_delay_seconds u:object_r:virtual_ab_prop:s0 exact int
+snapuserd.ready u:object_r:snapuserd_prop:s0 exact bool
+snapuserd.proxy_ready u:object_r:snapuserd_prop:s0 exact bool
+snapuserd.test.dm.snapshots u:object_r:snapuserd_prop:s0 exact bool
+snapuserd.test.io_uring.force_disable u:object_r:snapuserd_prop:s0 exact bool
+
+ro.product.ab_ota_partitions u:object_r:ota_prop:s0 exact string
+ro.vendor.build.ab_ota_partitions u:object_r:ota_build_prop:s0 exact string
+# Property to set/clear the warm reset flag after an OTA update.
+ota.warm_reset u:object_r:ota_prop:s0
+# The vbmeta digest for the inactive slot. It can be set after installing
+# ota updates to the b partition of a/b devices.
+ota.other.vbmeta_digest u:object_r:ota_prop:s0 exact string
+
+# Module properties
+com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
+persist.com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
+
+# Connectivity module
+net.464xlat.cellular.enabled u:object_r:net_464xlat_fromvendor_prop:s0 exact bool
+net.tcp_def_init_rwnd u:object_r:net_connectivity_prop:s0 exact int
+
+# Userspace reboot properties
+sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
+persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
+
+# Integer property which is used in libgui to configure the number of frames
+# tracked by buffer queue's frame event timing history. The property is set
+# by devices with video decoding pipelines long enough to overflow the default
+# history size.
+ro.lib_gui.frame_event_history_size u:object_r:bq_config_prop:s0
+
+af.fast_track_multiplier u:object_r:audio_config_prop:s0 exact int
+ro.af.client_heap_size_kbyte u:object_r:audio_config_prop:s0 exact int
+ro.audio.flinger_standbytime_ms u:object_r:audio_config_prop:s0 exact int
+
+audio.camerasound.force u:object_r:audio_config_prop:s0 exact bool
+audio.deep_buffer.media u:object_r:audio_config_prop:s0 exact bool
+audio.offload.video u:object_r:audio_config_prop:s0 exact bool
+audio.offload.min.duration.secs u:object_r:audio_config_prop:s0 exact int
+
+# Timecheck configuration
+audio.timecheck.disabled u:object_r:audio_config_prop:s0 exact bool
+audio.timecheck.timeout_duration_ms u:object_r:audio_config_prop:s0 exact int
+audio.timecheck.second_chance_duration_ms u:object_r:audio_config_prop:s0 exact int
+
+# spatializer tuning
+audio.spatializer.priority u:object_r:audio_config_prop:s0 exact int
+audio.spatializer.effect.affinity u:object_r:audio_config_prop:s0 exact int
+audio.spatializer.effect.util_clamp_min u:object_r:audio_config_prop:s0 exact int
+audio.spatializer.pose_predictor_type u:object_r:audio_config_prop:s0 exact enum 0 1 2 3
+audio.spatializer.prediction_duration_ms u:object_r:audio_config_prop:s0 exact int
+
+# Timestamp correction for MSD
+audio.timestamp.corrected_output_device u:object_r:audio_config_prop:s0 exact int
+
+ro.audio.ignore_effects u:object_r:audio_config_prop:s0 exact bool
+ro.audio.monitorRotation u:object_r:audio_config_prop:s0 exact bool
+ro.audio.offload_wakelock u:object_r:audio_config_prop:s0 exact bool
+
+# Configure whether new device has spatialization default enabled.
+ro.audio.spatializer_binaural_enabled_default u:object_r:audio_config_prop:s0 exact bool
+ro.audio.spatializer_transaural_enabled_default u:object_r:audio_config_prop:s0 exact bool
+# Boolean property used in AudioService to configure whether
+# spatializer functionality should be initialized
+ro.audio.spatializer_enabled u:object_r:audio_config_prop:s0 exact bool
+# Boolean property used in AudioService to configure whether
+# to enable head tracking for spatial audio
+ro.audio.headtracking_enabled u:object_r:audio_config_prop:s0 exact bool
+# Boolean property used in AudioPolicyManager to configure whether
+# to enable spatialization for stereo channel mask
+ro.audio.stereo_spatialization_enabled u:object_r:audio_config_prop:s0 exact bool
+
+# Boolean property used in AudioPolicyInterfaceImpl to configure whether
+# to disable usecase validator for game mode
+ro.audio.usecase_validator_enabled u:object_r:audio_config_prop:s0 exact bool
+
+# Boolean property used in UsbAlsaManager to decide if only one or multiple
+# USB devices can be connected to audio system at a certain time
+ro.audio.multi_usb_mode u:object_r:audio_config_prop:s0 exact bool
+
+# Boolean property used in libaudiohal@aidl to check if the SoC vendor
+# provides an implementation of IHalAdapterVendorExtension interface.
+# See b/323989070 for the discussion why this approach was chosen.
+ro.audio.ihaladaptervendorextension_enabled u:object_r:system_audio_config_prop:s0 exact bool
+
+# String property used in audioparameterparser.example service to load
+# vendor implementation IHalAdapterVendorExtension
+ro.audio.ihaladaptervendorextension_libname u:object_r:system_audio_config_prop:s0 exact string
+
+persist.config.calibration_fac u:object_r:camera_calibration_prop:s0 exact string
+
+config.disable_cameraservice u:object_r:camera_config_prop:s0 exact bool
+
+camera.disable_preview_scheduler u:object_r:camera_config_prop:s0 exact bool
+camera.disable_zsl_mode u:object_r:camera_config_prop:s0 exact bool
+camera.fifo.disable u:object_r:camera_config_prop:s0 exact bool
+camera.enable_landscape_to_portrait u:object_r:camera_config_prop:s0 exact bool
+ro.camera.notify_nfc u:object_r:camera_config_prop:s0 exact bool
+ro.camera.enableLazyHal u:object_r:camera_config_prop:s0 exact bool
+ro.camera.enableCamera1MaxZsl u:object_r:camera_config_prop:s0 exact bool
+ro.camera.disableJpegR u:object_r:camera_config_prop:s0 exact bool
+ro.camera.enableCompositeAPI0JpegR u:object_r:camera_config_prop:s0 exact bool
+ro.camera.enableVirtualCamera u:object_r:camera_config_prop:s0 exact bool
+
+ro.camerax.extensions.enabled u:object_r:camerax_extensions_prop:s0 exact bool
+
+ro.vendor.camera.extensions.package u:object_r:camera2_extensions_prop:s0 exact string
+ro.vendor.camera.extensions.service u:object_r:camera2_extensions_prop:s0 exact string
+
+# ART properties.
+dalvik.vm. u:object_r:dalvik_config_prop:s0
+ro.dalvik.vm. u:object_r:dalvik_config_prop:s0
+ro.zygote u:object_r:dalvik_config_prop:s0 exact string
+
+# A set of ART properties listed explicitly for compatibility purposes.
+ro.dalvik.vm.native.bridge u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.always_debuggable u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.appimageformat u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.backgroundgctype u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.boot-image u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.bgdexopt.new-classes-percent u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.bgdexopt.new-methods-percent u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.checkjni u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.dex2oat-max-image-block-size u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.dex2oat-minidebuginfo u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dex2oat-resolve-startup-strings u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dex2oat-very-large u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.dex2oat-swap u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dex2oat64.enabled u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dexopt.secondary u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.dexopt.thermal-cutoff u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.execution-mode u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.extra-opts u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.foreground-heap-growth-multiplier u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.gctype u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heapgrowthlimit u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heapmaxfree u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heapminfree u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heapsize u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heapstartsize u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.heaptargetutilization u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.hot-startup-method-samples u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.image-dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.image-dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.image-dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.image-dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.arm.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.arm.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.arm64.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.arm64.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.mips.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.mips.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.mips64.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.mips64.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.unknown.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.unknown.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.x86.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.x86.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.x86_64.features u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.isa.x86_64.variant u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.jitinitialsize u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.jitmaxsize u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.jitprithreadweight u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.jitthreshold u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.jittransitionweight u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.jniopts u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.lockprof.threshold u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.method-trace u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.method-trace-file u:object_r:dalvik_config_prop:s0 exact string
+dalvik.vm.method-trace-file-siz u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.method-trace-stream u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.profilesystemserver u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.profilebootclasspath u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.ps-min-save-period-ms u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.ps-resolved-classes-delay-ms u:object_r:dalvik_config_prop:s0 exact int
+dalvik.vm.usejit u:object_r:dalvik_config_prop:s0 exact bool
+dalvik.vm.zygote.max-boot-retry u:object_r:dalvik_config_prop:s0 exact int
+
+# A list of ART properties that can be set dynamically.
+dalvik.vm.background-dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
+dalvik.vm.background-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.boot-dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
+dalvik.vm.boot-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
+dalvik.vm.dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.image-dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
+dalvik.vm.image-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.restore-dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
+dalvik.vm.restore-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.pre-reboot. u:object_r:dalvik_dynamic_config_prop:s0 prefix
+
+persist.sys.dalvik.vm.lib.2 u:object_r:dalvik_runtime_prop:s0 exact string
+
+keyguard.no_require_sim u:object_r:keyguard_config_prop:s0 exact bool
+
+media.c2.dmabuf.padding u:object_r:codec2_config_prop:s0 exact int
+media.c2.hal.selection u:object_r:codec2_config_prop:s0 exact enum aidl hidl
+media.c2.remove_rendering_depth u:object_r:codec2_config_prop:s0 exact bool
+
+media.recorder.show_manufacturer_and_model u:object_r:media_config_prop:s0 exact bool
+media.resolution.limit.32bit u:object_r:media_config_prop:s0 exact int
+media.stagefright.cache-params u:object_r:media_config_prop:s0 exact string
+media.stagefright.enable-aac u:object_r:media_config_prop:s0 exact bool
+media.stagefright.enable-fma2dp u:object_r:media_config_prop:s0 exact bool
+media.stagefright.enable-http u:object_r:media_config_prop:s0 exact bool
+media.stagefright.enable-player u:object_r:media_config_prop:s0 exact bool
+media.stagefright.enable-qcp u:object_r:media_config_prop:s0 exact bool
+media.stagefright.enable-scan u:object_r:media_config_prop:s0 exact bool
+media.stagefright.thumbnail.prefer_hw_codecs u:object_r:media_config_prop:s0 exact bool
+persist.sys.media.avsync u:object_r:media_config_prop:s0 exact bool
+
+persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
+persist.bluetooth.a2dp_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+persist.bluetooth.leaudio_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
+persist.bluetooth.btsnoopenable u:object_r:exported_bluetooth_prop:s0 exact bool
+persist.bluetooth.btsnoopdefaultmode u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
+persist.bluetooth.btsnooplogmode u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
+persist.bluetooth.finder.supported u:object_r:bluetooth_finder_prop:s0 exact bool
+persist.bluetooth.sniff_offload.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+persist.bluetooth.snooplogfilter.headers.enabled u:object_r:bluetooth_prop:s0 exact bool
+persist.bluetooth.snooplogfilter.profiles.a2dp.enabled u:object_r:bluetooth_prop:s0 exact bool
+persist.bluetooth.snooplogfilter.profiles.map u:object_r:bluetooth_prop:s0 exact enum empty disabled fullfilter header magic
+persist.bluetooth.snooplogfilter.profiles.pbap u:object_r:bluetooth_prop:s0 exact enum empty disabled fullfilter header magic
+persist.bluetooth.snooplogfilter.profiles.rfcomm.enabled u:object_r:bluetooth_prop:s0 exact bool
+persist.bluetooth.factoryreset u:object_r:bluetooth_prop:s0 exact bool
+persist.bluetooth.leaudio.allow_list u:object_r:bluetooth_prop:s0 exact string
+
+bluetooth.a2dp.source.sbc_priority.config u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aac_priority.config u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aptx_priority.config u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aptx_hd_priority.config u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.ldac_priority.config u:object_r:bluetooth_config_prop:s0 exact int
+
+bluetooth.hardware.power.operating_voltage_mv u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.power.idle_cur_ma u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.power.tx_cur_ma u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.power.rx_cur_ma u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.radio.le_tx_path_loss_comp_db u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.radio.le_rx_path_loss_comp_db u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.hardware.wakeup_supported u:object_r:bluetooth_config_prop:s0 exact bool
+
+bluetooth.framework.support_persisted_state u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.framework.adapter_address_validation u:object_r:bluetooth_config_prop:s0 exact bool
+
+bluetooth.core.gap.le.privacy.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.core.gap.le.conn.min.limit u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.core.gap.le.conn.only_init_1m_phy.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.core.le_audio.inband_ringtone.supported u:object_r:bluetooth_config_prop:s0 exact bool
+
+bluetooth.device.default_name u:object_r:bluetooth_config_prop:s0 exact string
+bluetooth.device.class_of_device u:object_r:bluetooth_config_prop:s0 exact string
+
+bluetooth.profile.a2dp.sink.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.a2dp.source.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.asha.central.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.avrcp.controller.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.avrcp.target.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.bap.broadcast.assist.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.bap.broadcast.source.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.bap.unicast.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.bas.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.bass.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.ccp.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.csip.set_coordinator.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.gatt.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.hap.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.hfp.ag.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.hfp.hf.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.hid.device.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.hid.host.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.map.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.map.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.mcp.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.opp.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pan.nap.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pan.panu.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pbap.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pbap.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pbap.sim.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.sap.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.vcp.controller.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+
+bluetooth.core.acl.link_supervision_timeout u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.page_scan_type u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.page_scan_interval u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.page_scan_window u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.inq_scan_type u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.inq_scan_interval u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.inq_scan_window u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.page_timeout u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.classic.sniff_max_intervals u:object_r:bluetooth_config_prop:s0 exact string
+bluetooth.core.classic.sniff_min_intervals u:object_r:bluetooth_config_prop:s0 exact string
+bluetooth.core.classic.sniff_attempts u:object_r:bluetooth_config_prop:s0 exact string
+bluetooth.core.classic.sniff_timeouts u:object_r:bluetooth_config_prop:s0 exact string
+
+bluetooth.core.le.min_connection_interval u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.max_connection_interval u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.min_connection_interval_relaxed u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.max_connection_interval_relaxed u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.min_connection_interval_aggressive u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.max_connection_interval_aggressive u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.aggressive_connection_threshold u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_latency u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_supervision_timeout u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.direct_connection_timeout u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_interval_fast u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_window_fast u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_window_2m_fast u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_window_coded_fast u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_interval_slow u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.connection_scan_window_slow u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.inquiry_scan_interval u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.inquiry_scan_window u:object_r:bluetooth_config_prop:s0 exact uint
+
+bluetooth.core.le.vendor_capabilities.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.hfp.software_datapath.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.sco.disable_enhanced_connection u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.sco.managed_by_audio u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.core.le.dsa_transport_preference u:object_r:bluetooth_config_prop:s0 exact string
+
+persist.nfc.debug_enabled u:object_r:nfc_prop:s0 exact bool
+persist.nfc.vendor_debug_enabled u:object_r:nfc_prop:s0 exact bool
+persist.nfc.snoop_log_mode u:object_r:nfc_prop:s0 exact enum full filtered
+nfc.dta.skip_ndef_read u:object_r:nfc_prop:s0 exact bool
+
+persist.radio.multisim.config u:object_r:radio_control_prop:s0 exact string
+persist.radio.allow_mock_modem u:object_r:radio_control_prop:s0 exact bool
+
+persist.sys.hdmi.keep_awake u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.cec_device_types u:object_r:hdmi_config_prop:s0 exact string
+ro.hdmi.device_type u:object_r:hdmi_config_prop:s0 exact string
+ro.hdmi.set_menu_language u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.cec.source.set_menu_language.enabled u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.property_sytem_audio_device_arc_port u:object_r:hdmi_config_prop:s0 exact string
+ro.hdmi.cec_audio_device_forward_volume_keys_system_audio_mode_off u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.property_is_device_hdmi_cec_switch u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.wake_on_hotplug u:object_r:hdmi_config_prop:s0 exact bool
+ro.hdmi.cec.source.send_standby_on_sleep u:object_r:hdmi_config_prop:s0 exact enum to_tv broadcast none
+ro.hdmi.cec.source.playback_device_action_on_routing_control u:object_r:hdmi_config_prop:s0 exact enum none wake_up_only wake_up_and_send_active_source
+
+pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.bg-dexopt.concurrency u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.first-boot u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.first-boot.concurrency u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.boot-after-ota u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.boot-after-ota.concurrency u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.boot-after-mainline-update u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.boot-after-mainline-update.concurrency u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.post-boot u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.post-boot.concurrency u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.ab-ota.concurrency u:object_r:exported_pm_prop:s0 exact int
+
+pm.dexopt.cmdline u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.inactive u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install-fast u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install-bulk u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install-bulk-secondary u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install-bulk-downgraded u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install-bulk-secondary-downgraded u:object_r:exported_pm_prop:s0 exact string
+
+pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
+
+pm.dexopt.disable_bg_dexopt u:object_r:exported_pm_prop:s0 exact bool
+pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
+
+pm.dexopt. u:object_r:future_pm_prop:s0 prefix
+
+pm.16kb.app_compat.disabled u:object_r:pm_16kb_app_compat_prop:s0 exact bool
+
+ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
+
+ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+ro.bluetooth.leaudio_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+
+ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
+
+ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
+
+ro.config.alarm_alert u:object_r:systemsound_config_prop:s0 exact string
+ro.config.alarm_vol_default u:object_r:systemsound_config_prop:s0 exact int
+ro.config.alarm_vol_steps u:object_r:systemsound_config_prop:s0 exact int
+ro.config.assistant_vol_min u:object_r:systemsound_config_prop:s0 exact int
+ro.config.media_vol_default u:object_r:systemsound_config_prop:s0 exact int
+ro.config.media_vol_steps u:object_r:systemsound_config_prop:s0 exact int
+ro.config.notification_sound u:object_r:systemsound_config_prop:s0 exact string
+ro.config.ringtone u:object_r:systemsound_config_prop:s0 exact string
+ro.config.system_vol_default u:object_r:systemsound_config_prop:s0 exact int
+ro.config.system_vol_steps u:object_r:systemsound_config_prop:s0 exact int
+ro.config.vc_call_vol_default u:object_r:systemsound_config_prop:s0 exact int
+
+ro.control_privapp_permissions u:object_r:packagemanager_config_prop:s0 exact enum disable enforce log
+ro.cp_system_other_odex u:object_r:packagemanager_config_prop:s0 exact bool
+
+ro.crypto.allow_encrypt_override u:object_r:vold_config_prop:s0 exact bool
+ro.crypto.dm_default_key.options_format.version u:object_r:vold_config_prop:s0 exact int
+ro.crypto.fde_algorithm u:object_r:vold_config_prop:s0 exact string
+ro.crypto.fde_sector_size u:object_r:vold_config_prop:s0 exact int
+ro.crypto.hw_wrapped_keys.kdf u:object_r:vold_config_prop:s0 exact string
+ro.crypto.metadata_init_delete_all_keys.enabled u:object_r:vold_config_prop:s0 exact bool
+ro.crypto.scrypt_params u:object_r:vold_config_prop:s0 exact string
+ro.crypto.set_dun u:object_r:vold_config_prop:s0 exact bool
+ro.crypto.volume.contents_mode u:object_r:vold_config_prop:s0 exact string
+ro.crypto.volume.filenames_mode u:object_r:vold_config_prop:s0 exact string
+ro.crypto.volume.metadata.encryption u:object_r:vold_config_prop:s0 exact string
+ro.crypto.volume.metadata.method u:object_r:vold_config_prop:s0 exact string
+ro.crypto.volume.options u:object_r:vold_config_prop:s0 exact string
+
+external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
+external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
+external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool
+external_storage.cross_user.enabled u:object_r:storage_config_prop:s0 exact bool
+ro.fuse.bpf.enabled u:object_r:storage_config_prop:s0 exact bool
+ro.fuse.bpf.is_running u:object_r:vold_status_prop:s0 exact bool
+
+# Allow the vendor to disable the remote attestation feature at boot-time.
+avf.remote_attestation.enabled u:object_r:avf_virtualizationservice_prop:s0 exact bool
+
+hypervisor.pvmfw.path u:object_r:hypervisor_pvmfw_prop:s0 exact string
+hypervisor.virtualizationmanager.debug_policy.path u:object_r:hypervisor_virtualizationmanager_prop:s0 exact string
+hypervisor.virtualizationmanager.dump_device_tree u:object_r:hypervisor_virtualizationmanager_prop:s0 exact bool
+
+# hypervisor.*: configured by the vendor to advertise capabilities of their
+# hypervisor to virtualizationservice.
+hypervisor.memory_reclaim.supported u:object_r:hypervisor_restricted_prop:s0 exact bool
+
+ro.config.per_app_memcg u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.critical u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.critical_upgrade u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.debug u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.delay_monitors_until_boot u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.downgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.filecache_min_kb u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.kill_heaviest_task u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.kill_timeout_ms u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.log_stats u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.low u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.lowmem_min_oom_score u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.medium u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.pressure_after_kill_min_score u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.psi_partial_stall_ms u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.psi_complete_stall_ms u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.stall_limit_critical u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.swap_compression_ratio u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.swap_free_low_percentage u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.swap_util_max u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.thrashing_limit u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.thrashing_limit_critical u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.thrashing_limit_decay u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.direct_reclaim_threshold_ms u:object_r:lmkd_config_prop:s0 exact int
+ro.lmk.use_minfree_levels u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.use_new_strategy u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.use_psi u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.upgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
+lmkd.reinit u:object_r:lmkd_prop:s0 exact int
+
+ro.media.xml_variant.codecs u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.profiles u:object_r:media_variant_prop:s0 exact string
+
+ro.minui.default_rotation u:object_r:recovery_config_prop:s0 exact string
+ro.minui.overscan_percent u:object_r:recovery_config_prop:s0 exact int
+ro.minui.pixel_format u:object_r:recovery_config_prop:s0 exact string
+
+ro.oem_unlock_supported u:object_r:oem_unlock_prop:s0 exact int
+
+ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
+
+ro.recovery.usb.vid u:object_r:recovery_usb_config_prop:s0 exact string
+ro.recovery.usb.adb.pid u:object_r:recovery_usb_config_prop:s0 exact string
+ro.recovery.usb.fastboot.pid u:object_r:recovery_usb_config_prop:s0 exact string
+
+ro.storage_manager.enabled u:object_r:storagemanager_config_prop:s0 exact bool
+ro.storage_manager.show_opt_in u:object_r:storagemanager_config_prop:s0 exact bool
+
+ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
+
+ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
+
+ro.zram.mark_idle_delay_mins u:object_r:zram_config_prop:s0 exact int
+ro.zram.first_wb_delay_mins u:object_r:zram_config_prop:s0 exact int
+ro.zram.periodic_wb_delay_hours u:object_r:zram_config_prop:s0 exact int
+zram.force_writeback u:object_r:zram_config_prop:s0 exact bool
+persist.sys.zram_enabled u:object_r:zram_control_prop:s0 exact bool
+
+sendbug.preferred.domain u:object_r:sendbug_config_prop:s0 exact string
+
+persist.sys.usb.usbradio.config u:object_r:usb_control_prop:s0 exact string
+
+sys.usb.config u:object_r:usb_control_prop:s0 exact string
+sys.usb.configfs u:object_r:usb_control_prop:s0 exact int
+sys.usb.controller u:object_r:usb_control_prop:s0 exact string
+sys.usb.state u:object_r:usb_control_prop:s0 exact string
+
+sys.usb.mtp.batchcancel u:object_r:usb_config_prop:s0 exact bool
+sys.usb.mtp.device_type u:object_r:usb_config_prop:s0 exact int
+
+sys.usb.config. u:object_r:usb_prop:s0
+
+sys.usb.ffs.aio_compat u:object_r:ffs_config_prop:s0 exact bool
+sys.usb.ffs.io_uring_enabled u:object_r:ffs_config_prop:s0 exact bool
+sys.usb.ffs.max_read u:object_r:ffs_config_prop:s0 exact int
+sys.usb.ffs.max_write u:object_r:ffs_config_prop:s0 exact int
+
+sys.usb.ffs.ready u:object_r:ffs_control_prop:s0 exact bool
+sys.usb.ffs.mtp.ready u:object_r:ffs_control_prop:s0 exact bool
+
+tombstoned.max_tombstone_count u:object_r:tombstone_config_prop:s0 exact int
+
+vold.post_fs_data_done u:object_r:vold_post_fs_data_prop:s0 exact int
+
+apexd.payload_metadata.path u:object_r:apexd_payload_metadata_prop:s0 exact string
+apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
+
+dmesgd.start u:object_r:dmesgd_start_prop:s0 exact bool
+
+odsign.key.done u:object_r:odsign_prop:s0 exact bool
+odsign.verification.done u:object_r:odsign_prop:s0 exact bool
+odsign.verification.success u:object_r:odsign_prop:s0 exact bool
+
+dev.bootcomplete u:object_r:boot_status_prop:s0 exact bool
+sys.boot_completed u:object_r:boot_status_prop:s0 exact bool
+
+persist.sys.device_provisioned u:object_r:provisioned_prop:s0 exact string
+
+persist.sys.theme u:object_r:theme_prop:s0 exact string
+
+sys.retaildemo.enabled u:object_r:retaildemo_prop:s0 exact int
+
+sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
+
+aac_drc_boost u:object_r:aac_drc_prop:s0 exact int
+aac_drc_cut u:object_r:aac_drc_prop:s0 exact int
+aac_drc_enc_target_level u:object_r:aac_drc_prop:s0 exact int
+aac_drc_heavy u:object_r:aac_drc_prop:s0 exact int
+aac_drc_reference_level u:object_r:aac_drc_prop:s0 exact int
+ro.aac_drc_effect_type u:object_r:aac_drc_prop:s0 exact int
+
+build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
+
+drm.64bit.enabled u:object_r:mediadrm_config_prop:s0 exact bool
+media.mediadrmservice.enable u:object_r:mediadrm_config_prop:s0 exact bool
+persist.drm.forcel3.enabled u:object_r:drm_forcel3_prop:s0 exact bool
+
+drm.service.enabled u:object_r:drm_service_config_prop:s0 exact bool
+
+dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
+dumpstate.unroot u:object_r:exported_dumpstate_prop:s0 exact bool
+persist.dumpstate.verbose_logging.enabled u:object_r:hal_dumpstate_config_prop:s0 exact bool
+
+hal.instrumentation.enable u:object_r:hal_instrumentation_prop:s0 exact bool
+
+# default contexts only accessible by coredomain
+init.svc. u:object_r:init_service_status_private_prop:s0 prefix string
+
+# Globally-readable init service props
+init.svc.adbd u:object_r:init_service_status_prop:s0 exact string
+init.svc.bugreport u:object_r:init_service_status_prop:s0 exact string
+init.svc.bugreportd u:object_r:init_service_status_prop:s0 exact string
+init.svc.console u:object_r:init_service_status_prop:s0 exact string
+init.svc.dumpstatez u:object_r:init_service_status_prop:s0 exact string
+init.svc.mediadrm u:object_r:init_service_status_prop:s0 exact string
+init.svc.statsd u:object_r:init_service_status_prop:s0 exact string
+init.svc.surfaceflinger u:object_r:init_service_status_prop:s0 exact string
+init.svc.tombstoned u:object_r:init_service_status_prop:s0 exact string
+init.svc.zygote u:object_r:init_service_status_prop:s0 exact string
+
+# Epoch time at which last fatal reboot was performed
+persist.init.svc.last_fatal_reboot_epoch u:object_r:init_service_status_private_prop:s0 exact int
+
+libc.debug.malloc.options u:object_r:libc_debug_prop:s0 exact string
+libc.debug.malloc.program u:object_r:libc_debug_prop:s0 exact string
+libc.debug.hooks.enable u:object_r:libc_debug_prop:s0 exact string
+
+# GWP-ASan props. Separate from other libc.debug.* props, because we want users
+# to be able to set them from `adb shell` even on release devices.
+libc.debug.gwp_asan. u:object_r:gwp_asan_prop:s0 prefix string
+persist.libc.debug.gwp_asan. u:object_r:gwp_asan_prop:s0 prefix string
+
+# shell-only props for ARM memory tagging (MTE).
+arm64.memtag. u:object_r:arm64_memtag_prop:s0 prefix string
+persist.arm64.memtag. u:object_r:arm64_memtag_prop:s0 prefix string
+
+# kcmdline props for dogfood experiments
+# All kcmdline properties share the kcmdline_prop context
+kcmdline.loaded u:object_r:kcmdline_prop:s0 exact bool
+kcmdline.binder u:object_r:kcmdline_prop:s0 exact enum c rust
+
+net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
+
+# Settings system properties containing mutable "global" device settings.
+#
+# These can't be Android settings because they are also read by low-level
+# binaries that don't have access to "real" SettingsProvider settings. This
+# will usually be because of when they execute, e.g. during boot when Android
+# services are not yet running, and/or because they are needed by binaries that
+# are not "Android aware", i.e. they have light integration with the Android
+# platform via the low-level system properties lib. Processes like shell may
+# modify these for testing purposes, but doing so is generally discouraged;
+# updates to these props will generally require intents to be sent to
+# long-running Android apps so they can update cached data and their UI state.
+persist.sys.locale u:object_r:locale_prop:s0 exact string
+persist.sys.timezone u:object_r:timezone_prop:s0 exact string
+
+# Time zone metadata system properties. Holds information associated with the
+# device's time zone and will therefore be written to at the same time. Unlike
+# timezone_prop props, these do not need to be read by other processes.
+persist.sys.timezone_confidence u:object_r:timezone_metadata_prop:s0 exact uint
+
+persist.sys.mte.permissive u:object_r:permissive_mte_prop:s0 exact string
+persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
+
+ro.arch u:object_r:build_prop:s0 exact string
+
+# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
+ro.boot. u:object_r:bootloader_prop:s0
+ro.boot.avb_version u:object_r:bootloader_prop:s0 exact string
+ro.boot.baseband u:object_r:bootloader_prop:s0 exact string
+ro.boot.bootdevice u:object_r:bootloader_prop:s0 exact string
+ro.boot.bootloader u:object_r:bootloader_prop:s0 exact string
+ro.boot.boottime u:object_r:bootloader_prop:s0 exact string
+ro.boot.console u:object_r:bootloader_prop:s0 exact string
+ro.boot.ddr_size u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware.color u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware.sku u:object_r:bootloader_prop:s0 exact string
+ro.boot.keymaster u:object_r:bootloader_prop:s0 exact string
+ro.boot.mode u:object_r:bootloader_prop:s0 exact string
+# Populated on Android Studio Emulator (for emulator specific workarounds)
+ro.boot.qemu u:object_r:bootloader_prop:s0 exact bool
+ro.boot.revision u:object_r:bootloader_prop:s0 exact string
+ro.boot.serialconsole u:object_r:bootloader_prop:s0 exact bool
+ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
+ro.boot.vbmeta.public_key_digest u:object_r:bootloader_prop:s0 exact string
+ro.boot.verifiedbootstate u:object_r:bootloader_prop:s0 exact string
+ro.boot.veritymode u:object_r:bootloader_prop:s0 exact string
+# Properties specific to virtualized deployments of Android
+ro.boot.hypervisor.protected_vm.supported u:object_r:hypervisor_prop:s0 exact bool
+ro.boot.hypervisor.version u:object_r:hypervisor_prop:s0 exact string
+ro.boot.hypervisor.vm.supported u:object_r:hypervisor_prop:s0 exact bool
+
+# These ro.X properties are set to values of ro.boot.X by property_service.
+ro.baseband u:object_r:bootloader_prop:s0 exact string
+ro.bootloader u:object_r:bootloader_prop:s0 exact string
+ro.bootmode u:object_r:bootloader_prop:s0 exact string
+ro.hardware u:object_r:bootloader_prop:s0 exact string
+ro.revision u:object_r:bootloader_prop:s0 exact string
+
+ro.boot.dynamic_partitions u:object_r:exported_default_prop:s0 exact string
+ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
+
+ro.boottime.init.mount.data u:object_r:boottime_public_prop:s0 exact string
+ro.boottime.init.fsck.data u:object_r:boottime_public_prop:s0 exact string
+ro.fstype.data u:object_r:fstype_prop:s0 exact string
+
+ro.build.backported_fixes.alias_bitset.long_list u:object_r:build_prop:s0 exact string
+ro.build.characteristics u:object_r:build_prop:s0 exact string
+ro.build.date u:object_r:build_prop:s0 exact string
+ro.build.date.utc u:object_r:build_prop:s0 exact int
+ro.build.description u:object_r:build_prop:s0 exact string
+ro.build.display.id u:object_r:build_prop:s0 exact string
+ro.build.flavor u:object_r:build_prop:s0 exact string
+ro.build.host u:object_r:build_prop:s0 exact string
+ro.build.id u:object_r:build_prop:s0 exact string
+ro.build.product u:object_r:build_prop:s0 exact string
+ro.build.system_root_image u:object_r:build_prop:s0 exact bool
+ro.build.tags u:object_r:build_prop:s0 exact string
+ro.build.type u:object_r:build_prop:s0 exact string
+ro.build.user u:object_r:build_prop:s0 exact string
+ro.build.version.all_codenames u:object_r:build_prop:s0 exact string
+ro.build.version.base_os u:object_r:build_prop:s0 exact string
+ro.build.version.codename u:object_r:build_prop:s0 exact string
+ro.build.version.incremental u:object_r:build_prop:s0 exact string
+ro.build.version.min_supported_target_sdk u:object_r:build_prop:s0 exact int
+ro.build.version.preview_sdk u:object_r:build_prop:s0 exact int
+ro.build.version.preview_sdk_fingerprint u:object_r:build_prop:s0 exact string
+ro.build.version.release u:object_r:build_prop:s0 exact string
+ro.build.version.release_or_codename u:object_r:build_prop:s0 exact string
+ro.build.version.sdk u:object_r:build_prop:s0 exact int
+ro.build.version.security_patch u:object_r:build_prop:s0 exact string
+
+ro.actionable_compatible_property.enabled u:object_r:build_prop:s0 exact bool
+
+
+# Property for enabling 16k pages developer option.
+ro.product.build.16k_page.enabled u:object_r:enable_16k_pages_prop:s0 exact bool
+
+# Property that indicates which page size the device boots by default.
+ro.product.page_size u:object_r:page_size_prop:s0 exact int
+
+ro.debuggable u:object_r:userdebug_or_eng_prop:s0 exact bool
+ro.force.debuggable u:object_r:build_prop:s0 exact bool
+
+ro.treble.enabled u:object_r:build_prop:s0 exact bool
+
+ro.product.cpu.abi u:object_r:build_prop:s0 exact string
+ro.product.cpu.abilist u:object_r:build_prop:s0 exact string
+ro.product.cpu.abilist32 u:object_r:build_prop:s0 exact string
+ro.product.cpu.abilist64 u:object_r:build_prop:s0 exact string
+
+ro.product.cpu.pagesize.max u:object_r:build_prop:s0 exact enum 4096 16384 65536
+
+ro.product.system.brand u:object_r:build_prop:s0 exact string
+ro.product.system.device u:object_r:build_prop:s0 exact string
+ro.product.system.manufacturer u:object_r:build_prop:s0 exact string
+ro.product.system.model u:object_r:build_prop:s0 exact string
+ro.product.system.name u:object_r:build_prop:s0 exact string
+
+ro.system.build.date u:object_r:build_prop:s0 exact string
+ro.system.build.date.utc u:object_r:build_prop:s0 exact int
+ro.system.build.fingerprint u:object_r:build_prop:s0 exact string
+ro.system.build.id u:object_r:build_prop:s0 exact string
+ro.system.build.tags u:object_r:build_prop:s0 exact string
+ro.system.build.type u:object_r:build_prop:s0 exact string
+ro.system.build.version.incremental u:object_r:build_prop:s0 exact string
+ro.system.build.version.release u:object_r:build_prop:s0 exact string
+ro.system.build.version.release_or_codename u:object_r:build_prop:s0 exact string
+ro.system.build.version.sdk u:object_r:build_prop:s0 exact int
+
+ro.adb.secure u:object_r:build_prop:s0 exact bool
+ro.secure u:object_r:userdebug_or_eng_prop:s0 exact int
+
+ro.product.system_ext.brand u:object_r:build_prop:s0 exact string
+ro.product.system_ext.device u:object_r:build_prop:s0 exact string
+ro.product.system_ext.manufacturer u:object_r:build_prop:s0 exact string
+ro.product.system_ext.model u:object_r:build_prop:s0 exact string
+ro.product.system_ext.name u:object_r:build_prop:s0 exact string
+
+ro.system_ext.build.date u:object_r:build_prop:s0 exact string
+ro.system_ext.build.date.utc u:object_r:build_prop:s0 exact int
+ro.system_ext.build.fingerprint u:object_r:build_prop:s0 exact string
+ro.system_ext.build.id u:object_r:build_prop:s0 exact string
+ro.system_ext.build.tags u:object_r:build_prop:s0 exact string
+ro.system_ext.build.type u:object_r:build_prop:s0 exact string
+ro.system_ext.build.version.incremental u:object_r:build_prop:s0 exact string
+ro.system_ext.build.version.release u:object_r:build_prop:s0 exact string
+ro.system_ext.build.version.release_or_codename u:object_r:build_prop:s0 exact string
+ro.system_ext.build.version.sdk u:object_r:build_prop:s0 exact int
+
+# These ro.product.product.* and ro.product.build.* are set by /product/etc/build.prop
+ro.product.product.brand u:object_r:build_prop:s0 exact string
+ro.product.product.device u:object_r:build_prop:s0 exact string
+ro.product.product.manufacturer u:object_r:build_prop:s0 exact string
+ro.product.product.model u:object_r:build_prop:s0 exact string
+ro.product.product.name u:object_r:build_prop:s0 exact string
+
+ro.product.build.date u:object_r:build_prop:s0 exact string
+ro.product.build.date.utc u:object_r:build_prop:s0 exact int
+ro.product.build.fingerprint u:object_r:build_prop:s0 exact string
+ro.product.build.id u:object_r:build_prop:s0 exact string
+ro.product.build.tags u:object_r:build_prop:s0 exact string
+ro.product.build.type u:object_r:build_prop:s0 exact string
+ro.product.build.version.incremental u:object_r:build_prop:s0 exact string
+ro.product.build.version.release u:object_r:build_prop:s0 exact string
+ro.product.build.version.release_or_codename u:object_r:build_prop:s0 exact string
+ro.product.build.version.sdk u:object_r:build_prop:s0 exact int
+
+# These 5 properties are set by property_service
+ro.product.brand u:object_r:build_prop:s0 exact string
+ro.product.device u:object_r:build_prop:s0 exact string
+ro.product.manufacturer u:object_r:build_prop:s0 exact string
+ro.product.model u:object_r:build_prop:s0 exact string
+ro.product.name u:object_r:build_prop:s0 exact string
+
+# Sanitizer properties
+ro.sanitize.address u:object_r:build_prop:s0 exact bool
+ro.sanitize.cfi u:object_r:build_prop:s0 exact bool
+ro.sanitize.default-ub u:object_r:build_prop:s0 exact bool
+ro.sanitize.fuzzer u:object_r:build_prop:s0 exact bool
+ro.sanitize.hwaddress u:object_r:build_prop:s0 exact bool
+ro.sanitize.integer_overflow u:object_r:build_prop:s0 exact bool
+ro.sanitize.safe-stack u:object_r:build_prop:s0 exact bool
+ro.sanitize.scudo u:object_r:build_prop:s0 exact bool
+ro.sanitize.thread u:object_r:build_prop:s0 exact bool
+ro.sanitize.undefined u:object_r:build_prop:s0 exact bool
+
+# All odm build props are set by /odm/build.prop
+ro.odm.build.date u:object_r:build_odm_prop:s0 exact string
+ro.odm.build.date.utc u:object_r:build_odm_prop:s0 exact int
+ro.odm.build.fingerprint u:object_r:build_odm_prop:s0 exact string
+ro.odm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
+ro.odm.build.media_performance_class u:object_r:build_odm_prop:s0 exact int
+
+ro.product.odm.brand u:object_r:build_odm_prop:s0 exact string
+ro.product.odm.device u:object_r:build_odm_prop:s0 exact string
+ro.product.odm.manufacturer u:object_r:build_odm_prop:s0 exact string
+ro.product.odm.model u:object_r:build_odm_prop:s0 exact string
+ro.product.odm.name u:object_r:build_odm_prop:s0 exact string
+
+# All vendor_dlkm build props are set by /vendor_dlkm/etc/build.prop
+ro.vendor_dlkm.build.date u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.date.utc u:object_r:build_vendor_prop:s0 exact int
+ro.vendor_dlkm.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.id u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.tags u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.type u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.version.release u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.version.release_or_codename u:object_r:build_vendor_prop:s0 exact string
+ro.vendor_dlkm.build.version.sdk u:object_r:build_vendor_prop:s0 exact int
+
+# All odm_dlkm build props are set by /odm_dlkm/etc/build.prop
+ro.product.odm_dlkm.brand u:object_r:build_odm_prop:s0 exact string
+ro.product.odm_dlkm.device u:object_r:build_odm_prop:s0 exact string
+ro.product.odm_dlkm.manufacturer u:object_r:build_odm_prop:s0 exact string
+ro.product.odm_dlkm.model u:object_r:build_odm_prop:s0 exact string
+ro.product.odm_dlkm.name u:object_r:build_odm_prop:s0 exact string
+
+ro.odm_dlkm.build.date u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.date.utc u:object_r:build_odm_prop:s0 exact int
+ro.odm_dlkm.build.fingerprint u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.id u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.tags u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.type u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.version.release u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.version.release_or_codename u:object_r:build_odm_prop:s0 exact string
+ro.odm_dlkm.build.version.sdk u:object_r:build_odm_prop:s0 exact int
+
+# enforces debugfs restrictions in non-user builds, set by /vendor/build.prop
+ro.product.debugfs_restrictions.enabled u:object_r:debugfs_restriction_prop:s0 exact bool
+
+# All vendor build props are set by /vendor/build.prop
+ro.vendor.build.date u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.date.utc u:object_r:build_vendor_prop:s0 exact int
+ro.vendor.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.fingerprint_has_digest u:object_r:build_vendor_prop:s0 exact bool
+ro.vendor.build.id u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.tags u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.type u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.version.release u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.version.release_or_codename u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.build.version.sdk u:object_r:build_vendor_prop:s0 exact int
+ro.vendor.build.dont_use_vabc u:object_r:build_vendor_prop:s0 exact bool
+
+# All vendor CPU abilist props are set by /vendor/build.prop
+ro.vendor.product.cpu.abilist u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.product.cpu.abilist32 u:object_r:build_vendor_prop:s0 exact string
+ro.vendor.product.cpu.abilist64 u:object_r:build_vendor_prop:s0 exact string
+
+ro.product.board u:object_r:build_vendor_prop:s0 exact string
+ro.product.first_api_level u:object_r:build_vendor_prop:s0 exact int
+ro.product.vendor.brand u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor.device u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor.manufacturer u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor.model u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor.name u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor_dlkm.brand u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor_dlkm.device u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor_dlkm.manufacturer u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor_dlkm.model u:object_r:build_vendor_prop:s0 exact string
+ro.product.vendor_dlkm.name u:object_r:build_vendor_prop:s0 exact string
+
+# build props for attestation feature are set by property_service
+ro.product.brand_for_attestation u:object_r:build_attestation_prop:s0 exact string
+ro.product.model_for_attestation u:object_r:build_attestation_prop:s0 exact string
+ro.product.name_for_attestation u:object_r:build_attestation_prop:s0 exact string
+ro.product.device_for_attestation u:object_r:build_attestation_prop:s0 exact string
+ro.product.manufacturer_for_attestation u:object_r:build_attestation_prop:s0 exact string
+
+# Vendor API level properties for the vFRC and GRF
+ro.board.first_api_level u:object_r:build_vendor_prop:s0 exact int
+ro.board.api_level u:object_r:build_vendor_prop:s0 exact int
+ro.board.api_frozen u:object_r:build_vendor_prop:s0 exact bool
+ro.llndk.api_level u:object_r:build_prop:s0 exact int
+ro.vendor.api_level u:object_r:build_vendor_prop:s0 exact int
+
+# Boot image build props set by /{second_stage_resources/,}boot/etc/build.prop
+ro.bootimage.build.date u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.date.utc u:object_r:build_bootimage_prop:s0 exact int
+ro.bootimage.build.fingerprint u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.id u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.tags u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.type u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.version.incremental u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.version.release u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.version.release_or_codename u:object_r:build_bootimage_prop:s0 exact string
+ro.bootimage.build.version.sdk u:object_r:build_bootimage_prop:s0 exact int
+
+ro.product.bootimage.brand u:object_r:build_bootimage_prop:s0 exact string
+ro.product.bootimage.device u:object_r:build_bootimage_prop:s0 exact string
+ro.product.bootimage.manufacturer u:object_r:build_bootimage_prop:s0 exact string
+ro.product.bootimage.model u:object_r:build_bootimage_prop:s0 exact string
+ro.product.bootimage.name u:object_r:build_bootimage_prop:s0 exact string
+
+# ro.product.property_source_order is settable from any build.prop
+ro.product.property_source_order u:object_r:build_config_prop:s0 exact string
+
+ro.crypto.state u:object_r:vold_status_prop:s0 exact enum encrypted unencrypted unsupported
+ro.crypto.type u:object_r:vold_status_prop:s0 exact enum block file managed none
+
+ro.property_service.version u:object_r:property_service_version_prop:s0 exact int
+ro.property_service.async_persist_writes u:object_r:build_config_prop:s0 exact bool
+
+ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
+
+service.bootanim.exit u:object_r:bootanim_system_prop:s0 exact int
+service.bootanim.progress u:object_r:bootanim_system_prop:s0 exact int
+persist.bootanim.color1 u:object_r:bootanim_system_prop:s0 exact int
+persist.bootanim.color2 u:object_r:bootanim_system_prop:s0 exact int
+persist.bootanim.color3 u:object_r:bootanim_system_prop:s0 exact int
+persist.bootanim.color4 u:object_r:bootanim_system_prop:s0 exact int
+
+sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
+sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
+
+vold.decrypt u:object_r:vold_status_prop:s0 exact string
+
+aaudio.hw_burst_min_usec u:object_r:aaudio_config_prop:s0 exact int
+aaudio.minimum_sleep_usec u:object_r:aaudio_config_prop:s0 exact int
+aaudio.mixer_bursts u:object_r:aaudio_config_prop:s0 exact int
+aaudio.mmap_exclusive_policy u:object_r:aaudio_config_prop:s0 exact int
+aaudio.mmap_policy u:object_r:aaudio_config_prop:s0 exact int
+aaudio.wakeup_delay_usec u:object_r:aaudio_config_prop:s0 exact int
+
+persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
+
+ro.bionic.2nd_arch u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.arch u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.cpu_variant u:object_r:cpu_variant_prop:s0 exact string
+
+bionic.linker.16kb.app_compat.enabled u:object_r:bionic_linker_16kb_app_compat_prop:s0 exact bool
+
+ro.board.platform u:object_r:exported_default_prop:s0 exact string
+
+ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
+ro.boot.fstab_suffix u:object_r:exported_default_prop:s0 exact string
+ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
+ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
+ro.boot.product.vendor.sku u:object_r:exported_default_prop:s0 exact string
+ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
+
+# Vendor configurable property to be used specifically to assign industrial
+# design ID or vendor hardware identifier that encodes on device components.
+# This property should not be assigned a generic device name or identifier and
+# should not be redundant to properties like ro.boot.hardware. ro.product.name
+# etc.
+ro.boot.product.hardware.id u:object_r:exported_default_prop:s0 exact string
+
+ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
+
+# Update related props
+ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
+ro.build.ab_update.gki.prevent_downgrade_version u:object_r:ab_update_gki_prop:s0 exact bool
+ro.build.ab_update.gki.prevent_downgrade_spl u:object_r:ab_update_gki_prop:s0 exact bool
+
+ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
+ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
+
+ro.carrier u:object_r:exported_default_prop:s0 exact string
+
+ro.config.low_ram u:object_r:exported_config_prop:s0 exact bool
+ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
+
+ro.frp.pst u:object_r:exported_default_prop:s0 exact string
+
+ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.a2dp u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.hearing_aid u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.primary u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.usb u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio_policy u:object_r:exported_default_prop:s0 exact string
+ro.hardware.bootctrl u:object_r:exported_default_prop:s0 exact string
+ro.hardware.camera u:object_r:exported_default_prop:s0 exact string
+ro.hardware.consumerir u:object_r:exported_default_prop:s0 exact string
+ro.hardware.context_hub u:object_r:exported_default_prop:s0 exact string
+ro.hardware.egl u:object_r:exported_default_prop:s0 exact string
+ro.hardware.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.hardware.flp u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gatekeeper u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gps u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gralloc u:object_r:exported_default_prop:s0 exact string
+ro.hardware.hdmi_cec u:object_r:exported_default_prop:s0 exact string
+ro.hardware.hwcomposer u:object_r:exported_default_prop:s0 exact string
+ro.hardware.input u:object_r:exported_default_prop:s0 exact string
+ro.hardware.keystore u:object_r:exported_default_prop:s0 exact string
+ro.hardware.keystore_desede u:object_r:exported_default_prop:s0 exact string
+ro.hardware.lights u:object_r:exported_default_prop:s0 exact string
+ro.hardware.local_time u:object_r:exported_default_prop:s0 exact string
+ro.hardware.memtrack u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc_nci u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc_tag u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nvram u:object_r:exported_default_prop:s0 exact string
+ro.hardware.power u:object_r:exported_default_prop:s0 exact string
+ro.hardware.radio u:object_r:exported_default_prop:s0 exact string
+ro.hardware.sensors u:object_r:exported_default_prop:s0 exact string
+ro.hardware.sound_trigger u:object_r:exported_default_prop:s0 exact string
+ro.hardware.thermal u:object_r:exported_default_prop:s0 exact string
+ro.hardware.tv_input u:object_r:exported_default_prop:s0 exact string
+ro.hardware.type u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vehicle u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vibrator u:object_r:exported_default_prop:s0 exact string
+ro.hardware.virtual_device u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vulkan u:object_r:exported_default_prop:s0 exact string
+
+ro.hw_timeout_multiplier u:object_r:hw_timeout_multiplier_prop:s0 exact int
+
+ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
+
+# ro.kernel.* properties are emulator specific and deprecated. Do not use.
+# Should be retired once presubmit allows.
+ro.kernel.qemu u:object_r:exported_default_prop:s0 exact bool
+ro.kernel.qemu. u:object_r:exported_default_prop:s0
+ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
+
+# This property is used by init to store the original value or /proc/sys/vm/watermark_scale_factor
+ro.kernel.watermark_scale_factor u:object_r:init_storage_prop:s0 exact int
+
+ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
+
+ro.product.vndk.version u:object_r:vndk_prop:s0 exact string
+
+ro.vndk.lite u:object_r:vndk_prop:s0 exact bool
+ro.vndk.version u:object_r:vndk_prop:s0 exact string
+
+ro.vts.coverage u:object_r:vts_config_prop:s0 exact int
+
+vts.native_server.on u:object_r:vts_status_prop:s0 exact bool
+
+wifi.active.interface u:object_r:wifi_hal_prop:s0 exact string
+wifi.aware.interface u:object_r:wifi_hal_prop:s0 exact string
+wifi.concurrent.interface u:object_r:wifi_hal_prop:s0 exact string
+wifi.direct.interface u:object_r:wifi_hal_prop:s0 exact string
+wifi.interface u:object_r:wifi_hal_prop:s0 exact string
+wifi.interface. u:object_r:wifi_hal_prop:s0 prefix string
+wlan.driver.status u:object_r:wifi_hal_prop:s0 exact enum ok unloaded
+
+ro.boot.wificountrycode u:object_r:wifi_config_prop:s0 exact string
+
+ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
+
+# Property to enable incremental feature
+ro.incremental.enable u:object_r:incremental_prop:s0
+
+# Properties to configure userspace reboot.
+init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
+init.userspace_reboot.sigkill.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
+init.userspace_reboot.sigterm.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
+init.userspace_reboot.started.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
+init.userspace_reboot.userdata_remount.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
+init.userspace_reboot.watchdog.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
+
+sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
+
+# surfaceflinger properties
+ro.surface_flinger.default_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.default_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.force_hwc_copy_for_virtual_displays u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.has_HDR_display u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.has_wide_color_display u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.max_graphics_height u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.max_graphics_width u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.max_virtual_display_dimension u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.primary_display_orientation u:object_r:surfaceflinger_prop:s0 exact enum ORIENTATION_0 ORIENTATION_180 ORIENTATION_270 ORIENTATION_90
+ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.running_without_sync_framework u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.start_graphics_allocator_service u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.use_color_management u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.use_context_priority u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.use_vr_flinger u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.vsync_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.vsync_sf_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.wcg_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.wcg_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.display_primary_red u:object_r:surfaceflinger_prop:s0 exact string
+ro.surface_flinger.display_primary_green u:object_r:surfaceflinger_prop:s0 exact string
+ro.surface_flinger.display_primary_blue u:object_r:surfaceflinger_prop:s0 exact string
+ro.surface_flinger.display_primary_white u:object_r:surfaceflinger_prop:s0 exact string
+ro.surface_flinger.protected_contents u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.set_idle_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.set_touch_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.set_display_power_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.support_kernel_idle_timer u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.supports_background_blur u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.use_smart_90_for_video u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.color_space_agnostic_dataspace u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.refresh_rate_switching u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.update_device_product_info_on_hotplug_reconnect u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.enable_adpf_cpu_hint u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.enable_frame_rate_override u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.enable_layer_caching u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.display_update_imminent_timeout_ms u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.uclamp.min u:object_r:surfaceflinger_prop:s0 exact int
+ro.surface_flinger.ignore_hdr_camera_layers u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.clear_slots_with_set_layer_buffer u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.prime_shader_cache.ultrahdr u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.game_default_frame_rate_override u:object_r:surfaceflinger_prop:s0 exact int
+
+ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
+ro.sf.lcd_density u:object_r:surfaceflinger_prop:s0 exact int
+
+persist.sys.sf.color_mode u:object_r:surfaceflinger_color_prop:s0 exact int
+persist.sys.sf.color_saturation u:object_r:surfaceflinger_color_prop:s0 exact string
+persist.sys.sf.native_mode u:object_r:surfaceflinger_color_prop:s0 exact int
+
+# Binder cache properties. These are world-readable
+cache_key.app_inactive u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_compat_change_enabled u:object_r:binder_cache_system_server_prop:s0
+cache_key.get_packages_for_uid u:object_r:binder_cache_system_server_prop:s0
+cache_key.has_system_feature u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_interactive u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_power_save_mode u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_user_unlocked u:object_r:binder_cache_system_server_prop:s0
+cache_key.volume_list u:object_r:binder_cache_system_server_prop:s0
+cache_key.display_info u:object_r:binder_cache_system_server_prop:s0
+cache_key.location_enabled u:object_r:binder_cache_system_server_prop:s0
+cache_key.package_info u:object_r:binder_cache_system_server_prop:s0
+
+cache_key.bluetooth. u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
+cache_key.system_server. u:object_r:binder_cache_system_server_prop:s0 prefix string
+cache_key.telephony. u:object_r:binder_cache_telephony_server_prop:s0 prefix string
+
+# Framework watchdog configuration properties.
+framework_watchdog.fatal_count u:object_r:framework_watchdog_config_prop:s0 exact int
+framework_watchdog.fatal_window.second u:object_r:framework_watchdog_config_prop:s0 exact int
+
+# Framework configuration properties.
+framework.pause_bg_animations.enabled u:object_r:framework_status_prop:s0 exact bool
+
+gsm.operator.iso-country u:object_r:telephony_status_prop:s0 exact string
+gsm.sim.operator.iso-country u:object_r:telephony_status_prop:s0 exact string
+gsm.sim.operator.numeric u:object_r:telephony_status_prop:s0 exact string
+persist.radio.airplane_mode_on u:object_r:telephony_status_prop:s0 exact bool
+
+ro.cdma.home.operator.alpha u:object_r:telephony_config_prop:s0 exact string
+ro.cdma.home.operator.numeric u:object_r:telephony_config_prop:s0 exact string
+ro.com.android.dataroaming u:object_r:telephony_config_prop:s0 exact bool
+ro.com.android.prov_mobiledata u:object_r:telephony_config_prop:s0 exact bool
+ro.radio.noril u:object_r:telephony_config_prop:s0 exact string
+ro.telephony.call_ring.multiple u:object_r:telephony_config_prop:s0 exact bool
+ro.telephony.default_cdma_sub u:object_r:telephony_config_prop:s0 exact int
+ro.telephony.default_network u:object_r:telephony_config_prop:s0 exact string
+ro.telephony.iwlan_operation_mode u:object_r:telephony_config_prop:s0 exact enum default legacy AP-assisted
+telephony.active_modems.max_count u:object_r:telephony_config_prop:s0 exact int
+telephony.lteOnCdmaDevice u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.volte_avail_ovr u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.volte_avail_ovr0 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.volte_avail_ovr1 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.volte_avail_ovr2 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.vt_avail_ovr u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.vt_avail_ovr0 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.vt_avail_ovr1 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.vt_avail_ovr2 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.wfc_avail_ovr u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.wfc_avail_ovr0 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.wfc_avail_ovr1 u:object_r:telephony_config_prop:s0 exact int
+persist.dbg.wfc_avail_ovr2 u:object_r:telephony_config_prop:s0 exact int
+
+# System locale list filter configuration
+ro.localization.locale_filter u:object_r:localization_prop:s0 exact string
+
+# Graphics related properties
+ro.opengles.version u:object_r:graphics_config_prop:s0 exact int
+
+ro.egl.blobcache.multifile u:object_r:graphics_config_prop:s0 exact bool
+ro.egl.blobcache.multifile_limit u:object_r:graphics_config_prop:s0 exact int
+
+ro.gfx.driver.0 u:object_r:graphics_config_prop:s0 exact string
+ro.gfx.driver.1 u:object_r:graphics_config_prop:s0 exact string
+ro.gfx.angle.supported u:object_r:graphics_config_prop:s0 exact bool
+ro.gfx.driver_build_time u:object_r:graphics_config_prop:s0 exact int
+
+graphics.gpu.profiler.support u:object_r:graphics_config_prop:s0 exact bool
+graphics.gpu.profiler.vulkan_layer_apk u:object_r:graphics_config_prop:s0 exact string
+persist.graphics.egl u:object_r:graphics_config_writable_prop:s0 exact string
+
+ro.cpuvulkan.version u:object_r:graphics_config_prop:s0 exact int
+
+ro.vulkan.apex u:object_r:graphics_config_prop:s0 exact string
+
+# surfaceflinger-settable
+graphics.display.kernel_idle_timer.enabled u:object_r:surfaceflinger_display_prop:s0 exact bool
+
+# Disable/enable charger input
+power.battery_input.suspended u:object_r:power_debug_prop:s0 exact bool
+
+# zygote config property
+zygote.critical_window.minute u:object_r:zygote_config_prop:s0 exact int
+
+ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
+
+# Allows a device to run without batch attestation keys
+remote_provisioning.strongbox.rkp_only u:object_r:remote_prov_prop:s0 exact bool
+remote_provisioning.tee.rkp_only u:object_r:remote_prov_prop:s0 exact bool
+
+# Hostname for the remote provisioning server a device should communicate with
+remote_provisioning.hostname u:object_r:remote_prov_prop:s0 exact string
+
+# Support for post-processing RKP certificates
+remote_provisioning.use_cert_processor u:object_r:remote_prov_cert_prop:s0 exact bool
+
+# Connection Timeout for remote provisioning step
+remote_provisioning.connect_timeout_millis u:object_r:remote_prov_prop:s0 exact int
+
+# Broadcast boot stages, which keystore listens to
+keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
+
+# Tracks keystore crash counts during a boot cycle.
+keystore.crash_count u:object_r:keystore_diagnostics_prop:s0 exact int
+
+# Tracks whether Keystore has successfully sent the module info hash to (V4+) KeyMints.
+keystore.module_hash.sent u:object_r:keystore_diagnostics_prop:s0 exact bool
+
+# Configure the means by which we protect the L0 key from the future
+ro.keystore.boot_level_key.strategy u:object_r:keystore_config_prop:s0 exact string
+
+partition.system.verified u:object_r:verity_status_prop:s0 exact string
+partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
+partition.product.verified u:object_r:verity_status_prop:s0 exact string
+partition.vendor.verified u:object_r:verity_status_prop:s0 exact string
+partition.odm.verified u:object_r:verity_status_prop:s0 exact string
+
+# Properties that holds the hashtree information for verity partitions.
+partition.system.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
+partition.system_ext.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
+partition.product.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
+partition.vendor.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
+partition.odm.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
+partition.system.verified.root_digest u:object_r:verity_status_prop:s0 exact string
+partition.system_ext.verified.root_digest u:object_r:verity_status_prop:s0 exact string
+partition.product.verified.root_digest u:object_r:verity_status_prop:s0 exact string
+partition.vendor.verified.root_digest u:object_r:verity_status_prop:s0 exact string
+partition.odm.verified.root_digest u:object_r:verity_status_prop:s0 exact string
+
+ro.setupwizard.enterprise_mode u:object_r:setupwizard_prop:s0 exact bool
+ro.setupwizard.esim_cid_ignore u:object_r:setupwizard_prop:s0 exact string
+ro.setupwizard.rotation_locked u:object_r:setupwizard_prop:s0 exact bool
+ro.setupwizard.wifi_on_exit u:object_r:setupwizard_prop:s0 exact bool
+
+ro.setupwizard.mode u:object_r:setupwizard_mode_prop:s0 exact string
+
+setupwizard.enable_assist_gesture_training u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.avoid_duplicate_tos u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.baseline_setupwizard_enabled u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.day_night_mode_enabled u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.deferred_setup_low_ram_filter u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.deferred_setup_notification u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.deferred_setup_suggestion u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.device_default_dark_mode u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.esim_enabled u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.google_services_deferred_setup_pretend_not_suw u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.lock_mobile_data u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.lock_mobile_data.carrier-1 u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.portal_notification u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.predeferred_enabled u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.return_partner_customization_bundle u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.show_pixel_tos u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.use_biometric_lock u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.feature.wallpaper_suggestion_after_restore u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.logging u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.metrics_debug_mode u:object_r:setupwizard_prop:s0 exact bool
+setupwizard.theme u:object_r:setupwizard_prop:s0 exact string
+
+db.log.detailed u:object_r:sqlite_log_prop:s0 exact bool
+db.log.slow_query_threshold u:object_r:sqlite_log_prop:s0 exact int
+db.log.slow_query_threshold. u:object_r:sqlite_log_prop:s0 prefix int
+
+# SOC related props
+ro.soc.manufacturer u:object_r:soc_prop:s0 exact string
+ro.soc.model u:object_r:soc_prop:s0 exact string
+
+# set to true when running rollback tests to disable fallback-to-copy when enabling rollbacks
+# to detect failures where hard linking should work otherwise
+persist.rollback.is_test u:object_r:rollback_test_prop:s0 exact bool
+
+# bootanimation properties
+ro.bootanim.quiescent.enabled u:object_r:bootanim_config_prop:s0 exact bool
+ro.product.bootanim.file u:object_r:bootanim_config_prop:s0 exact string
+
+# dck properties
+ro.gms.dck.eligible_wcc u:object_r:dck_prop:s0 exact int
+ro.gms.dck.se_capability u:object_r:dck_prop:s0 exact int
+
+# virtualization service properties
+virtualizationservice.state.last_cid u:object_r:virtualizationservice_prop:s0 exact uint
+
+# composd properties
+composd.vm.art.memory_mib.config u:object_r:composd_vm_art_prop:s0 exact uint
+composd.vm.vendor.memory_mib.config u:object_r:composd_vm_vendor_prop:s0 exact int
+
+# properties for the virtual Face HAL
+persist.vendor.face.virtual.type u:object_r:virtual_face_prop:s0 exact string
+persist.vendor.face.virtual.strength u:object_r:virtual_face_prop:s0 exact string
+persist.vendor.face.virtual.enrollments u:object_r:virtual_face_prop:s0 exact string
+persist.vendor.face.virtual.features u:object_r:virtual_face_prop:s0 exact string
+persist.vendor.face.virtual.lockout_enable u:object_r:virtual_face_prop:s0 exact bool
+persist.vendor.face.virtual.lockout_timed_enable u:object_r:virtual_face_prop:s0 exact bool
+persist.vendor.face.virtual.lockout_timed_threshold u:object_r:virtual_face_prop:s0 exact int
+persist.vendor.face.virtual.lockout_timed_duration u:object_r:virtual_face_prop:s0 exact int
+persist.vendor.face.virtual.lockout_permanent_threshold u:object_r:virtual_face_prop:s0 exact int
+vendor.face.virtual.no_human_face_detected u:object_r:virtual_face_prop:s0 exact bool
+vendor.face.virtual.enrollment_hit u:object_r:virtual_face_prop:s0 exact int
+vendor.face.virtual.next_enrollment u:object_r:virtual_face_prop:s0 exact string
+vendor.face.virtual.authenticator_id u:object_r:virtual_face_prop:s0 exact int
+vendor.face.virtual.challenge u:object_r:virtual_face_prop:s0 exact int
+vendor.face.virtual.lockout u:object_r:virtual_face_prop:s0 exact bool
+vendor.face.virtual.operation_authenticate_fails u:object_r:virtual_face_prop:s0 exact bool
+vendor.face.virtual.operation_detect_interaction_fails u:object_r:virtual_face_prop:s0 exact bool
+vendor.face.virtual.operation_enroll_fails u:object_r:virtual_face_prop:s0 exact bool
+vendor.face.virtual.operation_authenticate_latency u:object_r:virtual_face_prop:s0 exact string
+vendor.face.virtual.operation_detect_interaction_latency u:object_r:virtual_face_prop:s0 exact string
+vendor.face.virtual.operation_enroll_latency u:object_r:virtual_face_prop:s0 exact string
+vendor.face.virtual.operation_authenticate_duration u:object_r:virtual_face_prop:s0 exact int
+
+# properties for the virtual Fingerprint HAL
+persist.vendor.fingerprint.virtual.type u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.enrollments u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.lockout u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.authenticator_id u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.sensor_location u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.sensor_id u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.sensor_strength u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.max_enrollments u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.navigation_gesture u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.detect_interaction u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.udfps.display_touch u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.udfps.control_illumination u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.lockout_enable u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.lockout_timed_threshold u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.lockout_timed_duration u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.lockout_permanent_threshold u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.enrollment_hit u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.next_enrollment u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.challenge u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.operation_authenticate_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_detect_interaction_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_enroll_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_authenticate_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_detect_interaction_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_enroll_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_authenticate_duration u:object_r:virtual_fingerprint_prop:s0 exact int
+
+# properties for tuner
+ro.tuner.lazyhal u:object_r:tuner_config_prop:s0 exact bool
+tuner.server.enable u:object_r:tuner_server_ctl_prop:s0 exact bool
+
+# Adaptive haptics settings property
+vibrator.adaptive_haptics.enabled u:object_r:adaptive_haptics_prop:s0 exact string
+
+# UVC Gadget property
+ro.usb.uvc.enabled u:object_r:usb_uvc_enabled_prop:s0 exact bool
+
+# System UI notification properties
+persist.sysui.notification.ranking_update_ashmem u:object_r:persist_sysui_ranking_update_prop:s0 exact bool
+persist.sysui.notification.builder_extras_override u:object_r:persist_sysui_builder_extras_prop:s0 exact bool
+
+# Properties for Quick Start setup.
+ro.quick_start.oem_id u:object_r:quick_start_prop:s0 exact string
+ro.quick_start.device_id u:object_r:quick_start_prop:s0 exact string
+
+# Properties for sensor service
+sensors.aosp_low_power_sensor_fusion.maximum_rate u:object_r:sensors_config_prop:s0 exact uint
+
+# Whether the device has a high quality barometer as defined on the CDD.
+# Set by OEMs, read for xTS verifier tests
+sensor.barometer.high_quality.implemented u:object_r:high_barometer_quality_prop:s0 exact bool
+
+# Properties for game manager service
+persist.graphics.game_default_frame_rate.enabled u:object_r:game_manager_config_prop:s0 exact bool
+
+# Properties for the HintManagerService
+persist.hms.use_hal_headrooms u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_tid u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_affinity u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_proc_stat_min_millis u:object_r:hint_manager_config_prop:s0 exact int
+persist.hms.cpu_headroom_tid_max_cnt u:object_r:hint_manager_config_prop:s0 exact int
+
+# Properties for ThreadNetworkService
+threadnetwork.country_code u:object_r:threadnetwork_config_prop:s0 exact string
+
+# Properties for crashrecovery
+crashrecovery.attempting_factory_reset u:object_r:crashrecovery_prop:s0 exact bool
+crashrecovery.attempting_reboot u:object_r:crashrecovery_prop:s0 exact bool
+crashrecovery.boot_mitigation_count u:object_r:crashrecovery_prop:s0 exact int
+crashrecovery.boot_mitigation_start u:object_r:crashrecovery_prop:s0 exact int
+crashrecovery.max_rescue_level_attempted u:object_r:crashrecovery_prop:s0 exact int
+crashrecovery.rescue_boot_count u:object_r:crashrecovery_prop:s0 exact int
+crashrecovery.rescue_boot_start u:object_r:crashrecovery_prop:s0 exact int
+persist.crashrecovery.enable_rescue u:object_r:crashrecovery_prop:s0 exact bool
+persist.crashrecovery.last_factory_reset u:object_r:crashrecovery_prop:s0 exact int
+
+# Properties for controlling snapshotctl.
+sys.snapshotctl.map u:object_r:snapshotctl_prop:s0 exact string
+sys.snapshotctl.unmap u:object_r:snapshotctl_prop:s0 exact string
+
+# Properties for enabling/disabling system services
+ro.system_settings.service.odp_enabled u:object_r:system_service_enable_prop:s0 exact bool
+ro.system_settings.service.backgound_install_control_enabled u:object_r:system_service_enable_prop:s0 exact bool
+
+# Properties related to Trusty VMs
+trusty.security_vm.nonsecure_vm_ready u:object_r:trusty_security_vm_sys_prop:s0 exact bool
+trusty.security_vm.vm_cid u:object_r:trusty_security_vm_sys_prop:s0 exact int
+
+# Properties that allows vendors to enable Trusty security VM features
+trusty.security_vm.enabled u:object_r:trusty_security_vm_sys_vendor_prop:s0 exact bool
+trusty.security_vm.keymint.enabled u:object_r:trusty_security_vm_sys_vendor_prop:s0 exact bool
+
+# Properties that allows vendors to enable Trusty widevine VM features
+# Enable Widevine VM
+trusty.widevine_vm.enabled u:object_r:widevine_sys_vendor_prop:s0 exact bool
+# Sets the path used by Widevine HALs to find correct library for the widevine
+# service provider location
+widevine.liboemcrypto.path u:object_r:widevine_sys_vendor_prop:s0 exact string
+
+# Properties for mmd
+mmd. u:object_r:mmd_prop:s0
+mmd.enabled_aconfig u:object_r:mmd_prop:s0 exact bool
diff --git a/prebuilts/api/202504/private/radio.te b/prebuilts/api/202504/private/radio.te
new file mode 100644
index 0000000..ef384ba
--- /dev/null
+++ b/prebuilts/api/202504/private/radio.te
@@ -0,0 +1,74 @@
+typeattribute radio coredomain, mlstrustedsubject;
+
+app_domain(radio)
+
+read_runtime_log_tags(radio)
+
+# Property service
+set_prop(radio, radio_control_prop)
+set_prop(radio, radio_prop)
+set_prop(radio, net_radio_prop)
+set_prop(radio, telephony_status_prop)
+set_prop(radio, radio_cdma_ecm_prop)
+
+# ctl interface
+set_prop(radio, ctl_rildaemon_prop)
+
+# Telephony code contains time / time zone detection logic so it reads the associated properties.
+get_prop(radio, time_prop)
+
+# allow telephony to access platform compat to log permission denials
+allow radio platform_compat_service:service_manager find;
+
+allow radio uce_service:service_manager find;
+
+# Manage /data/misc/emergencynumberdb
+allow radio emergency_data_file:dir r_dir_perms;
+allow radio emergency_data_file:file r_file_perms;
+
+# allow telephony to access related cache properties
+set_prop(radio, binder_cache_telephony_server_prop);
+
+# allow sending pulled atoms to statsd
+binder_call(radio, statsd)
+
+net_domain(radio)
+bluetooth_domain(radio)
+binder_service(radio)
+
+# Talks to hal_telephony_server via the rild socket only for devices without full treble
+not_full_treble(`unix_socket_connect(radio, rild, hal_telephony_server)')
+
+# Data file accesses.
+allow radio radio_data_file:dir create_dir_perms;
+allow radio radio_data_file:notdevfile_class_set create_file_perms;
+allow radio radio_core_data_file:dir r_dir_perms;
+allow radio radio_core_data_file:file r_file_perms;
+
+allow radio net_data_file:dir search;
+allow radio net_data_file:file r_file_perms;
+
+add_service(radio, radio_service)
+allow radio audioserver_service:service_manager find;
+allow radio cameraserver_service:service_manager find;
+allow radio drmserver_service:service_manager find;
+allow radio mediaserver_service:service_manager find;
+allow radio nfc_service:service_manager find;
+allow radio app_api_service:service_manager find;
+allow radio system_api_service:service_manager find;
+allow radio timedetector_service:service_manager find;
+allow radio timezonedetector_service:service_manager find;
+
+# Perform HwBinder IPC.
+hwbinder_use(radio)
+hal_client_domain(radio, hal_telephony)
+
+# Used by TelephonyManager
+allow radio proc_cmdline:file r_file_perms;
+
+###
+### Neverallow rules
+###
+
+neverallow { domain -radio -init }
+ binder_cache_telephony_server_prop:property_service set;
diff --git a/prebuilts/api/202504/private/recovery.te b/prebuilts/api/202504/private/recovery.te
new file mode 100644
index 0000000..24dfd43
--- /dev/null
+++ b/prebuilts/api/202504/private/recovery.te
@@ -0,0 +1,212 @@
+typeattribute recovery coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise recovery is only allowed the domain rules.
+recovery_only(`
+ # Reboot the device
+ set_prop(recovery, powerctl_prop)
+
+ # Read serial number of the device from system properties
+ get_prop(recovery, serialno_prop)
+
+ # Set sys.usb.ffs.ready when starting minadbd for sideload.
+ get_prop(recovery, ffs_config_prop)
+ set_prop(recovery, ffs_control_prop)
+
+ # Set sys.usb.config when switching into fastboot.
+ set_prop(recovery, usb_control_prop)
+ set_prop(recovery, usb_prop)
+
+ # Read ro.boot.bootreason
+ get_prop(recovery, bootloader_boot_reason_prop)
+
+ # Read storage properties (for correctly formatting filesystems)
+ get_prop(recovery, storage_config_prop)
+
+ set_prop(recovery, gsid_prop)
+
+ # These are needed to allow recovery to manage network
+ allow recovery self:netlink_route_socket { create write read nlmsg_readpriv nlmsg_read };
+ allow recovery self:global_capability_class_set net_admin;
+ allow recovery self:tcp_socket { create ioctl };
+ allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+
+ # Start snapuserd for merging VABC updates
+ set_prop(recovery, ctl_snapuserd_prop)
+
+ # Needed to communicate with snapuserd to complete merges.
+ allow recovery snapuserd_socket:sock_file write;
+ allow recovery snapuserd:unix_stream_socket connectto;
+ allow recovery dm_user_device:dir r_dir_perms;
+ get_prop(recovery, snapuserd_prop)
+
+ # Set fastbootd protocol property
+ set_prop(recovery, fastbootd_protocol_prop)
+
+ get_prop(recovery, recovery_config_prop)
+
+ # Needed to read bootconfig parameters through libfs_mgr
+ allow recovery proc_bootconfig:file r_file_perms;
+
+ # Allow recovery to perform an update as update_engine would do.
+ typeattribute recovery update_engine_common;
+ # Recovery can use HIDL HALs in passthrough mode
+ passthrough_hal_client_domain(recovery, hal_bootctl)
+
+ # Recovery can use AIDL HALs in binder mode
+ binder_use(recovery)
+ hal_client_domain(recovery, hal_health)
+
+ allow recovery self:global_capability_class_set {
+ chown
+ dac_override
+ dac_read_search
+ fowner
+ setuid
+ setgid
+ sys_admin
+ sys_tty_config
+ };
+
+ # Run helpers from / or /system without changing domain.
+ r_dir_file(recovery, rootfs)
+ allow recovery rootfs:file execute_no_trans;
+ allow recovery system_file:file execute_no_trans;
+ allow recovery toolbox_exec:file rx_file_perms;
+
+ # Mount filesystems.
+ allow recovery rootfs:dir mounton;
+ allow recovery tmpfs:dir mounton;
+ allow recovery { fs_type enforce_debugfs_restriction(`-debugfs_type') }:filesystem ~relabelto;
+ allow recovery unlabeled:filesystem ~relabelto;
+ allow recovery contextmount_type:filesystem relabelto;
+
+ # We may be asked to set an SELinux label for a type not known to the
+ # currently loaded policy. Allow it.
+ allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
+ allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
+
+ # Get file contexts
+ allow recovery file_contexts_file:file r_file_perms;
+
+ # Write to /proc/sys/vm/drop_caches
+ allow recovery proc_drop_caches:file w_file_perms;
+
+ # Read /proc/swaps
+ allow recovery proc_swaps:file r_file_perms;
+
+ # Read kernel config through libvintf for OTA matching
+ allow recovery config_gz:file { open read getattr };
+
+ # Write to /sys/class/android_usb/android0/enable.
+ r_dir_file(recovery, sysfs_android_usb)
+ allow recovery sysfs_android_usb:file w_file_perms;
+
+ # Write to /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq.
+ allow recovery sysfs_devices_system_cpu:file w_file_perms;
+
+ allow recovery sysfs_batteryinfo:file r_file_perms;
+
+ # Read /sysfs/fs/ext4/features
+ r_dir_file(recovery, sysfs_fs_ext4_features)
+
+ # Read from /sys/class/leds/lcd-backlight/max_brightness and write to /s/c/l/l/brightness to
+ # control backlight brightness.
+ allow recovery sysfs_leds:dir r_dir_perms;
+ allow recovery sysfs_leds:file rw_file_perms;
+ allow recovery sysfs_leds:lnk_file read;
+
+ allow recovery kernel:system syslog_read;
+
+ # Access /dev/usb-ffs/adb/ep0
+ allow recovery functionfs:dir search;
+ allow recovery functionfs:file rw_file_perms;
+ allowxperm recovery functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC;
+
+ # Access to /sys/fs/selinux/policyvers for compatibility check
+ allow recovery selinuxfs:file r_file_perms;
+
+ # Required to e.g. wipe userdata/cache.
+ allow recovery device:dir r_dir_perms;
+ allow recovery block_device:dir r_dir_perms;
+ allow recovery dev_type:blk_file rw_file_perms;
+ allowxperm recovery { userdata_block_device metadata_block_device cache_block_device }:blk_file ioctl BLKPBSZGET;
+
+ # GUI
+ allow recovery graphics_device:chr_file rw_file_perms;
+ allow recovery graphics_device:dir r_dir_perms;
+ allow recovery input_device:dir r_dir_perms;
+ allow recovery input_device:chr_file r_file_perms;
+ allow recovery tty_device:chr_file rw_file_perms;
+
+ # Create /tmp/recovery.log and execute /tmp/update_binary.
+ allow recovery tmpfs:file { create_file_perms x_file_perms };
+ allow recovery tmpfs:dir create_dir_perms;
+
+ # Manage files on /cache and /cache/recovery
+ allow recovery { cache_file cache_recovery_file }:dir create_dir_perms;
+ allow recovery { cache_file cache_recovery_file }:file create_file_perms;
+
+ # Read /sys/class/thermal/*/temp for thermal info.
+ r_dir_file(recovery, sysfs_thermal)
+
+ # Read files on /oem.
+ r_dir_file(recovery, oemfs);
+
+ # Use setfscreatecon() to label files for OTA updates.
+ allow recovery self:process setfscreate;
+
+ # Allow recovery to create a fuse filesystem, and read files from it.
+ allow recovery fuse_device:chr_file rw_file_perms;
+ allow recovery fuse:dir r_dir_perms;
+ allow recovery fuse:file r_file_perms;
+
+ wakelock_use(recovery)
+
+ # This line seems suspect, as it should not really need to
+ # set scheduling parameters for a kernel domain task.
+ allow recovery kernel:process setsched;
+
+ # These are needed to update dynamic partitions in recovery.
+ r_dir_file(recovery, sysfs_dm)
+ allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
+
+ # Allow using libfiemap/gsid directly (no binder in recovery).
+ allow recovery gsi_metadata_file_type:dir search;
+ allow recovery ota_metadata_file:dir rw_dir_perms;
+ allow recovery ota_metadata_file:file create_file_perms;
+
+ # Allow mounting /metadata for writing update states
+ allow recovery metadata_file:dir { getattr mounton };
+
+ # Recovery uses liblogwrap to write fsck logs to kmsg, liblogwrap requires devpts.
+ allow recovery devpts:chr_file rw_file_perms;
+ allow recovery kmsg_device:chr_file { getattr w_file_perms };
+')
+
+###
+### neverallow rules
+###
+
+# Recovery should never touch /data.
+#
+# In particular, if /data is encrypted, it is not accessible
+# to recovery anyway.
+#
+# For now, we only enforce write/execute restrictions, as domain.te
+# contains a number of read-only rules that apply to all
+# domains, including recovery.
+#
+# TODO: tighten this up further.
+neverallow recovery {
+ data_file_type
+ -cache_file
+ -cache_recovery_file
+ with_native_coverage(`-method_trace_data_file')
+}:file { no_w_file_perms no_x_file_perms };
+neverallow recovery {
+ data_file_type
+ -cache_file
+ -cache_recovery_file
+ with_native_coverage(`-method_trace_data_file')
+}:dir no_w_dir_perms;
diff --git a/prebuilts/api/202504/private/recovery_persist.te b/prebuilts/api/202504/private/recovery_persist.te
new file mode 100644
index 0000000..3e3c66c
--- /dev/null
+++ b/prebuilts/api/202504/private/recovery_persist.te
@@ -0,0 +1,39 @@
+typeattribute recovery_persist coredomain;
+
+init_daemon_domain(recovery_persist)
+
+allow recovery_persist pstorefs:dir search;
+allow recovery_persist pstorefs:file r_file_perms;
+
+allow recovery_persist recovery_data_file:file create_file_perms;
+allow recovery_persist recovery_data_file:dir create_dir_perms;
+
+allow recovery_persist cache_file:dir search;
+allow recovery_persist cache_file:lnk_file read;
+allow recovery_persist cache_recovery_file:dir rw_dir_perms;
+allow recovery_persist cache_recovery_file:file { r_file_perms unlink };
+
+###
+### Neverallow rules
+###
+### recovery_persist should NEVER do any of this
+
+# Block device access.
+neverallow recovery_persist dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow recovery_persist domain:process ptrace;
+
+# Write to /system.
+neverallow recovery_persist system_file_type:dir_file_class_set write;
+
+# Write to files in /data/data
+neverallow recovery_persist { app_data_file_type system_data_file }:dir_file_class_set write;
+
+# recovery_persist is not allowed to write anywhere other than recovery_data_file
+neverallow recovery_persist {
+ file_type
+ -recovery_data_file
+ userdebug_or_eng(`-coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file write;
diff --git a/prebuilts/api/202504/private/recovery_refresh.te b/prebuilts/api/202504/private/recovery_refresh.te
new file mode 100644
index 0000000..9dd95e3
--- /dev/null
+++ b/prebuilts/api/202504/private/recovery_refresh.te
@@ -0,0 +1,31 @@
+typeattribute recovery_refresh coredomain;
+
+init_daemon_domain(recovery_refresh)
+
+allow recovery_refresh pstorefs:dir search;
+allow recovery_refresh pstorefs:file r_file_perms;
+# NB: domain inherits write_logd which hands us write to pmsg_device
+
+###
+### Neverallow rules
+###
+### recovery_refresh should NEVER do any of this
+
+# Block device access.
+neverallow recovery_refresh dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow recovery_refresh domain:process ptrace;
+
+# Write to /system.
+neverallow recovery_refresh system_file_type:dir_file_class_set write;
+
+# Write to files in /data/data or system files on /data
+neverallow recovery_refresh { app_data_file_type system_data_file }:dir_file_class_set write;
+
+# recovery_refresh is not allowed to write anywhere
+neverallow recovery_refresh {
+ file_type
+ userdebug_or_eng(`-coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file write;
diff --git a/prebuilts/api/202504/private/remote_provisioning_service_server.te b/prebuilts/api/202504/private/remote_provisioning_service_server.te
new file mode 100644
index 0000000..710b43d
--- /dev/null
+++ b/prebuilts/api/202504/private/remote_provisioning_service_server.te
@@ -0,0 +1,5 @@
+# This service is hosted by system server, and provides a stable aidl
+# front-end for a mainline module that is loaded into system server.
+add_service(remote_provisioning_service_server, remote_provisioning_service)
+
+binder_use(remote_provisioning_service_server)
diff --git a/prebuilts/api/202504/private/remount.te b/prebuilts/api/202504/private/remount.te
new file mode 100644
index 0000000..5ef7fac
--- /dev/null
+++ b/prebuilts/api/202504/private/remount.te
@@ -0,0 +1,25 @@
+type remount, domain, coredomain;
+type remount_exec, system_file_type, exec_type, file_type;
+
+userdebug_or_eng(`
+ # Allow init to run clean_scratch_files and do auto domain transfer.
+ init_daemon_domain(remount)
+
+ # Allow talking to gsid.
+ binder_use(remount)
+ allow remount gsi_service:service_manager find;
+ binder_call(remount, gsid)
+
+ # Allow searching for /metadata/gsi/remount/lp_metadata.
+ allow remount { metadata_file gsi_metadata_file_type }:dir search;
+
+ # Allow remount to flip the overlayfs bit in the super partition.
+ # This requires being able to read fstab, find /dev/block/by-name/super,
+ # and read-write super.
+ r_dir_file(remount, sysfs_dt_firmware_android)
+ allow remount proc_bootconfig:file r_file_perms;
+ allow remount proc_cmdline:file r_file_perms;
+ allow remount block_device:dir r_dir_perms;
+ allow remount super_block_device_type:blk_file rw_file_perms;
+ allowxperm remount super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
+')
diff --git a/prebuilts/api/202504/private/rkp_cert_processor.te b/prebuilts/api/202504/private/rkp_cert_processor.te
new file mode 100644
index 0000000..e5c9d07
--- /dev/null
+++ b/prebuilts/api/202504/private/rkp_cert_processor.te
@@ -0,0 +1,15 @@
+# Cert processor service
+type rkp_cert_processor, domain, coredomain;
+type rkp_cert_processor_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(rkp_cert_processor)
+net_domain(rkp_cert_processor)
+
+binder_use(rkp_cert_processor)
+binder_call(rkp_cert_processor, system_server)
+
+add_service(rkp_cert_processor, rkp_cert_processor_service)
+
+use_bootstrap_libs(rkp_cert_processor)
+
+allow rkp_cert_processor package_native_service:service_manager find;
diff --git a/prebuilts/api/202504/private/rkpd.te b/prebuilts/api/202504/private/rkpd.te
new file mode 100644
index 0000000..45e3e8d
--- /dev/null
+++ b/prebuilts/api/202504/private/rkpd.te
@@ -0,0 +1,15 @@
+# Policies for Remote Key Provisioning Daemon (rkpd)
+type rkpd, domain;
+type rkpd_exec, system_file_type, exec_type, file_type;
+
+typeattribute rkpd coredomain;
+
+binder_use(rkpd)
+binder_service(rkpd)
+
+init_daemon_domain(rkpd)
+
+add_service(rkpd, rkpd_registrar_service)
+add_service(rkpd, rkpd_refresh_service)
+
+get_prop(rkpd, device_config_remote_key_provisioning_native_prop)
diff --git a/prebuilts/api/202504/private/rkpd_app.te b/prebuilts/api/202504/private/rkpd_app.te
new file mode 100644
index 0000000..e7809e9
--- /dev/null
+++ b/prebuilts/api/202504/private/rkpd_app.te
@@ -0,0 +1,27 @@
+###
+### A domain for sandboxing the remote key provisioning daemon
+### app that is shipped via mainline.
+###
+typeattribute rkpdapp coredomain;
+
+app_domain(rkpdapp)
+net_domain(rkpdapp)
+
+# RKPD needs to be able to call the remote provisioning HALs
+hal_client_domain(rkpdapp, hal_keymint)
+hal_client_domain(rkpdapp, hal_remotelyprovisionedcomponent_avf)
+
+# Grant access to certain system properties related to RKP
+get_prop(rkpdapp, device_config_remote_key_provisioning_native_prop)
+set_prop(rkpdapp, remote_prov_prop)
+
+# Grant access to the normal services that are available to all apps
+allow rkpdapp app_api_service:service_manager find;
+
+# Grant access to media.metrics service, needed for widevine. This
+# access is granted to all other apps already (e.g. untrusted_app_all).
+allow rkpdapp mediametrics_service:service_manager find;
+
+# Grant access to statsd
+allow rkpdapp statsmanager_service:service_manager find;
+binder_call(rkpdapp, statsd)
diff --git a/prebuilts/api/202504/private/roles_decl b/prebuilts/api/202504/private/roles_decl
new file mode 100644
index 0000000..c84fcba
--- /dev/null
+++ b/prebuilts/api/202504/private/roles_decl
@@ -0,0 +1 @@
+role r;
diff --git a/prebuilts/api/202504/private/rootdisk_sysdev.te b/prebuilts/api/202504/private/rootdisk_sysdev.te
new file mode 100644
index 0000000..f92fd79
--- /dev/null
+++ b/prebuilts/api/202504/private/rootdisk_sysdev.te
@@ -0,0 +1 @@
+allow rootdisk_sysdev sysfs:filesystem associate;
diff --git a/prebuilts/api/202504/private/rs.te b/prebuilts/api/202504/private/rs.te
new file mode 100644
index 0000000..2674c0e
--- /dev/null
+++ b/prebuilts/api/202504/private/rs.te
@@ -0,0 +1,46 @@
+# Any files which would have been created as app_data_file and
+# privapp_data_file will be created as app_exec_data_file instead.
+allow rs { app_data_file privapp_data_file }:dir ra_dir_perms;
+allow rs app_exec_data_file:file create_file_perms;
+type_transition rs app_data_file:file app_exec_data_file;
+type_transition rs privapp_data_file:file app_exec_data_file;
+
+# Follow /data/user/0 symlink
+allow rs system_data_file:lnk_file read;
+
+# Read files from the app home directory.
+allow rs { app_data_file privapp_data_file }:file r_file_perms;
+allow rs { app_data_file privapp_data_file }:dir r_dir_perms;
+
+# Cleanup app_exec_data_file files in the app home directory.
+allow rs { app_data_file privapp_data_file }:dir remove_name;
+
+# Use vendor resources
+allow rs vendor_file:dir r_dir_perms;
+r_dir_file(rs, vendor_overlay_file)
+r_dir_file(rs, vendor_app_file)
+# Vendor overlay can be found in vendor apex
+allow rs vendor_apex_metadata_file:dir { getattr search };
+
+# Read contents of app apks
+r_dir_file(rs, apk_data_file)
+
+allow rs gpu_device:chr_file rw_file_perms;
+allow rs ion_device:chr_file r_file_perms;
+allow rs same_process_hal_file:file { r_file_perms execute };
+
+# File descriptors passed from app to renderscript
+allow rs { untrusted_app_all ephemeral_app priv_app }:fd use;
+
+# See b/291211299. Since rs is deprecated, this shouldn't be too dangerous, since new
+# renderscript usages shouldn't be popping up.
+dontaudit rs { zygote surfaceflinger hal_graphics_allocator }:fd use;
+
+# rs can access app data, so ensure it can only be entered via an app domain and cannot have
+# CAP_DAC_OVERRIDE.
+neverallow rs rs:capability_class_set *;
+neverallow { domain -appdomain } rs:process { dyntransition transition };
+neverallow rs { domain -crash_dump }:process { dyntransition transition };
+neverallow rs app_data_file_type:file_class_set ~r_file_perms;
+# rs should never use network sockets
+neverallow rs *:network_socket_class_set *;
diff --git a/prebuilts/api/202504/private/rss_hwm_reset.te b/prebuilts/api/202504/private/rss_hwm_reset.te
new file mode 100644
index 0000000..30818c2
--- /dev/null
+++ b/prebuilts/api/202504/private/rss_hwm_reset.te
@@ -0,0 +1,14 @@
+type rss_hwm_reset_exec, system_file_type, exec_type, file_type;
+
+# Start rss_hwm_reset from init.
+init_daemon_domain(rss_hwm_reset)
+
+# Search /proc/pid directories.
+allow rss_hwm_reset domain:dir search;
+
+# Write to /proc/pid/clear_refs of other processes.
+# /proc/pid/clear_refs is S_IWUSER, see: fs/proc/base.c
+allow rss_hwm_reset self:global_capability_class_set { dac_override };
+
+# Write to /prc/pid/clear_refs.
+allow rss_hwm_reset domain:file w_file_perms;
diff --git a/prebuilts/api/202504/private/runas.te b/prebuilts/api/202504/private/runas.te
new file mode 100644
index 0000000..1d9aed0
--- /dev/null
+++ b/prebuilts/api/202504/private/runas.te
@@ -0,0 +1,45 @@
+typeattribute runas coredomain;
+
+# ndk-gdb invokes adb shell run-as.
+domain_auto_trans(shell, runas_exec, runas)
+
+allow runas adbd:fd use;
+allow runas adbd:process sigchld;
+allow runas adbd:unix_stream_socket { read write };
+allow runas shell:fd use;
+allow runas shell:fifo_file { read write };
+allow runas shell:unix_stream_socket { read write };
+allow runas devpts:chr_file { read write ioctl };
+allow runas shell_data_file:file { read write };
+
+# run-as reads package information.
+allow runas system_data_file:file r_file_perms;
+allow runas system_data_file:lnk_file getattr;
+allow runas packages_list_file:file r_file_perms;
+
+# The app's data dir may be accessed through a symlink.
+allow runas system_data_file:lnk_file read;
+
+# run-as checks and changes to the app data dir.
+dontaudit runas self:global_capability_class_set { dac_override dac_read_search };
+allow runas app_data_file:dir { getattr search };
+
+# run-as switches to the app UID/GID.
+allow runas self:global_capability_class_set { setuid setgid };
+
+# run-as switches to the app security context.
+selinux_check_context(runas) # validate context
+allow runas self:process setcurrent;
+allow runas non_system_app_set:process dyntransition; # setcon
+
+# runas/libselinux needs access to seapp_contexts_file to
+# determine which domain to transition to.
+allow runas seapp_contexts_file:file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# run-as cannot have capabilities other than CAP_SETUID and CAP_SETGID
+neverallow runas self:global_capability_class_set ~{ setuid setgid };
+neverallow runas self:global_capability2_class_set *;
diff --git a/prebuilts/api/202504/private/runas_app.te b/prebuilts/api/202504/private/runas_app.te
new file mode 100644
index 0000000..9142a19
--- /dev/null
+++ b/prebuilts/api/202504/private/runas_app.te
@@ -0,0 +1,35 @@
+typeattribute runas_app coredomain;
+
+app_domain(runas_app)
+untrusted_app_domain(runas_app)
+net_domain(runas_app)
+bluetooth_domain(runas_app)
+
+# The ability to call exec() on files in the apps home directories
+# when using run-as on a debuggable app. Used to run lldb/ndk-gdb/simpleperf,
+# which are copied to the apps home directories.
+allow runas_app app_data_file:file execute_no_trans;
+
+# Allow lldb/ndk-gdb/simpleperf to read maps of debuggable app processes.
+r_dir_file(runas_app, untrusted_app_all)
+
+# Allow lldb/ndk-gdb/simpleperf to ptrace attach to debuggable app processes.
+allow runas_app untrusted_app_all:process { ptrace sigkill signal sigstop };
+allow runas_app untrusted_app_all:unix_stream_socket connectto;
+
+# Allow executing system image simpleperf without a domain transition.
+allow runas_app simpleperf_exec:file rx_file_perms;
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective process, most of which this domain is not
+# allowed to see.
+dontaudit runas_app domain:dir search;
+
+# Allow runas_app to call perf_event_open for profiling debuggable app
+# processes, but not the whole system.
+allow runas_app self:perf_event { open read write kernel };
+neverallow runas_app self:perf_event ~{ open read write kernel };
+
+# Suppress bionic loader denial /data/local/tests directories.
+dontaudit runas_app shell_test_data_file:dir search;
diff --git a/prebuilts/api/202504/private/scheduler_service_server.te b/prebuilts/api/202504/private/scheduler_service_server.te
new file mode 100644
index 0000000..b3cede1
--- /dev/null
+++ b/prebuilts/api/202504/private/scheduler_service_server.te
@@ -0,0 +1 @@
+add_hwservice(scheduler_service_server, fwk_scheduler_hwservice)
diff --git a/prebuilts/api/202504/private/sdcardd.te b/prebuilts/api/202504/private/sdcardd.te
new file mode 100644
index 0000000..7cea890
--- /dev/null
+++ b/prebuilts/api/202504/private/sdcardd.te
@@ -0,0 +1,47 @@
+typeattribute sdcardd coredomain;
+
+type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
+
+allow sdcardd cgroup:dir create_dir_perms;
+allow sdcardd cgroup_v2:dir create_dir_perms;
+allow sdcardd fuse_device:chr_file rw_file_perms;
+allow sdcardd rootfs:dir mounton; # TODO: deprecated in M
+allow sdcardd sdcardfs:filesystem remount;
+allow sdcardd tmpfs:dir r_dir_perms;
+allow sdcardd mnt_media_rw_file:dir r_dir_perms;
+allow sdcardd storage_file:dir search;
+allow sdcardd storage_stub_file:dir { search mounton };
+allow sdcardd { sdcard_type fuse }:filesystem { mount unmount };
+allow sdcardd self:global_capability_class_set { setuid setgid dac_override dac_read_search sys_admin sys_resource };
+
+allow sdcardd { sdcard_type fuse }:dir create_dir_perms;
+allow sdcardd { sdcard_type fuse }:file create_file_perms;
+
+allow sdcardd media_rw_data_file:dir create_dir_perms;
+allow sdcardd media_rw_data_file:file create_file_perms;
+
+# Read /data/system/packages.list.
+allow sdcardd system_data_file:file r_file_perms;
+allow sdcardd packages_list_file:file r_file_perms;
+
+# Read /data/misc/installd/layout_version
+allow sdcardd install_data_file:file r_file_perms;
+allow sdcardd install_data_file:dir search;
+
+# Allow stdin/out back to vold
+allow sdcardd vold:fd use;
+allow sdcardd vold:fifo_file { read write getattr };
+
+# Allow running on top of expanded storage
+allow sdcardd mnt_expand_file:dir search;
+
+# access /proc/filesystems
+allow sdcardd proc_filesystems:file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# The sdcard daemon should no longer be started from init
+neverallow init sdcardd_exec:file execute;
+neverallow init sdcardd:process { transition dyntransition };
diff --git a/prebuilts/api/202504/private/sdk_sandbox_34.te b/prebuilts/api/202504/private/sdk_sandbox_34.te
new file mode 100644
index 0000000..bb15057
--- /dev/null
+++ b/prebuilts/api/202504/private/sdk_sandbox_34.te
@@ -0,0 +1,9 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for targetSdkVersion=34.
+type sdk_sandbox_34, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
+
+net_domain(sdk_sandbox_34)
+app_domain(sdk_sandbox_34)
diff --git a/prebuilts/api/202504/private/sdk_sandbox_all.te b/prebuilts/api/202504/private/sdk_sandbox_all.te
new file mode 100644
index 0000000..41b2799
--- /dev/null
+++ b/prebuilts/api/202504/private/sdk_sandbox_all.te
@@ -0,0 +1,148 @@
+###
+### sdk_sandbox_all
+###
+### This file defines the rules shared by all sdk_sandbox_all domains.
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The sdk_sandbox_all_all attribute is assigned to all default
+### seapp_contexts for any app with UID between FIRST_SDK_SANDBOX_UID (20000)
+### and LAST_SDK_SANDBOX_UID (29999) if the app has no specific seinfo
+### value as determined from mac_permissions.xml.
+
+allow sdk_sandbox_all system_linker_exec:file execute_no_trans;
+
+# Required to read CTS tests data from the shell_data_file location.
+allow sdk_sandbox_all shell_data_file:file r_file_perms;
+allow sdk_sandbox_all shell_data_file:dir r_dir_perms;
+
+# allow sdk sandbox to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow sdk_sandbox_all system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow sandbox to search in sdk system server directory
+# additionally, for webview to work, getattr has been permitted
+allow sdk_sandbox_all sdk_sandbox_system_data_file:dir { getattr search };
+# allow sandbox to create files and dirs in sdk data directory
+allow sdk_sandbox_all sdk_sandbox_data_file:dir create_dir_perms;
+allow sdk_sandbox_all sdk_sandbox_data_file:file create_file_perms;
+
+# allow apps to pass open fds to the sdk sandbox
+allow sdk_sandbox_all { app_data_file privapp_data_file }:file { getattr read };
+
+###
+### neverallow rules
+###
+
+neverallow sdk_sandbox_all app_data_file_type:file { execute execute_no_trans };
+
+# Receive or send uevent messages.
+neverallow sdk_sandbox_all domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow sdk_sandbox_all domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow sdk_sandbox_all debugfs_type:file read;
+
+# execute gpu_device
+neverallow sdk_sandbox_all gpu_device:chr_file execute;
+
+# access files in /sys with the default sysfs label
+neverallow sdk_sandbox_all sysfs:file *;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow sdk_sandbox_all proc:file { no_rw_file_perms no_x_file_perms };
+
+# Directly access external storage
+neverallow sdk_sandbox_all { sdcard_type media_rw_data_file }:file {open create};
+neverallow sdk_sandbox_all { sdcard_type media_rw_data_file }:dir search;
+
+# Avoid reads to proc_net, it contains too much device wide information about
+# ongoing connections.
+neverallow sdk_sandbox_all proc_net:file no_rw_file_perms;
+
+# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file
+# TODO(b/280514080): shell_data_file shouldn't be allowed here
+neverallow sdk_sandbox_all { app_data_file_type -sdk_sandbox_data_file -shell_data_file -radio_data_file }:dir no_rw_file_perms;
+neverallow sdk_sandbox_all { app_data_file_type -sdk_sandbox_data_file -shell_data_file -radio_data_file }:file ~{ getattr read };
+
+# SDK sandbox processes don't have any access to external storage
+neverallow sdk_sandbox_all { media_rw_data_file }:dir no_rw_file_perms;
+neverallow sdk_sandbox_all { media_rw_data_file }:file no_rw_file_perms;
+
+neverallow { sdk_sandbox_all } tmpfs:dir no_rw_file_perms;
+
+neverallow sdk_sandbox_all hal_drm_service:service_manager find;
+
+# Only certain system components should have access to sdk_sandbox_system_data_file
+# sdk_sandbox only needs search. Restricted in follow up neverallow rule.
+neverallow {
+ domain
+ -init
+ -installd
+ -system_server
+ -vold_prepare_subdirs
+} sdk_sandbox_system_data_file:dir { relabelfrom };
+
+neverallow {
+ domain
+ -init
+ -installd
+ -sdk_sandbox_all
+ -system_server
+ -vold_prepare_subdirs
+ -zygote
+} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto };
+
+# Only certain system components should have access to sdk_sandbox_all_system_data_file
+# sdk_sandbox_all only needs search. Restricted in follow up neverallow rule.
+neverallow {
+ domain
+ -init
+ -installd
+ -system_server
+ -vold_prepare_subdirs
+} sdk_sandbox_system_data_file:dir { relabelfrom };
+
+neverallow {
+ domain
+ -init
+ -installd
+ -sdk_sandbox_all
+ -system_server
+ -vold_prepare_subdirs
+ -zygote
+} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto };
+
+# sdk_sandbox_all only needs to traverse through the sdk_sandbox_all_system_data_file
+neverallow sdk_sandbox_all sdk_sandbox_system_data_file:dir ~{ getattr search };
+
+# Only dirs should be created at sdk_sandbox_all_system_data_file level
+neverallow { domain -init } sdk_sandbox_system_data_file:file *;
+
+# Restrict unix stream sockets for IPC.
+neverallow sdk_sandbox_all {
+ domain
+ -sdk_sandbox_all
+ -netd
+ -logd
+ -adbd
+ userdebug_or_eng(`-su')
+ # needed for profiling
+ -traced
+ -traced_perf
+ -heapprofd
+ # fallback crash handling for processes that can't exec crash_dump.
+ -tombstoned
+ # needed to connect to PRNG seeder daemon.
+ -prng_seeder
+}:unix_stream_socket connectto;
+neverallow {
+ domain
+ -adbd
+ -sdk_sandbox_all
+} sdk_sandbox_all:unix_stream_socket connectto;
diff --git a/prebuilts/api/202504/private/sdk_sandbox_audit.te b/prebuilts/api/202504/private/sdk_sandbox_audit.te
new file mode 100644
index 0000000..bb531ca
--- /dev/null
+++ b/prebuilts/api/202504/private/sdk_sandbox_audit.te
@@ -0,0 +1,34 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the audit sdk sandbox security policy for
+### the set of restrictions proposed for the next SDK level.
+###
+### The sdk_sandbox_audit domain has the same rules as the
+### sdk_sandbox_current domain and additional auditing rules
+### for the accesses we are considering forbidding in the upcoming
+### sdk_sandbox_next domain.
+type sdk_sandbox_audit, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
+
+net_domain(sdk_sandbox_audit)
+app_domain(sdk_sandbox_audit)
+
+# Auditallow rules for accesses that are currently allowed but we
+# might remove in the future.
+
+auditallow sdk_sandbox_audit {
+ cameraserver_service
+ ephemeral_app_api_service
+ mediadrmserver_service
+ radio_service
+}:service_manager find;
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:file rw_file_perms;
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:dir rw_dir_perms;
diff --git a/prebuilts/api/202504/private/sdk_sandbox_current.te b/prebuilts/api/202504/private/sdk_sandbox_current.te
new file mode 100644
index 0000000..55e5bc1
--- /dev/null
+++ b/prebuilts/api/202504/private/sdk_sandbox_current.te
@@ -0,0 +1,87 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for the current SDK level.
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow sdk_sandbox_current {
+ activity_service
+ activity_task_service
+ appops_service
+ audio_service
+ audioserver_service
+ batteryproperties_service
+ batterystats_service
+ cameraserver_service
+ connectivity_service
+ connmetrics_service
+ deviceidle_service
+ display_service
+ dropbox_service
+ ephemeral_app_api_service
+ font_service
+ game_service
+ gpu_service
+ graphicsstats_service
+ hardware_properties_service
+ hint_service
+ imms_service
+ input_method_service
+ input_service
+ IProxyService_service
+ ipsec_service
+ launcherapps_service
+ legacy_permission_service
+ light_service
+ locale_service
+ media_communication_service
+ mediadrmserver_service
+ mediaextractor_service
+ mediametrics_service
+ media_projection_service
+ media_router_service
+ mediaserver_service
+ media_session_service
+ memtrackproxy_service
+ midi_service
+ netpolicy_service
+ netstats_service
+ network_management_service
+ notification_service
+ package_service
+ permission_checker_service
+ permission_service
+ permissionmgr_service
+ platform_compat_service
+ power_service
+ procstats_service
+ radio_service
+ registry_service
+ restrictions_service
+ rttmanager_service
+ search_service
+ selection_toolbar_service
+ sensor_privacy_service
+ sensorservice_service
+ servicediscovery_service
+ settings_service
+ speech_recognition_service
+ statusbar_service
+ storagestats_service
+ surfaceflinger_service
+ telecom_service
+ tethering_service
+ textclassification_service
+ textservices_service
+ texttospeech_service
+ thermal_service
+ translation_service
+ tv_iapp_service
+ tv_input_service
+ uimode_service
+ vcn_management_service
+ webviewupdate_service
+}:service_manager find;
+
diff --git a/prebuilts/api/202504/private/sdk_sandbox_next.te b/prebuilts/api/202504/private/sdk_sandbox_next.te
new file mode 100644
index 0000000..6fd16ca
--- /dev/null
+++ b/prebuilts/api/202504/private/sdk_sandbox_next.te
@@ -0,0 +1,89 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for a test set of restrictions. These restrictions will be adapted
+### with modifications, into the set of restrictions for the next SDK
+### level.
+type sdk_sandbox_next, domain, coredomain, sdk_sandbox_all;
+
+net_domain(sdk_sandbox_next)
+app_domain(sdk_sandbox_next)
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow sdk_sandbox_next {
+ activity_service
+ activity_task_service
+ appops_service
+ audio_service
+ audioserver_service
+ batteryproperties_service
+ batterystats_service
+ connectivity_service
+ connmetrics_service
+ deviceidle_service
+ display_service
+ dropbox_service
+ font_service
+ game_service
+ gpu_service
+ graphicsstats_service
+ hardware_properties_service
+ hint_service
+ imms_service
+ input_method_service
+ input_service
+ IProxyService_service
+ ipsec_service
+ launcherapps_service
+ legacy_permission_service
+ light_service
+ locale_service
+ media_communication_service
+ mediaextractor_service
+ mediametrics_service
+ media_projection_service
+ media_router_service
+ mediaserver_service
+ media_session_service
+ memtrackproxy_service
+ midi_service
+ netpolicy_service
+ netstats_service
+ network_management_service
+ notification_service
+ package_service
+ permission_checker_service
+ permission_service
+ permissionmgr_service
+ platform_compat_service
+ power_service
+ procstats_service
+ registry_service
+ restrictions_service
+ rttmanager_service
+ search_service
+ selection_toolbar_service
+ sensor_privacy_service
+ sensorservice_service
+ servicediscovery_service
+ settings_service
+ speech_recognition_service
+ statusbar_service
+ storagestats_service
+ surfaceflinger_service
+ telecom_service
+ tethering_service
+ textclassification_service
+ textservices_service
+ texttospeech_service
+ thermal_service
+ translation_service
+ tv_iapp_service
+ tv_input_service
+ uimode_service
+ vcn_management_service
+ webviewupdate_service
+}:service_manager find;
+
diff --git a/prebuilts/api/202504/private/seapp_contexts b/prebuilts/api/202504/private/seapp_contexts
new file mode 100644
index 0000000..25ed1ba
--- /dev/null
+++ b/prebuilts/api/202504/private/seapp_contexts
@@ -0,0 +1,226 @@
+# The entries in this file define how security contexts for apps are determined.
+# Each entry lists input selectors, used to match the app, and outputs which are
+# used to determine the security contexts for matching apps.
+#
+# Input selectors:
+# isSystemServer (boolean)
+# isEphemeralApp (boolean)
+# user (string)
+# seinfo (string)
+# name (string)
+# isPrivApp (boolean)
+# minTargetSdkVersion (unsigned integer)
+# fromRunAs (boolean)
+# isIsolatedComputeApp (boolean)
+# isSdkSandboxNext (boolean)
+# isSdkSandboxAudit (boolean)
+#
+# All specified input selectors in an entry must match (i.e. logical AND).
+# An unspecified string or boolean selector with no default will match any
+# value.
+# A user, or name string selector that ends in * will perform a prefix
+# match.
+# String matching is case-insensitive.
+# See external/selinux/libselinux/src/android/android_platform.c,
+# seapp_context_lookup().
+#
+# isSystemServer=true only matches the system server.
+# An unspecified isSystemServer defaults to false.
+# isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
+# user=_app will match any regular app process.
+# user=_isolated will match any isolated service process.
+# user=_sdksandbox will match sdk sandbox process for an app.
+# Other values of user are matched against the name associated with the process
+# UID.
+# seinfo= matches aginst the seinfo tag for the app, determined from
+# mac_permissions.xml files.
+# The ':' character is reserved and may not be used in seinfo.
+# name= matches against the package name of the app.
+# isPrivApp=true will only match for applications preinstalled in
+# /system/priv-app.
+# minTargetSdkVersion will match applications with a targetSdkVersion
+# greater than or equal to the specified value. If unspecified,
+# it has a default value of 0.
+# fromRunAs=true means the process being labeled is started by run-as. Default
+# is false.
+# isIsolatedComputeApp=true means the process re-uses an isolated Uid but not
+# restricted to run in an isolated_app domain. Processes match this selector will
+# be mapped to isolated_compute_app by default. It is expected to be used together
+# with user=_isolated. This selector should not be used unless it is intended
+# to provide isolated processes with relaxed security restrictions.
+# An unspecified isIsolatedComputeApp defaults to false.
+#
+# The sdk_sandbox_next and sdk_sandbox_audit domains are special domains for the
+# SDK sandbox process. sdk_sandbox_next defines the set of restrictions proposed
+# for the upcoming dessert release. sdk_sandbox_audit uses the same restrictions
+# as the current dessert release, with additional auditing rules for the accesses
+# we are considering forbidding in the upcoming release.
+#
+# The sdk_sandbox_next and sdk_sandbox_audit domains are special domains for the
+# SDK sandbox process. sdk_sandbox_next defines the set of restrictions proposed
+# for the upcoming dessert release. sdk_sandbox_audit uses the same restrictions
+# as the current dessert release, with additional auditing rules for the accesses
+# we are considering forbidding in the upcoming release.
+#
+# isSdkSandboxNext=true means sdk sandbox processes will get
+# sdk_sandbox_next sepolicy applied to them.
+# An unspecified isSdkSandboxNext defaults to false.
+#
+# isSdkSandboxAudit=true means sdk sandbox processes will get
+# sdk_sandbox_audit sepolicy applied to them.
+# An unspecified isSdkSandboxAudit defaults to false.
+#
+# isSdkSandboxAudit=true means sdk sandbox processes will get
+# sdk_sandbox_audit sepolicy applied to them.
+# An unspecified isSdkSandboxAudit defaults to false.
+#
+# Precedence: entries are compared using the following rules, in the order shown
+# (see external/selinux/libselinux/src/android/android_seapp.c,
+# seapp_context_cmp()).
+# (1) isSystemServer=true before isSystemServer=false.
+# (2) Specified isEphemeralApp= before unspecified isEphemeralApp=
+# boolean.
+# (3) Specified user= string before unspecified user= string;
+# more specific user= string before less specific user= string.
+# (4) Specified seinfo= string before unspecified seinfo= string.
+# (5) Specified name= string before unspecified name= string;
+# more specific name= string before less specific name= string.
+# (6) Specified isPrivApp= before unspecified isPrivApp= boolean.
+# (7) Higher value of minTargetSdkVersion= before lower value of
+# minTargetSdkVersion= integer. Note that minTargetSdkVersion=
+# defaults to 0 if unspecified.
+# (8) fromRunAs=true before fromRunAs=false.
+# (9) Platform seapp_contexts files (system, system_ext, product) before
+# vendor seapp_contexts files (vendor, odm).
+# (A fixed selector is more specific than a prefix, i.e. ending in *, and a
+# longer prefix is more specific than a shorter prefix.)
+# Apps are checked against entries in precedence order until the first match,
+# regardless of their order in this file.
+#
+# Duplicate entries, i.e. with identical input selectors, are not allowed.
+#
+# Outputs:
+# domain (string)
+# type (string)
+# levelFrom (string; one of none, all, app, or user)
+# level (string)
+#
+# domain= determines the label to be used for the app process; entries
+# without domain= are ignored for this purpose.
+# type= specifies the label to be used for the app data directory; entries
+# without type= are ignored for this purpose. The label specified must
+# have the app_data_file_type attribute.
+# levelFrom and level are used to determine the level (sensitivity + categories)
+# for MLS/MCS.
+# levelFrom=none omits the level.
+# levelFrom=app determines the level from the process UID.
+# levelFrom=user determines the level from the user ID.
+# levelFrom=all determines the level from both UID and user ID.
+#
+# levelFrom=user is only supported for _app or _isolated UIDs.
+# levelFrom=app or levelFrom=all is only supported for _app UIDs.
+# level may be used to specify a fixed level for any UID.
+#
+#
+# Neverallow Assertions
+# Additional compile time assertion checks for the rules in this file can be
+# added as well. The assertion
+# rules are lines beginning with the keyword neverallow. Full support for PCRE
+# regular expressions exists on all input and output selectors. Neverallow
+# rules are never output to the built seapp_contexts file. Like all keywords,
+# neverallows are case-insensitive. A neverallow is asserted when all key value
+# inputs are matched on a key value rule line.
+#
+
+# only the system server can be assigned the system_server domains
+neverallow isSystemServer=false domain=system_server
+neverallow isSystemServer=false domain=system_server_startup
+neverallow isSystemServer="" domain=system_server
+neverallow isSystemServer="" domain=system_server_startup
+
+# system domains should never be assigned outside of system uid
+neverallow user=((?!system).)* domain=system_app
+neverallow user=((?!system).)* type=system_app_data_file
+
+# any non priv-app with a non-known uid with a specified name should have a specified
+# seinfo
+neverallow user=_app isPrivApp=false name=.* seinfo=""
+neverallow user=_app isPrivApp=false name=.* seinfo=default
+
+# neverallow shared relro to any other domain
+# and neverallow any other uid into shared_relro
+neverallow user=shared_relro domain=((?!shared_relro).)*
+neverallow user=((?!shared_relro).)* domain=shared_relro
+
+# neverallow non-isolated uids into isolated_app domain
+# and vice versa
+neverallow user=_isolated isIsolatedComputeApp=false domain=((?!isolated_app).)*
+neverallow user=((?!_isolated).)* domain=isolated_app
+
+# neverallow isolatedComputeApp into domains other than isolated_compute_app
+neverallow user=_isolated isIsolatedComputeApp=true domain=((?!isolated_compute_app).)*
+
+# uid shell should always be in shell domain, however non-shell
+# uid's can be in shell domain
+neverallow user=shell domain=((?!shell).)*
+
+# only the package named com.android.shell can run in the shell domain
+neverallow domain=shell name=((?!com\.android\.shell).)*
+neverallow user=shell name=((?!com\.android\.shell).)*
+
+# Ephemeral Apps must run in the ephemeral_app domain
+neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*
+
+isSystemServer=true domain=system_server_startup
+
+# sdksandbox must run in an sdksandbox domain
+neverallow user=_sdksandbox domain=((?!sdk_sandbox).)*
+
+user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all
+user=system seinfo=platform domain=system_app type=system_app_data_file
+user=system seinfo=platform isPrivApp=true name=com.android.DeviceAsWebcam domain=device_as_webcam type=system_app_data_file levelFrom=all
+user=bluetooth seinfo=bluetooth domain=bluetooth type=bluetooth_data_file
+user=network_stack seinfo=network_stack domain=network_stack type=radio_data_file
+# NFC stack signed with platform cert needed for maintaining backwards comptibility for -next release config.
+user=nfc seinfo=platform domain=nfc type=nfc_data_file
+user=nfc seinfo=nfc domain=nfc type=nfc_data_file
+user=secure_element seinfo=platform domain=secure_element levelFrom=all
+user=radio seinfo=platform domain=radio type=radio_data_file
+user=shared_relro domain=shared_relro levelFrom=all
+user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
+user=webview_zygote seinfo=webview_zygote domain=webview_zygote
+user=_isolated domain=isolated_app levelFrom=user
+user=_isolated isIsolatedComputeApp=true domain=isolated_compute_app levelFrom=user
+user=_sdksandbox domain=sdk_sandbox_34 type=sdk_sandbox_data_file levelFrom=all
+user=_sdksandbox isSdkSandboxNext=true domain=sdk_sandbox_next type=sdk_sandbox_data_file levelFrom=all
+user=_sdksandbox isSdkSandboxAudit=true domain=sdk_sandbox_audit type=sdk_sandbox_data_file levelFrom=all
+user=_app seinfo=app_zygote domain=app_zygote levelFrom=user
+user=_app seinfo=media domain=mediaprovider type=app_data_file levelFrom=user
+user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
+user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
+user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all
+user=_app seinfo=media isPrivApp=true name=com.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app seinfo=media isPrivApp=true name=com.android.providers.media.module:* domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.providers.media.module:* domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app seinfo=platform isPrivApp=true name=com.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.vzwomatrigger domain=vzwomatrigger_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.rkpdapp domain=rkpdapp type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.rkpdapp domain=rkpdapp type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.gms domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.gms.* domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.gms:* domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.gsf domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app minTargetSdkVersion=34 domain=untrusted_app type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=32 domain=untrusted_app_32 type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=30 domain=untrusted_app_30 type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=29 domain=untrusted_app_29 type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
+user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
+user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
+user=_app fromRunAs=true domain=runas_app levelFrom=user
+user=_app isPrivApp=true name=com.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
diff --git a/prebuilts/api/202504/private/secure_element.te b/prebuilts/api/202504/private/secure_element.te
new file mode 100644
index 0000000..fd3b688
--- /dev/null
+++ b/prebuilts/api/202504/private/secure_element.te
@@ -0,0 +1,16 @@
+# secure element subsystem
+typeattribute secure_element coredomain;
+app_domain(secure_element)
+
+binder_service(secure_element)
+add_service(secure_element, secure_element_service)
+
+allow secure_element app_api_service:service_manager find;
+hal_client_domain(secure_element, hal_secure_element)
+
+# already open bugreport file descriptors may be shared with
+# the secure element process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow secure_element shell_data_file:file read;
+
+allow secure_element vendor_uuid_mapping_config_file:file r_file_perms;
diff --git a/prebuilts/api/202504/private/security_classes b/prebuilts/api/202504/private/security_classes
new file mode 100644
index 0000000..0537214
--- /dev/null
+++ b/prebuilts/api/202504/private/security_classes
@@ -0,0 +1,177 @@
+# FLASK
+
+#
+# Define the security object classes
+#
+
+# Classes marked as userspace are classes
+# for userspace object managers
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class anon_inode
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related classes
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# extended netlink sockets
+class netlink_route_socket
+class netlink_tcpdiag_socket
+class netlink_nflog_socket
+class netlink_xfrm_socket
+class netlink_selinux_socket
+class netlink_audit_socket
+class netlink_dnrt_socket
+
+# IPSec association
+class association
+
+# Updated Netlink class for KOBJECT_UEVENT family.
+class netlink_kobject_uevent_socket
+
+class appletalk_socket
+
+class packet
+
+# Kernel access key retention
+class key
+
+class dccp_socket
+
+class memprotect
+
+# network peer labels
+class peer
+
+# Capabilities >= 32
+class capability2
+
+# kernel services that need to override task security, e.g. cachefiles
+class kernel_service
+
+class tun_socket
+
+class binder
+
+# Updated netlink classes for more recent netlink protocols.
+class netlink_iscsi_socket
+class netlink_fib_lookup_socket
+class netlink_connector_socket
+class netlink_netfilter_socket
+class netlink_generic_socket
+class netlink_scsitransport_socket
+class netlink_rdma_socket
+class netlink_crypto_socket
+
+# Infiniband
+class infiniband_pkey
+class infiniband_endport
+
+# Capability checks when on a non-init user namespace
+class cap_userns
+class cap2_userns
+
+# New socket classes introduced by extended_socket_class policy capability.
+# These two were previously mapped to rawip_socket.
+class sctp_socket
+class icmp_socket
+# These were previously mapped to socket.
+class ax25_socket
+class ipx_socket
+class netrom_socket
+class atmpvc_socket
+class x25_socket
+class rose_socket
+class decnet_socket
+class atmsvc_socket
+class rds_socket
+class irda_socket
+class pppox_socket
+class llc_socket
+class can_socket
+class tipc_socket
+class bluetooth_socket
+class iucv_socket
+class rxrpc_socket
+class isdn_socket
+class phonet_socket
+class ieee802154_socket
+class caif_socket
+class alg_socket
+class nfc_socket
+class vsock_socket
+class kcm_socket
+class qipcrtr_socket
+class smc_socket
+class xdp_socket
+class mctp_socket
+
+class process2
+
+class bpf
+
+class perf_event
+
+class io_uring
+
+# Introduced in https://github.com/torvalds/linux/commit/59438b46471ae6cdfb761afc8c9beaf1e428a331
+class lockdown
+
+class user_namespace
+
+# Property service
+class property_service # userspace
+
+# Service manager
+class service_manager # userspace
+
+# hardware service manager # userspace
+class hwservice_manager
+
+# Legacy Keystore key permissions
+class keystore_key # userspace
+
+# Keystore 2.0 permissions
+class keystore2 # userspace
+
+# Keystore 2.0 key permissions
+class keystore2_key # userspace
+
+# Diced permissions
+class diced # userspace
+
+class drmservice # userspace
+# FLASK
+
+# Permissions for VMs to access SMC services
+class tee_service # userspace
diff --git a/prebuilts/api/202504/private/sensor_service_server.te b/prebuilts/api/202504/private/sensor_service_server.te
new file mode 100644
index 0000000..7c526a5
--- /dev/null
+++ b/prebuilts/api/202504/private/sensor_service_server.te
@@ -0,0 +1 @@
+add_hwservice(sensor_service_server, fwk_sensor_hwservice)
diff --git a/prebuilts/api/202504/private/service.te b/prebuilts/api/202504/private/service.te
new file mode 100644
index 0000000..6912eb9
--- /dev/null
+++ b/prebuilts/api/202504/private/service.te
@@ -0,0 +1,84 @@
+type ambient_context_service, app_api_service, system_server_service, service_manager_type;
+type authentication_policy_service, system_api_service, system_server_service, service_manager_type;
+
+# These types will be public starting at board api 202504
+until_board_api(202504, `
+ type app_function_service, app_api_service, system_server_service, service_manager_type;
+')
+type attention_service, system_server_service, service_manager_type;
+type bg_install_control_service, system_api_service, system_server_service, service_manager_type;
+type compos_service, service_manager_type;
+type communal_service, app_api_service, system_server_service, service_manager_type;
+type dynamic_system_service, system_api_service, system_server_service, service_manager_type;
+type feature_flags_service, app_api_service, system_server_service, service_manager_type;
+type fwk_devicestate_service, system_server_service, service_manager_type;
+type gsi_service, service_manager_type;
+type incidentcompanion_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type logcat_service, system_server_service, service_manager_type;
+type logd_service, service_manager_type;
+type mediatuner_service, app_api_service, service_manager_type;
+type mmd_service, service_manager_type;
+type on_device_intelligence_service, app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type profcollectd_service, service_manager_type;
+type protolog_configuration_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type resolver_service, system_server_service, service_manager_type;
+type rkpd_registrar_service, service_manager_type;
+type rkpd_refresh_service, service_manager_type;
+type rkp_cert_processor_service, service_manager_type;
+type safety_center_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type stats_service, service_manager_type;
+type statsbootstrap_service, system_server_service, service_manager_type;
+type statscompanion_service, system_server_service, service_manager_type;
+type statsmanager_service, system_api_service, system_server_service, service_manager_type;
+until_board_api(202504, `
+ type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
+
+until_board_api(202504, `
+ type hal_mediaquality_service, protected_service, hal_service_type, service_manager_type;
+')
+
+is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
+ type supervision_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
+type tracingproxy_service, system_server_service, service_manager_type;
+type tradeinmode_service, system_server_service, service_manager_type;
+type transparency_service, system_server_service, service_manager_type;
+
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ type vfio_handler_service, service_manager_type;
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+ type virtualization_maintenance_service, service_manager_type;
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ type vm_tethering_service, system_server_service, service_manager_type;
+ type vmnic_service, service_manager_type;
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_MICROFUCHSIA, `
+ type microfuchsia_service, service_manager_type;
+')
+
+type uce_service, service_manager_type;
+type fwk_vold_service, service_manager_type;
+type wearable_sensing_service, app_api_service, system_server_service, service_manager_type;
+type wifi_mainline_supplicant_service, service_manager_type;
+type dynamic_instrumentation_service, app_api_service, system_server_service, service_manager_type;
+type advanced_protection_service, app_api_service, system_server_service, service_manager_type;
+
+is_flag_enabled(RELEASE_RANGING_STACK, `
+ type ranging_service, app_api_service, system_server_service, service_manager_type;
+')
+
+until_board_api(202504, `
+ type hal_vm_capabilities_service, protected_service, hal_service_type, service_manager_type;
+')
+
+###
+### Neverallow rules
+###
+
+# servicemanager handles registering or looking up named services.
+# It does not make sense to register or lookup something which is not a service.
+# Trigger a compile error if this occurs.
+neverallow domain ~{ service_manager_type vndservice_manager_type }:service_manager { add find };
diff --git a/prebuilts/api/202504/private/service_contexts b/prebuilts/api/202504/private/service_contexts
new file mode 100644
index 0000000..c72f9b0
--- /dev/null
+++ b/prebuilts/api/202504/private/service_contexts
@@ -0,0 +1,521 @@
+android.frameworks.cameraservice.service.ICameraService/default u:object_r:fwk_camera_service:s0
+android.frameworks.location.altitude.IAltitudeService/default u:object_r:fwk_altitude_service:s0
+android.frameworks.stats.IStats/default u:object_r:fwk_stats_service:s0
+android.frameworks.sensorservice.ISensorManager/default u:object_r:fwk_sensor_service:s0
+android.frameworks.vibrator.IVibratorControlService/default u:object_r:fwk_vibrator_control_service:s0
+android.frameworks.devicestate.IDeviceStateService/default u:object_r:fwk_devicestate_service:s0
+android.hardware.audio.core.IConfig/default u:object_r:hal_audio_service:s0
+# 'default' IModule is equivalent to 'primary' in HIDL
+android.hardware.audio.core.IModule/default u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/a2dp u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/bluetooth u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/hearing_aid u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/msd u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/r_submix u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/stub u:object_r:hal_audio_service:s0
+android.hardware.audio.core.IModule/usb u:object_r:hal_audio_service:s0
+android.hardware.audio.effect.IFactory/default u:object_r:hal_audio_service:s0
+android.hardware.audio.sounddose.ISoundDoseFactory/default u:object_r:hal_audio_service:s0
+android.hardware.authsecret.IAuthSecret/default u:object_r:hal_authsecret_service:s0
+android.hardware.automotive.evs.IEvsEnumerator/hw/0 u:object_r:hal_evs_service:s0
+android.hardware.boot.IBootControl/default u:object_r:hal_bootctl_service:s0
+android.hardware.automotive.can.ICanController/default u:object_r:hal_can_controller_service:s0
+android.hardware.automotive.evs.IEvsEnumerator/hw/1 u:object_r:hal_evs_service:s0
+android.hardware.automotive.audiocontrol.IAudioControl/default u:object_r:hal_audiocontrol_service:s0
+android.hardware.automotive.ivn.IIvnAndroidDevice/default u:object_r:hal_ivn_service:s0
+android.hardware.automotive.remoteaccess.IRemoteAccess/default u:object_r:hal_remoteaccess_service:s0
+android.hardware.automotive.vehicle.IVehicle/default u:object_r:hal_vehicle_service:s0
+android.hardware.biometrics.face.IFace/default u:object_r:hal_face_service:s0
+android.hardware.biometrics.face.IFace/virtual u:object_r:hal_face_service:s0
+android.hardware.biometrics.face.virtualhal.IVirtualHal/virtual u:object_r:hal_face_service:s0
+android.hardware.biometrics.fingerprint.IFingerprint/default u:object_r:hal_fingerprint_service:s0
+android.hardware.biometrics.fingerprint.IFingerprint/virtual u:object_r:hal_fingerprint_service:s0
+android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual u:object_r:hal_fingerprint_service:s0
+android.hardware.bluetooth.IBluetoothHci/default u:object_r:hal_bluetooth_service:s0
+android.hardware.bluetooth.finder.IBluetoothFinder/default u:object_r:hal_bluetooth_service:s0
+is_flag_enabled(RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE, `
+ android.hardware.bluetooth.ranging.IBluetoothChannelSounding/default u:object_r:hal_bluetooth_service:s0
+')
+android.hardware.bluetooth.lmp_event.IBluetoothLmpEvent/default u:object_r:hal_bluetooth_service:s0
+android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default u:object_r:hal_audio_service:s0
+android.hardware.bluetooth.socket.IBluetoothSocket/default u:object_r:hal_bluetooth_service:s0
+android.hardware.broadcastradio.IBroadcastRadio/amfm u:object_r:hal_broadcastradio_service:s0
+android.hardware.broadcastradio.IBroadcastRadio/dab u:object_r:hal_broadcastradio_service:s0
+# The instance here is internal/0 following naming convention for ICameraProvider.
+# It advertises internal camera devices.
+android.hardware.camera.provider.ICameraProvider/internal/0 u:object_r:hal_camera_service:s0
+android.hardware.camera.provider.ICameraProvider/virtual/0 u:object_r:virtual_camera_service:s0
+android.hardware.cas.IMediaCasService/default u:object_r:hal_cas_service:s0
+android.hardware.confirmationui.IConfirmationUI/default u:object_r:hal_confirmationui_service:s0
+android.hardware.contexthub.IContextHub/default u:object_r:hal_contexthub_service:s0
+android.hardware.drm.IDrmFactory/clearkey u:object_r:hal_drm_service:s0
+android.hardware.drm.ICryptoFactory/clearkey u:object_r:hal_drm_service:s0
+android.hardware.dumpstate.IDumpstateDevice/default u:object_r:hal_dumpstate_service:s0
+android.hardware.fastboot.IFastboot/default u:object_r:hal_fastboot_service:s0
+android.hardware.gnss.IGnss/default u:object_r:hal_gnss_service:s0
+android.hardware.graphics.allocator.IAllocator/default u:object_r:hal_graphics_allocator_service:s0
+android.hardware.graphics.composer3.IComposer/default u:object_r:hal_graphics_composer_service:s0
+android.hardware.health.storage.IStorage/default u:object_r:hal_health_storage_service:s0
+android.hardware.health.IHealth/default u:object_r:hal_health_service:s0
+android.hardware.identity.IIdentityCredentialStore/default u:object_r:hal_identity_service:s0
+android.hardware.input.processor.IInputProcessor/default u:object_r:hal_input_processor_service:s0
+android.hardware.ir.IConsumerIr/default u:object_r:hal_ir_service:s0
+android.hardware.light.ILights/default u:object_r:hal_light_service:s0
+android.hardware.macsec.IMacsecPskPlugin/default u:object_r:hal_macsec_service:s0
+android.hardware.media.c2.IComponentStore/default u:object_r:hal_codec2_service:s0
+android.hardware.media.c2.IComponentStore/default1 u:object_r:hal_codec2_service:s0
+android.hardware.media.c2.IComponentStore/default2 u:object_r:hal_codec2_service:s0
+android.hardware.media.c2.IComponentStore/software u:object_r:hal_codec2_service:s0
+android.hardware.memtrack.IMemtrack/default u:object_r:hal_memtrack_service:s0
+android.hardware.net.nlinterceptor.IInterceptor/default u:object_r:hal_nlinterceptor_service:s0
+android.hardware.nfc.INfc/default u:object_r:hal_nfc_service:s0
+android.hardware.oemlock.IOemLock/default u:object_r:hal_oemlock_service:s0
+android.hardware.power.IPower/default u:object_r:hal_power_service:s0
+android.hardware.power.stats.IPowerStats/default u:object_r:hal_power_stats_service:s0
+android.hardware.radio.config.IRadioConfig/default u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.ims.IRadioIms/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.ims.IRadioIms/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.ims.IRadioIms/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.ims.media.IImsMedia/default u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.satellite.IRadioSatellite/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.satellite.IRadioSatellite/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.satellite.IRadioSatellite/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.sap.ISap/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.sap.ISap/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.sap.ISap/slot3 u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot1 u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot2 u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot3 u:object_r:hal_radio_service:s0
+android.hardware.rebootescrow.IRebootEscrow/default u:object_r:hal_rebootescrow_service:s0
+android.hardware.security.authgraph.IAuthGraphKeyExchange/nonsecure u:object_r:hal_authgraph_service:s0
+android.hardware.security.keymint.IKeyMintDevice/default u:object_r:hal_keymint_service:s0
+android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
+android.hardware.security.keymint.IRemotelyProvisionedComponent/avf u:object_r:hal_remotelyprovisionedcomponent_avf_service:s0
+android.hardware.gatekeeper.IGatekeeper/default u:object_r:hal_gatekeeper_service:s0
+android.hardware.security.secureclock.ISecureClock/default u:object_r:hal_secureclock_service:s0
+android.hardware.security.sharedsecret.ISharedSecret/default u:object_r:hal_sharedsecret_service:s0
+android.hardware.sensors.ISensors/default u:object_r:hal_sensors_service:s0
+android.hardware.soundtrigger3.ISoundTriggerHw/default u:object_r:hal_audio_service:s0
+android.hardware.tetheroffload.IOffload/default u:object_r:hal_tetheroffload_service:s0
+android.hardware.thermal.IThermal/default u:object_r:hal_thermal_service:s0
+android.hardware.threadnetwork.IThreadChip/chip0 u:object_r:hal_threadnetwork_service:s0
+android.hardware.tv.hdmi.cec.IHdmiCec/default u:object_r:hal_tv_hdmi_cec_service:s0
+android.hardware.tv.hdmi.connection.IHdmiConnection/default u:object_r:hal_tv_hdmi_connection_service:s0
+android.hardware.tv.hdmi.earc.IEArc/default u:object_r:hal_tv_hdmi_earc_service:s0
+android.hardware.tv.mediaquality.IMediaQuality/default u:object_r:hal_mediaquality_service:s0
+android.hardware.tv.tuner.ITuner/default u:object_r:hal_tv_tuner_service:s0
+android.hardware.tv.input.ITvInput/default u:object_r:hal_tv_input_service:s0
+android.hardware.usb.IUsb/default u:object_r:hal_usb_service:s0
+android.hardware.usb.gadget.IUsbGadget/default u:object_r:hal_usb_gadget_service:s0
+android.hardware.uwb.IUwb/default u:object_r:hal_uwb_service:s0
+android.hardware.vibrator.IVibrator/default u:object_r:hal_vibrator_service:s0
+android.hardware.vibrator.IVibratorManager/default u:object_r:hal_vibrator_service:s0
+android.hardware.weaver.IWeaver/default u:object_r:hal_weaver_service:s0
+android.hardware.wifi.IWifi/default u:object_r:hal_wifi_service:s0
+android.hardware.wifi.hostapd.IHostapd/default u:object_r:hal_wifi_hostapd_service:s0
+android.hardware.wifi.supplicant.ISupplicant/default u:object_r:hal_wifi_supplicant_service:s0
+android.se.omapi.ISecureElementService/default u:object_r:secure_element_service:s0
+android.hardware.secure_element.ISecureElement/eSE1 u:object_r:hal_secure_element_service:s0
+android.hardware.secure_element.ISecureElement/eSE2 u:object_r:hal_secure_element_service:s0
+android.hardware.secure_element.ISecureElement/eSE3 u:object_r:hal_secure_element_service:s0
+android.hardware.secure_element.ISecureElement/SIM1 u:object_r:hal_secure_element_service:s0
+android.hardware.secure_element.ISecureElement/SIM2 u:object_r:hal_secure_element_service:s0
+android.hardware.secure_element.ISecureElement/SIM3 u:object_r:hal_secure_element_service:s0
+android.hardware.security.secretkeeper.ISecretkeeper/default u:object_r:hal_secretkeeper_service:s0
+android.hardware.security.secretkeeper.ISecretkeeper/nonsecure u:object_r:hal_secretkeeper_service:s0
+android.hardware.virtualization.capabilities.IVmCapabilitiesService/default u:object_r:hal_vm_capabilities_service:s0
+android.hardware.virtualization.capabilities.IVmCapabilitiesService/noop u:object_r:hal_vm_capabilities_service:s0
+android.system.keystore2.IKeystoreService/default u:object_r:keystore_service:s0
+android.system.net.netd.INetd/default u:object_r:system_net_netd_service:s0
+android.system.suspend.ISystemSuspend/default u:object_r:hal_system_suspend_service:s0
+android.system.vold.IVold/default u:object_r:fwk_vold_service:s0
+
+accessibility u:object_r:accessibility_service:s0
+account u:object_r:account_service:s0
+activity u:object_r:activity_service:s0
+activity_task u:object_r:activity_task_service:s0
+adb u:object_r:adb_service:s0
+adservices_manager u:object_r:adservices_manager_service:s0
+advanced_protection u:object_r:advanced_protection_service:s0
+aidl_lazy_test_1 u:object_r:aidl_lazy_test_service:s0
+aidl_lazy_test_2 u:object_r:aidl_lazy_test_service:s0
+aidl_lazy_test_quit u:object_r:aidl_lazy_test_service:s0
+aidl_lazy_cb_test u:object_r:aidl_lazy_test_service:s0
+alarm u:object_r:alarm_service:s0
+android.hardware.automotive.evs.IEvsEnumerator/default u:object_r:evsmanagerd_service:s0
+android.os.UpdateEngineService u:object_r:update_engine_service:s0
+android.os.UpdateEngineStableService u:object_r:update_engine_stable_service:s0
+android.frameworks.automotive.display.ICarDisplayProxy/default u:object_r:fwk_automotive_display_service:s0
+android.security.apc u:object_r:apc_service:s0
+android.security.authorization u:object_r:authorization_service:s0
+android.security.compat u:object_r:keystore_compat_hal_service:s0
+android.security.identity u:object_r:credstore_service:s0
+android.security.keystore u:object_r:keystore_service:s0
+android.security.legacykeystore u:object_r:legacykeystore_service:s0
+android.security.maintenance u:object_r:keystore_maintenance_service:s0
+android.security.metrics u:object_r:keystore_metrics_service:s0
+android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
+android.system.composd u:object_r:compos_service:s0
+android.system.virtualizationservice u:object_r:virtualization_service:s0
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ android.system.virtualizationservice_internal.IVfioHandler u:object_r:vfio_handler_service:s0
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+ android.system.virtualizationmaintenance u:object_r:virtualization_maintenance_service:s0
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ android.system.virtualizationservice_internal.IVmnic u:object_r:vmnic_service:s0
+ android.system.vmtethering.IVmTethering u:object_r:vm_tethering_service:s0
+')
+is_flag_enabled(RELEASE_AVF_ENABLE_MICROFUCHSIA, `
+ android.system.microfuchsiad u:object_r:microfuchsia_service:s0
+')
+ambient_context u:object_r:ambient_context_service:s0
+app_binding u:object_r:app_binding_service:s0
+app_function u:object_r:app_function_service:s0
+app_hibernation u:object_r:app_hibernation_service:s0
+dynamic_instrumentation u:object_r:dynamic_instrumentation_service:s0
+app_integrity u:object_r:app_integrity_service:s0
+app_prediction u:object_r:app_prediction_service:s0
+app_search u:object_r:app_search_service:s0
+apexservice u:object_r:apex_service:s0
+archive u:object_r:archive_service:s0
+attestation_verification u:object_r:attestation_verification_service:s0
+blob_store u:object_r:blob_store_service:s0
+gsiservice u:object_r:gsi_service:s0
+appops u:object_r:appops_service:s0
+appwidget u:object_r:appwidget_service:s0
+artd u:object_r:artd_service:s0
+artd_pre_reboot u:object_r:artd_pre_reboot_service:s0
+assetatlas u:object_r:assetatlas_service:s0
+attention u:object_r:attention_service:s0
+audio u:object_r:audio_service:s0
+auth u:object_r:auth_service:s0
+authentication_policy u:object_r:authentication_policy_service:s0
+autofill u:object_r:autofill_service:s0
+background_install_control u:object_r:bg_install_control_service:s0
+backup u:object_r:backup_service:s0
+batteryproperties u:object_r:batteryproperties_service:s0
+batterystats u:object_r:batterystats_service:s0
+battery u:object_r:battery_service:s0
+binder_calls_stats u:object_r:binder_calls_stats_service:s0
+biometric u:object_r:biometric_service:s0
+bluetooth_manager u:object_r:bluetooth_manager_service:s0
+bluetooth u:object_r:bluetooth_service:s0
+broadcastradio u:object_r:broadcastradio_service:s0
+bugreport u:object_r:bugreport_service:s0
+cacheinfo u:object_r:cacheinfo_service:s0
+carrier_config u:object_r:radio_service:s0
+clipboard u:object_r:clipboard_service:s0
+cloudsearch u:object_r:cloudsearch_service:s0
+cloudsearch_service u:object_r:cloudsearch_service:s0
+com.android.net.IProxyService u:object_r:IProxyService_service:s0
+companiondevice u:object_r:companion_device_service:s0
+communal u:object_r:communal_service:s0
+credential u:object_r:credential_service:s0
+platform_compat u:object_r:platform_compat_service:s0
+platform_compat_native u:object_r:platform_compat_service:s0
+connectivity u:object_r:connectivity_service:s0
+connectivity_native u:object_r:connectivity_native_service:s0
+connmetrics u:object_r:connmetrics_service:s0
+consumer_ir u:object_r:consumer_ir_service:s0
+content u:object_r:content_service:s0
+content_capture u:object_r:content_capture_service:s0
+content_suggestions u:object_r:content_suggestions_service:s0
+contexthub u:object_r:contexthub_service:s0
+contextual_search u:object_r:contextual_search_service:s0
+country_detector u:object_r:country_detector_service:s0
+coverage u:object_r:coverage_service:s0
+cpuinfo u:object_r:cpuinfo_service:s0
+cpu_monitor u:object_r:cpu_monitor_service:s0
+crossprofileapps u:object_r:crossprofileapps_service:s0
+dataloader_manager u:object_r:dataloader_manager_service:s0
+dbinfo u:object_r:dbinfo_service:s0
+device_config u:object_r:device_config_service:s0
+device_config_updatable u:object_r:device_config_updatable_service:s0
+device_policy u:object_r:device_policy_service:s0
+device_identifiers u:object_r:device_identifiers_service:s0
+deviceidle u:object_r:deviceidle_service:s0
+device_lock u:object_r:devicelock_service:s0
+device_state u:object_r:device_state_service:s0
+devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
+dexopt_chroot_setup u:object_r:dexopt_chroot_setup_service:s0
+diskstats u:object_r:diskstats_service:s0
+display u:object_r:display_service:s0
+dnsresolver u:object_r:dnsresolver_service:s0
+domain_verification u:object_r:domain_verification_service:s0
+color_display u:object_r:color_display_service:s0
+netd_listener u:object_r:netd_listener_service:s0
+network_watchlist u:object_r:network_watchlist_service:s0
+DockObserver u:object_r:DockObserver_service:s0
+dreams u:object_r:dreams_service:s0
+drm.drmManager u:object_r:drmserver_service:s0
+dropbox u:object_r:dropbox_service:s0
+dumpstate u:object_r:dumpstate_service:s0
+dynamic_system u:object_r:dynamic_system_service:s0
+econtroller u:object_r:radio_service:s0
+ecm_enhanced_confirmation u:object_r:ecm_enhanced_confirmation_service:s0
+emergency_affordance u:object_r:emergency_affordance_service:s0
+euicc_card_controller u:object_r:radio_service:s0
+external_vibrator_service u:object_r:external_vibrator_service:s0
+ethernet u:object_r:ethernet_service:s0
+face u:object_r:face_service:s0
+feature_flags u:object_r:feature_flags_service:s0
+file_integrity u:object_r:file_integrity_service:s0
+fingerprint u:object_r:fingerprint_service:s0
+font u:object_r:font_service:s0
+android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
+game u:object_r:game_service:s0
+gfxinfo u:object_r:gfxinfo_service:s0
+gnss_time_update_service u:object_r:gnss_time_update_service:s0
+grammatical_inflection u:object_r:grammatical_inflection_service:s0
+graphicsstats u:object_r:graphicsstats_service:s0
+gpu u:object_r:gpu_service:s0
+hardware u:object_r:hardware_service:s0
+hardware_properties u:object_r:hardware_properties_service:s0
+hdmi_control u:object_r:hdmi_control_service:s0
+healthconnect u:object_r:healthconnect_service:s0
+ions u:object_r:radio_service:s0
+idmap u:object_r:idmap_service:s0
+incident u:object_r:incident_service:s0
+incidentcompanion u:object_r:incidentcompanion_service:s0
+inputflinger u:object_r:inputflinger_service:s0
+input_method u:object_r:input_method_service:s0
+input u:object_r:input_service:s0
+installd u:object_r:installd_service:s0
+starting_at_board_api(202504, `
+ intrusion_detection u:object_r:intrusion_detection_service:s0
+')
+iphonesubinfo_msim u:object_r:radio_service:s0
+iphonesubinfo2 u:object_r:radio_service:s0
+iphonesubinfo u:object_r:radio_service:s0
+ims u:object_r:radio_service:s0
+imms u:object_r:imms_service:s0
+incremental u:object_r:incremental_service:s0
+ipsec u:object_r:ipsec_service:s0
+ircsmessage u:object_r:radio_service:s0
+iris u:object_r:iris_service:s0
+isms_msim u:object_r:radio_service:s0
+isms2 u:object_r:radio_service:s0
+isms u:object_r:radio_service:s0
+isub u:object_r:radio_service:s0
+jobscheduler u:object_r:jobscheduler_service:s0
+launcherapps u:object_r:launcherapps_service:s0
+legacy_permission u:object_r:legacy_permission_service:s0
+lights u:object_r:light_service:s0
+locale u:object_r:locale_service:s0
+location u:object_r:location_service:s0
+location_time_zone_manager u:object_r:location_time_zone_manager_service:s0
+lock_settings u:object_r:lock_settings_service:s0
+logcat u:object_r:logcat_service:s0
+logd u:object_r:logd_service:s0
+looper_stats u:object_r:looper_stats_service:s0
+lpdump_service u:object_r:lpdump_service:s0
+mdns u:object_r:mdns_service:s0
+media.aaudio u:object_r:audioserver_service:s0
+media.audio_flinger u:object_r:audioserver_service:s0
+media.audio_policy u:object_r:audioserver_service:s0
+media.camera u:object_r:cameraserver_service:s0
+media.camera.proxy u:object_r:cameraproxy_service:s0
+media.log u:object_r:audioserver_service:s0
+media.player u:object_r:mediaserver_service:s0
+media.metrics u:object_r:mediametrics_service:s0
+media.extractor u:object_r:mediaextractor_service:s0
+media.transcoding u:object_r:mediatranscoding_service:s0
+media.resource_manager u:object_r:mediaserver_service:s0
+media.resource_observer u:object_r:mediaserver_service:s0
+media.sound_trigger_hw u:object_r:audioserver_service:s0
+media.drm u:object_r:mediadrmserver_service:s0
+media.tuner u:object_r:mediatuner_service:s0
+media_communication u:object_r:media_communication_service:s0
+media_metrics u:object_r:media_metrics_service:s0
+media_projection u:object_r:media_projection_service:s0
+media_quality u:object_r:media_quality_service:s0
+media_resource_monitor u:object_r:media_session_service:s0
+media_router u:object_r:media_router_service:s0
+media_session u:object_r:media_session_service:s0
+meminfo u:object_r:meminfo_service:s0
+memtrack.proxy u:object_r:memtrackproxy_service:s0
+midi u:object_r:midi_service:s0
+mmd u:object_r:mmd_service:s0
+mount u:object_r:mount_service:s0
+music_recognition u:object_r:music_recognition_service:s0
+nearby u:object_r:nearby_service:s0
+netd u:object_r:netd_service:s0
+netpolicy u:object_r:netpolicy_service:s0
+netstats u:object_r:netstats_service:s0
+network_stack u:object_r:network_stack_service:s0
+network_management u:object_r:network_management_service:s0
+network_score u:object_r:network_score_service:s0
+network_time_update_service u:object_r:network_time_update_service:s0
+nfc u:object_r:nfc_service:s0
+notification u:object_r:notification_service:s0
+oem_lock u:object_r:oem_lock_service:s0
+ondevicepersonalization_system_service u:object_r:ondevicepersonalization_system_service:s0
+on_device_intelligence u:object_r:on_device_intelligence_service:s0
+otadexopt u:object_r:otadexopt_service:s0
+ot_daemon u:object_r:ot_daemon_service:s0
+overlay u:object_r:overlay_service:s0
+pac_proxy u:object_r:pac_proxy_service:s0
+package u:object_r:package_service:s0
+package_native u:object_r:package_native_service:s0
+people u:object_r:people_service:s0
+performance_hint u:object_r:hint_service:s0
+permission u:object_r:permission_service:s0
+permissionmgr u:object_r:permissionmgr_service:s0
+permission_checker u:object_r:permission_checker_service:s0
+persistent_data_block u:object_r:persistent_data_block_service:s0
+phone_msim u:object_r:radio_service:s0
+phone1 u:object_r:radio_service:s0
+phone2 u:object_r:radio_service:s0
+phone u:object_r:radio_service:s0
+pinner u:object_r:pinner_service:s0
+powerstats u:object_r:powerstats_service:s0
+power u:object_r:power_service:s0
+profiling_service u:object_r:profiling_service:s0
+protolog_configuration u:object_r:protolog_configuration_service:s0
+print u:object_r:print_service:s0
+processinfo u:object_r:processinfo_service:s0
+procstats u:object_r:procstats_service:s0
+profcollectd u:object_r:profcollectd_service:s0
+radio.phonesubinfo u:object_r:radio_service:s0
+radio.phone u:object_r:radio_service:s0
+radio.sms u:object_r:radio_service:s0
+is_flag_enabled(RELEASE_RANGING_STACK, `
+ ranging u:object_r:ranging_service:s0
+')
+rcs u:object_r:radio_service:s0
+reboot_readiness u:object_r:reboot_readiness_service:s0
+recovery u:object_r:recovery_service:s0
+remote_auth u:object_r:remote_auth_service:s0
+remote_provisioning u:object_r:remote_provisioning_service:s0
+resolver u:object_r:resolver_service:s0
+resources u:object_r:resources_manager_service:s0
+restrictions u:object_r:restrictions_service:s0
+rkpd.registrar u:object_r:rkpd_registrar_service:s0
+rkpd.refresh u:object_r:rkpd_refresh_service:s0
+rkp_cert_processor.service u:object_r:rkp_cert_processor_service:s0
+role u:object_r:role_service:s0
+rollback u:object_r:rollback_service:s0
+rttmanager u:object_r:rttmanager_service:s0
+runtime u:object_r:runtime_service:s0
+safety_center u:object_r:safety_center_service:s0
+samplingprofiler u:object_r:samplingprofiler_service:s0
+scheduling_policy u:object_r:scheduling_policy_service:s0
+search u:object_r:search_service:s0
+search_ui u:object_r:search_ui_service:s0
+secure_element u:object_r:secure_element_service:s0
+sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
+security_state u:object_r:security_state_service:s0
+selection_toolbar u:object_r:selection_toolbar_service:s0
+sensitive_content_protection_service u:object_r:sensitive_content_protection_service:s0
+sensorservice u:object_r:sensorservice_service:s0
+sensor_privacy u:object_r:sensor_privacy_service:s0
+serial u:object_r:serial_service:s0
+servicediscovery u:object_r:servicediscovery_service:s0
+manager u:object_r:service_manager_service:s0
+settings u:object_r:settings_service:s0
+shortcut u:object_r:shortcut_service:s0
+simphonebook_msim u:object_r:radio_service:s0
+simphonebook2 u:object_r:radio_service:s0
+simphonebook u:object_r:radio_service:s0
+sip u:object_r:radio_service:s0
+slice u:object_r:slice_service:s0
+smartspace u:object_r:smartspace_service:s0
+speech_recognition u:object_r:speech_recognition_service:s0
+stats u:object_r:stats_service:s0
+statsbootstrap u:object_r:statsbootstrap_service:s0
+statscompanion u:object_r:statscompanion_service:s0
+statsmanager u:object_r:statsmanager_service:s0
+soundtrigger u:object_r:voiceinteraction_service:s0
+soundtrigger_middleware u:object_r:soundtrigger_middleware_service:s0
+statusbar u:object_r:statusbar_service:s0
+storaged u:object_r:storaged_service:s0
+storaged_pri u:object_r:storaged_service:s0
+storagestats u:object_r:storagestats_service:s0
+# sdk_sandbox here refers to the service name, not the domain name.
+sdk_sandbox u:object_r:sdk_sandbox_service:s0
+
+is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
+ supervision u:object_r:supervision_service:s0
+')
+SurfaceFlinger u:object_r:surfaceflinger_service:s0
+SurfaceFlingerAIDL u:object_r:surfaceflinger_service:s0
+suspend_control u:object_r:system_suspend_control_service:s0
+suspend_control_internal u:object_r:system_suspend_control_internal_service:s0
+system_config u:object_r:system_config_service:s0
+system_server_dumper u:object_r:system_server_dumper_service:s0
+system_update u:object_r:system_update_service:s0
+tare u:object_r:tare_service:s0
+task u:object_r:task_service:s0
+telecom u:object_r:telecom_service:s0
+telephony.registry u:object_r:registry_service:s0
+telephony_ims u:object_r:radio_service:s0
+testharness u:object_r:testharness_service:s0
+tethering u:object_r:tethering_service:s0
+textclassification u:object_r:textclassification_service:s0
+textservices u:object_r:textservices_service:s0
+texttospeech u:object_r:texttospeech_service:s0
+time_detector u:object_r:timedetector_service:s0
+time_zone_detector u:object_r:timezonedetector_service:s0
+thermalservice u:object_r:thermal_service:s0
+thread_network u:object_r:threadnetwork_service:s0
+tracing.proxy u:object_r:tracingproxy_service:s0
+tradeinmode u:object_r:tradeinmode_service:s0
+translation u:object_r:translation_service:s0
+transparency u:object_r:transparency_service:s0
+trust u:object_r:trust_service:s0
+tv_ad u:object_r:tv_ad_service:s0
+tv_interactive_app u:object_r:tv_iapp_service:s0
+tv_input u:object_r:tv_input_service:s0
+tv_tuner_resource_mgr u:object_r:tv_tuner_resource_mgr_service:s0
+uce u:object_r:uce_service:s0
+uimode u:object_r:uimode_service:s0
+updatelock u:object_r:updatelock_service:s0
+uri_grants u:object_r:uri_grants_service:s0
+usagestats u:object_r:usagestats_service:s0
+usb u:object_r:usb_service:s0
+user u:object_r:user_service:s0
+uwb u:object_r:uwb_service:s0
+vcn_management u:object_r:vcn_management_service:s0
+vibrator u:object_r:vibrator_service:s0
+vibrator_manager u:object_r:vibrator_manager_service:s0
+virtual_camera u:object_r:virtual_camera_service:s0
+virtualdevice u:object_r:virtual_device_service:s0
+virtualdevice_native u:object_r:virtual_device_native_service:s0
+virtual_touchpad u:object_r:virtual_touchpad_service:s0
+voiceinteraction u:object_r:voiceinteraction_service:s0
+vold u:object_r:vold_service:s0
+vpn_management u:object_r:vpn_management_service:s0
+vrmanager u:object_r:vr_manager_service:s0
+wallpaper u:object_r:wallpaper_service:s0
+wallpaper_effects_generation u:object_r:wallpaper_effects_generation_service:s0
+wearable_sensing u:object_r:wearable_sensing_service:s0
+webviewupdate u:object_r:webviewupdate_service:s0
+wifip2p u:object_r:wifip2p_service:s0
+wifiscanner u:object_r:wifiscanner_service:s0
+wifi u:object_r:wifi_service:s0
+wifinl80211 u:object_r:wifinl80211_service:s0
+wifiaware u:object_r:wifiaware_service:s0
+wifirtt u:object_r:rttmanager_service:s0
+starting_at_board_api(202504, `
+ wifi_usd u:object_r:wifi_usd_service:s0
+')
+wifi_mainline_supplicant u:object_r:wifi_mainline_supplicant_service:s0
+window u:object_r:window_service:s0
+* u:object_r:default_android_service:s0
diff --git a/prebuilts/api/202504/private/servicemanager.te b/prebuilts/api/202504/private/servicemanager.te
new file mode 100644
index 0000000..6764b45
--- /dev/null
+++ b/prebuilts/api/202504/private/servicemanager.te
@@ -0,0 +1,52 @@
+typeattribute servicemanager coredomain;
+
+init_daemon_domain(servicemanager)
+
+read_runtime_log_tags(servicemanager)
+
+set_prop(servicemanager, ctl_interface_start_prop)
+set_prop(servicemanager, servicemanager_prop)
+
+# servicemanager is using bootstrap bionic
+use_bootstrap_libs(servicemanager)
+
+# servicemanager is using apex_info via libvintf
+use_apex_info(servicemanager)
+
+# Note that we do not use the binder_* macros here.
+# servicemanager is unique in that it only provides
+# name service (aka context manager) for Binder.
+# As such, it only ever receives and transfers other references
+# created by other domains. It never passes its own references
+# or initiates a Binder IPC.
+allow servicemanager self:binder set_context_mgr;
+allow servicemanager {
+ domain
+ -init
+ -vendor_init
+ -hwservicemanager
+ -vndservicemanager
+}:binder transfer;
+
+allow servicemanager service_contexts_file:file r_file_perms;
+
+allow servicemanager vendor_service_contexts_file:file r_file_perms;
+
+# nonplat_service_contexts only accessible on non full-treble devices
+not_full_treble(`allow servicemanager vendor_service_contexts_file:file r_file_perms;')
+
+add_service(servicemanager, service_manager_service)
+allow servicemanager dumpstate:fd use;
+allow servicemanager dumpstate:fifo_file write;
+
+# Check SELinux permissions.
+selinux_check_access(servicemanager)
+
+allow servicemanager kmsg_device:chr_file rw_file_perms;
+
+perfetto_producer(servicemanager)
+
+recovery_only(`
+ # Read VINTF files.
+ r_dir_file(servicemanager, rootfs)
+')
diff --git a/prebuilts/api/202504/private/sgdisk.te b/prebuilts/api/202504/private/sgdisk.te
new file mode 100644
index 0000000..42b8c6b
--- /dev/null
+++ b/prebuilts/api/202504/private/sgdisk.te
@@ -0,0 +1,38 @@
+typeattribute sgdisk coredomain;
+
+# Allowed to read/write low-level partition tables
+allow sgdisk block_device:dir search;
+allow sgdisk vold_device:blk_file rw_file_perms;
+# HDIO_GETGEO needed to get the number of disk heads
+# on vold_device. How quaint.
+allowxperm sgdisk vold_device:blk_file ioctl { HDIO_GETGEO };
+# sgdisk also uses BLKGETSIZE and BLKGETSIZE64. BLKGETSIZE64
+# is granted to all block device users in domain.te, so
+# no need to mention it here. sgdisk should not be
+# using the BLKGETSIZE ioctl as it is useless for devices over
+# 2T in size, but we allow it for now and hope that sgdisk
+# will fix their bug.
+allowxperm sgdisk vold_device:blk_file ioctl { BLKGETSIZE };
+# Force a re-read of the partition table.
+allowxperm sgdisk vold_device:blk_file ioctl { BLKRRPART };
+# Allow reading of the physical block size.
+allowxperm sgdisk vold_device:blk_file ioctl { BLKPBSZGET };
+
+# Inherit and use pty created by android_fork_execvp()
+allow sgdisk devpts:chr_file { read write ioctl getattr };
+
+# Allow stdin/out back to vold
+allow sgdisk vold:fd use;
+allow sgdisk vold:fifo_file { read write getattr };
+
+# Used to probe kernel to reload partition tables
+allow sgdisk self:global_capability_class_set sys_admin;
+
+###
+### Neverallow rules
+###
+
+# Only allow entry from vold
+neverallow { domain -vold } sgdisk:process transition;
+neverallow * sgdisk:process dyntransition;
+neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
diff --git a/prebuilts/api/202504/private/shared_relro.te b/prebuilts/api/202504/private/shared_relro.te
new file mode 100644
index 0000000..31fdb8c
--- /dev/null
+++ b/prebuilts/api/202504/private/shared_relro.te
@@ -0,0 +1,15 @@
+typeattribute shared_relro coredomain;
+
+# The shared relro process is a Java program forked from the zygote, so it
+# inherits from app to get basic permissions it needs to run.
+app_domain(shared_relro)
+
+allow shared_relro shared_relro_file:dir rw_dir_perms;
+allow shared_relro shared_relro_file:file create_file_perms;
+
+allow shared_relro activity_service:service_manager find;
+allow shared_relro webviewupdate_service:service_manager find;
+allow shared_relro package_service:service_manager find;
+
+# StrictMode may attempt to find this service, failure is harmless.
+dontaudit shared_relro network_management_service:service_manager find;
diff --git a/prebuilts/api/202504/private/shell.te b/prebuilts/api/202504/private/shell.te
new file mode 100644
index 0000000..2033f7e
--- /dev/null
+++ b/prebuilts/api/202504/private/shell.te
@@ -0,0 +1,549 @@
+typeattribute shell coredomain, mlstrustedsubject;
+
+# allow shell input injection
+allow shell uhid_device:chr_file rw_file_perms;
+
+# systrace support - allow atrace to run
+allow shell debugfs_tracing_debug:dir r_dir_perms;
+allow shell debugfs_tracing:dir r_dir_perms;
+allow shell debugfs_tracing:file rw_file_perms;
+allow shell debugfs_trace_marker:file getattr;
+allow shell atrace_exec:file rx_file_perms;
+
+userdebug_or_eng(`
+ allow shell debugfs_tracing_debug:file rw_file_perms;
+')
+
+# read config.gz for CTS purposes
+allow shell config_gz:file r_file_perms;
+
+# allow reading tombstones. users can already use bugreports to get those.
+allow shell tombstone_data_file:dir r_dir_perms;
+allow shell tombstone_data_file:file r_file_perms;
+
+# Run app_process.
+# XXX Transition into its own domain?
+app_domain(shell)
+
+# allow shell to call dumpsys storaged
+binder_call(shell, storaged)
+
+# Perform SELinux access checks, needed for CTS
+selinux_check_access(shell)
+selinux_check_context(shell)
+
+# Control Perfetto traced and obtain traces from it.
+# Needed for Studio and debugging.
+unix_socket_connect(shell, traced_consumer, traced)
+
+# Allow shell binaries to write trace data to Perfetto. Used for testing and
+# cmdline utils.
+perfetto_producer(shell)
+
+domain_auto_trans(shell, vendor_shell_exec, vendor_shell)
+
+# Allow shell to execute tradeinmode for testing.
+domain_auto_trans(shell, tradeinmode_exec, tradeinmode)
+
+# Allow shell binaries to exec the perfetto cmdline util and have that
+# transition into its own domain, so that it behaves consistently to
+# when exec()-d by statsd.
+domain_auto_trans(shell, perfetto_exec, perfetto)
+# Allow to send SIGINT to perfetto when daemonized.
+allow shell perfetto:process signal;
+
+# Allow shell to run adb shell cmd stats commands. Needed for CTS.
+binder_call(shell, statsd);
+
+# Allow shell to read and unlink traces stored in /data/misc/a11ytraces.
+userdebug_or_eng(`
+ allow shell accessibility_trace_data_file:dir rw_dir_perms;
+ allow shell accessibility_trace_data_file:file { r_file_perms unlink };
+')
+
+# Allow shell to read and unlink traces stored in /data/misc/perfetto-traces.
+allow shell perfetto_traces_data_file:dir rw_dir_perms;
+allow shell perfetto_traces_data_file:file { r_file_perms unlink };
+# ... and /data/misc/perfetto-traces/bugreport/ .
+allow shell perfetto_traces_bugreport_data_file:dir rw_dir_perms;
+allow shell perfetto_traces_bugreport_data_file:file { r_file_perms unlink };
+
+# Allow shell to create/remove configs stored in /data/misc/perfetto-configs.
+allow shell perfetto_configs_data_file:dir rw_dir_perms;
+allow shell perfetto_configs_data_file:file create_file_perms;
+
+# Allow shell to run adb shell cmd gpu commands.
+binder_call(shell, gpuservice);
+
+# Allow shell to use atrace HAL
+hal_client_domain(shell, hal_atrace)
+
+# For hostside tests such as CTS listening ports test.
+allow shell proc_net_tcp_udp:file r_file_perms;
+
+# The dl.exec_linker* tests need to execute /system/bin/linker
+# b/124789393
+allow shell system_linker_exec:file rx_file_perms;
+
+# Renderscript host side tests depend on being able to execute
+# /system/bin/bcc (b/126388046)
+allow shell rs_exec:file rx_file_perms;
+
+# Allow (host-driven) ART run-tests to execute dex2oat, in order to
+# check ART's compiler.
+allow shell dex2oat_exec:file rx_file_perms;
+allow shell dex2oat_exec:lnk_file read;
+
+# Allow shell to start and comminicate with lpdumpd.
+set_prop(shell, lpdumpd_prop);
+binder_call(shell, lpdumpd)
+
+# Allow shell to set and read value of properties used for CTS tests of
+# userspace reboot
+set_prop(shell, userspace_reboot_test_prop)
+
+# Allow shell to set this property to disable charging.
+set_prop(shell, power_debug_prop)
+
+# Allow shell to set this property used for rollback tests
+set_prop(shell, rollback_test_prop)
+
+# Allow shell to set RKP properties for testing purposes
+set_prop(shell, remote_prov_prop)
+
+# Allow shell to enable 16 KB backcompat globally.
+set_prop(shell, bionic_linker_16kb_app_compat_prop)
+
+# Allow shell to disable compat in package manager
+set_prop(shell, pm_16kb_app_compat_prop)
+
+# Allow shell to get encryption policy of /data/local/tmp/, for CTS
+allowxperm shell shell_data_file:dir ioctl {
+ FS_IOC_GET_ENCRYPTION_POLICY
+ FS_IOC_GET_ENCRYPTION_POLICY_EX
+};
+
+# Allow shell to execute simpleperf without a domain transition.
+allow shell simpleperf_exec:file rx_file_perms;
+
+userdebug_or_eng(`
+ # Allow shell to execute profcollectctl without a domain transition.
+ allow shell profcollectd_exec:file rx_file_perms;
+
+ # Allow shell to read profcollectd data files.
+ r_dir_file(shell, profcollectd_data_file)
+
+ # Allow to issue control commands to profcollectd binder service.
+ allow shell profcollectd:binder call;
+')
+
+# Allow shell to run remount command.
+allow shell remount_exec:file rx_file_perms;
+
+# Allow shell to call perf_event_open for profiling other shell processes, but
+# not the whole system.
+allow shell self:perf_event { open read write kernel };
+
+# Allow shell to read microdroid vendor image
+r_dir_file(shell, vendor_microdroid_file)
+
+# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
+allow shell apex_info_file:file r_file_perms;
+allow shell vendor_apex_file:file r_file_perms;
+allow shell vendor_apex_file:dir r_dir_perms;
+allow shell vendor_apex_metadata_file:dir r_dir_perms;
+
+# Allow shell to read updated APEXes under /data/apex
+allow shell apex_data_file:dir search;
+allow shell staging_data_file:file r_file_perms;
+
+# Set properties.
+set_prop(shell, shell_prop)
+set_prop(shell, ctl_bugreport_prop)
+set_prop(shell, ctl_dumpstate_prop)
+set_prop(shell, dumpstate_prop)
+set_prop(shell, exported_dumpstate_prop)
+set_prop(shell, debug_prop)
+set_prop(shell, perf_drop_caches_prop)
+set_prop(shell, powerctl_prop)
+set_prop(shell, log_tag_prop)
+set_prop(shell, wifi_log_prop)
+# Allow shell to start/stop traced via the persist.traced.enable
+# property (which also takes care of /data/misc initialization).
+set_prop(shell, traced_enabled_prop)
+# adjust SELinux audit rates
+set_prop(shell, logd_auditrate_prop)
+# adjust is_loggable properties
+userdebug_or_eng(`set_prop(shell, log_prop)')
+# logpersist script
+userdebug_or_eng(`set_prop(shell, logpersistd_logging_prop)')
+# Allow shell to start/stop heapprofd via the persist.heapprofd.enable
+# property.
+set_prop(shell, heapprofd_enabled_prop)
+# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
+# property.
+set_prop(shell, traced_perf_enabled_prop)
+# Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
+set_prop(shell, ctl_gsid_prop)
+set_prop(shell, ctl_snapuserd_prop)
+# Allow shell to start/stop prefetch
+set_prop(shell, ctl_prefetch_prop)
+# Allow shell to enable Dynamic System Update
+set_prop(shell, dynamic_system_prop)
+# Allow shell to mock an OTA using persist.pm.mock-upgrade
+set_prop(shell, mock_ota_prop)
+
+# Read device's serial number from system properties
+get_prop(shell, serialno_prop)
+
+# Allow shell to read the vendor security patch level for CTS
+get_prop(shell, vendor_security_patch_level_prop)
+
+# Read state of logging-related properties
+get_prop(shell, device_logging_prop)
+
+# Read state of boot reason properties
+get_prop(shell, bootloader_boot_reason_prop)
+get_prop(shell, last_boot_reason_prop)
+get_prop(shell, system_boot_reason_prop)
+
+# Allow shell to execute the remote key provisioning factory tool
+binder_call(shell, hal_keymint)
+# Allow shell to run the AVF RKP HAL during the execution of the remote key
+# provisioning factory tool.
+# TODO(b/351113293): Remove this once the AVF RKP HAL registration is moved to
+# a separate process.
+binder_call(shell, virtualizationservice)
+# Allow the shell to inspect whether AVF remote attestation is supported
+# through the system property.
+get_prop(shell, avf_virtualizationservice_prop)
+
+# Allow reading the outcome of perf_event_open LSM support test for CTS.
+get_prop(shell, init_perf_lsm_hooks_prop)
+
+# Allow shell to read boot image timestamps and fingerprints.
+get_prop(shell, build_bootimage_prop)
+
+# Allow shell to read odsign verification properties
+get_prop(shell, odsign_prop)
+
+userdebug_or_eng(`set_prop(shell, persist_debug_prop)')
+
+# Allow shell to read the keystore key contexts files. Used by native tests to test label lookup.
+allow shell keystore2_key_contexts_file:file r_file_perms;
+
+# Allow shell to access the keystore2_key namespace shell_key. Mainly used for native tests.
+allow shell shell_key:keystore2_key { delete rebind use get_info update };
+
+# Allow shell to open and execute memfd files for minijail unit tests.
+userdebug_or_eng(`
+ allow shell appdomain_tmpfs:file { open execute_no_trans };
+')
+
+# Allow shell to write db.log.detailed, db.log.slow_query_threshold*
+set_prop(shell, sqlite_log_prop)
+
+# Allow shell to write MTE properties even on user builds.
+set_prop(shell, arm64_memtag_prop)
+set_prop(shell, permissive_mte_prop)
+
+# Allow shell to write kcmdline properties even on user builds.
+set_prop(shell, kcmdline_prop)
+
+# Allow shell to read the dm-verity props on user builds.
+get_prop(shell, verity_status_prop)
+
+# Allow shell to read Virtual A/B related properties
+get_prop(shell, virtual_ab_prop)
+
+# Allow ReadDefaultFstab() for CTS.
+read_fstab(shell)
+
+# Allow shell read access to /apex/apex-info-list.xml for CTS.
+allow shell apex_info_file:file r_file_perms;
+
+# Let the shell user call virtualizationservice (and
+# virtualizationservice call back to shell) for debugging.
+virtualizationservice_use(shell)
+
+# Allow shell to set persist.wm.debug properties
+userdebug_or_eng(`set_prop(shell, persist_wm_debug_prop)')
+
+# Allow shell to write GWP-ASan properties even on user builds.
+set_prop(shell, gwp_asan_prop)
+
+# Allow shell to set persist.sysui.notification.builder_extras_override property
+userdebug_or_eng(`set_prop(shell, persist_sysui_builder_extras_prop)')
+# Allow shell to set persist.sysui.notification.ranking_update_ashmem property
+userdebug_or_eng(`set_prop(shell, persist_sysui_ranking_update_prop)')
+
+# Allow shell to read the build properties for attestation feature
+get_prop(shell, build_attestation_prop)
+
+# Allow shell to execute oatdump.
+# TODO (b/350628688): Remove this once it's safe to do so.
+allow shell oatdump_exec:file rx_file_perms;
+
+# Create and use network sockets.
+net_domain(shell)
+
+# logcat
+read_logd(shell)
+control_logd(shell)
+get_prop(shell, logd_prop)
+# logcat -L (directly, or via dumpstate)
+allow shell pstorefs:dir search;
+allow shell pstorefs:file r_file_perms;
+
+# Root fs.
+allow shell rootfs:dir r_dir_perms;
+
+# read files in /data/anr
+allow shell anr_data_file:dir r_dir_perms;
+allow shell anr_data_file:file r_file_perms;
+
+# Access /data/local/tmp.
+allow shell shell_data_file:dir create_dir_perms;
+allow shell shell_data_file:file create_file_perms;
+allow shell shell_data_file:file rx_file_perms;
+allow shell shell_data_file:lnk_file create_file_perms;
+
+# Access /data/local/tests.
+allow shell shell_test_data_file:dir create_dir_perms;
+allow shell shell_test_data_file:file create_file_perms;
+allow shell shell_test_data_file:file rx_file_perms;
+allow shell shell_test_data_file:lnk_file create_file_perms;
+allow shell shell_test_data_file:sock_file create_file_perms;
+
+# Read and delete from /data/local/traces.
+allow shell trace_data_file:file { r_file_perms unlink };
+allow shell trace_data_file:dir { r_dir_perms remove_name write };
+
+# Access /data/misc/profman.
+allow shell profman_dump_data_file:dir { write remove_name r_dir_perms };
+allow shell profman_dump_data_file:file { unlink r_file_perms };
+
+# Read/execute files in /data/nativetest
+userdebug_or_eng(`
+ allow shell nativetest_data_file:dir r_dir_perms;
+ allow shell nativetest_data_file:file rx_file_perms;
+')
+
+# adb bugreport
+unix_socket_connect(shell, dumpstate, dumpstate)
+
+allow shell devpts:chr_file rw_file_perms;
+allow shell tty_device:chr_file rw_file_perms;
+allow shell console_device:chr_file rw_file_perms;
+
+allow shell input_device:dir r_dir_perms;
+allow shell input_device:chr_file r_file_perms;
+
+r_dir_file(shell, system_file)
+allow shell system_file:file x_file_perms;
+allow shell toolbox_exec:file rx_file_perms;
+allow shell shell_exec:file rx_file_perms;
+allow shell zygote_exec:file rx_file_perms;
+
+userdebug_or_eng(`
+ # "systrace --boot" support - allow boottrace service to run
+ allow shell boottrace_data_file:dir rw_dir_perms;
+ allow shell boottrace_data_file:file create_file_perms;
+')
+
+# allow shell access to services
+allow shell servicemanager:service_manager list;
+# don't allow shell to access GateKeeper service
+# TODO: why is this so broad? Tightening candidate? It needs at list:
+# - dumpstate_service (so it can receive dumpstate progress updates)
+allow shell {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -gatekeeper_service
+ -hal_keymint_service
+ -hal_secureclock_service
+ -hal_sharedsecret_service
+ -incident_service
+ -installd_service
+ -mdns_service
+ -netd_service
+ -system_suspend_control_internal_service
+ -system_suspend_control_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+ -virtualization_service
+}:service_manager find;
+allow shell dumpstate:binder call;
+
+# allow shell to get information from hwservicemanager
+# for instance, listing hardware services with lshal
+hwbinder_use(shell)
+allow shell hwservicemanager:hwservice_manager list;
+
+# allow shell to look through /proc/ for lsmod, ps, top, netstat, vmstat.
+r_dir_file(shell, proc_net_type)
+
+allow shell {
+ proc_asound
+ proc_cgroups
+ proc_filesystems
+ proc_interrupts
+ proc_loadavg # b/124024827
+ proc_meminfo
+ proc_modules
+ proc_pid_max
+ proc_slabinfo
+ proc_stat
+ proc_timer
+ proc_uptime
+ proc_version
+ proc_vmstat
+ proc_zoneinfo
+}:file r_file_perms;
+
+# allow listing network interfaces under /sys/class/net.
+allow shell sysfs_net:dir r_dir_perms;
+
+r_dir_file(shell, cgroup)
+allow shell cgroup_desc_file:file r_file_perms;
+allow shell vendor_cgroup_desc_file:file r_file_perms;
+r_dir_file(shell, cgroup_v2)
+allow shell domain:dir { search open read getattr };
+allow shell domain:{ file lnk_file } { open read getattr };
+
+# statvfs() of /proc and other labeled filesystems
+# (yaffs2, jffs2, ext2, ext3, ext4, xfs, btrfs, f2fs, squashfs, overlay)
+allow shell { proc labeledfs }:filesystem getattr;
+
+# stat() of /dev
+allow shell device:dir getattr;
+
+# allow shell to read /proc/pid/attr/current for ps -Z
+allow shell domain:process getattr;
+
+# Allow pulling the SELinux policy for CTS purposes
+allow shell selinuxfs:dir r_dir_perms;
+allow shell selinuxfs:file r_file_perms;
+
+# enable shell domain to read/write files/dirs for bootchart data
+# User will creates the start and stop file via adb shell
+# and read other files created by init process under /data/bootchart
+allow shell bootchart_data_file:dir rw_dir_perms;
+allow shell bootchart_data_file:file create_file_perms;
+
+# Make sure strace works for the non-privileged shell user
+allow shell self:process ptrace;
+
+# allow shell to get battery info
+allow shell sysfs:dir r_dir_perms;
+allow shell sysfs_batteryinfo:dir r_dir_perms;
+allow shell sysfs_batteryinfo:file r_file_perms;
+
+# Allow reads (but not writes) of the MGLRU state
+allow shell sysfs_lru_gen_enabled:file r_file_perms;
+
+# Allow reads (but not writes) of mem_sleep to determine suspend mechanism
+allow shell sysfs_mem_sleep:file r_file_perms;
+
+# Allow communicating with the VM terminal.
+userdebug_or_eng(`
+ allow shell vmlauncher_app_devpts:chr_file rw_file_perms;
+ allowxperm shell vmlauncher_app_devpts:chr_file ioctl unpriv_tty_ioctls;
+')
+
+# Allow CTS to check whether AVF debug policy is installed
+allow shell { proc_dt_avf sysfs_dt_avf }:dir search;
+
+# Allow access to ion memory allocation device.
+allow shell ion_device:chr_file rw_file_perms;
+
+#
+# filesystem test for insecure chr_file's is done
+# via a host side test
+#
+allow shell dev_type:dir r_dir_perms;
+allow shell dev_type:chr_file getattr;
+
+# /dev/fd is a symlink
+allow shell proc:lnk_file getattr;
+
+#
+# filesystem test for insucre blk_file's is done
+# via hostside test
+#
+allow shell dev_type:blk_file getattr;
+
+# read selinux policy files
+allow shell file_contexts_file:file r_file_perms;
+allow shell property_contexts_file:file r_file_perms;
+allow shell seapp_contexts_file:file r_file_perms;
+allow shell service_contexts_file:file r_file_perms;
+allow shell sepolicy_file:file r_file_perms;
+
+# Allow shell to start up vendor shell
+allow shell vendor_shell_exec:file rx_file_perms;
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ allow shell linux_vm_setup_exec:file { entrypoint r_file_perms };
+')
+
+allow shell tee_service_contexts_file:file r_file_perms;
+allow shell test_pkvm_tee_service:tee_service use;
+
+# Everything is labeled as rootfs in recovery mode. Allow shell to
+# execute them.
+recovery_only(`
+ allow shell rootfs:file rx_file_perms;
+')
+
+###
+### Neverallow rules
+###
+
+# Do not allow shell to talk directly to security HAL services other than
+# hal_remotelyprovisionedcomponent_service
+neverallow shell {
+ hal_keymint_service
+ hal_secureclock_service
+ hal_sharedsecret_service
+ virtualization_service
+}:service_manager find;
+
+# Do not allow shell to hard link to any files.
+# In particular, if shell hard links to app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure the shell user never has this
+# capability.
+neverallow shell file_type:file link;
+
+# Do not allow privileged socket ioctl commands
+neverallowxperm shell domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+
+# limit shell access to sensitive char drivers to
+# only getattr required for host side test.
+neverallow shell {
+ fuse_device
+ hw_random_device
+ port_device
+}:chr_file ~getattr;
+
+# Limit shell to only getattr on blk devices for host side tests.
+neverallow shell dev_type:blk_file ~getattr;
+
+# b/30861057: Shell access to existing input devices is an abuse
+# vector. The shell user can inject events that look like they
+# originate from the touchscreen etc.
+# Everyone should have already moved to UiAutomation#injectInputEvent
+# if they are running instrumentation tests (i.e. CTS), Monkey for
+# their stress tests, and the input command (adb shell input ...) for
+# injecting swipes and things.
+neverallow shell input_device:chr_file no_w_file_perms;
+
+neverallow shell self:perf_event ~{ open read write kernel };
+
+# Never allow others to set or get the perf.drop_caches property.
+neverallow { domain -shell -init } perf_drop_caches_prop:property_service set;
+neverallow { domain -shell -init -dumpstate } perf_drop_caches_prop:file read;
diff --git a/prebuilts/api/202504/private/simpleperf.te b/prebuilts/api/202504/private/simpleperf.te
new file mode 100644
index 0000000..9c70060
--- /dev/null
+++ b/prebuilts/api/202504/private/simpleperf.te
@@ -0,0 +1,51 @@
+# Domain used when running /system/bin/simpleperf to profile a specific app.
+# Entered either by the app itself exec-ing the binary, or through
+# simpleperf_app_runner (with shell as its origin). Certain other domains
+# (runas_app, shell) can also exec this binary without a domain transition.
+typeattribute simpleperf coredomain;
+type simpleperf_exec, system_file_type, exec_type, file_type;
+
+# Define apps that can be marked debuggable/profileable and be profiled by simpleperf.
+define(`simpleperf_profileable_apps', `{
+ ephemeral_app
+ isolated_app
+ platform_app
+ priv_app
+ untrusted_app_all
+}')
+
+domain_auto_trans({ simpleperf_profileable_apps -runas_app }, simpleperf_exec, simpleperf)
+
+# When running in this domain, simpleperf is scoped to profiling an individual
+# app. The necessary MAC permissions for profiling are more maintainable and
+# consistent if simpleperf is marked as an app domain as well (as, for example,
+# it will then see the same set of system libraries as the app).
+app_domain(simpleperf)
+untrusted_app_domain(simpleperf)
+
+# Allow ptrace attach to the target app, for reading JIT debug info (using
+# process_vm_readv) during unwinding and symbolization.
+allow simpleperf simpleperf_profileable_apps:process ptrace;
+
+# Allow using perf_event_open syscall for profiling the target app.
+allow simpleperf self:perf_event { open read write kernel };
+
+# Allow /proc/<pid> access for the target app (for example, when trying to
+# discover it by cmdline).
+r_dir_file(simpleperf, simpleperf_profileable_apps)
+
+# Allow apps signalling simpleperf domain, which is the domain that the simpleperf
+# profiler runs as when executed by the app. The signals are used to control
+# the profiler (which would be profiling the app that is sending the signal).
+allow simpleperf_profileable_apps simpleperf:process signal;
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective processes, most of which this domain is
+# not allowed to see.
+dontaudit simpleperf domain:dir search;
+
+# Neverallows:
+
+# Profiling must be confined to the scope of an individual app.
+neverallow simpleperf self:perf_event ~{ open read write kernel };
diff --git a/prebuilts/api/202504/private/simpleperf_app_runner.te b/prebuilts/api/202504/private/simpleperf_app_runner.te
new file mode 100644
index 0000000..184a80a
--- /dev/null
+++ b/prebuilts/api/202504/private/simpleperf_app_runner.te
@@ -0,0 +1,45 @@
+typeattribute simpleperf_app_runner coredomain;
+
+domain_auto_trans(shell, simpleperf_app_runner_exec, simpleperf_app_runner)
+
+# run simpleperf_app_runner in adb shell.
+allow simpleperf_app_runner adbd:fd use;
+allow simpleperf_app_runner shell:fd use;
+allow simpleperf_app_runner devpts:chr_file { read write ioctl };
+
+# simpleperf_app_runner reads package information.
+allow simpleperf_app_runner system_data_file:file r_file_perms;
+allow simpleperf_app_runner system_data_file:lnk_file getattr;
+allow simpleperf_app_runner packages_list_file:file r_file_perms;
+
+# The app's data dir may be accessed through a symlink.
+allow simpleperf_app_runner system_data_file:lnk_file read;
+
+# simpleperf_app_runner switches to the app UID/GID.
+allow simpleperf_app_runner self:global_capability_class_set { setuid setgid };
+
+# simpleperf_app_runner switches to the app security context.
+selinux_check_context(simpleperf_app_runner) # validate context
+allow simpleperf_app_runner self:process setcurrent;
+allow simpleperf_app_runner { ephemeral_app isolated_app platform_app priv_app untrusted_app_all }:process dyntransition; # setcon
+
+# simpleperf_app_runner/libselinux needs access to seapp_contexts_file to
+# determine which domain to transition to.
+allow simpleperf_app_runner seapp_contexts_file:file r_file_perms;
+
+# simpleperf_app_runner passes pipe fds.
+# simpleperf_app_runner writes app type (debuggable or profileable) to pipe fds.
+allow simpleperf_app_runner shell:fifo_file { read write };
+
+# simpleperf_app_runner checks shell data paths.
+# simpleperf_app_runner passes shell data fds.
+allow simpleperf_app_runner shell_data_file:dir { getattr search };
+allow simpleperf_app_runner shell_data_file:file { getattr write };
+
+###
+### neverallow rules
+###
+
+# simpleperf_app_runner cannot have capabilities other than CAP_SETUID and CAP_SETGID
+neverallow simpleperf_app_runner self:global_capability_class_set ~{ setuid setgid };
+neverallow simpleperf_app_runner self:global_capability2_class_set *;
diff --git a/prebuilts/api/202504/private/simpleperf_boot.te b/prebuilts/api/202504/private/simpleperf_boot.te
new file mode 100644
index 0000000..e71c492
--- /dev/null
+++ b/prebuilts/api/202504/private/simpleperf_boot.te
@@ -0,0 +1,59 @@
+# Domain used when running /system/bin/simpleperf to record boot-time profiles.
+# It is started by init process. It's only available on userdebug/eng build.
+
+type simpleperf_boot, domain, coredomain, mlstrustedsubject;
+
+# /data/simpleperf_boot_data, used to store boot-time profiles.
+type simpleperf_boot_data_file, file_type;
+
+userdebug_or_eng(`
+ domain_auto_trans(init, simpleperf_exec, simpleperf_boot)
+
+ # simpleperf_boot writes profile data to /data/simpleperf_boot_data.
+ allow simpleperf_boot simpleperf_boot_data_file:file create_file_perms;
+ allow simpleperf_boot simpleperf_boot_data_file:dir rw_dir_perms;
+
+ # Allow simpleperf_boot full use of perf_event_open(2), to enable system wide profiling.
+ allow simpleperf_boot self:perf_event { cpu kernel open read write };
+ allow simpleperf_boot self:global_capability2_class_set perfmon;
+
+ # Allow simpleperf_boot to scan through /proc/pid for all processes.
+ r_dir_file(simpleperf_boot, domain)
+
+ # Allow simpleperf_boot to read executable binaries.
+ allow simpleperf_boot system_file_type:file r_file_perms;
+ allow simpleperf_boot vendor_file_type:file r_file_perms;
+
+ # Allow simpleperf_boot to search for and read kernel modules.
+ allow simpleperf_boot vendor_file:dir r_dir_perms;
+ allow simpleperf_boot vendor_kernel_modules:file r_file_perms;
+
+ # Allow simpleperf_boot to read system bootstrap libs.
+ allow simpleperf_boot system_bootstrap_lib_file:dir search;
+ allow simpleperf_boot system_bootstrap_lib_file:file r_file_perms;
+
+ # Allow simpleperf_boot to access tracefs.
+ allow simpleperf_boot debugfs_tracing:dir r_dir_perms;
+ allow simpleperf_boot debugfs_tracing:file rw_file_perms;
+ allow simpleperf_boot debugfs_tracing_debug:dir r_dir_perms;
+ allow simpleperf_boot debugfs_tracing_debug:file rw_file_perms;
+
+ # Allow simpleperf_boot to write to perf_event_paranoid under /proc.
+ allow simpleperf_boot proc_perf:file write;
+
+ # Allow simpleperf_boot to read process maps.
+ allow simpleperf_boot self:global_capability_class_set sys_ptrace;
+ # Allow simpleperf_boot to read JIT debug info from system_server and zygote.
+ allow simpleperf_boot { system_server zygote }:process ptrace;
+
+ # Allow to temporarily lift the kptr_restrict setting and get kernel start address
+ # by reading /proc/kallsyms, get module start address by reading /proc/modules.
+ set_prop(simpleperf_boot, lower_kptr_restrict_prop)
+ allow simpleperf_boot proc_kallsyms:file r_file_perms;
+ allow simpleperf_boot proc_modules:file r_file_perms;
+
+ # Allow simpleperf_boot to read kernel build id.
+ allow simpleperf_boot sysfs_kernel_notes:file r_file_perms;
+
+ dontaudit simpleperf_boot shell_data_file:dir search;
+')
diff --git a/prebuilts/api/202504/private/slideshow.te b/prebuilts/api/202504/private/slideshow.te
new file mode 100644
index 0000000..d7c9868
--- /dev/null
+++ b/prebuilts/api/202504/private/slideshow.te
@@ -0,0 +1,11 @@
+typeattribute slideshow coredomain;
+
+allow slideshow kmsg_device:chr_file rw_file_perms;
+wakelock_use(slideshow)
+allow slideshow device:dir r_dir_perms;
+allow slideshow self:global_capability_class_set sys_tty_config;
+allow slideshow graphics_device:dir r_dir_perms;
+allow slideshow graphics_device:chr_file rw_file_perms;
+allow slideshow input_device:dir r_dir_perms;
+allow slideshow input_device:chr_file r_file_perms;
+allow slideshow tty_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/snapshotctl.te b/prebuilts/api/202504/private/snapshotctl.te
new file mode 100644
index 0000000..c92217d
--- /dev/null
+++ b/prebuilts/api/202504/private/snapshotctl.te
@@ -0,0 +1,64 @@
+type snapshotctl, domain, coredomain;
+type snapshotctl_exec, system_file_type, exec_type, file_type;
+
+# Allow init to run snapshotctl and do auto domain transfer.
+init_daemon_domain(snapshotctl);
+
+# Allow to start gsid service.
+set_prop(snapshotctl, ctl_gsid_prop)
+
+# Allow to talk to gsid.
+binder_use(snapshotctl)
+allow snapshotctl gsi_service:service_manager find;
+binder_call(snapshotctl, gsid)
+
+# Allow to create/read/write/delete OTA metadata files for snapshot status and COW file status.
+allow snapshotctl metadata_file:dir search;
+allow snapshotctl ota_metadata_file:dir rw_dir_perms;
+allow snapshotctl ota_metadata_file:file create_file_perms;
+
+# Allow to get A/B slot suffix from device tree or kernel cmdline.
+r_dir_file(snapshotctl, sysfs_dt_firmware_android);
+allow snapshotctl proc_cmdline:file r_file_perms;
+
+# Needed to (re-)map logical partitions.
+allow snapshotctl block_device:dir r_dir_perms;
+allow snapshotctl super_block_device:blk_file r_file_perms;
+
+# Interact with device-mapper to collapse snapshots.
+allow snapshotctl dm_device:chr_file rw_file_perms;
+
+# Needed to mutate device-mapper nodes.
+allow snapshotctl self:global_capability_class_set sys_admin;
+
+# Snapshotctl talk to boot control HAL to set merge status.
+hwbinder_use(snapshotctl)
+hal_client_domain(snapshotctl, hal_bootctl)
+
+# Allow snapshotctl to write to statsd socket.
+unix_socket_send(snapshotctl, statsdw, statsd)
+
+# Logging
+userdebug_or_eng(`
+ allow snapshotctl snapshotctl_log_data_file:dir rw_dir_perms;
+ allow snapshotctl snapshotctl_log_data_file:file create_file_perms;
+')
+
+# Allow to read /proc/bootconfig.
+allow snapshotctl proc_bootconfig:file r_file_perms;
+
+# Allow to control snapuserd.
+set_prop(snapshotctl, ctl_snapuserd_prop)
+
+# Allow to read snapuserd.* properties.
+get_prop(snapshotctl, snapuserd_prop)
+
+# Allow to talk to snapuserd.
+allow snapshotctl snapuserd_socket:sock_file write;
+allow snapshotctl snapuserd:unix_stream_socket { connectto };
+
+# Allow to read /dev/block/dm-* (device-mapper) nodes.
+allow snapshotctl dm_device:blk_file r_file_perms;
+
+# Allow to read dm-user control nodes.
+allow snapshotctl dm_user_device:dir search;
diff --git a/prebuilts/api/202504/private/snapuserd.te b/prebuilts/api/202504/private/snapuserd.te
new file mode 100644
index 0000000..fda3fd1
--- /dev/null
+++ b/prebuilts/api/202504/private/snapuserd.te
@@ -0,0 +1,84 @@
+# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots.
+type snapuserd, domain;
+type snapuserd_exec, exec_type, file_type, system_file_type;
+
+typeattribute snapuserd coredomain;
+
+init_daemon_domain(snapuserd)
+
+allow snapuserd kmsg_device:chr_file rw_file_perms;
+
+# Allow snapuserd to reach block devices in /dev/block.
+allow snapuserd block_device:dir search;
+
+# Read /sys/block to find all the DM directories like (/sys/block/dm-X).
+allow snapuserd sysfs:dir { open read };
+
+# Read /sys/block/dm-X/dm/name (which is a symlink to
+# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between
+# dm-X and dynamic partitions.
+allow snapuserd sysfs_dm:dir { open read search };
+allow snapuserd sysfs_dm:file r_file_perms;
+
+# Reading and writing to /dev/block/dm-* (device-mapper) nodes.
+allow snapuserd block_device:dir r_dir_perms;
+allow snapuserd dm_device:chr_file rw_file_perms;
+allow snapuserd dm_device:blk_file rw_file_perms;
+
+# Reading and writing to dm-user control nodes.
+allow snapuserd dm_user_device:dir r_dir_perms;
+allow snapuserd dm_user_device:chr_file rw_file_perms;
+
+# Reading and writing to /dev/socket/snapuserd and snapuserd_proxy.
+allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write };
+allow snapuserd snapuserd_proxy_socket:sock_file write;
+
+# Required for setting GID to system while calling SetTaskProfile() API
+allow snapuserd self:global_capability_class_set { setgid };
+
+# This arises due to first-stage init opening /dev/null without F_CLOEXEC
+# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd
+# again, the descriptor leaks into the new process.
+allow snapuserd kernel:fd use;
+
+# snapuserd.* properties
+set_prop(snapuserd, snapuserd_prop)
+get_prop(snapuserd, virtual_ab_prop)
+
+# For inotify watching for /dev/socket/snapuserd_proxy to appear.
+allow snapuserd tmpfs:dir { read watch };
+
+# Forbid anything other than snapuserd and init setting snapuserd properties.
+neverallow {
+ domain
+ -snapuserd
+ -init
+} snapuserd_prop:property_service set;
+
+# Allow to read/write/create OTA metadata files
+allow snapuserd metadata_file:dir search;
+allow snapuserd ota_metadata_file:dir rw_dir_perms;
+allow snapuserd ota_metadata_file:file create_file_perms;
+
+# write to /data/misc/snapuserd_log
+allow snapuserd snapuserd_log_data_file:dir create_dir_perms;
+allow snapuserd snapuserd_log_data_file:file create_file_perms;
+
+# Read /proc/stat to determine boot time
+allow snapuserd proc_stat:file r_file_perms;
+
+# This capability allows snapuserd to circumvent memlock rlimits while using
+# io_uring. An Alternative would be to up the memlock rlimit for the snapuserd service.
+allow snapuserd self:capability ipc_lock;
+io_uring_use(snapuserd)
+
+# Disallow other domains controlling snapuserd.
+neverallow {
+ domain
+ -fastbootd
+ -init
+ -recovery
+ -shell
+ -snapshotctl
+ -update_engine
+} ctl_snapuserd_prop:property_service set;
diff --git a/prebuilts/api/202504/private/stats.te b/prebuilts/api/202504/private/stats.te
new file mode 100644
index 0000000..6261303
--- /dev/null
+++ b/prebuilts/api/202504/private/stats.te
@@ -0,0 +1,35 @@
+type stats, domain;
+typeattribute stats coredomain;
+type stats_exec, system_file_type, exec_type, file_type;
+
+# switch to stats domain for stats command
+domain_auto_trans(shell, stats_exec, stats)
+
+# allow stats access to stdout from its parent shell.
+allow stats shell:fd use;
+
+# allow stats to communicate use, read and write over the adb
+# connection.
+allow stats adbd:fd use;
+allow stats adbd:unix_stream_socket { read write };
+
+# allow adbd to reap stats
+allow stats adbd:process { sigchld };
+
+# Allow the stats command to talk to the statsd over the binder, and get
+# back the stats report data from a ParcelFileDescriptor.
+binder_use(stats)
+allow stats stats_service:service_manager find;
+binder_call(stats, statsd)
+allow stats statsd:fifo_file write;
+
+# Only statsd can publish the binder service.
+add_service(statsd, stats_service)
+
+# Allow pipes from (and only from) stats.
+allow statsd stats:fd use;
+allow statsd stats:fifo_file write;
+
+# Allow statsd to call back to stats with status updates.
+binder_call(statsd, stats)
+
diff --git a/prebuilts/api/202504/private/stats_service_server.te b/prebuilts/api/202504/private/stats_service_server.te
new file mode 100644
index 0000000..ab8e58a
--- /dev/null
+++ b/prebuilts/api/202504/private/stats_service_server.te
@@ -0,0 +1,4 @@
+add_hwservice(stats_service_server, fwk_stats_hwservice)
+add_service(stats_service_server, fwk_stats_service)
+
+binder_use(stats_service_server)
diff --git a/prebuilts/api/202504/private/statsd.te b/prebuilts/api/202504/private/statsd.te
new file mode 100644
index 0000000..3db5c60
--- /dev/null
+++ b/prebuilts/api/202504/private/statsd.te
@@ -0,0 +1,146 @@
+typeattribute statsd coredomain;
+
+init_daemon_domain(statsd)
+
+# Allow to exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe. It allows statsd to capture traces and hand them
+# to Android dropbox.
+allow statsd perfetto_exec:file rx_file_perms;
+domain_auto_trans(statsd, perfetto_exec, perfetto)
+
+# Grant statsd with permissions to register the services.
+allow statsd {
+ statscompanion_service
+}:service_manager find;
+
+# Allow incidentd to obtain the statsd incident section.
+allow statsd incidentd:fifo_file write;
+
+# Allow StatsCompanionService to pipe data to statsd.
+allow statsd system_server:fifo_file { read write getattr };
+
+# Allow any app to pipe data to statsd.
+# Access control to all statsd APIs inherit from system_api_service, so
+# appdomain permissions are granted to avoid listing each individual
+# service that can access system_api_service.
+allow statsd appdomain:fifo_file { read write getattr };
+
+# Allow statsd to retrieve SF statistics over binder
+binder_call(statsd, surfaceflinger);
+
+# Allow statsd to read its system properties
+get_prop(statsd, device_config_statsd_native_prop)
+get_prop(statsd, device_config_statsd_native_boot_prop)
+
+# Allow statsd to read misctl properties (for 16 KB)
+get_prop(statsd, misctrl_prop)
+
+# Allow statsd to write uprobestats configs.
+allow statsd uprobestats_configs_data_file:dir rw_dir_perms;
+allow statsd uprobestats_configs_data_file:file create_file_perms;
+
+# Allow statsd to trigger uprobestats via property.
+set_prop(statsd, uprobestats_start_with_config_prop);
+
+# Allow statsd to use io_uring
+io_uring_use(statsd)
+
+# Allow statsd to start the uprobestats service.
+set_prop(statsd, ctl_uprobestats_prop)
+binder_use(statsd)
+
+# Allow statsd to scan through /proc/pid for all processes.
+r_dir_file(statsd, domain)
+
+# Allow executing files on system, such as running a shell or running:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow statsd devpts:chr_file { getattr ioctl read write };
+allow statsd shell_exec:file rx_file_perms;
+allow statsd system_file:file execute_no_trans;
+allow statsd toolbox_exec:file rx_file_perms;
+
+userdebug_or_eng(`
+ allow statsd su:fifo_file read;
+')
+
+# Create, read, and write into
+# /data/misc/stats-active-metric
+# /data/misc/stats-data
+# /data/misc/stats-metadata
+# /data/misc/stats-service
+# /data/misc/train-info
+allow statsd stats_data_file:dir create_dir_perms;
+allow statsd stats_data_file:file create_file_perms;
+allow statsd stats_config_data_file:dir create_dir_perms;
+allow statsd stats_config_data_file:file create_file_perms;
+
+# Allow statsd to make binder calls to any binder service.
+binder_call(statsd, appdomain)
+binder_call(statsd, incidentd)
+binder_call(statsd, system_server)
+binder_call(statsd, traced_probes)
+
+# Allow statsd to interact with gpuservice
+allow statsd gpu_service:service_manager find;
+binder_call(statsd, gpuservice)
+
+# Allow statsd to interact with keystore to pull atoms
+allow statsd keystore_service:service_manager find;
+binder_call(statsd, keystore)
+
+# Allow statsd to interact with mediametrics
+allow statsd mediametrics_service:service_manager find;
+binder_call(statsd, mediametrics)
+
+# Allow statsd to interact with mediametrics
+allow statsd mediaserver_service:service_manager find;
+binder_call(statsd, mediaserver)
+
+# Allow logd access.
+read_logd(statsd)
+control_logd(statsd)
+
+# Grant statsd with permissions to register the services.
+allow statsd {
+ app_api_service
+ incident_service
+ system_api_service
+}:service_manager find;
+
+# Grant statsd to access health hal to access battery metrics.
+allow statsd hal_health_hwservice:hwservice_manager find;
+
+# Allow statsd to send dump info to dumpstate
+allow statsd dumpstate:fd use;
+allow statsd dumpstate:fifo_file { getattr write };
+
+# Allow access to with hardware layer and process stats.
+allow statsd proc_uid_cputime_showstat:file { getattr open read };
+hal_client_domain(statsd, hal_health)
+hal_client_domain(statsd, hal_power)
+hal_client_domain(statsd, hal_power_stats)
+hal_client_domain(statsd, hal_thermal)
+
+# Allow 'adb shell cmd' to upload configs and download output.
+allow statsd adbd:fd use;
+allow statsd adbd:unix_stream_socket { getattr read write };
+allow statsd shell:fifo_file { getattr read write };
+
+unix_socket_send(statsd, statsdw, statsd)
+
+###
+### neverallow rules
+###
+
+# Only statsd and the other root services in limited circumstances.
+# can get to the files in /data/misc/stats-data, /data/misc/stats-service.
+# Other services are prohibitted from accessing the file.
+neverallow { domain -statsd -init -vold } stats_data_file:file *;
+neverallow { domain -statsd -system_server -init -vold } stats_config_data_file:file *;
+
+
+# Limited access to the directory itself.
+neverallow { domain -statsd -init -vold } stats_data_file:dir *;
+neverallow { domain -statsd -system_server -init -vold } stats_config_data_file:dir *;
diff --git a/prebuilts/api/202504/private/storaged.te b/prebuilts/api/202504/private/storaged.te
new file mode 100644
index 0000000..bb39e5b
--- /dev/null
+++ b/prebuilts/api/202504/private/storaged.te
@@ -0,0 +1,69 @@
+# storaged daemon
+type storaged, domain, coredomain, mlstrustedsubject;
+type storaged_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(storaged)
+
+# Read access to pseudo filesystems
+r_dir_file(storaged, domain)
+
+# Read /proc/uid_io/stats
+allow storaged proc_uid_io_stats:file r_file_perms;
+
+# Read /data/system/packages.list
+allow storaged system_data_file:file r_file_perms;
+allow storaged packages_list_file:file r_file_perms;
+
+# Store storaged proto file
+allow storaged storaged_data_file:dir rw_dir_perms;
+allow storaged storaged_data_file:file create_file_perms;
+
+no_debugfs_restriction(`
+ userdebug_or_eng(`
+ # Read access to debugfs
+ allow storaged debugfs_mmc:dir search;
+ allow storaged debugfs_mmc:file r_file_perms;
+ ')
+')
+
+# Needed to provide debug dump output via dumpsys pipes.
+allow storaged shell:fd use;
+allow storaged shell:fifo_file write;
+
+# Needed for GMScore to call dumpsys storaged
+allow storaged priv_app:fd use;
+# b/142672293: No other priv-app should need this allow rule now that GMS core runs in its own domain.
+# Remove after no logs are seen for this rule.
+userdebug_or_eng(`
+ auditallow storaged priv_app:fd use;
+')
+allow storaged gmscore_app:fd use;
+allow storaged { privapp_data_file app_data_file }:file write;
+allow storaged permission_service:service_manager find;
+
+# Binder permissions
+add_service(storaged, storaged_service)
+
+binder_use(storaged)
+binder_call(storaged, system_server)
+
+hal_client_domain(storaged, hal_health)
+
+# Implements a dumpsys interface.
+allow storaged dumpstate:fd use;
+
+# use a subset of the package manager service
+allow storaged package_native_service:service_manager find;
+
+# Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is
+# running as root. See b/35323867 #3.
+dontaudit storaged self:global_capability_class_set { dac_override dac_read_search };
+
+# For collecting bugreports.
+allow storaged dumpstate:fifo_file write;
+
+###
+### neverallow
+###
+neverallow storaged domain:process ptrace;
+neverallow storaged self:capability_class_set *;
diff --git a/prebuilts/api/202504/private/su.te b/prebuilts/api/202504/private/su.te
new file mode 100644
index 0000000..247fd0b
--- /dev/null
+++ b/prebuilts/api/202504/private/su.te
@@ -0,0 +1,136 @@
+userdebug_or_eng(`
+ typeattribute su coredomain;
+
+ domain_auto_trans(shell, su_exec, su)
+ # Allow dumpstate to call su on userdebug / eng builds to collect
+ # additional information.
+ domain_auto_trans(dumpstate, su_exec, su)
+
+ # Make sure that dumpstate runs the same from the "su" domain as
+ # from the "init" domain.
+ domain_auto_trans(su, dumpstate_exec, dumpstate)
+
+ # Put the incident command into its domain so it is the same on user, userdebug and eng.
+ domain_auto_trans(su, incident_exec, incident)
+
+ # Put the odrefresh command into its domain.
+ domain_auto_trans(su, odrefresh_exec, odrefresh)
+
+ # Put the perfetto command into its domain so it is the same on user, userdebug and eng.
+ domain_auto_trans(su, perfetto_exec, perfetto)
+
+ # Allow accessing virtualization (e.g. via the vm command) - ensures virtmgr runs in its
+ # own domain.
+ virtualizationservice_use(su)
+
+ # su is also permissive to permit setenforce.
+ permissive su;
+
+ app_domain(su)
+
+ # Do not audit accesses to keystore2 namespace for the su domain.
+ dontaudit su keystore2_key_type:{ keystore2 keystore2_key } *;
+
+ typeattribute su mlstrustedsubject;
+
+ # Add su to various domains
+ net_domain(su)
+
+ # grant su access to vndbinder
+ vndbinder_use(su)
+
+ dontaudit su self:capability_class_set *;
+ dontaudit su self:capability2 *;
+ dontaudit su kernel:security *;
+ dontaudit su { kernel file_type }:system *;
+ dontaudit su self:memprotect *;
+ dontaudit su domain:anon_inode *;
+ dontaudit su domain:{ process process2 } *;
+ dontaudit su domain:fd *;
+ dontaudit su domain:dir *;
+ dontaudit su domain:lnk_file *;
+ dontaudit su domain:{ fifo_file file } *;
+ dontaudit su domain:socket_class_set *;
+ dontaudit su domain:ipc_class_set *;
+ dontaudit su domain:key *;
+ dontaudit su {fs_type fusefs_type}:filesystem *;
+ dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
+ dontaudit su node_type:node *;
+ dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
+ dontaudit su netif_type:netif *;
+ dontaudit su port_type:socket_class_set *;
+ dontaudit su port_type:{ tcp_socket dccp_socket } *;
+ dontaudit su domain:peer *;
+ dontaudit su domain:binder *;
+ dontaudit su property_type:property_service *;
+ dontaudit su property_type:file *;
+ dontaudit su service_manager_type:service_manager *;
+ dontaudit su hwservice_manager_type:hwservice_manager *;
+ dontaudit su vndservice_manager_type:service_manager *;
+ dontaudit su servicemanager:service_manager list;
+ dontaudit su hwservicemanager:hwservice_manager list;
+ dontaudit su vndservicemanager:service_manager list;
+ dontaudit su keystore:keystore2 *;
+ dontaudit su domain:drmservice *;
+ dontaudit su unlabeled:filesystem *;
+ dontaudit su postinstall_file:filesystem *;
+ dontaudit su domain:bpf *;
+ dontaudit su unlabeled:vsock_socket *;
+ dontaudit su self:perf_event *;
+
+ # VTS tests run in the permissive su domain on debug builds, but the HALs
+ # being tested run in enforcing mode. Because hal_foo_server is enforcing
+ # su needs to be declared as hal_foo_client to grant hal_foo_server
+ # permission to interact with it.
+ typeattribute su halclientdomain;
+ typeattribute su hal_allocator_client;
+ typeattribute su hal_atrace_client;
+ typeattribute su hal_audio_client;
+ typeattribute su hal_authsecret_client;
+ typeattribute su hal_bluetooth_client;
+ typeattribute su hal_bootctl_client;
+ typeattribute su hal_camera_client;
+ typeattribute su hal_configstore_client;
+ typeattribute su hal_confirmationui_client;
+ typeattribute su hal_contexthub_client;
+ typeattribute su hal_drm_client;
+ typeattribute su hal_cas_client;
+ typeattribute su hal_dumpstate_client;
+ typeattribute su hal_fingerprint_client;
+ typeattribute su hal_gatekeeper_client;
+ typeattribute su hal_gnss_client;
+ typeattribute su hal_graphics_allocator_client;
+ typeattribute su hal_graphics_composer_client;
+ typeattribute su hal_health_client;
+ typeattribute su hal_input_classifier_client;
+ typeattribute su hal_ir_client;
+ typeattribute su hal_keymaster_client;
+ typeattribute su hal_light_client;
+ typeattribute su hal_mediaquality_client;
+ typeattribute su hal_memtrack_client;
+ typeattribute su hal_neuralnetworks_client;
+ typeattribute su hal_nfc_client;
+ typeattribute su hal_oemlock_client;
+ typeattribute su hal_power_client;
+ typeattribute su hal_rebootescrow_client;
+ typeattribute su hal_secretkeeper_client;
+ typeattribute su hal_secure_element_client;
+ typeattribute su hal_sensors_client;
+ typeattribute su hal_telephony_client;
+ typeattribute su hal_tetheroffload_client;
+ typeattribute su hal_thermal_client;
+ typeattribute su hal_tv_cec_client;
+ typeattribute su hal_tv_hdmi_cec_client;
+ typeattribute su hal_tv_hdmi_connection_client;
+ typeattribute su hal_tv_hdmi_earc_client;
+ typeattribute su hal_tv_input_client;
+ typeattribute su hal_tv_tuner_client;
+ typeattribute su hal_usb_client;
+ typeattribute su hal_vibrator_client;
+ typeattribute su hal_vm_capabilities_client;
+ typeattribute su hal_vr_client;
+ typeattribute su hal_weaver_client;
+ typeattribute su hal_wifi_client;
+ typeattribute su hal_wifi_hostapd_client;
+ typeattribute su hal_wifi_supplicant_client;
+')
diff --git a/prebuilts/api/202504/private/surfaceflinger.te b/prebuilts/api/202504/private/surfaceflinger.te
new file mode 100644
index 0000000..1e0e1ef
--- /dev/null
+++ b/prebuilts/api/202504/private/surfaceflinger.te
@@ -0,0 +1,166 @@
+# surfaceflinger - display compositor service
+
+typeattribute surfaceflinger coredomain;
+
+type surfaceflinger_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(surfaceflinger)
+tmpfs_domain(surfaceflinger)
+
+typeattribute surfaceflinger mlstrustedsubject;
+typeattribute surfaceflinger display_service_server;
+
+read_runtime_log_tags(surfaceflinger)
+
+# Perform HwBinder IPC.
+hal_client_domain(surfaceflinger, hal_graphics_allocator)
+hal_client_domain(surfaceflinger, hal_graphics_composer)
+typeattribute surfaceflinger_tmpfs hal_graphics_composer_client_tmpfs;
+hal_client_domain(surfaceflinger, hal_codec2)
+hal_client_domain(surfaceflinger, hal_omx)
+hal_client_domain(surfaceflinger, hal_configstore)
+hal_client_domain(surfaceflinger, hal_power)
+allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
+
+# Perform Binder IPC.
+binder_use(surfaceflinger)
+binder_call(surfaceflinger, binderservicedomain)
+binder_call(surfaceflinger, appdomain)
+binder_call(surfaceflinger, bootanim)
+binder_call(surfaceflinger, system_server);
+binder_service(surfaceflinger)
+
+# Binder IPC to bu, presently runs in adbd domain.
+binder_call(surfaceflinger, adbd)
+
+# Read /proc/pid files for Binder clients.
+r_dir_file(surfaceflinger, binderservicedomain)
+r_dir_file(surfaceflinger, appdomain)
+
+# Access the GPU.
+allow surfaceflinger gpu_device:chr_file rw_file_perms;
+allow surfaceflinger gpu_device:dir r_dir_perms;
+allow surfaceflinger sysfs_gpu:file r_file_perms;
+
+# Access /dev/graphics/fb0.
+allow surfaceflinger graphics_device:dir search;
+allow surfaceflinger graphics_device:chr_file rw_file_perms;
+
+# Access /dev/video1.
+allow surfaceflinger video_device:dir r_dir_perms;
+allow surfaceflinger video_device:chr_file rw_file_perms;
+
+# Access the secure heap.
+allow surfaceflinger dmabuf_system_secure_heap_device:chr_file r_file_perms;
+
+# Create and use netlink kobject uevent sockets.
+allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# Set properties.
+set_prop(surfaceflinger, system_prop)
+set_prop(surfaceflinger, bootanim_system_prop)
+set_prop(surfaceflinger, exported_system_prop)
+set_prop(surfaceflinger, exported3_system_prop)
+set_prop(surfaceflinger, ctl_bootanim_prop)
+set_prop(surfaceflinger, locale_prop)
+set_prop(surfaceflinger, surfaceflinger_display_prop)
+set_prop(surfaceflinger, timezone_prop)
+
+# Get properties.
+get_prop(surfaceflinger, qemu_sf_lcd_density_prop)
+get_prop(surfaceflinger, device_config_surface_flinger_native_boot_prop)
+
+# Use open files supplied by an app.
+allow surfaceflinger appdomain:fd use;
+allow surfaceflinger { app_data_file privapp_data_file }:file { read write };
+
+# Allow writing surface traces to /data/misc/wmtrace.
+userdebug_or_eng(`
+ allow surfaceflinger wm_trace_data_file:dir rw_dir_perms;
+ allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
+')
+
+# Needed to register as a Perfetto producer.
+perfetto_producer(surfaceflinger)
+
+# Use socket supplied by adbd, for cmd gpu vkjson etc.
+allow surfaceflinger adbd:unix_stream_socket { read write getattr };
+
+# Allow reading and writing to sockets used for BLAST buffer releases.
+# SurfaceFlinger never reads from these sockets but needs read permissions in order to receive
+# the file descriptors over binder. There's no mechanism to mark a socket as write-only.
+# shutdown is used to close the read-end of the sockets that are sent to SurfaceFlinger. See
+# b/353597444
+allow surfaceflinger { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:unix_stream_socket { read write };
+allow surfaceflinger bootanim:unix_stream_socket { read write };
+allow surfaceflinger automotive_display_service:unix_stream_socket { read write };
+
+# Allow a dumpstate triggered screenshot
+binder_call(surfaceflinger, dumpstate)
+binder_call(surfaceflinger, shell)
+r_dir_file(surfaceflinger, dumpstate)
+
+# media.player service
+
+# do not use add_service() as hal_graphics_composer_default may be the
+# provider as well
+#add_service(surfaceflinger, surfaceflinger_service)
+allow surfaceflinger surfaceflinger_service:service_manager { add find };
+
+allow surfaceflinger mediaserver_service:service_manager find;
+allow surfaceflinger permission_service:service_manager find;
+allow surfaceflinger power_service:service_manager find;
+allow surfaceflinger vr_manager_service:service_manager find;
+allow surfaceflinger window_service:service_manager find;
+allow surfaceflinger inputflinger_service:service_manager find;
+
+
+# allow self to set SCHED_FIFO
+allow surfaceflinger self:global_capability_class_set sys_nice;
+allow surfaceflinger proc_meminfo:file r_file_perms;
+r_dir_file(surfaceflinger, cgroup)
+r_dir_file(surfaceflinger, cgroup_v2)
+r_dir_file(surfaceflinger, system_file)
+allow surfaceflinger tmpfs:dir r_dir_perms;
+allow surfaceflinger system_server:fd use;
+allow surfaceflinger system_server:unix_stream_socket { read write };
+allow surfaceflinger ion_device:chr_file r_file_perms;
+allow surfaceflinger dmabuf_system_heap_device:chr_file r_file_perms;
+
+# pdx IPC
+pdx_server(surfaceflinger, display_client)
+pdx_server(surfaceflinger, display_manager)
+pdx_server(surfaceflinger, display_screenshot)
+pdx_server(surfaceflinger, display_vsync)
+
+pdx_client(surfaceflinger, bufferhub_client)
+pdx_client(surfaceflinger, performance_client)
+
+# Allow supplying timestats statistics to statsd
+allow surfaceflinger stats_service:service_manager find;
+allow surfaceflinger statsmanager_service:service_manager find;
+# TODO(146461633): remove this once native pullers talk to StatsManagerService
+binder_call(surfaceflinger, statsd);
+# Allow pushing atoms to the stats bootstrap atom service
+allow surfaceflinger statsbootstrap_service:service_manager find;
+
+# Allow to use files supplied by hal_evs
+allow surfaceflinger hal_evs:fd use;
+
+# Allow to use release fence fds supplied by hal_camera
+allow surfaceflinger hal_camera:fd use;
+
+
+# Surfaceflinger should not be reading default vendor-defined properties.
+dontaudit surfaceflinger vendor_default_prop:file read;
+
+###
+### Neverallow rules
+###
+### surfaceflinger should NEVER do any of this
+
+# Do not allow accessing SDcard files as unsafe ejection could
+# cause the kernel to kill the process.
+neverallow surfaceflinger { sdcard_type fuse }:file rw_file_perms;
+
+# b/68864350
+dontaudit surfaceflinger unlabeled:dir search;
diff --git a/prebuilts/api/202504/private/system_app.te b/prebuilts/api/202504/private/system_app.te
new file mode 100644
index 0000000..9a70375
--- /dev/null
+++ b/prebuilts/api/202504/private/system_app.te
@@ -0,0 +1,208 @@
+###
+### Apps that run with the system UID, e.g. com.android.system.ui,
+### com.android.settings. These are not as privileged as the system
+### server.
+###
+
+typeattribute system_app coredomain, mlstrustedsubject;
+
+app_domain(system_app)
+net_domain(system_app)
+binder_service(system_app)
+
+# android.ui and system.ui
+allow system_app rootfs:dir getattr;
+
+# read/write certain subdirectories of /data/data for system UID apps.
+allow system_app system_app_data_file:dir create_dir_perms;
+allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
+
+# Read and write to /data/misc/user.
+allow system_app misc_user_data_file:dir create_dir_perms;
+allow system_app misc_user_data_file:file create_file_perms;
+
+# Access to apex files stored on /data (b/136063500)
+# Needed so that Settings can access NOTICE files inside apex
+# files located in the assets/ directory.
+allow system_app apex_data_file:dir search;
+allow system_app staging_data_file:file r_file_perms;
+
+# Read wallpaper file.
+allow system_app wallpaper_file:file r_file_perms;
+
+# Read icon file.
+allow system_app icon_file:file r_file_perms;
+
+# Write to properties
+set_prop(system_app, adaptive_haptics_prop)
+set_prop(system_app, arm64_memtag_prop)
+set_prop(system_app, bluetooth_a2dp_offload_prop)
+set_prop(system_app, bluetooth_audio_hal_prop)
+set_prop(system_app, bluetooth_prop)
+set_prop(system_app, debug_prop)
+set_prop(system_app, system_prop)
+set_prop(system_app, exported_bluetooth_prop)
+set_prop(system_app, exported_system_prop)
+set_prop(system_app, exported3_system_prop)
+set_prop(system_app, gesture_prop)
+set_prop(system_app, locale_prop)
+set_prop(system_app, logd_prop)
+set_prop(system_app, net_radio_prop)
+set_prop(system_app, timezone_prop)
+set_prop(system_app, usb_control_prop)
+set_prop(system_app, usb_prop)
+set_prop(system_app, log_tag_prop)
+set_prop(system_app, drm_forcel3_prop)
+userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
+auditallow system_app net_radio_prop:property_service set;
+auditallow system_app usb_control_prop:property_service set;
+auditallow system_app usb_prop:property_service set;
+# Allow Settings to enable Dynamic System Update
+set_prop(system_app, dynamic_system_prop)
+
+# ctl interface
+set_prop(system_app, ctl_default_prop)
+set_prop(system_app, ctl_bugreport_prop)
+
+# Allow developer settings to query gsid status
+get_prop(system_app, gsid_prop)
+
+# Allow developer settings to check 16k pages boot option status
+get_prop(system_app, enable_16k_pages_prop)
+
+# Allow developer settings to check virtualization capabilities
+get_prop(system_app, hypervisor_prop)
+
+# Create /data/anr/traces.txt.
+allow system_app anr_data_file:dir ra_dir_perms;
+allow system_app anr_data_file:file create_file_perms;
+
+# Settings need to access app name and icon from asec
+allow system_app asec_apk_file:file r_file_perms;
+
+# Allow system apps (like Settings) to interact with statsd
+binder_call(system_app, statsd)
+
+# Allow system apps to interact with incidentd
+binder_call(system_app, incidentd)
+
+# Allow system apps (Settings) to call into update_engine
+# in order to apply update to switch from 4k kernel to 16K and vice-versa
+binder_use(system_app)
+allow system_app update_engine_stable_service:service_manager find;
+binder_call(system_app, update_engine)
+
+# Allow system app to interact with Dumpstate HAL
+hal_client_domain(system_app, hal_dumpstate)
+
+allow system_app servicemanager:service_manager list;
+# TODO: scope this down? Too broad?
+allow system_app {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -dumpstate_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -system_suspend_control_internal_service
+ -system_suspend_control_service
+ -tracingproxy_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+}:service_manager find;
+# suppress denials for services system_app should not be accessing.
+dontaudit system_app {
+ dnsresolver_service
+ dumpstate_service
+ installd_service
+ mdns_service
+ netd_service
+ virtual_touchpad_service
+ vold_service
+}:service_manager find;
+
+# suppress denials caused by debugfs_tracing
+dontaudit system_app debugfs_tracing:file rw_file_perms;
+
+# Ignore access to memory properties for Settings.
+dontaudit system_app proc_pagetypeinfo:file r_file_perms;
+dontaudit system_app sysfs_zram:dir search;
+
+allow system_app keystore:keystore2_key {
+ delete
+ get_info
+ grant
+ rebind
+ update
+ use
+};
+
+# Allow Settings to manage WI-FI keys.
+allow system_app wifi_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# settings app reads /proc/version
+allow system_app {
+ proc_version
+}:file r_file_perms;
+
+# Allow system apps to modify cgroup attributes and migrate processes
+allow system_app cgroup:file w_file_perms;
+allow system_app cgroup_v2:file w_file_perms;
+allow system_app cgroup_v2:dir w_dir_perms;
+
+control_logd(system_app)
+read_runtime_log_tags(system_app)
+get_prop(system_app, device_logging_prop)
+
+# allow system apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow system_app system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# allow system apps to read game manager related sysrops
+get_prop(system_app, game_manager_config_prop)
+
+# Settings app reads ro.oem_unlock_supported
+get_prop(system_app, oem_unlock_prop)
+
+# Settings app reads ro.usb.uvc.enabled
+get_prop(system_app, usb_uvc_enabled_prop)
+
+# Settings app reads and writes the wifi blob database
+allow system_app connectivityblob_data_file:dir rw_dir_perms;
+allow system_app connectivityblob_data_file:file create_file_perms;
+
+###
+### Neverallow rules
+###
+
+# app domains which access /dev/fuse should not run as system_app
+neverallow system_app fuse_device:chr_file *;
+
+# Apps which run as UID=system should not rely on any attacker controlled
+# filesystem locations, such as /data/local/tmp. For /data/local/tmp, we
+# allow writes to files passed by file descriptor to support dumpstate and
+# bug reports, but not reads.
+neverallow system_app shell_data_file:dir { no_w_dir_perms open search read };
+neverallow system_app shell_data_file:file { open read ioctl lock };
+
+# system_app should be the only domain writing the adaptive haptics prop
+neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set;
+# system_app should be the only domain writing the force l3 prop
+neverallow { domain -init -system_app } drm_forcel3_prop:property_service set;
+
+allow system_app vendor_boot_ota_file:dir { r_dir_perms };
+allow system_app vendor_boot_ota_file:file { r_file_perms };
+
+# allow system_app to read system_dlkm_file for /system_dlkm/etc/NOTICE.xml.gz
+allow system_app system_dlkm_file:dir search;
+allow system_app system_dlkm_file:file { getattr open read };
diff --git a/prebuilts/api/202504/private/system_server.te b/prebuilts/api/202504/private/system_server.te
new file mode 100644
index 0000000..20556ab
--- /dev/null
+++ b/prebuilts/api/202504/private/system_server.te
@@ -0,0 +1,1717 @@
+#
+# System Server aka system_server spawned by zygote.
+# Most of the framework services run in this process.
+#
+
+typeattribute system_server coredomain;
+typeattribute system_server mlstrustedsubject;
+typeattribute system_server remote_provisioning_service_server;
+typeattribute system_server scheduler_service_server;
+typeattribute system_server sensor_service_server;
+typeattribute system_server stats_service_server;
+typeattribute system_server bpfdomain;
+
+# Define a type for tmpfs-backed ashmem regions.
+tmpfs_domain(system_server)
+
+userfaultfd_use(system_server)
+
+# Create a socket for connections from crash_dump.
+type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
+
+# Create a socket for connections from zygotes.
+type_transition system_server system_data_file:sock_file system_unsolzygote_socket "unsolzygotesocket";
+
+allow system_server zygote_tmpfs:file { map read };
+allow system_server appdomain_tmpfs:file { getattr map read write };
+
+# For Incremental Service to check if incfs is available
+allow system_server proc_filesystems:file r_file_perms;
+
+# To create files, get permission to fill blocks, and configure Incremental File System
+allow system_server incremental_control_file:file { ioctl r_file_perms };
+allowxperm system_server incremental_control_file:file ioctl {
+ INCFS_IOCTL_CREATE_FILE
+ INCFS_IOCTL_CREATE_MAPPED_FILE
+ INCFS_IOCTL_PERMIT_FILL
+ INCFS_IOCTL_GET_READ_TIMEOUTS
+ INCFS_IOCTL_SET_READ_TIMEOUTS
+ INCFS_IOCTL_GET_LAST_READ_ERROR
+};
+
+# To get signature of an APK installed on Incremental File System, and fill in data
+# blocks and get the filesystem state
+allowxperm system_server apk_data_file:file ioctl {
+ INCFS_IOCTL_READ_SIGNATURE
+ INCFS_IOCTL_FILL_BLOCKS
+ INCFS_IOCTL_GET_FILLED_BLOCKS
+ INCFS_IOCTL_GET_BLOCK_COUNT
+ F2FS_IOC_GET_FEATURES
+ F2FS_IOC_GET_COMPRESS_BLOCKS
+ F2FS_IOC_COMPRESS_FILE
+ F2FS_IOC_DECOMPRESS_FILE
+ F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+ F2FS_IOC_RESERVE_COMPRESS_BLOCKS
+ FS_IOC_SETFLAGS
+ FS_IOC_GETFLAGS
+};
+
+allowxperm system_server apk_tmp_file:file ioctl {
+ F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+ FS_IOC_GETFLAGS
+};
+
+# For Incremental Service to check incfs metrics
+allow system_server sysfs_fs_incfs_metrics:file r_file_perms;
+
+# For f2fs-compression support
+allow system_server sysfs_fs_f2fs:dir r_dir_perms;
+allow system_server sysfs_fs_f2fs:file r_file_perms;
+
+# For SdkSandboxManagerService
+allow system_server sdk_sandbox_system_data_file:dir create_dir_perms;
+
+# For art.
+allow system_server { apex_art_data_file dalvikcache_data_file }:dir r_dir_perms;
+allow system_server { apex_art_data_file dalvikcache_data_file }:file r_file_perms;
+
+# Ignore the denial on `system@framework@com.android.location.provider.jar@classes.odex`.
+# `com.android.location.provider.jar` happens to be both a jar on system server classpath and a
+# shared library used by a system server app. The odex file is loaded fine by Zygote when it forks
+# system_server. It fails to be loaded when the jar is used as a shared library, which is expected.
+dontaudit system_server apex_art_data_file:file execute;
+
+# For release odex/vdex compress blocks
+allowxperm system_server dalvikcache_data_file:file ioctl {
+ F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+ FS_IOC_GETFLAGS
+};
+
+# When running system server under --invoke-with, we'll try to load the boot image under the
+# system server domain, following links to the system partition.
+with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;')
+
+# /data/resource-cache
+allow system_server resourcecache_data_file:file r_file_perms;
+allow system_server resourcecache_data_file:dir r_dir_perms;
+
+# ptrace to processes in the same domain for debugging crashes.
+allow system_server self:process ptrace;
+
+# Child of the zygote.
+allow system_server zygote:fd use;
+allow system_server zygote:process sigchld;
+
+# May kill zygote (or its child processes) on crashes.
+allow system_server {
+ app_zygote
+ crash_dump
+ crosvm
+ virtualizationmanager
+ webview_zygote
+ zygote
+}:process { getpgid sigkill signull };
+
+# Read /system/bin/app_process.
+allow system_server zygote_exec:file r_file_perms;
+
+# Needed to close the zygote socket, which involves getopt / getattr
+allow system_server zygote:unix_stream_socket { getopt getattr };
+
+# system server gets network and bluetooth permissions.
+net_domain(system_server)
+# in addition to ioctls allowlisted for all domains, also allow system_server
+# to use privileged ioctls commands. Needed to set up VPNs.
+allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
+bluetooth_domain(system_server)
+
+# Allow setup of tcp keepalive offload. This gives system_server the permission to
+# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to
+# be granted individually, except for a small set of safe values allowlisted in
+# public/domain.te.
+allow system_server appdomain:tcp_socket ioctl;
+
+# These are the capabilities assigned by the zygote to the
+# system server.
+allow system_server self:global_capability_class_set {
+ ipc_lock
+ kill
+ net_admin
+ net_bind_service
+ net_broadcast
+ net_raw
+ sys_boot
+ sys_nice
+ sys_ptrace
+ sys_time
+ sys_tty_config
+};
+
+# Allow alarmtimers to be set
+allow system_server self:global_capability2_class_set wake_alarm;
+
+# Create and share netlink_netfilter_sockets for tetheroffload.
+allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl;
+
+# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps.
+allow system_server self:netlink_tcpdiag_socket
+ { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
+
+# Use netlink uevent sockets.
+allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+allow system_server self:netlink_nflog_socket create_socket_perms_no_ioctl;
+
+# Use generic netlink sockets.
+allow system_server self:netlink_socket create_socket_perms_no_ioctl;
+allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
+
+# libvintf reads the kernel config to verify vendor interface compatibility.
+allow system_server config_gz:file { read open };
+
+# Use generic "sockets" where the address family is not known
+# to the kernel. The ioctl permission is specifically omitted here, but may
+# be added to device specific policy along with the ioctl commands to be
+# allowlisted.
+allow system_server self:socket create_socket_perms_no_ioctl;
+
+# Set and get routes directly via netlink.
+allow system_server self:netlink_route_socket nlmsg_write;
+
+# Use XFRM (IPsec) netlink sockets
+allow system_server self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
+
+# Kill apps.
+allow system_server appdomain:process { getpgid sigkill signal };
+# signull allowed for kill(pid, 0) existence test.
+allow system_server appdomain:process { signull };
+
+# Set scheduling info for apps.
+allow system_server appdomain:process { getsched setsched };
+allow system_server audioserver:process { getsched setsched };
+allow system_server hal_audio:process { getsched setsched };
+allow system_server hal_bluetooth:process { getsched setsched };
+allow system_server hal_codec2_server:process { getsched setsched };
+allow system_server hal_omx_server:process { getsched setsched };
+allow system_server mediaswcodec:process { getsched setsched };
+allow system_server cameraserver:process { getsched setsched };
+allow system_server hal_camera:process { getsched setsched };
+allow system_server mediaserver:process { getsched setsched };
+allow system_server bootanim:process { getsched setsched };
+# Set scheduling info for VMs (b/375058190)
+allow system_server { virtualizationmanager crosvm }:process { getsched setsched };
+
+# Set scheduling info for psi monitor thread.
+# TODO: delete this line b/131761776
+allow system_server kernel:process { getsched setsched };
+
+# Allow system_server to write to /proc/<pid>/*
+allow system_server domain:file w_file_perms;
+
+# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
+# within system_server to keep track of memory and CPU usage for
+# all processes on the device. In addition, /proc/pid files access is needed
+# for dumping stack traces of native processes.
+r_dir_file(system_server, domain)
+
+# Write /proc/uid_cputime/remove_uid_range.
+allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
+
+# Write /proc/uid_procstat/set.
+allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
+
+# Write to /proc/sysrq-trigger.
+allow system_server proc_sysrq:file rw_file_perms;
+
+# Delete /data/misc/stats-service/ directories.
+allow system_server stats_config_data_file:dir { open read remove_name search write };
+allow system_server stats_config_data_file:file unlink;
+
+# Read metric file & upload to statsd
+allow system_server odsign_data_file:dir search;
+allow system_server odsign_metrics_file:dir { r_dir_perms write remove_name };
+allow system_server odsign_metrics_file:file { r_file_perms unlink };
+
+# Read /sys/kernel/debug/wakeup_sources.
+no_debugfs_restriction(`
+ allow system_server debugfs_wakeup_sources:file r_file_perms;
+')
+
+# Read /sys/kernel/ion/*.
+allow system_server sysfs_ion:file r_file_perms;
+
+# Read /sys/kernel/dma_heap/*.
+allow system_server sysfs_dma_heap:file r_file_perms;
+
+# Read /sys/kernel/mm/cma/*.
+starting_at_board_api(202504, `
+allow system_server sysfs_cma:file r_file_perms;
+')
+
+# Allow reading DMA-BUF sysfs stats from /sys/kernel/dmabuf.
+allow system_server sysfs_dmabuf_stats:dir r_dir_perms;
+allow system_server sysfs_dmabuf_stats:file r_file_perms;
+
+# Allow ActivityManager to look at the list of DMA-BUF heaps from /dev/dma_heap
+# for dumpsys meminfo
+allow system_server dmabuf_heap_device:dir r_dir_perms;
+
+# Allow reading /proc/vmstat for the oom kill count
+allow system_server proc_vmstat:file r_file_perms;
+
+# The DhcpClient and WifiWatchdog use packet_sockets
+allow system_server self:packet_socket create_socket_perms_no_ioctl;
+
+# 3rd party VPN clients require a tun_socket to be created
+allow system_server self:tun_socket create_socket_perms_no_ioctl;
+
+# Talk to init and various daemons via sockets.
+unix_socket_connect(system_server, lmkd, lmkd)
+unix_socket_connect(system_server, zygote, zygote)
+unix_socket_connect(system_server, uncrypt, uncrypt)
+
+# Allow system_server to write to statsd.
+unix_socket_send(system_server, statsdw, statsd)
+
+# Communicate over a socket created by surfaceflinger.
+allow system_server surfaceflinger:unix_stream_socket { read write setopt };
+
+allow system_server gpuservice:unix_stream_socket { read write setopt };
+
+# Communicate over a socket created by webview_zygote.
+allow system_server webview_zygote:unix_stream_socket { read write connectto setopt };
+
+# Communicate over a socket created by app_zygote.
+allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
+
+# Perform Binder IPC.
+binder_use(system_server)
+binder_call(system_server, appdomain)
+binder_call(system_server, artd)
+binder_call(system_server, binderservicedomain)
+binder_call(system_server, composd)
+binder_call(system_server, dexopt_chroot_setup)
+binder_call(system_server, dumpstate)
+binder_call(system_server, fingerprintd)
+binder_call(system_server, gatekeeperd)
+binder_call(system_server, gpuservice)
+binder_call(system_server, idmap)
+binder_call(system_server, installd)
+binder_call(system_server, incidentd)
+binder_call(system_server, mmd)
+binder_call(system_server, netd)
+binder_call(system_server, ot_daemon)
+userdebug_or_eng(`binder_call(system_server, profcollectd)')
+binder_call(system_server, statsd)
+binder_call(system_server, storaged)
+binder_call(system_server, update_engine)
+binder_call(system_server, virtual_camera)
+binder_call(system_server, vold)
+binder_call(system_server, logd)
+binder_call(system_server, wificond)
+binder_call(system_server, uprobestats)
+binder_call(system_server, wifi_mainline_supplicant)
+binder_service(system_server)
+
+# Use HALs
+hal_client_domain(system_server, hal_allocator)
+hal_client_domain(system_server, hal_audio)
+hal_client_domain(system_server, hal_authgraph)
+hal_client_domain(system_server, hal_authsecret)
+hal_client_domain(system_server, hal_bluetooth)
+hal_client_domain(system_server, hal_broadcastradio)
+hal_client_domain(system_server, hal_codec2)
+hal_client_domain(system_server, hal_configstore)
+hal_client_domain(system_server, hal_contexthub)
+hal_client_domain(system_server, hal_face)
+hal_client_domain(system_server, hal_fingerprint)
+hal_client_domain(system_server, hal_gnss)
+hal_client_domain(system_server, hal_graphics_allocator)
+hal_client_domain(system_server, hal_health)
+hal_client_domain(system_server, hal_input_classifier)
+hal_client_domain(system_server, hal_input_processor)
+hal_client_domain(system_server, hal_ir)
+hal_client_domain(system_server, hal_keymint)
+hal_client_domain(system_server, hal_light)
+hal_client_domain(system_server, hal_mediaquality)
+hal_client_domain(system_server, hal_memtrack)
+hal_client_domain(system_server, hal_neuralnetworks)
+hal_client_domain(system_server, hal_oemlock)
+hal_client_domain(system_server, hal_omx)
+hal_client_domain(system_server, hal_power)
+hal_client_domain(system_server, hal_power_stats)
+hal_client_domain(system_server, hal_rebootescrow)
+hal_client_domain(system_server, hal_remotelyprovisionedcomponent_avf)
+hal_client_domain(system_server, hal_sensors)
+hal_client_domain(system_server, hal_secretkeeper)
+hal_client_domain(system_server, hal_tetheroffload)
+hal_client_domain(system_server, hal_thermal)
+hal_client_domain(system_server, hal_threadnetwork)
+hal_client_domain(system_server, hal_tv_cec)
+hal_client_domain(system_server, hal_tv_hdmi_cec)
+hal_client_domain(system_server, hal_tv_hdmi_connection)
+hal_client_domain(system_server, hal_tv_hdmi_earc)
+hal_client_domain(system_server, hal_tv_input)
+hal_client_domain(system_server, hal_usb)
+hal_client_domain(system_server, hal_usb_gadget)
+hal_client_domain(system_server, hal_uwb)
+hal_client_domain(system_server, hal_vibrator)
+hal_client_domain(system_server, hal_vr)
+hal_client_domain(system_server, hal_weaver)
+hal_client_domain(system_server, hal_wifi)
+hal_client_domain(system_server, hal_wifi_hostapd)
+hal_client_domain(system_server, hal_wifi_supplicant)
+# The bootctl is a pass through HAL mode under recovery mode. So we skip the
+# permission for recovery in order not to give system server the access to
+# the low level block devices.
+not_recovery(`hal_client_domain(system_server, hal_bootctl)')
+
+# Talk with graphics composer fences
+allow system_server hal_graphics_composer:fd use;
+
+# Use RenderScript always-passthrough HAL
+allow system_server hal_renderscript_hwservice:hwservice_manager find;
+allow system_server same_process_hal_file:file { execute read open getattr map };
+
+# Talk to tombstoned to get ANR traces.
+unix_socket_connect(system_server, tombstoned_intercept, tombstoned)
+
+# List HAL interfaces to get ANR traces.
+allow system_server hwservicemanager:hwservice_manager list;
+allow system_server servicemanager:service_manager list;
+
+# Send signals to trigger ANR traces.
+allow system_server {
+ # This is derived from the list that system server defines as interesting native processes
+ # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
+ # frameworks/base/services/core/java/com/android/server/Watchdog.java.
+ artd
+ audioserver
+ cameraserver
+ drmserver
+ gpuservice
+ inputflinger
+ keystore
+ mediadrmserver
+ mediaextractor
+ mediametrics
+ mediaserver
+ mediaswcodec
+ mediatranscoding
+ mediatuner
+ mmd
+ netd
+ sdcardd
+ servicemanager
+ statsd
+ surfaceflinger
+ vold
+
+ # This list comes from HAL_INTERFACES_OF_INTEREST in
+ # frameworks/base/services/core/java/com/android/server/Watchdog.java.
+ hal_audio_server
+ hal_bluetooth_server
+ hal_camera_server
+ hal_codec2_server
+ hal_drm_server
+ hal_face_server
+ hal_fingerprint_server
+ hal_gnss_server
+ hal_graphics_allocator_server
+ hal_graphics_composer_server
+ hal_health_server
+ hal_input_processor_server
+ hal_light_server
+ hal_neuralnetworks_server
+ hal_omx_server
+ hal_power_server
+ hal_power_stats_server
+ hal_sensors_server
+ hal_vibrator_server
+ hal_vr_server
+ system_suspend_server
+}:process { signal };
+
+# Use sockets received over binder from various services.
+allow system_server audioserver:tcp_socket rw_socket_perms;
+allow system_server audioserver:udp_socket rw_socket_perms;
+allow system_server mediaserver:tcp_socket rw_socket_perms;
+allow system_server mediaserver:udp_socket rw_socket_perms;
+
+# Use sockets received over binder from various services.
+allow system_server mediadrmserver:tcp_socket rw_socket_perms;
+allow system_server mediadrmserver:udp_socket rw_socket_perms;
+
+# Write trace data to the Perfetto traced daemon. This requires connecting to
+# its producer socket and obtaining a (per-process) tmpfs fd.
+perfetto_producer(system_server)
+
+# Get file context
+allow system_server file_contexts_file:file r_file_perms;
+# access for mac_permissions
+allow system_server mac_perms_file: file r_file_perms;
+# Check SELinux permissions.
+selinux_check_access(system_server)
+
+allow system_server sysfs_type:dir r_dir_perms;
+
+r_dir_file(system_server, sysfs_android_usb)
+allow system_server sysfs_android_usb:file w_file_perms;
+
+r_dir_file(system_server, sysfs_extcon)
+
+r_dir_file(system_server, sysfs_ipv4)
+allow system_server sysfs_ipv4:file w_file_perms;
+
+r_dir_file(system_server, sysfs_rtc)
+r_dir_file(system_server, sysfs_switch)
+
+allow system_server sysfs_nfc_power_writable:file rw_file_perms;
+allow system_server sysfs_power:dir search;
+allow system_server sysfs_power:file rw_file_perms;
+allow system_server sysfs_thermal:dir search;
+allow system_server sysfs_thermal:file r_file_perms;
+allow system_server sysfs_uhid:dir r_dir_perms;
+allow system_server sysfs_uhid:file rw_file_perms;
+
+# TODO: Remove when HALs are forced into separate processes
+allow system_server sysfs_vibrator:file { write append };
+
+# TODO: added to match above sysfs rule. Remove me?
+allow system_server sysfs_usb:file w_file_perms;
+
+# Access devices.
+allow system_server device:dir r_dir_perms;
+allow system_server mdns_socket:sock_file rw_file_perms;
+allow system_server gpu_device:chr_file rw_file_perms;
+allow system_server gpu_device:dir r_dir_perms;
+allow system_server sysfs_gpu:file r_file_perms;
+allow system_server input_device:dir r_dir_perms;
+allow system_server input_device:chr_file rw_file_perms;
+allow system_server tty_device:chr_file rw_file_perms;
+allow system_server usbaccessory_device:chr_file rw_file_perms;
+allow system_server video_device:dir r_dir_perms;
+allow system_server video_device:chr_file rw_file_perms;
+allow system_server adbd_socket:sock_file rw_file_perms;
+allow system_server rtc_device:chr_file rw_file_perms;
+allow system_server audio_device:dir r_dir_perms;
+allow system_server uhid_device:chr_file rw_file_perms;
+allow system_server hidraw_device:dir r_dir_perms;
+allow system_server hidraw_device:chr_file rw_file_perms;
+
+# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
+allow system_server audio_device:chr_file rw_file_perms;
+
+# tun device used for 3rd party vpn apps and test network manager
+allow system_server tun_device:chr_file rw_file_perms;
+allowxperm system_server tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETLINK TUNSETCARRIER };
+
+# Manage data/ota_package
+allow system_server ota_package_file:dir rw_dir_perms;
+allow system_server ota_package_file:file create_file_perms;
+
+# Manage system data files.
+allow system_server system_data_file:dir create_dir_perms;
+allow system_server system_data_file:notdevfile_class_set create_file_perms;
+allow system_server packages_list_file:file create_file_perms;
+allow system_server game_mode_intervention_list_file:file create_file_perms;
+allow system_server keychain_data_file:dir create_dir_perms;
+allow system_server keychain_data_file:file create_file_perms;
+allow system_server keychain_data_file:lnk_file create_file_perms;
+
+# Read the user parent directories like /data/user. Don't allow write access,
+# as vold is responsible for creating and deleting the subdirectories.
+allow system_server system_userdir_file:dir r_dir_perms;
+
+# Manage /data/app.
+allow system_server apk_data_file:dir create_dir_perms;
+allow system_server apk_data_file:{ file lnk_file } { create_file_perms link };
+allow system_server apk_tmp_file:dir create_dir_perms;
+allow system_server apk_tmp_file:file create_file_perms;
+
+# Manage /data/app-metadata
+allow system_server apk_metadata_file:dir create_dir_perms;
+allow system_server apk_metadata_file:file create_file_perms;
+
+# Access input configuration files in the /vendor directory
+r_dir_file(system_server, vendor_keylayout_file)
+r_dir_file(system_server, vendor_keychars_file)
+r_dir_file(system_server, vendor_idc_file)
+get_prop(system_server, input_device_config_prop)
+
+# Access /vendor/{app,framework,overlay}
+r_dir_file(system_server, vendor_app_file)
+r_dir_file(system_server, vendor_framework_file)
+r_dir_file(system_server, vendor_overlay_file)
+
+# Manage /data/app-private.
+allow system_server apk_private_data_file:dir create_dir_perms;
+allow system_server apk_private_data_file:file create_file_perms;
+allow system_server apk_private_tmp_file:dir create_dir_perms;
+allow system_server apk_private_tmp_file:file create_file_perms;
+
+# Manage files within asec containers.
+allow system_server asec_apk_file:dir create_dir_perms;
+allow system_server asec_apk_file:file create_file_perms;
+allow system_server asec_public_file:file create_file_perms;
+
+# Manage /data/anr.
+#
+# TODO: Some of these permissions can be withdrawn once we've switched to the
+# new stack dumping mechanism, see b/32064548 and the rules below. In particular,
+# the system_server should never need to create a new anr_data_file:file or write
+# to one, but it will still need to read and append to existing files.
+allow system_server anr_data_file:dir create_dir_perms;
+allow system_server anr_data_file:file create_file_perms;
+
+# New stack dumping scheme : request an output FD from tombstoned via a unix
+# domain socket.
+#
+# Allow system_server to connect and write to the tombstoned java trace socket in
+# order to dump its traces. Also allow the system server to write its traces to
+# dumpstate during bugreport capture and incidentd during incident collection.
+unix_socket_connect(system_server, tombstoned_java_trace, tombstoned)
+allow system_server tombstoned:fd use;
+allow system_server dumpstate:fifo_file append;
+allow system_server incidentd:fifo_file append;
+# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`)
+userdebug_or_eng(`
+ allow system_server su:fifo_file append;
+')
+
+# Allow system_server to read pipes from incidentd (used to deliver incident reports
+# to dropbox)
+allow system_server incidentd:fifo_file read;
+
+# Read /data/misc/incidents - only read. The fd will be sent over binder,
+# with no DAC access to it, for dropbox to read.
+allow system_server incident_data_file:file read;
+
+# Manage /data/misc/prereboot.
+allow system_server prereboot_data_file:dir rw_dir_perms;
+allow system_server prereboot_data_file:file create_file_perms;
+
+# Allow tracing proxy service to read traces. Only the fd is sent over
+# binder.
+allow system_server perfetto_traces_data_file:file { read getattr };
+allow system_server perfetto:fd use;
+
+# Allow system_server to exec the perfetto cmdline client and pass it a trace config
+domain_auto_trans(system_server, perfetto_exec, perfetto);
+allow system_server perfetto:fifo_file { read write };
+
+# Allow system server to manage perfetto traces for ProfilingService.
+allow system_server perfetto_traces_profiling_data_file:dir rw_dir_perms;
+allow system_server perfetto_traces_profiling_data_file:file create_file_perms;
+allow system_server perfetto_traces_data_file:dir search;
+
+# Allow system server to exec the trace redactor cmdline client and kill the process for
+# ProfilingService.
+domain_auto_trans(system_server, trace_redactor_exec, trace_redactor);
+allow system_server trace_redactor:process signal;
+
+# Allow system server to kill perfetto processes for ProfilingService.
+allow system_server perfetto:process signal;
+
+# Manage /data/backup.
+allow system_server backup_data_file:dir create_dir_perms;
+allow system_server backup_data_file:file create_file_perms;
+
+# Write to /data/system/dropbox
+allow system_server dropbox_data_file:dir create_dir_perms;
+allow system_server dropbox_data_file:file create_file_perms;
+
+# Write to /data/system/heapdump
+allow system_server heapdump_data_file:dir rw_dir_perms;
+allow system_server heapdump_data_file:file create_file_perms;
+
+# Manage /data/misc/adb.
+allow system_server adb_keys_file:dir create_dir_perms;
+allow system_server adb_keys_file:file create_file_perms;
+
+# Manage /data/misc/appcompat.
+allow system_server appcompat_data_file:dir rw_dir_perms;
+allow system_server appcompat_data_file:file create_file_perms;
+
+# Manage /data/misc/connectivityblobdb.
+# Specifically, for vpn and wifi to create, read and write to an sqlite database.
+allow system_server connectivityblob_data_file:dir create_dir_perms;
+allow system_server connectivityblob_data_file:file create_file_perms;
+
+# Manage /data/misc/emergencynumberdb
+allow system_server emergency_data_file:dir create_dir_perms;
+allow system_server emergency_data_file:file create_file_perms;
+
+# Manage /data/misc/network_watchlist
+allow system_server network_watchlist_data_file:dir create_dir_perms;
+allow system_server network_watchlist_data_file:file create_file_perms;
+
+# Manage /data/misc/sms.
+# TODO: Split into a separate type?
+allow system_server radio_data_file:dir create_dir_perms;
+allow system_server radio_data_file:file create_file_perms;
+
+# Manage /data/misc/systemkeys.
+allow system_server systemkeys_data_file:dir create_dir_perms;
+allow system_server systemkeys_data_file:file create_file_perms;
+
+# Manage /data/misc/textclassifier.
+allow system_server textclassifier_data_file:dir create_dir_perms;
+allow system_server textclassifier_data_file:file create_file_perms;
+
+# Manage /data/tombstones.
+allow system_server tombstone_data_file:dir rw_dir_perms;
+allow system_server tombstone_data_file:file create_file_perms;
+
+# Manage /data/misc/vpn.
+allow system_server vpn_data_file:dir create_dir_perms;
+allow system_server vpn_data_file:file create_file_perms;
+
+# Manage /data/misc/wifi.
+allow system_server wifi_data_file:dir create_dir_perms;
+allow system_server wifi_data_file:file create_file_perms;
+
+# Manage /data/app-staging.
+allow system_server staging_data_file:dir create_dir_perms;
+allow system_server staging_data_file:file create_file_perms;
+
+# Manage /data/rollback.
+allow system_server staging_data_file:{ file lnk_file } { create_file_perms link };
+
+# Walk /data/data subdirectories.
+allow system_server app_data_file_type:dir { getattr read search };
+
+# Also permit for unlabeled /data/data subdirectories and
+# for unlabeled asec containers on upgrades from 4.2.
+allow system_server unlabeled:dir r_dir_perms;
+# Read pkg.apk file before it has been relabeled by vold.
+allow system_server unlabeled:file r_file_perms;
+
+# Populate com.android.providers.settings/databases/settings.db.
+allow system_server system_app_data_file:dir create_dir_perms;
+allow system_server system_app_data_file:file create_file_perms;
+
+# Receive and use open app data files passed over binder IPC.
+allow system_server app_data_file_type:file { getattr read write append map };
+
+# Access to /data/media for measuring disk usage.
+allow system_server media_rw_data_file:dir { search getattr open read };
+
+# Receive and use open /data/media files passed over binder IPC.
+# Also used for measuring disk usage.
+allow system_server media_rw_data_file:file { getattr read write append };
+
+# System server needs to setfscreate to packages_list_file when writing
+# /data/system/packages.list
+allow system_server system_server:process setfscreate;
+
+# Relabel apk files.
+allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
+allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
+# Allow PackageManager to:
+# 1. rename file from /data/app-staging folder to /data/app
+# 2. relabel files (linked to /data/rollback) under /data/app-staging
+# during staged apk/apex install.
+allow system_server { staging_data_file }:{ dir file } { relabelfrom relabelto };
+
+# Relabel wallpaper.
+allow system_server system_data_file:file relabelfrom;
+allow system_server wallpaper_file:file relabelto;
+allow system_server wallpaper_file:file { rw_file_perms rename unlink };
+
+# Backup of wallpaper imagery uses temporary hard links to avoid data churn
+allow system_server { system_data_file wallpaper_file }:file link;
+
+# ShortcutManager icons
+allow system_server system_data_file:dir relabelfrom;
+allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto };
+allow system_server shortcut_manager_icons:file create_file_perms;
+
+# Manage ringtones.
+allow system_server ringtone_file:dir { create_dir_perms relabelto };
+allow system_server ringtone_file:file create_file_perms;
+
+# Relabel icon file.
+allow system_server icon_file:file relabelto;
+allow system_server icon_file:file { rw_file_perms unlink };
+
+# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
+allow system_server system_data_file:dir relabelfrom;
+
+# server_configurable_flags_data_file is used for storing server configurable flags which
+# have been reset during current booting. system_server needs to read the data to perform related
+# disaster recovery actions.
+allow system_server server_configurable_flags_data_file:dir r_dir_perms;
+allow system_server server_configurable_flags_data_file:file r_file_perms;
+
+# Property Service write
+set_prop(system_server, system_prop)
+set_prop(system_server, bootanim_system_prop)
+set_prop(system_server, bluetooth_prop)
+set_prop(system_server, exported_system_prop)
+set_prop(system_server, exported3_system_prop)
+set_prop(system_server, safemode_prop)
+set_prop(system_server, theme_prop)
+set_prop(system_server, dhcp_prop)
+set_prop(system_server, net_connectivity_prop)
+set_prop(system_server, net_radio_prop)
+set_prop(system_server, net_dns_prop)
+set_prop(system_server, usb_control_prop)
+set_prop(system_server, usb_prop)
+set_prop(system_server, debug_prop)
+set_prop(system_server, powerctl_prop)
+set_prop(system_server, fingerprint_prop)
+set_prop(system_server, device_logging_prop)
+set_prop(system_server, dumpstate_options_prop)
+set_prop(system_server, overlay_prop)
+set_prop(system_server, exported_overlay_prop)
+set_prop(system_server, pm_prop)
+set_prop(system_server, exported_pm_prop)
+set_prop(system_server, socket_hook_prop)
+set_prop(system_server, audio_prop)
+set_prop(system_server, boot_status_prop)
+set_prop(system_server, surfaceflinger_color_prop)
+set_prop(system_server, provisioned_prop)
+set_prop(system_server, retaildemo_prop)
+set_prop(system_server, dmesgd_start_prop)
+set_prop(system_server, locale_prop)
+set_prop(system_server, timezone_metadata_prop)
+set_prop(system_server, timezone_prop)
+set_prop(system_server, crashrecovery_prop)
+userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
+userdebug_or_eng(`set_prop(system_server, system_user_mode_emulation_prop)')
+
+# ctl interface
+set_prop(system_server, ctl_default_prop)
+set_prop(system_server, ctl_bugreport_prop)
+set_prop(system_server, ctl_gsid_prop)
+set_prop(system_server, ctl_artd_pre_reboot_prop)
+
+# cppreopt property
+set_prop(system_server, cppreopt_prop)
+
+# server configurable flags properties
+set_prop(system_server, device_config_core_experiments_team_internal_prop)
+set_prop(system_server, device_config_edgetpu_native_prop)
+set_prop(system_server, device_config_input_native_boot_prop)
+set_prop(system_server, device_config_netd_native_prop)
+set_prop(system_server, device_config_nnapi_native_prop)
+set_prop(system_server, device_config_activity_manager_native_boot_prop)
+set_prop(system_server, device_config_runtime_native_boot_prop)
+set_prop(system_server, device_config_runtime_native_prop)
+set_prop(system_server, device_config_lmkd_native_prop)
+set_prop(system_server, device_config_media_native_prop)
+set_prop(system_server, device_config_camera_native_prop)
+set_prop(system_server, device_config_mglru_native_prop)
+set_prop(system_server, device_config_profcollect_native_boot_prop)
+set_prop(system_server, device_config_statsd_native_prop)
+set_prop(system_server, device_config_statsd_native_boot_prop)
+set_prop(system_server, device_config_storage_native_boot_prop)
+set_prop(system_server, device_config_swcodec_native_prop)
+set_prop(system_server, device_config_sys_traced_prop)
+set_prop(system_server, device_config_window_manager_native_boot_prop)
+set_prop(system_server, device_config_configuration_prop)
+set_prop(system_server, device_config_connectivity_prop)
+set_prop(system_server, device_config_surface_flinger_native_boot_prop)
+set_prop(system_server, device_config_aconfig_flags_prop)
+set_prop(system_server, device_config_vendor_system_native_prop)
+set_prop(system_server, device_config_vendor_system_native_boot_prop)
+set_prop(system_server, device_config_virtualization_framework_native_prop)
+set_prop(system_server, device_config_memory_safety_native_boot_prop)
+set_prop(system_server, device_config_memory_safety_native_prop)
+set_prop(system_server, device_config_remote_key_provisioning_native_prop)
+set_prop(system_server, device_config_tethering_u_or_later_native_prop)
+set_prop(system_server, device_config_mmd_native_prop)
+set_prop(system_server, smart_idle_maint_enabled_prop)
+set_prop(system_server, arm64_memtag_prop)
+
+# staged flag properties
+set_prop(system_server, next_boot_prop)
+
+# Allow system server to read pm.16kb.app_compat.disabled
+get_prop(system_server, pm_16kb_app_compat_prop)
+
+# Allow query ART device config properties
+get_prop(system_server, device_config_runtime_native_boot_prop)
+get_prop(system_server, device_config_runtime_native_prop)
+
+# BootReceiver to read ro.boot.bootreason
+get_prop(system_server, bootloader_boot_reason_prop)
+# PowerManager to read sys.boot.reason
+get_prop(system_server, system_boot_reason_prop)
+
+# Collect metrics on boot time created by init
+get_prop(system_server, boottime_prop)
+
+# Read device's serial number from system properties
+get_prop(system_server, serialno_prop)
+
+# Read/write the property which keeps track of whether this is the first start of system_server
+set_prop(system_server, firstboot_prop)
+
+# Audio service in system server can read audio config properties,
+# such as camera shutter enforcement
+get_prop(system_server, audio_config_prop)
+
+# StorageManager service reads media config while checking if transcoding is supported.
+get_prop(system_server, media_config_prop)
+
+# system server reads this property to keep track of whether server configurable flags have been
+# reset during current boot.
+get_prop(system_server, device_config_reset_performed_prop)
+
+# Read/write the property that enables Test Harness Mode
+set_prop(system_server, test_harness_prop)
+
+# Read gsid.image_running.
+get_prop(system_server, gsid_prop)
+
+# Read the property that mocks an OTA
+get_prop(system_server, mock_ota_prop)
+
+# Read the property as feature flag for protecting apks with fs-verity.
+get_prop(system_server, apk_verity_prop)
+
+# Read wifi.interface
+get_prop(system_server, wifi_prop)
+
+# Read the vendor property that indicates if Incremental features is enabled
+get_prop(system_server, incremental_prop)
+
+# Read ro.zram. properties
+get_prop(system_server, zram_config_prop)
+
+# Read/write persist.sys.zram_enabled
+set_prop(system_server, zram_control_prop)
+
+# Read/write persist.sys.dalvik.vm.lib.2
+set_prop(system_server, dalvik_runtime_prop)
+
+# Read ro.control_privapp_permissions and ro.cp_system_other_odex
+get_prop(system_server, packagemanager_config_prop)
+
+# Read the net.464xlat.cellular.enabled property (written by init).
+get_prop(system_server, net_464xlat_fromvendor_prop)
+
+# Read hypervisor capabilities ro.boot.hypervisor.*
+get_prop(system_server, hypervisor_prop)
+
+# Read persist.wm.debug. properties
+get_prop(system_server, persist_wm_debug_prop)
+
+# Read persist.sysui.notification.builder_extras_override property
+get_prop(system_server, persist_sysui_builder_extras_prop)
+# Read persist.sysui.notification.ranking_update_ashmem property
+get_prop(system_server, persist_sysui_ranking_update_prop)
+
+# Read ro.tuner.lazyhal
+get_prop(system_server, tuner_config_prop)
+# Write tuner.server.enable
+set_prop(system_server, tuner_server_ctl_prop)
+
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(system_server, traced_oome_heap_session_count_prop)
+
+# Allow the sensor service (running in the system service) to read sensor
+# configuration properties
+get_prop(system_server, sensors_config_prop)
+
+# Allow system server to determine if system services are enabled
+get_prop(system_server, system_service_enable_prop)
+
+# Create a socket for connections from debuggerd.
+allow system_server system_ndebug_socket:sock_file create_file_perms;
+
+# Create a socket for connections from zygotes.
+allow system_server system_unsolzygote_socket:sock_file create_file_perms;
+
+# Manage cache files.
+allow system_server cache_file:lnk_file r_file_perms;
+allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
+allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
+allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
+
+allow system_server system_file:dir r_dir_perms;
+allow system_server system_file:lnk_file r_file_perms;
+
+# ART locks profile files.
+allow system_server system_file:file lock;
+
+# LocationManager(e.g, GPS) needs to read and write
+# to uart driver and ctrl proc entry
+allow system_server gps_control:file rw_file_perms;
+
+# Allow system_server to use app-created sockets and pipes.
+allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
+allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
+
+# BackupManagerService needs to manipulate backup data files
+allow system_server cache_backup_file:dir rw_dir_perms;
+allow system_server cache_backup_file:file create_file_perms;
+# LocalTransport works inside /cache/backup
+allow system_server cache_private_backup_file:dir create_dir_perms;
+allow system_server cache_private_backup_file:file create_file_perms;
+
+# Allow system to talk to usb device
+allow system_server usb_device:chr_file rw_file_perms;
+allow system_server usb_device:dir r_dir_perms;
+
+# Read and delete files under /dev/fscklogs.
+r_dir_file(system_server, fscklogs)
+allow system_server fscklogs:dir { write remove_name add_name };
+allow system_server fscklogs:file rename;
+
+# logd access, system_server inherit logd write socket
+# (urge is to deprecate this long term)
+allow system_server zygote:unix_dgram_socket write;
+
+# Read from log daemon.
+read_logd(system_server)
+read_runtime_log_tags(system_server)
+
+# Be consistent with DAC permissions. Allow system_server to write to
+# /sys/module/lowmemorykiller/parameters/adj
+# /sys/module/lowmemorykiller/parameters/minfree
+allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms };
+
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow system_server pstorefs:dir r_dir_perms;
+allow system_server pstorefs:file r_file_perms;
+
+# /sys access
+allow system_server sysfs_zram:dir search;
+allow system_server sysfs_zram:file rw_file_perms;
+
+# Read /sys/fs/selinux/policy
+allow system_server kernel:security read_policy;
+
+add_service(system_server, system_server_service);
+allow system_server artd_service:service_manager find;
+allow system_server artd_pre_reboot_service:service_manager find;
+allow system_server audioserver_service:service_manager find;
+allow system_server authorization_service:service_manager find;
+allow system_server batteryproperties_service:service_manager find;
+allow system_server cameraserver_service:service_manager find;
+allow system_server compos_service:service_manager find;
+allow system_server dataloader_manager_service:service_manager find;
+allow system_server dexopt_chroot_setup_service:service_manager find;
+allow system_server dnsresolver_service:service_manager find;
+allow system_server drmserver_service:service_manager find;
+allow system_server dumpstate_service:service_manager find;
+allow system_server fingerprintd_service:service_manager find;
+allow system_server gatekeeper_service:service_manager find;
+allow system_server gpu_service:service_manager find;
+allow system_server gsi_service:service_manager find;
+allow system_server idmap_service:service_manager find;
+allow system_server incident_service:service_manager find;
+allow system_server incremental_service:service_manager find;
+allow system_server installd_service:service_manager find;
+allow system_server keystore_maintenance_service:service_manager find;
+allow system_server keystore_metrics_service:service_manager find;
+allow system_server keystore_service:service_manager find;
+allow system_server mdns_service:service_manager find;
+allow system_server mediaserver_service:service_manager find;
+allow system_server mediametrics_service:service_manager find;
+allow system_server mediaextractor_service:service_manager find;
+allow system_server mediadrmserver_service:service_manager find;
+allow system_server mediatuner_service:service_manager find;
+allow system_server mmd_service:service_manager find;
+allow system_server netd_service:service_manager find;
+allow system_server nfc_service:service_manager find;
+allow system_server ot_daemon_service:service_manager find;
+allow system_server radio_service:service_manager find;
+allow system_server stats_service:service_manager find;
+allow system_server storaged_service:service_manager find;
+allow system_server surfaceflinger_service:service_manager find;
+allow system_server update_engine_service:service_manager find;
+allow system_server virtual_camera_service:service_manager find;
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+ allow system_server virtualization_maintenance_service:service_manager find;
+')
+allow system_server vold_service:service_manager find;
+allow system_server wifinl80211_service:service_manager find;
+allow system_server logd_service:service_manager find;
+userdebug_or_eng(`
+ allow system_server profcollectd_service:service_manager find;
+')
+allow system_server wifi_mainline_supplicant_service:service_manager find;
+
+add_service(system_server, batteryproperties_service)
+
+allow system_server keystore:keystore2 {
+ add_auth
+ change_password
+ change_user
+ clear_ns
+ clear_uid
+ delete_all_keys
+ get_last_auth_time
+ lock
+ pull_metrics
+ reset
+ unlock
+};
+
+allow system_server keystore:keystore2_key {
+ delete
+ use_dev_id
+ grant
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow Wifi module to manage Wi-Fi keys.
+allow system_server wifi_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow lock_settings service to manage RoR keys.
+allow system_server resume_on_reboot_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+# Allow lock_settings service to manage locksettings keys (e.g. the synthetic password key).
+allow system_server locksettings_key:keystore2_key {
+ delete
+ get_info
+ rebind
+ update
+ use
+};
+
+
+# Allow system server to search and write to the persistent factory reset
+# protection partition. This block device does not get wiped in a factory reset.
+allow system_server block_device:dir search;
+allow system_server frp_block_device:blk_file rw_file_perms;
+allowxperm system_server frp_block_device:blk_file ioctl { BLKSECDISCARD BLKDISCARD };
+
+# Create new process groups and clean up old cgroups
+allow system_server cgroup:dir create_dir_perms;
+allow system_server cgroup:file setattr;
+allow system_server cgroup_v2:dir create_dir_perms;
+allow system_server cgroup_v2:file { r_file_perms setattr };
+
+# /oem access
+r_dir_file(system_server, oemfs)
+
+# Allow resolving per-user storage symlinks
+allow system_server { mnt_user_file storage_file }:dir { getattr search };
+allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
+
+# Allow statfs() on storage devices, which happens fast enough that
+# we shouldn't be killed during unsafe removal
+allow system_server { sdcard_type fuse }:dir { getattr search };
+
+# Traverse into expanded storage
+allow system_server mnt_expand_file:dir r_dir_perms;
+
+# Allow system process to relabel the fingerprint directory after mkdir
+# and delete the directory and files when no longer needed
+allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
+allow system_server fingerprintd_data_file:file { getattr unlink };
+
+userdebug_or_eng(`
+ # Allow system server to create and write method traces in /data/misc/trace.
+ allow system_server method_trace_data_file:dir w_dir_perms;
+ allow system_server method_trace_data_file:file { create w_file_perms };
+
+ # Allow system server to read dmesg
+ allow system_server kernel:system syslog_read;
+
+ # Allow writing and removing window traces in /data/misc/wmtrace.
+ allow system_server wm_trace_data_file:dir rw_dir_perms;
+ allow system_server wm_trace_data_file:file { getattr setattr create unlink w_file_perms };
+
+ # Allow writing and removing accessibility traces in /data/misc/a11ytrace.
+ allow system_server accessibility_trace_data_file:dir rw_dir_perms;
+ allow system_server accessibility_trace_data_file:file { getattr setattr create unlink w_file_perms };
+')
+
+# For AppFuse.
+allow system_server vold:fd use;
+allow system_server fuse_device:chr_file { read write ioctl getattr };
+allow system_server app_fuse_file:file { read write getattr };
+
+# For configuring sdcardfs
+allow system_server configfs:dir { create_dir_perms };
+allow system_server configfs:file { getattr open create unlink write };
+
+# Connect to adbd and use a socket transferred from it.
+# Used for e.g. jdwp.
+allow system_server adbd_common:unix_stream_socket connectto;
+allow system_server adbd_common:fd use;
+allow system_server adbd_common:unix_stream_socket { getattr getopt ioctl read write shutdown };
+
+# Read service.adb.tls.port, persist.adb.wifi. properties
+get_prop(system_server, adbd_prop)
+
+# Set persist.adb.tls_server.enable property
+set_prop(system_server, system_adbd_prop)
+
+# Set service.adbd.tradeinmode from ITradeInService.
+set_prop(system_server, adbd_tradeinmode_prop)
+
+# Allow invoking tools like "timeout"
+allow system_server toolbox_exec:file rx_file_perms;
+
+# Allow system process to setup fs-verity
+allowxperm system_server { apk_data_file apk_tmp_file system_data_file apex_system_server_data_file }:file ioctl FS_IOC_ENABLE_VERITY;
+
+# Allow system process to measure fs-verity for apps, including those being installed
+allowxperm system_server { apk_data_file apk_tmp_file }:file ioctl FS_IOC_MEASURE_VERITY;
+allowxperm system_server apk_tmp_file:file ioctl FS_IOC_SETFLAGS;
+
+# Postinstall
+#
+# For OTA dexopt, allow calls coming from postinstall.
+binder_call(system_server, postinstall)
+
+allow system_server postinstall:fifo_file write;
+allow system_server update_engine:fd use;
+allow system_server update_engine:fifo_file write;
+
+# Access to /data/preloads
+allow system_server preloads_data_file:file { r_file_perms unlink };
+allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
+allow system_server preloads_media_file:file { r_file_perms unlink };
+allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
+
+r_dir_file(system_server, cgroup)
+r_dir_file(system_server, cgroup_v2)
+allow system_server ion_device:chr_file r_file_perms;
+
+# Access to /dev/dma_heap/system
+allow system_server dmabuf_system_heap_device:chr_file r_file_perms;
+# Access to /dev/dma_heap/system-secure
+allow system_server dmabuf_system_secure_heap_device:chr_file r_file_perms;
+
+r_dir_file(system_server, proc_asound)
+r_dir_file(system_server, proc_net_type)
+r_dir_file(system_server, proc_qtaguid_stat)
+allow system_server {
+ proc_cmdline
+ proc_loadavg
+ proc_locks
+ proc_meminfo
+ proc_pagetypeinfo
+ proc_pipe_conf
+ proc_stat
+ proc_uid_cputime_showstat
+ proc_uid_io_stats
+ proc_uid_time_in_state
+ proc_uid_concurrent_active_time
+ proc_uid_concurrent_policy_time
+ proc_version
+ proc_vmallocinfo
+}:file r_file_perms;
+
+allow system_server proc_uid_time_in_state:dir r_dir_perms;
+allow system_server proc_uid_cpupower:file r_file_perms;
+
+r_dir_file(system_server, rootfs)
+
+# Allow WifiService to start, stop, and read wifi-specific trace events.
+allow system_server debugfs_tracing_instances:dir search;
+allow system_server debugfs_wifi_tracing:dir search;
+allow system_server debugfs_wifi_tracing:file rw_file_perms;
+
+# Allow BootReceiver to watch trace error_report events.
+allow system_server debugfs_bootreceiver_tracing:dir search;
+allow system_server debugfs_bootreceiver_tracing:file r_file_perms;
+
+# Allow system_server to read tracepoint ids in order to attach BPF programs to them.
+allow system_server debugfs_tracing:file r_file_perms;
+
+# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
+# asanwrapper.
+with_asan(`
+ allow system_server shell_exec:file rx_file_perms;
+ allow system_server asanwrapper_exec:file rx_file_perms;
+ allow system_server zygote_exec:file rx_file_perms;
+')
+
+# allow system_server to read the eBPF maps that stores the traffic stats information and update
+# the map after snapshot is recorded, and to read, update and run the maps and programs used for
+# time in state accounting
+allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:dir search;
+allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:file { getattr read write };
+allow system_server bpfloader:bpf prog_run;
+allow system_server self:bpf map_create;
+allow system_server { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+allow system_server self:key_socket create;
+# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
+# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
+dontaudit system_server self:key_socket getopt;
+
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow system_server fs_bpf_memevents:dir search;
+allow system_server fs_bpf_memevents:file { read write };
+
+# Allow system_server to start clatd in its own domain and kill it.
+domain_auto_trans(system_server, clatd_exec, clatd)
+allow system_server clatd:process { sigkill signal };
+
+# ART Profiles.
+# Allow system_server to open profile snapshots for read.
+# System server never reads the actual content. It passes the descriptor to
+# to privileged apps which acquire the permissions to inspect the profiles.
+allow system_server { user_profile_root_file user_profile_data_file}:dir { getattr search };
+allow system_server user_profile_data_file:file { getattr open read };
+
+# System server may dump profile data for debuggable apps in the /data/misc/profman.
+# As such it needs to be able create files but it should never read from them.
+# It also needs to stat the directory to check if it has the right permissions.
+allow system_server profman_dump_data_file:file { create getattr setattr w_file_perms};
+allow system_server profman_dump_data_file:dir rw_dir_perms;
+
+# On userdebug build we may profile system server. Allow it to write and create its own profile.
+userdebug_or_eng(`
+ allow system_server user_profile_data_file:dir w_dir_perms;
+ allow system_server user_profile_data_file:file create_file_perms;
+')
+# Allow system server to load JVMTI agents under control of a property.
+get_prop(system_server,system_jvmti_agent_prop)
+
+# UsbDeviceManager uses /dev/usb-ffs
+allow system_server functionfs:dir search;
+allow system_server functionfs:file rw_file_perms;
+# To resolve arbitrary sysfs paths from /sys/class/udc/* symlinks.
+starting_at_board_api(202504, `
+allow system_server sysfs_type:dir search;
+r_dir_file(system_server, sysfs_udc)
+')
+
+# system_server contains time / time zone detection logic so reads the associated properties.
+get_prop(system_server, time_prop)
+
+# system_server reads this property to know it should expect the lmkd sends notification to it
+# on low memory kills.
+get_prop(system_server, system_lmk_prop)
+
+get_prop(system_server, wifi_config_prop)
+
+# Only system server can access BINDER_FREEZE and BINDER_GET_FROZEN_INFO
+allowxperm system_server binder_device:chr_file ioctl { BINDER_FREEZE BINDER_GET_FROZEN_INFO };
+
+# Watchdog prints debugging log to /dev/kmsg_debug.
+userdebug_or_eng(`
+ allow system_server kmsg_debug_device:chr_file { open append getattr };
+')
+# Watchdog reads sysprops framework_watchdog.fatal_* to handle watchdog timeout loop.
+get_prop(system_server, framework_watchdog_config_prop)
+
+
+# Font files are written by system server
+allow system_server font_data_file:file create_file_perms;
+allow system_server font_data_file:dir create_dir_perms;
+# Allow system process to setup and measure fs-verity for font files
+allowxperm system_server font_data_file:file ioctl { FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY };
+
+# Read qemu.hw.mainkeys property
+get_prop(system_server, qemu_hw_prop)
+
+# Allow system server to read profcollectd reports for upload.
+userdebug_or_eng(`r_dir_file(system_server, profcollectd_data_file)')
+
+# Power controls for debugging/diagnostics
+get_prop(system_server, power_debug_prop)
+set_prop(system_server, power_debug_prop)
+
+###
+### Neverallow rules
+###
+### system_server should NEVER do any of this
+
+# Do not allow opening files from external storage as unsafe ejection
+# could cause the kernel to kill the system_server.
+neverallow system_server { sdcard_type fuse }:dir { open read write };
+neverallow system_server { sdcard_type fuse }:file rw_file_perms;
+
+# system server should never be operating on zygote spawned app data
+# files directly. Rather, they should always be passed via a
+# file descriptor.
+# Exclude those types that system_server needs to open directly.
+neverallow system_server {
+ app_data_file_type
+ -system_app_data_file
+ -radio_data_file
+}:file { open create unlink link };
+
+# Forking and execing is inherently dangerous and racy. See, for
+# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
+# Prevent the addition of new file execs to stop the problem from
+# getting worse. b/28035297
+neverallow system_server {
+ file_type
+ -toolbox_exec
+ -logcat_exec
+ with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
+}:file execute_no_trans;
+
+# Ensure that system_server doesn't perform any domain transitions other than
+# transitioning to the crash_dump domain when a crash occurs or fork clatd.
+# add perfetto and trace_redactor which are exec'd from system server for ProfilingService.
+neverallow system_server { domain -clatd -crash_dump -perfetto -trace_redactor }:process transition;
+neverallow system_server *:process dyntransition;
+
+# Ensure that system_server doesn't access anything but search in perfetto_traces_data_file:dir.
+neverallow system_server perfetto_traces_data_file:dir ~search;
+
+# Only allow crash_dump to connect to system_ndebug_socket.
+neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
+
+# Only allow zygotes to connect to system_unsolzygote_socket.
+neverallow {
+ domain
+ -init
+ -system_server
+ -zygote
+ -app_zygote
+ -webview_zygote
+} system_unsolzygote_socket:sock_file { open write };
+
+# Only allow init, system_server, flags_health_check to set properties for server configurable flags
+neverallow {
+ domain
+ -init
+ -system_server
+ -flags_health_check
+} {
+ device_config_core_experiments_team_internal_prop
+ device_config_activity_manager_native_boot_prop
+ device_config_connectivity_prop
+ device_config_input_native_boot_prop
+ device_config_lmkd_native_prop
+ device_config_netd_native_prop
+ device_config_nnapi_native_prop
+ device_config_edgetpu_native_prop
+ device_config_runtime_native_boot_prop
+ device_config_runtime_native_prop
+ device_config_media_native_prop
+ device_config_mglru_native_prop
+ device_config_remote_key_provisioning_native_prop
+ device_config_storage_native_boot_prop
+ device_config_surface_flinger_native_boot_prop
+ device_config_sys_traced_prop
+ device_config_swcodec_native_prop
+ device_config_aconfig_flags_prop
+ device_config_window_manager_native_boot_prop
+ device_config_tethering_u_or_later_native_prop
+ device_config_mmd_native_prop
+ next_boot_prop
+}:property_service set;
+
+# Only allow system_server and init to set tuner_server_ctl_prop
+neverallow {
+ domain
+ -system_server
+ -init
+} tuner_server_ctl_prop:property_service set;
+
+# system_server should never be executing dex2oat. This is either
+# a bug (for example, bug 16317188), or represents an attempt by
+# system server to dynamically load a dex file, something we do not
+# want to allow.
+neverallow system_server dex2oat_exec:file no_x_file_perms;
+
+# system_server should never execute or load executable shared libraries
+# in /data. Executable files in /data are a persistence vector.
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
+neverallow system_server data_file_type:file no_x_file_perms;
+
+# The only block device system_server should be writing to is
+# the frp_block_device. This helps avoid a system_server to root
+# escalation by writing to raw block devices.
+# The system_server may need to read from vd_device if it uses
+# block apexes.
+neverallow system_server { dev_type -frp_block_device }:blk_file no_w_file_perms;
+neverallow system_server { dev_type -frp_block_device -vd_device }:blk_file r_file_perms;
+
+# system_server should never use JIT functionality
+# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
+# in the section titled "A Short ROP Chain" for why.
+# However, in emulator builds without OpenGL passthrough, we use software
+# rendering via SwiftShader, which requires JIT support. These builds are
+# never shipped to users.
+ifelse(target_requires_insecure_execmem_for_swiftshader, `true',
+ `allow system_server self:process execmem;',
+ `neverallow system_server self:process execmem;')
+neverallow system_server { ashmem_device ashmem_libcutils_device }:chr_file execute;
+
+# TODO: deal with tmpfs_domain pub/priv split properly
+neverallow system_server system_server_tmpfs:file execute;
+
+# Resources handed off by system_server_startup
+allow system_server system_server_startup:fd use;
+allow system_server system_server_startup_tmpfs:file { read write map };
+allow system_server system_server_startup:unix_dgram_socket write;
+
+# Allow system server to communicate to apexd
+allow system_server apex_service:service_manager find;
+allow system_server apexd:binder call;
+
+# Allow system server to scan /apex for flattened APEXes
+allow system_server apex_mnt_dir:dir r_dir_perms;
+
+# Allow system server to read /apex/apex-info-list.xml
+allow system_server apex_info_file:file r_file_perms;
+
+# Allow system_server to communicate with tradeinmode.
+binder_call(system_server, tradeinmode)
+
+# Allow system server to communicate to system-suspend's control interface
+allow system_server system_suspend_control_internal_service:service_manager find;
+allow system_server system_suspend_control_service:service_manager find;
+binder_call(system_server, system_suspend)
+binder_call(system_suspend, system_server)
+
+# Allow system server to communicate to system-suspend's wakelock interface
+wakelock_use(system_server)
+
+# Allow the system server to read files under /data/apex. The system_server
+# needs these privileges to compare file signatures while processing installs.
+#
+# Only apexd is allowed to create new entries or write to any file under /data/apex.
+allow system_server apex_data_file:dir { getattr search };
+allow system_server apex_data_file:file r_file_perms;
+
+# Allow the system server to read files under /vendor/apex. This is where
+# vendor APEX packages might be installed and system_server needs to parse
+# these packages to inspect the signatures and other metadata.
+allow system_server vendor_apex_file:dir { getattr search };
+allow system_server vendor_apex_file:file r_file_perms;
+
+# Allow the system server to manage relevant apex module data files.
+allow system_server apex_module_data_file:dir { getattr search };
+# These are modules where the code runs in system_server, so we need full access.
+allow system_server apex_system_server_data_file:dir create_dir_perms;
+allow system_server apex_system_server_data_file:file create_file_perms;
+allow system_server apex_tethering_data_file:dir create_dir_perms;
+allow system_server apex_tethering_data_file:file create_file_perms;
+allow system_server apex_uwb_data_file:dir create_dir_perms;
+allow system_server apex_uwb_data_file:file create_file_perms;
+# Legacy labels that we still need to support (b/217581286)
+allow system_server {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_wifi_data_file
+}:dir create_dir_perms;
+allow system_server {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_wifi_data_file
+}:file create_file_perms;
+
+# Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can
+# communicate which slots are available for use.
+allow system_server metadata_file:dir search;
+allow system_server password_slot_metadata_file:dir rw_dir_perms;
+allow system_server password_slot_metadata_file:file create_file_perms;
+
+# Allow TradeInMode service rw access to /metadata/tradeinmode.
+allow system_server tradeinmode_metadata_file:dir rw_dir_perms;
+allow system_server tradeinmode_metadata_file:file create_file_perms;
+
+allow system_server userspace_reboot_metadata_file:dir create_dir_perms;
+allow system_server userspace_reboot_metadata_file:file create_file_perms;
+
+# Allow system server rw access to files in /metadata/staged-install folder
+allow system_server staged_install_file:dir rw_dir_perms;
+allow system_server staged_install_file:file create_file_perms;
+
+allow system_server watchdog_metadata_file:dir rw_dir_perms;
+allow system_server watchdog_metadata_file:file create_file_perms;
+
+# allow system_server write to aconfigd socket
+unix_socket_connect(system_server, aconfigd, aconfigd);
+
+# allow system_server write to aconfigd_mainline socket
+unix_socket_connect(system_server, aconfigd_mainline, aconfigd_mainline);
+
+allow system_server repair_mode_metadata_file:dir rw_dir_perms;
+allow system_server repair_mode_metadata_file:file create_file_perms;
+
+allow system_server gsi_persistent_data_file:dir rw_dir_perms;
+allow system_server gsi_persistent_data_file:file create_file_perms;
+
+# Allow system server read and remove files under /data/misc/odrefresh
+allow system_server odrefresh_data_file:dir rw_dir_perms;
+allow system_server odrefresh_data_file:file { r_file_perms unlink };
+
+# Allow system server r access to /system/bin/surfaceflinger for PinnerService.
+allow system_server surfaceflinger_exec:file r_file_perms;
+
+# Allow init to set sysprop used to compute stats about userspace reboot.
+set_prop(system_server, userspace_reboot_log_prop)
+
+# JVMTI agent settings are only readable from the system server.
+neverallow {
+ domain
+ -system_server
+ -dumpstate
+ -init
+ -vendor_init
+} {
+ system_jvmti_agent_prop
+}:file no_rw_file_perms;
+
+# Read/Write /proc/pressure/memory
+allow system_server proc_pressure_mem:file rw_file_perms;
+# Read /proc/pressure/cpu and /proc/pressure/io
+allow system_server { proc_pressure_cpu proc_pressure_io }:file r_file_perms;
+
+# No ptracing others
+neverallow system_server { domain -system_server }:process ptrace;
+
+# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
+# file read access. However, that is now unnecessary (b/34951864)
+neverallow system_server system_server:global_capability_class_set sys_resource;
+
+# Only system_server/init should access /metadata/password_slots.
+neverallow { domain -init -system_server } password_slot_metadata_file:dir *;
+neverallow {
+ domain
+ -init
+ -system_server
+} password_slot_metadata_file:notdevfile_class_set ~{ relabelto getattr };
+neverallow { domain -init -system_server } password_slot_metadata_file:notdevfile_class_set *;
+
+# Allow systemserver to read/write the invalidation property
+set_prop(system_server, binder_cache_system_server_prop)
+neverallow { domain -system_server -init }
+ binder_cache_system_server_prop:property_service set;
+
+# Allow system server to attach BPF programs to tracepoints. Deny read permission so that
+# system_server cannot use this access to read perf event data like process stacks.
+allow system_server self:perf_event { open write cpu kernel };
+neverallow system_server self:perf_event ~{ open write cpu kernel };
+
+# Allow writing files under /data/system/shutdown-checkpoints/
+allow system_server shutdown_checkpoints_system_data_file:dir create_dir_perms;
+allow system_server shutdown_checkpoints_system_data_file:file create_file_perms;
+
+# Do not allow any domain other than init or system server to set the property
+neverallow { domain -init -system_server } socket_hook_prop:property_service set;
+
+neverallow { domain -init -system_server } boot_status_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_server
+} wifi_config_prop:file no_rw_file_perms;
+
+# Only allow system server to write uhid sysfs files
+neverallow {
+ domain
+ -init
+ -system_server
+ -ueventd
+ -vendor_init
+} sysfs_uhid:file no_w_file_perms;
+
+# BINDER_FREEZE is used to block ipc transactions to frozen processes, so it
+# can be accessed by system_server only (b/143717177)
+# BINDER_GET_FROZEN_INFO is used by system_server to determine the state of a frozen binder
+# interface
+neverallowxperm { domain -system_server } binder_device:chr_file ioctl { BINDER_FREEZE BINDER_GET_FROZEN_INFO };
+
+# Only system server can write the font files.
+neverallow { domain -init -system_server } font_data_file:file no_w_file_perms;
+neverallow { domain -init -system_server } font_data_file:dir no_w_dir_perms;
+
+# Allow reading /system/etc/font_fallback.xml
+allow system_server system_font_fallback_file:file r_file_perms;
+
+# Allow system server to set dynamic ART properties.
+set_prop(system_server, dalvik_dynamic_config_prop)
+
+# Allow system server to read binderfs
+allow system_server binderfs_logs:dir r_dir_perms;
+allow system_server binderfs_logs_stats:file r_file_perms;
+
+# For ANRs
+userdebug_or_eng(`
+ allow system_server binderfs_logs_transactions:file r_file_perms;
+')
+
+# Allow GameManagerService to read and write persist.graphics.game_default_frame_rate.enabled
+set_prop(system_server, game_manager_config_prop)
+
+# Allow system server to write HintManagerService properties
+set_prop(system_server, hint_manager_config_prop)
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -system_server
+ userdebug_or_eng(`-shell')
+} hint_manager_config_prop:property_service set;
+
+# ThreadNetworkService reads Thread Network properties
+get_prop(system_server, threadnetwork_config_prop)
+
+# Do not allow any domain other than init and system server to set the property
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_server
+} threadnetwork_config_prop:file no_rw_file_perms;
+
+# Allow accessing /mnt/pre_reboot_dexopt/chroot, to load the new service-art.jar
+# in Pre-reboot Dexopt.
+allow system_server pre_reboot_dexopt_file:dir { getattr search };
+
+# Allow system_server to reopen its own memfd.
+# system_server needs to copy the new service-art.jar to a memfd and reopen it with the path
+# /proc/self/fd/<fd> with a classloader.
+allow system_server system_server_tmpfs:file open;
+
+# Allow system_server to read from postinstall scripts through STDIN, to check if the
+# otapreopt_script is still alive.
+allow system_server postinstall:fifo_file read;
+
+# Allow system_server to kill artd and its subprocesses, to make sure that no process is accessing
+# files in chroot when we teardown chroot.
+allow system_server {
+ artd
+ derive_classpath
+ dex2oat
+ odrefresh
+ profman
+}:process sigkill;
+
+# Do not allow any domain other than init or system server to get or set the property
+neverallow { domain -init -system_server } crashrecovery_prop:property_service set;
+neverallow { domain -init -dumpstate -system_server } crashrecovery_prop:file no_rw_file_perms;
+
+# Do not allow anything other than system_server and init to touch /metadata/tradeinmode.
+neverallow { domain -init -system_server } tradeinmode_metadata_file:file no_rw_file_perms;
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -system_server
+ -shell
+} power_debug_prop:property_service set;
diff --git a/prebuilts/api/202504/private/system_server_startup.te b/prebuilts/api/202504/private/system_server_startup.te
new file mode 100644
index 0000000..064e038
--- /dev/null
+++ b/prebuilts/api/202504/private/system_server_startup.te
@@ -0,0 +1,24 @@
+type system_server_startup, domain, coredomain;
+type system_server_startup_tmpfs, file_type;
+
+tmpfs_domain(system_server_startup)
+
+# Create JIT memory
+allow system_server_startup self:process execmem;
+allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
+
+# Allow to pick up integrity-checked artifacts from the ART APEX dalvik cache.
+allow system_server_startup apex_art_data_file:dir r_dir_perms;
+allow system_server_startup apex_art_data_file:file { r_file_perms execute };
+
+# Allow system_server_startup to run setcon() and enter the
+# system_server domain
+allow system_server_startup self:process setcurrent;
+allow system_server_startup system_server:process dyntransition;
+
+# Child of the zygote.
+allow system_server_startup zygote:process sigchld;
+
+# Allow query ART device config properties
+get_prop(system_server_startup, device_config_runtime_native_boot_prop)
+get_prop(system_server_startup, device_config_runtime_native_prop)
diff --git a/prebuilts/api/202504/private/system_suspend.te b/prebuilts/api/202504/private/system_suspend.te
new file mode 100644
index 0000000..a525866
--- /dev/null
+++ b/prebuilts/api/202504/private/system_suspend.te
@@ -0,0 +1,56 @@
+type system_suspend, domain, coredomain, system_suspend_server, system_suspend_internal_server;
+
+type system_suspend_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(system_suspend)
+
+# To serve ISuspendControlService.
+binder_use(system_suspend)
+add_service(system_suspend, system_suspend_control_service)
+
+add_service(system_suspend, hal_system_suspend_service)
+
+# Access to /sys/power/{ wakeup_count, state } suspend interface.
+allow system_suspend sysfs_power:file rw_file_perms;
+
+# Access to wakeup, suspend stats, and wakeup reasons.
+r_dir_file(system_suspend, sysfs_suspend_stats)
+r_dir_file(system_suspend, sysfs_wakeup)
+r_dir_file(system_suspend, sysfs_wakeup_reasons)
+# To resolve arbitrary sysfs paths from /sys/class/wakeup/* symlinks.
+allow system_suspend sysfs_type:dir search;
+
+# Access to suspend_hal system properties
+get_prop(system_suspend, suspend_prop)
+
+# Access to system_suspend debug system properties
+userdebug_or_eng(`
+ get_prop(system_suspend, suspend_debug_prop)
+')
+
+# To call BTAA registered callbacks
+allow system_suspend bluetooth:binder call;
+
+# For adding `dumpsys syspend_control` output to bugreport
+allow system_suspend dumpstate:fd use;
+allow system_suspend dumpstate:fifo_file write;
+
+# Allow init to take kernel wakelock and system suspend to
+# remove kenel wakelocks and the capability to access these
+# files
+allow init sysfs_wake_lock:file rw_file_perms;
+allow init self:global_capability2_class_set block_suspend;
+allow system_suspend sysfs_wake_lock:file rw_file_perms;
+allow system_suspend self:global_capability2_class_set block_suspend;
+
+# Allow init to set /sys/power/sync_on_suspend.
+allow init sysfs_sync_on_suspend:file w_file_perms;
+
+neverallow {
+ domain
+ -atrace # tracing
+ -bluetooth # support Bluetooth activity attribution (BTAA)
+ -dumpstate # bug reports
+ -system_suspend # implements system_suspend_control_service
+ -system_server # configures system_suspend via ISuspendControlService
+ -traceur_app # tracing
+} system_suspend_control_service:service_manager find;
diff --git a/prebuilts/api/202504/private/system_suspend_internal_server.te b/prebuilts/api/202504/private/system_suspend_internal_server.te
new file mode 100644
index 0000000..8ff9da9
--- /dev/null
+++ b/prebuilts/api/202504/private/system_suspend_internal_server.te
@@ -0,0 +1,12 @@
+# To serve ISuspendControlServiceInternal.
+add_service(system_suspend_internal_server, system_suspend_control_internal_service)
+
+neverallow {
+ domain
+ -atrace # tracing
+ -dumpstate # bug reports
+ -system_suspend_internal_server # implements system_suspend_control_internal_service
+ -system_server # configures system_suspend via ISuspendControlServiceInternal
+ -traced_probes # tracing
+ -traceur_app # tracing
+} system_suspend_control_internal_service:service_manager find;
diff --git a/prebuilts/api/202504/private/system_suspend_server.te b/prebuilts/api/202504/private/system_suspend_server.te
new file mode 100644
index 0000000..8e8310d
--- /dev/null
+++ b/prebuilts/api/202504/private/system_suspend_server.te
@@ -0,0 +1,6 @@
+# Required to export a HIDL interface.
+hwbinder_use(system_suspend_server)
+get_prop(system_suspend_server, hwservicemanager_prop)
+
+# To serve ISystemSuspend.hal.
+add_hwservice(system_suspend_server, system_suspend_hwservice)
diff --git a/prebuilts/api/202504/private/technical_debt.cil b/prebuilts/api/202504/private/technical_debt.cil
new file mode 100644
index 0000000..4286053
--- /dev/null
+++ b/prebuilts/api/202504/private/technical_debt.cil
@@ -0,0 +1,66 @@
+; THIS IS A WORKAROUND for the current limitations of the module policy language
+; This should be used sparingly until we figure out a saner way to achieve the
+; stuff below, for example, by improving typeattribute statement of module
+; language.
+;
+; NOTE: This file has no effect on recovery policy.
+
+; Apps, except isolated apps, are clients of Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_allocator_client;
+; typeattribute hal_allocator_client halclientdomain;
+(typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app_all))))))
+(typeattributeset halclientdomain (hal_allocator_client))
+
+; Apps, except isolated apps, are clients of OMX-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps, are clients of Codec2-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps and SDK sandboxes, are clients of Drm-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_drm_client ((and (appdomain) ((not (or (isolated_app_all) (sdk_sandbox_all)))))))
+
+; Apps, except isolated apps, are clients of Configstore HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_configstore_client;
+(typeattributeset hal_configstore_client ((and (appdomain) ((not (isolated_app_all))))))
+
+; Apps, except isolated apps, are clients of Graphics Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app } hal_graphics_allocator_client;
+(typeattributeset hal_graphics_allocator_client ((and (appdomain) ((not (isolated_app))))))
+
+; Apps, except isolated apps, are clients of Cas HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_cas_client;
+(typeattributeset hal_cas_client ((and (appdomain) ((not (isolated_app_all))))))
+
+; Domains hosting Camera HAL implementations are clients of Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute hal_camera hal_allocator_client;
+(typeattributeset hal_allocator_client (hal_camera))
+
+; Apps, except isolated apps, are clients of Neuralnetworks HAL
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { appdomain -isolated_app_all } hal_neuralnetworks_client;
+(typeattributeset hal_neuralnetworks_client ((and (appdomain) ((not (isolated_app))))))
+
+; TODO(b/112056006): move these to mapping files when/if we implement 'versioned' attributes.
+; Rename untrusted_app_visible_* to untrusted_app_visible_*_violators.
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute untrusted_app_visible_hwservice untrusted_app_visible_hwservice_violators;
+; typeattribute untrusted_app_visible_halserver untrusted_app_visible_halserver_violators;
+(typeattribute untrusted_app_visible_hwservice)
+(typeattributeset untrusted_app_visible_hwservice_violators (untrusted_app_visible_hwservice))
+(typeattribute untrusted_app_visible_halserver)
+(typeattributeset untrusted_app_visible_halserver_violators (untrusted_app_visible_halserver))
+
+; Properties having both system_property_type and vendor_property_type are illegal
+; Unfortunately, we can't currently express this in module policy language:
+; typeattribute { system_property_type && vendor_property_type } system_and_vendor_property_type;
+(typeattribute system_and_vendor_property_type)
+(typeattributeset system_and_vendor_property_type ((and (system_property_type) (vendor_property_type))))
diff --git a/prebuilts/api/202504/private/tee.te b/prebuilts/api/202504/private/tee.te
new file mode 100644
index 0000000..2f86c4d
--- /dev/null
+++ b/prebuilts/api/202504/private/tee.te
@@ -0,0 +1,2 @@
+allow tee fingerprint_vendor_data_file:dir rw_dir_perms;
+allow tee fingerprint_vendor_data_file:file create_file_perms;
diff --git a/prebuilts/api/202504/private/tee_service_contexts b/prebuilts/api/202504/private/tee_service_contexts
new file mode 100644
index 0000000..89eceae
--- /dev/null
+++ b/prebuilts/api/202504/private/tee_service_contexts
@@ -0,0 +1,13 @@
+# Tee services contexts.
+#
+# This file defines all tee services available to VMs.
+# This file is read by virtmngr.
+#
+# Format:
+# <tee_service_name> <label>
+#
+# <tee_service_name> must be a string
+
+# Example tee service that can be used for end-to-end integration of
+# custom smcs filtering on devices with pkvm hypervisor.
+test_pkvm_tee_service u:object_r:test_pkvm_tee_service:s0
diff --git a/prebuilts/api/202504/private/tee_services.te b/prebuilts/api/202504/private/tee_services.te
new file mode 100644
index 0000000..320f8b7
--- /dev/null
+++ b/prebuilts/api/202504/private/tee_services.te
@@ -0,0 +1,6 @@
+# Specify tee_services in this file.
+# Please keep the names in the alphabetical order and comment each new entry.
+
+# An example tee_service that can be used to test end-to-end integration of custom
+# smcs filtering feature on a device with pkvm hypervisor.
+type test_pkvm_tee_service, tee_service_type;
diff --git a/prebuilts/api/202504/private/tombstoned.te b/prebuilts/api/202504/private/tombstoned.te
new file mode 100644
index 0000000..1384835
--- /dev/null
+++ b/prebuilts/api/202504/private/tombstoned.te
@@ -0,0 +1,31 @@
+typeattribute tombstoned coredomain;
+
+init_daemon_domain(tombstoned)
+
+get_prop(tombstoned, tombstone_config_prop)
+
+# Write to arbitrary pipes given to us.
+allow tombstoned domain:fd use;
+allow tombstoned domain:fifo_file write;
+
+allow tombstoned domain:dir r_dir_perms;
+allow tombstoned domain:file r_file_perms;
+allow tombstoned tombstone_data_file:dir rw_dir_perms;
+allow tombstoned tombstone_data_file:file { create_file_perms link };
+
+# Changes for the new stack dumping mechanism. Each trace goes into a
+# separate file, and these files are managed by tombstoned.
+allow tombstoned anr_data_file:dir rw_dir_perms;
+allow tombstoned anr_data_file:file { append create getattr open link unlink };
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -tombstoned
+} tombstone_config_prop:file no_rw_file_perms;
diff --git a/prebuilts/api/202504/private/toolbox.te b/prebuilts/api/202504/private/toolbox.te
new file mode 100644
index 0000000..265db0a
--- /dev/null
+++ b/prebuilts/api/202504/private/toolbox.te
@@ -0,0 +1,44 @@
+typeattribute toolbox coredomain;
+
+init_daemon_domain(toolbox)
+
+# rm -rf in /data/misc/virtualizationservice
+allow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms };
+allow toolbox virtualizationservice_data_file:file { getattr unlink };
+
+# If we can't remove these directories we try to chmod them. That
+# doesn't work, but it doesn't matter as virtualizationservice itself
+# will delete them when it starts. See b/235338094#comment39
+dontaudit toolbox virtualizationservice_data_file:dir setattr;
+
+# /dev/__null__ created by init prior to policy load,
+# open fd inherited by fsck.
+allow toolbox tmpfs:chr_file { read write ioctl };
+
+# Inherit and use pty created by android_fork_execvp_ext().
+allow toolbox devpts:chr_file { read write getattr ioctl };
+
+# mkswap-specific.
+# Read/write block devices used for swap partitions.
+# Assign swap_block_device type any such partition in your
+# device/<vendor>/<product>/sepolicy/file_contexts file.
+allow toolbox block_device:dir search;
+allow toolbox swap_block_device:blk_file rw_file_perms;
+
+# rm -rf /data/per_boot
+allow toolbox system_data_root_file:dir { remove_name write };
+allow toolbox system_data_file:dir { rmdir rw_dir_perms };
+allow toolbox system_data_file:file { getattr unlink };
+
+# chattr +F /data/media in init
+allow toolbox media_userdir_file:dir { r_dir_perms setattr };
+allowxperm toolbox media_userdir_file:dir ioctl { FS_IOC_SETFLAGS FS_IOC_GETFLAGS };
+
+###
+### Neverallow rules
+###
+
+# Only allow entry from init via the toolbox binary.
+neverallow { domain -init } toolbox:process transition;
+neverallow * toolbox:process dyntransition;
+neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
diff --git a/prebuilts/api/202504/private/trace_redactor.te b/prebuilts/api/202504/private/trace_redactor.te
new file mode 100644
index 0000000..fbca3fd
--- /dev/null
+++ b/prebuilts/api/202504/private/trace_redactor.te
@@ -0,0 +1,13 @@
+# Trace Redactor command line
+type trace_redactor_exec, system_file_type, exec_type, file_type;
+type trace_redactor, domain, coredomain;
+
+# Use pipes provided by system_server
+allow trace_redactor system_server:fd use;
+allow trace_redactor system_server:fifo_file { read write getattr ioctl };
+
+# Allow trace_redactor to read output trace file and write to new redacted file.
+allow trace_redactor perfetto_traces_profiling_data_file:dir search;
+allow trace_redactor perfetto_traces_data_file:dir search;
+allow trace_redactor perfetto_traces_data_file:file { read getattr ioctl };
+allow trace_redactor perfetto_traces_profiling_data_file:file rw_file_perms;
diff --git a/prebuilts/api/202504/private/traced.te b/prebuilts/api/202504/private/traced.te
new file mode 100644
index 0000000..8a29541
--- /dev/null
+++ b/prebuilts/api/202504/private/traced.te
@@ -0,0 +1,130 @@
+# Perfetto user-space tracing daemon (unprivileged)
+type traced_exec, system_file_type, exec_type, file_type;
+
+# Allow init to exec the daemon.
+init_daemon_domain(traced)
+tmpfs_domain(traced)
+
+# Allow apps in other MLS contexts (for multi-user) to access
+# share memory buffers created by traced.
+typeattribute traced_tmpfs mlstrustedobject;
+
+# Allow traced to start with a lower scheduling class and change
+# class accordingly to what defined in the config provided by
+# the privileged process that controls it.
+allow traced self:global_capability_class_set { sys_nice };
+
+# Allow to pass a file descriptor for the output trace from "perfetto" (the
+# cmdline client) and other shell binaries to traced and let traced write
+# directly into that (rather than returning the trace contents over the socket).
+allow traced perfetto:fd use;
+allow traced shell:fd use;
+allow traced shell:fifo_file { read write };
+
+# Allow the service to create new files within /data/misc/perfetto-traces.
+allow traced perfetto_traces_data_file:file create_file_perms;
+allow traced perfetto_traces_data_file:dir rw_dir_perms;
+
+# Allow traceur to pass open file descriptors to traced, so traced can directly
+# write into the output file without doing roundtrips over IPC.
+allow traced traceur_app:fd use;
+allow traced platform_app:fd use;
+allow traced trace_data_file:file { read write };
+
+# Allow perfetto to access the proxy service for notifying Traceur.
+allow traced tracingproxy_service:service_manager find;
+binder_use(traced);
+binder_call(traced, system_server);
+
+# Allow traced to use shared memory supplied by producers. Typically, traced
+# (i.e. the tracing service) creates the shared memory used for data transfer
+# from the producer. This rule allows an alternative scheme, where the producer
+# creates the shared memory, that is then adopted by traced (after validating
+# that it is appropriately sealed).
+# This list has to replicate the tmpfs domains of all applicable domains that
+# have perfetto_producer() macro applied to them.
+# perfetto_tmpfs excluded as it should never need to use the producer-supplied
+# shared memory scheme.
+allow traced {
+ appdomain_tmpfs
+ heapprofd_tmpfs
+ surfaceflinger_tmpfs
+ traced_probes_tmpfs
+ userdebug_or_eng(`system_server_tmpfs')
+}:file { getattr map read write };
+
+# Allow traced to detect if a process is frozen (b/381089063).
+allow traced cgroup_v2:file r_file_perms;
+
+# Allow setting debug properties which guard initialization of the Perfetto SDK
+# in SurfaceFlinger and HWUI's copy of Skia.
+# Required for the android.sdk_sysprop_guard data source.
+# TODO(b/281329340): remove this when no longer needed.
+set_prop(traced, debug_prop)
+# Allow traced to notify Traceur when a trace ends by setting the
+# sys.trace.trace_end_signal property.
+set_prop(traced, system_trace_prop)
+# Allow to lazily start producers.
+set_prop(traced, traced_lazy_prop)
+# Allow tracking the count of sessions intercepting Java OutOfMemoryError
+# If there are such tracing sessions and an OutOfMemoryError is thrown by ART,
+# the hprof plugin intercepts the error, lazily registers a data source to
+# traced and collects a heap dump.
+set_prop(traced, traced_oome_heap_session_count_prop)
+
+# Allow traced to talk to statsd for logging metrics.
+unix_socket_send(traced, statsdw, statsd)
+
+###
+### Neverallow rules
+###
+### traced should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced self:process execmem;
+
+# Block device access.
+neverallow traced dev_type:blk_file { read write };
+
+# ptrace any other process
+neverallow traced domain:process ptrace;
+
+# Disallows access to /data files, still allowing to write to file descriptors
+# passed through the socket.
+neverallow traced {
+ data_file_type
+ -perfetto_traces_data_file
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
+ # subsequent neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:dir *;
+neverallow traced { system_data_file }:dir ~{ getattr search };
+neverallow traced {
+ data_file_type
+ -perfetto_traces_data_file
+ -trace_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:file ~write;
+
+# Only init is allowed to enter the traced domain via exec()
+neverallow { domain -init } traced:process transition;
+neverallow * traced:process dyntransition;
+
+# Limit the processes that can access tracingproxy_service.
+neverallow {
+ domain
+ -traced
+ -dumpstate
+ -traceur_app
+ -platform_app
+ -shell
+ -system_server
+ -perfetto
+} tracingproxy_service:service_manager find;
diff --git a/prebuilts/api/202504/private/traced_perf.te b/prebuilts/api/202504/private/traced_perf.te
new file mode 100644
index 0000000..8bd7ad3
--- /dev/null
+++ b/prebuilts/api/202504/private/traced_perf.te
@@ -0,0 +1,83 @@
+# Performance profiler, backed by perf_event_open(2).
+# See go/perfetto-perf-android.
+typeattribute traced_perf coredomain;
+typeattribute traced_perf mlstrustedsubject;
+
+type traced_perf_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(traced_perf)
+perfetto_producer(traced_perf)
+
+# Allow traced_perf full use of perf_event_open(2). It will perform cpu-wide
+# profiling, but retain samples only for profileable processes.
+# Thread-specific profiling is still disallowed due to a PTRACE_MODE_ATTACH
+# check (which would require a process:attach SELinux allow-rule).
+allow traced_perf self:perf_event { open cpu kernel read write tracepoint };
+
+# Allow CAP_KILL for delivery of dedicated signal to obtain proc-fds from a
+# process. Allow CAP_DAC_READ_SEARCH for stack unwinding and symbolization of
+# sampled stacks, which requires opening the backing libraries/executables (as
+# symbols are usually not mapped into the process space). Not all such files
+# are world-readable, e.g. odex files that included user profiles during
+# profile-guided optimization.
+allow traced_perf self:capability { kill dac_read_search };
+
+# Allow reading /system/data/packages.list.
+allow traced_perf packages_list_file:file r_file_perms;
+
+# Allow reading files for stack unwinding and symbolization.
+r_dir_file(traced_perf, nativetest_data_file)
+r_dir_file(traced_perf, system_file_type)
+r_dir_file(traced_perf, apk_data_file)
+r_dir_file(traced_perf, dalvikcache_data_file)
+r_dir_file(traced_perf, vendor_file_type)
+# ART apex files and directory access to the containing /data/misc/apexdata.
+r_dir_file(traced_perf, apex_art_data_file)
+allow traced_perf apex_module_data_file:dir { getattr search };
+
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
+userdebug_or_eng(`set_prop(traced_perf, lower_kptr_restrict_prop)')
+allow traced_perf proc_kallsyms:file { open read lock };
+
+# Allow reading tracefs files to get the format and numeric ids of tracepoints.
+allow traced_perf debugfs_tracing:dir r_dir_perms;
+allow traced_perf debugfs_tracing:file r_file_perms;
+userdebug_or_eng(`
+ allow traced_perf debugfs_tracing_debug:dir r_dir_perms;
+ allow traced_perf debugfs_tracing_debug:file r_file_perms;
+')
+
+# Do not audit the cases where traced_perf attempts to access /proc/[pid] for
+# domains that it cannot read.
+dontaudit traced_perf domain:dir { search getattr open };
+
+# Do not audit failures to signal a process, as there are cases when this is
+# expected (native processes on debug builds use the policy for enforcing which
+# processes are profileable).
+dontaudit traced_perf domain:process signal;
+
+# Never allow access to app data files
+neverallow traced_perf app_data_file_type:file *;
+
+# Never allow profiling privileged or otherwise incompatible domains.
+# Corresponding allow-rule is in private/domain.te.
+never_profile_perf(`{
+ apexd
+ app_zygote
+ bpfloader
+ hal_configstore_server
+ init
+ kernel
+ keystore
+ llkd
+ logd
+ ueventd
+ vendor_init
+ vold
+ webview_zygote
+ zygote
+}')
diff --git a/prebuilts/api/202504/private/traced_probes.te b/prebuilts/api/202504/private/traced_probes.te
new file mode 100644
index 0000000..6a42eb2
--- /dev/null
+++ b/prebuilts/api/202504/private/traced_probes.te
@@ -0,0 +1,175 @@
+# Perfetto tracing probes, has tracefs access.
+type traced_probes_exec, system_file_type, exec_type, file_type;
+type traced_probes_tmpfs, file_type;
+
+# Allow init to exec the daemon.
+init_daemon_domain(traced_probes)
+tmpfs_domain(traced_probes)
+
+# Write trace data to the Perfetto traced damon. This requires connecting to its
+# producer socket and obtaining a (per-process) tmpfs fd.
+perfetto_producer(traced_probes)
+
+# Allow traced_probes to access tracefs.
+allow traced_probes debugfs_tracing:dir r_dir_perms;
+allow traced_probes debugfs_tracing:file rw_file_perms;
+allow traced_probes debugfs_trace_marker:file getattr;
+allow traced_probes debugfs_tracing_printk_formats:file r_file_perms;
+
+# Allow traced_probes to access mm_events trace instance
+allow traced_probes debugfs_tracing_instances:dir search;
+allow traced_probes debugfs_mm_events_tracing:dir search;
+allow traced_probes debugfs_mm_events_tracing:file rw_file_perms;
+
+# TODO(primiano): temporarily I/O tracing categories are still
+# userdebug only until we nail down the denylist/allowlist.
+userdebug_or_eng(`
+allow traced_probes debugfs_tracing_debug:dir r_dir_perms;
+allow traced_probes debugfs_tracing_debug:file rw_file_perms;
+')
+
+# Allow traced_probes to start with a higher scheduling class and then downgrade
+# itself.
+allow traced_probes self:global_capability_class_set { sys_nice };
+
+# Allow procfs access
+r_dir_file(traced_probes, domain)
+
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
+userdebug_or_eng(`set_prop(traced_probes, lower_kptr_restrict_prop)')
+allow traced_probes proc_kallsyms:file { open read lock };
+
+# Allow to read packages.list file.
+allow traced_probes packages_list_file:file r_file_perms;
+
+# Allow to read game_mode_intervention.list file.
+allow traced_probes game_mode_intervention_list_file:file r_file_perms;
+
+# Allow to log to kernel dmesg when starting / stopping ftrace.
+allow traced_probes kmsg_device:chr_file write;
+
+# Allow traced_probes to list the system partition.
+allow traced_probes system_file:dir { open read };
+
+# Allow traced_probes to list some of the data partition.
+allow traced_probes self:global_capability_class_set dac_read_search;
+
+allow traced_probes apk_data_file:dir { getattr open read search };
+allow traced_probes { apex_art_data_file apex_module_data_file }:dir { getattr open read search };
+allow traced_probes dalvikcache_data_file:dir { getattr open read search };
+userdebug_or_eng(`
+# search and getattr are granted via domain and coredomain, respectively.
+allow traced_probes system_data_file:dir { open read };
+')
+allow traced_probes system_app_data_file:dir { getattr open read search };
+allow traced_probes backup_data_file:dir { getattr open read search };
+allow traced_probes bootstat_data_file:dir { getattr open read search };
+allow traced_probes update_engine_data_file:dir { getattr open read search };
+allow traced_probes update_engine_log_data_file:dir { getattr open read search };
+allow traced_probes { user_profile_root_file user_profile_data_file}:dir { getattr open read search };
+
+# Allow traced_probes to run atrace. atrace pokes at system services to enable
+# their userspace TRACE macros.
+domain_auto_trans(traced_probes, atrace_exec, atrace);
+
+# Allow traced_probes to kill atrace on timeout.
+allow traced_probes atrace:process sigkill;
+
+# Allow traced_probes to access /proc files for system stats.
+# Note: trace data is NOT exposed to anything other than shell and privileged
+# system apps that have access to the traced consumer socket.
+allow traced_probes {
+ proc_meminfo
+ proc_vmstat
+ proc_stat
+ proc_buddyinfo
+ proc_pressure_cpu
+ proc_pressure_io
+ proc_pressure_mem
+}:file r_file_perms;
+
+# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files
+allow traced_probes sysfs_devfreq_dir:dir r_dir_perms;
+allow traced_probes sysfs_devfreq_cur:file r_file_perms;
+
+# Allow access to read /proc/diskstats for I/O profiling.
+allow traced_probes proc_diskstats:file r_file_perms;
+
+# Allow access to the IHealth and IPowerStats HAL service for tracing battery counters.
+hal_client_domain(traced_probes, hal_health)
+hal_client_domain(traced_probes, hal_power_stats)
+
+# Allow access to Atrace HAL for enabling vendor/device specific tracing categories.
+hal_client_domain(traced_probes, hal_atrace)
+
+# On debug builds allow to ingest system logs into the trace.
+userdebug_or_eng(`read_logd(traced_probes)')
+
+# Allow traced_probes to talk to statsd for logging metrics and recording atoms.
+unix_socket_send(traced_probes, statsdw, statsd)
+binder_call(traced_probes, statsd)
+allow traced_probes stats_service:service_manager find;
+
+# Allow traced_probes to talk to suspend control service to read details of kernel wakelocks.
+allow traced_probes system_suspend_control_internal_service:service_manager find;
+allow traced_probes system_suspend:binder call;
+
+# Allow reading the system property representing number of desktop windows to
+# set the initial value for the counter in traces.
+get_prop(traced_probes, debug_tracing_desktop_mode_visible_tasks_prop)
+
+###
+### Neverallow rules
+###
+### traced_probes should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced_probes self:process execmem;
+
+# Block device access.
+neverallow traced_probes dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow traced_probes domain:process ptrace;
+
+# Disallows access to /data files.
+neverallow traced_probes {
+ data_file_type
+ -apex_module_data_file
+ -apex_art_data_file
+ -apk_data_file
+ -dalvikcache_data_file
+ -system_data_file
+ -system_data_root_file
+ -media_userdir_file
+ -system_userdir_file
+ -vendor_userdir_file
+ -system_app_data_file
+ -backup_data_file
+ -bootstat_data_file
+ -update_engine_data_file
+ -update_engine_log_data_file
+ -user_profile_root_file
+ -user_profile_data_file
+ # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
+ # subsequent neverallow. Currently only getattr and search are allowed.
+ -vendor_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:dir *;
+neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search };
+neverallow traced_probes {
+ data_file_type
+ -packages_list_file
+ with_native_coverage(`-method_trace_data_file')
+ -game_mode_intervention_list_file
+}:file *;
+
+# Only init is allowed to enter the traced_probes domain via exec()
+neverallow { domain -init } traced_probes:process transition;
+neverallow * traced_probes:process dyntransition;
+
diff --git a/prebuilts/api/202504/private/traceur_app.te b/prebuilts/api/202504/private/traceur_app.te
new file mode 100644
index 0000000..4e6feff
--- /dev/null
+++ b/prebuilts/api/202504/private/traceur_app.te
@@ -0,0 +1,51 @@
+typeattribute traceur_app coredomain;
+
+app_domain(traceur_app);
+allow traceur_app debugfs_tracing:file rw_file_perms;
+allow traceur_app debugfs_tracing_debug:dir r_dir_perms;
+
+userdebug_or_eng(`
+ allow traceur_app debugfs_tracing_debug:file rw_file_perms;
+')
+
+allow traceur_app trace_data_file:file create_file_perms;
+allow traceur_app trace_data_file:dir rw_dir_perms;
+allow traceur_app wm_trace_data_file:dir rw_dir_perms;
+allow traceur_app wm_trace_data_file:file { getattr r_file_perms unlink };
+allow traceur_app atrace_exec:file rx_file_perms;
+
+# To exec the perfetto cmdline client and pass it the trace config on
+# stdint through a pipe.
+allow traceur_app perfetto_exec:file rx_file_perms;
+
+# Allow to access traced's privileged consumer socket.
+unix_socket_connect(traceur_app, traced_consumer, traced)
+
+dontaudit traceur_app debugfs_tracing_debug:file audit_access;
+
+set_prop(traceur_app, debug_prop)
+
+allow traceur_app servicemanager:service_manager list;
+allow traceur_app hwservicemanager:hwservice_manager list;
+
+allow traceur_app {
+ service_manager_type
+ -apex_service
+ -dnsresolver_service
+ -gatekeeper_service
+ -incident_service
+ -installd_service
+ -lpdump_service
+ -mdns_service
+ -netd_service
+ -virtual_touchpad_service
+ -vold_service
+ -default_android_service
+}:service_manager find;
+
+# Allow traceur_app to use atrace HAL
+hal_client_domain(traceur_app, hal_atrace)
+
+dontaudit traceur_app service_manager_type:service_manager find;
+dontaudit traceur_app hwservice_manager_type:hwservice_manager find;
+dontaudit traceur_app domain:binder call;
diff --git a/prebuilts/api/202504/private/tradeinmode.te b/prebuilts/api/202504/private/tradeinmode.te
new file mode 100644
index 0000000..18cf452
--- /dev/null
+++ b/prebuilts/api/202504/private/tradeinmode.te
@@ -0,0 +1,35 @@
+### trade-in mode
+
+type tradeinmode, domain, coredomain;
+type tradeinmode_exec, exec_type, file_type, system_file_type;
+
+allow tradeinmode adbd_tradeinmode:fd use;
+allow tradeinmode adbd_tradeinmode:unix_stream_socket { read write ioctl };
+
+# Needed to enable trade-in mode for testing.
+set_prop(tradeinmode, adbd_tradeinmode_prop)
+
+# Allow running from normal shell.
+allow tradeinmode { adbd shell }:fd use;
+allow tradeinmode adbd:unix_stream_socket { read write ioctl };
+
+allow tradeinmode devpts:chr_file rw_file_perms;
+
+# Allow executing am/content without a domain transition.
+allow tradeinmode system_file:file rx_file_perms;
+allow tradeinmode zygote_exec:file rx_file_perms;
+allow tradeinmode apex_info_file:file r_file_perms;
+
+allow tradeinmode activity_service:service_manager find;
+
+get_prop(tradeinmode, odsign_prop)
+get_prop(tradeinmode, build_attestation_prop)
+get_prop(tradeinmode, adbd_tradeinmode_prop)
+set_prop(tradeinmode, powerctl_prop)
+
+# Needed to start activities through "am".
+binder_call(tradeinmode, system_server)
+binder_call(tradeinmode, servicemanager)
+
+# Needed to run "content".
+binder_call(tradeinmode, platform_app)
diff --git a/prebuilts/api/202504/private/ueventd.te b/prebuilts/api/202504/private/ueventd.te
new file mode 100644
index 0000000..7effa6d
--- /dev/null
+++ b/prebuilts/api/202504/private/ueventd.te
@@ -0,0 +1,92 @@
+typeattribute ueventd coredomain;
+
+tmpfs_domain(ueventd)
+
+# ueventd can set properties, particularly it sets ro.cold_boot_done to signal
+# to init that cold boot has completed.
+set_prop(ueventd, cold_boot_done_prop)
+
+# Write to /dev/kmsg.
+allow ueventd kmsg_device:chr_file rw_file_perms;
+
+allow ueventd self:global_capability_class_set { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner setuid };
+allow ueventd device:file create_file_perms;
+
+r_dir_file(ueventd, rootfs)
+
+# ueventd needs write access to files in /sys to regenerate uevents
+allow ueventd sysfs_type:file w_file_perms;
+r_dir_file(ueventd, sysfs_type)
+allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr };
+allow ueventd sysfs_type:dir { relabelfrom relabelto setattr };
+allow ueventd tmpfs:chr_file rw_file_perms;
+allow ueventd dev_type:dir create_dir_perms;
+allow ueventd dev_type:lnk_file { create unlink };
+allow ueventd dev_type:chr_file { getattr create setattr unlink };
+allow ueventd dev_type:blk_file { getattr relabelfrom relabelto create setattr unlink };
+allow ueventd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow ueventd efs_file:dir search;
+allow ueventd efs_file:file r_file_perms;
+
+# Get SELinux enforcing status.
+r_dir_file(ueventd, selinuxfs)
+
+# Access for /vendor/ueventd.rc and /vendor/firmware
+r_dir_file(ueventd, { vendor_file_type -vendor_app_file -vendor_overlay_file })
+
+# Access for /apex/*/firmware
+allow ueventd apex_mnt_dir:dir r_dir_perms;
+
+# Get file contexts for new device nodes
+allow ueventd file_contexts_file:file r_file_perms;
+
+# Use setfscreatecon() to label /dev directories and files.
+allow ueventd self:process setfscreate;
+
+# Allow ueventd to read androidboot.android_dt_dir from kernel cmdline or bootconfig.
+allow ueventd proc_cmdline:file r_file_perms;
+allow ueventd proc_bootconfig:file r_file_perms;
+
+# Everything is labeled as rootfs in recovery mode. ueventd has to execute
+# the dynamic linker and shared libraries.
+recovery_only(`
+ allow ueventd rootfs:file { r_file_perms execute };
+')
+
+# Suppress denials for ueventd to getattr /postinstall. This occurs when the
+# linker tries to resolve paths in ld.config.txt.
+dontaudit ueventd postinstall_mnt_dir:dir getattr;
+
+# ueventd loads modules in response to modalias events.
+allow ueventd self:global_capability_class_set sys_module;
+allow ueventd vendor_file:system module_load;
+allow ueventd kernel:key search;
+
+# ueventd is using bootstrap bionic
+use_bootstrap_libs(ueventd)
+
+# Allow ueventd to run shell scripts from vendor
+allow ueventd vendor_shell_exec:file execute;
+
+# Query device-mapper to extract name/uuid in response to uevents.
+allow ueventd dm_device:chr_file rw_file_perms;
+allow ueventd self:capability sys_admin;
+
+# Allow ueventd to read apexd property
+get_prop(ueventd, apexd_prop)
+
+#####
+##### neverallow rules
+#####
+
+# Restrict ueventd access on block devices to maintenence operations.
+neverallow ueventd dev_type:blk_file ~{ getattr relabelfrom relabelto create setattr unlink };
+
+# Only relabelto as we would never want to relabelfrom port_device
+neverallow ueventd port_device:chr_file ~{ getattr create setattr unlink relabelto };
+
+# Nobody should be able to ptrace ueventd
+neverallow * ueventd:process ptrace;
+
+# ueventd should never execute a program without changing to another domain.
+neverallow ueventd { file_type fs_type }:file execute_no_trans;
diff --git a/prebuilts/api/202504/private/uncrypt.te b/prebuilts/api/202504/private/uncrypt.te
new file mode 100644
index 0000000..156f684
--- /dev/null
+++ b/prebuilts/api/202504/private/uncrypt.te
@@ -0,0 +1,49 @@
+typeattribute uncrypt coredomain;
+
+init_daemon_domain(uncrypt)
+
+# Set a property to reboot the device.
+set_prop(uncrypt, powerctl_prop)
+
+allow uncrypt self:global_capability_class_set { dac_override dac_read_search };
+
+userdebug_or_eng(`
+ # For debugging, allow /data/local/tmp access
+ r_dir_file(uncrypt, shell_data_file)
+')
+
+# Read /cache/recovery/command
+# Read /cache/recovery/uncrypt_file
+allow uncrypt cache_file:dir search;
+allow uncrypt cache_recovery_file:dir rw_dir_perms;
+allow uncrypt cache_recovery_file:file create_file_perms;
+
+# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/.
+allow uncrypt ota_package_file:dir r_dir_perms;
+allow uncrypt ota_package_file:file rw_file_perms;
+
+# Write to /dev/socket/uncrypt
+unix_socket_connect(uncrypt, uncrypt, uncrypt)
+
+# Raw writes to block device
+allow uncrypt self:global_capability_class_set sys_rawio;
+allow uncrypt misc_block_device:blk_file w_file_perms;
+allow uncrypt block_device:dir r_dir_perms;
+
+# Access userdata block device.
+allow uncrypt userdata_block_device:blk_file w_file_perms;
+
+r_dir_file(uncrypt, rootfs)
+
+# Access to bootconfig is needed when calling ReadDefaultFstab.
+allow uncrypt {
+ proc_bootconfig
+ proc_cmdline
+
+}:file r_file_perms;
+
+# Read files in /sys
+r_dir_file(uncrypt, sysfs_dt_firmware_android)
+
+# Allow ReadDefaultFstab().
+read_fstab(uncrypt)
diff --git a/prebuilts/api/202504/private/untrusted_app.te b/prebuilts/api/202504/private/untrusted_app.te
new file mode 100644
index 0000000..d0f9b24
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app.te
@@ -0,0 +1,23 @@
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion >= 34.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app coredomain;
+
+app_domain(untrusted_app)
+untrusted_app_domain(untrusted_app)
+net_domain(untrusted_app)
+bluetooth_domain(untrusted_app)
+
+# Allow webview to access fd shared by sdksandbox for experiments data
+# TODO(b/229249719): Will not be supported in Android U
+allow untrusted_app sdk_sandbox_data_file:fd use;
+allow untrusted_app sdk_sandbox_data_file:file write;
+
+neverallow untrusted_app sdk_sandbox_data_file:file { open create };
diff --git a/prebuilts/api/202504/private/untrusted_app_25.te b/prebuilts/api/202504/private/untrusted_app_25.te
new file mode 100644
index 0000000..d59245c
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_25.te
@@ -0,0 +1,70 @@
+###
+### Untrusted_app_25
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion <= 25.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_25 coredomain;
+
+app_domain(untrusted_app_25)
+untrusted_app_domain(untrusted_app_25)
+net_domain(untrusted_app_25)
+bluetooth_domain(untrusted_app_25)
+
+# b/35917228 - /proc/misc access
+# This will go away in a future Android release
+allow untrusted_app_25 proc_misc:file r_file_perms;
+
+# Access to /proc/tty/drivers, to allow apps to determine if they
+# are running in an emulated environment.
+# b/33214085 b/33814662 b/33791054 b/33211769
+# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
+# This will go away in a future Android release
+allow untrusted_app_25 proc_tty_drivers:file r_file_perms;
+
+# Text relocation support for API < 23. This is now disallowed for targetSdkVersion>=Q.
+# https://android.googlesource.com/platform/bionic/+/master/android-changes-for-ndk-developers.md#text-relocations-enforced-for-api-level-23
+allow untrusted_app_25 { apk_data_file app_data_file asec_public_file }:file execmod;
+
+# The ability to call exec() on files in the apps home directories
+# for targetApi<=25. This is also allowed for targetAPIs 26, 27,
+# and 28 in untrusted_app_27.te.
+allow untrusted_app_25 app_data_file:file execute_no_trans;
+auditallow untrusted_app_25 app_data_file:file { execute execute_no_trans };
+
+# The ability to invoke dex2oat. Historically required by ART, now only
+# allowed for targetApi<=28 for compat reasons.
+allow untrusted_app_25 dex2oat_exec:file rx_file_perms;
+userdebug_or_eng(`auditallow untrusted_app_25 dex2oat_exec:file rx_file_perms;')
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_25 ashmem_device:chr_file rw_file_perms;
+auditallow untrusted_app_25 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_25 mnt_sdcard_file:lnk_file r_file_perms;
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_25 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_25 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(untrusted_app_25, mdnsd, mdnsd)
+userdebug_or_eng(`
+ auditallow untrusted_app_25 mdnsd_socket:sock_file write;
+ auditallow untrusted_app_25 mdnsd:unix_stream_socket connectto;
+')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_25 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_25 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_25 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_25 apk_data_file:file { watch watch_reads };
+')
diff --git a/prebuilts/api/202504/private/untrusted_app_27.te b/prebuilts/api/202504/private/untrusted_app_27.te
new file mode 100644
index 0000000..8c970d8
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_27.te
@@ -0,0 +1,58 @@
+###
+### Untrusted_27.
+###
+### This file defines the rules for untrusted apps running with
+### 25 < targetSdkVersion <= 28.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_27 coredomain;
+
+app_domain(untrusted_app_27)
+untrusted_app_domain(untrusted_app_27)
+net_domain(untrusted_app_27)
+bluetooth_domain(untrusted_app_27)
+
+# Text relocation support for API < 23. This is now disallowed for targetSdkVersion>=Q.
+# https://android.googlesource.com/platform/bionic/+/master/android-changes-for-ndk-developers.md#text-relocations-enforced-for-api-level-23
+allow untrusted_app_27 { apk_data_file app_data_file asec_public_file }:file execmod;
+
+# The ability to call exec() on files in the apps home directories
+# for targetApi 26, 27, and 28.
+allow untrusted_app_27 app_data_file:file execute_no_trans;
+auditallow untrusted_app_27 app_data_file:file { execute execute_no_trans };
+
+# The ability to invoke dex2oat. Historically required by ART, now only
+# allowed for targetApi<=28 for compat reasons.
+allow untrusted_app_27 dex2oat_exec:file rx_file_perms;
+userdebug_or_eng(`auditallow untrusted_app_27 dex2oat_exec:file rx_file_perms;')
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_27 ashmem_device:chr_file rw_file_perms;
+auditallow untrusted_app_27 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_27 mnt_sdcard_file:lnk_file r_file_perms;
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_27 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_27 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(untrusted_app_27, mdnsd, mdnsd)
+userdebug_or_eng(`
+ auditallow untrusted_app_27 mdnsd_socket:sock_file write;
+ auditallow untrusted_app_27 mdnsd:unix_stream_socket connectto;
+')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_27 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_27 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_27 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_27 apk_data_file:file { watch watch_reads };
+')
diff --git a/prebuilts/api/202504/private/untrusted_app_29.te b/prebuilts/api/202504/private/untrusted_app_29.te
new file mode 100644
index 0000000..ed0bbfc
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_29.te
@@ -0,0 +1,36 @@
+###
+### Untrusted_29.
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion = 29.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_29 coredomain;
+
+app_domain(untrusted_app_29)
+untrusted_app_domain(untrusted_app_29)
+net_domain(untrusted_app_29)
+bluetooth_domain(untrusted_app_29)
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(untrusted_app_29, mdnsd, mdnsd)
+userdebug_or_eng(`
+ auditallow untrusted_app_29 mdnsd_socket:sock_file write;
+ auditallow untrusted_app_29 mdnsd:unix_stream_socket connectto;
+')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_29 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_29 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_29 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_29 apk_data_file:file { watch watch_reads };
+')
diff --git a/prebuilts/api/202504/private/untrusted_app_30.te b/prebuilts/api/202504/private/untrusted_app_30.te
new file mode 100644
index 0000000..c87548e
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_30.te
@@ -0,0 +1,38 @@
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### 29 < targetSdkVersion <= 31.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+### TODO(b/192334803): Merge this policy into untrusted_app_29 when possible
+###
+
+typeattribute untrusted_app_30 coredomain;
+
+app_domain(untrusted_app_30)
+untrusted_app_domain(untrusted_app_30)
+net_domain(untrusted_app_30)
+bluetooth_domain(untrusted_app_30)
+
+# allow sending RTM_GETNEIGH{TBL} messages.
+allow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh;
+auditallow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh;
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(untrusted_app_30, mdnsd, mdnsd)
+userdebug_or_eng(`
+ auditallow untrusted_app_30 mdnsd_socket:sock_file write;
+ auditallow untrusted_app_30 mdnsd:unix_stream_socket connectto;
+')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_30 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_30 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_30 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_30 apk_data_file:file { watch watch_reads };
+')
diff --git a/prebuilts/api/202504/private/untrusted_app_32.te b/prebuilts/api/202504/private/untrusted_app_32.te
new file mode 100644
index 0000000..6e95fd1
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_32.te
@@ -0,0 +1,39 @@
+###
+### Untrusted apps.
+###
+### This file defines the rules for untrusted apps running with
+### 31 < targetSdkVersion <= 33.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_32 coredomain;
+
+app_domain(untrusted_app_32)
+untrusted_app_domain(untrusted_app_32)
+net_domain(untrusted_app_32)
+bluetooth_domain(untrusted_app_32)
+
+# Allow webview to access fd shared by sdksandbox for experiments data
+# TODO(b/229249719): Will not be supported in Android U
+allow untrusted_app_32 sdk_sandbox_data_file:fd use;
+allow untrusted_app_32 sdk_sandbox_data_file:file write;
+
+neverallow untrusted_app_32 sdk_sandbox_data_file:file { open create };
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(untrusted_app_32, mdnsd, mdnsd)
+userdebug_or_eng(`
+ auditallow untrusted_app_32 mdnsd_socket:sock_file write;
+ auditallow untrusted_app_32 mdnsd:unix_stream_socket connectto;
+')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_32 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_32 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_32 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_32 apk_data_file:file { watch watch_reads };
+')
diff --git a/prebuilts/api/202504/private/untrusted_app_all.te b/prebuilts/api/202504/private/untrusted_app_all.te
new file mode 100644
index 0000000..c646137
--- /dev/null
+++ b/prebuilts/api/202504/private/untrusted_app_all.te
@@ -0,0 +1,179 @@
+###
+### Untrusted_app_all.
+###
+### This file defines the rules shared by all untrusted app domains except
+### ephemeral_app for instant apps and isolated_app (which has a reduced
+### permission set).
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The untrusted_app_all attribute is assigned to all default
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml. In current AOSP, this
+### attribute is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key. To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
+###
+### Note that rules that should apply to all untrusted apps must be in app.te or also
+### added to ephemeral_app.te.
+
+# Some apps ship with shared libraries and binaries that they write out
+# to their sandbox directory and then execute.
+allow untrusted_app_all privapp_data_file:file { r_file_perms execute };
+allow untrusted_app_all app_data_file:file { r_file_perms execute };
+auditallow untrusted_app_all app_data_file:file execute;
+
+# Chrome Crashpad uses the the dynamic linker to load native executables
+# from an APK (b/112050209, crbug.com/928422)
+allow untrusted_app_all system_linker_exec:file execute_no_trans;
+
+# Follow priv-app symlinks. This is used for dynamite functionality.
+allow untrusted_app_all privapp_data_file:lnk_file r_file_perms;
+
+# Allow handling of less common filesystem objects
+allow untrusted_app_all app_data_file:{ lnk_file sock_file fifo_file } create_file_perms;
+
+# Allow loading and deleting executable shared libraries
+# within an application home directory. Such shared libraries would be
+# created by things like renderscript or via other mechanisms.
+allow untrusted_app_all app_exec_data_file:file { r_file_perms execute unlink };
+
+# ASEC
+allow untrusted_app_all asec_apk_file:file r_file_perms;
+allow untrusted_app_all asec_apk_file:dir r_dir_perms;
+# Execute libs in asec containers.
+allow untrusted_app_all asec_public_file:file { execute };
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+# TODO: Long term, we don't want apps probing into shell data files.
+# Figure out a way to remove these rules.
+allow untrusted_app_all shell_data_file:file r_file_perms;
+allow untrusted_app_all shell_data_file:dir r_dir_perms;
+
+# Allow traceur to pass file descriptors through a content provider to untrusted apps
+# for the purpose of sharing files through e.g. gmail
+allow untrusted_app_all trace_data_file:file { getattr read };
+
+# untrusted apps should not be able to open trace data files, they should depend
+# upon traceur to pass a file descriptor
+neverallow untrusted_app_all trace_data_file:dir *;
+neverallow untrusted_app_all trace_data_file:file { no_w_file_perms open };
+
+# neverallow untrusted apps accessing debugfs_tracing
+neverallow untrusted_app_all debugfs_tracing:file no_rw_file_perms;
+
+# Allow to read staged apks.
+allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr};
+
+# Read and write system app data files passed over Binder.
+# Motivating case was /data/data/com.android.settings/cache/*.jpg for
+# cropping or taking user photos.
+allow untrusted_app_all system_app_data_file:file { read write getattr };
+
+#
+# Rules migrated from old app domains coalesced into untrusted_app.
+# This includes what used to be media_app, shared_app, and release_app.
+#
+
+# Access to /data/media.
+allow untrusted_app_all media_rw_data_file:dir create_dir_perms;
+allow untrusted_app_all media_rw_data_file:file create_file_perms;
+
+# allow cts to query all services
+allow untrusted_app_all servicemanager:service_manager list;
+
+allow untrusted_app_all audioserver_service:service_manager find;
+allow untrusted_app_all cameraserver_service:service_manager find;
+allow untrusted_app_all drmserver_service:service_manager find;
+allow untrusted_app_all mediaserver_service:service_manager find;
+allow untrusted_app_all mediaextractor_service:service_manager find;
+allow untrusted_app_all mediametrics_service:service_manager find;
+allow untrusted_app_all mediadrmserver_service:service_manager find;
+allow untrusted_app_all nfc_service:service_manager find;
+allow untrusted_app_all radio_service:service_manager find;
+allow untrusted_app_all app_api_service:service_manager find;
+allow untrusted_app_all vr_manager_service:service_manager find;
+
+# gdbserver for ndk-gdb ptrace attaches to app process.
+allow untrusted_app_all self:process ptrace;
+
+# Android Studio Instant Run has the application connect to a
+# runas_app socket listening in the abstract namespace.
+# https://developer.android.com/studio/run/
+# b/123297648
+allow untrusted_app_all runas_app:unix_stream_socket connectto;
+
+# Untrusted apps need to be able to send a SIGCHLD to runas_app
+# when running under a debugger (b/123612207)
+allow untrusted_app_all runas_app:process sigchld;
+
+# Cts: HwRngTest
+allow untrusted_app_all sysfs_hwrandom:dir search;
+allow untrusted_app_all sysfs_hwrandom:file r_file_perms;
+
+# Allow apps to view preloaded media content
+allow untrusted_app_all preloads_media_file:dir r_dir_perms;
+allow untrusted_app_all preloads_media_file:file r_file_perms;
+allow untrusted_app_all preloads_data_file:dir search;
+
+# Allow untrusted apps read / execute access to /vendor/app for there can
+# be pre-installed vendor apps that package a library within themselves.
+# TODO (b/37784178) Consider creating a special type for /vendor/app installed
+# apps.
+allow untrusted_app_all vendor_app_file:dir { open getattr read search };
+allow untrusted_app_all vendor_app_file:file { r_file_perms execute };
+allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
+
+# allow untrusted apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow untrusted_app_all system_server:udp_socket {
+ connect getattr read recvfrom sendto write getopt setopt };
+
+# Allow the renderscript compiler to be run.
+domain_auto_trans(untrusted_app_all, rs_exec, rs)
+
+# suppress denials caused by debugfs_tracing
+dontaudit untrusted_app_all debugfs_tracing:file rw_file_perms;
+
+# This is allowed for targetSdkVersion <= 25 but disallowed on newer versions.
+dontaudit untrusted_app_all net_dns_prop:file read;
+
+# These have been disallowed since Android O.
+# For P, we assume that apps are safely handling the denial.
+dontaudit untrusted_app_all {
+ proc_stat
+ proc_uptime
+ proc_vmstat
+ proc_zoneinfo
+}:file read;
+
+# Allow the allocation and use of ptys
+# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
+create_pty(untrusted_app_all)
+
+# Allow access to kcov via its ioctl interface for coverage
+# guided kernel fuzzing.
+userdebug_or_eng(`
+ allow untrusted_app_all debugfs_kcov:file rw_file_perms;
+ allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
+')
+
+# Allow running a VM for test/demo purposes. Note that access to the
+# service is still guarded with the
+# `android.permission.MANAGE_VIRTUAL_MACHINE` permission. The
+# protection level of the permission is
+# `signature|privileged|development` so that it can only be granted to
+# either platform-key signed apps, privileged apps, or test-only apps
+# having `android:testOnly="true"` in their manifest.
+virtualizationservice_use(untrusted_app_all)
+
+with_native_coverage(`
+ # Allow writing coverage information to /data/misc/trace
+ allow domain method_trace_data_file:dir create_dir_perms;
+ allow domain method_trace_data_file:file create_file_perms;
+')
diff --git a/prebuilts/api/202504/private/update_engine.te b/prebuilts/api/202504/private/update_engine.te
new file mode 100644
index 0000000..1a6d9c7
--- /dev/null
+++ b/prebuilts/api/202504/private/update_engine.te
@@ -0,0 +1,120 @@
+typeattribute update_engine coredomain;
+
+init_daemon_domain(update_engine);
+
+# Allow to talk to gsid.
+allow update_engine gsi_service:service_manager find;
+binder_call(update_engine, gsid)
+
+# Allow to start gsid service.
+set_prop(update_engine, ctl_gsid_prop)
+
+# Allow to start snapuserd for dm-user communication.
+set_prop(update_engine, ctl_snapuserd_prop)
+
+# Allow to set the OTA related properties, e.g. ota.warm_reset.
+set_prop(update_engine, ota_prop)
+get_prop(update_engine, ota_build_prop)
+
+# Allow to get the DSU status
+get_prop(update_engine, gsid_prop)
+
+# Allow update_engine to call the callback function provided by GKI update hook.
+binder_call(update_engine, gki_apex_prepostinstall)
+
+# Allow update_engine to call the callback function by settings app
+# for the kernel update triggered using 16k developer option
+binder_call(update_engine, system_app)
+
+# Allow to communicate with the snapuserd service, for dm-user snapshots.
+allow update_engine snapuserd:unix_stream_socket connectto;
+allow update_engine snapuserd_socket:sock_file write;
+get_prop(update_engine, snapuserd_prop)
+
+# Allow to communicate with apexd for calculating and reserving space for
+# capex decompression
+allow update_engine apex_service:service_manager find;
+binder_call(update_engine, apexd)
+
+# let this domain use the hal service
+binder_use(update_engine)
+hal_client_domain(update_engine, hal_bootctl)
+
+net_domain(update_engine);
+
+# Following permissions are needed for update_engine.
+allow update_engine self:process { setsched };
+allow update_engine self:global_capability_class_set { fowner sys_admin };
+# Note: fsetid checks are triggered when creating a file in a directory with
+# the setgid bit set to determine if the file should inherit setgid. In this
+# case, setgid on the file is undesirable so we should just suppress the
+# denial.
+dontaudit update_engine self:global_capability_class_set fsetid;
+
+allow update_engine kmsg_device:chr_file { getattr w_file_perms };
+allow update_engine update_engine_exec:file rx_file_perms;
+wakelock_use(update_engine);
+
+# Ignore these denials.
+dontaudit update_engine kernel:process setsched;
+dontaudit update_engine self:global_capability_class_set sys_rawio;
+
+# Allow using persistent storage in /data/misc/update_engine.
+allow update_engine update_engine_data_file:dir create_dir_perms;
+allow update_engine update_engine_data_file:file create_file_perms;
+
+# Allow using persistent storage in /data/misc/update_engine_log.
+allow update_engine update_engine_log_data_file:dir create_dir_perms;
+allow update_engine update_engine_log_data_file:file create_file_perms;
+
+# Register the service to perform Binder IPC.
+binder_use(update_engine)
+add_service(update_engine, update_engine_service)
+add_service(update_engine, update_engine_stable_service)
+
+# Allow update_engine to call the callback function provided by priv_app/GMS core.
+binder_call(update_engine, priv_app)
+# b/142672293: No other priv-app should need this rule now that GMS core runs in its own domain.
+userdebug_or_eng(`
+ auditallow update_engine priv_app:binder { call transfer };
+ auditallow priv_app update_engine:binder transfer;
+ auditallow update_engine priv_app:fd use;
+')
+
+binder_call(update_engine, gmscore_app)
+
+# Allow update_engine to call the callback function provided by system_server.
+binder_call(update_engine, system_server)
+
+# Read OTA zip file at /data/ota_package/.
+allow update_engine ota_package_file:file r_file_perms;
+allow update_engine ota_package_file:dir r_dir_perms;
+
+# Use Boot Control HAL
+hal_client_domain(update_engine, hal_bootctl)
+
+# access /proc/misc
+allow update_engine proc_misc:file r_file_perms;
+
+# read directories on /system and /vendor
+allow update_engine system_file:dir r_dir_perms;
+
+# Allow ReadDefaultFstab().
+# update_engine tries to determine the parent path for all devices (e.g.
+# /dev/block/by-name) by reading the default fstab and looking for the misc
+# device.
+read_fstab(update_engine)
+
+# Allow to write to snapshotctl_log logs.
+# TODO(b/148818798) revert when parent bug is fixed.
+userdebug_or_eng(`
+allow update_engine snapshotctl_log_data_file:dir rw_dir_perms;
+allow update_engine snapshotctl_log_data_file:file create_file_perms;
+')
+
+# Allow determining filesystems available on system.
+# Needed for checking if overlayfs is enabled
+allow update_engine proc_filesystems:file r_file_perms;
+
+allow update_engine vendor_boot_ota_file:dir { r_dir_perms };
+allow update_engine vendor_boot_ota_file:file { r_file_perms };
diff --git a/prebuilts/api/202504/private/update_engine_common.te b/prebuilts/api/202504/private/update_engine_common.te
new file mode 100644
index 0000000..6de0292
--- /dev/null
+++ b/prebuilts/api/202504/private/update_engine_common.te
@@ -0,0 +1,111 @@
+# update_engine payload application permissions. These are shared between the
+# background daemon and the recovery tool to sideload an update.
+
+# type_transition must be private policy the domain_trans rules could stay
+# public, but conceptually should go with this
+# The postinstall program is run by update_engine_common and must be tagged
+# with postinstall_exec in the new filesystem.
+# TODO Have build system attempt to verify this
+domain_auto_trans(update_engine_common, postinstall_exec, postinstall)
+
+# Vendor directories can have the transition as well during OTA. This is caused
+# by update_engine execing scripts in vendor to perform any update tasks needed
+# there.
+domain_auto_trans(update_engine_common, postinstall_file, postinstall)
+
+# Allow update_engine to reach block devices in /dev/block.
+allow update_engine_common block_device:dir search;
+
+# Allow read/write on system and boot partitions.
+allow update_engine_common boot_block_device:blk_file rw_file_perms;
+allow update_engine_common system_block_device:blk_file rw_file_perms;
+
+# Where ioctls are granted via standard allow rules to block devices,
+# automatically allow common ioctls that are generally needed by
+# update_engine.
+allowxperm update_engine_common dev_type:blk_file ioctl {
+ BLKDISCARD
+ BLKDISCARDZEROES
+ BLKROGET
+ BLKROSET
+ BLKSECDISCARD
+ BLKZEROOUT
+};
+
+# Allow to set recovery options in the BCB. Used to trigger factory reset when
+# the update to an older version (channel change) or incompatible version
+# requires it.
+allow update_engine_common misc_block_device:blk_file rw_file_perms;
+
+# read fstab
+allow update_engine_common rootfs:dir getattr;
+allow update_engine_common rootfs:file r_file_perms;
+
+# Allow update_engine_common to mount on the /postinstall directory and reset the
+# labels on the mounted filesystem to postinstall_file.
+allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search };
+allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto };
+allow update_engine_common labeledfs:filesystem { mount unmount relabelfrom };
+
+# Allow update_engine_common to read and execute postinstall_file.
+allow update_engine_common postinstall_file:file rx_file_perms;
+allow update_engine_common postinstall_file:lnk_file r_file_perms;
+allow update_engine_common postinstall_file:dir r_dir_perms;
+
+# install update.zip from cache
+r_dir_file(update_engine_common, cache_file)
+
+# A postinstall program is typically a shell script (with a #!), so we allow
+# to execute those.
+allow update_engine_common shell_exec:file rx_file_perms;
+
+# Allow update_engine_common to suspend, resume and kill the postinstall program.
+allow update_engine_common postinstall:process { signal sigstop sigkill };
+
+# access /proc/cmdline
+allow update_engine_common proc_cmdline:file r_file_perms;
+
+# Read files in /sys/firmware/devicetree/base/firmware/android/
+r_dir_file(update_engine_common, sysfs_dt_firmware_android)
+
+# Needed because libdm reads sysfs to validate when a dm path is ready.
+r_dir_file(update_engine_common, sysfs_dm)
+
+# Scan files in /sys/fs/ext4 and /sys/fs/f2fs for device-mapper diagnostics.
+allow update_engine_common sysfs:dir r_dir_perms;
+allow update_engine_common sysfs_fs_f2fs:dir r_dir_perms;
+
+# read / write on /dev/device-mapper to map / unmap devices
+allow update_engine_common dm_device:chr_file rw_file_perms;
+
+# apply / verify updates on devices mapped via device mapper
+allow update_engine_common dm_device:blk_file rw_file_perms;
+
+# read /dev/dm-user, so that we can inotify wait for control devices to be
+# asynchronously created by ueventd.
+allow update_engine dm_user_device:dir r_dir_perms;
+allow update_engine dm_user_device:chr_file r_file_perms;
+
+# read / write metadata on super device to resize partitions
+allow update_engine_common super_block_device_type:blk_file rw_file_perms;
+
+# ioctl on super device to get block device alignment and alignment offset
+allowxperm update_engine_common super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
+
+# get physical block device to map logical partitions on device mapper
+allow update_engine_common block_device:dir r_dir_perms;
+
+# Allow update_engine_common to write to statsd socket.
+unix_socket_send(update_engine_common, statsdw, statsd)
+
+# Allow to read Virtual A/B feature flags.
+get_prop(update_engine_common, virtual_ab_prop)
+
+# Allow to read GKI related flags.
+get_prop(update_engine_common, ab_update_gki_prop)
+get_prop(update_engine_common, build_bootimage_prop)
+
+# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
+allow update_engine_common metadata_file:dir search;
+allow update_engine_common ota_metadata_file:dir { rw_dir_perms rmdir };
+allow update_engine_common ota_metadata_file:file create_file_perms;
diff --git a/prebuilts/api/202504/private/update_verifier.te b/prebuilts/api/202504/private/update_verifier.te
new file mode 100644
index 0000000..2c68f4c
--- /dev/null
+++ b/prebuilts/api/202504/private/update_verifier.te
@@ -0,0 +1,46 @@
+typeattribute update_verifier coredomain;
+
+init_daemon_domain(update_verifier)
+
+# Allow update_verifier to reboot the device.
+set_prop(update_verifier, powerctl_prop)
+
+# Allow to set the OTA related properties e.g. ota.warm_reset.
+set_prop(update_verifier, ota_prop)
+
+# allow update_verifier to connect to snapuserd daemon
+allow update_verifier snapuserd_socket:sock_file write;
+allow update_verifier snapuserd:unix_stream_socket connectto;
+
+# virtual a/b properties
+get_prop(update_verifier, virtual_ab_prop)
+
+# Allow update_verifier to reach block devices in /dev/block.
+allow update_verifier block_device:dir search;
+
+# Read care map in /data/ota_package/.
+allow update_verifier ota_package_file:dir r_dir_perms;
+allow update_verifier ota_package_file:file r_file_perms;
+
+# Read /sys/block to find all the DM directories like (/sys/block/dm-X).
+allow update_verifier sysfs:dir r_dir_perms;
+
+# Read /sys/block/dm-X/dm/name (which is a symlink to
+# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between
+# dm-X and system/vendor partitions.
+allow update_verifier sysfs_dm:dir r_dir_perms;
+allow update_verifier sysfs_dm:file r_file_perms;
+
+# Read all blocks in DM wrapped system partition.
+allow update_verifier dm_device:blk_file r_file_perms;
+
+# Write to kernel message.
+allow update_verifier kmsg_device:chr_file { getattr w_file_perms };
+
+# Use Boot Control HAL
+hal_client_domain(update_verifier, hal_bootctl)
+
+# Access Checkpoint commands over binder
+allow update_verifier vold_service:service_manager find;
+binder_call(update_verifier, servicemanager)
+binder_call(update_verifier, vold)
diff --git a/prebuilts/api/202504/private/uprobestats.te b/prebuilts/api/202504/private/uprobestats.te
new file mode 100644
index 0000000..d778126
--- /dev/null
+++ b/prebuilts/api/202504/private/uprobestats.te
@@ -0,0 +1,38 @@
+type uprobestats, domain, coredomain;
+
+typeattribute uprobestats bpfdomain;
+
+type uprobestats_exec, system_file_type, exec_type, file_type;
+
+# Allow init to start uprobestats.
+init_daemon_domain(uprobestats)
+
+allow uprobestats fs_bpf_uprobestats:file { read write };
+allow uprobestats fs_bpf_uprobestats:dir search;
+allow uprobestats bpfloader:bpf { map_read map_write prog_run };
+allow uprobestats self:capability2 perfmon;
+allow uprobestats self:perf_event { cpu open write };
+allow uprobestats sysfs_uprobe:file { open read };
+allow uprobestats sysfs_uprobe:dir { search };
+
+# Allow uprobestats to popen oatdump.
+allow uprobestats system_file:file rx_file_perms;
+
+# Allow uprobestats to write atoms to statsd
+unix_socket_send(uprobestats, statsdw, statsd)
+
+# For registration with system server as a process observer.
+binder_use(uprobestats)
+allow uprobestats activity_service:service_manager find;
+allow uprobestats dynamic_instrumentation_service:service_manager find;
+binder_call(uprobestats, system_server);
+
+# Allow uprobestats to talk to native package manager
+allow uprobestats package_native_service:service_manager find;
+
+# Allow uprobestats to scan /proc/<pid>/cmdline.
+r_dir_file(uprobestats, { domain -appdomain })
+
+# Allow uprobestats to manage its own config files.
+allow uprobestats uprobestats_configs_data_file:dir rw_dir_perms;
+allow uprobestats uprobestats_configs_data_file:file { r_file_perms unlink };
diff --git a/prebuilts/api/202504/private/usbd.te b/prebuilts/api/202504/private/usbd.te
new file mode 100644
index 0000000..a444f9c
--- /dev/null
+++ b/prebuilts/api/202504/private/usbd.te
@@ -0,0 +1,17 @@
+typeattribute usbd coredomain;
+
+init_daemon_domain(usbd)
+
+# Access usb gadget hal
+hal_client_domain(usbd, hal_usb_gadget)
+
+# Access persist.sys.usb.config
+get_prop(usbd, system_prop)
+
+# start adbd during boot if adb is enabled
+set_prop(usbd, ctl_default_prop)
+
+# Start/stop adbd via ctl.start adbd
+set_prop(usbd, ctl_adbd_prop)
+
+binder_call(usbd, servicemanager)
diff --git a/prebuilts/api/202504/private/userdata_sysdev.te b/prebuilts/api/202504/private/userdata_sysdev.te
new file mode 100644
index 0000000..9974f36
--- /dev/null
+++ b/prebuilts/api/202504/private/userdata_sysdev.te
@@ -0,0 +1 @@
+allow userdata_sysdev sysfs:filesystem associate;
diff --git a/prebuilts/api/202504/private/users b/prebuilts/api/202504/private/users
new file mode 100644
index 0000000..51b7b57
--- /dev/null
+++ b/prebuilts/api/202504/private/users
@@ -0,0 +1 @@
+user u roles { r } level s0 range s0 - mls_systemhigh;
diff --git a/prebuilts/api/202504/private/vdc.te b/prebuilts/api/202504/private/vdc.te
new file mode 100644
index 0000000..e59afce
--- /dev/null
+++ b/prebuilts/api/202504/private/vdc.te
@@ -0,0 +1,17 @@
+typeattribute vdc coredomain;
+
+init_daemon_domain(vdc)
+
+# Allow stdin/out back to vehicle_binding_util
+allow vdc vehicle_binding_util:fd use;
+
+# vdc can be invoked with logwrapper, so let it write to pty
+allow vdc devpts:chr_file rw_file_perms;
+
+# vdc writes directly to kmsg during the boot process
+allow vdc kmsg_device:chr_file { getattr w_file_perms };
+
+# vdc talks to vold over Binder
+binder_use(vdc)
+binder_call(vdc, vold)
+allow vdc vold_service:service_manager find;
diff --git a/prebuilts/api/202504/private/vehicle_binding_util.te b/prebuilts/api/202504/private/vehicle_binding_util.te
new file mode 100644
index 0000000..f527944
--- /dev/null
+++ b/prebuilts/api/202504/private/vehicle_binding_util.te
@@ -0,0 +1,22 @@
+# vehicle binding util startup application
+type vehicle_binding_util, domain, coredomain;
+
+# allow init to start vehicle_binding_util
+type vehicle_binding_util_exec, exec_type, file_type, system_file_type;
+init_daemon_domain(vehicle_binding_util)
+
+# allow writing to kmsg during boot
+allow vehicle_binding_util kmsg_device:chr_file { getattr w_file_perms };
+
+# allow reading the binding property from HIDL VHAL.
+hwbinder_use(vehicle_binding_util)
+# allow reading the binding property from AIDL VHAL.
+binder_use(vehicle_binding_util)
+hal_client_domain(vehicle_binding_util, hal_vehicle)
+
+# allow executing vdc
+domain_auto_trans(vehicle_binding_util, vdc_exec, vdc)
+
+# devpts is needed to redirect output from vdc
+allow vehicle_binding_util devpts:chr_file rw_file_perms;
+
diff --git a/prebuilts/api/202504/private/vendor_init.te b/prebuilts/api/202504/private/vendor_init.te
new file mode 100644
index 0000000..60962d4
--- /dev/null
+++ b/prebuilts/api/202504/private/vendor_init.te
@@ -0,0 +1,364 @@
+# Creating files on sysfs is impossible so this isn't a threat
+# Sometimes we have to write to non-existent files to avoid conditional
+# init behavior. See b/35303861 for an example.
+dontaudit vendor_init sysfs:dir write;
+
+# TODO(b/140259336) We want to remove vendor_init in the long term but allow for now
+allow vendor_init system_data_root_file:dir rw_dir_perms;
+
+# Let vendor_init set service.adb.tcp.port.
+set_prop(vendor_init, adbd_config_prop)
+
+# Let vendor_init react to AVF device config changes
+get_prop(vendor_init, device_config_virtualization_framework_native_prop)
+
+# Let vendor_init use apex.<name>.ready to start services from vendor APEX
+get_prop(vendor_init, apex_ready_prop)
+
+# Let vendor_init read ro.fstype.data to process init.rc triggers
+# for this property
+get_prop(vendor_init, fstype_prop)
+
+# chown/chmod on devices, e.g. /dev/ttyHS0
+allow vendor_init {
+ dev_type
+ -keychord_device
+ -vm_manager_device_type
+ -port_device
+ -lowpan_device
+ -hw_random_device
+}:chr_file setattr;
+
+# Communication to the main init process
+allow vendor_init init:unix_stream_socket { read write };
+
+# Logging to kmsg
+allow vendor_init kmsg_device:chr_file { open getattr write };
+
+# Mount on /dev/usb-ffs/adb.
+allow vendor_init device:dir mounton;
+
+# Create and remove symlinks in /.
+allow vendor_init rootfs:lnk_file { create unlink };
+
+# Create cgroups mount points in tmpfs and mount cgroups on them.
+allow vendor_init cgroup:dir create_dir_perms;
+allow vendor_init cgroup:file w_file_perms;
+allow vendor_init cgroup_v2:dir create_dir_perms;
+allow vendor_init cgroup_v2:file w_file_perms;
+
+# /config
+allow vendor_init configfs:dir mounton;
+allow vendor_init configfs:dir create_dir_perms;
+allow vendor_init configfs:{ file lnk_file } create_file_perms;
+
+# Create directories under /dev/cpuctl after chowning it to system.
+allow vendor_init self:global_capability_class_set { dac_override dac_read_search };
+
+# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
+# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
+# system/core/init.rc requires at least cache_file and data_file_type.
+# init.<board>.rc files often include device-specific types, so
+# we just allow all file types except /system files here.
+allow vendor_init self:global_capability_class_set { chown fowner fsetid };
+
+# mkdir with FBE requires reading /data/unencrypted/{ref,mode}.
+allow vendor_init unencrypted_data_file:dir search;
+allow vendor_init unencrypted_data_file:file r_file_perms;
+
+# Set encryption policy on dirs in /data
+allowxperm vendor_init data_file_type:dir ioctl {
+ FS_IOC_GET_ENCRYPTION_POLICY
+ FS_IOC_SET_ENCRYPTION_POLICY
+};
+
+allow vendor_init system_data_file:dir getattr;
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -system_dlkm_file_type
+ -system_file_type
+ -mnt_product_file
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
+
+allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -runtime_event_log_tags_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -apex_info_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+ -tradeinmode_metadata_file
+ -proc_kallsyms
+ enforce_debugfs_restriction(`-debugfs_type')
+}:file { create getattr open read write setattr relabelfrom unlink map };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
+
+allow vendor_init {
+ file_type
+ -apex_mnt_dir
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -unlabeled
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:lnk_file { create getattr setattr relabelfrom unlink };
+
+allow vendor_init {
+ file_type
+ -bpffs_type
+ -core_data_file_type
+ -exec_type
+ -mnt_product_file
+ -password_slot_metadata_file
+ -ota_metadata_file
+ -system_dlkm_file_type
+ -system_file_type
+ -vendor_file_type
+ -vold_metadata_file
+ -gsi_metadata_file_type
+ -apex_metadata_file
+ -userspace_reboot_metadata_file
+ -aconfig_storage_metadata_file
+ -aconfig_storage_flags_metadata_file
+}:dir_file_class_set relabelto;
+
+allow vendor_init dev_type:dir create_dir_perms;
+allow vendor_init dev_type:lnk_file create;
+
+# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
+allow vendor_init debugfs_tracing:file w_file_perms;
+
+# chown/chmod on pseudo files.
+allow vendor_init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -keychord_device
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+ -proc_uid_time_in_state
+ -proc_uid_concurrent_active_time
+ -proc_uid_concurrent_policy_time
+ -proc_kallsyms
+ enforce_debugfs_restriction(`-debugfs_type')
+}:file { open read setattr map };
+
+allow vendor_init tracefs_type:file { open read setattr map };
+
+allow vendor_init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+ -proc_uid_time_in_state
+ -proc_uid_concurrent_active_time
+ -proc_uid_concurrent_policy_time
+}:dir { open read setattr search };
+
+allow vendor_init dev_type:blk_file getattr;
+
+# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
+r_dir_file(vendor_init, proc_net_type)
+allow vendor_init proc_net_type:file w_file_perms;
+allow vendor_init self:global_capability_class_set net_admin;
+
+# Write to /proc/sys/vm/page-cluster
+allow vendor_init proc_page_cluster:file w_file_perms;
+
+# Write to sysfs nodes.
+allow vendor_init sysfs_type:dir r_dir_perms;
+allow vendor_init sysfs_type:lnk_file read;
+allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms;
+
+# setfscreatecon() for labeling directories and socket files.
+allow vendor_init self:process { setfscreate };
+
+r_dir_file(vendor_init, vendor_file_type)
+
+# Vendor init can read properties
+allow vendor_init serialno_prop:file { getattr open read map };
+
+# Vendor init can perform operations on trusted and security Extended Attributes
+allow vendor_init self:global_capability_class_set sys_admin;
+
+# Raw writes to misc block device
+allow vendor_init misc_block_device:blk_file w_file_perms;
+
+# vendor_init is using bootstrap bionic
+use_bootstrap_libs(vendor_init)
+
+# allow filesystem tuning
+allow vendor_init userdata_sysdev:file create_file_perms;
+
+# Everything is labeled as rootfs in recovery mode. Vendor init has to execute
+# the dynamic linker and shared libraries.
+recovery_only(`
+ allow vendor_init rootfs:file { r_file_perms execute };
+')
+
+not_compatible_property(`
+ set_prop(vendor_init, {
+ property_type
+ -system_internal_property_type
+ -system_restricted_property_type
+ })
+')
+
+# Get file context
+allow vendor_init file_contexts_file:file r_file_perms;
+
+# Allow vendor_init to (re)set nice
+allow vendor_init self:capability sys_nice;
+
+set_prop(vendor_init, apk_verity_prop)
+set_prop(vendor_init, bluetooth_a2dp_offload_prop)
+set_prop(vendor_init, bluetooth_audio_hal_prop)
+set_prop(vendor_init, bluetooth_config_prop)
+set_prop(vendor_init, camera2_extensions_prop)
+set_prop(vendor_init, camerax_extensions_prop)
+set_prop(vendor_init, cpu_variant_prop)
+set_prop(vendor_init, dalvik_config_prop)
+set_prop(vendor_init, dalvik_dynamic_config_prop)
+set_prop(vendor_init, dalvik_runtime_prop)
+set_prop(vendor_init, debug_prop)
+set_prop(vendor_init, exported_bluetooth_prop)
+set_prop(vendor_init, exported_camera_prop)
+set_prop(vendor_init, exported_config_prop)
+set_prop(vendor_init, exported_default_prop)
+set_prop(vendor_init, exported_overlay_prop)
+set_prop(vendor_init, exported_pm_prop)
+set_prop(vendor_init, ffs_control_prop)
+set_prop(vendor_init, hw_timeout_multiplier_prop)
+set_prop(vendor_init, incremental_prop)
+set_prop(vendor_init, lmkd_prop)
+set_prop(vendor_init, logd_prop)
+set_prop(vendor_init, log_tag_prop)
+set_prop(vendor_init, log_prop)
+set_prop(vendor_init, graphics_config_writable_prop)
+set_prop(vendor_init, prefetch_boot_prop);
+set_prop(vendor_init, qemu_hw_prop)
+set_prop(vendor_init, radio_control_prop)
+set_prop(vendor_init, rebootescrow_hal_prop)
+set_prop(vendor_init, serialno_prop)
+set_prop(vendor_init, soc_prop)
+set_prop(vendor_init, surfaceflinger_color_prop)
+set_prop(vendor_init, usb_control_prop)
+set_prop(vendor_init, userspace_reboot_config_prop)
+set_prop(vendor_init, vehicle_hal_prop)
+set_prop(vendor_init, vendor_default_prop)
+set_prop(vendor_init, keystore_config_prop)
+set_prop(vendor_init, vendor_security_patch_level_prop)
+set_prop(vendor_init, vndk_prop)
+set_prop(vendor_init, virtual_ab_prop)
+set_prop(vendor_init, vold_post_fs_data_prop)
+set_prop(vendor_init, wifi_hal_prop)
+set_prop(vendor_init, wifi_log_prop)
+set_prop(vendor_init, zram_control_prop)
+
+get_prop(vendor_init, boot_status_prop)
+get_prop(vendor_init, exported3_system_prop)
+get_prop(vendor_init, ota_prop)
+get_prop(vendor_init, power_debug_prop)
+get_prop(vendor_init, provisioned_prop)
+get_prop(vendor_init, retaildemo_prop)
+get_prop(vendor_init, surfaceflinger_display_prop)
+get_prop(vendor_init, test_harness_prop)
+get_prop(vendor_init, theme_prop)
+set_prop(vendor_init, dck_prop)
+
+# Allow vendor_init to read vendor_system_native device config changes
+get_prop(vendor_init, device_config_vendor_system_native_prop)
+get_prop(vendor_init, device_config_vendor_system_native_boot_prop)
+
+userdebug_or_eng(`
+get_prop(vendor_init, profcollectd_etr_prop)
+')
+
+###
+### neverallow rules
+###
+
+# Vendor init shouldn't communicate with any vendor process, nor most system processes.
+neverallow_establish_socket_comms(vendor_init, {
+ domain -init -logd -prng_seeder -su -vendor_init });
+
+# The vendor_init domain is only entered via an exec based transition from the
+# init domain, never via setcon().
+neverallow domain vendor_init:process dyntransition;
+neverallow { domain -init } vendor_init:process transition;
+neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint;
+
+# Never read/follow symlinks created by shell or untrusted apps.
+neverallow vendor_init app_data_file_type:lnk_file read;
+neverallow vendor_init shell_data_file:lnk_file read;
+# Init should not be creating subdirectories in /data/local/tmp
+neverallow vendor_init shell_data_file:dir { write add_name remove_name };
+
+# init should never execute a program without changing to another domain.
+neverallow vendor_init { file_type fs_type }:file execute_no_trans;
+
+# Init never adds or uses services via service_manager.
+neverallow vendor_init service_manager_type:service_manager { add find };
+neverallow vendor_init servicemanager:service_manager list;
+
+# vendor_init should never be ptraced
+neverallow * vendor_init:process ptrace;
diff --git a/prebuilts/api/202504/private/vendor_misc_writer.te b/prebuilts/api/202504/private/vendor_misc_writer.te
new file mode 100644
index 0000000..1f27bf9
--- /dev/null
+++ b/prebuilts/api/202504/private/vendor_misc_writer.te
@@ -0,0 +1,12 @@
+# Raw writes to misc_block_device
+allow vendor_misc_writer misc_block_device:blk_file w_file_perms;
+allow vendor_misc_writer block_device:dir r_dir_perms;
+
+# Silence the denial when calling libfstab's ReadDefaultFstab, which tries to
+# load DT fstab.
+dontaudit vendor_misc_writer proc_cmdline:file r_file_perms;
+dontaudit vendor_misc_writer sysfs_dt_firmware_android:dir search;
+dontaudit vendor_misc_writer proc_bootconfig:file r_file_perms;
+
+# Allow ReadDefaultFstab().
+read_fstab(vendor_misc_writer)
diff --git a/prebuilts/api/202504/private/vendor_shell.te b/prebuilts/api/202504/private/vendor_shell.te
new file mode 100644
index 0000000..5a5925d
--- /dev/null
+++ b/prebuilts/api/202504/private/vendor_shell.te
@@ -0,0 +1,18 @@
+allow vendor_shell vendor_shell_exec:file rx_file_perms;
+allow vendor_shell vendor_toolbox_exec:file rx_file_perms;
+
+# Use fd from shell when vendor_shell is started from shell
+allow vendor_shell shell:fd use;
+
+# adbd: allow `adb shell /vendor/bin/sh` and `adb shell` then `/vendor/bin/sh`
+allow vendor_shell adbd:fd use;
+allow vendor_shell adbd:process sigchld;
+allow vendor_shell adbd:unix_stream_socket { getattr ioctl read write };
+
+allow vendor_shell devpts:chr_file rw_file_perms;
+allow vendor_shell tty_device:chr_file rw_file_perms;
+allow vendor_shell console_device:chr_file rw_file_perms;
+allow vendor_shell input_device:dir r_dir_perms;
+allow vendor_shell input_device:chr_file rw_file_perms;
+
+userdebug_or_eng(`set_prop(vendor_shell, persist_vendor_debug_wifi_prop)')
diff --git a/prebuilts/api/202504/private/vendor_toolbox.te b/prebuilts/api/202504/private/vendor_toolbox.te
new file mode 100644
index 0000000..178fa8f
--- /dev/null
+++ b/prebuilts/api/202504/private/vendor_toolbox.te
@@ -0,0 +1,11 @@
+# Do not allow domains to transition to vendor toolbox
+# or read, execute the vendor_toolbox file.
+full_treble_only(`
+ # Do not allow non-vendor domains to transition
+ # to vendor toolbox except for the allowlisted domains.
+ neverallow {
+ coredomain
+ -init
+ -modprobe
+ } vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
+')
diff --git a/prebuilts/api/202504/private/vfio_handler.te b/prebuilts/api/202504/private/vfio_handler.te
new file mode 100644
index 0000000..fd6499d
--- /dev/null
+++ b/prebuilts/api/202504/private/vfio_handler.te
@@ -0,0 +1,34 @@
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ # vfio_handler is a helper service for VFIO tasks, like binding platform devices to VFIO driver.
+ # vfio_handler is separate from virtualizationservice as VFIO tasks require root.
+ type vfio_handler, domain, coredomain;
+ type vfio_handler_exec, system_file_type, exec_type, file_type;
+
+ # When init runs a file labelled with vfio_handler_exec, run it in the vfio_handler domain.
+ init_daemon_domain(vfio_handler)
+
+ # Let the vfio_handler domain register the vfio_handler_service with ServiceManager.
+ add_service(vfio_handler, vfio_handler_service)
+
+ # Let the vfio_handler domain use Binder.
+ binder_use(vfio_handler)
+
+ # Allow vfio_handler to check if VFIO is supported
+ allow vfio_handler vfio_device:chr_file getattr;
+ allow vfio_handler vfio_device:dir r_dir_perms;
+
+ # Allow vfio_handler to bind/unbind platform devices
+ allow vfio_handler sysfs:dir r_dir_perms;
+ allow vfio_handler sysfs:file rw_file_perms;
+
+ # Allow vfio_handler to write to VM DTBO via a file created by virtualizationservice.
+ allow vfio_handler virtualizationservice:fd use;
+ allow vfio_handler virtualizationservice_data_file:file write;
+
+ # vfio_handler can only use fd from virtualizationservice, and cannot open files itself
+ neverallow vfio_handler virtualizationservice_data_file:file { open create };
+
+ # Allow vfio_handler to search /dev/block for accessing dtbo.img
+ allow vfio_handler block_device:dir search;
+ allow vfio_handler dtbo_block_device:blk_file r_file_perms;
+') # is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT)
diff --git a/prebuilts/api/202504/private/virtual_camera.te b/prebuilts/api/202504/private/virtual_camera.te
new file mode 100644
index 0000000..86174b1
--- /dev/null
+++ b/prebuilts/api/202504/private/virtual_camera.te
@@ -0,0 +1,67 @@
+# virtual_camera - virtual camera daemon
+
+# The types are moved to public starting at 202502
+until_board_api(202504, `
+ type virtual_camera, domain, coredomain;
+ type virtual_camera_exec, system_file_type, exec_type, file_type;
+')
+
+init_daemon_domain(virtual_camera)
+
+# Since virtual_camera is not a real HAL we don't set the
+# hal_server_domain(virtual_camera, hal_camera) macro but only the rules that
+# we actually need from halserverdomain and hal_camera_server:
+binder_use(virtual_camera)
+binder_call(virtual_camera, cameraserver)
+binder_call(virtual_camera, system_server)
+
+# Allow virtual_camera to communicate with
+# mediaserver (required for using Surface originating
+# from virtual camera in mediaserver).
+binder_call(virtual_camera, mediaserver)
+
+# Required for the codecs to be able to decode
+# video into surface provided by virtual camera.
+hal_client_domain(virtual_camera, hal_codec2)
+hal_client_domain(virtual_camera, hal_omx)
+
+# Allow virtualCamera to call apps via binder.
+binder_call(virtual_camera, appdomain)
+
+# Allow virtual_camera to use fd from apps
+allow virtual_camera { appdomain -isolated_app }:fd use;
+
+binder_call(virtual_camera, surfaceflinger);
+
+# Only allow virtual_camera to add a virtual_camera_service and no one else.
+add_service(virtual_camera, virtual_camera_service);
+
+# Allow virtual_camera to map graphic buffers
+hal_client_domain(virtual_camera, hal_graphics_allocator)
+
+# Allow virtual_camera to use GPU
+allow virtual_camera gpu_device:chr_file rw_file_perms;
+allow virtual_camera gpu_device:dir r_dir_perms;
+r_dir_file(virtual_camera, sysfs_gpu)
+
+# ION And DMABUF are used by vendor to allocate graphic buffers needed by virtual_camera
+allow cameraserver ion_device:chr_file rw_file_perms;
+allow cameraserver dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Allow virtual camera to use graphics composer fd-s (fences).
+allow virtual_camera hal_graphics_composer:fd use;
+
+# For collecting bugreports.
+allow virtual_camera dumpstate:fd use;
+allow virtual_camera dumpstate:fifo_file write;
+
+# Needed for permission checks.
+allow virtual_camera permission_service:service_manager find;
+
+# Allow 'adb shell cmd' to configure test instances of camera.
+allow virtual_camera adbd:fd use;
+allow virtual_camera adbd:unix_stream_socket { getattr read write };
+allow virtual_camera shell:fifo_file { getattr read write };
+
+# Allow virtual_camera to access dmabuf_system_heap_device
+allow virtual_camera dmabuf_system_heap_device:chr_file { read open };
diff --git a/prebuilts/api/202504/private/virtual_face.te b/prebuilts/api/202504/private/virtual_face.te
new file mode 100644
index 0000000..9a805e8
--- /dev/null
+++ b/prebuilts/api/202504/private/virtual_face.te
@@ -0,0 +1,7 @@
+# biometric virtual face sensor
+type virtual_face, domain;
+type virtual_face_exec, system_file_type, exec_type, file_type;
+hal_server_domain(virtual_face, hal_face)
+typeattribute virtual_face coredomain;
+init_daemon_domain(virtual_face)
+set_prop(virtual_face, virtual_face_prop)
diff --git a/prebuilts/api/202504/private/virtual_fingerprint.te b/prebuilts/api/202504/private/virtual_fingerprint.te
new file mode 100644
index 0000000..be20e24
--- /dev/null
+++ b/prebuilts/api/202504/private/virtual_fingerprint.te
@@ -0,0 +1,7 @@
+# biometric virtual fingerprint sensor
+type virtual_fingerprint, domain;
+type virtual_fingerprint_exec, system_file_type, exec_type, file_type;
+hal_server_domain(virtual_fingerprint, hal_fingerprint)
+typeattribute virtual_fingerprint coredomain;
+init_daemon_domain(virtual_fingerprint)
+set_prop(virtual_fingerprint, virtual_fingerprint_prop)
diff --git a/prebuilts/api/202504/private/virtual_touchpad.te b/prebuilts/api/202504/private/virtual_touchpad.te
new file mode 100644
index 0000000..035b121
--- /dev/null
+++ b/prebuilts/api/202504/private/virtual_touchpad.te
@@ -0,0 +1,17 @@
+typeattribute virtual_touchpad coredomain;
+
+init_daemon_domain(virtual_touchpad)
+
+binder_use(virtual_touchpad)
+binder_service(virtual_touchpad)
+add_service(virtual_touchpad, virtual_touchpad_service)
+
+# Needed to check app permissions.
+binder_call(virtual_touchpad, system_server)
+
+# Requires access to /dev/uinput to create and feed the virtual device.
+allow virtual_touchpad uhid_device:chr_file { w_file_perms ioctl };
+
+# Requires access to the permission service to validate that clients have the
+# appropriate VR permissions.
+allow virtual_touchpad permission_service:service_manager find;
diff --git a/prebuilts/api/202504/private/virtualizationmanager.te b/prebuilts/api/202504/private/virtualizationmanager.te
new file mode 100644
index 0000000..259c402
--- /dev/null
+++ b/prebuilts/api/202504/private/virtualizationmanager.te
@@ -0,0 +1,144 @@
+until_board_api(202504, `
+ type virtualizationmanager, domain, coredomain;
+ type virtualizationmanager_exec, system_file_type, exec_type, file_type;
+')
+
+# Allow virtualizationmanager to communicate use, read and write over the adb connection.
+allow virtualizationmanager adbd:fd use;
+allow virtualizationmanager adbd:unix_stream_socket { getattr read write };
+
+# Allow writing VM logs to the shell console
+allow virtualizationmanager devpts:chr_file { read write getattr ioctl };
+
+# Let the virtualizationmanager domain use Binder.
+binder_use(virtualizationmanager)
+
+# Let virtualizationmanager find and communicate with virtualizationservice.
+allow virtualizationmanager virtualization_service:service_manager find;
+binder_call(virtualizationmanager, virtualizationservice)
+
+# Allow calling into the system server to find native services. "permission_service" to check
+# permissions, and "package_native" for staged apex info.
+binder_call(virtualizationmanager, system_server)
+allow virtualizationmanager { package_native_service permission_service }:service_manager find;
+
+# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain.
+domain_auto_trans(virtualizationmanager, crosvm_exec, crosvm)
+
+# Let virtualizationmanager kill crosvm.
+allow virtualizationmanager crosvm:process sigkill;
+
+# Let virtualizationmanager create files inside virtualizationservice's temporary directories.
+allow virtualizationmanager virtualizationservice_data_file:dir rw_dir_perms;
+allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } create_file_perms;
+
+# Let virtualizationmanager read and write files from its various clients, but not open them
+# directly as they must be passed over Binder by the client.
+allow virtualizationmanager apk_data_file:file { getattr read };
+
+# Write access is needed for mutable partitions like instance.img
+allow virtualizationmanager {
+ app_data_file
+ apex_compos_data_file
+ apex_virt_data_file
+ privapp_data_file
+}:file { getattr read write };
+
+# shell_data_file is used for automated tests and manual debugging.
+allow virtualizationmanager shell_data_file:file { getattr read write };
+
+# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there.
+allow virtualizationmanager apex_info_file:file r_file_perms;
+allow virtualizationmanager apex_data_file:dir search;
+allow virtualizationmanager staging_data_file:file r_file_perms;
+allow virtualizationmanager staging_data_file:dir search;
+
+# Run derive_classpath in our domain
+allow virtualizationmanager derive_classpath_exec:file rx_file_perms;
+allow virtualizationmanager apex_mnt_dir:dir r_dir_perms;
+# Ignore harmless denials on /proc/self/fd
+dontaudit virtualizationmanager self:dir write;
+
+# Let virtualizationmanager to accept vsock connection from the guest VMs
+allow virtualizationmanager self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+neverallow { domain -virtualizationmanager } virtualizationmanager:vsock_socket { accept bind create connect listen };
+
+# Allow virtualizationmanager to inspect all hypervisor capabilities.
+get_prop(virtualizationmanager, hypervisor_prop)
+get_prop(virtualizationmanager, hypervisor_restricted_prop)
+
+# Allow virtualizationmanager to be read custom pvmfw.img configuration
+userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)')
+dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
+neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-virtualizationmanager')
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_pvmfw_prop:file no_rw_file_perms;
+
+# Allow virtualizationmanager to be read custom virtualizationmanager configuration
+userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)')
+dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
+neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-virtualizationmanager')
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
+
+# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
+unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)
+
+# Append ramdumps to tombstone files passed as fds from tombstoned
+allow virtualizationmanager tombstone_data_file:file { append getattr };
+allow virtualizationmanager tombstoned:fd use;
+
+# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy
+r_dir_file(virtualizationmanager, proc_dt_avf)
+r_dir_file(virtualizationmanager, sysfs_dt_avf)
+
+# virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages
+# from pVM to HAL.
+hal_client_domain(virtualizationmanager, hal_secretkeeper);
+
+# Let virtualizationmanager open test artifacts under /data/local/tmp with file path.
+# (e.g. custom debug policy)
+userdebug_or_eng(`
+ allow virtualizationmanager shell_data_file:dir search;
+ allow virtualizationmanager shell_data_file:file open;
+')
+
+# Allow virtualizationmanager to read microdroid related files in vendor partition
+r_dir_file(virtualizationmanager, vendor_microdroid_file)
+
+# Do not allow writing vendor_microdroid_file from any process.
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms;
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms;
+
+# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
+r_dir_file(virtualizationmanager, crosvm);
+
+# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
+# a harmless denial for CompOS log files, so ignore that.
+dontaudit virtualizationmanager apex_module_data_file:dir search;
+
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ # virtualizationmanager holds references to bound devices, returned from vfio_handler
+ binder_call(virtualizationmanager, vfio_handler)
+')
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow virtualizationmanager to deal with file descriptors of TAP interfaces.
+ allow virtualizationmanager tun_device:chr_file rw_file_perms;
+ allow virtualizationmanager vmnic:fd use;
+')
+
+# virtualizationmanager reads tee_service_contexts_file to determine if VM is allowed
+# to access requested tee services
+allow virtualizationmanager tee_service_contexts_file:file r_file_perms;
+# virtualizationmanager uses libselinux to check if VM is allowed to access requested
+# tee services.
+selinux_check_access(virtualizationmanager)
diff --git a/prebuilts/api/202504/private/virtualizationservice.te b/prebuilts/api/202504/private/virtualizationservice.te
new file mode 100644
index 0000000..1acf734
--- /dev/null
+++ b/prebuilts/api/202504/private/virtualizationservice.te
@@ -0,0 +1,146 @@
+type virtualizationservice, domain, coredomain;
+type virtualizationservice_exec, system_file_type, exec_type, file_type;
+
+# The domain needs to be a 'mlstrustedsubject' to change the memlock rlimit of
+# the virtualizationmanager domain running at a more constrained MLS level.
+typeattribute virtualizationservice mlstrustedsubject;
+
+# When init runs a file labelled with virtualizationservice_exec, run it in the
+# virtualizationservice domain.
+init_daemon_domain(virtualizationservice)
+
+# Let the virtualizationservice domain use Binder.
+binder_use(virtualizationservice)
+
+# Register our services with ServiceManager.
+add_service(virtualizationservice, virtualization_service)
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+ add_service(virtualizationservice, virtualization_maintenance_service)
+')
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ # Let virtualizationservice find and communicate with vfio_handler.
+ allow virtualizationservice vfio_handler_service:service_manager find;
+ binder_call(virtualizationservice, vfio_handler)
+')
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Let virtualizationservice find and communicate with vmnic.
+ allow virtualizationservice vmnic_service:service_manager find;
+ binder_call(virtualizationservice, vmnic)
+ allow virtualizationservice vm_tethering_service:service_manager find;
+')
+
+# Allow the virtualizationservice domain to serve a remotely provisioned component for
+# pVM remote attestation.
+hal_server_domain(virtualizationservice, hal_remotelyprovisionedcomponent_avf)
+
+# Allow the virtualizationservice to inspect whether remote attestation is supported
+# through the system property.
+get_prop(virtualizationservice, avf_virtualizationservice_prop)
+
+# Allow calling into the system server to find "permission_service".
+binder_call(virtualizationservice, system_server)
+allow virtualizationservice permission_service:service_manager find;
+
+# Allow virtualizationservice to retrieve the remotely provisioned keys from rkpd.
+binder_call(virtualizationservice, remote_provisioning_service_server)
+allow virtualizationservice remote_provisioning_service:service_manager find;
+
+# Allow virtualizationservice to manage VM secrets via Secretkeeper.
+hal_client_domain(virtualizationservice, hal_secretkeeper)
+
+# Let virtualizationservice remove memlock rlimit of virtualizationmanager. This is necessary
+# to mlock VM memory and page tables.
+allow virtualizationservice self:capability sys_resource;
+allow virtualizationservice virtualizationmanager:process setrlimit;
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ # To provide display service to an app to get surface.
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+ allow virtualizationservice vmlauncher_app:binder transfer;
+')
+
+# Let virtualizationservice set the owner of a VM's temporary directory.
+allow virtualizationservice self:capability chown;
+
+# Let virtualizationservice create and delete temporary directories of VMs. To remove old
+# directories, it needs the permission to unlink the files created by virtualizationmanager.
+allow virtualizationservice virtualizationservice_data_file:dir create_dir_perms;
+allow virtualizationservice virtualizationservice_data_file:sock_file unlink;
+allow virtualizationservice virtualizationservice_data_file:file create_file_perms;
+
+# Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from
+# crosvm to the console
+allow virtualizationservice adbd:fd use;
+allow virtualizationservice adbd:unix_stream_socket { read write };
+
+# Allow to connnect to and run VirtMgr to start the service VM for remote attestation.
+virtualizationservice_use(virtualizationservice)
+
+# Allow virtualizationservice to read and write in the apex data directory
+# /data/misc/apexdata/com.android.virt. Also allow checking of the parent directory
+# (needed for SQLite database creation).
+allow virtualizationservice apex_module_data_file:dir { search getattr };
+allow virtualizationservice apex_virt_data_file:dir create_dir_perms;
+allow virtualizationservice apex_virt_data_file:file create_file_perms;
+
+# Accept vsock connection from the guest VMs to singleton services
+# such as the guest tombstone server.
+allow virtualizationservice self:vsock_socket { create read getattr write setattr lock append bind getopt setopt shutdown map listen accept };
+neverallow { domain -virtualizationservice -dumpstate } virtualizationservice:vsock_socket *;
+
+# Allow virtualizationservice to read/write its own sysprop. Only the process can do so.
+set_prop(virtualizationservice, virtualizationservice_prop)
+
+# Allow writing stats to statsd
+unix_socket_send(virtualizationservice, statsdw, statsd)
+
+# Allow virtualization service to talk to tombstoned to push guest tombstones
+unix_socket_connect(virtualizationservice, tombstoned_crash, tombstoned)
+
+# Append to tombstone files passed as fds from tombstoned
+allow virtualizationservice tombstone_data_file:file { append getattr };
+allow virtualizationservice tombstoned:fd use;
+
+# Allow virtualizationservice to check if VFIO is supported
+allow virtualizationservice vfio_device:chr_file getattr;
+allow virtualizationservice vfio_device:dir r_dir_perms;
+
+# Allow virtualizationservice to access VM DTBO via a file created by virtualizationmanager.
+allow virtualizationservice virtualizationmanager:fd use;
+
+# Allow virtualizationservice to access vendor_configs_file to get the list of assignable devices.
+r_dir_file(virtualizationservice, vendor_configs_file)
+
+neverallow {
+ domain
+ -init
+ -virtualizationservice
+} virtualizationservice_prop:property_service set;
+
+neverallow {
+ domain
+ -init
+ -virtualizationmanager
+ -virtualizationservice
+} virtualizationservice_data_file:file { open create };
+
+neverallow virtualizationservice {
+ domain
+ -virtualizationmanager
+ -virtualizationservice
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+ -crosvm
+}:process setrlimit;
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow virtualizationservice to deal with file descriptors of TAP interfaces.
+ allow virtualizationservice tun_device:chr_file rw_file_perms;
+ allow virtualizationservice vmnic:fd use;
+')
+
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ # Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
+ neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;
+')
diff --git a/prebuilts/api/202504/private/vmlauncher_app.te b/prebuilts/api/202504/private/vmlauncher_app.te
new file mode 100644
index 0000000..ef34c31
--- /dev/null
+++ b/prebuilts/api/202504/private/vmlauncher_app.te
@@ -0,0 +1,40 @@
+type vmlauncher_app, domain;
+typeattribute vmlauncher_app coredomain;
+
+app_domain(vmlauncher_app)
+net_domain(vmlauncher_app)
+
+allow vmlauncher_app app_api_service:service_manager find;
+allow vmlauncher_app system_api_service:service_manager find;
+
+allow vmlauncher_app shell_data_file:dir search;
+allow vmlauncher_app shell_data_file:file { read open write };
+virtualizationservice_use(vmlauncher_app)
+
+allow vmlauncher_app fsck_exec:file { r_file_perms execute execute_no_trans };
+allow vmlauncher_app crosvm:fd use;
+allow vmlauncher_app crosvm_tmpfs:file { map read write };
+allow vmlauncher_app crosvm_exec:file rx_file_perms;
+
+allow vmlauncher_app privapp_data_file:sock_file { create unlink write getattr };
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+ # TODO(b/332677707): remove them when display service uses binder RPC.
+ allow vmlauncher_app virtualization_service:service_manager find;
+ allow vmlauncher_app virtualizationservice:binder call;
+ allow vmlauncher_app crosvm:binder { call transfer };
+')
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ allow vmlauncher_app self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+')
+
+userdebug_or_eng(`
+ # Create pty/pts and connect it to the guest terminal.
+ create_pty(vmlauncher_app)
+ # Allow other processes to access the pts.
+ allow vmlauncher_app vmlauncher_app_devpts:chr_file setattr;
+')
+
+# TODO(b/372664601): Remove this when we don't need linux_vm_setup
+set_prop(vmlauncher_app, debug_prop);
diff --git a/prebuilts/api/202504/private/vmnic.te b/prebuilts/api/202504/private/vmnic.te
new file mode 100644
index 0000000..4a706df
--- /dev/null
+++ b/prebuilts/api/202504/private/vmnic.te
@@ -0,0 +1,26 @@
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # vmnic is a helper service for network tasks, like creating TAP network interface.
+ # vmnic is separated from virtualizationservice as vmnic requires more permission to do network related tasks.
+ type vmnic, domain, coredomain;
+ type vmnic_exec, system_file_type, exec_type, file_type;
+
+ # When init runs a file labelled with vmnic_exec, run it in the vmnic domain.
+ init_daemon_domain(vmnic)
+
+ # Let the vmnic domain register the vmnic_service with ServiceManager.
+ add_service(vmnic, vmnic_service)
+
+ # Let the vmnic domain use Binder.
+ binder_use(vmnic)
+
+ # Allow for creating and deleting TAP network interfaces.
+ allow vmnic self:global_capability_class_set net_admin;
+ allow vmnic self:tun_socket create_socket_perms_no_ioctl;
+ allow vmnic tun_device:chr_file rw_file_perms;
+ allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
+ allow vmnic self:udp_socket create_socket_perms;
+ allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
+
+ # Only virtualizationservice can communicate to vmnic
+ neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;
+') # is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK)
diff --git a/prebuilts/api/202504/private/vold.te b/prebuilts/api/202504/private/vold.te
new file mode 100644
index 0000000..8fe8518
--- /dev/null
+++ b/prebuilts/api/202504/private/vold.te
@@ -0,0 +1,481 @@
+typeattribute vold coredomain;
+
+init_daemon_domain(vold)
+
+# Switch to more restrictive domains when executing common tools
+domain_auto_trans(vold, sgdisk_exec, sgdisk);
+domain_auto_trans(vold, sdcardd_exec, sdcardd);
+domain_auto_trans(vold, fuseblkd_untrusted_exec, fuseblkd_untrusted);
+
+# Switch to e2fs domain when running mkfs.ext4 to format a partition
+domain_auto_trans(vold, e2fs_exec, e2fs);
+
+
+# For a handful of probing tools, we choose an even more restrictive
+# domain when working with untrusted block devices
+domain_trans(vold, blkid_exec, blkid);
+domain_trans(vold, blkid_exec, blkid_untrusted);
+domain_trans(vold, fsck_exec, fsck);
+domain_trans(vold, fsck_exec, fsck_untrusted);
+
+# Newly created storage dirs are always treated as mount stubs to prevent us
+# from accidentally writing when the mount point isn't present.
+type_transition vold storage_file:dir storage_stub_file;
+type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
+
+# Property Service
+get_prop(vold, vold_config_prop)
+get_prop(vold, storage_config_prop);
+get_prop(vold, incremental_prop);
+get_prop(vold, gsid_prop);
+
+set_prop(vold, vold_prop)
+set_prop(vold, vold_status_prop)
+set_prop(vold, powerctl_prop)
+set_prop(vold, ctl_fuse_prop)
+set_prop(vold, restorecon_prop)
+set_prop(vold, ota_prop)
+set_prop(vold, boottime_prop)
+set_prop(vold, boottime_public_prop)
+
+# Vold will use Keystore instead of using Keymint directly. But it still needs
+# to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
+allow vold vold_key:keystore2_key {
+ convert_storage_key_to_ephemeral
+ delete
+ get_info
+ manage_blob
+ rebind
+ req_forced_op
+ update
+ use
+};
+
+# vold needs to call keystore methods
+allow vold keystore:binder call;
+
+# vold needs to find keystore2 services
+allow vold keystore_service:service_manager find;
+allow vold keystore_maintenance_service:service_manager find;
+
+# vold needs to be able to call earlyBootEnded() and deleteAllKeys()
+allow vold keystore:keystore2 early_boot_ended;
+allow vold keystore:keystore2 delete_all_keys;
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ allow vold storage_area_app_dir:dir search;
+ # Allow vold to get the encryption policy and
+ # verify the ownership of storage areas
+ allow vold storage_area_dir:dir {
+ read
+ open
+ getattr
+ ioctl
+ };
+')
+
+# when a storage area is created (with `openStorageArea`), vold creates the key
+# and when a storage area is deleted (with `deleteStorageArea`), vold deletes the key
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ allow vold storage_area_key_file:file create_file_perms;
+ allow vold storage_area_key_file:dir create_dir_perms;
+')
+
+# Allow vold to create and delete per-user directories like /data/user/$userId.
+allow vold {
+ media_userdir_file
+ system_userdir_file
+ vendor_userdir_file
+}:dir {
+ add_name
+ remove_name
+ write
+};
+
+# Read already opened /cache files.
+allow vold cache_file:dir r_dir_perms;
+allow vold cache_file:file { getattr read };
+allow vold cache_file:lnk_file r_file_perms;
+
+r_dir_file(vold, { sysfs_type -sysfs_batteryinfo })
+# XXX Label sysfs files with a specific type?
+allow vold {
+ sysfs # writing to /sys/*/uevent during coldboot.
+ sysfs_devices_block
+ sysfs_dm
+ sysfs_loop # writing to /sys/block/loop*/uevent during coldboot.
+ sysfs_usb
+ sysfs_zram_uevent
+ sysfs_fs_f2fs
+}:file w_file_perms;
+
+r_dir_file(vold, rootfs)
+r_dir_file(vold, metadata_file)
+allow vold {
+ proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
+ proc_bootconfig
+ proc_cmdline
+ proc_drop_caches
+ proc_filesystems
+ proc_meminfo
+ proc_mounts
+}:file r_file_perms;
+
+#Get file contexts
+allow vold file_contexts_file:file r_file_perms;
+
+# Allow us to jump into execution domains of above tools
+allow vold self:process setexec;
+
+# For formatting adoptable storage devices
+allow vold e2fs_exec:file rx_file_perms;
+
+# Run fstrim on mounted partitions
+# allowxperm still requires the ioctl permission for the individual type
+allowxperm vold { fs_type file_type }:dir ioctl FITRIM;
+
+# Get/set file-based encryption policies on dirs in /data and adoptable storage,
+# and add/remove file-based encryption keys.
+allowxperm vold data_file_type:dir ioctl {
+ FS_IOC_GET_ENCRYPTION_POLICY
+ FS_IOC_GET_ENCRYPTION_POLICY_EX
+ FS_IOC_SET_ENCRYPTION_POLICY
+ FS_IOC_ADD_ENCRYPTION_KEY
+ FS_IOC_REMOVE_ENCRYPTION_KEY
+ FS_IOC_GET_ENCRYPTION_KEY_STATUS
+};
+
+# Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is
+# tried first. Otherwise, FS_IOC_FIEMAP is needed to get the
+# location of the file's blocks on the raw block device to erase.
+allowxperm vold {
+ vold_data_file
+ vold_metadata_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_key_file')
+}:file ioctl {
+ F2FS_IOC_SEC_TRIM_FILE
+ FS_IOC_FIEMAP
+};
+
+typeattribute vold mlstrustedsubject;
+allow vold self:process setfscreate;
+allow vold system_file:file x_file_perms;
+not_full_treble(`allow vold vendor_file:file x_file_perms;')
+allow vold block_device:dir create_dir_perms;
+allow vold device:dir write;
+allow vold devpts:chr_file rw_file_perms;
+allow vold rootfs:dir mounton;
+allow vold { sdcard_type fuse }:dir mounton; # TODO: deprecated in M
+allow vold { sdcard_type fuse }:filesystem { mount remount unmount }; # TODO: deprecated in M
+
+# Manage locations where storage is mounted
+allow vold { mnt_media_rw_file storage_file sdcard_type fuse }:dir create_dir_perms;
+allow vold { mnt_media_rw_file storage_file sdcard_type fuse }:file create_file_perms;
+
+# Access to storage that backs emulated FUSE daemons for migration optimization
+allow vold media_rw_data_file:dir create_dir_perms;
+allow vold media_rw_data_file:file create_file_perms;
+# Allow mounting (lower filesystem) on parts of media for performance
+allow vold media_rw_data_file:dir mounton;
+
+# Allow setting project quota IDs and enabling project ID inheritance on
+# /data/media/$userId/* and /mnt/expand/$volume/media/$userId/*
+allowxperm vold media_rw_data_file:{ dir file } ioctl {
+ FS_IOC_FSGETXATTR
+ FS_IOC_FSSETXATTR
+ FS_IOC_GETFLAGS
+ FS_IOC_SETFLAGS
+};
+
+# Allow mounting of storage devices
+allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
+
+# Manage per-user primary symlinks
+allow vold mnt_user_file:dir { create_dir_perms mounton };
+allow vold mnt_user_file:lnk_file create_file_perms;
+allow vold mnt_user_file:file create_file_perms;
+
+# Manage per-user pass_through primary symlinks
+allow vold mnt_pass_through_file:dir { create_dir_perms mounton };
+allow vold mnt_pass_through_file:lnk_file create_file_perms;
+
+# Allow to create and mount expanded storage
+allow vold mnt_expand_file:dir { create_dir_perms mounton };
+allow vold apk_data_file:dir { create getattr setattr };
+allow vold shell_data_file:dir { create getattr setattr };
+allow vold system_userdir_file:dir { create getattr setattr };
+allow vold media_userdir_file:dir { create getattr setattr open read ioctl };
+# Needed to set the casefold flag on /mnt/expand/$volume/media
+allowxperm vold media_userdir_file:dir ioctl { FS_IOC_GETFLAGS FS_IOC_SETFLAGS };
+
+# Allow to mount incremental file system on /data/incremental and create files
+allow vold apk_data_file:dir { mounton rw_dir_perms };
+# Allow to create and write files in /data/incremental
+allow vold apk_data_file:file { rw_file_perms unlink };
+# Allow to bind-mount incremental file system on /data/app/vmdl*.tmp and read files
+allow vold apk_tmp_file:dir { mounton r_dir_perms };
+# Allow to read incremental control file and call selinux restorecon on it
+allow vold incremental_control_file:file { r_file_perms relabelto };
+
+allow vold tmpfs:filesystem { mount unmount };
+allow vold tmpfs:dir create_dir_perms;
+allow vold tmpfs:dir mounton;
+allow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid };
+allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow vold loop_control_device:chr_file rw_file_perms;
+allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
+allowxperm vold loop_device:blk_file ioctl {
+ LOOP_CLR_FD
+ LOOP_CTL_GET_FREE
+ LOOP_GET_STATUS64
+ LOOP_SET_FD
+ LOOP_SET_STATUS64
+};
+allow vold vold_device:blk_file { create setattr unlink rw_file_perms };
+allowxperm vold vold_device:blk_file ioctl { BLKDISCARD BLKGETSIZE };
+allow vold dm_device:chr_file rw_file_perms;
+allow vold dm_device:blk_file rw_file_perms;
+allowxperm vold dm_device:blk_file ioctl { BLKDISCARD BLKSECDISCARD BLKREPORTZONE BLKRESETZONE BLKROSET BLKROGET };
+# For vold Process::killProcessesWithOpenFiles function.
+allow vold domain:dir r_dir_perms;
+allow vold domain:{ file lnk_file } r_file_perms;
+allow vold domain:process { signal sigkill };
+allow vold self:global_capability_class_set { sys_ptrace kill };
+
+allow vold kmsg_device:chr_file rw_file_perms;
+
+# Run fsck in the fsck domain.
+allow vold fsck_exec:file { r_file_perms execute };
+
+# Log fsck results
+allow vold fscklogs:dir rw_dir_perms;
+allow vold fscklogs:file create_file_perms;
+
+# Mount and unmount filesystems.
+allow vold labeledfs:filesystem { mount unmount remount };
+
+# Create and mount on /data/tmp_mnt and management of expansion mounts
+#
+# Also rename per-user encrypted directories such as /data/user/10 from their
+# temporary name ("10.new") to their final name ("10").
+allow vold {
+ system_data_file
+ system_data_root_file
+}:dir { create_dir_perms mounton };
+allow vold system_data_file:lnk_file getattr;
+
+# Vold create users in /data/vendor_{ce,de}/[0-9]+
+allow vold vendor_data_file:dir create_dir_perms;
+
+# for secdiscard
+allow vold system_data_file:file read;
+
+# Set scheduling policy of kernel processes
+allow vold kernel:process setsched;
+
+# ASEC
+allow vold asec_image_file:file create_file_perms;
+allow vold asec_image_file:dir rw_dir_perms;
+allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
+allow vold asec_public_file:dir { relabelto setattr };
+allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
+allow vold asec_public_file:file { relabelto setattr };
+# restorecon files in asec containers created on 4.2 or earlier.
+allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
+allow vold unlabeled:file { r_file_perms setattr relabelfrom };
+
+# Access to FUSE control filesystem to hard-abort FUSE mounts
+allow vold fusectlfs:file rw_file_perms;
+allow vold fusectlfs:dir rw_dir_perms;
+
+# Allow vold to use wake locks. Needed for idle maintenance and moving storage.
+wakelock_use(vold)
+
+# Allow vold to make binder calls and publish binder services.
+binder_use(vold)
+add_service(vold, vold_service)
+add_service(vold, fwk_vold_service)
+
+# Allow vold to call into the system server so it can check permissions.
+binder_call(vold, system_server)
+allow vold permission_service:service_manager find;
+
+# talk to health storage HAL
+hal_client_domain(vold, hal_health_storage)
+
+# talk to bootloader HAL
+full_treble_only(`hal_client_domain(vold, hal_bootctl)')
+
+# Access userdata block device.
+allow vold userdata_block_device:blk_file rw_file_perms;
+allowxperm vold userdata_block_device:blk_file ioctl BLKSECDISCARD;
+
+# Access zoned block device.
+allow vold zoned_block_device:blk_file rw_file_perms;
+
+# Access metadata block device used for encryption meta-data.
+allow vold metadata_block_device:blk_file rw_file_perms;
+allowxperm vold metadata_block_device:blk_file ioctl BLKSECDISCARD;
+
+# Allow vold to manipulate /data/unencrypted
+allow vold unencrypted_data_file:{ file } create_file_perms;
+allow vold unencrypted_data_file:dir create_dir_perms;
+
+# Write to /proc/sys/vm/drop_caches
+allow vold proc_drop_caches:file w_file_perms;
+
+# Give vold a place where only vold can store files; everyone else is off limits
+allow vold vold_data_file:dir create_dir_perms;
+allow vold vold_data_file:file create_file_perms;
+
+# And a similar place in the metadata partition
+allow vold vold_metadata_file:dir create_dir_perms;
+allow vold vold_metadata_file:file create_file_perms;
+
+# linux keyring configuration
+allow vold init:key { write search setattr };
+allow vold vold:key { write search setattr };
+
+# vold temporarily changes its priority when running benchmarks
+allow vold self:global_capability_class_set sys_nice;
+
+# vold needs to chroot into app namespaces to remount when runtime permissions change
+allow vold self:global_capability_class_set sys_chroot;
+allow vold storage_file:dir mounton;
+
+# For AppFuse.
+allow vold fuse_device:chr_file rw_file_perms;
+allow vold fuse:filesystem { relabelfrom };
+allow vold app_fusefs:filesystem { relabelfrom relabelto };
+allow vold app_fusefs:filesystem { mount unmount };
+allow vold app_fuse_file:dir rw_dir_perms;
+allow vold app_fuse_file:file { read write open getattr append };
+
+# MoveStorage.cpp executes cp and rm
+allow vold toolbox_exec:file rx_file_perms;
+
+# Prepare profile dir for users.
+allow vold { user_profile_data_file user_profile_root_file }:dir create_dir_perms;
+
+# Raw writes to misc block device
+allow vold misc_block_device:blk_file w_file_perms;
+
+# vold might need to search or mount /mnt/vendor/*
+allow vold mnt_vendor_file:dir search;
+
+dontaudit vold self:global_capability_class_set sys_resource;
+
+dontaudit vold self:capability sys_rawio;
+
+# Allow ReadDefaultFstab().
+read_fstab(vold)
+
+# vold might need to search loopback apex files
+allow vold vendor_apex_file:file r_file_perms;
+
+###
+### Neverallow rules
+###
+
+neverallow {
+ domain
+ -system_server
+ -vdc
+ -vold
+ -update_verifier
+ -apexd
+ -gsid
+} vold_service:service_manager find;
+
+# Only vold should create (and delete) per-user directories like
+# /data/user/$userId. This is very important, as these directories need to be
+# encrypted with per-user keys, which only vold can do. Encryption can only be
+# set up on empty directories, so creation and encryption must happen together.
+neverallow {
+ domain
+ -vold
+} {
+ media_userdir_file
+ system_userdir_file
+ vendor_userdir_file
+}:dir {
+ add_name
+ remove_name
+ write
+};
+
+# Only vold and init should ever set file-based encryption policies.
+neverallowxperm {
+ domain
+ -vold
+ -init
+ -vendor_init
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, ` -vold_prepare_subdirs ')
+} data_file_type:dir ioctl { FS_IOC_SET_ENCRYPTION_POLICY };
+
+# Only vold should ever add/remove file-based encryption keys.
+neverallowxperm {
+ domain
+ -vold
+} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY FS_IOC_GET_ENCRYPTION_KEY_STATUS };
+
+neverallow {
+ domain
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:dir ~{ open create read getattr setattr search relabelfrom relabelto ioctl };
+
+neverallow {
+ domain
+ -init
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:dir *;
+
+neverallow {
+ domain
+ -init
+ -vold
+} vold_metadata_file:dir *;
+
+neverallow {
+ domain
+ -kernel
+ -vold
+ -vold_prepare_subdirs
+} vold_data_file:notdevfile_class_set ~{ relabelto getattr };
+
+neverallow {
+ domain
+ -init
+ -vold
+ -vold_prepare_subdirs
+} vold_metadata_file:notdevfile_class_set ~{ relabelto getattr };
+
+neverallow {
+ domain
+ -init
+ -kernel
+ -vold
+ -vold_prepare_subdirs
+} { vold_data_file vold_metadata_file }:notdevfile_class_set *;
+
+neverallow { domain -vold -init } restorecon_prop:property_service set;
+
+neverallow vold {
+ domain
+ -hal_health_storage_server
+ -hal_keymaster_server
+ -system_suspend_server
+ -hal_bootctl_server
+ -hwservicemanager
+ -keystore
+ -servicemanager
+ -system_server
+ userdebug_or_eng(`-su')
+}:binder call;
+
+neverallow vold fsck_exec:file execute_no_trans;
+neverallow { domain -init } vold:process { transition dyntransition };
+neverallow vold *:process ptrace;
+neverallow vold *:rawip_socket *;
diff --git a/prebuilts/api/202504/private/vold_prepare_subdirs.te b/prebuilts/api/202504/private/vold_prepare_subdirs.te
new file mode 100644
index 0000000..44c9ea5
--- /dev/null
+++ b/prebuilts/api/202504/private/vold_prepare_subdirs.te
@@ -0,0 +1,101 @@
+domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)
+
+typeattribute vold_prepare_subdirs coredomain;
+typeattribute vold_prepare_subdirs mlstrustedsubject;
+
+allow vold_prepare_subdirs system_file:file execute_no_trans;
+allow vold_prepare_subdirs shell_exec:file rx_file_perms;
+allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
+allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
+allow vold_prepare_subdirs vold:fd use;
+allow vold_prepare_subdirs vold:fifo_file { read write };
+allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
+allow vold_prepare_subdirs seapp_contexts_file:file r_file_perms;
+allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
+allow vold_prepare_subdirs self:process setfscreate;
+allow vold_prepare_subdirs {
+ sdk_sandbox_system_data_file
+ system_data_file
+ vendor_data_file
+}:dir { open read write add_name remove_name rmdir relabelfrom };
+allow vold_prepare_subdirs {
+ apex_data_file_type
+ apex_module_data_file
+ apex_rollback_data_file
+ backup_data_file
+ checkin_data_file
+ face_vendor_data_file
+ fingerprint_vendor_data_file
+ iris_vendor_data_file
+ rollback_data_file
+ is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_key_file')
+ storaged_data_file
+ sdk_sandbox_data_file
+ sdk_sandbox_system_data_file
+ system_data_file
+ vold_data_file
+}:dir { create_dir_perms relabelto };
+allow vold_prepare_subdirs {
+ apex_data_file_type
+ apex_art_staging_data_file
+ apex_module_data_file
+ apex_rollback_data_file
+ backup_data_file
+ checkin_data_file
+ face_vendor_data_file
+ fingerprint_vendor_data_file
+ iris_vendor_data_file
+ rollback_data_file
+ storaged_data_file
+ sdk_sandbox_data_file
+ system_data_file
+ vold_data_file
+}:file { getattr unlink };
+allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
+allow vold_prepare_subdirs mnt_expand_file:dir search;
+allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
+allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
+
+# Allow vold_prepare_subdirs to create storage area directories on behalf of apps.
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ allow vold_prepare_subdirs {
+ storage_area_dir
+ storage_area_app_dir
+ }:dir {
+ rw_dir_perms
+ create
+ setattr # for chown() and chmod()
+ rmdir
+ unlink
+ relabelfrom # setfilecon
+ relabelto # setfilecon
+ };
+
+ # The storage area directories should have type storage_area_dir
+ type_transition vold_prepare_subdirs storage_area_app_dir:dir storage_area_dir;
+
+ selinux_check_context(vold_prepare_subdirs)
+
+ allowxperm vold_prepare_subdirs storage_area_dir:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
+')
+
+is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
+ neverallowxperm vold_prepare_subdirs {
+ data_file_type
+ -storage_area_dir
+ }:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
+')
+
+# Migrate legacy labels to apex_system_server_data_file (b/217581286)
+allow vold_prepare_subdirs {
+ apex_appsearch_data_file
+ apex_permission_data_file
+ apex_scheduling_data_file
+ apex_tethering_data_file
+ apex_wifi_data_file
+}:dir relabelfrom;
+
+# /data/misc is unlabeled during early boot.
+allow vold_prepare_subdirs unlabeled:dir search;
+
+dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;
diff --git a/prebuilts/api/202504/private/vzwomatrigger_app.te b/prebuilts/api/202504/private/vzwomatrigger_app.te
new file mode 100644
index 0000000..8deb22b
--- /dev/null
+++ b/prebuilts/api/202504/private/vzwomatrigger_app.te
@@ -0,0 +1,6 @@
+###
+### A domain for further sandboxing the VzwOmaTrigger app.
+###
+type vzwomatrigger_app, domain;
+
+app_domain(vzwomatrigger_app)
diff --git a/prebuilts/api/202504/private/wait_for_keymaster.te b/prebuilts/api/202504/private/wait_for_keymaster.te
new file mode 100644
index 0000000..974a297
--- /dev/null
+++ b/prebuilts/api/202504/private/wait_for_keymaster.te
@@ -0,0 +1,5 @@
+# wait_for_keymaster service. No longer used;
+# here only so that downstream code compiles.
+type wait_for_keymaster, domain, coredomain;
+type wait_for_keymaster_exec, system_file_type, exec_type, file_type;
+
diff --git a/prebuilts/api/202504/private/watchdogd.te b/prebuilts/api/202504/private/watchdogd.te
new file mode 100644
index 0000000..509e950
--- /dev/null
+++ b/prebuilts/api/202504/private/watchdogd.te
@@ -0,0 +1,6 @@
+typeattribute watchdogd coredomain;
+
+init_daemon_domain(watchdogd)
+
+allow watchdogd watchdog_device:chr_file rw_file_perms;
+allow watchdogd kmsg_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/202504/private/webview_zygote.te b/prebuilts/api/202504/private/webview_zygote.te
new file mode 100644
index 0000000..1e32c1f
--- /dev/null
+++ b/prebuilts/api/202504/private/webview_zygote.te
@@ -0,0 +1,162 @@
+# webview_zygote is an auxiliary zygote process that is used to spawn
+# isolated_app processes for rendering untrusted web content.
+
+typeattribute webview_zygote coredomain;
+
+# The webview_zygote needs to be able to transition domains.
+typeattribute webview_zygote mlstrustedsubject;
+
+# Allow access to temporary files, which is normally permitted through
+# a domain macro.
+tmpfs_domain(webview_zygote);
+
+userfaultfd_use(webview_zygote)
+
+# Allow reading/executing installed binaries to enable preloading the
+# installed WebView implementation.
+allow webview_zygote apk_data_file:dir r_dir_perms;
+allow webview_zygote apk_data_file:file { r_file_perms execute };
+
+# Access to the WebView relro file.
+allow webview_zygote shared_relro_file:dir search;
+allow webview_zygote shared_relro_file:file r_file_perms;
+
+# Set the UID/GID of the process.
+allow webview_zygote self:global_capability_class_set { setgid setuid };
+# Drop capabilities from bounding set.
+allow webview_zygote self:global_capability_class_set setpcap;
+# Switch SELinux context to app domains.
+allow webview_zygote self:process setcurrent;
+allow webview_zygote isolated_app:process dyntransition;
+
+# For art.
+allow webview_zygote { apex_art_data_file dalvikcache_data_file }:dir r_dir_perms;
+allow webview_zygote dalvikcache_data_file:lnk_file r_file_perms;
+allow webview_zygote { apex_art_data_file dalvikcache_data_file }:file { r_file_perms execute };
+allow webview_zygote apex_module_data_file:dir search;
+
+# To load overlay from /apex (vendor APEXes)
+allow webview_zygote vendor_apex_metadata_file:dir search;
+
+# Allow webview_zygote to create JIT memory.
+allow webview_zygote self:process execmem;
+
+# Allow webview_zygote to stat the files that it opens. It must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow webview_zygote debugfs_trace_marker:file getattr;
+
+# Allow webview_zygote to manage the pgroup of its children.
+allow webview_zygote system_server:process getpgid;
+
+# Interaction between the webview_zygote and its children.
+allow webview_zygote isolated_app:process setpgid;
+
+# TODO (b/63631799) fix this access
+# Suppress denials to storage. Webview zygote should not be accessing.
+dontaudit webview_zygote mnt_expand_file:dir getattr;
+
+# TODO (b/72957399) remove this when webview_zygote is reparented to
+# app_process zygote
+dontaudit webview_zygote dex2oat_exec:file execute;
+
+# Get seapp_contexts
+allow webview_zygote seapp_contexts_file:file r_file_perms;
+# Check validity of SELinux context before use.
+selinux_check_context(webview_zygote)
+# Check SELinux permissions.
+selinux_check_access(webview_zygote)
+
+# Directory listing in /system.
+allow webview_zygote system_file:dir r_dir_perms;
+
+# Read and inspect temporary files (like system properties) managed by zygote.
+allow webview_zygote zygote_tmpfs:file { read getattr };
+# Child of zygote.
+allow webview_zygote zygote:fd use;
+allow webview_zygote zygote:process sigchld;
+
+# Allow apps access to /vendor/overlay
+r_dir_file(webview_zygote, vendor_overlay_file)
+
+allow webview_zygote same_process_hal_file:file { execute read open getattr map };
+
+allow webview_zygote system_data_file:lnk_file r_file_perms;
+
+# Send unsolicited message to system_server
+unix_socket_send(webview_zygote, system_unsolzygote, system_server)
+
+# Allow the webview_zygote to access the runtime feature flag properties.
+get_prop(webview_zygote, device_config_runtime_native_prop)
+get_prop(webview_zygote, device_config_runtime_native_boot_prop)
+
+# Allow webview_zygote to access odsign verification status
+get_prop(zygote, odsign_prop)
+
+# /data/resource-cache
+allow webview_zygote resourcecache_data_file:file r_file_perms;
+allow webview_zygote resourcecache_data_file:dir r_dir_perms;
+
+#####
+##### Neverallow
+#####
+
+# Only permit transition to isolated_app.
+neverallow webview_zygote { domain -isolated_app }:process dyntransition;
+
+# Only setcon() transitions, no exec() based transitions, except for crash_dump.
+neverallow webview_zygote { domain -crash_dump }:process transition;
+
+# Must not exec() a program without changing domains.
+# Having said that, exec() above is not allowed.
+neverallow webview_zygote *:file execute_no_trans;
+
+# The only way to enter this domain is for the zygote to fork a new
+# webview_zygote child.
+neverallow { domain -zygote } webview_zygote:process dyntransition;
+
+# Disallow write access to properties.
+neverallow webview_zygote property_socket:sock_file write;
+neverallow webview_zygote property_type:property_service set;
+
+# Should not have any access to app data files.
+neverallow webview_zygote app_data_file_type:file { rwx_file_perms };
+
+neverallow webview_zygote {
+ service_manager_type
+ -activity_service
+ -webviewupdate_service
+}:service_manager find;
+
+# Isolated apps shouldn't be able to access the driver directly.
+neverallow webview_zygote gpu_device:chr_file { rwx_file_perms };
+
+# Do not allow webview_zygote access to /cache.
+neverallow webview_zygote cache_file:dir ~{ r_dir_perms };
+neverallow webview_zygote cache_file:file ~{ read getattr };
+
+# Do not allow most socket access. This is socket_class_set, excluding unix_dgram_socket,
+# unix_stream_socket, and netlink_selinux_socket.
+neverallow webview_zygote domain:{
+ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket
+ appletalk_socket netlink_route_socket netlink_tcpdiag_socket
+ netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket
+ netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
+ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
+ netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
+ sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket
+ x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket
+ pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket
+ rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+ alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
+ xdp_socket
+} *;
+
+# Do not allow access to Bluetooth-related system properties.
+# neverallow rules for Bluetooth-related data files are listed above.
+neverallow webview_zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file create_file_perms;
diff --git a/prebuilts/api/202504/private/wifi_mainline_supplicant.te b/prebuilts/api/202504/private/wifi_mainline_supplicant.te
new file mode 100644
index 0000000..d6c7998
--- /dev/null
+++ b/prebuilts/api/202504/private/wifi_mainline_supplicant.te
@@ -0,0 +1,31 @@
+type wifi_mainline_supplicant, domain, coredomain;
+type wifi_mainline_supplicant_exec, system_file_type, exec_type, file_type;
+
+binder_use(wifi_mainline_supplicant)
+init_daemon_domain(wifi_mainline_supplicant)
+add_service(wifi_mainline_supplicant, wifi_mainline_supplicant_service)
+
+allow wifi_mainline_supplicant self:global_capability_class_set { setuid setgid net_admin net_raw };
+allow wifi_mainline_supplicant proc_net:file rw_file_perms;
+allow wifi_mainline_supplicant sysfs_net:dir search;
+
+# Allow limited access to the parent directory /data/misc/wifi/
+allow wifi_mainline_supplicant wifi_data_file:dir { getattr search };
+
+# Create temporary socket files in /data/misc/wifi/mainline_supplicant/sockets
+allow wifi_mainline_supplicant mainline_supplicant_data_file:dir create_dir_perms;
+allow wifi_mainline_supplicant mainline_supplicant_data_file:file create_file_perms;
+allow wifi_mainline_supplicant mainline_supplicant_data_file:sock_file { create write setattr unlink };
+
+# UDP sockets
+allow wifi_mainline_supplicant self:udp_socket create_socket_perms;
+allowxperm wifi_mainline_supplicant self:udp_socket ioctl { priv_sock_ioctls SIOCSIFFLAGS SIOCSIFHWADDR };
+
+# Packet sockets
+allow wifi_mainline_supplicant self:packet_socket create_socket_perms;
+allowxperm wifi_mainline_supplicant self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
+
+# Netlink sockets
+allow wifi_mainline_supplicant self:netlink_route_socket { bind create read write nlmsg_readpriv nlmsg_write };
+allow wifi_mainline_supplicant self:netlink_socket create_socket_perms_no_ioctl;
+allow wifi_mainline_supplicant self:netlink_generic_socket create_socket_perms_no_ioctl;
diff --git a/prebuilts/api/202504/private/wificond.te b/prebuilts/api/202504/private/wificond.te
new file mode 100644
index 0000000..0461573
--- /dev/null
+++ b/prebuilts/api/202504/private/wificond.te
@@ -0,0 +1,49 @@
+typeattribute wificond coredomain;
+
+set_prop(wificond, wifi_hal_prop)
+set_prop(wificond, wifi_prop)
+set_prop(wificond, ctl_default_prop)
+
+get_prop(wificond, hwservicemanager_prop)
+
+allow wificond legacykeystore_service:service_manager find;
+
+init_daemon_domain(wificond)
+
+binder_use(wificond)
+binder_call(wificond, system_server)
+binder_call(wificond, keystore)
+
+add_service(wificond, wifinl80211_service)
+hal_client_domain(wificond, hal_nlinterceptor)
+
+# create sockets to set interfaces up and down
+allow wificond self:udp_socket create_socket_perms;
+# setting interface state up/down is a privileged ioctl
+allowxperm wificond self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFHWADDR };
+allow wificond self:global_capability_class_set { net_admin net_raw };
+# allow wificond to speak to nl80211 in the kernel
+allow wificond self:netlink_socket create_socket_perms_no_ioctl;
+# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
+allow wificond self:netlink_generic_socket create_socket_perms_no_ioctl;
+
+r_dir_file(wificond, proc_net_type)
+
+# allow wificond to check permission for dumping logs
+allow wificond permission_service:service_manager find;
+
+# dumpstate support
+allow wificond dumpstate:fd use;
+allow wificond dumpstate:fifo_file write;
+
+#### Offer the Wifi Keystore HwBinder service ###
+hwbinder_use(wificond)
+typeattribute wificond wifi_keystore_service_server;
+add_hwservice(wificond, system_wifi_keystore_hwservice)
+
+# Allow keystore2 binder access to serve the HwBinder service.
+allow wificond keystore_service:service_manager find;
+allow wificond wifi_key:keystore2_key {
+ get_info
+ use
+};
diff --git a/prebuilts/api/202504/private/zygote.te b/prebuilts/api/202504/private/zygote.te
new file mode 100644
index 0000000..4815ecc
--- /dev/null
+++ b/prebuilts/api/202504/private/zygote.te
@@ -0,0 +1,309 @@
+# zygote
+typeattribute zygote coredomain;
+typeattribute zygote mlstrustedsubject;
+
+init_daemon_domain(zygote)
+tmpfs_domain(zygote)
+
+read_runtime_log_tags(zygote)
+
+# Override DAC on files and switch uid/gid.
+allow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown };
+
+# Drop capabilities from bounding set.
+allow zygote self:global_capability_class_set setpcap;
+
+# Switch SELinux context to app domains.
+allow zygote self:process setcurrent;
+allow zygote system_server_startup:process dyntransition;
+allow zygote appdomain:process dyntransition;
+allow zygote webview_zygote:process dyntransition;
+allow zygote app_zygote:process dyntransition;
+
+# Allow zygote to read app /proc/pid dirs (b/10455872).
+allow zygote appdomain:dir { getattr search };
+allow zygote appdomain:file { r_file_perms };
+
+userfaultfd_use(zygote)
+
+# Move children into the peer process group.
+allow zygote system_server:process { getpgid setpgid };
+allow zygote appdomain:process { getpgid setpgid };
+allow zygote webview_zygote:process { getpgid setpgid };
+allow zygote app_zygote:process { getpgid setpgid };
+
+# Read system data.
+allow zygote system_data_file:dir r_dir_perms;
+allow zygote system_data_file:file r_file_perms;
+
+# Get attributes of /mnt/expand, needed by cacheNonBootClasspathClassLoaders.
+allow zygote mnt_expand_file:dir getattr;
+
+# Write to /data/dalvik-cache.
+allow zygote dalvikcache_data_file:dir create_dir_perms;
+allow zygote dalvikcache_data_file:file create_file_perms;
+
+# Create symlinks in /data/dalvik-cache.
+allow zygote dalvikcache_data_file:lnk_file create_file_perms;
+
+# Write to /data/resource-cache.
+allow zygote resourcecache_data_file:dir rw_dir_perms;
+allow zygote resourcecache_data_file:file create_file_perms;
+
+# For updateability, the zygote may fetch the current boot
+# classpath from the dalvik cache. Integrity of the files
+# is ensured by fsverity protection (checked in art_apex_boot_integrity).
+allow zygote dalvikcache_data_file:file execute;
+
+# Allow zygote to find files in APEX data directories.
+allow zygote apex_module_data_file:dir search;
+
+# Allow zygote to find and map files created by on device signing.
+allow zygote apex_art_data_file:dir { getattr search };
+allow zygote apex_art_data_file:file { r_file_perms execute };
+
+# Mount tmpfs over various directories containing per-app directories, to hide
+# them for app data isolation. Also traverse these directories (via
+# /data_mirror) to find the allowlisted per-app directories to bind-mount in.
+allow zygote {
+ # /data/user{,_de}, /mnt/expand/$volume/user{,_de}
+ system_userdir_file
+ # /data/data
+ system_data_file
+ # /data/misc/profiles/cur
+ user_profile_root_file
+ # /data/misc/profiles/ref
+ user_profile_data_file
+ # /storage/emulated/$userId/Android/{data,obb}
+ media_rw_data_file
+ # /dev/__properties__
+ properties_device
+}:dir { mounton search };
+
+# Traverse /data_mirror to get to the above directories while their normal paths
+# are hidden, in order to bind-mount allowlisted per-app directories.
+allow zygote mirror_data_file:dir search;
+
+# List /mnt/expand to find all /mnt/expand/$volume/user{,_de} directories that
+# need to be hidden by app data isolation, and traverse /mnt/expand to get to
+# any allowlisted per-app directories within these directories.
+allow zygote mnt_expand_file:dir { open read search };
+
+# Get the inode number of app CE data directories to find them by inode number
+# when CE storage is locked. Needed for app data isolation.
+allow zygote app_data_file_type:dir getattr;
+
+# Create dirs in the app data isolation tmpfs mounts and bind mount on them.
+allow zygote tmpfs:dir { create_dir_perms mounton };
+
+# Create the '/data/user/0 => /data/data' symlink in the /data/user tmpfs mount
+# when setting up app data isolation.
+allow zygote tmpfs:lnk_file create;
+
+# Relabel dirs and symlinks in the app and sdk sandbox data isolation tmpfs mounts to their
+# standard labels. Note: it seems that not all dirs are actually relabeled yet,
+# but it works anyway since all domains can search tmpfs:dir.
+allow zygote tmpfs:{ dir lnk_file } relabelfrom;
+allow zygote system_userdir_file:dir relabelto;
+allow zygote system_data_file:{ dir lnk_file } relabelto;
+allow zygote sdk_sandbox_system_data_file:dir { getattr relabelto search };
+
+# Read if sdcardfs is supported
+allow zygote proc_filesystems:file r_file_perms;
+
+# Allow zygote to create JIT memory.
+allow zygote self:process execmem;
+allow zygote zygote_tmpfs:file execute;
+allow zygote ashmem_libcutils_device:chr_file execute;
+
+# Execute idmap and dex2oat within zygote's own domain.
+# TODO: Should either of these be transitioned to the same domain
+# used by installd or stay in-domain for zygote?
+allow zygote idmap_exec:file rx_file_perms;
+allow zygote dex2oat_exec:file rx_file_perms;
+
+# Allow apps access to /vendor/overlay
+r_dir_file(zygote, vendor_overlay_file)
+
+# Control cgroups.
+allow zygote cgroup:dir create_dir_perms;
+allow zygote cgroup:{ file lnk_file } { r_file_perms setattr };
+allow zygote cgroup_v2:dir create_dir_perms;
+allow zygote cgroup_v2:{ file lnk_file } { r_file_perms setattr };
+allow zygote self:global_capability_class_set sys_admin;
+
+# Allow zygote to stat the files that it opens. The zygote must
+# be able to inspect them so that it can reopen them on fork
+# if necessary: b/30963384.
+allow zygote pmsg_device:chr_file getattr;
+allow zygote debugfs_trace_marker:file getattr;
+
+# Get seapp_contexts
+allow zygote seapp_contexts_file:file r_file_perms;
+# Check validity of SELinux context before use.
+selinux_check_context(zygote)
+# Check SELinux permissions.
+selinux_check_access(zygote)
+
+# Native bridge functionality requires that zygote replaces
+# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
+allow zygote proc_cpuinfo:file mounton;
+
+# Allow remounting rootfs as MS_SLAVE.
+allow zygote rootfs:dir mounton;
+allow zygote tmpfs:filesystem { mount unmount };
+allow zygote fuse:filesystem { unmount };
+allow zygote sdcardfs:filesystem { unmount };
+allow zygote labeledfs:filesystem { unmount };
+
+# Allow creating user-specific storage source if started before vold.
+allow zygote mnt_user_file:dir { create_dir_perms mounton };
+allow zygote mnt_user_file:lnk_file create_file_perms;
+allow zygote mnt_user_file:file create_file_perms;
+
+# Allow mounting user-specific storage source if started before vold.
+allow zygote mnt_pass_through_file:dir { create_dir_perms mounton };
+
+# Allowed to mount user-specific storage into place
+allow zygote storage_file:dir { search mounton };
+
+# Allow mounting and creating files, dirs on sdcardfs.
+allow zygote { sdcard_type fuse }:dir { create_dir_perms mounton };
+allow zygote { sdcard_type fuse }:file { create_file_perms };
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file rx_file_perms;
+
+# Allow zygote to write to statsd.
+unix_socket_send(zygote, statsdw, statsd)
+
+# Root fs.
+r_dir_file(zygote, rootfs)
+
+# System file accesses.
+r_dir_file(zygote, system_file)
+
+# /oem accesses.
+allow zygote oemfs:dir search;
+
+userdebug_or_eng(`
+ # Allow zygote to create and write method traces in /data/misc/trace.
+ allow zygote method_trace_data_file:dir w_dir_perms;
+ allow zygote method_trace_data_file:file { create w_file_perms };
+')
+
+allow zygote ion_device:chr_file r_file_perms;
+allow zygote tmpfs:dir r_dir_perms;
+
+allow zygote same_process_hal_file:file { execute read open getattr map };
+
+# Allow zygote to read build properties for attestation feature
+get_prop(zygote, build_attestation_prop)
+
+# Allow the zygote to access storage properties to check if sdcardfs is enabled.
+get_prop(zygote, storage_config_prop);
+
+# Let the zygote access overlays so it can initialize the AssetManager.
+get_prop(zygote, overlay_prop)
+get_prop(zygote, exported_overlay_prop)
+
+# Allow the zygote to access the runtime feature flag properties.
+get_prop(zygote, device_config_runtime_native_prop)
+get_prop(zygote, device_config_runtime_native_boot_prop)
+
+# Allow the zygote to access window manager native boot feature flags
+# to initialize WindowManager static properties.
+get_prop(zygote, device_config_window_manager_native_boot_prop)
+
+# ingore spurious denials
+# fsetid can be checked as a consequence of chmod when using cgroup v2 uid/pid hierarchy. This is
+# done to determine if the file should inherit setgid. In this case, setgid on the file is
+# undesirable, so suppress the denial.
+dontaudit zygote self:global_capability_class_set { sys_resource fsetid };
+
+# Ignore spurious denials calling access() on fuse.
+# Also ignore read and open as sdcardfs may read and open dir when app tries to access a dir that
+# doesn't exist.
+# TODO(b/151316657): avoid the denials
+dontaudit zygote media_rw_data_file:dir { read open setattr };
+
+# Allow zygote to use ashmem fds from system_server.
+allow zygote system_server:fd use;
+
+# Send unsolicited message to system_server
+unix_socket_send(zygote, system_unsolzygote, system_server)
+
+# Allow zygote to access media_variant_prop for static initialization
+get_prop(zygote, media_variant_prop)
+
+# Allow zygote to access odsign verification status
+get_prop(zygote, odsign_prop)
+
+# Allow zygote to read ro.control_privapp_permissions and ro.cp_system_other_odex
+get_prop(zygote, packagemanager_config_prop)
+
+# Allow zygote to read qemu.sf.lcd_density
+get_prop(zygote, qemu_sf_lcd_density_prop)
+
+# Allow zygote to read persist.wm.debug.* to toggle experimental window manager features in
+# preloaded classes
+get_prop(zygote, persist_wm_debug_prop)
+
+# Allow zygote to read persist_sysui_builder_extras_prop
+# and persist_sysui_ranking_update_prop
+# to toggle experimental features in core preloaded classes
+get_prop(zygote, persist_sysui_builder_extras_prop)
+get_prop(zygote, persist_sysui_ranking_update_prop)
+
+# Allow zygote to read /apex/apex-info-list.xml
+allow zygote apex_info_file:file r_file_perms;
+
+# Allow zygote to canonicalize vendor APEX paths. This is used when zygote is checking the
+# preinstalled path of APEXes that contain runtime resource overlays for the 'android' package.
+allow zygote vendor_apex_file:dir { getattr search };
+allow zygote vendor_apex_file:file { getattr };
+allow zygote vendor_apex_metadata_file:dir { search };
+
+# Allow zygote to query for compression/features.
+r_dir_file(zygote, sysfs_fs_f2fs)
+
+# Allow zygote to read fonts_customization.xml for preloading font files that matches device locale.
+allow zygote system_font_fallback_file:file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# Ensure that all types assigned to app processes are included
+# in the appdomain attribute, so that all allow and neverallow rules
+# written on appdomain are applied to all app processes.
+# This is achieved by ensuring that it is impossible for zygote to
+# setcon (dyntransition) to any types other than those associated
+# with appdomain plus system_server_startup, webview_zygote and
+# app_zygote.
+neverallow zygote ~{
+ appdomain
+ system_server_startup
+ webview_zygote
+ app_zygote
+}:process dyntransition;
+
+# Zygote should never execute anything from /data except for
+# /data/dalvik-cache files or files generated during on-device
+# signing under /data/misc/apexdata/com.android.art/.
+neverallow zygote {
+ data_file_type
+ -apex_art_data_file # map PROT_EXEC
+ -dalvikcache_data_file # map PROT_EXEC
+}:file no_x_file_perms;
+
+# Do not allow access to Bluetooth-related system properties and files
+neverallow zygote {
+ bluetooth_a2dp_offload_prop
+ bluetooth_audio_hal_prop
+ bluetooth_prop
+ exported_bluetooth_prop
+}:file create_file_perms;
+
+# Zygote should not be able to access app private data.
+neverallow zygote app_data_file_type:dir ~getattr;
diff --git a/prebuilts/api/202504/public/adbd.te b/prebuilts/api/202504/public/adbd.te
new file mode 100644
index 0000000..36e4bd3
--- /dev/null
+++ b/prebuilts/api/202504/public/adbd.te
@@ -0,0 +1,8 @@
+# adbd seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type adbd, domain;
+type adbd_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/aidl_lazy_test_server.te b/prebuilts/api/202504/public/aidl_lazy_test_server.te
new file mode 100644
index 0000000..2d3b7e7
--- /dev/null
+++ b/prebuilts/api/202504/public/aidl_lazy_test_server.te
@@ -0,0 +1,6 @@
+type aidl_lazy_test_server, domain;
+type aidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/apexd.te b/prebuilts/api/202504/public/apexd.te
new file mode 100644
index 0000000..1964bbe
--- /dev/null
+++ b/prebuilts/api/202504/public/apexd.te
@@ -0,0 +1,7 @@
+# apexd -- manager for APEX packages
+type apexd, domain;
+type apexd_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/app.te b/prebuilts/api/202504/public/app.te
new file mode 100644
index 0000000..864557d
--- /dev/null
+++ b/prebuilts/api/202504/public/app.te
@@ -0,0 +1,13 @@
+###
+### Domain for all zygote spawned apps
+###
+### This file is the base policy for all zygote spawned apps.
+### Other policy files, such as isolated_app.te, untrusted_app.te, etc
+### extend from this policy. Only policies which should apply to ALL
+### zygote spawned apps should be added here.
+###
+type appdomain_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/app_zygote.te b/prebuilts/api/202504/public/app_zygote.te
new file mode 100644
index 0000000..5c649d2
--- /dev/null
+++ b/prebuilts/api/202504/public/app_zygote.te
@@ -0,0 +1,9 @@
+# app_zygote is an auxiliary zygote process that is used to spawn
+# isolated service processes for individual applications. It is
+# spawned from the regular zygote process as a "child zygote".
+type app_zygote, domain;
+type app_zygote_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/artd.te b/prebuilts/api/202504/public/artd.te
new file mode 100644
index 0000000..3cf8aa0
--- /dev/null
+++ b/prebuilts/api/202504/public/artd.te
@@ -0,0 +1,6 @@
+# ART service daemon.
+type artd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/asan_extract.te b/prebuilts/api/202504/public/asan_extract.te
new file mode 100644
index 0000000..cf160d0
--- /dev/null
+++ b/prebuilts/api/202504/public/asan_extract.te
@@ -0,0 +1,13 @@
+# asan_extract
+#
+# This command set moves the artifact corresponding to the current slot
+# from /data/ota to /data/dalvik-cache.
+
+with_asan(`
+ type asan_extract, domain, coredomain;
+ type asan_extract_exec, exec_type, file_type, system_file_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/atrace.te b/prebuilts/api/202504/public/atrace.te
new file mode 100644
index 0000000..26387c6
--- /dev/null
+++ b/prebuilts/api/202504/public/atrace.te
@@ -0,0 +1,5 @@
+type atrace, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/attributes b/prebuilts/api/202504/public/attributes
new file mode 100644
index 0000000..bc58e40
--- /dev/null
+++ b/prebuilts/api/202504/public/attributes
@@ -0,0 +1,474 @@
+######################################
+# Attribute declarations
+#
+
+# All types used for devices.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# in tools/checkfc.c
+attribute dev_type;
+
+# Attribute for all bpf filesystem subtypes.
+attribute bpffs_type;
+
+# All types used for processes.
+attribute domain;
+
+# All types used for filesystems.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute fs_type;
+
+# All types used for context= mounts.
+attribute contextmount_type;
+
+# All types referencing a FUSE filesystem.
+# When mounting a new FUSE filesystem, the fscontext= option should be used to
+# set a domain-specific type with this attribute. See app_fusefs for an
+# example.
+attribute fusefs_type;
+
+# All types used for files that can exist on a labeled fs.
+# Do not use for pseudo file types.
+# On change, update CHECK_FC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute file_type;
+
+# All types used for domain entry points.
+attribute exec_type;
+
+# All types used for /data files.
+attribute data_file_type;
+expandattribute data_file_type false;
+# All types in /data, not in /data/vendor
+attribute core_data_file_type;
+expandattribute core_data_file_type false;
+
+# All types used for app private data files in seapp_contexts.
+# Such types should not be applied to any other files.
+attribute app_data_file_type;
+expandattribute app_data_file_type false;
+
+# All types in /system
+attribute system_file_type;
+
+# All types in /system_dlkm
+attribute system_dlkm_file_type;
+
+# All types in /vendor
+attribute vendor_file_type;
+
+# All types used for procfs files.
+attribute proc_type;
+expandattribute proc_type false;
+
+# Types in /proc/net, excluding qtaguid types.
+# TODO(b/9496886) Lock down access to /proc/net.
+# This attribute is used to audit access to proc_net. it is temporary and will
+# be removed.
+attribute proc_net_type;
+expandattribute proc_net_type true;
+
+# All types used for sysfs files.
+attribute sysfs_type;
+
+# All types use for debugfs files.
+attribute debugfs_type;
+
+# All types used for tracefs files.
+attribute tracefs_type;
+
+# Attribute used for all sdcards
+attribute sdcard_type;
+
+# All types used for nodes/hosts.
+attribute node_type;
+
+# All types used for network interfaces.
+attribute netif_type;
+
+# All types used for network ports.
+attribute port_type;
+
+# All types used for property service
+# On change, update CHECK_PC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute property_type;
+
+# All properties defined in core SELinux policy. Should not be
+# used by device specific properties
+attribute core_property_type;
+
+# All properties used to configure log filtering.
+attribute log_property_type;
+
+# All properties that are not specific to device but are added from
+# outside of AOSP. (e.g. OEM-specific properties)
+# These properties are not accessible from device-specific domains
+attribute extended_core_property_type;
+
+# Properties used for representing ownership. All properties should have one
+# of: system_property_type, product_property_type, or vendor_property_type.
+
+# All properties defined by /system.
+attribute system_property_type;
+expandattribute system_property_type false;
+
+# All /system-defined properties used only in /system.
+attribute system_internal_property_type;
+expandattribute system_internal_property_type false;
+
+# All /system-defined properties which can't be written outside /system.
+attribute system_restricted_property_type;
+expandattribute system_restricted_property_type false;
+
+# All /system-defined properties with no restrictions.
+attribute system_public_property_type;
+expandattribute system_public_property_type false;
+
+# All keystore2_key labels.
+attribute keystore2_key_type;
+
+# All properties defined by /product.
+# Currently there are no enforcements between /system and /product, so for now
+# /product attributes are just replaced to /system attributes.
+define(`product_property_type', `system_property_type')
+define(`product_internal_property_type', `system_internal_property_type')
+define(`product_restricted_property_type', `system_restricted_property_type')
+define(`product_public_property_type', `system_public_property_type')
+
+# All properties defined by /vendor.
+attribute vendor_property_type;
+expandattribute vendor_property_type false;
+
+# All /vendor-defined properties used only in /vendor.
+attribute vendor_internal_property_type;
+expandattribute vendor_internal_property_type false;
+
+# All /vendor-defined properties which can't be written outside /vendor.
+attribute vendor_restricted_property_type;
+expandattribute vendor_restricted_property_type false;
+
+# All /vendor-defined properties with no restrictions.
+attribute vendor_public_property_type;
+expandattribute vendor_public_property_type false;
+
+# All service_manager types created by system_server
+attribute system_server_service;
+
+# services which should be available to all but isolated apps
+attribute app_api_service;
+
+# services which should be available to all ephemeral apps
+attribute ephemeral_app_api_service;
+
+# services which export only system_api
+attribute system_api_service;
+
+# services which are explicitly disallowed for untrusted apps to access
+attribute protected_service;
+
+# All types used for services managed by servicemanager.
+# On change, update CHECK_SC_ASSERT_ATTRS
+# definition in tools/checkfc.c.
+attribute service_manager_type;
+
+# All types used for services managed by hwservicemanager
+attribute hwservice_manager_type;
+
+# All HwBinder services guaranteed to be passthrough. These services always run
+# in the process of their clients, and thus operate with the same access as
+# their clients.
+attribute same_process_hwservice;
+
+# All HwBinder services guaranteed to be offered only by core domain components
+attribute coredomain_hwservice;
+
+# All HwBinder services that untrusted apps can't directly access
+attribute protected_hwservice;
+
+# All types used for services managed by vndservicemanager
+attribute vndservice_manager_type;
+
+# All services declared as part of an HAL
+attribute hal_service_type;
+
+# All domains that can override MLS restrictions.
+# i.e. processes that can read up and write down.
+attribute mlstrustedsubject;
+
+# All types that can override MLS restrictions.
+# i.e. files that can be read by lower and written by higher
+attribute mlstrustedobject;
+
+# All domains used for apps.
+attribute appdomain;
+
+# All third party apps (except isolated_app and ephemeral_app)
+attribute untrusted_app_all;
+
+# All apps with UID between AID_ISOLATED_START (99000) and AID_ISOLATED_END (99999).
+attribute isolated_app_all;
+
+# All service types that would be allowed for isolated_compute_app.
+attribute isolated_compute_allowed_service;
+
+# All device types that would be allowed for isolated_compute_app.
+attribute isolated_compute_allowed_device;
+
+# All domains used for apps with network access.
+attribute netdomain;
+
+# All domains used for apps with bluetooth access.
+attribute bluetoothdomain;
+
+# Specific domains that expose a binder service.
+# Deprecated, consider granting the exact permissions required by your service.
+attribute binderservicedomain;
+
+# All domains which have BPF access.
+attribute bpfdomain;
+expandattribute bpfdomain false;
+
+# update_engine related domains that need to apply an update and run
+# postinstall. This includes the background daemon and the sideload tool from
+# recovery for A/B devices.
+attribute update_engine_common;
+
+# All core domains (as opposed to vendor/device-specific domains)
+attribute coredomain;
+
+# All vendor hwservice.
+attribute vendor_hwservice_type;
+
+# All socket devices owned by core domain components
+attribute coredomain_socket;
+expandattribute coredomain_socket false;
+
+# All vendor domains which violate the requirement of not using sockets for
+# communicating with core components
+# TODO(b/36577153): Remove this once there are no violations
+attribute socket_between_core_and_vendor_violators;
+expandattribute socket_between_core_and_vendor_violators false;
+
+starting_at_board_api(202504, `
+# All vsock communication is required to go through AVF so that we can
+# have a consistent permission model for which is allowed to talk to
+# which. This breaks Treble as well as updatability of VMs and
+# other components.
+# TODO(b/347661724): Remove this once there are no violations.
+attribute unconstrained_vsock_violators;
+expandattribute unconstrained_vsock_violators false;
+')
+
+# All vendor domains which violate the requirement of not executing
+# system processes
+# TODO(b/36463595)
+attribute vendor_executes_system_violators;
+expandattribute vendor_executes_system_violators false;
+
+# All domains which violate the requirement of not sharing files by path
+# between between vendor and core domains.
+# TODO(b/34980020)
+attribute data_between_core_and_vendor_violators;
+expandattribute data_between_core_and_vendor_violators false;
+
+# All system domains which violate the requirement of not executing vendor
+# binaries/libraries.
+# TODO(b/62041836)
+attribute system_executes_vendor_violators;
+expandattribute system_executes_vendor_violators false;
+
+# All system domains which violate the requirement of not writing vendor
+# properties.
+# TODO(b/78598545): Remove this once there are no violations
+attribute system_writes_vendor_properties_violators;
+expandattribute system_writes_vendor_properties_violators false;
+
+# All system domains which violate the requirement of not writing to
+# /mnt/vendor/*. Must not be used on devices launched with P or later.
+attribute system_writes_mnt_vendor_violators;
+expandattribute system_writes_mnt_vendor_violators false;
+
+# hwservices that are accessible from untrusted applications
+# WARNING: Use of this attribute should be avoided unless
+# absolutely necessary. It is a temporary allowance to aid the
+# transition to treble and will be removed in a future platform
+# version, requiring all hwservices that are labeled with this
+# attribute to be submitted to AOSP in order to maintain their
+# app-visibility.
+attribute untrusted_app_visible_hwservice_violators;
+expandattribute untrusted_app_visible_hwservice_violators false;
+
+# halserver domains that are accessible to untrusted applications. These
+# domains are typically those hosting hwservices attributed by the
+# untrusted_app_visible_hwservice_violators.
+# WARNING: Use of this attribute should be avoided unless absolutely necessary.
+# It is a temporary allowance to aid the transition to treble and will be
+# removed in the future platform version, requiring all halserver domains that
+# are labeled with this attribute to be submitted to AOSP in order to maintain
+# their app-visibility.
+attribute untrusted_app_visible_halserver_violators;
+expandattribute untrusted_app_visible_halserver_violators false;
+
+# PDX services
+attribute pdx_endpoint_dir_type;
+attribute pdx_endpoint_socket_type;
+expandattribute pdx_endpoint_socket_type false;
+attribute pdx_channel_socket_type;
+expandattribute pdx_channel_socket_type false;
+
+pdx_service_attributes(display_client)
+pdx_service_attributes(display_manager)
+pdx_service_attributes(display_screenshot)
+pdx_service_attributes(display_vsync)
+pdx_service_attributes(performance_client)
+pdx_service_attributes(bufferhub_client)
+
+# All HAL servers
+attribute halserverdomain;
+# All HAL clients
+attribute halclientdomain;
+expandattribute halclientdomain true;
+
+# Exempt for halserverdomain to access sockets. Only builds for automotive
+# device types are allowed to use this attribute (enforced by CTS).
+# Unlike phone, in a car many modules are external from Android perspective and
+# HALs should be able to communicate with those devices through sockets.
+attribute hal_automotive_socket_exemption;
+
+# HALs
+hal_attribute(allocator);
+hal_attribute(atrace);
+hal_attribute(audio);
+hal_attribute(audiocontrol);
+hal_attribute(authgraph);
+hal_attribute(authsecret);
+hal_attribute(bluetooth);
+hal_attribute(bootctl);
+hal_attribute(broadcastradio);
+hal_attribute(camera);
+hal_attribute(can_bus);
+hal_attribute(can_controller);
+hal_attribute(cas);
+hal_attribute(codec2);
+hal_attribute(configstore);
+hal_attribute(confirmationui);
+hal_attribute(contexthub);
+hal_attribute(drm);
+hal_attribute(dumpstate);
+hal_attribute(evs);
+hal_attribute(face);
+hal_attribute(fastboot);
+hal_attribute(fingerprint);
+hal_attribute(gatekeeper);
+hal_attribute(gnss);
+hal_attribute(graphics_allocator);
+hal_attribute(graphics_composer);
+hal_attribute(health);
+hal_attribute(health_storage);
+hal_attribute(identity);
+hal_attribute(input_classifier);
+hal_attribute(input_processor);
+hal_attribute(ir);
+hal_attribute(ivn);
+hal_attribute(keymaster);
+hal_attribute(keymint);
+hal_attribute(light);
+hal_attribute(lowpan);
+hal_attribute(macsec);
+starting_at_board_api(202504, `
+ hal_attribute(mediaquality);
+')
+hal_attribute(memtrack);
+hal_attribute(neuralnetworks);
+hal_attribute(nfc);
+hal_attribute(nlinterceptor);
+hal_attribute(oemlock);
+hal_attribute(omx);
+hal_attribute(power);
+hal_attribute(power_stats);
+hal_attribute(rebootescrow);
+hal_attribute(remoteaccess);
+hal_attribute(secretkeeper);
+hal_attribute(remotelyprovisionedcomponent_avf);
+hal_attribute(secure_element);
+hal_attribute(sensors);
+hal_attribute(telephony);
+hal_attribute(tetheroffload);
+hal_attribute(thermal);
+hal_attribute(threadnetwork);
+hal_attribute(tv_cec);
+hal_attribute(tv_hdmi_cec);
+hal_attribute(tv_hdmi_connection);
+hal_attribute(tv_hdmi_earc);
+hal_attribute(tv_input);
+hal_attribute(tv_tuner);
+hal_attribute(usb);
+hal_attribute(usb_gadget);
+hal_attribute(uwb);
+# TODO(b/196225233): Remove this attribute and its usages elsewhere
+# once all chip vendors integrate to the new UWB stack.
+hal_attribute(uwb_vendor);
+hal_attribute(vehicle);
+hal_attribute(vibrator);
+hal_attribute(vr);
+hal_attribute(weaver);
+hal_attribute(wifi);
+hal_attribute(wifi_hostapd);
+hal_attribute(wifi_supplicant);
+
+# HwBinder services offered across the core-vendor boundary
+#
+# We annotate server domains with x_server to loosen the coupling between
+# system and vendor images. For example, it should be possible to move a service
+# from one core domain to another, without having to update the vendor image
+# which contains clients of this service.
+
+attribute automotive_display_service_server;
+attribute camera_service_server;
+attribute display_service_server;
+attribute evsmanager_service_server;
+attribute remote_provisioning_service_server;
+attribute scheduler_service_server;
+attribute sensor_service_server;
+attribute stats_service_server;
+attribute system_suspend_internal_server;
+attribute system_suspend_server;
+attribute wifi_keystore_service_server;
+
+# All types used for super partition block devices.
+attribute super_block_device_type;
+
+# All types used for DMA-BUF heaps
+attribute dmabuf_heap_device_type;
+expandattribute dmabuf_heap_device_type false;
+
+# Types for VM managers
+attribute vm_manager_device_type;
+
+# All types used for DSU metadata files.
+attribute gsi_metadata_file_type;
+
+# Types used for module-specific APEX data directories under
+# /data/{misc,misc_ce,misc_de}/apexdata.
+attribute apex_data_file_type;
+
+# Domains used for charger.
+# This is the common type for domains that executes charger's
+# functionalities, including setting and getting necessary properties,
+# permissions to maintain the health loop, writing to kernel log, handling
+# inputs and drawing screens, etc.
+attribute charger_type;
+
+# All types of ART properties.
+attribute dalvik_config_prop_type;
+
+# All tee services that can be accessed by VMs
+starting_at_board_api(202504, `
+ attribute tee_service_type;
+')
+
+# HAL service used for custom smc filtering project
+starting_at_board_api(202504, `
+ hal_attribute(vm_capabilities);
+')
diff --git a/prebuilts/api/202504/public/audioserver.te b/prebuilts/api/202504/public/audioserver.te
new file mode 100644
index 0000000..64a283d
--- /dev/null
+++ b/prebuilts/api/202504/public/audioserver.te
@@ -0,0 +1,7 @@
+# audioserver - audio services daemon
+type audioserver, domain;
+type audioserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/blkid.te b/prebuilts/api/202504/public/blkid.te
new file mode 100644
index 0000000..4e92e72
--- /dev/null
+++ b/prebuilts/api/202504/public/blkid.te
@@ -0,0 +1,6 @@
+# blkid called from vold
+type blkid, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/blkid_untrusted.te b/prebuilts/api/202504/public/blkid_untrusted.te
new file mode 100644
index 0000000..4be4c0c
--- /dev/null
+++ b/prebuilts/api/202504/public/blkid_untrusted.te
@@ -0,0 +1,2 @@
+# blkid for untrusted block devices
+type blkid_untrusted, domain;
diff --git a/prebuilts/api/202504/public/bluetooth.te b/prebuilts/api/202504/public/bluetooth.te
new file mode 100644
index 0000000..ff868a8
--- /dev/null
+++ b/prebuilts/api/202504/public/bluetooth.te
@@ -0,0 +1,6 @@
+# bluetooth subsystem
+type bluetooth, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/bootanim.te b/prebuilts/api/202504/public/bootanim.te
new file mode 100644
index 0000000..47f1160
--- /dev/null
+++ b/prebuilts/api/202504/public/bootanim.te
@@ -0,0 +1,7 @@
+# bootanimation oneshot service
+type bootanim, domain;
+type bootanim_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/bootstat.te b/prebuilts/api/202504/public/bootstat.te
new file mode 100644
index 0000000..437f6bc
--- /dev/null
+++ b/prebuilts/api/202504/public/bootstat.te
@@ -0,0 +1,7 @@
+# bootstat command
+type bootstat, domain;
+type bootstat_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/bpfloader.te b/prebuilts/api/202504/public/bpfloader.te
new file mode 100644
index 0000000..4aae1cf
--- /dev/null
+++ b/prebuilts/api/202504/public/bpfloader.te
@@ -0,0 +1,5 @@
+type bpfloader, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/bufferhubd.te b/prebuilts/api/202504/public/bufferhubd.te
new file mode 100644
index 0000000..e688d5c
--- /dev/null
+++ b/prebuilts/api/202504/public/bufferhubd.te
@@ -0,0 +1,7 @@
+# bufferhubd
+type bufferhubd, domain, mlstrustedsubject;
+type bufferhubd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/cameraserver.te b/prebuilts/api/202504/public/cameraserver.te
new file mode 100644
index 0000000..619b386
--- /dev/null
+++ b/prebuilts/api/202504/public/cameraserver.te
@@ -0,0 +1,8 @@
+# cameraserver - camera daemon
+type cameraserver, domain;
+type cameraserver_exec, system_file_type, exec_type, file_type;
+type cameraserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/charger.te b/prebuilts/api/202504/public/charger.te
new file mode 100644
index 0000000..4514fde
--- /dev/null
+++ b/prebuilts/api/202504/public/charger.te
@@ -0,0 +1,6 @@
+type charger, charger_type, domain;
+type charger_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/charger_vendor.te b/prebuilts/api/202504/public/charger_vendor.te
new file mode 100644
index 0000000..dd8d020
--- /dev/null
+++ b/prebuilts/api/202504/public/charger_vendor.te
@@ -0,0 +1,6 @@
+# Context when health HAL runs charger mode
+type charger_vendor, charger_type, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/crash_dump.te b/prebuilts/api/202504/public/crash_dump.te
new file mode 100644
index 0000000..3146ac4
--- /dev/null
+++ b/prebuilts/api/202504/public/crash_dump.te
@@ -0,0 +1,6 @@
+type crash_dump, domain;
+type crash_dump_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/credstore.te b/prebuilts/api/202504/public/credstore.te
new file mode 100644
index 0000000..faa23e9
--- /dev/null
+++ b/prebuilts/api/202504/public/credstore.te
@@ -0,0 +1,7 @@
+# credstore daemon
+type credstore, domain;
+type credstore_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/crosvm.te b/prebuilts/api/202504/public/crosvm.te
new file mode 100644
index 0000000..174a8b2
--- /dev/null
+++ b/prebuilts/api/202504/public/crosvm.te
@@ -0,0 +1,7 @@
+starting_at_board_api(202504, `
+ type crosvm, domain, coredomain;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/device.te b/prebuilts/api/202504/public/device.te
new file mode 100644
index 0000000..835b532
--- /dev/null
+++ b/prebuilts/api/202504/public/device.te
@@ -0,0 +1,143 @@
+# Device types
+type device, dev_type, fs_type;
+type ashmem_device, dev_type, mlstrustedobject;
+type ashmem_libcutils_device, dev_type, mlstrustedobject;
+type audio_device, dev_type;
+type binder_device, dev_type, mlstrustedobject;
+type hwbinder_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type vndbinder_device, dev_type;
+type block_device, dev_type;
+type bt_device, dev_type;
+type camera_device, dev_type;
+type dm_device, dev_type;
+type ublk_block_device, dev_type;
+type dm_user_device, dev_type;
+type ublk_control_device, dev_type;
+type keychord_device, dev_type;
+type loop_control_device, dev_type;
+type loop_device, dev_type;
+type pmsg_device, dev_type, mlstrustedobject;
+type radio_device, dev_type;
+type ram_device, dev_type;
+type rtc_device, dev_type;
+type vd_device, dev_type;
+type vold_device, dev_type;
+type console_device, dev_type;
+type fscklogs, dev_type;
+# GPU (used by most UI apps)
+type gpu_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type graphics_device, dev_type;
+type hw_random_device, dev_type;
+type input_device, dev_type;
+type port_device, dev_type;
+type lowpan_device, dev_type;
+type mtp_device, dev_type, mlstrustedobject;
+type nfc_device, dev_type;
+type ptmx_device, dev_type, mlstrustedobject;
+type kmsg_device, dev_type, mlstrustedobject;
+type kmsg_debug_device, dev_type;
+type null_device, dev_type, mlstrustedobject;
+type random_device, dev_type, mlstrustedobject;
+type secure_element_device, dev_type;
+type sensors_device, dev_type;
+type serial_device, dev_type;
+type socket_device, dev_type;
+type owntty_device, dev_type, mlstrustedobject;
+type tty_device, dev_type;
+type video_device, dev_type;
+type zero_device, dev_type, mlstrustedobject;
+type fuse_device, dev_type, mlstrustedobject;
+type iio_device, dev_type;
+type ion_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type dmabuf_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject;
+type dmabuf_system_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject, isolated_compute_allowed_device;
+type dmabuf_system_secure_heap_device, dmabuf_heap_device_type, dev_type, mlstrustedobject;
+type qtaguid_device, dev_type;
+type watchdog_device, dev_type;
+type uhid_device, dev_type, mlstrustedobject;
+type uio_device, dev_type;
+type tun_device, dev_type, mlstrustedobject;
+type usbaccessory_device, dev_type, mlstrustedobject;
+type usb_device, dev_type, mlstrustedobject;
+type usb_serial_device, dev_type;
+type gnss_device, dev_type;
+type properties_device, dev_type;
+type properties_serial, dev_type;
+type property_info, dev_type;
+type hidraw_device, dev_type;
+
+# All devices have a uart for the hci
+# attach service. The uart dev node
+# varies per device. This type
+# is used in per device policy
+type hci_attach_dev, dev_type;
+
+# All devices have a rpmsg device for
+# achieving remoteproc and rpmsg modules
+type rpmsg_device, dev_type;
+
+# Partition layout block device
+type root_block_device, dev_type;
+
+# factory reset protection block device
+type frp_block_device, dev_type;
+
+# System block device mounted on /system.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type system_block_device, dev_type;
+
+# Recovery block device.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type recovery_block_device, dev_type;
+
+# boot block device.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type boot_block_device, dev_type;
+
+# dtbo block device, type used for getting DTBO information for AVF.
+# Documented at https://source.android.com/docs/core/architecture/dto/partitions
+type dtbo_block_device, dev_type;
+
+# Userdata block device mounted on /data.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type userdata_block_device, dev_type;
+
+# Zoned block device.
+type zoned_block_device, dev_type;
+
+# Cache block device mounted on /cache.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type cache_block_device, dev_type;
+
+# Block device for any swap partition.
+type swap_block_device, dev_type;
+
+# Metadata block device mounted on /metadata, used for encryption metadata and
+# various other purposes.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type metadata_block_device, dev_type;
+
+# The 'misc' partition used by recovery and A/B.
+# Documented at https://source.android.com/devices/bootloader/partitions
+type misc_block_device, dev_type;
+
+# 'super' partition to be used for logical partitioning.
+type super_block_device, super_block_device_type, dev_type;
+
+# sdcard devices; normally vold uses the vold_block_device label and creates a
+# separate device node. gsid, however, accesses the original devide node
+# created through uevents, so we use a separate label.
+type sdcard_block_device, dev_type;
+
+# Userdata device file for filesystem tunables
+type userdata_sysdev, dev_type;
+
+# Root disk file for disk tunables
+type rootdisk_sysdev, dev_type;
+
+# vfio device
+type vfio_device, dev_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/dhcp.te b/prebuilts/api/202504/public/dhcp.te
new file mode 100644
index 0000000..0c1fa30
--- /dev/null
+++ b/prebuilts/api/202504/public/dhcp.te
@@ -0,0 +1,6 @@
+type dhcp, domain;
+type dhcp_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/dnsmasq.te b/prebuilts/api/202504/public/dnsmasq.te
new file mode 100644
index 0000000..08ce653
--- /dev/null
+++ b/prebuilts/api/202504/public/dnsmasq.te
@@ -0,0 +1,7 @@
+# DNS, DHCP services
+type dnsmasq, domain;
+type dnsmasq_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/drmserver.te b/prebuilts/api/202504/public/drmserver.te
new file mode 100644
index 0000000..4b59ee0
--- /dev/null
+++ b/prebuilts/api/202504/public/drmserver.te
@@ -0,0 +1,8 @@
+# drmserver - DRM service
+type drmserver, domain;
+type drmserver_exec, system_file_type, exec_type, file_type;
+type drmserver_socket, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/dumpstate.te b/prebuilts/api/202504/public/dumpstate.te
new file mode 100644
index 0000000..dd61ad1
--- /dev/null
+++ b/prebuilts/api/202504/public/dumpstate.te
@@ -0,0 +1,7 @@
+# dumpstate
+type dumpstate, domain, mlstrustedsubject;
+type dumpstate_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/e2fs.te b/prebuilts/api/202504/public/e2fs.te
new file mode 100644
index 0000000..74bab31
--- /dev/null
+++ b/prebuilts/api/202504/public/e2fs.te
@@ -0,0 +1,6 @@
+type e2fs, domain, coredomain;
+type e2fs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/early_virtmgr.te b/prebuilts/api/202504/public/early_virtmgr.te
new file mode 100644
index 0000000..6caac18
--- /dev/null
+++ b/prebuilts/api/202504/public/early_virtmgr.te
@@ -0,0 +1,12 @@
+is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `
+ # Domain for a child process that manages early VMs available before /data mount, on behalf of
+ # its parent.
+ starting_at_board_api(202504, `
+ type early_virtmgr, domain, coredomain;
+ type early_virtmgr_exec, system_file_type, exec_type, file_type;
+ ')
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/ephemeral_app.te b/prebuilts/api/202504/public/ephemeral_app.te
new file mode 100644
index 0000000..072f8f6
--- /dev/null
+++ b/prebuilts/api/202504/public/ephemeral_app.te
@@ -0,0 +1,18 @@
+###
+### Ephemeral apps.
+###
+### This file defines the security policy for apps with the ephemeral
+### feature.
+###
+### The ephemeral_app domain is a reduced permissions sandbox allowing
+### ephemeral applications to be safely installed and run. Non ephemeral
+### applications may also opt-in to ephemeral to take advantage of the
+### additional security features.
+###
+### PackageManager flags an app as ephemeral at install time.
+
+type ephemeral_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/evsmanagerd.te b/prebuilts/api/202504/public/evsmanagerd.te
new file mode 100644
index 0000000..b436f92
--- /dev/null
+++ b/prebuilts/api/202504/public/evsmanagerd.te
@@ -0,0 +1,6 @@
+# evsmanager daemon
+type evsmanagerd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/extra_free_kbytes.te b/prebuilts/api/202504/public/extra_free_kbytes.te
new file mode 100644
index 0000000..82ba963
--- /dev/null
+++ b/prebuilts/api/202504/public/extra_free_kbytes.te
@@ -0,0 +1,7 @@
+# The extra_free_kbytes.sh script run by init.
+type extra_free_kbytes, domain;
+type extra_free_kbytes_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/fastbootd.te b/prebuilts/api/202504/public/fastbootd.te
new file mode 100644
index 0000000..360a109
--- /dev/null
+++ b/prebuilts/api/202504/public/fastbootd.te
@@ -0,0 +1,9 @@
+# fastbootd (used in recovery init.rc for /sbin/fastbootd)
+
+# Declare the domain unconditionally so we can always reference it
+# in neverallow rules.
+type fastbootd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/file.te b/prebuilts/api/202504/public/file.te
new file mode 100644
index 0000000..7a8e3af
--- /dev/null
+++ b/prebuilts/api/202504/public/file.te
@@ -0,0 +1,667 @@
+# Filesystem types
+type labeledfs, fs_type;
+type pipefs, fs_type;
+type sockfs, fs_type;
+type rootfs, fs_type;
+type proc, fs_type, proc_type;
+type binderfs, fs_type;
+type binderfs_logs, fs_type;
+type binderfs_logs_proc, fs_type;
+type binderfs_logs_stats, fs_type;
+
+starting_at_board_api(202504, `
+ type binderfs_logs_transactions, fs_type;
+ type binderfs_logs_transaction_history, fs_type;
+')
+
+type binderfs_features, fs_type;
+# Security-sensitive proc nodes that should not be writable to most.
+type proc_security, fs_type, proc_type;
+type proc_drop_caches, fs_type, proc_type;
+type proc_overcommit_memory, fs_type, proc_type;
+type proc_min_free_order_shift, fs_type, proc_type;
+type proc_kpageflags, fs_type, proc_type;
+type proc_watermark_boost_factor, fs_type, proc_type;
+type proc_percpu_pagelist_high_fraction, fs_type, proc_type;
+# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
+type usermodehelper, fs_type, proc_type;
+type sysfs_usermodehelper, fs_type, sysfs_type;
+type proc_qtaguid_ctrl, fs_type, mlstrustedobject, proc_type;
+type proc_qtaguid_stat, fs_type, mlstrustedobject, proc_type;
+type proc_bluetooth_writable, fs_type, proc_type;
+type proc_abi, fs_type, proc_type;
+type proc_asound, fs_type, proc_type;
+type proc_bootconfig, fs_type, proc_type;
+type proc_bpf, fs_type, proc_type;
+type proc_buddyinfo, fs_type, proc_type;
+starting_at_board_api(202504, `
+ type proc_cgroups, fs_type, proc_type;
+')
+type proc_cmdline, fs_type, proc_type;
+type proc_cpu_alignment, fs_type, proc_type;
+type proc_cpuinfo, fs_type, proc_type;
+type proc_dirty, fs_type, proc_type;
+type proc_diskstats, fs_type, proc_type;
+type proc_extra_free_kbytes, fs_type, proc_type;
+type proc_filesystems, fs_type, proc_type;
+type proc_fs_verity, fs_type, proc_type;
+type proc_hostname, fs_type, proc_type;
+type proc_hung_task, fs_type, proc_type;
+type proc_interrupts, fs_type, proc_type;
+type proc_iomem, fs_type, proc_type;
+type proc_kallsyms, fs_type, proc_type;
+type proc_keys, fs_type, proc_type;
+type proc_kmsg, fs_type, proc_type;
+type proc_loadavg, fs_type, proc_type;
+type proc_locks, fs_type, proc_type;
+type proc_lowmemorykiller, fs_type, proc_type;
+type proc_max_map_count, fs_type, proc_type;
+type proc_meminfo, fs_type, proc_type;
+type proc_misc, fs_type, proc_type;
+type proc_modules, fs_type, proc_type;
+type proc_mounts, fs_type, proc_type;
+type proc_net, fs_type, proc_type, proc_net_type;
+type proc_net_tcp_udp, fs_type, proc_type;
+type proc_page_cluster, fs_type, proc_type;
+type proc_pagetypeinfo, fs_type, proc_type;
+type proc_panic, fs_type, proc_type;
+type proc_perf, fs_type, proc_type;
+type proc_pid_max, fs_type, proc_type;
+type proc_pipe_conf, fs_type, proc_type;
+type proc_pressure_cpu, fs_type, proc_type;
+type proc_pressure_io, fs_type, proc_type;
+type proc_pressure_mem, fs_type, proc_type;
+type proc_random, fs_type, proc_type;
+type proc_sched, fs_type, proc_type;
+type proc_slabinfo, fs_type, proc_type;
+type proc_stat, fs_type, proc_type;
+type proc_swaps, fs_type, proc_type;
+type proc_sysrq, fs_type, proc_type;
+type proc_timer, fs_type, proc_type;
+type proc_tty_drivers, fs_type, proc_type;
+type proc_uid_cputime_showstat, fs_type, proc_type;
+type proc_uid_cputime_removeuid, fs_type, proc_type;
+type proc_uid_io_stats, fs_type, proc_type;
+type proc_uid_procstat_set, fs_type, proc_type;
+type proc_uid_time_in_state, fs_type, proc_type;
+type proc_uid_concurrent_active_time, fs_type, proc_type;
+type proc_uid_concurrent_policy_time, fs_type, proc_type;
+type proc_uid_cpupower, fs_type, proc_type;
+type proc_uptime, fs_type, proc_type;
+type proc_version, fs_type, proc_type;
+type proc_vmallocinfo, fs_type, proc_type;
+type proc_vmstat, fs_type, proc_type;
+type proc_watermark_scale_factor, fs_type, proc_type;
+type proc_zoneinfo, fs_type, proc_type;
+type proc_vendor_sched, proc_type, fs_type;
+type selinuxfs, fs_type, mlstrustedobject;
+type fusectlfs, fs_type;
+type cgroup, fs_type, mlstrustedobject;
+type cgroup_v2, fs_type;
+type sysfs, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_android_usb, fs_type, sysfs_type;
+type sysfs_uio, sysfs_type, fs_type;
+type sysfs_batteryinfo, fs_type, sysfs_type;
+type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
+
+starting_at_board_api(202504, `
+ type sysfs_cma, fs_type, sysfs_type;
+')
+
+type sysfs_devfreq_cur, fs_type, sysfs_type;
+type sysfs_devfreq_dir, fs_type, sysfs_type;
+type sysfs_devices_block, fs_type, sysfs_type;
+type sysfs_dm, fs_type, sysfs_type;
+type sysfs_dm_verity, fs_type, sysfs_type;
+type sysfs_dma_heap, fs_type, sysfs_type;
+type sysfs_dmabuf_stats, fs_type, sysfs_type;
+type sysfs_dt_firmware_android, fs_type, sysfs_type;
+type sysfs_extcon, fs_type, sysfs_type;
+type sysfs_ion, fs_type, sysfs_type;
+type sysfs_ipv4, fs_type, sysfs_type;
+type sysfs_kernel_notes, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_leds, fs_type, sysfs_type;
+type sysfs_loop, fs_type, sysfs_type;
+type sysfs_gpu, fs_type, sysfs_type;
+type sysfs_hwrandom, fs_type, sysfs_type;
+type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_wake_lock, fs_type, sysfs_type;
+type sysfs_net, fs_type, sysfs_type;
+type sysfs_power, fs_type, sysfs_type;
+type sysfs_rtc, fs_type, sysfs_type;
+
+starting_at_board_api(202504, `
+ type sysfs_mem_sleep, fs_type, sysfs_type;
+')
+
+type sysfs_suspend_stats, fs_type, sysfs_type;
+type sysfs_switch, fs_type, sysfs_type;
+type sysfs_sync_on_suspend, fs_type, sysfs_type;
+type sysfs_transparent_hugepage, fs_type, sysfs_type;
+type sysfs_lru_gen_enabled, fs_type, sysfs_type;
+type sysfs_usb, fs_type, sysfs_type;
+type sysfs_wakeup, fs_type, sysfs_type;
+type sysfs_wakeup_reasons, fs_type, sysfs_type;
+type sysfs_fs_ext4_features, sysfs_type, fs_type;
+type sysfs_fs_f2fs, sysfs_type, fs_type;
+type sysfs_fs_fuse_bpf, sysfs_type, fs_type;
+type sysfs_fs_fuse_features, sysfs_type, fs_type;
+type sysfs_fs_incfs_features, sysfs_type, fs_type;
+type sysfs_fs_incfs_metrics, sysfs_type, fs_type;
+type sysfs_vendor_sched, sysfs_type, fs_type;
+userdebug_or_eng(`
+ typeattribute sysfs_vendor_sched mlstrustedobject;
+')
+type fs_bpf, fs_type, bpffs_type;
+# TODO: S+ fs_bpf_tethering (used by mainline) should be private
+type fs_bpf_tethering, fs_type, bpffs_type;
+type fs_bpf_vendor, fs_type, bpffs_type;
+
+type configfs, fs_type;
+# /sys/devices/cs_etm
+type sysfs_devices_cs_etm, fs_type, sysfs_type;
+# /sys/devices/system/cpu
+type sysfs_devices_system_cpu, fs_type, sysfs_type;
+# /sys/module/lowmemorykiller
+type sysfs_lowmemorykiller, fs_type, sysfs_type;
+# /sys/module/wlan/parameters/fwpath
+type sysfs_wlan_fwpath, fs_type, sysfs_type;
+type sysfs_vibrator, fs_type, sysfs_type;
+type sysfs_uhid, fs_type, sysfs_type;
+type sysfs_thermal, sysfs_type, fs_type;
+
+type sysfs_zram, fs_type, sysfs_type;
+type sysfs_zram_uevent, fs_type, sysfs_type;
+type inotify, fs_type, mlstrustedobject;
+type devpts, fs_type, mlstrustedobject;
+type tmpfs, fs_type;
+type shm, fs_type;
+type mqueue, fs_type;
+type fuse, fusefs_type, fs_type, mlstrustedobject;
+type fuseblk, sdcard_type, fusefs_type, fs_type, mlstrustedobject;
+type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
+type vfat, sdcard_type, fs_type, mlstrustedobject;
+type exfat, sdcard_type, fs_type, mlstrustedobject;
+type debugfs, fs_type, debugfs_type;
+type debugfs_kprobes, fs_type, debugfs_type;
+type debugfs_mmc, fs_type, debugfs_type;
+type debugfs_mm_events_tracing, fs_type, debugfs_type, tracefs_type;
+type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing_debug, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
+type debugfs_tracing_instances, fs_type, debugfs_type, tracefs_type;
+type debugfs_tracing_printk_formats, fs_type, debugfs_type, tracefs_type;
+type debugfs_wakeup_sources, fs_type, debugfs_type;
+type debugfs_wifi_tracing, fs_type, debugfs_type, tracefs_type;
+type securityfs, fs_type;
+
+type pstorefs, fs_type;
+type functionfs, fs_type, mlstrustedobject;
+type oemfs, fs_type, contextmount_type;
+type usbfs, fs_type;
+type binfmt_miscfs, fs_type;
+type app_fusefs, fs_type, fusefs_type, contextmount_type;
+
+# File types
+type unlabeled, file_type;
+
+# Default type for anything under /system.
+type system_file, system_file_type, file_type;
+# Default type for /system/asan.options
+type system_asan_options_file, system_file_type, file_type;
+# Type for /system/etc/event-log-tags (liblog implementation detail)
+type system_event_log_tags_file, system_file_type, file_type;
+# Default type for anything under /system/lib[64].
+type system_lib_file, system_file_type, file_type;
+# system libraries that are available only to bootstrap processes
+type system_bootstrap_lib_file, system_file_type, file_type;
+# Default type for the group file /system/etc/group.
+type system_group_file, system_file_type, file_type;
+# Default type for linker executable /system/bin/linker[64].
+type system_linker_exec, system_file_type, file_type;
+# Default type for linker config /system/etc/ld.config.*.
+type system_linker_config_file, system_file_type, file_type;
+# Default type for the passwd file /system/etc/passwd.
+type system_passwd_file, system_file_type, file_type;
+# Default type for linker config /system/etc/seccomp_policy/*.
+type system_seccomp_policy_file, system_file_type, file_type;
+# Default type for cacerts in /system/etc/security/cacerts/*.
+type system_security_cacerts_file, system_file_type, file_type;
+# Default type for /system/bin/tcpdump.
+type tcpdump_exec, system_file_type, exec_type, file_type;
+# Default type for zoneinfo files in /system/usr/share/zoneinfo/*.
+type system_zoneinfo_file, system_file_type, file_type;
+# Cgroups description file under /system/etc/cgroups.json or
+# API file under /system/etc/task_profiles/cgroups_*.json
+type cgroup_desc_file, system_file_type, file_type;
+until_board_api(202504, `
+ # Cgroups description file under /system/etc/task_profiles/cgroups_*.json
+ type cgroup_desc_api_file, system_file_type, file_type;
+')
+# Vendor cgroups description file under /vendor/etc/cgroups.json
+type vendor_cgroup_desc_file, vendor_file_type, file_type;
+# Task profiles file under /system/etc/task_profiles.json or
+# API file under /system/etc/task_profiles/task_profiles_*.json
+type task_profiles_file, system_file_type, file_type;
+until_board_api(202504, `
+ # Task profiles file under /system/etc/task_profiles/task_profiles_*.json
+ type task_profiles_api_file, system_file_type, file_type;
+')
+# Vendor task profiles file under /vendor/etc/task_profiles.json
+type vendor_task_profiles_file, vendor_file_type, file_type;
+# Type for /system/apex/com.android.art
+type art_apex_dir, system_file_type, file_type;
+# /linkerconfig(/.*)?
+type linkerconfig_file, file_type;
+# Control files under /data/incremental
+type incremental_control_file, file_type, data_file_type, core_data_file_type;
+# /oem/media/bootanimation.zip|shutdownanimation.zip|userspace-reboot.zip
+type bootanim_oem_file, file_type, system_file_type;
+
+# Default type for directories search for
+# HAL implementations
+type vendor_hal_file, vendor_file_type, file_type;
+# Default type for under /vendor or /system/vendor
+type vendor_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/app
+type vendor_app_file, vendor_file_type, file_type;
+# Default type for everything under /vendor/etc/
+type vendor_configs_file, vendor_file_type, file_type;
+# Default type for all *same process* HALs and their lib/bin dependencies.
+# e.g. libEGL_xxx.so, android.hardware.graphics.mapper@2.0-impl.so
+type same_process_hal_file, vendor_file_type, file_type;
+# Default type for vndk-sp libs. /vendor/lib/vndk-sp
+type vndk_sp_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/framework
+type vendor_framework_file, vendor_file_type, file_type;
+# Default type for everything in /vendor/overlay
+type vendor_overlay_file, vendor_file_type, file_type;
+# Type for all vendor public libraries. These libs should only be exposed to
+# apps. ABI stability of these libs is vendor's responsibility.
+type vendor_public_lib_file, vendor_file_type, file_type;
+# Type for all vendor public libraries for system. These libs should only be exposed to
+# system. ABI stability of these libs is vendor's responsibility.
+type vendor_public_framework_file, vendor_file_type, file_type;
+# Type for all microdroid related files in the vendor partition.
+# Files having this type should be read-only.
+type vendor_microdroid_file, vendor_file_type, file_type;
+
+starting_at_board_api(202504, `
+ # boot otas for 16KB developer option
+ type vendor_boot_ota_file, vendor_file_type, file_type;
+')
+
+# Input configuration
+type vendor_keylayout_file, vendor_file_type, file_type;
+type vendor_keychars_file, vendor_file_type, file_type;
+type vendor_idc_file, vendor_file_type, file_type;
+
+# Type for vendor uuid mapping config file
+type vendor_uuid_mapping_config_file, vendor_file_type, file_type;
+
+# SoC-specific virtual machine disk files
+type vendor_vm_file, vendor_file_type, file_type;
+# SoC-specific virtual machine disk files that are mutable
+type vendor_vm_data_file, vendor_file_type, file_type;
+
+# /metadata partition itself
+type metadata_file, file_type;
+# Vold files within /metadata
+type vold_metadata_file, file_type;
+# GSI files within /metadata
+type gsi_metadata_file, gsi_metadata_file_type, file_type;
+# DSU (GSI) files within /metadata that are globally readable.
+type gsi_public_metadata_file, gsi_metadata_file_type, file_type;
+# system_server shares Weaver slot information in /metadata
+type password_slot_metadata_file, file_type;
+# APEX files within /metadata
+type apex_metadata_file, file_type;
+# libsnapshot files within /metadata
+type ota_metadata_file, file_type;
+# property files within /metadata/bootstat
+type metadata_bootstat_file, file_type;
+# userspace reboot files within /metadata/userspacereboot
+type userspace_reboot_metadata_file, file_type;
+# Staged install files within /metadata/staged-install
+type staged_install_file, file_type;
+# Metadata information within /metadata/watchdog
+type watchdog_metadata_file, file_type;
+# Repair mode files within /metadata/repair-mode
+type repair_mode_metadata_file, file_type;
+# Aconfig storage file
+type aconfig_storage_metadata_file, file_type;
+# Aconfig storage flag value persistent copy
+type aconfig_storage_flags_metadata_file, file_type;
+
+# Type for /dev/cpu_variant:.*.
+type dev_cpu_variant, file_type;
+# Speedup access for trusted applications to the runtime event tags
+type runtime_event_log_tags_file, file_type;
+# Type for /system/bin/logcat.
+type logcat_exec, system_file_type, exec_type, file_type;
+# Speedup access to cgroup map file
+type cgroup_rc_file, file_type;
+# /cores for coredumps on userdebug / eng builds
+type coredump_file, file_type;
+# Type of /data itself
+type system_data_root_file, file_type, data_file_type, core_data_file_type;
+# Default type for anything under /data.
+type system_data_file, file_type, data_file_type, core_data_file_type;
+# Default type for directories containing per-user encrypted directories, such
+# as /data/user and /data/user_de.
+type system_userdir_file, file_type, data_file_type, core_data_file_type;
+# Type for /data/system/packages.list.
+# TODO(b/129332765): Narrow down permissions to this.
+# Find out users of system_data_file that should be granted only this.
+type packages_list_file, file_type, data_file_type, core_data_file_type;
+type game_mode_intervention_list_file, file_type, data_file_type, core_data_file_type;
+# Default type for anything inside /data/vendor_{ce,de}.
+type vendor_data_file, file_type, data_file_type;
+# Type for /data/vendor_{ce,de} themselves. This has core_data_file_type
+# because these directories themselves are platform-managed; only the files
+# *inside* them are vendor data. (Somewhat similar to system_data_root_file.)
+type vendor_userdir_file, file_type, data_file_type, core_data_file_type;
+# Unencrypted data
+type unencrypted_data_file, file_type, data_file_type, core_data_file_type;
+# installd-create files in /data/misc/installd such as layout_version
+type install_data_file, file_type, data_file_type, core_data_file_type;
+# /data/drm - DRM plugin data
+type drm_data_file, file_type, data_file_type, core_data_file_type;
+# /data/adb - adb debugging files
+type adb_data_file, file_type, data_file_type, core_data_file_type;
+# /data/anr - ANR traces
+type anr_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/tombstones - core dumps
+type tombstone_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/vendor/tombstones/wifi - vendor wifi dumps
+type tombstone_wifi_data_file, file_type, data_file_type;
+# /data/apex - APEX data files
+type apex_data_file, file_type, data_file_type, core_data_file_type;
+# /data/app - user-installed apps
+type apk_data_file, file_type, data_file_type, core_data_file_type;
+type apk_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/app-private - forward-locked apps
+type apk_private_data_file, file_type, data_file_type, core_data_file_type;
+type apk_private_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/dalvik-cache
+type dalvikcache_data_file, file_type, data_file_type, core_data_file_type;
+# /data/ota
+type ota_data_file, file_type, data_file_type, core_data_file_type;
+# /data/ota_package
+type ota_package_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/misc/profiles
+type user_profile_root_file, file_type, data_file_type, core_data_file_type;
+type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/misc/profman
+type profman_dump_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/prereboot
+type prereboot_data_file, file_type, data_file_type, core_data_file_type;
+# /data/resource-cache
+type resourcecache_data_file, file_type, data_file_type, core_data_file_type;
+# /data/local - writable by shell
+type shell_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+# /data/property
+type property_data_file, file_type, data_file_type, core_data_file_type;
+# /data/bootchart
+type bootchart_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system/dropbox
+type dropbox_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system/heapdump
+type heapdump_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/nativetest
+type nativetest_data_file, file_type, data_file_type, core_data_file_type;
+# /data/local/tests
+type shell_test_data_file, file_type, data_file_type, core_data_file_type;
+# /data/system_de/0/ringtones
+type ringtone_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# /data/preloads
+type preloads_data_file, file_type, data_file_type, core_data_file_type;
+# /data/preloads/media
+type preloads_media_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/dhcp and /data/misc/dhcp-6.8.2
+type dhcp_data_file, file_type, data_file_type, core_data_file_type;
+# /data/server_configurable_flags
+type server_configurable_flags_data_file, file_type, data_file_type, core_data_file_type;
+# /data/app-staging
+type staging_data_file, file_type, data_file_type, core_data_file_type;
+# /vendor/apex
+type vendor_apex_file, vendor_file_type, file_type;
+# apex_manifest.pb in vendor apex
+type vendor_apex_metadata_file, vendor_file_type, file_type;
+# /data/system/shutdown-checkpoints
+type shutdown_checkpoints_system_data_file, file_type, data_file_type, core_data_file_type;
+
+# Mount locations managed by vold
+type mnt_media_rw_file, file_type;
+type mnt_user_file, file_type;
+type mnt_pass_through_file, file_type;
+type mnt_expand_file, file_type;
+type mnt_sdcard_file, file_type;
+type storage_file, file_type;
+
+# Label for storage dirs which are just mount stubs
+type mnt_media_rw_stub_file, file_type;
+type storage_stub_file, file_type;
+
+# Mount location for read-write vendor partitions.
+type mnt_vendor_file, file_type;
+
+# Mount location for read-write product partitions.
+type mnt_product_file, file_type;
+
+# Mount point used for APEX images
+type apex_mnt_dir, file_type;
+
+# /apex/apex-info-list.xml created by apexd
+type apex_info_file, file_type;
+
+# /postinstall: Mount point used by update_engine to run postinstall.
+type postinstall_mnt_dir, file_type;
+# Files inside the /postinstall mountpoint are all labeled as postinstall_file.
+type postinstall_file, file_type;
+# /postinstall/apex: Mount point used for APEX images within /postinstall.
+type postinstall_apex_mnt_dir, file_type;
+
+# /data_mirror: Contains mirror directory for storing all apps data.
+type mirror_data_file, file_type, core_data_file_type;
+
+# /data/misc subdirectories
+type adb_keys_file, file_type, data_file_type, core_data_file_type;
+type apex_system_server_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+type apex_module_data_file, file_type, data_file_type, core_data_file_type;
+type apex_ota_reserved_file, file_type, data_file_type, core_data_file_type;
+type apex_rollback_data_file, file_type, data_file_type, core_data_file_type;
+type appcompat_data_file, file_type, data_file_type, core_data_file_type;
+type audio_data_file, file_type, data_file_type, core_data_file_type;
+type audioserver_data_file, file_type, data_file_type, core_data_file_type;
+type bluetooth_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+type bluetooth_logs_data_file, file_type, data_file_type, core_data_file_type;
+type bootstat_data_file, file_type, data_file_type, core_data_file_type;
+type boottrace_data_file, file_type, data_file_type, core_data_file_type;
+type camera_data_file, file_type, data_file_type, core_data_file_type;
+type credstore_data_file, file_type, data_file_type, core_data_file_type;
+type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
+type incident_data_file, file_type, data_file_type, core_data_file_type;
+type keychain_data_file, file_type, data_file_type, core_data_file_type;
+type keystore_data_file, file_type, data_file_type, core_data_file_type;
+type media_data_file, file_type, data_file_type, core_data_file_type;
+type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type media_userdir_file, file_type, data_file_type, core_data_file_type;
+type misc_user_data_file, file_type, data_file_type, core_data_file_type;
+type net_data_file, file_type, data_file_type, core_data_file_type;
+type network_watchlist_data_file, file_type, data_file_type, core_data_file_type;
+type nfc_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+type nfc_logs_data_file, file_type, data_file_type, core_data_file_type;
+type radio_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+type recovery_data_file, file_type, data_file_type, core_data_file_type;
+type shared_relro_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type snapshotctl_log_data_file, file_type, data_file_type, core_data_file_type;
+type stats_config_data_file, file_type, data_file_type, core_data_file_type;
+type stats_data_file, file_type, data_file_type, core_data_file_type;
+type systemkeys_data_file, file_type, data_file_type, core_data_file_type;
+type textclassifier_data_file, file_type, data_file_type, core_data_file_type;
+type trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type vpn_data_file, file_type, data_file_type, core_data_file_type;
+type wifi_data_file, file_type, data_file_type, core_data_file_type;
+type vold_data_file, file_type, data_file_type, core_data_file_type;
+type tee_data_file, file_type, data_file_type;
+type update_engine_data_file, file_type, data_file_type, core_data_file_type;
+type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
+type snapuserd_log_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/trace for method traces on userdebug / eng builds
+type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+type gsi_data_file, file_type, data_file_type, core_data_file_type;
+type radio_core_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/data subdirectories - app sandboxes
+type app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# /data/data subdirectories - priv-app sandboxes
+type privapp_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
+# /data/data subdirectory for system UID apps.
+type system_app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
+# Compatibility with type name used in Android 4.3 and 4.4.
+# Default type for anything under /cache
+type cache_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for /cache/overlay /mnt/scratch/overlay
+type overlayfs_file, file_type, data_file_type, core_data_file_type;
+# Type for /cache/backup_stage/* (fd interchange with apps)
+type cache_backup_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# type for anything under /cache/backup (local transport storage)
+type cache_private_backup_file, file_type, data_file_type, core_data_file_type;
+# Type for anything under /cache/recovery
+type cache_recovery_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Default type for anything under /efs
+type efs_file, file_type;
+# Type for wallpaper file.
+type wallpaper_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for shortcut manager icon file.
+type shortcut_manager_icons, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for user icon file.
+type icon_file, file_type, data_file_type, core_data_file_type;
+# /mnt/asec
+type asec_apk_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Elements of asec files (/mnt/asec) that are world readable
+type asec_public_file, file_type, data_file_type, core_data_file_type;
+# /data/app-asec
+type asec_image_file, file_type, data_file_type, core_data_file_type;
+# /data/backup and /data/secure/backup
+type backup_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# All devices have bluetooth efs files. But they
+# vary per device, so this type is used in per
+# device policy
+type bluetooth_efs_file, file_type;
+# Type for fingerprint template file
+type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
+# Type for _new_ fingerprint template file
+type fingerprint_vendor_data_file, file_type, data_file_type;
+# Type for appfuse file.
+type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
+# Type for face template file
+type face_vendor_data_file, file_type, data_file_type;
+# Type for iris template file
+type iris_vendor_data_file, file_type, data_file_type;
+
+# Socket types
+type adbd_socket, file_type, coredomain_socket;
+type bluetooth_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
+type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject;
+type dumpstate_socket, file_type, coredomain_socket;
+type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject;
+type lmkd_socket, file_type, coredomain_socket;
+type logd_socket, file_type, coredomain_socket, mlstrustedobject;
+type logdr_socket, file_type, coredomain_socket, mlstrustedobject;
+type logdw_socket, file_type, coredomain_socket, mlstrustedobject;
+type mdns_socket, file_type, coredomain_socket;
+type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject;
+type misc_logd_file, coredomain_socket, file_type, data_file_type, core_data_file_type;
+type mtpd_socket, file_type, coredomain_socket;
+type ot_daemon_socket, file_type, coredomain_socket;
+type property_socket, file_type, coredomain_socket, mlstrustedobject;
+type racoon_socket, file_type, coredomain_socket;
+type recovery_socket, file_type, coredomain_socket;
+type rild_socket, file_type;
+type rild_debug_socket, file_type;
+type snapuserd_socket, file_type, coredomain_socket;
+type snapuserd_proxy_socket, file_type, coredomain_socket;
+type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
+type system_wpa_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
+type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
+type system_unsolzygote_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
+type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
+type tombstoned_java_trace_socket, file_type, mlstrustedobject;
+type tombstoned_intercept_socket, file_type, coredomain_socket;
+type traced_consumer_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_perf_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject;
+type uncrypt_socket, file_type, coredomain_socket;
+type wpa_socket, file_type, data_file_type, core_data_file_type;
+type zygote_socket, file_type, coredomain_socket;
+type heapprofd_socket, file_type, coredomain_socket, mlstrustedobject;
+# UART (for GPS) control proc file
+type gps_control, file_type;
+
+# PDX endpoint types
+type pdx_display_dir, pdx_endpoint_dir_type, file_type;
+type pdx_performance_dir, pdx_endpoint_dir_type, file_type;
+type pdx_bufferhub_dir, pdx_endpoint_dir_type, file_type;
+
+pdx_service_socket_types(display_client, pdx_display_dir)
+pdx_service_socket_types(display_manager, pdx_display_dir)
+pdx_service_socket_types(display_screenshot, pdx_display_dir)
+pdx_service_socket_types(display_vsync, pdx_display_dir)
+pdx_service_socket_types(performance_client, pdx_performance_dir)
+pdx_service_socket_types(bufferhub_client, pdx_bufferhub_dir)
+
+# file_contexts files
+type file_contexts_file, system_file_type, file_type;
+
+# mac_permissions file
+type mac_perms_file, system_file_type, file_type;
+
+# property_contexts file
+type property_contexts_file, system_file_type, file_type;
+
+# seapp_contexts file
+type seapp_contexts_file, system_file_type, file_type;
+
+# sepolicy files binary and others
+type sepolicy_file, system_file_type, file_type;
+
+# service_contexts file
+type service_contexts_file, system_file_type, file_type;
+
+# keystore2_key_contexts_file
+type keystore2_key_contexts_file, system_file_type, file_type;
+
+# vendor service_contexts file
+type vendor_service_contexts_file, vendor_file_type, file_type;
+
+# hwservice_contexts file
+type hwservice_contexts_file, system_file_type, file_type;
+
+# vndservice_contexts file
+type vndservice_contexts_file, file_type;
+
+# /sys/kernel/tracing/instances/bootreceiver for monitoring kernel memory corruptions.
+type debugfs_bootreceiver_tracing, fs_type, debugfs_type, tracefs_type;
+
+# kernel modules
+type vendor_kernel_modules, vendor_file_type, file_type;
+
+# system_dlkm
+type system_dlkm_file, system_dlkm_file_type, file_type;
+
+# asanwrapper (run a sanitized app_process, to be used with wrap properties)
+with_asan(`type asanwrapper_exec, exec_type, file_type;')
+
+# Deprecated in SDK version 28
+type audiohal_data_file, file_type, data_file_type, core_data_file_type;
+
+starting_at_board_api(202504, `
+ type sysfs_udc, fs_type, sysfs_type;
+ type tee_service_contexts_file, system_file_type, file_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/fingerprintd.te b/prebuilts/api/202504/public/fingerprintd.te
new file mode 100644
index 0000000..b40ff3b
--- /dev/null
+++ b/prebuilts/api/202504/public/fingerprintd.te
@@ -0,0 +1,6 @@
+type fingerprintd, domain;
+type fingerprintd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/flags_health_check.te b/prebuilts/api/202504/public/flags_health_check.te
new file mode 100644
index 0000000..fbd386c
--- /dev/null
+++ b/prebuilts/api/202504/public/flags_health_check.te
@@ -0,0 +1,7 @@
+# The flags_health_check command run by init.
+type flags_health_check, domain, coredomain;
+type flags_health_check_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/fsck.te b/prebuilts/api/202504/public/fsck.te
new file mode 100644
index 0000000..cdf7c79
--- /dev/null
+++ b/prebuilts/api/202504/public/fsck.te
@@ -0,0 +1,7 @@
+# Any fsck program run by init
+type fsck, domain;
+type fsck_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/fsck_untrusted.te b/prebuilts/api/202504/public/fsck_untrusted.te
new file mode 100644
index 0000000..bb58f4d
--- /dev/null
+++ b/prebuilts/api/202504/public/fsck_untrusted.te
@@ -0,0 +1,6 @@
+# Any fsck program run on untrusted block devices
+type fsck_untrusted, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/gatekeeperd.te b/prebuilts/api/202504/public/gatekeeperd.te
new file mode 100644
index 0000000..6120d60
--- /dev/null
+++ b/prebuilts/api/202504/public/gatekeeperd.te
@@ -0,0 +1,6 @@
+type gatekeeperd, domain;
+type gatekeeperd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/global_macros b/prebuilts/api/202504/public/global_macros
new file mode 100644
index 0000000..2c87fde
--- /dev/null
+++ b/prebuilts/api/202504/public/global_macros
@@ -0,0 +1,51 @@
+#####################################
+# Common groupings of object classes.
+#
+define(`capability_class_set', `{ capability capability2 cap_userns cap2_userns }')
+define(`global_capability_class_set', `{ capability cap_userns }')
+define(`global_capability2_class_set', `{ capability2 cap2_userns }')
+
+define(`devfile_class_set', `{ chr_file blk_file }')
+define(`notdevfile_class_set', `{ file lnk_file sock_file fifo_file }')
+define(`file_class_set', `{ devfile_class_set notdevfile_class_set }')
+define(`dir_file_class_set', `{ dir file_class_set }')
+
+define(`socket_class_set', `{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket }')
+define(`dgram_socket_class_set', `{ udp_socket unix_dgram_socket }')
+define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket sctp_socket }')
+define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket sctp_socket }')
+define(`network_socket_class_set', `{ icmp_socket rawip_socket tcp_socket udp_socket }')
+
+define(`ipc_class_set', `{ sem msgq shm ipc }')
+
+#####################################
+# Common groupings of permissions.
+#
+define(`x_file_perms', `{ getattr execute execute_no_trans map }')
+define(`r_file_perms', `{ getattr open read ioctl lock map watch watch_reads }')
+define(`w_file_perms', `{ open append write lock map }')
+define(`rx_file_perms', `{ r_file_perms x_file_perms }')
+define(`ra_file_perms', `{ r_file_perms append }')
+define(`rw_file_perms', `{ r_file_perms w_file_perms }')
+define(`rwx_file_perms', `{ rw_file_perms x_file_perms }')
+define(`create_file_perms', `{ create rename setattr unlink rw_file_perms }')
+
+define(`r_dir_perms', `{ open getattr read search ioctl lock watch watch_reads }')
+define(`w_dir_perms', `{ open search write add_name remove_name lock }')
+define(`ra_dir_perms', `{ r_dir_perms add_name write }')
+define(`rw_dir_perms', `{ r_dir_perms w_dir_perms }')
+define(`create_dir_perms', `{ create reparent rename rmdir setattr rw_dir_perms }')
+
+define(`r_ipc_perms', `{ getattr read associate unix_read }')
+define(`w_ipc_perms', `{ write unix_write }')
+define(`rw_ipc_perms', `{ r_ipc_perms w_ipc_perms }')
+define(`create_ipc_perms', `{ create setattr destroy rw_ipc_perms }')
+
+#####################################
+# Common socket permission sets.
+define(`rw_socket_perms', `{ ioctl read getattr write setattr lock append bind connect getopt setopt shutdown map }')
+define(`rw_socket_perms_no_ioctl', `{ read getattr write setattr lock append bind connect getopt setopt shutdown map }')
+define(`create_socket_perms', `{ create rw_socket_perms }')
+define(`create_socket_perms_no_ioctl', `{ create rw_socket_perms_no_ioctl }')
+define(`rw_stream_socket_perms', `{ rw_socket_perms listen accept }')
+define(`create_stream_socket_perms', `{ create rw_stream_socket_perms }')
diff --git a/prebuilts/api/202504/public/gmscore_app.te b/prebuilts/api/202504/public/gmscore_app.te
new file mode 100644
index 0000000..ded8655
--- /dev/null
+++ b/prebuilts/api/202504/public/gmscore_app.te
@@ -0,0 +1,9 @@
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+
+type gmscore_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/gpuservice.te b/prebuilts/api/202504/public/gpuservice.te
new file mode 100644
index 0000000..75f1c34
--- /dev/null
+++ b/prebuilts/api/202504/public/gpuservice.te
@@ -0,0 +1,6 @@
+# gpuservice - server for gpu stats and other gpu related services
+type gpuservice, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/hal_graphics_composer.te b/prebuilts/api/202504/public/hal_graphics_composer.te
new file mode 100644
index 0000000..f7ccd65
--- /dev/null
+++ b/prebuilts/api/202504/public/hal_graphics_composer.te
@@ -0,0 +1,7 @@
+type hal_graphics_composer_server_tmpfs, file_type;
+attribute hal_graphics_composer_client_tmpfs;
+expandattribute hal_graphics_composer_client_tmpfs true;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/healthd.te b/prebuilts/api/202504/public/healthd.te
new file mode 100644
index 0000000..69c03c6
--- /dev/null
+++ b/prebuilts/api/202504/public/healthd.te
@@ -0,0 +1,7 @@
+# healthd - battery/charger monitoring service daemon
+# healthd is removed. The type is kept for backwards compatibility.
+type healthd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/heapprofd.te b/prebuilts/api/202504/public/heapprofd.te
new file mode 100644
index 0000000..95fadaa
--- /dev/null
+++ b/prebuilts/api/202504/public/heapprofd.te
@@ -0,0 +1,5 @@
+type heapprofd, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/hwservice.te b/prebuilts/api/202504/public/hwservice.te
new file mode 100644
index 0000000..d6f2de4
--- /dev/null
+++ b/prebuilts/api/202504/public/hwservice.te
@@ -0,0 +1,96 @@
+# hwservice types. By default most of the HALs are protected_hwservice, which means
+# access from untrusted apps is prohibited.
+type default_android_hwservice, hwservice_manager_type, protected_hwservice;
+type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_stats_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_automotive_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type hal_atrace_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audiocontrol_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_authsecret_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bluetooth_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bootctl_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_broadcastradio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_camera_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_bus_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_controller_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_confirmationui_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_contexthub_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_dumpstate_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_evs_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_face_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_fingerprint_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gatekeeper_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gnss_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_graphics_composer_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_storage_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_input_classifier_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_ir_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_keymaster_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_light_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_lowpan_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_memtrack_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_nfc_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_oemlock_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_stats_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_secure_element_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_sensors_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_telephony_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tetheroffload_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_thermal_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_cec_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_input_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_tuner_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_gadget_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vehicle_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vibrator_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vr_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_weaver_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hostapd_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_supplicant_hwservice, hwservice_manager_type, protected_hwservice;
+type system_net_netd_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_suspend_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_wifi_keystore_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+
+# Following is the hwservices that are explicitly not marked with protected_hwservice.
+# These are directly accessible from untrusted apps.
+# - same process services: because they by definition run in the process
+# of the client and thus have the same access as the client domain in which
+# the process runs
+# - coredomain_hwservice: are considered safer than ordinary hwservices which
+# are from vendor partition
+# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been
+# designed for use by any domain.
+# - hal_graphics_allocator_hwservice: because these operations are also offered
+# by surfaceflinger Binder service, which apps are permitted to access
+# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
+# Binder service which apps were permitted to access.
+# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
+# - hal_drm_hwservice: versions > API 29 are designed specifically with
+# untrusted app access in mind.
+type fwk_bufferhub_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hal_cas_hwservice, hwservice_manager_type;
+type hal_codec2_hwservice, hwservice_manager_type;
+type hal_configstore_ISurfaceFlingerConfigs, hwservice_manager_type;
+type hal_drm_hwservice, hwservice_manager_type;
+type hal_graphics_allocator_hwservice, hwservice_manager_type;
+type hal_graphics_mapper_hwservice, hwservice_manager_type, same_process_hwservice;
+type hal_neuralnetworks_hwservice, hwservice_manager_type;
+type hal_omx_hwservice, hwservice_manager_type;
+type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice;
+type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_base_hwservice, hwservice_manager_type;
+type hidl_manager_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_memory_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hidl_token_hwservice, hwservice_manager_type, coredomain_hwservice;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/hwservicemanager.te b/prebuilts/api/202504/public/hwservicemanager.te
new file mode 100644
index 0000000..7ed9583
--- /dev/null
+++ b/prebuilts/api/202504/public/hwservicemanager.te
@@ -0,0 +1,7 @@
+# hwservicemanager - the Binder context manager for HAL services
+type hwservicemanager, domain, mlstrustedsubject;
+type hwservicemanager_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/idmap.te b/prebuilts/api/202504/public/idmap.te
new file mode 100644
index 0000000..02ff988
--- /dev/null
+++ b/prebuilts/api/202504/public/idmap.te
@@ -0,0 +1,7 @@
+# idmap, when executed by installd
+type idmap, domain;
+type idmap_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/incident.te b/prebuilts/api/202504/public/incident.te
new file mode 100644
index 0000000..f3f8140
--- /dev/null
+++ b/prebuilts/api/202504/public/incident.te
@@ -0,0 +1,11 @@
+# The incident command is used to call into the incidentd service to
+# take an incident report (binary, shared bugreport), download incident
+# reports that have already been taken, and monitor for new ones.
+# It doesn't do anything else.
+
+# incident
+type incident, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/incident_helper.te b/prebuilts/api/202504/public/incident_helper.te
new file mode 100644
index 0000000..e8aca04
--- /dev/null
+++ b/prebuilts/api/202504/public/incident_helper.te
@@ -0,0 +1,9 @@
+# The incident_helper is called by incidentd and
+# can only read/write data from/to incidentd
+
+# incident_helper
+type incident_helper, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/incidentd.te b/prebuilts/api/202504/public/incidentd.te
new file mode 100644
index 0000000..4a7501d
--- /dev/null
+++ b/prebuilts/api/202504/public/incidentd.te
@@ -0,0 +1,6 @@
+# incidentd
+type incidentd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/init.te b/prebuilts/api/202504/public/init.te
new file mode 100644
index 0000000..a74983c
--- /dev/null
+++ b/prebuilts/api/202504/public/init.te
@@ -0,0 +1,8 @@
+# init is its own domain.
+type init, domain, mlstrustedsubject;
+type init_exec, system_file_type, exec_type, file_type;
+type init_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/inputflinger.te b/prebuilts/api/202504/public/inputflinger.te
new file mode 100644
index 0000000..2f44e56
--- /dev/null
+++ b/prebuilts/api/202504/public/inputflinger.te
@@ -0,0 +1,7 @@
+# inputflinger
+type inputflinger, domain;
+type inputflinger_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/installd.te b/prebuilts/api/202504/public/installd.te
new file mode 100644
index 0000000..53e7239
--- /dev/null
+++ b/prebuilts/api/202504/public/installd.te
@@ -0,0 +1,7 @@
+# installer daemon
+type installd, domain;
+type installd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/ioctl_defines b/prebuilts/api/202504/public/ioctl_defines
new file mode 100644
index 0000000..1dd2e3d
--- /dev/null
+++ b/prebuilts/api/202504/public/ioctl_defines
@@ -0,0 +1,2759 @@
+define(`ADD_NEW_DISK', `0x40140921')
+define(`ADV7842_CMD_RAM_TEST', `0x000056c0')
+define(`AGPIOC_ACQUIRE', `0x00004101')
+define(`AGPIOC_ALLOCATE', `0xc0084106')
+define(`AGPIOC_BIND', `0x40084108')
+define(`AGPIOC_CHIPSET_FLUSH', `0x0000410a')
+define(`AGPIOC_DEALLOCATE', `0x40044107')
+define(`AGPIOC_INFO', `0x80084100')
+define(`AGPIOC_PROTECT', `0x40084105')
+define(`AGPIOC_RELEASE', `0x00004102')
+define(`AGPIOC_RESERVE', `0x40084104')
+define(`AGPIOC_SETUP', `0x40084103')
+define(`AGPIOC_UNBIND', `0x40084109')
+define(`AMDKFD_IOC_CREATE_QUEUE', `0xc0584b02')
+define(`AMDKFD_IOC_DESTROY_QUEUE', `0xc0084b03')
+define(`AMDKFD_IOC_GET_CLOCK_COUNTERS', `0xc0284b05')
+define(`AMDKFD_IOC_GET_PROCESS_APERTURES', `0x81904b06')
+define(`AMDKFD_IOC_GET_VERSION', `0x80084b01')
+define(`AMDKFD_IOC_SET_MEMORY_POLICY', `0x40204b04')
+define(`AMDKFD_IOC_UPDATE_QUEUE', `0x40184b07')
+define(`ANDROID_ALARM_SET_RTC', `0x40106105')
+define(`ANDROID_ALARM_WAIT', `0x00006101')
+define(`APEI_ERST_CLEAR_RECORD', `0x40084501')
+define(`APEI_ERST_GET_RECORD_COUNT', `0x80044502')
+define(`APM_IOC_STANDBY', `0x00004101')
+define(`APM_IOC_SUSPEND', `0x00004102')
+define(`ASHMEM_GET_NAME', `0x81007702')
+define(`ASHMEM_GET_PIN_STATUS', `0x00007709')
+define(`ASHMEM_GET_PROT_MASK', `0x00007706')
+define(`ASHMEM_GET_SIZE', `0x00007704')
+define(`ASHMEM_PIN', `0x40087707')
+define(`ASHMEM_PURGE_ALL_CACHES', `0x0000770a')
+define(`ASHMEM_SET_NAME', `0x41007701')
+define(`ASHMEM_SET_PROT_MASK', `0x40087705')
+define(`ASHMEM_SET_SIZE', `0x40087703')
+define(`ASHMEM_UNPIN', `0x40087708')
+define(`ATM_ADDADDR', `0x40106188')
+define(`ATM_ADDLECSADDR', `0x4010618e')
+define(`ATM_ADDPARTY', `0x401061f4')
+define(`ATMARPD_CTRL', `0x000061e1')
+define(`ATMARP_ENCAP', `0x000061e5')
+define(`ATMARP_MKIP', `0x000061e2')
+define(`ATMARP_SETENTRY', `0x000061e3')
+define(`ATM_DELADDR', `0x40106189')
+define(`ATM_DELLECSADDR', `0x4010618f')
+define(`ATM_DROPPARTY', `0x400461f5')
+define(`ATM_GETADDR', `0x40106186')
+define(`ATM_GETCIRANGE', `0x4010618a')
+define(`ATM_GETESI', `0x40106185')
+define(`ATM_GETLECSADDR', `0x40106190')
+define(`ATM_GETLINKRATE', `0x40106181')
+define(`ATM_GETLOOP', `0x40106152')
+define(`ATM_GETNAMES', `0x40106183')
+define(`ATM_GETSTAT', `0x40106150')
+define(`ATM_GETSTATZ', `0x40106151')
+define(`ATM_GETTYPE', `0x40106184')
+define(`ATMLEC_CTRL', `0x000061d0')
+define(`ATMLEC_DATA', `0x000061d1')
+define(`ATMLEC_MCAST', `0x000061d2')
+define(`ATMMPC_CTRL', `0x000061d8')
+define(`ATMMPC_DATA', `0x000061d9')
+define(`ATM_NEWBACKENDIF', `0x400261f3')
+define(`ATM_QUERYLOOP', `0x40106154')
+define(`ATM_RSTADDR', `0x40106187')
+define(`ATM_SETBACKEND', `0x400261f2')
+define(`ATM_SETCIRANGE', `0x4010618b')
+define(`ATM_SETESI', `0x4010618c')
+define(`ATM_SETESIF', `0x4010618d')
+define(`ATM_SETLOOP', `0x40106153')
+define(`ATM_SETSC', `0x400461f1')
+define(`ATMSIGD_CTRL', `0x000061f0')
+define(`ATMTCP_CREATE', `0x0000618e')
+define(`ATMTCP_REMOVE', `0x0000618f')
+define(`AUDIO_BILINGUAL_CHANNEL_SELECT', `0x00006f14')
+define(`AUDIO_CHANNEL_SELECT', `0x00006f09')
+define(`AUDIO_CLEAR_BUFFER', `0x00006f0c')
+define(`AUDIO_CONTINUE', `0x00006f04')
+define(`AUDIO_GET_CAPABILITIES', `0x80046f0b')
+define(`AUDIO_GET_PTS', `0x80086f13')
+define(`AUDIO_GET_STATUS', `0x80206f0a')
+define(`AUDIO_PAUSE', `0x00006f03')
+define(`AUDIO_PLAY', `0x00006f02')
+define(`AUDIO_SELECT_SOURCE', `0x00006f05')
+define(`AUDIO_SET_ATTRIBUTES', `0x40026f11')
+define(`AUDIO_SET_AV_SYNC', `0x00006f07')
+define(`AUDIO_SET_BYPASS_MODE', `0x00006f08')
+define(`AUDIO_SET_EXT_ID', `0x00006f10')
+define(`AUDIO_SET_ID', `0x00006f0d')
+define(`AUDIO_SET_KARAOKE', `0x400c6f12')
+define(`AUDIO_SET_MIXER', `0x40086f0e')
+define(`AUDIO_SET_MUTE', `0x00006f06')
+define(`AUDIO_SET_STREAMTYPE', `0x00006f0f')
+define(`AUDIO_STOP', `0x00006f01')
+define(`AUTOFS_DEV_IOCTL_ASKUMOUNT', `0xc018937d')
+define(`AUTOFS_DEV_IOCTL_CATATONIC', `0xc0189379')
+define(`AUTOFS_DEV_IOCTL_CLOSEMOUNT', `0xc0189375')
+define(`AUTOFS_DEV_IOCTL_EXPIRE', `0xc018937c')
+define(`AUTOFS_DEV_IOCTL_FAIL', `0xc0189377')
+define(`AUTOFS_DEV_IOCTL_ISMOUNTPOINT', `0xc018937e')
+define(`AUTOFS_DEV_IOCTL_OPENMOUNT', `0xc0189374')
+define(`AUTOFS_DEV_IOCTL_PROTOSUBVER', `0xc0189373')
+define(`AUTOFS_DEV_IOCTL_PROTOVER', `0xc0189372')
+define(`AUTOFS_DEV_IOCTL_READY', `0xc0189376')
+define(`AUTOFS_DEV_IOCTL_REQUESTER', `0xc018937b')
+define(`AUTOFS_DEV_IOCTL_SETPIPEFD', `0xc0189378')
+define(`AUTOFS_DEV_IOCTL_TIMEOUT', `0xc018937a')
+define(`AUTOFS_DEV_IOCTL_VERSION', `0xc0189371')
+define(`AUTOFS_IOC_ASKUMOUNT', `0x80049370')
+define(`AUTOFS_IOC_CATATONIC', `0x00009362')
+define(`AUTOFS_IOC_EXPIRE', `0x810c9365')
+define(`AUTOFS_IOC_EXPIRE_MULTI', `0x40049366')
+define(`AUTOFS_IOC_FAIL', `0x00009361')
+define(`AUTOFS_IOC_PROTOSUBVER', `0x80049367')
+define(`AUTOFS_IOC_PROTOVER', `0x80049363')
+define(`AUTOFS_IOC_READY', `0x00009360')
+define(`AUTOFS_IOC_SETTIMEOUT', `0xc0089364')
+define(`AUTOFS_IOC_SETTIMEOUT32', `0xc0049364')
+define(`BC_ACQUIRE', `0x40046305')
+define(`BC_ACQUIRE_DONE', `0x40106309')
+define(`BC_ACQUIRE_RESULT', `0x40046302')
+define(`BC_ATTEMPT_ACQUIRE', `0x4008630a')
+define(`BC_CLEAR_DEATH_NOTIFICATION', `0x400c630f')
+define(`BC_DEAD_BINDER_DONE', `0x40086310')
+define(`BC_DECREFS', `0x40046307')
+define(`BC_ENTER_LOOPER', `0x0000630c')
+define(`BC_EXIT_LOOPER', `0x0000630d')
+define(`BC_FREE_BUFFER', `0x40086303')
+define(`BC_INCREFS', `0x40046304')
+define(`BC_INCREFS_DONE', `0x40106308')
+define(`BC_REGISTER_LOOPER', `0x0000630b')
+define(`BC_RELEASE', `0x40046306')
+define(`BC_REPLY', `0x40406301')
+define(`BC_REQUEST_DEATH_NOTIFICATION', `0x400c630e')
+define(`BC_TRANSACTION', `0x40406300')
+define(`BINDER_GET_EXTENDED_ERROR', `0xc0486211')
+define(`BINDER_ENABLE_ONEWAY_SPAM_DETECTION', `0x40046210')
+define(`BINDER_FREEZE', `0x400c620e')
+define(`BINDER_GET_FROZEN_INFO', `0xc00c620f')
+define(`BINDER_GET_NODE_DEBUG_INFO', `0xc018620b')
+define(`BINDER_GET_NODE_INFO_FOR_REF', `0xc018620c')
+define(`BINDER_SET_CONTEXT_MGR', `0x40046207')
+define(`BINDER_SET_CONTEXT_MGR_EXT', `0x4018620d')
+define(`BINDER_SET_IDLE_PRIORITY', `0x40046206')
+define(`BINDER_SET_IDLE_TIMEOUT', `0x40086203')
+define(`BINDER_SET_MAX_THREADS', `0x40046205')
+define(`BINDER_THREAD_EXIT', `0x40046208')
+define(`BINDER_VERSION', `0xc0046209')
+define(`BINDER_WRITE_READ', `0xc0306201')
+define(`BLKALIGNOFF', `0x0000127a')
+define(`BLKBSZGET', `0x80081270')
+define(`BLKBSZSET', `0x40081271')
+define(`BLKDISCARD', `0x00001277')
+define(`BLKDISCARDZEROES', `0x0000127c')
+define(`BLKFLSBUF', `0x00001261')
+define(`BLKFRAGET', `0x00001265')
+define(`BLKFRASET', `0x00001264')
+define(`BLKGETSIZE', `0x00001260')
+define(`BLKGETSIZE64', `0x80081272')
+define(`BLKI2OGRSTRAT', `0x80043201')
+define(`BLKI2OGWSTRAT', `0x80043202')
+define(`BLKI2OSRSTRAT', `0x40043203')
+define(`BLKI2OSWSTRAT', `0x40043204')
+define(`BLKIOMIN', `0x00001278')
+define(`BLKIOOPT', `0x00001279')
+define(`BLKPBSZGET', `0x0000127b')
+define(`BLKPG', `0x00001269')
+define(`BLKRAGET', `0x00001263')
+define(`BLKRASET', `0x00001262')
+define(`BLKREPORTZONE', `0xc0101282')
+define(`BLKRESETZONE', `0x40101283')
+define(`BLKROGET', `0x0000125e')
+define(`BLKROSET', `0x0000125d')
+define(`BLKBSZSET', `0x00001271')
+define(`BLKROTATIONAL', `0x0000127e')
+define(`BLKRRPART', `0x0000125f')
+define(`BLKSECDISCARD', `0x0000127d')
+define(`BLKSECTGET', `0x00001267')
+define(`BLKSECTSET', `0x00001266')
+define(`BLKSSZGET', `0x00001268')
+define(`BLKTRACESETUP', `0xc0481273')
+define(`BLKTRACESTART', `0x00001274')
+define(`BLKTRACESTOP', `0x00001275')
+define(`BLKTRACETEARDOWN', `0x00001276')
+define(`BLKZEROOUT', `0x0000127f')
+define(`BR2684_SETFILT', `0x401c6190')
+define(`BR_ACQUIRE', `0x80107208')
+define(`BR_ACQUIRE_RESULT', `0x80047204')
+define(`BR_ATTEMPT_ACQUIRE', `0x8018720b')
+define(`BR_CLEAR_DEATH_NOTIFICATION_DONE', `0x80087210')
+define(`BR_DEAD_BINDER', `0x8008720f')
+define(`BR_DEAD_REPLY', `0x00007205')
+define(`BR_DECREFS', `0x8010720a')
+define(`BR_ERROR', `0x80047200')
+define(`BR_FAILED_REPLY', `0x00007211')
+define(`BR_FINISHED', `0x0000720e')
+define(`BR_INCREFS', `0x80107207')
+define(`BR_NOOP', `0x0000720c')
+define(`BR_OK', `0x00007201')
+define(`BR_ONEWAY_SPAM_SUSPECT', `0x00007213')
+define(`BR_RELEASE', `0x80107209')
+define(`BR_REPLY', `0x80407203')
+define(`BR_SPAWN_LOOPER', `0x0000720d')
+define(`BR_TRANSACTION', `0x80407202')
+define(`BR_TRANSACTION_COMPLETE', `0x00007206')
+define(`BT819_FIFO_RESET_HIGH', `0x00006201')
+define(`BT819_FIFO_RESET_LOW', `0x00006200')
+define(`BTRFS_IOC_ADD_DEV', `0x5000940a')
+define(`BTRFS_IOC_BALANCE', `0x5000940c')
+define(`BTRFS_IOC_BALANCE_CTL', `0x40049421')
+define(`BTRFS_IOC_BALANCE_PROGRESS', `0x84009422')
+define(`BTRFS_IOC_BALANCE_V2', `0xc4009420')
+define(`BTRFS_IOC_CLONE', `0x40049409')
+define(`BTRFS_IOC_CLONE_RANGE', `0x4020940d')
+define(`BTRFS_IOC_DEFAULT_SUBVOL', `0x40089413')
+define(`BTRFS_IOC_DEFRAG', `0x50009402')
+define(`BTRFS_IOC_DEFRAG_RANGE', `0x40309410')
+define(`BTRFS_IOC_DEVICES_READY', `0x90009427')
+define(`BTRFS_IOC_DEV_INFO', `0xd000941e')
+define(`BTRFS_IOC_DEV_REPLACE', `0xca289435')
+define(`BTRFS_IOC_FILE_EXTENT_SAME', `0xc0189436')
+define(`BTRFS_IOC_FS_INFO', `0x8400941f')
+define(`BTRFS_IOC_GET_DEV_STATS', `0xc4089434')
+define(`BTRFS_IOC_GET_FEATURES', `0x80189439')
+define(`BTRFS_IOC_GET_FSLABEL', `0x81009431')
+define(`BTRFS_IOC_GET_SUPPORTED_FEATURES', `0x80489439')
+define(`BTRFS_IOC_INO_LOOKUP', `0xd0009412')
+define(`BTRFS_IOC_INO_PATHS', `0xc0389423')
+define(`BTRFS_IOC_LOGICAL_INO', `0xc0389424')
+define(`BTRFS_IOC_QGROUP_ASSIGN', `0x40189429')
+define(`BTRFS_IOC_QGROUP_CREATE', `0x4010942a')
+define(`BTRFS_IOC_QGROUP_LIMIT', `0x8030942b')
+define(`BTRFS_IOC_QUOTA_CTL', `0xc0109428')
+define(`BTRFS_IOC_QUOTA_RESCAN', `0x4040942c')
+define(`BTRFS_IOC_QUOTA_RESCAN_STATUS', `0x8040942d')
+define(`BTRFS_IOC_QUOTA_RESCAN_WAIT', `0x0000942e')
+define(`BTRFS_IOC_RESIZE', `0x50009403')
+define(`BTRFS_IOC_RM_DEV', `0x5000940b')
+define(`BTRFS_IOC_SCAN_DEV', `0x50009404')
+define(`BTRFS_IOC_SCRUB', `0xc400941b')
+define(`BTRFS_IOC_SCRUB_CANCEL', `0x0000941c')
+define(`BTRFS_IOC_SCRUB_PROGRESS', `0xc400941d')
+define(`BTRFS_IOC_SEND', `0x40489426')
+define(`BTRFS_IOC_SET_FEATURES', `0x40309439')
+define(`BTRFS_IOC_SET_FSLABEL', `0x41009432')
+define(`BTRFS_IOC_SET_RECEIVED_SUBVOL', `0xc0c89425')
+define(`BTRFS_IOC_SNAP_CREATE', `0x50009401')
+define(`BTRFS_IOC_SNAP_CREATE_V2', `0x50009417')
+define(`BTRFS_IOC_SNAP_DESTROY', `0x5000940f')
+define(`BTRFS_IOC_SPACE_INFO', `0xc0109414')
+define(`BTRFS_IOC_START_SYNC', `0x80089418')
+define(`BTRFS_IOC_SUBVOL_CREATE', `0x5000940e')
+define(`BTRFS_IOC_SUBVOL_CREATE_V2', `0x50009418')
+define(`BTRFS_IOC_SUBVOL_GETFLAGS', `0x80089419')
+define(`BTRFS_IOC_SUBVOL_SETFLAGS', `0x4008941a')
+define(`BTRFS_IOC_SYNC', `0x00009408')
+define(`BTRFS_IOC_TRANS_END', `0x00009407')
+define(`BTRFS_IOC_TRANS_START', `0x00009406')
+define(`BTRFS_IOC_TREE_SEARCH', `0xd0009411')
+define(`BTRFS_IOC_TREE_SEARCH_V2', `0xc0709411')
+define(`BTRFS_IOC_WAIT_SYNC', `0x40089416')
+define(`CA_GET_CAP', `0x80106f81')
+define(`CA_GET_DESCR_INFO', `0x80086f83')
+define(`CA_GET_MSG', `0x810c6f84')
+define(`CA_GET_SLOT_INFO', `0x800c6f82')
+define(`CAPI_CLR_FLAGS', `0x80044325')
+define(`CAPI_GET_ERRCODE', `0x80024321')
+define(`CAPI_GET_FLAGS', `0x80044323')
+define(`CAPI_GET_MANUFACTURER', `0xc0044306')
+define(`CAPI_GET_PROFILE', `0xc0404309')
+define(`CAPI_GET_SERIAL', `0xc0044308')
+define(`CAPI_GET_VERSION', `0xc0104307')
+define(`CAPI_INSTALLED', `0x80024322')
+define(`CAPI_MANUFACTURER_CMD', `0xc0104320')
+define(`CAPI_NCCI_GETUNIT', `0x80044327')
+define(`CAPI_NCCI_OPENCOUNT', `0x80044326')
+define(`CAPI_REGISTER', `0x400c4301')
+define(`CAPI_SET_FLAGS', `0x80044324')
+define(`CA_RESET', `0x00006f80')
+define(`CA_SEND_MSG', `0x410c6f85')
+define(`CA_SET_DESCR', `0x40106f86')
+define(`CA_SET_PID', `0x40086f87')
+define(`CCISS_BIG_PASSTHRU', `0xc0604212')
+define(`CCISS_DEREGDISK', `0x0000420c')
+define(`CCISS_GETBUSTYPES', `0x80044207')
+define(`CCISS_GETDRIVVER', `0x80044209')
+define(`CCISS_GETFIRMVER', `0x80044208')
+define(`CCISS_GETHEARTBEAT', `0x80044206')
+define(`CCISS_GETINTINFO', `0x80084202')
+define(`CCISS_GETLUNINFO', `0x800c4211')
+define(`CCISS_GETNODENAME', `0x80104204')
+define(`CCISS_GETPCIINFO', `0x80084201')
+define(`CCISS_PASSTHRU', `0xc058420b')
+define(`CCISS_REGNEWD', `0x0000420e')
+define(`CCISS_REGNEWDISK', `0x4004420d')
+define(`CCISS_RESCANDISK', `0x00004210')
+define(`CCISS_REVALIDVOLS', `0x0000420a')
+define(`CCISS_SETINTINFO', `0x40084203')
+define(`CCISS_SETNODENAME', `0x40104205')
+define(`CDROMAUDIOBUFSIZ', `0x00005382')
+define(`CDROM_CHANGER_NSLOTS', `0x00005328')
+define(`CDROM_CLEAR_OPTIONS', `0x00005321')
+define(`CDROMCLOSETRAY', `0x00005319')
+define(`CDROM_DEBUG', `0x00005330')
+define(`CDROM_DISC_STATUS', `0x00005327')
+define(`CDROM_DRIVE_STATUS', `0x00005326')
+define(`CDROMEJECT', `0x00005309')
+define(`CDROMEJECT_SW', `0x0000530f')
+define(`CDROM_GET_CAPABILITY', `0x00005331')
+define(`CDROM_GET_MCN', `0x00005311')
+define(`CDROMGETSPINDOWN', `0x0000531d')
+define(`CDROM_LAST_WRITTEN', `0x00005395')
+define(`CDROM_LOCKDOOR', `0x00005329')
+define(`CDROM_MEDIA_CHANGED', `0x00005325')
+define(`CDROMMULTISESSION', `0x00005310')
+define(`CDROM_NEXT_WRITABLE', `0x00005394')
+define(`CDROMPAUSE', `0x00005301')
+define(`CDROMPLAYBLK', `0x00005317')
+define(`CDROMPLAYMSF', `0x00005303')
+define(`CDROMPLAYTRKIND', `0x00005304')
+define(`CDROMREADALL', `0x00005318')
+define(`CDROMREADAUDIO', `0x0000530e')
+define(`CDROMREADCOOKED', `0x00005315')
+define(`CDROMREADMODE1', `0x0000530d')
+define(`CDROMREADMODE2', `0x0000530c')
+define(`CDROMREADRAW', `0x00005314')
+define(`CDROMREADTOCENTRY', `0x00005306')
+define(`CDROMREADTOCHDR', `0x00005305')
+define(`CDROMRESET', `0x00005312')
+define(`CDROMRESUME', `0x00005302')
+define(`CDROMSEEK', `0x00005316')
+define(`CDROM_SELECT_DISC', `0x00005323')
+define(`CDROM_SELECT_SPEED', `0x00005322')
+define(`CDROM_SEND_PACKET', `0x00005393')
+define(`CDROM_SET_OPTIONS', `0x00005320')
+define(`CDROMSETSPINDOWN', `0x0000531e')
+define(`CDROMSTART', `0x00005308')
+define(`CDROMSTOP', `0x00005307')
+define(`CDROMSUBCHNL', `0x0000530b')
+define(`CDROMVOLCTRL', `0x0000530a')
+define(`CDROMVOLREAD', `0x00005313')
+define(`CHIOEXCHANGE', `0x401c6302')
+define(`CHIOGELEM', `0x406c6310')
+define(`CHIOGPARAMS', `0x80146306')
+define(`CHIOGPICKER', `0x80046304')
+define(`CHIOGSTATUS', `0x40106308')
+define(`CHIOGVPARAMS', `0x80706313')
+define(`CHIOINITELEM', `0x00006311')
+define(`CHIOMOVE', `0x40146301')
+define(`CHIOPOSITION', `0x400c6303')
+define(`CHIOSPICKER', `0x40046305')
+define(`CHIOSVOLTAG', `0x40306312')
+define(`CIOC_KERNEL_VERSION', `0xc008630a')
+define(`CLEAR_ARRAY', `0x00000920')
+define(`CM_IOCARDOFF', `0x00006304')
+define(`CM_IOCGATR', `0xc0086301')
+define(`CM_IOCGSTATUS', `0x80086300')
+define(`CM_IOCSPTS', `0x40086302')
+define(`CM_IOCSRDR', `0x00006303')
+define(`CM_IOSDBGLVL', `0x400863fa')
+define(`CXL_IOCTL_GET_PROCESS_ELEMENT', `0x8004ca01')
+define(`CXL_IOCTL_START_WORK', `0x4040ca00')
+define(`DM_DEV_CREATE', `0xc138fd03')
+define(`DM_DEV_REMOVE', `0xc138fd04')
+define(`DM_DEV_RENAME', `0xc138fd05')
+define(`DM_DEV_SET_GEOMETRY', `0xc138fd0f')
+define(`DM_DEV_STATUS', `0xc138fd07')
+define(`DM_DEV_SUSPEND', `0xc138fd06')
+define(`DM_DEV_WAIT', `0xc138fd08')
+define(`DM_LIST_DEVICES', `0xc138fd02')
+define(`DM_LIST_VERSIONS', `0xc138fd0d')
+define(`DM_REMOVE_ALL', `0xc138fd01')
+define(`DM_TABLE_CLEAR', `0xc138fd0a')
+define(`DM_TABLE_DEPS', `0xc138fd0b')
+define(`DM_TABLE_LOAD', `0xc138fd09')
+define(`DM_TABLE_STATUS', `0xc138fd0c')
+define(`DM_TARGET_MSG', `0xc138fd0e')
+define(`DM_VERSION', `0xc138fd00')
+define(`DMX_ADD_PID', `0x40026f33')
+define(`DMX_GET_CAPS', `0x80086f30')
+define(`DMX_GET_PES_PIDS', `0x800a6f2f')
+define(`DMX_GET_STC', `0xc0106f32')
+define(`DMX_REMOVE_PID', `0x40026f34')
+define(`DMX_SET_BUFFER_SIZE', `0x00006f2d')
+define(`DMX_SET_FILTER', `0x403c6f2b')
+define(`DMX_SET_PES_FILTER', `0x40146f2c')
+define(`DMX_SET_SOURCE', `0x40046f31')
+define(`DMX_START', `0x00006f29')
+define(`DMX_STOP', `0x00006f2a')
+define(`DRM_IOCTL_ADD_BUFS', `0xc0206416')
+define(`DRM_IOCTL_ADD_CTX', `0xc0086420')
+define(`DRM_IOCTL_ADD_DRAW', `0xc0046427')
+define(`DRM_IOCTL_ADD_MAP', `0xc0286415')
+define(`DRM_IOCTL_AGP_ACQUIRE', `0x00006430')
+define(`DRM_IOCTL_AGP_ALLOC', `0xc0206434')
+define(`DRM_IOCTL_AGP_BIND', `0x40106436')
+define(`DRM_IOCTL_AGP_ENABLE', `0x40086432')
+define(`DRM_IOCTL_AGP_FREE', `0x40206435')
+define(`DRM_IOCTL_AGP_INFO', `0x80386433')
+define(`DRM_IOCTL_AGP_RELEASE', `0x00006431')
+define(`DRM_IOCTL_AGP_UNBIND', `0x40106437')
+define(`DRM_IOCTL_AUTH_MAGIC', `0x40046411')
+define(`DRM_IOCTL_BLOCK', `0xc0046412')
+define(`DRM_IOCTL_CONTROL', `0x40086414')
+define(`DRM_IOCTL_DMA', `0xc0406429')
+define(`DRM_IOCTL_DROP_MASTER', `0x0000641f')
+define(`DRM_IOCTL_EXYNOS_G2D_EXEC', `0xc0086462')
+define(`DRM_IOCTL_EXYNOS_G2D_GET_VER', `0xc0086460')
+define(`DRM_IOCTL_EXYNOS_G2D_SET_CMDLIST', `0xc0286461')
+define(`DRM_IOCTL_EXYNOS_GEM_CREATE', `0xc0106440')
+define(`DRM_IOCTL_EXYNOS_GEM_GET', `0xc0106444')
+define(`DRM_IOCTL_EXYNOS_IPP_CMD_CTRL', `0xc0086473')
+define(`DRM_IOCTL_EXYNOS_IPP_GET_PROPERTY', `0xc0506470')
+define(`DRM_IOCTL_EXYNOS_IPP_QUEUE_BUF', `0xc0286472')
+define(`DRM_IOCTL_EXYNOS_IPP_SET_PROPERTY', `0xc0606471')
+define(`DRM_IOCTL_EXYNOS_VIDI_CONNECTION', `0xc0106447')
+define(`DRM_IOCTL_FINISH', `0x4008642c')
+define(`DRM_IOCTL_FREE_BUFS', `0x4010641a')
+define(`DRM_IOCTL_GEM_CLOSE', `0x40086409')
+define(`DRM_IOCTL_GEM_FLINK', `0xc008640a')
+define(`DRM_IOCTL_GEM_OPEN', `0xc010640b')
+define(`DRM_IOCTL_GET_CAP', `0xc010640c')
+define(`DRM_IOCTL_GET_CLIENT', `0xc0286405')
+define(`DRM_IOCTL_GET_CTX', `0xc0086423')
+define(`DRM_IOCTL_GET_MAGIC', `0x80046402')
+define(`DRM_IOCTL_GET_MAP', `0xc0286404')
+define(`DRM_IOCTL_GET_SAREA_CTX', `0xc010641d')
+define(`DRM_IOCTL_GET_STATS', `0x80f86406')
+define(`DRM_IOCTL_GET_UNIQUE', `0xc0106401')
+define(`DRM_IOCTL_I810_CLEAR', `0x400c6442')
+define(`DRM_IOCTL_I810_COPY', `0x40106447')
+define(`DRM_IOCTL_I810_DOCOPY', `0x00006448')
+define(`DRM_IOCTL_I810_FLIP', `0x0000644e')
+define(`DRM_IOCTL_I810_FLUSH', `0x00006443')
+define(`DRM_IOCTL_I810_FSTATUS', `0x0000644a')
+define(`DRM_IOCTL_I810_GETAGE', `0x00006444')
+define(`DRM_IOCTL_I810_GETBUF', `0xc0186445')
+define(`DRM_IOCTL_I810_INIT', `0x40406440')
+define(`DRM_IOCTL_I810_MC', `0x4020644c')
+define(`DRM_IOCTL_I810_OV0FLIP', `0x0000644b')
+define(`DRM_IOCTL_I810_OV0INFO', `0x80086449')
+define(`DRM_IOCTL_I810_RSTATUS', `0x0000644d')
+define(`DRM_IOCTL_I810_SWAP', `0x00006446')
+define(`DRM_IOCTL_I810_VERTEX', `0x400c6441')
+define(`DRM_IOCTL_I915_ALLOC', `0xc0186448')
+define(`DRM_IOCTL_I915_BATCHBUFFER', `0x40206443')
+define(`DRM_IOCTL_I915_CMDBUFFER', `0x4020644b')
+define(`DRM_IOCTL_I915_DESTROY_HEAP', `0x4004644c')
+define(`DRM_IOCTL_I915_FLIP', `0x00006442')
+define(`DRM_IOCTL_I915_FLUSH', `0x00006441')
+define(`DRM_IOCTL_I915_FREE', `0x40086449')
+define(`DRM_IOCTL_I915_GEM_BUSY', `0xc0086457')
+define(`DRM_IOCTL_I915_GEM_CONTEXT_CREATE', `0xc008646d')
+define(`DRM_IOCTL_I915_GEM_CONTEXT_DESTROY', `0x4008646e')
+define(`DRM_IOCTL_I915_GEM_CREATE', `0xc010645b')
+define(`DRM_IOCTL_I915_GEM_ENTERVT', `0x00006459')
+define(`DRM_IOCTL_I915_GEM_EXECBUFFER', `0x40286454')
+define(`DRM_IOCTL_I915_GEM_EXECBUFFER2', `0x40406469')
+define(`DRM_IOCTL_I915_GEM_GET_APERTURE', `0x80106463')
+define(`DRM_IOCTL_I915_GEM_GET_CACHING', `0xc0086470')
+define(`DRM_IOCTL_I915_GEM_GET_TILING', `0xc0106462')
+define(`DRM_IOCTL_I915_GEM_INIT', `0x40106453')
+define(`DRM_IOCTL_I915_GEM_LEAVEVT', `0x0000645a')
+define(`DRM_IOCTL_I915_GEM_MADVISE', `0xc00c6466')
+define(`DRM_IOCTL_I915_GEM_MMAP', `0xc020645e')
+define(`DRM_IOCTL_I915_GEM_MMAP_GTT', `0xc0106464')
+define(`DRM_IOCTL_I915_GEM_PIN', `0xc0186455')
+define(`DRM_IOCTL_I915_GEM_PREAD', `0x4020645c')
+define(`DRM_IOCTL_I915_GEM_PWRITE', `0x4020645d')
+define(`DRM_IOCTL_I915_GEM_SET_CACHING', `0x4008646f')
+define(`DRM_IOCTL_I915_GEM_SET_DOMAIN', `0x400c645f')
+define(`DRM_IOCTL_I915_GEM_SET_TILING', `0xc0106461')
+define(`DRM_IOCTL_I915_GEM_SW_FINISH', `0x40046460')
+define(`DRM_IOCTL_I915_GEM_THROTTLE', `0x00006458')
+define(`DRM_IOCTL_I915_GEM_UNPIN', `0x40086456')
+define(`DRM_IOCTL_I915_GEM_USERPTR', `0xc0186473')
+define(`DRM_IOCTL_I915_GEM_WAIT', `0xc010646c')
+define(`DRM_IOCTL_I915_GETPARAM', `0xc0106446')
+define(`DRM_IOCTL_I915_GET_PIPE_FROM_CRTC_ID', `0xc0086465')
+define(`DRM_IOCTL_I915_GET_RESET_STATS', `0xc0186472')
+define(`DRM_IOCTL_I915_GET_SPRITE_COLORKEY', `0xc014646b')
+define(`DRM_IOCTL_I915_GET_VBLANK_PIPE', `0x8004644e')
+define(`DRM_IOCTL_I915_HWS_ADDR', `0x40106451')
+define(`DRM_IOCTL_I915_INIT', `0x40446440')
+define(`DRM_IOCTL_I915_INIT_HEAP', `0x400c644a')
+define(`DRM_IOCTL_I915_IRQ_EMIT', `0xc0086444')
+define(`DRM_IOCTL_I915_IRQ_WAIT', `0x40046445')
+define(`DRM_IOCTL_I915_OVERLAY_ATTRS', `0xc02c6468')
+define(`DRM_IOCTL_I915_OVERLAY_PUT_IMAGE', `0x402c6467')
+define(`DRM_IOCTL_I915_REG_READ', `0xc0106471')
+define(`DRM_IOCTL_I915_SETPARAM', `0x40086447')
+define(`DRM_IOCTL_I915_SET_SPRITE_COLORKEY', `0xc014646b')
+define(`DRM_IOCTL_I915_SET_VBLANK_PIPE', `0x4004644d')
+define(`DRM_IOCTL_I915_VBLANK_SWAP', `0xc00c644f')
+define(`DRM_IOCTL_INFO_BUFS', `0xc0106418')
+define(`DRM_IOCTL_IRQ_BUSID', `0xc0106403')
+define(`DRM_IOCTL_LOCK', `0x4008642a')
+define(`DRM_IOCTL_MAP_BUFS', `0xc0186419')
+define(`DRM_IOCTL_MARK_BUFS', `0x40206417')
+define(`DRM_IOCTL_MGA_BLIT', `0x40346448')
+define(`DRM_IOCTL_MGA_CLEAR', `0x40146444')
+define(`DRM_IOCTL_MGA_DMA_BOOTSTRAP', `0xc020644c')
+define(`DRM_IOCTL_MGA_FLUSH', `0x40086441')
+define(`DRM_IOCTL_MGA_GETPARAM', `0xc0106449')
+define(`DRM_IOCTL_MGA_ILOAD', `0x400c6447')
+define(`DRM_IOCTL_MGA_INDICES', `0x40106446')
+define(`DRM_IOCTL_MGA_INIT', `0x40806440')
+define(`DRM_IOCTL_MGA_RESET', `0x00006442')
+define(`DRM_IOCTL_MGA_SET_FENCE', `0x4004644a')
+define(`DRM_IOCTL_MGA_SWAP', `0x00006443')
+define(`DRM_IOCTL_MGA_VERTEX', `0x400c6445')
+define(`DRM_IOCTL_MGA_WAIT_FENCE', `0xc004644b')
+define(`DRM_IOCTL_MOD_CTX', `0x40086422')
+define(`DRM_IOCTL_MODE_ADDFB', `0xc01c64ae')
+define(`DRM_IOCTL_MODE_ADDFB2', `0xc04464b8')
+define(`DRM_IOCTL_MODE_ATTACHMODE', `0xc04864a8')
+define(`DRM_IOCTL_MODE_CREATE_DUMB', `0xc02064b2')
+define(`DRM_IOCTL_MODE_CURSOR', `0xc01c64a3')
+define(`DRM_IOCTL_MODE_CURSOR2', `0xc02464bb')
+define(`DRM_IOCTL_MODE_DESTROY_DUMB', `0xc00464b4')
+define(`DRM_IOCTL_MODE_DETACHMODE', `0xc04864a9')
+define(`DRM_IOCTL_MODE_DIRTYFB', `0xc01864b1')
+define(`DRM_IOCTL_MODE_GETCONNECTOR', `0xc05064a7')
+define(`DRM_IOCTL_MODE_GETCRTC', `0xc06864a1')
+define(`DRM_IOCTL_MODE_GETENCODER', `0xc01464a6')
+define(`DRM_IOCTL_MODE_GETFB', `0xc01c64ad')
+define(`DRM_IOCTL_MODE_GETGAMMA', `0xc02064a4')
+define(`DRM_IOCTL_MODE_GETPLANE', `0xc02064b6')
+define(`DRM_IOCTL_MODE_GETPLANERESOURCES', `0xc01064b5')
+define(`DRM_IOCTL_MODE_GETPROPBLOB', `0xc01064ac')
+define(`DRM_IOCTL_MODE_GETPROPERTY', `0xc04064aa')
+define(`DRM_IOCTL_MODE_GETRESOURCES', `0xc04064a0')
+define(`DRM_IOCTL_MODE_MAP_DUMB', `0xc01064b3')
+define(`DRM_IOCTL_MODE_OBJ_GETPROPERTIES', `0xc02064b9')
+define(`DRM_IOCTL_MODE_OBJ_SETPROPERTY', `0xc01864ba')
+define(`DRM_IOCTL_MODE_PAGE_FLIP', `0xc01864b0')
+define(`DRM_IOCTL_MODE_RMFB', `0xc00464af')
+define(`DRM_IOCTL_MODE_SETCRTC', `0xc06864a2')
+define(`DRM_IOCTL_MODESET_CTL', `0x40086408')
+define(`DRM_IOCTL_MODE_SETGAMMA', `0xc02064a5')
+define(`DRM_IOCTL_MODE_SETPLANE', `0xc03064b7')
+define(`DRM_IOCTL_MODE_SETPROPERTY', `0xc01064ab')
+define(`DRM_IOCTL_MSM_GEM_CPU_FINI', `0x40046445')
+define(`DRM_IOCTL_MSM_GEM_CPU_PREP', `0x40186444')
+define(`DRM_IOCTL_MSM_GEM_INFO', `0xc0106443')
+define(`DRM_IOCTL_MSM_GEM_NEW', `0xc0106442')
+define(`DRM_IOCTL_MSM_GEM_SUBMIT', `0xc0206446')
+define(`DRM_IOCTL_MSM_GET_PARAM', `0xc0106440')
+define(`DRM_IOCTL_MSM_WAIT_FENCE', `0x40186447')
+define(`DRM_IOCTL_NEW_CTX', `0x40086425')
+define(`DRM_IOCTL_NOUVEAU_GEM_CPU_FINI', `0x40046483')
+define(`DRM_IOCTL_NOUVEAU_GEM_CPU_PREP', `0x40086482')
+define(`DRM_IOCTL_NOUVEAU_GEM_INFO', `0xc0286484')
+define(`DRM_IOCTL_NOUVEAU_GEM_NEW', `0xc0306480')
+define(`DRM_IOCTL_NOUVEAU_GEM_PUSHBUF', `0xc0406481')
+define(`DRM_IOCTL_OMAP_GEM_CPU_FINI', `0x40106445')
+define(`DRM_IOCTL_OMAP_GEM_CPU_PREP', `0x40086444')
+define(`DRM_IOCTL_OMAP_GEM_INFO', `0xc0186446')
+define(`DRM_IOCTL_OMAP_GEM_NEW', `0xc0106443')
+define(`DRM_IOCTL_OMAP_GET_PARAM', `0xc0106440')
+define(`DRM_IOCTL_OMAP_SET_PARAM', `0x40106441')
+define(`DRM_IOCTL_PRIME_FD_TO_HANDLE', `0xc00c642e')
+define(`DRM_IOCTL_PRIME_HANDLE_TO_FD', `0xc00c642d')
+define(`DRM_IOCTL_QXL_ALLOC', `0xc0086440')
+define(`DRM_IOCTL_QXL_ALLOC_SURF', `0xc0186446')
+define(`DRM_IOCTL_QXL_CLIENTCAP', `0x40086445')
+define(`DRM_IOCTL_QXL_EXECBUFFER', `0x40106442')
+define(`DRM_IOCTL_QXL_GETPARAM', `0xc0106444')
+define(`DRM_IOCTL_QXL_MAP', `0xc0106441')
+define(`DRM_IOCTL_QXL_UPDATE_AREA', `0x40186443')
+define(`DRM_IOCTL_R128_BLIT', `0x4018644b')
+define(`DRM_IOCTL_R128_CCE_IDLE', `0x00006444')
+define(`DRM_IOCTL_R128_CCE_RESET', `0x00006443')
+define(`DRM_IOCTL_R128_CCE_START', `0x00006441')
+define(`DRM_IOCTL_R128_CCE_STOP', `0x40086442')
+define(`DRM_IOCTL_R128_CLEAR', `0x40146448')
+define(`DRM_IOCTL_R128_DEPTH', `0x4028644c')
+define(`DRM_IOCTL_R128_FLIP', `0x00006453')
+define(`DRM_IOCTL_R128_FULLSCREEN', `0x40046450')
+define(`DRM_IOCTL_R128_GETPARAM', `0xc0106452')
+define(`DRM_IOCTL_R128_INDICES', `0x4014644a')
+define(`DRM_IOCTL_R128_INDIRECT', `0xc010644f')
+define(`DRM_IOCTL_R128_INIT', `0x40786440')
+define(`DRM_IOCTL_R128_RESET', `0x00006446')
+define(`DRM_IOCTL_R128_STIPPLE', `0x4008644d')
+define(`DRM_IOCTL_R128_SWAP', `0x00006447')
+define(`DRM_IOCTL_R128_VERTEX', `0x40106449')
+define(`DRM_IOCTL_RADEON_ALLOC', `0xc0186453')
+define(`DRM_IOCTL_RADEON_CLEAR', `0x40206448')
+define(`DRM_IOCTL_RADEON_CMDBUF', `0x40206450')
+define(`DRM_IOCTL_RADEON_CP_IDLE', `0x00006444')
+define(`DRM_IOCTL_RADEON_CP_INIT', `0x40786440')
+define(`DRM_IOCTL_RADEON_CP_RESET', `0x00006443')
+define(`DRM_IOCTL_RADEON_CP_RESUME', `0x00006458')
+define(`DRM_IOCTL_RADEON_CP_START', `0x00006441')
+define(`DRM_IOCTL_RADEON_CP_STOP', `0x40086442')
+define(`DRM_IOCTL_RADEON_CS', `0xc0206466')
+define(`DRM_IOCTL_RADEON_FLIP', `0x00006452')
+define(`DRM_IOCTL_RADEON_FREE', `0x40086454')
+define(`DRM_IOCTL_RADEON_FULLSCREEN', `0x40046446')
+define(`DRM_IOCTL_RADEON_GEM_BUSY', `0xc008646a')
+define(`DRM_IOCTL_RADEON_GEM_CREATE', `0xc020645d')
+define(`DRM_IOCTL_RADEON_GEM_GET_TILING', `0xc00c6469')
+define(`DRM_IOCTL_RADEON_GEM_INFO', `0xc018645c')
+define(`DRM_IOCTL_RADEON_GEM_MMAP', `0xc020645e')
+define(`DRM_IOCTL_RADEON_GEM_OP', `0xc010646c')
+define(`DRM_IOCTL_RADEON_GEM_PREAD', `0xc0206461')
+define(`DRM_IOCTL_RADEON_GEM_PWRITE', `0xc0206462')
+define(`DRM_IOCTL_RADEON_GEM_SET_DOMAIN', `0xc00c6463')
+define(`DRM_IOCTL_RADEON_GEM_SET_TILING', `0xc00c6468')
+define(`DRM_IOCTL_RADEON_GEM_USERPTR', `0xc018646d')
+define(`DRM_IOCTL_RADEON_GEM_VA', `0xc018646b')
+define(`DRM_IOCTL_RADEON_GEM_WAIT_IDLE', `0x40086464')
+define(`DRM_IOCTL_RADEON_GETPARAM', `0xc0106451')
+define(`DRM_IOCTL_RADEON_INDICES', `0x4014644a')
+define(`DRM_IOCTL_RADEON_INDIRECT', `0xc010644d')
+define(`DRM_IOCTL_RADEON_INFO', `0xc0106467')
+define(`DRM_IOCTL_RADEON_INIT_HEAP', `0x400c6455')
+define(`DRM_IOCTL_RADEON_IRQ_EMIT', `0xc0086456')
+define(`DRM_IOCTL_RADEON_IRQ_WAIT', `0x40046457')
+define(`DRM_IOCTL_RADEON_RESET', `0x00006445')
+define(`DRM_IOCTL_RADEON_SETPARAM', `0x40106459')
+define(`DRM_IOCTL_RADEON_STIPPLE', `0x4008644c')
+define(`DRM_IOCTL_RADEON_SURF_ALLOC', `0x400c645a')
+define(`DRM_IOCTL_RADEON_SURF_FREE', `0x4004645b')
+define(`DRM_IOCTL_RADEON_SWAP', `0x00006447')
+define(`DRM_IOCTL_RADEON_TEXTURE', `0xc020644e')
+define(`DRM_IOCTL_RADEON_VERTEX', `0x40106449')
+define(`DRM_IOCTL_RADEON_VERTEX2', `0x4028644f')
+define(`DRM_IOCTL_RES_CTX', `0xc0106426')
+define(`DRM_IOCTL_RM_CTX', `0xc0086421')
+define(`DRM_IOCTL_RM_DRAW', `0xc0046428')
+define(`DRM_IOCTL_RM_MAP', `0x4028641b')
+define(`DRM_IOCTL_SAVAGE_BCI_CMDBUF', `0x40386441')
+define(`DRM_IOCTL_SAVAGE_BCI_EVENT_EMIT', `0xc0086442')
+define(`DRM_IOCTL_SAVAGE_BCI_EVENT_WAIT', `0x40086443')
+define(`DRM_IOCTL_SAVAGE_BCI_INIT', `0x40606440')
+define(`DRM_IOCTL_SET_CLIENT_CAP', `0x4010640d')
+define(`DRM_IOCTL_SET_MASTER', `0x0000641e')
+define(`DRM_IOCTL_SET_SAREA_CTX', `0x4010641c')
+define(`DRM_IOCTL_SET_UNIQUE', `0x40106410')
+define(`DRM_IOCTL_SET_VERSION', `0xc0106407')
+define(`DRM_IOCTL_SG_ALLOC', `0xc0106438')
+define(`DRM_IOCTL_SG_FREE', `0x40106439')
+define(`DRM_IOCTL_SIS_AGP_ALLOC', `0xc0206454')
+define(`DRM_IOCTL_SIS_AGP_FREE', `0x40206455')
+define(`DRM_IOCTL_SIS_AGP_INIT', `0xc0106453')
+define(`DRM_IOCTL_SIS_FB_ALLOC', `0xc0206444')
+define(`DRM_IOCTL_SIS_FB_FREE', `0x40206445')
+define(`DRM_IOCTL_SIS_FB_INIT', `0x40106456')
+define(`DRM_IOCTL_SWITCH_CTX', `0x40086424')
+define(`DRM_IOCTL_TEGRA_CLOSE_CHANNEL', `0xc0106446')
+define(`DRM_IOCTL_TEGRA_GEM_CREATE', `0xc0106440')
+define(`DRM_IOCTL_TEGRA_GEM_GET_FLAGS', `0xc008644d')
+define(`DRM_IOCTL_TEGRA_GEM_GET_TILING', `0xc010644b')
+define(`DRM_IOCTL_TEGRA_GEM_MMAP', `0xc0086441')
+define(`DRM_IOCTL_TEGRA_GEM_SET_FLAGS', `0xc008644c')
+define(`DRM_IOCTL_TEGRA_GEM_SET_TILING', `0xc010644a')
+define(`DRM_IOCTL_TEGRA_GET_SYNCPT', `0xc0106447')
+define(`DRM_IOCTL_TEGRA_GET_SYNCPT_BASE', `0xc0106449')
+define(`DRM_IOCTL_TEGRA_OPEN_CHANNEL', `0xc0106445')
+define(`DRM_IOCTL_TEGRA_SUBMIT', `0xc0586448')
+define(`DRM_IOCTL_TEGRA_SYNCPT_INCR', `0xc0086443')
+define(`DRM_IOCTL_TEGRA_SYNCPT_READ', `0xc0086442')
+define(`DRM_IOCTL_TEGRA_SYNCPT_WAIT', `0xc0106444')
+define(`DRM_IOCTL_UNBLOCK', `0xc0046413')
+define(`DRM_IOCTL_UNLOCK', `0x4008642b')
+define(`DRM_IOCTL_UPDATE_DRAW', `0x4018643f')
+define(`DRM_IOCTL_VERSION', `0xc0406400')
+define(`DRM_IOCTL_VIA_AGP_INIT', `0xc0086442')
+define(`DRM_IOCTL_VIA_ALLOCMEM', `0xc0206440')
+define(`DRM_IOCTL_VIA_BLIT_SYNC', `0x4008644f')
+define(`DRM_IOCTL_VIA_CMDBUFFER', `0x40106448')
+define(`DRM_IOCTL_VIA_CMDBUF_SIZE', `0xc00c644b')
+define(`DRM_IOCTL_VIA_DEC_FUTEX', `0x40106445')
+define(`DRM_IOCTL_VIA_DMA_BLIT', `0x4030644e')
+define(`DRM_IOCTL_VIA_DMA_INIT', `0xc0206447')
+define(`DRM_IOCTL_VIA_FB_INIT', `0xc0086443')
+define(`DRM_IOCTL_VIA_FLUSH', `0x00006449')
+define(`DRM_IOCTL_VIA_FREEMEM', `0x40206441')
+define(`DRM_IOCTL_VIA_MAP_INIT', `0xc0286444')
+define(`DRM_IOCTL_VIA_PCICMD', `0x4010644a')
+define(`DRM_IOCTL_VIA_WAIT_IRQ', `0xc018644d')
+define(`DRM_IOCTL_WAIT_VBLANK', `0xc018643a')
+define(`DVD_AUTH', `0x00005392')
+define(`DVD_READ_STRUCT', `0x00005390')
+define(`DVD_WRITE_STRUCT', `0x00005391')
+define(`ECCGETLAYOUT', `0x81484d11')
+define(`ECCGETSTATS', `0x80104d12')
+define(`ENI_MEMDUMP', `0x40106160')
+define(`ENI_SETMULT', `0x40106167')
+define(`EVIOCGEFFECTS', `0x80044584')
+define(`EVIOCGID', `0x80084502')
+define(`EVIOCGKEYCODE', `0x80084504')
+define(`EVIOCGKEYCODE_V2', `0x80284504')
+define(`EVIOCGRAB', `0x40044590')
+define(`EVIOCGREP', `0x80084503')
+define(`EVIOCGVERSION', `0x80044501')
+define(`EVIOCREVOKE', `0x40044591')
+define(`EVIOCRMFF', `0x40044581')
+define(`EVIOCSCLOCKID', `0x400445a0')
+define(`EVIOCSFF', `0x40304580')
+define(`EVIOCSKEYCODE', `0x40084504')
+define(`EVIOCSKEYCODE_V2', `0x40284504')
+define(`EVIOCSREP', `0x40084503')
+define(`F2FS_IOC_START_ATOMIC_WRITE', `0xf501')
+define(`F2FS_IOC_COMMIT_ATOMIC_WRITE', `0xf502')
+define(`F2FS_IOC_START_VOLATILE_WRITE', `0xf503')
+define(`F2FS_IOC_RELEASE_VOLATILE_WRITE', `0xf504')
+define(`F2FS_IOC_ABORT_VOLATILE_WRITE', `0xf505')
+define(`F2FS_IOC_GARBAGE_COLLECT', `0xf506')
+define(`F2FS_IOC_WRITE_CHECKPOINT', `0xf507')
+define(`F2FS_IOC_DEFRAGMENT', `0xf508')
+define(`F2FS_IOC_MOVE_RANGE', `0xf509')
+define(`F2FS_IOC_FLUSH_DEVICE', `0xf50a')
+define(`F2FS_IOC_GARBAGE_COLLECT_RANGE', `0xf50b')
+define(`F2FS_IOC_GET_FEATURES', `0xf50c')
+define(`F2FS_IOC_SET_PIN_FILE', `0xf50d')
+define(`F2FS_IOC_GET_PIN_FILE', `0xf50e')
+define(`F2FS_IOC_PRECACHE_EXTENTS', `0xf50f')
+define(`F2FS_IOC_RESIZE_FS', `0xf510')
+define(`F2FS_IOC_GET_COMPRESS_BLOCKS', `0xf511')
+define(`F2FS_IOC_RELEASE_COMPRESS_BLOCKS', `0xf512')
+define(`F2FS_IOC_RESERVE_COMPRESS_BLOCKS', `0xf513')
+define(`F2FS_IOC_SEC_TRIM_FILE', `0xf514')
+define(`F2FS_IOC_GET_COMPRESS_OPTION', `0xf515')
+define(`F2FS_IOC_SET_COMPRESS_OPTION', `0xf516')
+define(`F2FS_IOC_DECOMPRESS_FILE', `0xf517')
+define(`F2FS_IOC_COMPRESS_FILE', `0xf518')
+define(`F2FS_IOC_SHUTDOWN', `0x587d')
+define(`FAT_IOCTL_GET_ATTRIBUTES', `0x80047210')
+define(`FAT_IOCTL_GET_VOLUME_ID', `0x80047213')
+define(`FAT_IOCTL_SET_ATTRIBUTES', `0x40047211')
+define(`FBIGET_BRIGHTNESS', `0x80044603')
+define(`FBIGET_COLOR', `0x80044605')
+define(`FBIO_ALLOC', `0x00004613')
+define(`FBIOBLANK', `0x00004611')
+define(`FBIO_CURSOR', `0xc0684608')
+define(`FBIO_FREE', `0x00004614')
+define(`FBIOGETCMAP', `0x00004604')
+define(`FBIOGET_CON2FBMAP', `0x0000460f')
+define(`FBIOGET_CONTRAST', `0x80044601')
+define(`FBIO_GETCONTROL2', `0x80084689')
+define(`FBIOGET_DISPINFO', `0x00004618')
+define(`FBIOGET_FSCREENINFO', `0x00004602')
+define(`FBIOGET_GLYPH', `0x00004615')
+define(`FBIOGET_HWCINFO', `0x00004616')
+define(`FBIOGET_VBLANK', `0x80204612')
+define(`FBIOGET_VSCREENINFO', `0x00004600')
+define(`FBIOPAN_DISPLAY', `0x00004606')
+define(`FBIOPUTCMAP', `0x00004605')
+define(`FBIOPUT_CON2FBMAP', `0x00004610')
+define(`FBIOPUT_CONTRAST', `0x40044602')
+define(`FBIOPUT_MODEINFO', `0x00004617')
+define(`FBIOPUT_VSCREENINFO', `0x00004601')
+define(`FBIO_RADEON_GET_MIRROR', `0x80084003')
+define(`FBIO_RADEON_SET_MIRROR', `0x40084004')
+define(`FBIO_WAITEVENT', `0x00004688')
+define(`FBIO_WAITFORVSYNC', `0x40044620')
+define(`FBIPUT_BRIGHTNESS', `0x40044603')
+define(`FBIPUT_COLOR', `0x40044606')
+define(`FBIPUT_HSYNC', `0x40044609')
+define(`FBIPUT_VSYNC', `0x4004460a')
+define(`FDCLRPRM', `0x00000241')
+define(`FDDEFPRM', `0x40200243')
+define(`FDEJECT', `0x0000025a')
+define(`FDFLUSH', `0x0000024b')
+define(`FDFMTBEG', `0x00000247')
+define(`FDFMTEND', `0x00000249')
+define(`FDFMTTRK', `0x400c0248')
+define(`FDGETDRVPRM', `0x80800211')
+define(`FDGETDRVSTAT', `0x80500212')
+define(`FDGETDRVTYP', `0x8010020f')
+define(`FDGETFDCSTAT', `0x80280215')
+define(`FDGETMAXERRS', `0x8014020e')
+define(`FDGETPRM', `0x80200204')
+define(`FDMSGOFF', `0x00000246')
+define(`FDMSGON', `0x00000245')
+define(`FDPOLLDRVSTAT', `0x80500213')
+define(`FDRAWCMD', `0x00000258')
+define(`FDRESET', `0x00000254')
+define(`FDSETDRVPRM', `0x40800290')
+define(`FDSETEMSGTRESH', `0x0000024a')
+define(`FDSETMAXERRS', `0x4014024c')
+define(`FDSETPRM', `0x40200242')
+define(`FDTWADDLE', `0x00000259')
+define(`FDWERRORCLR', `0x00000256')
+define(`FDWERRORGET', `0x80280217')
+define(`FE_DISEQC_RECV_SLAVE_REPLY', `0x800c6f40')
+define(`FE_DISEQC_RESET_OVERLOAD', `0x00006f3e')
+define(`FE_DISEQC_SEND_BURST', `0x00006f41')
+define(`FE_DISEQC_SEND_MASTER_CMD', `0x40076f3f')
+define(`FE_DISHNETWORK_SEND_LEGACY_CMD', `0x00006f50')
+define(`FE_ENABLE_HIGH_LNB_VOLTAGE', `0x00006f44')
+define(`FE_GET_EVENT', `0x80286f4e')
+define(`FE_GET_FRONTEND', `0x80246f4d')
+define(`FE_GET_INFO', `0x80a86f3d')
+define(`FE_GET_PROPERTY', `0x80106f53')
+define(`FE_READ_BER', `0x80046f46')
+define(`FE_READ_SIGNAL_STRENGTH', `0x80026f47')
+define(`FE_READ_SNR', `0x80026f48')
+define(`FE_READ_STATUS', `0x80046f45')
+define(`FE_READ_UNCORRECTED_BLOCKS', `0x80046f49')
+define(`FE_SET_FRONTEND', `0x40246f4c')
+define(`FE_SET_FRONTEND_TUNE_MODE', `0x00006f51')
+define(`FE_SET_PROPERTY', `0x40106f52')
+define(`FE_SET_TONE', `0x00006f42')
+define(`FE_SET_VOLTAGE', `0x00006f43')
+define(`FIBMAP', `0x00000001')
+define(`FIFREEZE', `0xc0045877')
+define(`FIGETBSZ', `0x00000002')
+define(`FIOASYNC', `0x00005452')
+define(`FIOCLEX', ifelse(target_arch, mips, 0x00006601, 0x00005451))
+define(`FIOGETOWN', `0x00008903')
+define(`FIONBIO', `0x00005421')
+define(`FIONCLEX', ifelse(target_arch, mips, 0x00006602, 0x00005450))
+define(`FIONREAD', ifelse(target_arch, mips, 0x0000467f, 0x0000541b))
+define(`FIOQSIZE', `0x00005460')
+define(`FIOSETOWN', `0x00008901')
+define(`FITHAW', `0xc0045878')
+define(`FITRIM', `0xc0185879')
+define(`FS_IOC32_GETFLAGS', `0x80046601')
+define(`FS_IOC32_GETVERSION', `0x80047601')
+define(`FS_IOC32_SETFLAGS', `0x40046602')
+define(`FS_IOC32_SETVERSION', `0x40047602')
+define(`FS_IOC_ADD_ENCRYPTION_KEY', `0xc0506617')
+define(`FS_IOC_ENABLE_VERITY', `0x6685')
+define(`FS_IOC_FIEMAP', `0xc020660b')
+define(`FS_IOC_FSGETXATTR', `0x801c581f')
+define(`FS_IOC_FSSETXATTR', `0x401c5820')
+define(`FS_IOC_GET_ENCRYPTION_KEY_STATUS', `0xc080661a')
+define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
+define(`FS_IOC_GET_ENCRYPTION_POLICY_EX', `0xc0096616')
+define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
+define(`FS_IOC_GETFLAGS', `0x80086601')
+define(`FS_IOC_GETVERSION', `0x80087601')
+define(`FS_IOC_MEASURE_VERITY', `0x6686')
+define(`FS_IOC_REMOVE_ENCRYPTION_KEY', `0xc0406618')
+define(`FS_IOC_SET_ENCRYPTION_POLICY', `0x800c6613')
+define(`FS_IOC_SETFLAGS', `0x40086602')
+define(`FS_IOC_SETVERSION', `0x40087602')
+define(`FSL_HV_IOCTL_DOORBELL', `0xc008af06')
+define(`FSL_HV_IOCTL_GETPROP', `0xc028af07')
+define(`FSL_HV_IOCTL_MEMCPY', `0xc028af05')
+define(`FSL_HV_IOCTL_PARTITION_GET_STATUS', `0xc00caf02')
+define(`FSL_HV_IOCTL_PARTITION_RESTART', `0xc008af01')
+define(`FSL_HV_IOCTL_PARTITION_START', `0xc010af03')
+define(`FSL_HV_IOCTL_PARTITION_STOP', `0xc008af04')
+define(`FSL_HV_IOCTL_SETPROP', `0xc028af08')
+define(`FUNCTIONFS_CLEAR_HALT', `0x00006703')
+define(`FUNCTIONFS_ENDPOINT_ALLOC', `0x000067e7')
+define(`FUNCTIONFS_ENDPOINT_DESC', `0x80096782')
+define(`FUNCTIONFS_ENDPOINT_REVMAP', `0x00006781')
+define(`FUNCTIONFS_FIFO_FLUSH', `0x00006702')
+define(`FUNCTIONFS_FIFO_STATUS', `0x00006701')
+define(`FUNCTIONFS_INTERFACE_REVMAP', `0x00006780')
+define(`FW_CDEV_IOC_ADD_DESCRIPTOR', `0xc0182306')
+define(`FW_CDEV_IOC_ALLOCATE', `0xc0202302')
+define(`FW_CDEV_IOC_ALLOCATE_ISO_RESOURCE', `0xc018230d')
+define(`FW_CDEV_IOC_ALLOCATE_ISO_RESOURCE_ONCE', `0x4018230f')
+define(`FW_CDEV_IOC_CREATE_ISO_CONTEXT', `0xc0202308')
+define(`FW_CDEV_IOC_DEALLOCATE', `0x40042303')
+define(`FW_CDEV_IOC_DEALLOCATE_ISO_RESOURCE', `0x4004230e')
+define(`FW_CDEV_IOC_DEALLOCATE_ISO_RESOURCE_ONCE', `0x40182310')
+define(`FW_CDEV_IOC_FLUSH_ISO', `0x40042318')
+define(`FW_CDEV_IOC_GET_CYCLE_TIMER', `0x8010230c')
+define(`FW_CDEV_IOC_GET_CYCLE_TIMER2', `0xc0182314')
+define(`FW_CDEV_IOC_GET_INFO', `0xc0282300')
+define(`FW_CDEV_IOC_GET_SPEED', `0x00002311')
+define(`FW_CDEV_IOC_INITIATE_BUS_RESET', `0x40042305')
+define(`FW_CDEV_IOC_QUEUE_ISO', `0xc0182309')
+define(`FW_CDEV_IOC_RECEIVE_PHY_PACKETS', `0x40082316')
+define(`FW_CDEV_IOC_REMOVE_DESCRIPTOR', `0x40042307')
+define(`FW_CDEV_IOC_SEND_BROADCAST_REQUEST', `0x40282312')
+define(`FW_CDEV_IOC_SEND_PHY_PACKET', `0xc0182315')
+define(`FW_CDEV_IOC_SEND_REQUEST', `0x40282301')
+define(`FW_CDEV_IOC_SEND_RESPONSE', `0x40182304')
+define(`FW_CDEV_IOC_SEND_STREAM_PACKET', `0x40282313')
+define(`FW_CDEV_IOC_SET_ISO_CHANNELS', `0x40102317')
+define(`FW_CDEV_IOC_START_ISO', `0x4010230a')
+define(`FW_CDEV_IOC_STOP_ISO', `0x4004230b')
+define(`GADGETFS_CLEAR_HALT', `0x00006703')
+define(`GADGETFS_FIFO_FLUSH', `0x00006702')
+define(`GADGETFS_FIFO_STATUS', `0x00006701')
+define(`GADGET_GET_PRINTER_STATUS', `0x80016721')
+define(`GADGET_SET_PRINTER_STATUS', `0xc0016722')
+define(`GENWQE_EXECUTE_DDCB', `0xc0e8a532')
+define(`GENWQE_EXECUTE_RAW_DDCB', `0xc0e8a533')
+define(`GENWQE_GET_CARD_STATE', `0x8004a524')
+define(`GENWQE_PIN_MEM', `0xc020a528')
+define(`GENWQE_READ_REG16', `0x8010a522')
+define(`GENWQE_READ_REG32', `0x8010a520')
+define(`GENWQE_READ_REG64', `0x8010a51e')
+define(`GENWQE_SLU_READ', `0xc038a551')
+define(`GENWQE_SLU_UPDATE', `0xc038a550')
+define(`GENWQE_UNPIN_MEM', `0xc020a529')
+define(`GENWQE_WRITE_REG16', `0x4010a523')
+define(`GENWQE_WRITE_REG32', `0x4010a521')
+define(`GENWQE_WRITE_REG64', `0x4010a51f')
+define(`GET_ARRAY_INFO', `0x80480911')
+define(`GET_BITMAP_FILE', `0x90000915')
+define(`GET_DISK_INFO', `0x80140912')
+define(`GIGASET_BRKCHARS', `0x40064702')
+define(`GIGASET_CONFIG', `0xc0044701')
+define(`GIGASET_REDIR', `0xc0044700')
+define(`GIGASET_VERSION', `0xc0104703')
+define(`GIO_CMAP', `0x00004b70')
+define(`GIO_FONT', `0x00004b60')
+define(`GIO_FONTX', `0x00004b6b')
+define(`GIO_SCRNMAP', `0x00004b40')
+define(`GIO_UNIMAP', `0x00004b66')
+define(`GIO_UNISCRNMAP', `0x00004b69')
+define(`GSMIOC_DISABLE_NET', `0x00004703')
+define(`GSMIOC_ENABLE_NET', `0x40344702')
+define(`GSMIOC_GETCONF', `0x804c4700')
+define(`GSMIOC_SETCONF', `0x404c4701')
+define(`HCIBLOCKADDR', `0x400448e6')
+define(`HCIDEVDOWN', `0x400448ca')
+define(`HCIDEVRESET', `0x400448cb')
+define(`HCIDEVRESTAT', `0x400448cc')
+define(`HCIDEVUP', `0x400448c9')
+define(`HCIGETAUTHINFO', `0x800448d7')
+define(`HCIGETCONNINFO', `0x800448d5')
+define(`HCIGETCONNLIST', `0x800448d4')
+define(`HCIGETDEVINFO', `0x800448d3')
+define(`HCIGETDEVLIST', `0x800448d2')
+define(`HCIINQUIRY', `0x800448f0')
+define(`HCISETACLMTU', `0x400448e3')
+define(`HCISETAUTH', `0x400448de')
+define(`HCISETENCRYPT', `0x400448df')
+define(`HCISETLINKMODE', `0x400448e2')
+define(`HCISETLINKPOL', `0x400448e1')
+define(`HCISETPTYPE', `0x400448e0')
+define(`HCISETRAW', `0x400448dc')
+define(`HCISETSCAN', `0x400448dd')
+define(`HCISETSCOMTU', `0x400448e4')
+define(`HCIUNBLOCKADDR', `0x400448e7')
+define(`HDA_IOCTL_GET_WCAP', `0xc0084812')
+define(`HDA_IOCTL_PVERSION', `0x80044810')
+define(`HDA_IOCTL_VERB_WRITE', `0xc0084811')
+define(`HDIO_DRIVE_CMD', `0x0000031f')
+define(`HDIO_DRIVE_RESET', `0x0000031c')
+define(`HDIO_DRIVE_TASK', `0x0000031e')
+define(`HDIO_DRIVE_TASKFILE', `0x0000031d')
+define(`HDIO_GET_32BIT', `0x00000309')
+define(`HDIO_GET_ACOUSTIC', `0x0000030f')
+define(`HDIO_GET_ADDRESS', `0x00000310')
+define(`HDIO_GET_BUSSTATE', `0x0000031a')
+define(`HDIO_GET_DMA', `0x0000030b')
+define(`HDIO_GETGEO', `0x00000301')
+define(`HDIO_GET_IDENTITY', `0x0000030d')
+define(`HDIO_GET_KEEPSETTINGS', `0x00000308')
+define(`HDIO_GET_MULTCOUNT', `0x00000304')
+define(`HDIO_GET_NICE', `0x0000030c')
+define(`HDIO_GET_NOWERR', `0x0000030a')
+define(`HDIO_GET_QDMA', `0x00000305')
+define(`HDIO_GET_UNMASKINTR', `0x00000302')
+define(`HDIO_GET_WCACHE', `0x0000030e')
+define(`HDIO_OBSOLETE_IDENTITY', `0x00000307')
+define(`HDIO_SCAN_HWIF', `0x00000328')
+define(`HDIO_SET_32BIT', `0x00000324')
+define(`HDIO_SET_ACOUSTIC', `0x0000032c')
+define(`HDIO_SET_ADDRESS', `0x0000032f')
+define(`HDIO_SET_BUSSTATE', `0x0000032d')
+define(`HDIO_SET_DMA', `0x00000326')
+define(`HDIO_SET_KEEPSETTINGS', `0x00000323')
+define(`HDIO_SET_MULTCOUNT', `0x00000321')
+define(`HDIO_SET_NICE', `0x00000329')
+define(`HDIO_SET_NOWERR', `0x00000325')
+define(`HDIO_SET_PIO_MODE', `0x00000327')
+define(`HDIO_SET_QDMA', `0x0000032e')
+define(`HDIO_SET_UNMASKINTR', `0x00000322')
+define(`HDIO_SET_WCACHE', `0x0000032b')
+define(`HDIO_SET_XFER', `0x00000306')
+define(`HDIO_TRISTATE_HWIF', `0x0000031b')
+define(`HDIO_UNREGISTER_HWIF', `0x0000032a')
+define(`HE_GET_REG', `0x40106160')
+define(`HIDIOCAPPLICATION', `0x00004802')
+define(`HIDIOCGCOLLECTIONINDEX', `0x40184810')
+define(`HIDIOCGCOLLECTIONINFO', `0xc0104811')
+define(`HIDIOCGDEVINFO', `0x801c4803')
+define(`HIDIOCGFIELDINFO', `0xc038480a')
+define(`HIDIOCGFLAG', `0x8004480e')
+define(`HIDIOCGRAWINFO', `0x80084803')
+define(`HIDIOCGRDESC', `0x90044802')
+define(`HIDIOCGRDESCSIZE', `0x80044801')
+define(`HIDIOCGREPORT', `0x400c4807')
+define(`HIDIOCGREPORTINFO', `0xc00c4809')
+define(`HIDIOCGSTRING', `0x81044804')
+define(`HIDIOCGUCODE', `0xc018480d')
+define(`HIDIOCGUSAGE', `0xc018480b')
+define(`HIDIOCGUSAGES', `0xd01c4813')
+define(`HIDIOCGVERSION', `0x80044801')
+define(`HIDIOCINITREPORT', `0x00004805')
+define(`HIDIOCSFLAG', `0x4004480f')
+define(`HIDIOCSREPORT', `0x400c4808')
+define(`HIDIOCSUSAGE', `0x4018480c')
+define(`HIDIOCSUSAGES', `0x501c4814')
+define(`HOT_ADD_DISK', `0x00000928')
+define(`HOT_GENERATE_ERROR', `0x0000092a')
+define(`HOT_REMOVE_DISK', `0x00000922')
+define(`HPET_DPI', `0x00006805')
+define(`HPET_EPI', `0x00006804')
+define(`HPET_IE_OFF', `0x00006802')
+define(`HPET_IE_ON', `0x00006801')
+define(`HPET_INFO', `0x80186803')
+define(`HPET_IRQFREQ', `0x40086806')
+define(`HSC_GET_RX', `0x400c6b14')
+define(`HSC_GET_TX', `0x40106b16')
+define(`HSC_RESET', `0x00006b10')
+define(`HSC_SEND_BREAK', `0x00006b12')
+define(`HSC_SET_PM', `0x00006b11')
+define(`HSC_SET_RX', `0x400c6b13')
+define(`HSC_SET_TX', `0x40106b15')
+define(`I2OEVTGET', `0x8068690b')
+define(`I2OEVTREG', `0x400c690a')
+define(`I2OGETIOPS', `0x80206900')
+define(`I2OHRTGET', `0xc0186901')
+define(`I2OHTML', `0xc0306909')
+define(`I2OLCTGET', `0xc0186902')
+define(`I2OPARMGET', `0xc0286904')
+define(`I2OPARMSET', `0xc0286903')
+define(`I2OPASSTHRU', `0x8010690c')
+define(`I2OPASSTHRU32', `0x8008690c')
+define(`I2OSWDEL', `0xc0306907')
+define(`I2OSWDL', `0xc0306905')
+define(`I2OSWUL', `0xc0306906')
+define(`I2OVALIDATE', `0x80046908')
+define(`I8K_BIOS_VERSION', `0x80046980')
+define(`I8K_FN_STATUS', `0x80086983')
+define(`I8K_GET_FAN', `0xc0086986')
+define(`I8K_GET_SPEED', `0xc0086985')
+define(`I8K_GET_TEMP', `0x80086984')
+define(`I8K_MACHINE_ID', `0x80046981')
+define(`I8K_POWER_STATUS', `0x80086982')
+define(`I8K_SET_FAN', `0xc0086987')
+define(`IB_USER_MAD_ENABLE_PKEY', `0x00001b03')
+define(`IB_USER_MAD_REGISTER_AGENT', `0xc01c1b01')
+define(`IB_USER_MAD_REGISTER_AGENT2', `0xc0281b04')
+define(`IB_USER_MAD_UNREGISTER_AGENT', `0x40041b02')
+define(`IDT77105_GETSTAT', `0x40106132')
+define(`IDT77105_GETSTATZ', `0x40106133')
+define(`IIOCDBGVAR', `0x0000497f')
+define(`IIOCDRVCTL', `0x00004980')
+define(`IIOCGETCPS', `0x00004915')
+define(`IIOCGETDVR', `0x00004916')
+define(`IIOCGETMAP', `0x00004911')
+define(`IIOCGETPRF', `0x0000490f')
+define(`IIOCGETSET', `0x00004908')
+define(`IIOCNETAIF', `0x00004901')
+define(`IIOCNETALN', `0x00004920')
+define(`IIOCNETANM', `0x00004905')
+define(`IIOCNETASL', `0x00004913')
+define(`IIOCNETDIF', `0x00004902')
+define(`IIOCNETDIL', `0x00004914')
+define(`IIOCNETDLN', `0x00004921')
+define(`IIOCNETDNM', `0x00004906')
+define(`IIOCNETDWRSET', `0x00004918')
+define(`IIOCNETGCF', `0x00004904')
+define(`IIOCNETGNM', `0x00004907')
+define(`IIOCNETGPN', `0x00004922')
+define(`IIOCNETHUP', `0x0000490b')
+define(`IIOCNETLCR', `0x00004917')
+define(`IIOCNETSCF', `0x00004903')
+define(`IIOCSETBRJ', `0x0000490d')
+define(`IIOCSETGST', `0x0000490c')
+define(`IIOCSETMAP', `0x00004912')
+define(`IIOCSETPRF', `0x00004910')
+define(`IIOCSETSET', `0x00004909')
+define(`IIOCSETVER', `0x0000490a')
+define(`IIOCSIGPRF', `0x0000490e')
+define(`IIO_GET_EVENT_FD_IOCTL', `0x80046990')
+define(`IMADDTIMER', `0x80044940')
+define(`IMCLEAR_L2', `0x80044946')
+define(`IMCTRLREQ', `0x80044945')
+define(`IMDELTIMER', `0x80044941')
+define(`IMGETCOUNT', `0x80044943')
+define(`IMGETDEVINFO', `0x80044944')
+define(`IMGETVERSION', `0x80044942')
+define(`IMHOLD_L1', `0x80044948')
+define(`IMSETDEVNAME', `0x80184947')
+define(`INCFS_IOCTL_CREATE_FILE', `0x0000671e')
+define(`INCFS_IOCTL_READ_SIGNATURE', `0x0000671f')
+define(`INCFS_IOCTL_FILL_BLOCKS', `0x00006720')
+define(`INCFS_IOCTL_PERMIT_FILL', `0x00006721')
+define(`INCFS_IOCTL_GET_FILLED_BLOCKS', `0x00006722')
+define(`INCFS_IOCTL_CREATE_MAPPED_FILE', `0x00006723')
+define(`INCFS_IOCTL_GET_BLOCK_COUNT', `0x00006724')
+define(`INCFS_IOCTL_GET_READ_TIMEOUTS', `0x00006725')
+define(`INCFS_IOCTL_SET_READ_TIMEOUTS', `0x00006726')
+define(`INCFS_IOCTL_GET_LAST_READ_ERROR', `0x00006727')
+define(`IOCTL_EVTCHN_BIND_INTERDOMAIN', `0x00084501')
+define(`IOCTL_EVTCHN_BIND_UNBOUND_PORT', `0x00044502')
+define(`IOCTL_EVTCHN_BIND_VIRQ', `0x00044500')
+define(`IOCTL_EVTCHN_NOTIFY', `0x00044504')
+define(`IOCTL_EVTCHN_RESET', `0x00004505')
+define(`IOCTL_EVTCHN_UNBIND', `0x00044503')
+define(`IOCTL_MEI_CONNECT_CLIENT', `0xc0104801')
+define(`IOCTL_VMCI_CTX_ADD_NOTIFICATION', `0x000007af')
+define(`IOCTL_VMCI_CTX_GET_CPT_STATE', `0x000007b1')
+define(`IOCTL_VMCI_CTX_REMOVE_NOTIFICATION', `0x000007b0')
+define(`IOCTL_VMCI_CTX_SET_CPT_STATE', `0x000007b2')
+define(`IOCTL_VMCI_DATAGRAM_RECEIVE', `0x000007ac')
+define(`IOCTL_VMCI_DATAGRAM_SEND', `0x000007ab')
+define(`IOCTL_VMCI_GET_CONTEXT_ID', `0x000007b3')
+define(`IOCTL_VMCI_INIT_CONTEXT', `0x000007a0')
+define(`IOCTL_VMCI_NOTIFICATIONS_RECEIVE', `0x000007a6')
+define(`IOCTL_VMCI_NOTIFY_RESOURCE', `0x000007a5')
+define(`IOCTL_VMCI_QUEUEPAIR_ALLOC', `0x000007a8')
+define(`IOCTL_VMCI_QUEUEPAIR_DETACH', `0x000007aa')
+define(`IOCTL_VMCI_QUEUEPAIR_SETPAGEFILE', `0x000007a9')
+define(`IOCTL_VMCI_QUEUEPAIR_SETVA', `0x000007a4')
+define(`IOCTL_VMCI_SET_NOTIFY', `0x000007cb')
+define(`IOCTL_VMCI_SOCKETS_GET_AF_VALUE', `0x000007b8')
+define(`IOCTL_VMCI_SOCKETS_GET_LOCAL_CID', `0x000007b9')
+define(`IOCTL_VMCI_SOCKETS_VERSION', `0x000007b4')
+define(`IOCTL_VMCI_VERSION', `0x0000079f')
+define(`IOCTL_VMCI_VERSION2', `0x000007a7')
+define(`IOCTL_VM_SOCKETS_GET_LOCAL_CID', `0x000007b9')
+define(`IOCTL_WDM_MAX_COMMAND', `0x800248a0')
+define(`IOCTL_XENBUS_BACKEND_EVTCHN', `0x00004200')
+define(`IOCTL_XENBUS_BACKEND_SETUP', `0x00004201')
+define(`ION_IOC_ALLOC', `0xc0204900')
+define(`ION_IOC_CUSTOM', `0xc0104906')
+define(`ION_IOC_FREE', `0xc0044901')
+define(`ION_IOC_IMPORT', `0xc0084905')
+define(`ION_IOC_MAP', `0xc0084902')
+define(`ION_IOC_SHARE', `0xc0084904')
+define(`ION_IOC_SYNC', `0xc0084907')
+define(`ION_IOC_TEST_DMA_MAPPING', `0x402049f1')
+define(`ION_IOC_TEST_KERNEL_MAPPING', `0x402049f2')
+define(`ION_IOC_TEST_SET_FD', `0x000049f0')
+define(`IOW_GETINFO', `0x8028c003')
+define(`IOW_READ', `0x4008c002')
+define(`IOW_WRITE', `0x4008c001')
+define(`IPMICTL_GET_MAINTENANCE_MODE_CMD', `0x8004691e')
+define(`IPMICTL_GET_MY_ADDRESS_CMD', `0x80046912')
+define(`IPMICTL_GET_MY_CHANNEL_ADDRESS_CMD', `0x80046919')
+define(`IPMICTL_GET_MY_CHANNEL_LUN_CMD', `0x8004691b')
+define(`IPMICTL_GET_MY_LUN_CMD', `0x80046914')
+define(`IPMICTL_GET_TIMING_PARMS_CMD', `0x80086917')
+define(`IPMICTL_RECEIVE_MSG', `0xc030690c')
+define(`IPMICTL_RECEIVE_MSG_TRUNC', `0xc030690b')
+define(`IPMICTL_REGISTER_FOR_CMD', `0x8002690e')
+define(`IPMICTL_REGISTER_FOR_CMD_CHANS', `0x800c691c')
+define(`IPMICTL_SEND_COMMAND', `0x8028690d')
+define(`IPMICTL_SEND_COMMAND_SETTIME', `0x80306915')
+define(`IPMICTL_SET_GETS_EVENTS_CMD', `0x80046910')
+define(`IPMICTL_SET_MAINTENANCE_MODE_CMD', `0x4004691f')
+define(`IPMICTL_SET_MY_ADDRESS_CMD', `0x80046911')
+define(`IPMICTL_SET_MY_CHANNEL_ADDRESS_CMD', `0x80046918')
+define(`IPMICTL_SET_MY_CHANNEL_LUN_CMD', `0x8004691a')
+define(`IPMICTL_SET_MY_LUN_CMD', `0x80046913')
+define(`IPMICTL_SET_TIMING_PARMS_CMD', `0x80086916')
+define(`IPMICTL_UNREGISTER_FOR_CMD', `0x8002690f')
+define(`IPMICTL_UNREGISTER_FOR_CMD_CHANS', `0x800c691d')
+define(`IVTVFB_IOC_DMA_FRAME', `0x401856c0')
+define(`IVTV_IOC_DMA_FRAME', `0x404056c0')
+define(`IVTV_IOC_PASSTHROUGH_MODE', `0x400456c1')
+define(`IXJCTL_AEC_GET_LEVEL', `0x000071cd')
+define(`IXJCTL_AEC_START', `0x400471cb')
+define(`IXJCTL_AEC_STOP', `0x000071cc')
+define(`IXJCTL_CARDTYPE', `0x800471c1')
+define(`IXJCTL_CID', `0x800871d4')
+define(`IXJCTL_CIDCW', `0x400871d9')
+define(`IXJCTL_DAA_AGAIN', `0x400471d2')
+define(`IXJCTL_DAA_COEFF_SET', `0x400471d0')
+define(`IXJCTL_DRYBUFFER_CLEAR', `0x000071e7')
+define(`IXJCTL_DRYBUFFER_READ', `0x800871e6')
+define(`IXJCTL_DSP_IDLE', `0x000071c5')
+define(`IXJCTL_DSP_RESET', `0x000071c0')
+define(`IXJCTL_DSP_TYPE', `0x800471c3')
+define(`IXJCTL_DSP_VERSION', `0x800471c4')
+define(`IXJCTL_DTMF_PRESCALE', `0x400471e8')
+define(`IXJCTL_FILTER_CADENCE', `0x400871d6')
+define(`IXJCTL_FRAMES_READ', `0x800871e2')
+define(`IXJCTL_FRAMES_WRITTEN', `0x800871e3')
+define(`IXJCTL_GET_FILTER_HIST', `0x400471c8')
+define(`IXJCTL_HZ', `0x400471e0')
+define(`IXJCTL_INIT_TONE', `0x400871c9')
+define(`IXJCTL_INTERCOM_START', `0x400471fd')
+define(`IXJCTL_INTERCOM_STOP', `0x400471fe')
+define(`IXJCTL_MIXER', `0x400471cf')
+define(`IXJCTL_PLAY_CID', `0x000071d7')
+define(`IXJCTL_PORT', `0x400471d1')
+define(`IXJCTL_POTS_PSTN', `0x400471d5')
+define(`IXJCTL_PSTN_LINETEST', `0x000071d3')
+define(`IXJCTL_RATE', `0x400471e1')
+define(`IXJCTL_READ_WAIT', `0x800871e4')
+define(`IXJCTL_SC_RXG', `0x400471ea')
+define(`IXJCTL_SC_TXG', `0x400471eb')
+define(`IXJCTL_SERIAL', `0x800471c2')
+define(`IXJCTL_SET_FILTER', `0x400871c7')
+define(`IXJCTL_SET_FILTER_RAW', `0x400871dd')
+define(`IXJCTL_SET_LED', `0x400471ce')
+define(`IXJCTL_SIGCTL', `0x400871e9')
+define(`IXJCTL_TESTRAM', `0x000071c6')
+define(`IXJCTL_TONE_CADENCE', `0x400871ca')
+define(`IXJCTL_VERSION', `0x800871da')
+define(`IXJCTL_VMWI', `0x800471d8')
+define(`IXJCTL_WRITE_WAIT', `0x800871e5')
+define(`JSIOCGAXES', `0x80016a11')
+define(`JSIOCGAXMAP', `0x80406a32')
+define(`JSIOCGBTNMAP', `0x84006a34')
+define(`JSIOCGBUTTONS', `0x80016a12')
+define(`JSIOCGCORR', `0x80246a22')
+define(`JSIOCGVERSION', `0x80046a01')
+define(`JSIOCSAXMAP', `0x40406a31')
+define(`JSIOCSBTNMAP', `0x44006a33')
+define(`JSIOCSCORR', `0x40246a21')
+define(`KCOV_DISABLE', `0x00006365')
+define(`KCOV_ENABLE', `0x00006364')
+define(`KCOV_INIT_TRACE', `0x80086301')
+define(`KDADDIO', `0x00004b34')
+define(`KDDELIO', `0x00004b35')
+define(`KDDISABIO', `0x00004b37')
+define(`KDENABIO', `0x00004b36')
+define(`KDFONTOP', `0x00004b72')
+define(`KDGETKEYCODE', `0x00004b4c')
+define(`KDGETLED', `0x00004b31')
+define(`KDGETMODE', `0x00004b3b')
+define(`KDGKBDIACR', `0x00004b4a')
+define(`KDGKBDIACRUC', `0x00004bfa')
+define(`KDGKBENT', `0x00004b46')
+define(`KDGKBLED', `0x00004b64')
+define(`KDGKBMETA', `0x00004b62')
+define(`KDGKBMODE', `0x00004b44')
+define(`KDGKBSENT', `0x00004b48')
+define(`KDGKBTYPE', `0x00004b33')
+define(`KDKBDREP', `0x00004b52')
+define(`KDMAPDISP', `0x00004b3c')
+define(`KDMKTONE', `0x00004b30')
+define(`KDSETKEYCODE', `0x00004b4d')
+define(`KDSETLED', `0x00004b32')
+define(`KDSETMODE', `0x00004b3a')
+define(`KDSIGACCEPT', `0x00004b4e')
+define(`KDSKBDIACR', `0x00004b4b')
+define(`KDSKBDIACRUC', `0x00004bfb')
+define(`KDSKBENT', `0x00004b47')
+define(`KDSKBLED', `0x00004b65')
+define(`KDSKBMETA', `0x00004b63')
+define(`KDSKBMODE', `0x00004b45')
+define(`KDSKBSENT', `0x00004b49')
+define(`KDUNMAPDISP', `0x00004b3d')
+define(`KIOCSOUND', `0x00004b2f')
+define(`KVM_ALLOCATE_RMA', `0x8008aea9')
+define(`KVM_ARM_PREFERRED_TARGET', `0x8020aeaf')
+define(`KVM_ARM_SET_DEVICE_ADDR', `0x4010aeab')
+define(`KVM_ARM_VCPU_INIT', `0x4020aeae')
+define(`KVM_ASSIGN_DEV_IRQ', `0x4040ae70')
+define(`KVM_ASSIGN_PCI_DEVICE', `0x8040ae69')
+define(`KVM_ASSIGN_SET_INTX_MASK', `0x4040aea4')
+define(`KVM_ASSIGN_SET_MSIX_ENTRY', `0x4010ae74')
+define(`KVM_ASSIGN_SET_MSIX_NR', `0x4008ae73')
+define(`KVM_CHECK_EXTENSION', `0x0000ae03')
+define(`KVM_CREATE_DEVICE', `0xc00caee0')
+define(`KVM_CREATE_IRQCHIP', `0x0000ae60')
+define(`KVM_CREATE_PIT', `0x0000ae64')
+define(`KVM_CREATE_PIT2', `0x4040ae77')
+define(`KVM_CREATE_SPAPR_TCE', `0x400caea8')
+define(`KVM_CREATE_VCPU', `0x0000ae41')
+define(`KVM_CREATE_VM', `0x0000ae01')
+define(`KVM_DEASSIGN_DEV_IRQ', `0x4040ae75')
+define(`KVM_DEASSIGN_PCI_DEVICE', `0x4040ae72')
+define(`KVM_DIRTY_TLB', `0x4010aeaa')
+define(`KVM_ENABLE_CAP', `0x4068aea3')
+define(`KVM_GET_API_VERSION', `0x0000ae00')
+define(`KVM_GET_CLOCK', `0x8030ae7c')
+define(`KVM_GET_CPUID2', `0xc008ae91')
+define(`KVM_GET_DEBUGREGS', `0x8080aea1')
+define(`KVM_GET_DEVICE_ATTR', `0x4018aee2')
+define(`KVM_GET_DIRTY_LOG', `0x4010ae42')
+define(`KVM_GET_EMULATED_CPUID', `0xc008ae09')
+define(`KVM_GET_FPU', `0x81a0ae8c')
+define(`KVM_GET_IRQCHIP', `0xc208ae62')
+define(`KVM_GET_LAPIC', `0x8400ae8e')
+define(`KVM_GET_MP_STATE', `0x8004ae98')
+define(`KVM_GET_MSR_INDEX_LIST', `0xc004ae02')
+define(`KVM_GET_MSRS', `0xc008ae88')
+define(`KVM_GET_NR_MMU_PAGES', `0x0000ae45')
+define(`KVM_GET_ONE_REG', `0x4010aeab')
+define(`KVM_GET_PIT', `0xc048ae65')
+define(`KVM_GET_PIT2', `0x8070ae9f')
+define(`KVM_GET_REG_LIST', `0xc008aeb0')
+define(`KVM_GET_REGS', `0x8090ae81')
+define(`KVM_GET_SREGS', `0x8138ae83')
+define(`KVM_GET_SUPPORTED_CPUID', `0xc008ae05')
+define(`KVM_GET_TSC_KHZ', `0x0000aea3')
+define(`KVM_GET_VCPU_EVENTS', `0x8040ae9f')
+define(`KVM_GET_VCPU_MMAP_SIZE', `0x0000ae04')
+define(`KVM_GET_XCRS', `0x8188aea6')
+define(`KVM_GET_XSAVE', `0x9000aea4')
+define(`KVM_HAS_DEVICE_ATTR', `0x4018aee3')
+define(`KVM_INTERRUPT', `0x4004ae86')
+define(`KVM_IOEVENTFD', `0x4040ae79')
+define(`KVM_IRQFD', `0x4020ae76')
+define(`KVM_IRQ_LINE', `0x4008ae61')
+define(`KVM_IRQ_LINE_STATUS', `0xc008ae67')
+define(`KVM_KVMCLOCK_CTRL', `0x0000aead')
+define(`KVM_NMI', `0x0000ae9a')
+define(`KVM_PPC_ALLOCATE_HTAB', `0xc004aea7')
+define(`KVM_PPC_GET_HTAB_FD', `0x4020aeaa')
+define(`KVM_PPC_GET_PVINFO', `0x4080aea1')
+define(`KVM_PPC_GET_SMMU_INFO', `0x8250aea6')
+define(`KVM_PPC_RTAS_DEFINE_TOKEN', `0x4080aeac')
+define(`KVM_REGISTER_COALESCED_MMIO', `0x4010ae67')
+define(`KVM_REINJECT_CONTROL', `0x0000ae71')
+define(`KVM_RUN', `0x0000ae80')
+define(`KVM_S390_ENABLE_SIE', `0x0000ae06')
+define(`KVM_S390_INITIAL_RESET', `0x0000ae97')
+define(`KVM_S390_INTERRUPT', `0x4010ae94')
+define(`KVM_S390_SET_INITIAL_PSW', `0x4010ae96')
+define(`KVM_S390_STORE_STATUS', `0x4008ae95')
+define(`KVM_S390_UCAS_MAP', `0x4018ae50')
+define(`KVM_S390_UCAS_UNMAP', `0x4018ae51')
+define(`KVM_S390_VCPU_FAULT', `0x4008ae52')
+define(`KVM_SET_BOOT_CPU_ID', `0x0000ae78')
+define(`KVM_SET_CLOCK', `0x4030ae7b')
+define(`KVM_SET_CPUID', `0x4008ae8a')
+define(`KVM_SET_CPUID2', `0x4008ae90')
+define(`KVM_SET_DEBUGREGS', `0x4080aea2')
+define(`KVM_SET_DEVICE_ATTR', `0x4018aee1')
+define(`KVM_SET_FPU', `0x41a0ae8d')
+define(`KVM_SET_GSI_ROUTING', `0x4008ae6a')
+define(`KVM_SET_GUEST_DEBUG', `0x4048ae9b')
+define(`KVM_SET_IDENTITY_MAP_ADDR', `0x4008ae48')
+define(`KVM_SET_IRQCHIP', `0x8208ae63')
+define(`KVM_SET_LAPIC', `0x4400ae8f')
+define(`KVM_SET_MEMORY_ALIAS', `0x4020ae43')
+define(`KVM_SET_MEMORY_REGION', `0x4018ae40')
+define(`KVM_SET_MP_STATE', `0x4004ae99')
+define(`KVM_SET_MSRS', `0x4008ae89')
+define(`KVM_SET_NR_MMU_PAGES', `0x0000ae44')
+define(`KVM_SET_ONE_REG', `0x4010aeac')
+define(`KVM_SET_PIT', `0x8048ae66')
+define(`KVM_SET_PIT2', `0x4070aea0')
+define(`KVM_SET_REGS', `0x4090ae82')
+define(`KVM_SET_SIGNAL_MASK', `0x4004ae8b')
+define(`KVM_SET_SREGS', `0x4138ae84')
+define(`KVM_SET_TSC_KHZ', `0x0000aea2')
+define(`KVM_SET_TSS_ADDR', `0x0000ae47')
+define(`KVM_SET_USER_MEMORY_REGION', `0x4020ae46')
+define(`KVM_SET_VAPIC_ADDR', `0x4008ae93')
+define(`KVM_SET_VCPU_EVENTS', `0x4040aea0')
+define(`KVM_SET_XCRS', `0x4188aea7')
+define(`KVM_SET_XSAVE', `0x5000aea5')
+define(`KVM_SIGNAL_MSI', `0x4020aea5')
+define(`KVM_TPR_ACCESS_REPORTING', `0xc028ae92')
+define(`KVM_TRANSLATE', `0xc018ae85')
+define(`KVM_UNREGISTER_COALESCED_MMIO', `0x4010ae68')
+define(`KVM_X86_GET_MCE_CAP_SUPPORTED', `0x8008ae9d')
+define(`KVM_X86_SET_MCE', `0x4040ae9e')
+define(`KVM_X86_SETUP_MCE', `0x4008ae9c')
+define(`KVM_XEN_HVM_CONFIG', `0x4038ae7a')
+define(`KYRO_IOCTL_OVERLAY_CREATE', `0x00006b00')
+define(`KYRO_IOCTL_OVERLAY_OFFSET', `0x00006b04')
+define(`KYRO_IOCTL_OVERLAY_VIEWPORT_SET', `0x00006b01')
+define(`KYRO_IOCTL_SET_VIDEO_MODE', `0x00006b02')
+define(`KYRO_IOCTL_STRIDE', `0x00006b05')
+define(`KYRO_IOCTL_UVSTRIDE', `0x00006b03')
+define(`LIRC_GET_FEATURES', `0x80046900')
+define(`LIRC_GET_LENGTH', `0x8004690f')
+define(`LIRC_GET_MAX_FILTER_PULSE', `0x8004690b')
+define(`LIRC_GET_MAX_FILTER_SPACE', `0x8004690d')
+define(`LIRC_GET_MAX_TIMEOUT', `0x80046909')
+define(`LIRC_GET_MIN_FILTER_PULSE', `0x8004690a')
+define(`LIRC_GET_MIN_FILTER_SPACE', `0x8004690c')
+define(`LIRC_GET_MIN_TIMEOUT', `0x80046908')
+define(`LIRC_GET_REC_CARRIER', `0x80046904')
+define(`LIRC_GET_REC_DUTY_CYCLE', `0x80046906')
+define(`LIRC_GET_REC_MODE', `0x80046902')
+define(`LIRC_GET_REC_RESOLUTION', `0x80046907')
+define(`LIRC_GET_SEND_CARRIER', `0x80046903')
+define(`LIRC_GET_SEND_DUTY_CYCLE', `0x80046905')
+define(`LIRC_GET_SEND_MODE', `0x80046901')
+define(`LIRC_NOTIFY_DECODE', `0x00006920')
+define(`LIRC_SET_MEASURE_CARRIER_MODE', `0x4004691d')
+define(`LIRC_SET_REC_CARRIER', `0x40046914')
+define(`LIRC_SET_REC_CARRIER_RANGE', `0x4004691f')
+define(`LIRC_SET_REC_DUTY_CYCLE', `0x40046916')
+define(`LIRC_SET_REC_DUTY_CYCLE_RANGE', `0x4004691e')
+define(`LIRC_SET_REC_FILTER', `0x4004691c')
+define(`LIRC_SET_REC_FILTER_PULSE', `0x4004691a')
+define(`LIRC_SET_REC_FILTER_SPACE', `0x4004691b')
+define(`LIRC_SET_REC_MODE', `0x40046912')
+define(`LIRC_SET_REC_TIMEOUT', `0x40046918')
+define(`LIRC_SET_REC_TIMEOUT_REPORTS', `0x40046919')
+define(`LIRC_SET_SEND_CARRIER', `0x40046913')
+define(`LIRC_SET_SEND_DUTY_CYCLE', `0x40046915')
+define(`LIRC_SET_SEND_MODE', `0x40046911')
+define(`LIRC_SET_TRANSMITTER_MASK', `0x40046917')
+define(`LIRC_SETUP_END', `0x00006922')
+define(`LIRC_SETUP_START', `0x00006921')
+define(`LIRC_SET_WIDEBAND_RECEIVER', `0x40046923')
+define(`LOGGER_FLUSH_LOG', `0x0000ae04')
+define(`LOGGER_GET_LOG_BUF_SIZE', `0x0000ae01')
+define(`LOGGER_GET_LOG_LEN', `0x0000ae02')
+define(`LOGGER_GET_NEXT_ENTRY_LEN', `0x0000ae03')
+define(`LOGGER_GET_VERSION', `0x0000ae05')
+define(`LOGGER_SET_VERSION', `0x0000ae06')
+define(`LOOP_CHANGE_FD', `0x00004c06')
+define(`LOOP_CLR_FD', `0x00004c01')
+define(`LOOP_CONFIGURE', `0x00004c0a')
+define(`LOOP_CTL_ADD', `0x00004c80')
+define(`LOOP_CTL_GET_FREE', `0x00004c82')
+define(`LOOP_CTL_REMOVE', `0x00004c81')
+define(`LOOP_GET_STATUS', `0x00004c03')
+define(`LOOP_GET_STATUS64', `0x00004c05')
+define(`LOOP_SET_BLOCK_SIZE', `0x00004c09')
+define(`LOOP_SET_CAPACITY', `0x00004c07')
+define(`LOOP_SET_DIRECT_IO', `0x00004c08')
+define(`LOOP_SET_FD', `0x00004c00')
+define(`LOOP_SET_STATUS', `0x00004c02')
+define(`LOOP_SET_STATUS64', `0x00004c04')
+define(`MATROXFB_GET_ALL_OUTPUTS', `0x80086efb')
+define(`MATROXFB_GET_AVAILABLE_OUTPUTS', `0x80086ef9')
+define(`MATROXFB_GET_OUTPUT_CONNECTION', `0x80086ef8')
+define(`MATROXFB_GET_OUTPUT_MODE', `0xc0086efa')
+define(`MATROXFB_SET_OUTPUT_CONNECTION', `0x40086ef8')
+define(`MATROXFB_SET_OUTPUT_MODE', `0x40086efa')
+define(`MBXFB_IOCG_ALPHA', `0x8018f401')
+define(`MBXFB_IOCS_ALPHA', `0x4018f402')
+define(`MBXFB_IOCS_PLANEORDER', `0x8002f403')
+define(`MBXFB_IOCS_REG', `0x400cf404')
+define(`MBXFB_IOCX_OVERLAY', `0xc030f400')
+define(`MBXFB_IOCX_REG', `0xc00cf405')
+define(`MCE_GETCLEAR_FLAGS', `0x80044d03')
+define(`MCE_GET_LOG_LEN', `0x80044d02')
+define(`MCE_GET_RECORD_LEN', `0x80044d01')
+define(`MEDIA_IOC_DEVICE_INFO', `0xc1007c00')
+define(`MEDIA_IOC_ENUM_ENTITIES', `0xc1007c01')
+define(`MEDIA_IOC_ENUM_LINKS', `0xc0287c02')
+define(`MEDIA_IOC_SETUP_LINK', `0xc0347c03')
+define(`MEMERASE', `0x40084d02')
+define(`MEMERASE64', `0x40104d14')
+define(`MEMGETBADBLOCK', `0x40084d0b')
+define(`MEMGETINFO', `0x80204d01')
+define(`MEMGETOOBSEL', `0x80c84d0a')
+define(`MEMGETREGIONCOUNT', `0x80044d07')
+define(`MEMGETREGIONINFO', `0xc0104d08')
+define(`MEMISLOCKED', `0x80084d17')
+define(`MEMLOCK', `0x40084d05')
+define(`MEMREADOOB', `0xc0104d04')
+define(`MEMREADOOB64', `0xc0184d16')
+define(`MEMSETBADBLOCK', `0x40084d0c')
+define(`MEMUNLOCK', `0x40084d06')
+define(`MEMWRITE', `0xc0304d18')
+define(`MEMWRITEOOB', `0xc0104d03')
+define(`MEMWRITEOOB64', `0xc0184d15')
+define(`MEYEIOC_G_PARAMS', `0x800676c0')
+define(`MEYEIOC_QBUF_CAPT', `0x400476c2')
+define(`MEYEIOC_S_PARAMS', `0x400676c1')
+define(`MEYEIOC_STILLCAPT', `0x000076c4')
+define(`MEYEIOC_STILLJCAPT', `0x800476c5')
+define(`MEYEIOC_SYNC', `0xc00476c3')
+define(`MFB_GET_ALPHA', `0x80014d00')
+define(`MFB_GET_AOID', `0x80084d04')
+define(`MFB_GET_GAMMA', `0x80014d01')
+define(`MFB_GET_PIXFMT', `0x80044d08')
+define(`MFB_SET_ALPHA', `0x40014d00')
+define(`MFB_SET_AOID', `0x40084d04')
+define(`MFB_SET_BRIGHTNESS', `0x40014d03')
+define(`MFB_SET_CHROMA_KEY', `0x400c4d01')
+define(`MFB_SET_GAMMA', `0x40014d01')
+define(`MFB_SET_PIXFMT', `0x40044d08')
+define(`MGSL_IOCCLRMODCOUNT', `0x00006d0f')
+define(`MGSL_IOCGGPIO', `0x80106d11')
+define(`MGSL_IOCGIF', `0x00006d0b')
+define(`MGSL_IOCGPARAMS', `0x80306d01')
+define(`MGSL_IOCGSTATS', `0x00006d07')
+define(`MGSL_IOCGTXIDLE', `0x00006d03')
+define(`MGSL_IOCGXCTRL', `0x00006d16')
+define(`MGSL_IOCGXSYNC', `0x00006d14')
+define(`MGSL_IOCLOOPTXDONE', `0x00006d09')
+define(`MGSL_IOCRXENABLE', `0x00006d05')
+define(`MGSL_IOCSGPIO', `0x40106d10')
+define(`MGSL_IOCSIF', `0x00006d0a')
+define(`MGSL_IOCSPARAMS', `0x40306d00')
+define(`MGSL_IOCSTXIDLE', `0x00006d02')
+define(`MGSL_IOCSXCTRL', `0x00006d15')
+define(`MGSL_IOCSXSYNC', `0x00006d13')
+define(`MGSL_IOCTXABORT', `0x00006d06')
+define(`MGSL_IOCTXENABLE', `0x00006d04')
+define(`MGSL_IOCWAITEVENT', `0xc0046d08')
+define(`MGSL_IOCWAITGPIO', `0xc0106d12')
+define(`MIC_VIRTIO_ADD_DEVICE', `0xc0087301')
+define(`MIC_VIRTIO_CONFIG_CHANGE', `0xc0087305')
+define(`MIC_VIRTIO_COPY_DESC', `0xc0087302')
+define(`MMC_IOC_CMD', `0xc048b300')
+define(`MMTIMER_GETBITS', `0x00006d04')
+define(`MMTIMER_GETCOUNTER', `0x80086d09')
+define(`MMTIMER_GETFREQ', `0x80086d02')
+define(`MMTIMER_GETOFFSET', `0x00006d00')
+define(`MMTIMER_GETRES', `0x80086d01')
+define(`MMTIMER_MMAPAVAIL', `0x00006d06')
+define(`MSMFB_BLIT', `0x40046d02')
+define(`MSMFB_GRP_DISP', `0x40046d01')
+define(`MTDFILEMODE', `0x00004d13')
+define(`MTIOCGET', `0x80306d02')
+define(`MTIOCPOS', `0x80086d03')
+define(`MTIOCTOP', `0x40086d01')
+define(`MTRRIOC_ADD_ENTRY', `0x40104d00')
+define(`MTRRIOC_ADD_PAGE_ENTRY', `0x40104d05')
+define(`MTRRIOC_DEL_ENTRY', `0x40104d02')
+define(`MTRRIOC_DEL_PAGE_ENTRY', `0x40104d07')
+define(`MTRRIOC_GET_ENTRY', `0xc0184d03')
+define(`MTRRIOC_GET_PAGE_ENTRY', `0xc0184d08')
+define(`MTRRIOC_KILL_ENTRY', `0x40104d04')
+define(`MTRRIOC_KILL_PAGE_ENTRY', `0x40104d09')
+define(`MTRRIOC_SET_ENTRY', `0x40104d01')
+define(`MTRRIOC_SET_PAGE_ENTRY', `0x40104d06')
+define(`NBD_CLEAR_QUE', `0x0000ab05')
+define(`NBD_CLEAR_SOCK', `0x0000ab04')
+define(`NBD_DISCONNECT', `0x0000ab08')
+define(`NBD_DO_IT', `0x0000ab03')
+define(`NBD_PRINT_DEBUG', `0x0000ab06')
+define(`NBD_SET_BLKSIZE', `0x0000ab01')
+define(`NBD_SET_FLAGS', `0x0000ab0a')
+define(`NBD_SET_SIZE', `0x0000ab02')
+define(`NBD_SET_SIZE_BLOCKS', `0x0000ab07')
+define(`NBD_SET_SOCK', `0x0000ab00')
+define(`NBD_SET_TIMEOUT', `0x0000ab09')
+define(`NCP_IOC_CONN_LOGGED_IN', `0x00006e03')
+define(`NCP_IOC_GETCHARSETS', `0xc02a6e0b')
+define(`NCP_IOC_GETDENTRYTTL', `0x40046e0c')
+define(`NCP_IOC_GET_FS_INFO', `0xc0286e04')
+define(`NCP_IOC_GET_FS_INFO_V2', `0xc0306e04')
+define(`NCP_IOC_GETMOUNTUID', `0x40026e02')
+define(`NCP_IOC_GETMOUNTUID2', `0x40086e02')
+define(`NCP_IOC_GETOBJECTNAME', `0xc0186e09')
+define(`NCP_IOC_GETPRIVATEDATA', `0xc0106e0a')
+define(`NCP_IOC_GETROOT', `0x400c6e08')
+define(`NCP_IOC_LOCKUNLOCK', `0x80146e07')
+define(`NCP_IOC_NCPREQUEST', `0x80106e01')
+define(`NCP_IOC_SETCHARSETS', `0x802a6e0b')
+define(`NCP_IOC_SETDENTRYTTL', `0x80046e0c')
+define(`NCP_IOC_SETOBJECTNAME', `0x80186e09')
+define(`NCP_IOC_SETPRIVATEDATA', `0x80106e0a')
+define(`NCP_IOC_SETROOT', `0x800c6e08')
+define(`NCP_IOC_SET_SIGN_WANTED', `0x40046e06')
+define(`NCP_IOC_SIGN_INIT', `0x80186e05')
+define(`NCP_IOC_SIGN_WANTED', `0x80046e06')
+define(`NET_ADD_IF', `0xc0066f34')
+define(`NET_GET_IF', `0xc0066f36')
+define(`NET_REMOVE_IF', `0x00006f35')
+define(`NILFS_IOCTL_CHANGE_CPMODE', `0x40106e80')
+define(`NILFS_IOCTL_CLEAN_SEGMENTS', `0x40786e88')
+define(`NILFS_IOCTL_DELETE_CHECKPOINT', `0x40086e81')
+define(`NILFS_IOCTL_GET_BDESCS', `0xc0186e87')
+define(`NILFS_IOCTL_GET_CPINFO', `0x80186e82')
+define(`NILFS_IOCTL_GET_CPSTAT', `0x80186e83')
+define(`NILFS_IOCTL_GET_SUINFO', `0x80186e84')
+define(`NILFS_IOCTL_GET_SUSTAT', `0x80306e85')
+define(`NILFS_IOCTL_GET_VINFO', `0xc0186e86')
+define(`NILFS_IOCTL_RESIZE', `0x40086e8b')
+define(`NILFS_IOCTL_SET_ALLOC_RANGE', `0x40106e8c')
+define(`NILFS_IOCTL_SET_SUINFO', `0x40186e8d')
+define(`NILFS_IOCTL_SYNC', `0x80086e8a')
+define(`NS_ADJBUFLEV', `0x00006163')
+define(`NS_GETPSTAT', `0xc0106161')
+define(`NS_SETBUFLEV', `0x40106162')
+define(`NVME_IOCTL_ADMIN_CMD', `0xc0484e41')
+define(`NVME_IOCTL_ID', `0x00004e40')
+define(`NVME_IOCTL_IO_CMD', `0xc0484e43')
+define(`NVME_IOCTL_SUBMIT_IO', `0x40304e42')
+define(`NVRAM_INIT', `0x00007040')
+define(`NVRAM_SETCKS', `0x00007041')
+define(`OLD_PHONE_RING_START', `0x00007187')
+define(`OMAPFB_CTRL_TEST', `0x40044f2e')
+define(`OMAPFB_GET_CAPS', `0x800c4f2a')
+define(`OMAPFB_GET_COLOR_KEY', `0x40104f33')
+define(`OMAPFB_GET_DISPLAY_INFO', `0x80204f3f')
+define(`OMAPFB_GET_OVERLAY_COLORMODE', `0x803c4f3b')
+define(`OMAPFB_GET_UPDATE_MODE', `0x40044f2b')
+define(`OMAPFB_GET_VRAM_INFO', `0x80204f3d')
+define(`OMAPFB_LCD_TEST', `0x40044f2d')
+define(`OMAPFB_MEMORY_READ', `0x80184f3a')
+define(`OMAPFB_MIRROR', `0x40044f1f')
+define(`OMAPFB_QUERY_MEM', `0x40084f38')
+define(`OMAPFB_QUERY_PLANE', `0x40444f35')
+define(`OMAPFB_SET_COLOR_KEY', `0x40104f32')
+define(`OMAPFB_SET_TEARSYNC', `0x40084f3e')
+define(`OMAPFB_SET_UPDATE_MODE', `0x40044f28')
+define(`OMAPFB_SETUP_MEM', `0x40084f37')
+define(`OMAPFB_SETUP_PLANE', `0x40444f34')
+define(`OMAPFB_SYNC_GFX', `0x00004f25')
+define(`OMAPFB_UPDATE_WINDOW', `0x40444f36')
+define(`OMAPFB_UPDATE_WINDOW_OLD', `0x40144f2f')
+define(`OMAPFB_VSYNC', `0x00004f26')
+define(`OMAPFB_WAITFORGO', `0x00004f3c')
+define(`OMAPFB_WAITFORVSYNC', `0x00004f39')
+define(`OSD_GET_CAPABILITY', `0x80106fa1')
+define(`OSD_SEND_CMD', `0x40206fa0')
+define(`OSIOCGNETADDR', `0x800489e1')
+define(`OSIOCSNETADDR', `0x400489e0')
+define(`OSS_GETVERSION', `0x80044d76')
+define(`OTPGETREGIONCOUNT', `0x40044d0e')
+define(`OTPGETREGIONINFO', `0x400c4d0f')
+define(`OTPLOCK', `0x800c4d10')
+define(`OTPSELECT', `0x80044d0d')
+define(`PACKET_CTRL_CMD', `0xc0185801')
+define(`PERF_EVENT_IOC_DISABLE', `0x00002401')
+define(`PERF_EVENT_IOC_ENABLE', `0x00002400')
+define(`PERF_EVENT_IOC_ID', `0x80082407')
+define(`PERF_EVENT_IOC_PERIOD', `0x40082404')
+define(`PERF_EVENT_IOC_REFRESH', `0x00002402')
+define(`PERF_EVENT_IOC_RESET', `0x00002403')
+define(`PERF_EVENT_IOC_SET_FILTER', `0x40082406')
+define(`PERF_EVENT_IOC_SET_OUTPUT', `0x00002405')
+define(`PHN_GET_REG', `0xc0087000')
+define(`PHN_GETREG', `0xc0087005')
+define(`PHN_GET_REGS', `0xc0087002')
+define(`PHN_GETREGS', `0xc0287007')
+define(`PHN_NOT_OH', `0x00007004')
+define(`PHN_SET_REG', `0x40087001')
+define(`PHN_SETREG', `0x40087006')
+define(`PHN_SET_REGS', `0x40087003')
+define(`PHN_SETREGS', `0x40287008')
+define(`PHONE_BUSY', `0x000071a1')
+define(`PHONE_CAPABILITIES', `0x00007180')
+define(`PHONE_CAPABILITIES_CHECK', `0x40087182')
+define(`PHONE_CAPABILITIES_LIST', `0x80087181')
+define(`PHONE_CPT_STOP', `0x000071a4')
+define(`PHONE_DIALTONE', `0x000071a3')
+define(`PHONE_DTMF_OOB', `0x40047199')
+define(`PHONE_DTMF_READY', `0x80047196')
+define(`PHONE_EXCEPTION', `0x8004719a')
+define(`PHONE_FRAME', `0x4004718d')
+define(`PHONE_GET_DTMF', `0x80047197')
+define(`PHONE_GET_DTMF_ASCII', `0x80047198')
+define(`PHONE_GET_TONE_OFF_TIME', `0x0000719f')
+define(`PHONE_GET_TONE_ON_TIME', `0x0000719e')
+define(`PHONE_GET_TONE_STATE', `0x000071a0')
+define(`PHONE_HOOKSTATE', `0x00007184')
+define(`PHONE_MAXRINGS', `0x40017185')
+define(`PHONE_PLAY_CODEC', `0x40047190')
+define(`PHONE_PLAY_DEPTH', `0x40047193')
+define(`PHONE_PLAY_LEVEL', `0x00007195')
+define(`PHONE_PLAY_START', `0x00007191')
+define(`PHONE_PLAY_STOP', `0x00007192')
+define(`PHONE_PLAY_TONE', `0x4001719b')
+define(`PHONE_PLAY_VOLUME', `0x40047194')
+define(`PHONE_PLAY_VOLUME_LINEAR', `0x400471dc')
+define(`PHONE_PSTN_GET_STATE', `0x000071a5')
+define(`PHONE_PSTN_LINETEST', `0x000071a8')
+define(`PHONE_PSTN_SET_STATE', `0x400471a4')
+define(`PHONE_QUERY_CODEC', `0xc00871a7')
+define(`PHONE_REC_CODEC', `0x40047189')
+define(`PHONE_REC_DEPTH', `0x4004718c')
+define(`PHONE_REC_LEVEL', `0x0000718f')
+define(`PHONE_REC_START', `0x0000718a')
+define(`PHONE_REC_STOP', `0x0000718b')
+define(`PHONE_REC_VOLUME', `0x4004718e')
+define(`PHONE_REC_VOLUME_LINEAR', `0x400471db')
+define(`PHONE_RING', `0x00007183')
+define(`PHONE_RINGBACK', `0x000071a2')
+define(`PHONE_RING_CADENCE', `0x40027186')
+define(`PHONE_RING_START', `0x40087187')
+define(`PHONE_RING_STOP', `0x00007188')
+define(`PHONE_SET_TONE_OFF_TIME', `0x4004719d')
+define(`PHONE_SET_TONE_ON_TIME', `0x4004719c')
+define(`PHONE_VAD', `0x400471a9')
+define(`PHONE_WINK', `0x400471aa')
+define(`PHONE_WINK_DURATION', `0x400471a6')
+define(`PIO_CMAP', `0x00004b71')
+define(`PIO_FONT', `0x00004b61')
+define(`PIO_FONTRESET', `0x00004b6d')
+define(`PIO_FONTX', `0x00004b6c')
+define(`PIO_SCRNMAP', `0x00004b41')
+define(`PIO_UNIMAP', `0x00004b67')
+define(`PIO_UNIMAPCLR', `0x00004b68')
+define(`PIO_UNISCRNMAP', `0x00004b6a')
+define(`PMU_IOC_CAN_SLEEP', `0x80084205')
+define(`PMU_IOC_GET_BACKLIGHT', `0x80084201')
+define(`PMU_IOC_GET_MODEL', `0x80084203')
+define(`PMU_IOC_GRAB_BACKLIGHT', `0x80084206')
+define(`PMU_IOC_HAS_ADB', `0x80084204')
+define(`PMU_IOC_SET_BACKLIGHT', `0x40084202')
+define(`PMU_IOC_SLEEP', `0x00004200')
+define(`PPCLAIM', `0x0000708b')
+define(`PPCLRIRQ', `0x80047093')
+define(`PPDATADIR', `0x40047090')
+define(`PPEXCL', `0x0000708f')
+define(`PPFCONTROL', `0x4002708e')
+define(`PPGETFLAGS', `0x8004709a')
+define(`PPGETMODE', `0x80047098')
+define(`PPGETMODES', `0x80047097')
+define(`PPGETPHASE', `0x80047099')
+define(`PPGETTIME', `0x80107095')
+define(`PPNEGOT', `0x40047091')
+define(`PPPIOCATTACH', `0x743d')
+define(`PPPIOCATTCHAN', `0x7438')
+define(`PPPIOCBUNDLE', `0x7481')
+define(`PPPIOCCONNECT', `0x743a')
+define(`PPPIOCDETACH', `0x743c')
+define(`PPPIOCDISCONN', `0x7439')
+define(`PPPIOCGASYNCMAP', `0x7458')
+define(`PPPIOCGCALLINFO', `0x7480')
+define(`PPPIOCGCHAN', `0x7437')
+define(`PPPIOCGCOMPRESSORS', `0x7486')
+define(`PPPIOCGDEBUG', `0x7441')
+define(`PPPIOCGFLAGS', `0x745a')
+define(`PPPIOCGIDLE', `0x743f')
+define(`PPPIOCGIFNAME', `0x7488')
+define(`PPPIOCGL2TPSTATS', `0x7436')
+define(`PPPIOCGMPFLAGS', `0x7482')
+define(`PPPIOCGMRU', `0x7453')
+define(`PPPIOCGNPMODE', `0x744c')
+define(`PPPIOCGRASYNCMAP', `0x7455')
+define(`PPPIOCGUNIT', `0x7456')
+define(`PPPIOCGXASYNCMAP', `0x7450')
+define(`PPPIOCNEWUNIT', `0x743e')
+define(`PPPIOCSACTIVE', `0x7446')
+define(`PPPIOCSASYNCMAP', `0x7457')
+define(`PPPIOCSCOMPRESS', `0x744d')
+define(`PPPIOCSCOMPRESSOR', `0x7487')
+define(`PPPIOCSDEBUG', `0x7440')
+define(`PPPIOCSFLAGS', `0x7459')
+define(`PPPIOCSMAXCID', `0x7451')
+define(`PPPIOCSMPFLAGS', `0x7483')
+define(`PPPIOCSMPMRU', `0x7485')
+define(`PPPIOCSMPMTU', `0x7484')
+define(`PPPIOCSMRRU', `0x743b')
+define(`PPPIOCSMRU', `0x7452')
+define(`PPPIOCSNPMODE', `0x744b')
+define(`PPPIOCSPASS', `0x7447')
+define(`PPPIOCSRASYNCMAP', `0x7454')
+define(`PPPIOCSXASYNCMAP', `0x744f')
+define(`PPPIOCXFERUNIT', `0x744e')
+define(`PPPOEIOCDFWD', `0x0000b101')
+define(`PPPOEIOCSFWD', `0x4008b100')
+define(`PPRCONTROL', `0x80017083')
+define(`PPRDATA', `0x80017085')
+define(`PPRELEASE', `0x0000708c')
+define(`PPRSTATUS', `0x80017081')
+define(`PPSETFLAGS', `0x4004709b')
+define(`PPSETMODE', `0x40047080')
+define(`PPSETPHASE', `0x40047094')
+define(`PPSETTIME', `0x40107096')
+define(`PPS_FETCH', `0xc00870a4')
+define(`PPS_GETCAP', `0x800870a3')
+define(`PPS_GETPARAMS', `0x800870a1')
+define(`PPS_KC_BIND', `0x400870a5')
+define(`PPS_SETPARAMS', `0x400870a2')
+define(`PPWCONTROL', `0x40017084')
+define(`PPWCTLONIRQ', `0x40017092')
+define(`PPWDATA', `0x40017086')
+define(`PPYIELD', `0x0000708d')
+define(`PROTECT_ARRAY', `0x00000927')
+define(`PTP_CLOCK_GETCAPS', `0x80503d01')
+define(`PTP_ENABLE_PPS', `0x40043d04')
+define(`PTP_EXTTS_REQUEST', `0x40103d02')
+define(`PTP_PEROUT_REQUEST', `0x40383d03')
+define(`PTP_PIN_GETFUNC', `0xc0603d06')
+define(`PTP_PIN_SETFUNC', `0x40603d07')
+define(`PTP_SYS_OFFSET', `0x43403d05')
+define(`RAID_AUTORUN', `0x00000914')
+define(`RAID_VERSION', `0x800c0910')
+define(`RAW_GETBIND', `0x0000ac01')
+define(`RAW_SETBIND', `0x0000ac00')
+define(`REISERFS_IOC_UNPACK', `0x4008cd01')
+define(`RESTART_ARRAY_RW', `0x00000934')
+define(`RFCOMMCREATEDEV', `0x400452c8')
+define(`RFCOMMGETDEVINFO', `0x800452d3')
+define(`RFCOMMGETDEVLIST', `0x800452d2')
+define(`RFCOMMRELEASEDEV', `0x400452c9')
+define(`RFCOMMSTEALDLC', `0x400452dc')
+define(`RFKILL_IOCTL_NOINPUT', `0x00005201')
+define(`RNDADDENTROPY', `0x40085203')
+define(`RNDADDTOENTCNT', `0x40045201')
+define(`RNDCLEARPOOL', `0x00005206')
+define(`RNDGETENTCNT', `0x80045200')
+define(`RNDGETPOOL', `0x80085202')
+define(`RNDZAPENTCNT', `0x00005204')
+define(`ROCCATIOCGREPSIZE', `0x800448f1')
+define(`RTC_AIE_OFF', `0x00007002')
+define(`RTC_AIE_ON', `0x00007001')
+define(`RTC_ALM_READ', `0x80247008')
+define(`RTC_ALM_SET', `0x40247007')
+define(`RTC_EPOCH_READ', `0x8008700d')
+define(`RTC_EPOCH_SET', `0x4008700e')
+define(`RTC_IRQP_READ', `0x8008700b')
+define(`RTC_IRQP_SET', `0x4008700c')
+define(`RTC_PIE_OFF', `0x00007006')
+define(`RTC_PIE_ON', `0x00007005')
+define(`RTC_PLL_GET', `0x80207011')
+define(`RTC_PLL_SET', `0x40207012')
+define(`RTC_RD_TIME', `0x80247009')
+define(`RTC_SET_TIME', `0x4024700a')
+define(`RTC_UIE_OFF', `0x00007004')
+define(`RTC_UIE_ON', `0x00007003')
+define(`RTC_VL_CLR', `0x00007014')
+define(`RTC_VL_READ', `0x80047013')
+define(`RTC_WIE_OFF', `0x00007010')
+define(`RTC_WIE_ON', `0x0000700f')
+define(`RTC_WKALM_RD', `0x80287010')
+define(`RTC_WKALM_SET', `0x4028700f')
+define(`RUN_ARRAY', `0x400c0930')
+define(`S5P_FIMC_TX_END_NOTIFY', `0x00006500')
+define(`SAA6588_CMD_CLOSE', `0x40045202')
+define(`SAA6588_CMD_POLL', `0x80045204')
+define(`SAA6588_CMD_READ', `0x80045203')
+define(`SCSI_IOCTL_DOORLOCK', `0x00005380')
+define(`SCSI_IOCTL_DOORUNLOCK', `0x00005381')
+define(`SCSI_IOCTL_GET_BUS_NUMBER', `0x00005386')
+define(`SCSI_IOCTL_GET_IDLUN', `0x00005382')
+define(`SCSI_IOCTL_GET_PCI', `0x00005387')
+define(`SCSI_IOCTL_PROBE_HOST', `0x00005385')
+define(`SET_ARRAY_INFO', `0x40480923')
+define(`SET_BITMAP_FILE', `0x4004092b')
+define(`SET_DISK_FAULTY', `0x00000929')
+define(`SET_DISK_INFO', `0x00000924')
+define(`SG_EMULATED_HOST', `0x00002203')
+define(`SG_GET_ACCESS_COUNT', `0x00002289')
+define(`SG_GET_COMMAND_Q', `0x00002270')
+define(`SG_GET_KEEP_ORPHAN', `0x00002288')
+define(`SG_GET_LOW_DMA', `0x0000227a')
+define(`SG_GET_NUM_WAITING', `0x0000227d')
+define(`SG_GET_PACK_ID', `0x0000227c')
+define(`SG_GET_REQUEST_TABLE', `0x00002286')
+define(`SG_GET_RESERVED_SIZE', `0x00002272')
+define(`SG_GET_SCSI_ID', `0x00002276')
+define(`SG_GET_SG_TABLESIZE', `0x0000227f')
+define(`SG_GET_TIMEOUT', `0x00002202')
+define(`SG_GET_TRANSFORM', `0x00002205')
+define(`SG_GET_VERSION_NUM', `0x00002282')
+define(`SG_IO', `0x00002285')
+define(`SG_NEXT_CMD_LEN', `0x00002283')
+define(`SG_SCSI_RESET', `0x00002284')
+define(`SG_SET_COMMAND_Q', `0x00002271')
+define(`SG_SET_DEBUG', `0x0000227e')
+define(`SG_SET_FORCE_LOW_DMA', `0x00002279')
+define(`SG_SET_FORCE_PACK_ID', `0x0000227b')
+define(`SG_SET_KEEP_ORPHAN', `0x00002287')
+define(`SG_SET_RESERVED_SIZE', `0x00002275')
+define(`SG_SET_TIMEOUT', `0x00002201')
+define(`SG_SET_TRANSFORM', `0x00002204')
+define(`SI4713_IOC_MEASURE_RNL', `0xc01c56c0')
+define(`SIOCADDDLCI', `0x00008980')
+define(`SIOCADDMULTI', `0x00008931')
+define(`SIOCADDRT', `0x0000890b')
+define(`SIOCATMARK', `0x00008905')
+define(`SIOCBONDCHANGEACTIVE', `0x00008995')
+define(`SIOCBONDENSLAVE', `0x00008990')
+define(`SIOCBONDINFOQUERY', `0x00008994')
+define(`SIOCBONDRELEASE', `0x00008991')
+define(`SIOCBONDSETHWADDR', `0x00008992')
+define(`SIOCBONDSLAVEINFOQUERY', `0x00008993')
+define(`SIOCBRADDBR', `0x000089a0')
+define(`SIOCBRADDIF', `0x000089a2')
+define(`SIOCBRDELBR', `0x000089a1')
+define(`SIOCBRDELIF', `0x000089a3')
+define(`SIOCDARP', `0x00008953')
+define(`SIOCDELDLCI', `0x00008981')
+define(`SIOCDELMULTI', `0x00008932')
+define(`SIOCDELRT', `0x0000890c')
+define(`SIOCDEVPRIVATE', `0x000089f0')
+define(`SIOCDEVPRIVATE_1', `0x000089f1')
+define(`SIOCDEVPRIVATE_2', `0x000089f2')
+define(`SIOCDEVPRIVATE_3', `0x000089f3')
+define(`SIOCDEVPRIVATE_4', `0x000089f4')
+define(`SIOCDEVPRIVATE_5', `0x000089f5')
+define(`SIOCDEVPRIVATE_6', `0x000089f6')
+define(`SIOCDEVPRIVATE_7', `0x000089f7')
+define(`SIOCDEVPRIVATE_8', `0x000089f8')
+define(`SIOCDEVPRIVATE_9', `0x000089f9')
+define(`SIOCDEVPRIVATE_A', `0x000089fa')
+define(`SIOCDEVPRIVATE_B', `0x000089fb')
+define(`SIOCDEVPRIVATE_C', `0x000089fc')
+define(`SIOCDEVPRIVATE_D', `0x000089fd')
+define(`SIOCDEVPRIVATE_E', `0x000089fe')
+define(`SIOCDEVPRIVLAST', `0x000089ff')
+define(`SIOCDIFADDR', `0x00008936')
+define(`SIOCDRARP', `0x00008960')
+define(`SIOCETHTOOL', `0x00008946')
+define(`SIOCGARP', `0x00008954')
+define(`SIOCGHWTSTAMP', `0x000089b1')
+define(`SIOCGIFADDR', `0x00008915')
+define(`SIOCGIFBR', `0x00008940')
+define(`SIOCGIFBRDADDR', `0x00008919')
+define(`SIOCGIFCONF', `0x00008912')
+define(`SIOCGIFCOUNT', `0x00008938')
+define(`SIOCGIFDSTADDR', `0x00008917')
+define(`SIOCGIFENCAP', `0x00008925')
+define(`SIOCGIFFLAGS', `0x00008913')
+define(`SIOCGIFHWADDR', `0x00008927')
+define(`SIOCGIFINDEX', `0x00008933')
+define(`SIOCGIFMAP', `0x00008970')
+define(`SIOCGIFMEM', `0x0000891f')
+define(`SIOCGIFMETRIC', `0x0000891d')
+define(`SIOCGIFMTU', `0x00008921')
+define(`SIOCGIFNAME', `0x00008910')
+define(`SIOCGIFNETMASK', `0x0000891b')
+define(`SIOCGIFPFLAGS', `0x00008935')
+define(`SIOCGIFSLAVE', `0x00008929')
+define(`SIOCGIFTXQLEN', `0x00008942')
+define(`SIOCGIFVLAN', `0x00008982')
+define(`SIOCGIWAP', `0x00008b15')
+define(`SIOCGIWAPLIST', `0x00008b17')
+define(`SIOCGIWAUTH', `0x00008b33')
+define(`SIOCGIWENCODE', `0x00008b2b')
+define(`SIOCGIWENCODEEXT', `0x00008b35')
+define(`SIOCGIWESSID', `0x00008b1b')
+define(`SIOCGIWFRAG', `0x00008b25')
+define(`SIOCGIWFREQ', `0x00008b05')
+define(`SIOCGIWGENIE', `0x00008b31')
+define(`SIOCGIWMODE', `0x00008b07')
+define(`SIOCGIWNAME', `0x00008b01')
+define(`SIOCGIWNICKN', `0x00008b1d')
+define(`SIOCGIWNWID', `0x00008b03')
+define(`SIOCGIWPOWER', `0x00008b2d')
+define(`SIOCGIWPRIV', `0x00008b0d')
+define(`SIOCGIWRANGE', `0x00008b0b')
+define(`SIOCGIWRATE', `0x00008b21')
+define(`SIOCGIWRETRY', `0x00008b29')
+define(`SIOCGIWRTS', `0x00008b23')
+define(`SIOCGIWSCAN', `0x00008b19')
+define(`SIOCGIWSENS', `0x00008b09')
+define(`SIOCGIWSPY', `0x00008b11')
+define(`SIOCGIWSTATS', `0x00008b0f')
+define(`SIOCGIWTHRSPY', `0x00008b13')
+define(`SIOCGIWTXPOW', `0x00008b27')
+define(`SIOCGMIIPHY', `0x00008947')
+define(`SIOCGMIIREG', `0x00008948')
+define(`SIOCGNETADDR', `0x800489e1')
+define(`SIOCGPGRP', `0x00008904')
+define(`SIOCGRARP', `0x00008961')
+define(`SIOCGSTAMP', `0x00008906')
+define(`SIOCGSTAMPNS', `0x00008907')
+define(`SIOCIWFIRST', `0x00008b00')
+define(`SIOCIWFIRSTPRIV_01', `0x00008be1')
+define(`SIOCIWFIRSTPRIV_02', `0x00008be2')
+define(`SIOCIWFIRSTPRIV_03', `0x00008be3')
+define(`SIOCIWFIRSTPRIV_04', `0x00008be4')
+define(`SIOCIWFIRSTPRIV_05', `0x00008be5')
+define(`SIOCIWFIRSTPRIV_06', `0x00008be6')
+define(`SIOCIWFIRSTPRIV_07', `0x00008be7')
+define(`SIOCIWFIRSTPRIV_08', `0x00008be8')
+define(`SIOCIWFIRSTPRIV_09', `0x00008be9')
+define(`SIOCIWFIRSTPRIV_0A', `0x00008bea')
+define(`SIOCIWFIRSTPRIV_0B', `0x00008beb')
+define(`SIOCIWFIRSTPRIV_0C', `0x00008bec')
+define(`SIOCIWFIRSTPRIV_0D', `0x00008bed')
+define(`SIOCIWFIRSTPRIV_0E', `0x00008bee')
+define(`SIOCIWFIRSTPRIV_0F', `0x00008bef')
+define(`SIOCIWFIRSTPRIV', `0x00008be0')
+define(`SIOCIWFIRSTPRIV_10', `0x00008bf0')
+define(`SIOCIWFIRSTPRIV_11', `0x00008bf1')
+define(`SIOCIWFIRSTPRIV_12', `0x00008bf2')
+define(`SIOCIWFIRSTPRIV_13', `0x00008bf3')
+define(`SIOCIWFIRSTPRIV_14', `0x00008bf4')
+define(`SIOCIWFIRSTPRIV_15', `0x00008bf5')
+define(`SIOCIWFIRSTPRIV_16', `0x00008bf6')
+define(`SIOCIWFIRSTPRIV_17', `0x00008bf7')
+define(`SIOCIWFIRSTPRIV_18', `0x00008bf8')
+define(`SIOCIWFIRSTPRIV_19', `0x00008bf9')
+define(`SIOCIWFIRSTPRIV_1A', `0x00008bfa')
+define(`SIOCIWFIRSTPRIV_1B', `0x00008bfb')
+define(`SIOCIWFIRSTPRIV_1C', `0x00008bfc')
+define(`SIOCIWFIRSTPRIV_1D', `0x00008bfd')
+define(`SIOCIWFIRSTPRIV_1E', `0x00008bfe')
+define(`SIOCIWLASTPRIV', `0x00008bff')
+define(`SIOCKILLADDR', `0x00008939')
+define(`SIOCMKCLIP', `0x000061e0')
+define(`SIOCOUTQNSD', `0x0000894b')
+define(`SIOCPROTOPRIVATE', `0x000089e0')
+define(`SIOCPROTOPRIVATE_1', `0x000089e1')
+define(`SIOCPROTOPRIVATE_2', `0x000089e2')
+define(`SIOCPROTOPRIVATE_3', `0x000089e3')
+define(`SIOCPROTOPRIVATE_4', `0x000089e4')
+define(`SIOCPROTOPRIVATE_5', `0x000089e5')
+define(`SIOCPROTOPRIVATE_6', `0x000089e6')
+define(`SIOCPROTOPRIVATE_7', `0x000089e7')
+define(`SIOCPROTOPRIVATE_8', `0x000089e8')
+define(`SIOCPROTOPRIVATE_9', `0x000089e9')
+define(`SIOCPROTOPRIVATE_A', `0x000089ea')
+define(`SIOCPROTOPRIVATE_B', `0x000089eb')
+define(`SIOCPROTOPRIVATE_C', `0x000089ec')
+define(`SIOCPROTOPRIVATE_D', `0x000089ed')
+define(`SIOCPROTOPRIVATE_E', `0x000089ee')
+define(`SIOCPROTOPRIVLAST', `0x000089ef')
+define(`SIOCRTMSG', `0x0000890d')
+define(`SIOCSARP', `0x00008955')
+define(`SIOCSHWTSTAMP', `0x000089b0')
+define(`SIOCSIFADDR', `0x00008916')
+define(`SIOCSIFATMTCP', `0x00006180')
+define(`SIOCSIFBR', `0x00008941')
+define(`SIOCSIFBRDADDR', `0x0000891a')
+define(`SIOCSIFDSTADDR', `0x00008918')
+define(`SIOCSIFENCAP', `0x00008926')
+define(`SIOCSIFFLAGS', `0x00008914')
+define(`SIOCSIFHWADDR', `0x00008924')
+define(`SIOCSIFHWBROADCAST', `0x00008937')
+define(`SIOCSIFLINK', `0x00008911')
+define(`SIOCSIFMAP', `0x00008971')
+define(`SIOCSIFMEM', `0x00008920')
+define(`SIOCSIFMETRIC', `0x0000891e')
+define(`SIOCSIFMTU', `0x00008922')
+define(`SIOCSIFNAME', `0x00008923')
+define(`SIOCSIFNETMASK', `0x0000891c')
+define(`SIOCSIFPFLAGS', `0x00008934')
+define(`SIOCSIFSLAVE', `0x00008930')
+define(`SIOCSIFTXQLEN', `0x00008943')
+define(`SIOCSIFVLAN', `0x00008983')
+define(`SIOCSIWAP', `0x00008b14')
+define(`SIOCSIWAUTH', `0x00008b32')
+define(`SIOCSIWCOMMIT', `0x00008b00')
+define(`SIOCSIWENCODE', `0x00008b2a')
+define(`SIOCSIWENCODEEXT', `0x00008b34')
+define(`SIOCSIWESSID', `0x00008b1a')
+define(`SIOCSIWFRAG', `0x00008b24')
+define(`SIOCSIWFREQ', `0x00008b04')
+define(`SIOCSIWGENIE', `0x00008b30')
+define(`SIOCSIWMLME', `0x00008b16')
+define(`SIOCSIWMODE', `0x00008b06')
+define(`SIOCSIWNICKN', `0x00008b1c')
+define(`SIOCSIWNWID', `0x00008b02')
+define(`SIOCSIWPMKSA', `0x00008b36')
+define(`SIOCSIWPOWER', `0x00008b2c')
+define(`SIOCSIWPRIV', `0x00008b0c')
+define(`SIOCSIWRANGE', `0x00008b0a')
+define(`SIOCSIWRATE', `0x00008b20')
+define(`SIOCSIWRETRY', `0x00008b28')
+define(`SIOCSIWRTS', `0x00008b22')
+define(`SIOCSIWSCAN', `0x00008b18')
+define(`SIOCSIWSENS', `0x00008b08')
+define(`SIOCSIWSPY', `0x00008b10')
+define(`SIOCSIWSTATS', `0x00008b0e')
+define(`SIOCSIWTHRSPY', `0x00008b12')
+define(`SIOCSIWTXPOW', `0x00008b26')
+define(`SIOCSMIIREG', `0x00008949')
+define(`SIOCSNETADDR', `0x400489e0')
+define(`SIOCSPGRP', `0x00008902')
+define(`SIOCSRARP', `0x00008962')
+define(`SIOCWANDEV', `0x0000894a')
+define(`SISFB_COMMAND', `0xc054f305')
+define(`SISFB_GET_AUTOMAXIMIZE', `0x8004f303')
+define(`SISFB_GET_AUTOMAXIMIZE_OLD', `0x80046efa')
+define(`SISFB_GET_INFO', `0x811cf301')
+define(`SISFB_GET_INFO_OLD', `0x80046ef8')
+define(`SISFB_GET_INFO_SIZE', `0x8004f300')
+define(`SISFB_GET_TVPOSOFFSET', `0x8004f304')
+define(`SISFB_GET_VBRSTATUS', `0x8004f302')
+define(`SISFB_GET_VBRSTATUS_OLD', `0x80046ef9')
+define(`SISFB_SET_AUTOMAXIMIZE', `0x4004f303')
+define(`SISFB_SET_AUTOMAXIMIZE_OLD', `0x40046efa')
+define(`SISFB_SET_LOCK', `0x4004f306')
+define(`SISFB_SET_TVPOSOFFSET', `0x4004f304')
+define(`SNAPSHOT_ALLOC_SWAP_PAGE', `0x80083314')
+define(`SNAPSHOT_ATOMIC_RESTORE', `0x00003304')
+define(`SNAPSHOT_AVAIL_SWAP_SIZE', `0x80083313')
+define(`SNAPSHOT_CREATE_IMAGE', `0x40043311')
+define(`SNAPSHOT_FREE', `0x00003305')
+define(`SNAPSHOT_FREE_SWAP_PAGES', `0x00003309')
+define(`SNAPSHOT_FREEZE', `0x00003301')
+define(`SNAPSHOT_GET_IMAGE_SIZE', `0x8008330e')
+define(`SNAPSHOT_PLATFORM_SUPPORT', `0x0000330f')
+define(`SNAPSHOT_POWER_OFF', `0x00003310')
+define(`SNAPSHOT_PREF_IMAGE_SIZE', `0x00003312')
+define(`SNAPSHOT_S2RAM', `0x0000330b')
+define(`SNAPSHOT_SET_SWAP_AREA', `0x400c330d')
+define(`SNAPSHOT_UNFREEZE', `0x00003302')
+define(`SNDCTL_COPR_HALT', `0xc0144307')
+define(`SNDCTL_COPR_LOAD', `0xcfb04301')
+define(`SNDCTL_COPR_RCODE', `0xc0144303')
+define(`SNDCTL_COPR_RCVMSG', `0x8fa44309')
+define(`SNDCTL_COPR_RDATA', `0xc0144302')
+define(`SNDCTL_COPR_RESET', `0x00004300')
+define(`SNDCTL_COPR_RUN', `0xc0144306')
+define(`SNDCTL_COPR_SENDMSG', `0xcfa44308')
+define(`SNDCTL_COPR_WCODE', `0x40144305')
+define(`SNDCTL_COPR_WDATA', `0x40144304')
+define(`SNDCTL_DSP_BIND_CHANNEL', `0xc0045041')
+define(`SNDCTL_DSP_CHANNELS', `0xc0045006')
+define(`SNDCTL_DSP_GETBLKSIZE', `0xc0045004')
+define(`SNDCTL_DSP_GETCAPS', `0x8004500f')
+define(`SNDCTL_DSP_GETCHANNELMASK', `0xc0045040')
+define(`SNDCTL_DSP_GETFMTS', `0x8004500b')
+define(`SNDCTL_DSP_GETIPTR', `0x800c5011')
+define(`SNDCTL_DSP_GETISPACE', `0x8010500d')
+define(`SNDCTL_DSP_GETODELAY', `0x80045017')
+define(`SNDCTL_DSP_GETOPTR', `0x800c5012')
+define(`SNDCTL_DSP_GETOSPACE', `0x8010500c')
+define(`SNDCTL_DSP_GETSPDIF', `0x80045043')
+define(`SNDCTL_DSP_GETTRIGGER', `0x80045010')
+define(`SNDCTL_DSP_MAPINBUF', `0x80105013')
+define(`SNDCTL_DSP_MAPOUTBUF', `0x80105014')
+define(`SNDCTL_DSP_NONBLOCK', `0x0000500e')
+define(`SNDCTL_DSP_POST', `0x00005008')
+define(`SNDCTL_DSP_PROFILE', `0x40045017')
+define(`SNDCTL_DSP_RESET', `0x00005000')
+define(`SNDCTL_DSP_SETDUPLEX', `0x00005016')
+define(`SNDCTL_DSP_SETFMT', `0xc0045005')
+define(`SNDCTL_DSP_SETFRAGMENT', `0xc004500a')
+define(`SNDCTL_DSP_SETSPDIF', `0x40045042')
+define(`SNDCTL_DSP_SETSYNCRO', `0x00005015')
+define(`SNDCTL_DSP_SETTRIGGER', `0x40045010')
+define(`SNDCTL_DSP_SPEED', `0xc0045002')
+define(`SNDCTL_DSP_STEREO', `0xc0045003')
+define(`SNDCTL_DSP_SUBDIVIDE', `0xc0045009')
+define(`SNDCTL_DSP_SYNC', `0x00005001')
+define(`SNDCTL_FM_4OP_ENABLE', `0x4004510f')
+define(`SNDCTL_FM_LOAD_INSTR', `0x40285107')
+define(`SNDCTL_MIDI_INFO', `0xc074510c')
+define(`SNDCTL_MIDI_MPUCMD', `0xc0216d02')
+define(`SNDCTL_MIDI_MPUMODE', `0xc0046d01')
+define(`SNDCTL_MIDI_PRETIME', `0xc0046d00')
+define(`SNDCTL_SEQ_CTRLRATE', `0xc0045103')
+define(`SNDCTL_SEQ_GETINCOUNT', `0x80045105')
+define(`SNDCTL_SEQ_GETOUTCOUNT', `0x80045104')
+define(`SNDCTL_SEQ_GETTIME', `0x80045113')
+define(`SNDCTL_SEQ_NRMIDIS', `0x8004510b')
+define(`SNDCTL_SEQ_NRSYNTHS', `0x8004510a')
+define(`SNDCTL_SEQ_OUTOFBAND', `0x40085112')
+define(`SNDCTL_SEQ_PANIC', `0x00005111')
+define(`SNDCTL_SEQ_PERCMODE', `0x40045106')
+define(`SNDCTL_SEQ_RESET', `0x00005100')
+define(`SNDCTL_SEQ_RESETSAMPLES', `0x40045109')
+define(`SNDCTL_SEQ_SYNC', `0x00005101')
+define(`SNDCTL_SEQ_TESTMIDI', `0x40045108')
+define(`SNDCTL_SEQ_THRESHOLD', `0x4004510d')
+define(`SNDCTL_SYNTH_CONTROL', `0xcfa45115')
+define(`SNDCTL_SYNTH_ID', `0xc08c5114')
+define(`SNDCTL_SYNTH_INFO', `0xc08c5102')
+define(`SNDCTL_SYNTH_MEMAVL', `0xc004510e')
+define(`SNDCTL_SYNTH_REMOVESAMPLE', `0xc00c5116')
+define(`SNDCTL_TMR_CONTINUE', `0x00005404')
+define(`SNDCTL_TMR_METRONOME', `0x40045407')
+define(`SNDCTL_TMR_SELECT', `0x40045408')
+define(`SNDCTL_TMR_SOURCE', `0xc0045406')
+define(`SNDCTL_TMR_START', `0x00005402')
+define(`SNDCTL_TMR_STOP', `0x00005403')
+define(`SNDCTL_TMR_TEMPO', `0xc0045405')
+define(`SNDCTL_TMR_TIMEBASE', `0xc0045401')
+define(`SNDRV_COMPRESS_AVAIL', `0x801c4321')
+define(`SNDRV_COMPRESS_DRAIN', `0x00004334')
+define(`SNDRV_COMPRESS_GET_CAPS', `0xc0c44310')
+define(`SNDRV_COMPRESS_GET_CODEC_CAPS', `0xeb884311')
+define(`SNDRV_COMPRESS_GET_METADATA', `0xc0244315')
+define(`SNDRV_COMPRESS_GET_PARAMS', `0x80784313')
+define(`SNDRV_COMPRESS_IOCTL_VERSION', `0x80044300')
+define(`SNDRV_COMPRESS_NEXT_TRACK', `0x00004335')
+define(`SNDRV_COMPRESS_PARTIAL_DRAIN', `0x00004336')
+define(`SNDRV_COMPRESS_PAUSE', `0x00004330')
+define(`SNDRV_COMPRESS_RESUME', `0x00004331')
+define(`SNDRV_COMPRESS_SET_METADATA', `0x40244314')
+define(`SNDRV_COMPRESS_SET_PARAMS', `0x40844312')
+define(`SNDRV_COMPRESS_START', `0x00004332')
+define(`SNDRV_COMPRESS_STOP', `0x00004333')
+define(`SNDRV_COMPRESS_TSTAMP', `0x80144320')
+define(`SNDRV_CTL_IOCTL_CARD_INFO', `0x81785501')
+define(`SNDRV_CTL_IOCTL_ELEM_ADD', `0xc1105517')
+define(`SNDRV_CTL_IOCTL_ELEM_INFO', `0xc1105511')
+define(`SNDRV_CTL_IOCTL_ELEM_LIST', `0xc0505510')
+define(`SNDRV_CTL_IOCTL_ELEM_LOCK', `0x40405514')
+define(`SNDRV_CTL_IOCTL_ELEM_READ', `0xc4c85512')
+define(`SNDRV_CTL_IOCTL_ELEM_REMOVE', `0xc0405519')
+define(`SNDRV_CTL_IOCTL_ELEM_REPLACE', `0xc1105518')
+define(`SNDRV_CTL_IOCTL_ELEM_UNLOCK', `0x40405515')
+define(`SNDRV_CTL_IOCTL_ELEM_WRITE', `0xc4c85513')
+define(`SNDRV_CTL_IOCTL_HWDEP_INFO', `0x80dc5521')
+define(`SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE', `0xc0045520')
+define(`SNDRV_CTL_IOCTL_PCM_INFO', `0xc1205531')
+define(`SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE', `0x80045530')
+define(`SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE', `0x40045532')
+define(`SNDRV_CTL_IOCTL_POWER', `0xc00455d0')
+define(`SNDRV_CTL_IOCTL_POWER_STATE', `0x800455d1')
+define(`SNDRV_CTL_IOCTL_PVERSION', `0x80045500')
+define(`SNDRV_CTL_IOCTL_RAWMIDI_INFO', `0xc10c5541')
+define(`SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE', `0xc0045540')
+define(`SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE', `0x40045542')
+define(`SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS', `0xc0045516')
+define(`SNDRV_CTL_IOCTL_TLV_COMMAND', `0xc008551c')
+define(`SNDRV_CTL_IOCTL_TLV_READ', `0xc008551a')
+define(`SNDRV_CTL_IOCTL_TLV_WRITE', `0xc008551b')
+define(`SNDRV_DM_FM_IOCTL_CLEAR_PATCHES', `0x00004840')
+define(`SNDRV_DM_FM_IOCTL_INFO', `0x80024820')
+define(`SNDRV_DM_FM_IOCTL_PLAY_NOTE', `0x400c4822')
+define(`SNDRV_DM_FM_IOCTL_RESET', `0x00004821')
+define(`SNDRV_DM_FM_IOCTL_SET_CONNECTION', `0x40044826')
+define(`SNDRV_DM_FM_IOCTL_SET_MODE', `0x40044825')
+define(`SNDRV_DM_FM_IOCTL_SET_PARAMS', `0x40094824')
+define(`SNDRV_DM_FM_IOCTL_SET_VOICE', `0x40124823')
+define(`SNDRV_EMU10K1_IOCTL_CODE_PEEK', `0xc1b04812')
+define(`SNDRV_EMU10K1_IOCTL_CODE_POKE', `0x41b04811')
+define(`SNDRV_EMU10K1_IOCTL_CONTINUE', `0x00004881')
+define(`SNDRV_EMU10K1_IOCTL_DBG_READ', `0x80044884')
+define(`SNDRV_EMU10K1_IOCTL_INFO', `0x880c4810')
+define(`SNDRV_EMU10K1_IOCTL_PCM_PEEK', `0xc0484831')
+define(`SNDRV_EMU10K1_IOCTL_PCM_POKE', `0x40484830')
+define(`SNDRV_EMU10K1_IOCTL_PVERSION', `0x80044840')
+define(`SNDRV_EMU10K1_IOCTL_SINGLE_STEP', `0x40044883')
+define(`SNDRV_EMU10K1_IOCTL_STOP', `0x00004880')
+define(`SNDRV_EMU10K1_IOCTL_TRAM_PEEK', `0xc0104822')
+define(`SNDRV_EMU10K1_IOCTL_TRAM_POKE', `0x40104821')
+define(`SNDRV_EMU10K1_IOCTL_TRAM_SETUP', `0x40044820')
+define(`SNDRV_EMU10K1_IOCTL_ZERO_TRAM_COUNTER', `0x00004882')
+define(`SNDRV_EMUX_IOCTL_LOAD_PATCH', `0xc0104881')
+define(`SNDRV_EMUX_IOCTL_MEM_AVAIL', `0x40044884')
+define(`SNDRV_EMUX_IOCTL_MISC_MODE', `0xc0104884')
+define(`SNDRV_EMUX_IOCTL_REMOVE_LAST_SAMPLES', `0x00004883')
+define(`SNDRV_EMUX_IOCTL_RESET_SAMPLES', `0x00004882')
+define(`SNDRV_EMUX_IOCTL_VERSION', `0x80044880')
+define(`SNDRV_FIREWIRE_IOCTL_GET_INFO', `0x802048f8')
+define(`SNDRV_FIREWIRE_IOCTL_LOCK', `0x000048f9')
+define(`SNDRV_FIREWIRE_IOCTL_UNLOCK', `0x000048fa')
+define(`SNDRV_HDSP_IOCTL_GET_9632_AEB', `0x80084845')
+define(`SNDRV_HDSP_IOCTL_GET_CONFIG_INFO', `0x80244841')
+define(`SNDRV_HDSP_IOCTL_GET_MIXER', `0x90004844')
+define(`SNDRV_HDSP_IOCTL_GET_PEAK_RMS', `0x83b04840')
+define(`SNDRV_HDSP_IOCTL_GET_VERSION', `0x80084843')
+define(`SNDRV_HDSP_IOCTL_UPLOAD_FIRMWARE', `0x40084842')
+define(`SNDRV_HDSPM_IOCTL_GET_CONFIG', `0x80184841')
+define(`SNDRV_HDSPM_IOCTL_GET_LTC', `0x80104846')
+define(`SNDRV_HDSPM_IOCTL_GET_MIXER', `0x80084844')
+define(`SNDRV_HDSPM_IOCTL_GET_PEAK_RMS', `0x89084842')
+define(`SNDRV_HDSPM_IOCTL_GET_STATUS', `0x80204847')
+define(`SNDRV_HDSPM_IOCTL_GET_VERSION', `0x80244848')
+define(`SNDRV_HWDEP_IOCTL_DSP_LOAD', `0x40604803')
+define(`SNDRV_HWDEP_IOCTL_DSP_STATUS', `0x80404802')
+define(`SNDRV_HWDEP_IOCTL_INFO', `0x80dc4801')
+define(`SNDRV_HWDEP_IOCTL_PVERSION', `0x80044800')
+define(`SNDRV_PCM_IOCTL_CHANNEL_INFO', `0x80184132')
+define(`SNDRV_PCM_IOCTL_DELAY', `0x80084121')
+define(`SNDRV_PCM_IOCTL_DRAIN', `0x00004144')
+define(`SNDRV_PCM_IOCTL_DROP', `0x00004143')
+define(`SNDRV_PCM_IOCTL_FORWARD', `0x40084149')
+define(`SNDRV_PCM_IOCTL_HW_FREE', `0x00004112')
+define(`SNDRV_PCM_IOCTL_HW_PARAMS', `0xc2604111')
+define(`SNDRV_PCM_IOCTL_HW_REFINE', `0xc2604110')
+define(`SNDRV_PCM_IOCTL_HWSYNC', `0x00004122')
+define(`SNDRV_PCM_IOCTL_INFO', `0x81204101')
+define(`SNDRV_PCM_IOCTL_LINK', `0x40044160')
+define(`SNDRV_PCM_IOCTL_PAUSE', `0x40044145')
+define(`SNDRV_PCM_IOCTL_PREPARE', `0x00004140')
+define(`SNDRV_PCM_IOCTL_PVERSION', `0x80044100')
+define(`SNDRV_PCM_IOCTL_READI_FRAMES', `0x80184151')
+define(`SNDRV_PCM_IOCTL_READN_FRAMES', `0x80184153')
+define(`SNDRV_PCM_IOCTL_RESET', `0x00004141')
+define(`SNDRV_PCM_IOCTL_RESUME', `0x00004147')
+define(`SNDRV_PCM_IOCTL_REWIND', `0x40084146')
+define(`SNDRV_PCM_IOCTL_START', `0x00004142')
+define(`SNDRV_PCM_IOCTL_STATUS', `0x80984120')
+define(`SNDRV_PCM_IOCTL_SW_PARAMS', `0xc0884113')
+define(`SNDRV_PCM_IOCTL_SYNC_PTR', `0xc0884123')
+define(`SNDRV_PCM_IOCTL_TSTAMP', `0x40044102')
+define(`SNDRV_PCM_IOCTL_TTSTAMP', `0x40044103')
+define(`SNDRV_PCM_IOCTL_UNLINK', `0x00004161')
+define(`SNDRV_PCM_IOCTL_WRITEI_FRAMES', `0x40184150')
+define(`SNDRV_PCM_IOCTL_WRITEN_FRAMES', `0x40184152')
+define(`SNDRV_PCM_IOCTL_XRUN', `0x00004148')
+define(`SNDRV_RAWMIDI_IOCTL_DRAIN', `0x40045731')
+define(`SNDRV_RAWMIDI_IOCTL_DROP', `0x40045730')
+define(`SNDRV_RAWMIDI_IOCTL_INFO', `0x810c5701')
+define(`SNDRV_RAWMIDI_IOCTL_PARAMS', `0xc0305710')
+define(`SNDRV_RAWMIDI_IOCTL_PVERSION', `0x80045700')
+define(`SNDRV_RAWMIDI_IOCTL_STATUS', `0xc0385720')
+define(`SNDRV_SB_CSP_IOCTL_INFO', `0x80284810')
+define(`SNDRV_SB_CSP_IOCTL_LOAD_CODE', `0x70124811')
+define(`SNDRV_SB_CSP_IOCTL_PAUSE', `0x00004815')
+define(`SNDRV_SB_CSP_IOCTL_RESTART', `0x00004816')
+define(`SNDRV_SB_CSP_IOCTL_START', `0x40084813')
+define(`SNDRV_SB_CSP_IOCTL_STOP', `0x00004814')
+define(`SNDRV_SB_CSP_IOCTL_UNLOAD_CODE', `0x00004812')
+define(`SNDRV_SEQ_IOCTL_CLIENT_ID', `0x80045301')
+define(`SNDRV_SEQ_IOCTL_CREATE_PORT', `0xc0a85320')
+define(`SNDRV_SEQ_IOCTL_CREATE_QUEUE', `0xc08c5332')
+define(`SNDRV_SEQ_IOCTL_DELETE_PORT', `0x40a85321')
+define(`SNDRV_SEQ_IOCTL_DELETE_QUEUE', `0x408c5333')
+define(`SNDRV_SEQ_IOCTL_GET_CLIENT_INFO', `0xc0bc5310')
+define(`SNDRV_SEQ_IOCTL_GET_CLIENT_POOL', `0xc058534b')
+define(`SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE', `0xc08c5336')
+define(`SNDRV_SEQ_IOCTL_GET_PORT_INFO', `0xc0a85322')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT', `0xc04c5349')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_INFO', `0xc08c5334')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_OWNER', `0xc0005343')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS', `0xc05c5340')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO', `0xc02c5341')
+define(`SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER', `0xc0605345')
+define(`SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION', `0xc0505350')
+define(`SNDRV_SEQ_IOCTL_PVERSION', `0x80045300')
+define(`SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT', `0xc0bc5351')
+define(`SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT', `0xc0a85352')
+define(`SNDRV_SEQ_IOCTL_QUERY_SUBS', `0xc058534f')
+define(`SNDRV_SEQ_IOCTL_REMOVE_EVENTS', `0x4040534e')
+define(`SNDRV_SEQ_IOCTL_RUNNING_MODE', `0xc0105303')
+define(`SNDRV_SEQ_IOCTL_SET_CLIENT_INFO', `0x40bc5311')
+define(`SNDRV_SEQ_IOCTL_SET_CLIENT_POOL', `0x4058534c')
+define(`SNDRV_SEQ_IOCTL_SET_PORT_INFO', `0x40a85323')
+define(`SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT', `0x404c534a')
+define(`SNDRV_SEQ_IOCTL_SET_QUEUE_INFO', `0xc08c5335')
+define(`SNDRV_SEQ_IOCTL_SET_QUEUE_OWNER', `0x40005344')
+define(`SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO', `0x402c5342')
+define(`SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER', `0x40605346')
+define(`SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT', `0x40505330')
+define(`SNDRV_SEQ_IOCTL_SYSTEM_INFO', `0xc0305302')
+define(`SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT', `0x40505331')
+define(`SNDRV_TIMER_IOCTL_CONTINUE', `0x000054a2')
+define(`SNDRV_TIMER_IOCTL_GINFO', `0xc0f85403')
+define(`SNDRV_TIMER_IOCTL_GPARAMS', `0x40485404')
+define(`SNDRV_TIMER_IOCTL_GSTATUS', `0xc0505405')
+define(`SNDRV_TIMER_IOCTL_INFO', `0x80e85411')
+define(`SNDRV_TIMER_IOCTL_NEXT_DEVICE', `0xc0145401')
+define(`SNDRV_TIMER_IOCTL_PARAMS', `0x40505412')
+define(`SNDRV_TIMER_IOCTL_PAUSE', `0x000054a3')
+define(`SNDRV_TIMER_IOCTL_PVERSION', `0x80045400')
+define(`SNDRV_TIMER_IOCTL_SELECT', `0x40345410')
+define(`SNDRV_TIMER_IOCTL_START', `0x000054a0')
+define(`SNDRV_TIMER_IOCTL_STATUS', `0x80605414')
+define(`SNDRV_TIMER_IOCTL_STOP', `0x000054a1')
+define(`SNDRV_TIMER_IOCTL_TREAD', `0x40045402')
+define(`SONET_CLRDIAG', `0xc0046113')
+define(`SONET_GETDIAG', `0x80046114')
+define(`SONET_GETFRAMING', `0x80046116')
+define(`SONET_GETFRSENSE', `0x80066117')
+define(`SONET_GETSTAT', `0x80246110')
+define(`SONET_GETSTATZ', `0x80246111')
+define(`SONET_SETDIAG', `0xc0046112')
+define(`SONET_SETFRAMING', `0x40046115')
+define(`SONYPI_IOCGBAT1CAP', `0x80027602')
+define(`SONYPI_IOCGBAT1REM', `0x80027603')
+define(`SONYPI_IOCGBAT2CAP', `0x80027604')
+define(`SONYPI_IOCGBAT2REM', `0x80027605')
+define(`SONYPI_IOCGBATFLAGS', `0x80017607')
+define(`SONYPI_IOCGBLUE', `0x80017608')
+define(`SONYPI_IOCGBRT', `0x80017600')
+define(`SONYPI_IOCGFAN', `0x8001760a')
+define(`SONYPI_IOCGTEMP', `0x8001760c')
+define(`SONYPI_IOCSBLUE', `0x40017609')
+define(`SONYPI_IOCSBRT', `0x40017600')
+define(`SONYPI_IOCSFAN', `0x4001760b')
+define(`SOUND_MIXER_3DSE', `0xc0044d68')
+define(`SOUND_MIXER_ACCESS', `0xc0804d66')
+define(`SOUND_MIXER_AGC', `0xc0044d67')
+define(`SOUND_MIXER_GETLEVELS', `0xc0a44d74')
+define(`SOUND_MIXER_INFO', `0x805c4d65')
+define(`SOUND_MIXER_PRIVATE1', `0xc0044d6f')
+define(`SOUND_MIXER_PRIVATE2', `0xc0044d70')
+define(`SOUND_MIXER_PRIVATE3', `0xc0044d71')
+define(`SOUND_MIXER_PRIVATE4', `0xc0044d72')
+define(`SOUND_MIXER_PRIVATE5', `0xc0044d73')
+define(`SOUND_MIXER_SETLEVELS', `0xc0a44d75')
+define(`SOUND_OLD_MIXER_INFO', `0x80304d65')
+define(`SOUND_PCM_READ_BITS', `0x80045005')
+define(`SOUND_PCM_READ_CHANNELS', `0x80045006')
+define(`SOUND_PCM_READ_FILTER', `0x80045007')
+define(`SOUND_PCM_READ_RATE', `0x80045002')
+define(`SOUND_PCM_WRITE_FILTER', `0xc0045007')
+define(`SPI_IOC_RD_BITS_PER_WORD', `0x80016b03')
+define(`SPI_IOC_RD_LSB_FIRST', `0x80016b02')
+define(`SPI_IOC_RD_MAX_SPEED_HZ', `0x80046b04')
+define(`SPI_IOC_RD_MODE', `0x80016b01')
+define(`SPI_IOC_RD_MODE32', `0x80046b05')
+define(`SPI_IOC_WR_BITS_PER_WORD', `0x40016b03')
+define(`SPI_IOC_WR_LSB_FIRST', `0x40016b02')
+define(`SPI_IOC_WR_MAX_SPEED_HZ', `0x40046b04')
+define(`SPI_IOC_WR_MODE', `0x40016b01')
+define(`SPI_IOC_WR_MODE32', `0x40046b05')
+define(`SPIOCSTYPE', `0x40087101')
+define(`SSTFB_GET_VGAPASS', `0x800446dd')
+define(`SSTFB_SET_VGAPASS', `0x400446dd')
+define(`STOP_ARRAY', `0x00000932')
+define(`STOP_ARRAY_RO', `0x00000933')
+define(`SW_SYNC_IOC_CREATE_FENCE', `0xc0285700')
+define(`SW_SYNC_IOC_INC', `0x40045701')
+define(`SYNC_IOC_FENCE_INFO', `0xc0283e02')
+define(`SYNC_IOC_MERGE', `0xc0283e01')
+define(`SYNC_IOC_WAIT', `0x40043e00')
+define(`TCFLSH', `0x0000540b')
+define(`TCGETA', `0x00005405')
+define(`TCGETS2', `0x802c542a')
+define(`TCGETS', ifelse(target_arch, mips, 0x0000540d, 0x00005401))
+define(`TCGETX', `0x00005432')
+define(`TCSBRK', `0x00005409')
+define(`TCSBRKP', `0x00005425')
+define(`TCSETA', `0x00005406')
+define(`TCSETAF', `0x00005408')
+define(`TCSETAW', `0x00005407')
+define(`TCSETS', `0x00005402')
+define(`TCSETS2', `0x402c542b')
+define(`TCSETSF', `0x00005404')
+define(`TCSETSF2', `0x402c542d')
+define(`TCSETSW', `0x00005403')
+define(`TCSETSW2', `0x402c542c')
+define(`TCSETX', `0x00005433')
+define(`TCSETXF', `0x00005434')
+define(`TCSETXW', `0x00005435')
+define(`TCXONC', `0x0000540a')
+define(`TFD_IOC_SET_TICKS', `0x40085400')
+define(`TIOCCBRK', `0x00005428')
+define(`TIOCCONS', `0x0000541d')
+define(`TIOCEXCL', `0x0000540c')
+define(`TIOCGDEV', `0x80045432')
+define(`TIOCGETD', `0x00005424')
+define(`TIOCGEXCL', `0x80045440')
+define(`TIOCGICOUNT', `0x0000545d')
+define(`TIOCGLCKTRMIOS', `0x00005456')
+define(`TIOCGPGRP', `0x0000540f')
+define(`TIOCGPKT', `0x80045438')
+define(`TIOCGPTLCK', `0x80045439')
+define(`TIOCGPTN', `0x80045430')
+define(`TIOCGRS485', `0x0000542e')
+define(`TIOCGSERIAL', `0x0000541e')
+define(`TIOCGSID', `0x00005429')
+define(`TIOCGSOFTCAR', `0x00005419')
+define(`TIOCGWINSZ', ifelse(target_arch, mips, 0x80087468, 0x00005413))
+define(`TIOCLINUX', `0x0000541c')
+define(`TIOCMBIC', `0x00005417')
+define(`TIOCMBIS', `0x00005416')
+define(`TIOCMGET', `0x00005415')
+define(`TIOCMIWAIT', `0x0000545c')
+define(`TIOCMSET', `0x00005418')
+define(`TIOCNOTTY', `0x00005422')
+define(`TIOCNXCL', `0x0000540d')
+define(`TIOCOUTQ', ifelse(target_arch, mips, 0x00007472, 0x00005411))
+define(`TIOCPKT', `0x00005420')
+define(`TIOCSBRK', `0x00005427')
+define(`TIOCSCTTY', ifelse(target_arch, mips, 0x00005480, 0x0000540e))
+define(`TIOCSERCONFIG', `0x00005453')
+define(`TIOCSERGETLSR', `0x00005459')
+define(`TIOCSERGETMULTI', `0x0000545a')
+define(`TIOCSERGSTRUCT', `0x00005458')
+define(`TIOCSERGWILD', `0x00005454')
+define(`TIOCSERSETMULTI', `0x0000545b')
+define(`TIOCSERSWILD', `0x00005455')
+define(`TIOCSETD', `0x00005423')
+define(`TIOCSIG', `0x40045436')
+define(`TIOCSLCKTRMIOS', `0x00005457')
+define(`TIOCSPGRP', `0x00005410')
+define(`TIOCSPTLCK', `0x40045431')
+define(`TIOCSRS485', `0x0000542f')
+define(`TIOCSSERIAL', `0x0000541f')
+define(`TIOCSSOFTCAR', `0x0000541a')
+define(`TIOCSTI', `0x00005412')
+define(`TIOCSWINSZ', ifelse(target_arch, mips, 0x40087467, 0x00005414))
+define(`TIOCVHANGUP', `0x00005437')
+define(`TOSH_SMM', `0xc0047490')
+define(`TUNATTACHFILTER', `0x401054d5')
+define(`TUNDETACHFILTER', `0x401054d6')
+define(`TUNER_SET_CONFIG', `0x4010645c')
+define(`TUNGETFEATURES', `0x800454cf')
+define(`TUNGETFILTER', `0x801054db')
+define(`TUNGETIFF', `0x800454d2')
+define(`TUNGETSNDBUF', `0x800454d3')
+define(`TUNGETVNETHDRSZ', `0x800454d7')
+define(`TUNGETVNETLE', `0x800454dd')
+define(`TUNSETCARRIER', `0x400454e2')
+define(`TUNSETDEBUG', `0x400454c9')
+define(`TUNSETGROUP', `0x400454ce')
+define(`TUNSETIFF', `0x400454ca')
+define(`TUNSETIFINDEX', `0x400454da')
+define(`TUNSETLINK', `0x400454cd')
+define(`TUNSETNOCSUM', `0x400454c8')
+define(`TUNSETOFFLOAD', `0x400454d0')
+define(`TUNSETOWNER', `0x400454cc')
+define(`TUNSETPERSIST', `0x400454cb')
+define(`TUNSETQUEUE', `0x400454d9')
+define(`TUNSETSNDBUF', `0x400454d4')
+define(`TUNSETTXFILTER', `0x400454d1')
+define(`TUNSETVNETHDRSZ', `0x400454d8')
+define(`TUNSETVNETLE', `0x400454dc')
+define(`UBI_IOCATT', `0x40186f40')
+define(`UBI_IOCDET', `0x40046f41')
+define(`UBI_IOCEBCH', `0x40044f02')
+define(`UBI_IOCEBER', `0x40044f01')
+define(`UBI_IOCEBISMAP', `0x80044f05')
+define(`UBI_IOCEBMAP', `0x40084f03')
+define(`UBI_IOCEBUNMAP', `0x40044f04')
+define(`UBI_IOCMKVOL', `0x40986f00')
+define(`UBI_IOCRMVOL', `0x40046f01')
+define(`UBI_IOCRNVOL', `0x51106f03')
+define(`UBI_IOCRSVOL', `0x400c6f02')
+define(`UBI_IOCSETVOLPROP', `0x40104f06')
+define(`UBI_IOCVOLCRBLK', `0x40804f07')
+define(`UBI_IOCVOLRMBLK', `0x00004f08')
+define(`UBI_IOCVOLUP', `0x40084f00')
+define(`UDF_GETEABLOCK', `0x80086c41')
+define(`UDF_GETEASIZE', `0x80046c40')
+define(`UDF_GETVOLIDENT', `0x80086c42')
+define(`UDF_RELOCATE_BLOCKS', `0xc0086c43')
+define(`UI_BEGIN_FF_ERASE', `0xc00c55ca')
+define(`UI_BEGIN_FF_UPLOAD', `0xc06855c8')
+define(`UI_DEV_CREATE', `0x00005501')
+define(`UI_DEV_DESTROY', `0x00005502')
+define(`UI_END_FF_ERASE', `0x400c55cb')
+define(`UI_END_FF_UPLOAD', `0x406855c9')
+define(`UI_GET_VERSION', `0x8004552d')
+define(`UI_SET_ABSBIT', `0x40045567')
+define(`UI_SET_EVBIT', `0x40045564')
+define(`UI_SET_FFBIT', `0x4004556b')
+define(`UI_SET_KEYBIT', `0x40045565')
+define(`UI_SET_LEDBIT', `0x40045569')
+define(`UI_SET_MSCBIT', `0x40045568')
+define(`UI_SET_PHYS', `0x4008556c')
+define(`UI_SET_PROPBIT', `0x4004556e')
+define(`UI_SET_RELBIT', `0x40045566')
+define(`UI_SET_SNDBIT', `0x4004556a')
+define(`UI_SET_SWBIT', `0x4004556d')
+define(`UNPROTECT_ARRAY', `0x00000926')
+define(`USBDEVFS_ALLOC_STREAMS', `0x8008551c')
+define(`USBDEVFS_BULK', `0xc0185502')
+define(`USBDEVFS_BULK32', `0xc0105502')
+define(`USBDEVFS_CLAIMINTERFACE', `0x8004550f')
+define(`USBDEVFS_CLAIM_PORT', `0x80045518')
+define(`USBDEVFS_CLEAR_HALT', `0x80045515')
+define(`USBDEVFS_CONNECT', `0x00005517')
+define(`USBDEVFS_CONNECTINFO', `0x40085511')
+define(`USBDEVFS_CONTROL', `0xc0185500')
+define(`USBDEVFS_CONTROL32', `0xc0105500')
+define(`USBDEVFS_DISCARDURB', `0x0000550b')
+define(`USBDEVFS_DISCONNECT', `0x00005516')
+define(`USBDEVFS_DISCONNECT_CLAIM', `0x8108551b')
+define(`USBDEVFS_DISCSIGNAL', `0x8010550e')
+define(`USBDEVFS_DISCSIGNAL32', `0x8008550e')
+define(`USBDEVFS_FREE_STREAMS', `0x8008551d')
+define(`USBDEVFS_GET_CAPABILITIES', `0x8004551a')
+define(`USBDEVFS_GETDRIVER', `0x41045508')
+define(`USBDEVFS_HUB_PORTINFO', `0x80805513')
+define(`USBDEVFS_IOCTL', `0xc0105512')
+define(`USBDEVFS_IOCTL32', `0xc00c5512')
+define(`USBDEVFS_REAPURB', `0x4008550c')
+define(`USBDEVFS_REAPURB32', `0x4004550c')
+define(`USBDEVFS_REAPURBNDELAY', `0x4008550d')
+define(`USBDEVFS_REAPURBNDELAY32', `0x4004550d')
+define(`USBDEVFS_RELEASEINTERFACE', `0x80045510')
+define(`USBDEVFS_RELEASE_PORT', `0x80045519')
+define(`USBDEVFS_RESET', `0x00005514')
+define(`USBDEVFS_RESETEP', `0x80045503')
+define(`USBDEVFS_SETCONFIGURATION', `0x80045505')
+define(`USBDEVFS_SETINTERFACE', `0x80085504')
+define(`USBDEVFS_SUBMITURB', `0x8038550a')
+define(`USBDEVFS_SUBMITURB32', `0x802a550a')
+define(`USBTMC_IOCTL_ABORT_BULK_IN', `0x00005b04')
+define(`USBTMC_IOCTL_ABORT_BULK_OUT', `0x00005b03')
+define(`USBTMC_IOCTL_CLEAR', `0x00005b02')
+define(`USBTMC_IOCTL_CLEAR_IN_HALT', `0x00005b07')
+define(`USBTMC_IOCTL_CLEAR_OUT_HALT', `0x00005b06')
+define(`USBTMC_IOCTL_INDICATOR_PULSE', `0x00005b01')
+define(`UVCIOC_CTRL_MAP', `0xc0607520')
+define(`UVCIOC_CTRL_QUERY', `0xc0107521')
+define(`V4L2_SUBDEV_IR_RX_NOTIFY', `0x40047600')
+define(`V4L2_SUBDEV_IR_TX_NOTIFY', `0x40047601')
+define(`VFAT_IOCTL_READDIR_BOTH', `0x82307201')
+define(`VFAT_IOCTL_READDIR_SHORT', `0x82307202')
+define(`VFIO_CHECK_EXTENSION', `0x00003b65')
+define(`VFIO_DEVICE_GET_INFO', `0x00003b6b')
+define(`VFIO_DEVICE_GET_IRQ_INFO', `0x00003b6d')
+define(`VFIO_DEVICE_GET_PCI_HOT_RESET_INFO', `0x00003b70')
+define(`VFIO_DEVICE_GET_REGION_INFO', `0x00003b6c')
+define(`VFIO_DEVICE_PCI_HOT_RESET', `0x00003b71')
+define(`VFIO_DEVICE_RESET', `0x00003b6f')
+define(`VFIO_DEVICE_SET_IRQS', `0x00003b6e')
+define(`VFIO_EEH_PE_OP', `0x00003b79')
+define(`VFIO_GET_API_VERSION', `0x00003b64')
+define(`VFIO_GROUP_GET_DEVICE_FD', `0x00003b6a')
+define(`VFIO_GROUP_GET_STATUS', `0x00003b67')
+define(`VFIO_GROUP_SET_CONTAINER', `0x00003b68')
+define(`VFIO_GROUP_UNSET_CONTAINER', `0x00003b69')
+define(`VFIO_IOMMU_DISABLE', `0x00003b74')
+define(`VFIO_IOMMU_ENABLE', `0x00003b73')
+define(`VFIO_IOMMU_GET_INFO', `0x00003b70')
+define(`VFIO_IOMMU_MAP_DMA', `0x00003b71')
+define(`VFIO_IOMMU_SPAPR_TCE_GET_INFO', `0x00003b70')
+define(`VFIO_IOMMU_UNMAP_DMA', `0x00003b72')
+define(`VFIO_SET_IOMMU', `0x00003b66')
+define(`VHOST_GET_FEATURES', `0x8008af00')
+define(`VHOST_GET_VRING_BASE', `0xc008af12')
+define(`VHOST_NET_SET_BACKEND', `0x4008af30')
+define(`VHOST_RESET_OWNER', `0x0000af02')
+define(`VHOST_SCSI_CLEAR_ENDPOINT', `0x40e8af41')
+define(`VHOST_SCSI_GET_ABI_VERSION', `0x4004af42')
+define(`VHOST_SCSI_GET_EVENTS_MISSED', `0x4004af44')
+define(`VHOST_SCSI_SET_ENDPOINT', `0x40e8af40')
+define(`VHOST_SCSI_SET_EVENTS_MISSED', `0x4004af43')
+define(`VHOST_SET_FEATURES', `0x4008af00')
+define(`VHOST_SET_LOG_BASE', `0x4008af04')
+define(`VHOST_SET_LOG_FD', `0x4004af07')
+define(`VHOST_SET_MEM_TABLE', `0x4008af03')
+define(`VHOST_SET_OWNER', `0x0000af01')
+define(`VHOST_SET_VRING_ADDR', `0x4028af11')
+define(`VHOST_SET_VRING_BASE', `0x4008af12')
+define(`VHOST_SET_VRING_CALL', `0x4008af21')
+define(`VHOST_SET_VRING_ERR', `0x4008af22')
+define(`VHOST_SET_VRING_KICK', `0x4008af20')
+define(`VHOST_SET_VRING_NUM', `0x4008af10')
+define(`VIDEO_CLEAR_BUFFER', `0x00006f22')
+define(`VIDEO_COMMAND', `0xc0486f3b')
+define(`VIDEO_CONTINUE', `0x00006f18')
+define(`VIDEO_FAST_FORWARD', `0x00006f1f')
+define(`VIDEO_FREEZE', `0x00006f17')
+define(`VIDEO_GET_CAPABILITIES', `0x80046f21')
+define(`VIDEO_GET_EVENT', `0x80206f1c')
+define(`VIDEO_GET_FRAME_COUNT', `0x80086f3a')
+define(`VIDEO_GET_FRAME_RATE', `0x80046f38')
+define(`VIDEO_GET_NAVI', `0x84046f34')
+define(`VIDEO_GET_PTS', `0x80086f39')
+define(`VIDEO_GET_SIZE', `0x800c6f37')
+define(`VIDEO_GET_STATUS', `0x80146f1b')
+define(`VIDEO_PLAY', `0x00006f16')
+define(`VIDEO_SELECT_SOURCE', `0x00006f19')
+define(`VIDEO_SET_ATTRIBUTES', `0x00006f35')
+define(`VIDEO_SET_BLANK', `0x00006f1a')
+define(`VIDEO_SET_DISPLAY_FORMAT', `0x00006f1d')
+define(`VIDEO_SET_FORMAT', `0x00006f25')
+define(`VIDEO_SET_HIGHLIGHT', `0x40106f27')
+define(`VIDEO_SET_ID', `0x00006f23')
+define(`VIDEO_SET_SPU', `0x40086f32')
+define(`VIDEO_SET_SPU_PALETTE', `0x40106f33')
+define(`VIDEO_SET_STREAMTYPE', `0x00006f24')
+define(`VIDEO_SET_SYSTEM', `0x00006f26')
+define(`VIDEO_SLOWMOTION', `0x00006f20')
+define(`VIDEO_STILLPICTURE', `0x40106f1e')
+define(`VIDEO_STOP', `0x00006f15')
+define(`VIDEO_TRY_COMMAND', `0xc0486f3c')
+define(`VIDIOC_CREATE_BUFS', `0xc100565c')
+define(`VIDIOC_CROPCAP', `0xc02c563a')
+define(`VIDIOC_DBG_G_CHIP_INFO', `0xc0c85666')
+define(`VIDIOC_DBG_G_REGISTER', `0xc0385650')
+define(`VIDIOC_DBG_S_REGISTER', `0x4038564f')
+define(`VIDIOC_DECODER_CMD', `0xc0485660')
+define(`VIDIOC_DQBUF', `0xc0585611')
+define(`VIDIOC_DQEVENT', `0x80885659')
+define(`VIDIOC_DV_TIMINGS_CAP', `0xc0905664')
+define(`VIDIOC_ENCODER_CMD', `0xc028564d')
+define(`VIDIOC_ENUMAUDIO', `0xc0345641')
+define(`VIDIOC_ENUMAUDOUT', `0xc0345642')
+define(`VIDIOC_ENUM_DV_TIMINGS', `0xc0945662')
+define(`VIDIOC_ENUM_FMT', `0xc0405602')
+define(`VIDIOC_ENUM_FRAMEINTERVALS', `0xc034564b')
+define(`VIDIOC_ENUM_FRAMESIZES', `0xc02c564a')
+define(`VIDIOC_ENUM_FREQ_BANDS', `0xc0405665')
+define(`VIDIOC_ENUMINPUT', `0xc050561a')
+define(`VIDIOC_ENUMOUTPUT', `0xc0485630')
+define(`VIDIOC_ENUMSTD', `0xc0485619')
+define(`VIDIOC_EXPBUF', `0xc0405610')
+define(`VIDIOC_G_AUDIO', `0x80345621')
+define(`VIDIOC_G_AUDOUT', `0x80345631')
+define(`VIDIOC_G_CROP', `0xc014563b')
+define(`VIDIOC_G_CTRL', `0xc008561b')
+define(`VIDIOC_G_DV_TIMINGS', `0xc0845658')
+define(`VIDIOC_G_EDID', `0xc0285628')
+define(`VIDIOC_G_ENC_INDEX', `0x8818564c')
+define(`VIDIOC_G_EXT_CTRLS', `0xc0205647')
+define(`VIDIOC_G_FBUF', `0x8030560a')
+define(`VIDIOC_G_FMT', `0xc0d05604')
+define(`VIDIOC_G_FREQUENCY', `0xc02c5638')
+define(`VIDIOC_G_INPUT', `0x80045626')
+define(`VIDIOC_G_JPEGCOMP', `0x808c563d')
+define(`VIDIOC_G_MODULATOR', `0xc0445636')
+define(`VIDIOC_G_OUTPUT', `0x8004562e')
+define(`VIDIOC_G_PARM', `0xc0cc5615')
+define(`VIDIOC_G_PRIORITY', `0x80045643')
+define(`VIDIOC_G_SELECTION', `0xc040565e')
+define(`VIDIOC_G_SLICED_VBI_CAP', `0xc0745645')
+define(`VIDIOC_G_STD', `0x80085617')
+define(`VIDIOC_G_TUNER', `0xc054561d')
+define(`VIDIOC_INT_RESET', `0x40046466')
+define(`VIDIOC_LOG_STATUS', `0x00005646')
+define(`VIDIOC_OMAP3ISP_AEWB_CFG', `0xc02056c3')
+define(`VIDIOC_OMAP3ISP_AF_CFG', `0xc04c56c5')
+define(`VIDIOC_OMAP3ISP_CCDC_CFG', `0xc03856c1')
+define(`VIDIOC_OMAP3ISP_HIST_CFG', `0xc03056c4')
+define(`VIDIOC_OMAP3ISP_PRV_CFG', `0xc07056c2')
+define(`VIDIOC_OMAP3ISP_STAT_EN', `0xc00856c7')
+define(`VIDIOC_OMAP3ISP_STAT_REQ', `0xc02856c6')
+define(`VIDIOC_OVERLAY', `0x4004560e')
+define(`VIDIOC_PREPARE_BUF', `0xc058565d')
+define(`VIDIOC_QBUF', `0xc058560f')
+define(`VIDIOC_QUERYBUF', `0xc0585609')
+define(`VIDIOC_QUERYCAP', `0x80685600')
+define(`VIDIOC_QUERYCTRL', `0xc0445624')
+define(`VIDIOC_QUERY_DV_TIMINGS', `0x80845663')
+define(`VIDIOC_QUERY_EXT_CTRL', `0xc0e85667')
+define(`VIDIOC_QUERYMENU', `0xc02c5625')
+define(`VIDIOC_QUERYSTD', `0x8008563f')
+define(`VIDIOC_REQBUFS', `0xc0145608')
+define(`VIDIOC_RESERVED', `0x00005601')
+define(`VIDIOC_S_AUDIO', `0x40345622')
+define(`VIDIOC_S_AUDOUT', `0x40345632')
+define(`VIDIOC_S_CROP', `0x4014563c')
+define(`VIDIOC_S_CTRL', `0xc008561c')
+define(`VIDIOC_S_DV_TIMINGS', `0xc0845657')
+define(`VIDIOC_S_EDID', `0xc0285629')
+define(`VIDIOC_S_EXT_CTRLS', `0xc0205648')
+define(`VIDIOC_S_FBUF', `0x4030560b')
+define(`VIDIOC_S_FMT', `0xc0d05605')
+define(`VIDIOC_S_FREQUENCY', `0x402c5639')
+define(`VIDIOC_S_HW_FREQ_SEEK', `0x40305652')
+define(`VIDIOC_S_INPUT', `0xc0045627')
+define(`VIDIOC_S_JPEGCOMP', `0x408c563e')
+define(`VIDIOC_S_MODULATOR', `0x40445637')
+define(`VIDIOC_S_OUTPUT', `0xc004562f')
+define(`VIDIOC_S_PARM', `0xc0cc5616')
+define(`VIDIOC_S_PRIORITY', `0x40045644')
+define(`VIDIOC_S_SELECTION', `0xc040565f')
+define(`VIDIOC_S_STD', `0x40085618')
+define(`VIDIOC_STREAMOFF', `0x40045613')
+define(`VIDIOC_STREAMON', `0x40045612')
+define(`VIDIOC_S_TUNER', `0x4054561e')
+define(`VIDIOC_SUBDEV_DV_TIMINGS_CAP', `0xc0905664')
+define(`VIDIOC_SUBDEV_ENUM_DV_TIMINGS', `0xc0945662')
+define(`VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL', `0xc040564b')
+define(`VIDIOC_SUBDEV_ENUM_FRAME_SIZE', `0xc040564a')
+define(`VIDIOC_SUBDEV_ENUM_MBUS_CODE', `0xc0305602')
+define(`VIDIOC_SUBDEV_G_CROP', `0xc038563b')
+define(`VIDIOC_SUBDEV_G_DV_TIMINGS', `0xc0845658')
+define(`VIDIOC_SUBDEV_G_EDID', `0xc0285628')
+define(`VIDIOC_SUBDEV_G_FMT', `0xc0585604')
+define(`VIDIOC_SUBDEV_G_FRAME_INTERVAL', `0xc0305615')
+define(`VIDIOC_SUBDEV_G_SELECTION', `0xc040563d')
+define(`VIDIOC_SUBDEV_QUERY_DV_TIMINGS', `0x80845663')
+define(`VIDIOC_SUBDEV_S_CROP', `0xc038563c')
+define(`VIDIOC_SUBDEV_S_DV_TIMINGS', `0xc0845657')
+define(`VIDIOC_SUBDEV_S_EDID', `0xc0285629')
+define(`VIDIOC_SUBDEV_S_FMT', `0xc0585605')
+define(`VIDIOC_SUBDEV_S_FRAME_INTERVAL', `0xc0305616')
+define(`VIDIOC_SUBDEV_S_SELECTION', `0xc040563e')
+define(`VIDIOC_SUBSCRIBE_EVENT', `0x4020565a')
+define(`VIDIOC_TRY_DECODER_CMD', `0xc0485661')
+define(`VIDIOC_TRY_ENCODER_CMD', `0xc028564e')
+define(`VIDIOC_TRY_EXT_CTRLS', `0xc0205649')
+define(`VIDIOC_TRY_FMT', `0xc0d05640')
+define(`VIDIOC_UNSUBSCRIBE_EVENT', `0x4020565b')
+define(`VIDIOC_VSP1_LUT_CONFIG', `0xc40056c1')
+define(`VPFE_CMD_S_CCDC_RAW_PARAMS', `0x400856c1')
+define(`VT_ACTIVATE', `0x00005606')
+define(`VT_DISALLOCATE', `0x00005608')
+define(`VT_GETHIFONTMASK', `0x0000560d')
+define(`VT_GETMODE', `0x00005601')
+define(`VT_GETSTATE', `0x00005603')
+define(`VT_LOCKSWITCH', `0x0000560b')
+define(`VT_OPENQRY', `0x00005600')
+define(`VT_RELDISP', `0x00005605')
+define(`VT_RESIZE', `0x00005609')
+define(`VT_RESIZEX', `0x0000560a')
+define(`VT_SENDSIG', `0x00005604')
+define(`VT_SETACTIVATE', `0x0000560f')
+define(`VT_SETMODE', `0x00005602')
+define(`VT_UNLOCKSWITCH', `0x0000560c')
+define(`VT_WAITACTIVE', `0x00005607')
+define(`VT_WAITEVENT', `0x0000560e')
+define(`WAN_IOC_ADD_FLT_INDEX', `0x00006902')
+define(`WAN_IOC_ADD_FLT_RULE', `0x00006900')
+define(`WDIOC_GETBOOTSTATUS', `0x80045702')
+define(`WDIOC_GETPRETIMEOUT', `0x80045709')
+define(`WDIOC_GETSTATUS', `0x80045701')
+define(`WDIOC_GETSUPPORT', `0x80285700')
+define(`WDIOC_GETTEMP', `0x80045703')
+define(`WDIOC_GETTIMELEFT', `0x8004570a')
+define(`WDIOC_GETTIMEOUT', `0x80045707')
+define(`WDIOC_KEEPALIVE', `0x80045705')
+define(`WDIOC_SETOPTIONS', `0x80045704')
+define(`WDIOC_SETPRETIMEOUT', `0xc0045708')
+define(`WDIOC_SETTIMEOUT', `0xc0045706')
+define(`WRITE_RAID_INFO', `0x00000925')
+define(`X86_IOC_RDMSR_REGS', `0xc02063a0')
+define(`X86_IOC_WRMSR_REGS', `0xc02063a1')
+define(`ZATM_GETPOOL', `0x40106161')
+define(`ZATM_GETPOOLZ', `0x40106162')
+define(`ZATM_SETPOOL', `0x40106163')
diff --git a/prebuilts/api/202504/public/ioctl_macros b/prebuilts/api/202504/public/ioctl_macros
new file mode 100644
index 0000000..64ee1b0
--- /dev/null
+++ b/prebuilts/api/202504/public/ioctl_macros
@@ -0,0 +1,77 @@
+# socket ioctls allowed to unprivileged apps
+define(`unpriv_sock_ioctls', `
+{
+# Socket ioctls for gathering information about the interface
+SIOCGSTAMP SIOCGSTAMPNS
+SIOCGIFNAME SIOCGIFCONF SIOCGIFFLAGS SIOCGIFADDR SIOCGIFDSTADDR SIOCGIFBRDADDR
+SIOCGIFNETMASK SIOCGIFMTU SIOCGIFINDEX SIOCGIFCOUNT SIOCGIFTXQLEN
+# Wireless extension ioctls. Primarily get functions.
+SIOCGIWNAME SIOCGIWFREQ SIOCGIWMODE SIOCGIWSENS SIOCGIWRANGE SIOCGIWPRIV
+SIOCGIWSTATS SIOCGIWSPY SIOCSIWTHRSPY SIOCGIWTHRSPY SIOCGIWRATE SIOCGIWRTS
+SIOCGIWFRAG SIOCGIWTXPOW SIOCGIWRETRY SIOCGIWPOWER
+}')
+
+# socket ioctls never allowed to unprivileged apps
+define(`priv_sock_ioctls', `
+{
+# qualcomm rmnet ioctls
+WAN_IOC_ADD_FLT_RULE WAN_IOC_ADD_FLT_INDEX
+# socket ioctls
+SIOCADDRT SIOCDELRT SIOCRTMSG SIOCSIFLINK SIOCSIFFLAGS SIOCSIFADDR
+SIOCSIFDSTADDR SIOCSIFBRDADDR SIOCSIFNETMASK SIOCGIFMETRIC SIOCSIFMETRIC SIOCGIFMEM
+SIOCSIFMEM SIOCSIFMTU SIOCSIFNAME SIOCSIFHWADDR SIOCGIFENCAP SIOCSIFENCAP
+SIOCGIFHWADDR SIOCGIFSLAVE SIOCSIFSLAVE SIOCADDMULTI SIOCDELMULTI
+SIOCSIFPFLAGS SIOCGIFPFLAGS SIOCDIFADDR SIOCSIFHWBROADCAST SIOCKILLADDR SIOCGIFBR SIOCSIFBR
+SIOCSIFTXQLEN SIOCETHTOOL SIOCGMIIPHY SIOCGMIIREG SIOCSMIIREG SIOCWANDEV
+SIOCOUTQNSD SIOCDARP SIOCGARP SIOCSARP SIOCDRARP SIOCGRARP SIOCSRARP SIOCGIFMAP
+SIOCSIFMAP SIOCADDDLCI SIOCDELDLCI SIOCGIFVLAN SIOCSIFVLAN SIOCBONDENSLAVE
+SIOCBONDRELEASE SIOCBONDSETHWADDR SIOCBONDSLAVEINFOQUERY SIOCBONDINFOQUERY
+SIOCBONDCHANGEACTIVE SIOCBRADDBR SIOCBRDELBR SIOCBRADDIF SIOCBRDELIF SIOCSHWTSTAMP
+# device and protocol specific ioctls
+SIOCDEVPRIVATE-SIOCDEVPRIVLAST
+SIOCPROTOPRIVATE-SIOCPROTOPRIVLAST
+# Wireless extension ioctls
+SIOCSIWCOMMIT SIOCSIWNWID SIOCSIWFREQ SIOCSIWMODE SIOCSIWSENS SIOCSIWRANGE
+SIOCSIWPRIV SIOCSIWSTATS SIOCSIWSPY SIOCSIWAP SIOCGIWAP SIOCSIWMLME SIOCGIWAPLIST
+SIOCSIWSCAN SIOCGIWSCAN SIOCSIWESSID SIOCGIWESSID SIOCSIWNICKN SIOCGIWNICKN
+SIOCSIWRATE SIOCSIWRTS SIOCSIWFRAG SIOCSIWTXPOW SIOCSIWRETRY SIOCSIWENCODE
+SIOCGIWENCODE SIOCSIWPOWER SIOCSIWGENIE SIOCGIWGENIE SIOCSIWAUTH SIOCGIWAUTH
+SIOCSIWENCODEEXT SIOCGIWENCODEEXT SIOCSIWPMKSA
+# Dev private ioctl i.e. hardware specific ioctls
+SIOCIWFIRSTPRIV-SIOCIWLASTPRIV
+}')
+
+# commonly used ioctls on unix sockets
+define(`unpriv_unix_sock_ioctls', `{
+ TIOCOUTQ FIOCLEX FIONCLEX TCGETS TIOCGWINSZ TIOCSWINSZ FIONREAD
+}')
+
+# commonly used TTY ioctls
+# merge with unpriv_unix_sock_ioctls?
+define(`unpriv_tty_ioctls', `{
+ TIOCOUTQ FIOCLEX FIONCLEX TCGETS TCSETS TCSETSW TCSETSF TIOCGWINSZ TIOCSWINSZ
+ TIOCSCTTY TCFLSH TIOCSPGRP TIOCGPGRP
+}')
+
+# point to point ioctls
+define(`ppp_ioctls', `{
+PPPIOCGL2TPSTATS PPPIOCGCHAN PPPIOCATTCHAN PPPIOCDISCONN
+PPPIOCCONNECT PPPIOCSMRRU PPPIOCDETACH PPPIOCATTACH
+PPPIOCNEWUNIT PPPIOCGIDLE PPPIOCSDEBUG PPPIOCGDEBUG
+PPPIOCSACTIVE PPPIOCSPASS PPPIOCSNPMODE PPPIOCGNPMODE
+PPPIOCSCOMPRESS PPPIOCXFERUNIT PPPIOCSXASYNCMAP
+PPPIOCGXASYNCMAP PPPIOCSMAXCID PPPIOCSMRU PPPIOCGMRU
+PPPIOCSRASYNCMAP PPPIOCGRASYNCMAP PPPIOCGUNIT PPPIOCSASYNCMAP
+PPPIOCGASYNCMAP PPPIOCSFLAGS PPPIOCGFLAGS PPPIOCGCALLINFO
+PPPIOCBUNDLE PPPIOCGMPFLAGS PPPIOCSMPFLAGS PPPIOCSMPMTU
+PPPIOCSMPMRU PPPIOCGCOMPRESSORS PPPIOCSCOMPRESSOR PPPIOCGIFNAME
+}')
+
+# unprivileged binder ioctls
+define(`unpriv_binder_ioctls', `{
+BINDER_WRITE_READ BINDER_SET_IDLE_TIMEOUT BINDER_SET_MAX_THREADS
+BINDER_SET_IDLE_PRIORITY BINDER_SET_CONTEXT_MGR BINDER_THREAD_EXIT
+BINDER_VERSION BINDER_GET_NODE_DEBUG_INFO BINDER_GET_NODE_INFO_FOR_REF
+BINDER_SET_CONTEXT_MGR_EXT BINDER_ENABLE_ONEWAY_SPAM_DETECTION
+BINDER_GET_EXTENDED_ERROR
+}')
diff --git a/prebuilts/api/202504/public/isolated_app.te b/prebuilts/api/202504/public/isolated_app.te
new file mode 100644
index 0000000..b231df7
--- /dev/null
+++ b/prebuilts/api/202504/public/isolated_app.te
@@ -0,0 +1,13 @@
+###
+### Services with isolatedProcess=true in their manifest.
+###
+### This file defines the rules for isolated apps. An "isolated
+### app" is an APP with UID between AID_ISOLATED_START (99000)
+### and AID_ISOLATED_END (99999).
+###
+
+type isolated_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/isolated_compute_app.te b/prebuilts/api/202504/public/isolated_compute_app.te
new file mode 100644
index 0000000..4bfadaa
--- /dev/null
+++ b/prebuilts/api/202504/public/isolated_compute_app.te
@@ -0,0 +1,5 @@
+type isolated_compute_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/kernel.te b/prebuilts/api/202504/public/kernel.te
new file mode 100644
index 0000000..c3fcdad
--- /dev/null
+++ b/prebuilts/api/202504/public/kernel.te
@@ -0,0 +1,6 @@
+# Life begins with the kernel.
+type kernel, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/keystore.te b/prebuilts/api/202504/public/keystore.te
new file mode 100644
index 0000000..34b6c95
--- /dev/null
+++ b/prebuilts/api/202504/public/keystore.te
@@ -0,0 +1,7 @@
+# keystore daemon
+type keystore, domain, keystore2_key_type;
+type keystore_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/keystore_keys.te b/prebuilts/api/202504/public/keystore_keys.te
new file mode 100644
index 0000000..370be4c
--- /dev/null
+++ b/prebuilts/api/202504/public/keystore_keys.te
@@ -0,0 +1,6 @@
+# A keystore2 namespace for WI-FI.
+type wifi_key, keystore2_key_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/llkd.te b/prebuilts/api/202504/public/llkd.te
new file mode 100644
index 0000000..d678c3c
--- /dev/null
+++ b/prebuilts/api/202504/public/llkd.te
@@ -0,0 +1,7 @@
+# llkd Live LocK Daemon
+type llkd, domain, mlstrustedsubject;
+type llkd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/lmkd.te b/prebuilts/api/202504/public/lmkd.te
new file mode 100644
index 0000000..7d05b00
--- /dev/null
+++ b/prebuilts/api/202504/public/lmkd.te
@@ -0,0 +1,7 @@
+# lmkd low memory killer daemon
+type lmkd, domain, mlstrustedsubject;
+type lmkd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/logd.te b/prebuilts/api/202504/public/logd.te
new file mode 100644
index 0000000..a33ebd5
--- /dev/null
+++ b/prebuilts/api/202504/public/logd.te
@@ -0,0 +1,7 @@
+# android user-space log manager
+type logd, domain, mlstrustedsubject;
+type logd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/logpersist.te b/prebuilts/api/202504/public/logpersist.te
new file mode 100644
index 0000000..2936584
--- /dev/null
+++ b/prebuilts/api/202504/public/logpersist.te
@@ -0,0 +1,6 @@
+# android debug logging, logpersist domains
+type logpersist, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mdnsd.te b/prebuilts/api/202504/public/mdnsd.te
new file mode 100644
index 0000000..c36f5e6
--- /dev/null
+++ b/prebuilts/api/202504/public/mdnsd.te
@@ -0,0 +1,6 @@
+# mdns daemon
+type mdnsd, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediadrmserver.te b/prebuilts/api/202504/public/mediadrmserver.te
new file mode 100644
index 0000000..f647529
--- /dev/null
+++ b/prebuilts/api/202504/public/mediadrmserver.te
@@ -0,0 +1,7 @@
+# mediadrmserver - mediadrm daemon
+type mediadrmserver, domain;
+type mediadrmserver_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediaextractor.te b/prebuilts/api/202504/public/mediaextractor.te
new file mode 100644
index 0000000..0943ea3
--- /dev/null
+++ b/prebuilts/api/202504/public/mediaextractor.te
@@ -0,0 +1,8 @@
+# mediaextractor - multimedia daemon
+type mediaextractor, domain;
+type mediaextractor_exec, system_file_type, exec_type, file_type;
+type mediaextractor_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediametrics.te b/prebuilts/api/202504/public/mediametrics.te
new file mode 100644
index 0000000..34a1415
--- /dev/null
+++ b/prebuilts/api/202504/public/mediametrics.te
@@ -0,0 +1,7 @@
+# mediametrics - daemon for collecting media.metrics data
+type mediametrics, domain;
+type mediametrics_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediaprovider.te b/prebuilts/api/202504/public/mediaprovider.te
new file mode 100644
index 0000000..61dbf4c
--- /dev/null
+++ b/prebuilts/api/202504/public/mediaprovider.te
@@ -0,0 +1,10 @@
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+type mediaprovider, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediaserver.te b/prebuilts/api/202504/public/mediaserver.te
new file mode 100644
index 0000000..8be8627
--- /dev/null
+++ b/prebuilts/api/202504/public/mediaserver.te
@@ -0,0 +1,8 @@
+# mediaserver - multimedia daemon
+type mediaserver, domain;
+type mediaserver_exec, system_file_type, exec_type, file_type;
+type mediaserver_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediaswcodec.te b/prebuilts/api/202504/public/mediaswcodec.te
new file mode 100644
index 0000000..4e131d3
--- /dev/null
+++ b/prebuilts/api/202504/public/mediaswcodec.te
@@ -0,0 +1,6 @@
+type mediaswcodec, domain;
+type mediaswcodec_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mediatranscoding.te b/prebuilts/api/202504/public/mediatranscoding.te
new file mode 100644
index 0000000..cd4a2ac
--- /dev/null
+++ b/prebuilts/api/202504/public/mediatranscoding.te
@@ -0,0 +1,5 @@
+type mediatranscoding, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/modprobe.te b/prebuilts/api/202504/public/modprobe.te
new file mode 100644
index 0000000..6964fee
--- /dev/null
+++ b/prebuilts/api/202504/public/modprobe.te
@@ -0,0 +1,5 @@
+type modprobe, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/mtp.te b/prebuilts/api/202504/public/mtp.te
new file mode 100644
index 0000000..165c43e
--- /dev/null
+++ b/prebuilts/api/202504/public/mtp.te
@@ -0,0 +1,6 @@
+# vpn tunneling protocol manager
+type mtp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/net.te b/prebuilts/api/202504/public/net.te
new file mode 100644
index 0000000..414b5bf
--- /dev/null
+++ b/prebuilts/api/202504/public/net.te
@@ -0,0 +1,8 @@
+## Network types
+type node, node_type;
+type netif, netif_type;
+type port, port_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/netd.te b/prebuilts/api/202504/public/netd.te
new file mode 100644
index 0000000..bfb3059
--- /dev/null
+++ b/prebuilts/api/202504/public/netd.te
@@ -0,0 +1,7 @@
+# network manager
+type netd, domain, mlstrustedsubject;
+type netd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/netutils_wrapper.te b/prebuilts/api/202504/public/netutils_wrapper.te
new file mode 100644
index 0000000..d53f152
--- /dev/null
+++ b/prebuilts/api/202504/public/netutils_wrapper.te
@@ -0,0 +1,6 @@
+type netutils_wrapper, domain;
+type netutils_wrapper_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/network_stack.te b/prebuilts/api/202504/public/network_stack.te
new file mode 100644
index 0000000..f909be3
--- /dev/null
+++ b/prebuilts/api/202504/public/network_stack.te
@@ -0,0 +1,6 @@
+# Network stack service app
+type network_stack, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/neverallow_macros b/prebuilts/api/202504/public/neverallow_macros
new file mode 100644
index 0000000..59fa441
--- /dev/null
+++ b/prebuilts/api/202504/public/neverallow_macros
@@ -0,0 +1,15 @@
+#
+# Common neverallow permissions
+define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
+define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads }')
+define(`no_x_file_perms', `{ execute execute_no_trans }')
+define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
+
+#####################################
+# neverallow_establish_socket_comms(src, dst)
+# neverallow src domain establishing socket connections to dst domain.
+#
+define(`neverallow_establish_socket_comms', `
+ neverallow $1 $2:socket_class_set { connect sendto };
+ neverallow $1 $2:unix_stream_socket connectto;
+')
diff --git a/prebuilts/api/202504/public/nfc.te b/prebuilts/api/202504/public/nfc.te
new file mode 100644
index 0000000..a6e5160
--- /dev/null
+++ b/prebuilts/api/202504/public/nfc.te
@@ -0,0 +1,6 @@
+# nfc subsystem
+type nfc, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/otapreopt_chroot.te b/prebuilts/api/202504/public/otapreopt_chroot.te
new file mode 100644
index 0000000..eb340c8
--- /dev/null
+++ b/prebuilts/api/202504/public/otapreopt_chroot.te
@@ -0,0 +1,8 @@
+# otapreopt_chroot seclabel
+
+# TODO: Only present to allow mediatek/wembley-sepolicy to see it for validation reasons.
+until_board_api(202504, `type otapreopt_chroot, domain;')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/perfetto.te b/prebuilts/api/202504/public/perfetto.te
new file mode 100644
index 0000000..6da515a
--- /dev/null
+++ b/prebuilts/api/202504/public/perfetto.te
@@ -0,0 +1,5 @@
+type perfetto, domain, coredomain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/performanced.te b/prebuilts/api/202504/public/performanced.te
new file mode 100644
index 0000000..8da3b49
--- /dev/null
+++ b/prebuilts/api/202504/public/performanced.te
@@ -0,0 +1,7 @@
+# performanced
+type performanced, domain, mlstrustedsubject;
+type performanced_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/platform_app.te b/prebuilts/api/202504/public/platform_app.te
new file mode 100644
index 0000000..035a3ef
--- /dev/null
+++ b/prebuilts/api/202504/public/platform_app.te
@@ -0,0 +1,9 @@
+###
+### Apps signed with the platform key.
+###
+
+type platform_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/postinstall.te b/prebuilts/api/202504/public/postinstall.te
new file mode 100644
index 0000000..38b120f
--- /dev/null
+++ b/prebuilts/api/202504/public/postinstall.te
@@ -0,0 +1,8 @@
+# Domain where the postinstall program runs during the update.
+# Extend the permissions in this domain to allow this program to access other
+# files needed by the specific device on your device's sepolicy directory.
+type postinstall, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/ppp.te b/prebuilts/api/202504/public/ppp.te
new file mode 100644
index 0000000..892b614
--- /dev/null
+++ b/prebuilts/api/202504/public/ppp.te
@@ -0,0 +1,6 @@
+# Point to Point Protocol daemon
+type ppp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/priv_app.te b/prebuilts/api/202504/public/priv_app.te
new file mode 100644
index 0000000..03a8c09
--- /dev/null
+++ b/prebuilts/api/202504/public/priv_app.te
@@ -0,0 +1,9 @@
+###
+### A domain for further sandboxing privileged apps.
+###
+
+type priv_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/prng_seeder.te b/prebuilts/api/202504/public/prng_seeder.te
new file mode 100644
index 0000000..ae1a2c1
--- /dev/null
+++ b/prebuilts/api/202504/public/prng_seeder.te
@@ -0,0 +1,6 @@
+# PRNG seeder daemon
+type prng_seeder, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/profman.te b/prebuilts/api/202504/public/profman.te
new file mode 100644
index 0000000..34ae4a1
--- /dev/null
+++ b/prebuilts/api/202504/public/profman.te
@@ -0,0 +1,7 @@
+# profman
+type profman, domain;
+type profman_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/property.te b/prebuilts/api/202504/public/property.te
new file mode 100644
index 0000000..cb18741
--- /dev/null
+++ b/prebuilts/api/202504/public/property.te
@@ -0,0 +1,364 @@
+# Properties used only in /system
+#
+# DO NOT ADD system_internal_prop here.
+# Instead, add to private/property.te.
+# TODO(b/150331497): move these to private/property.te
+system_internal_prop(apexd_prop)
+system_internal_prop(bootloader_boot_reason_prop)
+system_internal_prop(device_config_activity_manager_native_boot_prop)
+system_internal_prop(device_config_boot_count_prop)
+system_internal_prop(device_config_input_native_boot_prop)
+system_internal_prop(device_config_netd_native_prop)
+system_internal_prop(device_config_reset_performed_prop)
+system_internal_prop(firstboot_prop)
+
+compatible_property_only(`
+ # DO NOT ADD ANY PROPERTIES HERE
+ system_internal_prop(boottime_prop)
+ system_internal_prop(charger_prop)
+ system_internal_prop(cold_boot_done_prop)
+ system_internal_prop(ctl_adbd_prop)
+ system_internal_prop(ctl_apexd_prop)
+ system_internal_prop(ctl_bootanim_prop)
+ system_internal_prop(ctl_bugreport_prop)
+ system_internal_prop(ctl_console_prop)
+ system_internal_prop(ctl_dumpstate_prop)
+ system_internal_prop(ctl_fuse_prop)
+ system_internal_prop(ctl_gsid_prop)
+ system_internal_prop(ctl_interface_restart_prop)
+ system_internal_prop(ctl_interface_stop_prop)
+ system_internal_prop(ctl_mdnsd_prop)
+ system_internal_prop(ctl_restart_prop)
+ system_internal_prop(ctl_rildaemon_prop)
+ system_internal_prop(ctl_sigstop_prop)
+ system_internal_prop(dynamic_system_prop)
+ system_internal_prop(heapprofd_enabled_prop)
+ system_internal_prop(llkd_prop)
+ system_internal_prop(lpdumpd_prop)
+ system_internal_prop(mmc_prop)
+ system_internal_prop(mock_ota_prop)
+ system_internal_prop(net_dns_prop)
+ system_internal_prop(overlay_prop)
+ system_internal_prop(persistent_properties_ready_prop)
+ system_internal_prop(safemode_prop)
+ system_internal_prop(system_lmk_prop)
+ system_internal_prop(system_trace_prop)
+ system_internal_prop(test_boot_reason_prop)
+ system_internal_prop(time_prop)
+ system_internal_prop(traced_enabled_prop)
+ system_internal_prop(traced_lazy_prop)
+')
+
+# Properties which can't be written outside system
+system_restricted_prop(aac_drc_prop)
+system_restricted_prop(adaptive_haptics_prop)
+system_restricted_prop(apex_ready_prop)
+system_restricted_prop(arm64_memtag_prop)
+system_restricted_prop(binder_cache_bluetooth_server_prop)
+system_restricted_prop(binder_cache_system_server_prop)
+system_restricted_prop(binder_cache_telephony_server_prop)
+system_restricted_prop(boot_status_prop)
+system_restricted_prop(bootanim_system_prop)
+system_restricted_prop(bootloader_prop)
+system_restricted_prop(boottime_public_prop)
+system_restricted_prop(bq_config_prop)
+system_restricted_prop(build_bootimage_prop)
+system_restricted_prop(build_prop)
+system_restricted_prop(composd_vm_art_prop)
+system_restricted_prop(device_config_aconfig_flags_prop)
+system_restricted_prop(device_config_camera_native_prop)
+system_restricted_prop(device_config_edgetpu_native_prop)
+system_restricted_prop(device_config_media_native_prop)
+system_restricted_prop(device_config_nnapi_native_prop)
+system_restricted_prop(device_config_runtime_native_boot_prop)
+system_restricted_prop(device_config_runtime_native_prop)
+system_restricted_prop(device_config_surface_flinger_native_boot_prop)
+system_restricted_prop(device_config_vendor_system_native_prop)
+system_restricted_prop(device_config_vendor_system_native_boot_prop)
+system_restricted_prop(drm_forcel3_prop)
+system_restricted_prop(fingerprint_prop)
+system_restricted_prop(gwp_asan_prop)
+system_restricted_prop(hal_instrumentation_prop)
+system_restricted_prop(userdebug_or_eng_prop)
+system_restricted_prop(init_service_status_prop)
+system_restricted_prop(libc_debug_prop)
+system_restricted_prop(module_sdkextensions_prop)
+system_restricted_prop(nnapi_ext_deny_product_prop)
+system_restricted_prop(persist_wm_debug_prop)
+system_restricted_prop(power_debug_prop)
+system_restricted_prop(property_service_version_prop)
+system_restricted_prop(provisioned_prop)
+system_restricted_prop(restorecon_prop)
+system_restricted_prop(retaildemo_prop)
+system_restricted_prop(servicemanager_prop)
+system_restricted_prop(smart_idle_maint_enabled_prop)
+system_restricted_prop(socket_hook_prop)
+system_restricted_prop(sqlite_log_prop)
+system_restricted_prop(surfaceflinger_display_prop)
+system_restricted_prop(system_boot_reason_prop)
+system_restricted_prop(system_jvmti_agent_prop)
+system_restricted_prop(traced_oome_heap_session_count_prop)
+system_restricted_prop(ab_update_gki_prop)
+system_restricted_prop(usb_prop)
+system_restricted_prop(userspace_reboot_exported_prop)
+system_restricted_prop(vold_status_prop)
+system_restricted_prop(vts_status_prop)
+
+starting_at_board_api(202504, `
+ system_restricted_prop(enable_16k_pages_prop)
+ system_restricted_prop(profcollectd_etr_prop)
+')
+
+compatible_property_only(`
+ # DO NOT ADD ANY PROPERTIES HERE
+ system_restricted_prop(config_prop)
+ system_restricted_prop(cppreopt_prop)
+ system_restricted_prop(dalvik_prop)
+ system_restricted_prop(debuggerd_prop)
+ system_restricted_prop(device_logging_prop)
+ system_restricted_prop(dhcp_prop)
+ system_restricted_prop(dumpstate_prop)
+ system_restricted_prop(exported3_system_prop)
+ system_restricted_prop(exported_dumpstate_prop)
+ system_restricted_prop(exported_secure_prop)
+ system_restricted_prop(heapprofd_prop)
+ system_restricted_prop(net_radio_prop)
+ system_restricted_prop(pan_result_prop)
+ system_restricted_prop(persist_debug_prop)
+ system_restricted_prop(shell_prop)
+ system_restricted_prop(test_harness_prop)
+ system_restricted_prop(theme_prop)
+ system_restricted_prop(use_memfd_prop)
+ system_restricted_prop(vold_prop)
+')
+
+# Properties which can be written only by vendor_init
+system_vendor_config_prop(apexd_config_prop)
+system_vendor_config_prop(apexd_select_prop)
+system_vendor_config_prop(aaudio_config_prop)
+system_vendor_config_prop(apk_verity_prop)
+system_vendor_config_prop(audio_config_prop)
+system_vendor_config_prop(bootanim_config_prop)
+system_vendor_config_prop(bluetooth_config_prop)
+system_vendor_config_prop(build_attestation_prop)
+system_vendor_config_prop(build_config_prop)
+system_vendor_config_prop(build_odm_prop)
+system_vendor_config_prop(build_vendor_prop)
+system_vendor_config_prop(camera_calibration_prop)
+system_vendor_config_prop(camera_config_prop)
+system_vendor_config_prop(camera2_extensions_prop)
+system_vendor_config_prop(camerax_extensions_prop)
+system_vendor_config_prop(charger_config_prop)
+system_vendor_config_prop(codec2_config_prop)
+system_vendor_config_prop(composd_vm_vendor_prop)
+system_vendor_config_prop(cpu_variant_prop)
+system_vendor_config_prop(debugfs_restriction_prop)
+system_vendor_config_prop(drm_service_config_prop)
+system_vendor_config_prop(exported_camera_prop)
+system_vendor_config_prop(exported_config_prop)
+system_vendor_config_prop(exported_default_prop)
+system_vendor_config_prop(ffs_config_prop)
+system_vendor_config_prop(framework_watchdog_config_prop)
+system_vendor_config_prop(graphics_config_prop)
+system_vendor_config_prop(hdmi_config_prop)
+system_vendor_config_prop(hw_timeout_multiplier_prop)
+system_vendor_config_prop(hypervisor_prop)
+system_vendor_config_prop(hypervisor_restricted_prop)
+system_vendor_config_prop(incremental_prop)
+system_vendor_config_prop(input_device_config_prop)
+system_vendor_config_prop(keyguard_config_prop)
+system_vendor_config_prop(keystore_config_prop)
+system_vendor_config_prop(lmkd_config_prop)
+system_vendor_config_prop(media_config_prop)
+system_vendor_config_prop(media_variant_prop)
+system_vendor_config_prop(mediadrm_config_prop)
+system_vendor_config_prop(mm_events_config_prop)
+system_vendor_config_prop(oem_unlock_prop)
+system_vendor_config_prop(ota_build_prop)
+system_vendor_config_prop(packagemanager_config_prop)
+system_vendor_config_prop(quick_start_prop)
+system_vendor_config_prop(recovery_config_prop)
+system_vendor_config_prop(recovery_usb_config_prop)
+system_vendor_config_prop(sendbug_config_prop)
+system_vendor_config_prop(soc_prop)
+system_vendor_config_prop(storage_config_prop)
+system_vendor_config_prop(storagemanager_config_prop)
+system_vendor_config_prop(surfaceflinger_prop)
+system_vendor_config_prop(suspend_prop)
+system_vendor_config_prop(systemsound_config_prop)
+system_vendor_config_prop(telephony_config_prop)
+system_vendor_config_prop(threadnetwork_config_prop)
+system_vendor_config_prop(tombstone_config_prop)
+system_vendor_config_prop(usb_config_prop)
+system_vendor_config_prop(userspace_reboot_config_prop)
+system_vendor_config_prop(vehicle_hal_prop)
+system_vendor_config_prop(vendor_security_patch_level_prop)
+system_vendor_config_prop(vendor_socket_hook_prop)
+system_vendor_config_prop(virtual_ab_prop)
+system_vendor_config_prop(vndk_prop)
+system_vendor_config_prop(vts_config_prop)
+system_vendor_config_prop(vold_config_prop)
+system_vendor_config_prop(wifi_config_prop)
+system_vendor_config_prop(zram_config_prop)
+system_vendor_config_prop(zygote_config_prop)
+system_vendor_config_prop(dck_prop)
+system_vendor_config_prop(tuner_config_prop)
+system_vendor_config_prop(usb_uvc_enabled_prop)
+system_vendor_config_prop(setupwizard_mode_prop)
+system_vendor_config_prop(pm_archiving_enabled_prop)
+starting_at_board_api(202504, `
+ system_vendor_config_prop(trusty_security_vm_sys_vendor_prop)
+')
+
+# Properties with no restrictions
+system_public_prop(adbd_config_prop)
+system_public_prop(audio_prop)
+system_public_prop(bluetooth_a2dp_offload_prop)
+system_public_prop(bluetooth_audio_hal_prop)
+starting_at_board_api(202504, `
+ system_public_prop(bluetooth_finder_prop)
+')
+system_public_prop(bluetooth_prop)
+system_public_prop(bpf_progs_loaded_prop)
+system_public_prop(charger_status_prop)
+system_public_prop(ctl_default_prop)
+system_public_prop(ctl_interface_start_prop)
+system_public_prop(ctl_start_prop)
+system_public_prop(ctl_stop_prop)
+system_public_prop(dalvik_config_prop)
+system_public_prop(dalvik_dynamic_config_prop)
+system_public_prop(dalvik_runtime_prop)
+system_public_prop(debug_prop)
+system_public_prop(device_config_memory_safety_native_boot_prop)
+system_public_prop(device_config_memory_safety_native_prop)
+system_public_prop(dumpstate_options_prop)
+system_public_prop(exported_system_prop)
+system_public_prop(exported_bluetooth_prop)
+system_public_prop(exported_overlay_prop)
+system_public_prop(exported_pm_prop)
+system_public_prop(future_pm_prop)
+system_public_prop(ffs_control_prop)
+system_public_prop(framework_status_prop)
+system_public_prop(gesture_prop)
+system_public_prop(graphics_config_writable_prop)
+system_public_prop(hal_dumpstate_config_prop)
+system_public_prop(sota_prop)
+system_public_prop(hwservicemanager_prop)
+system_public_prop(lmkd_prop)
+system_public_prop(locale_prop)
+system_public_prop(logd_prop)
+system_public_prop(logpersistd_logging_prop)
+system_public_prop(log_prop)
+system_public_prop(log_tag_prop)
+system_public_prop(lowpan_prop)
+system_public_prop(nfc_prop)
+system_public_prop(ota_prop)
+system_public_prop(permissive_mte_prop)
+system_public_prop(powerctl_prop)
+system_public_prop(qemu_hw_prop)
+system_public_prop(qemu_sf_lcd_density_prop)
+system_public_prop(radio_control_prop)
+system_public_prop(radio_prop)
+system_public_prop(serialno_prop)
+system_public_prop(surfaceflinger_color_prop)
+system_public_prop(system_prop)
+system_public_prop(system_user_mode_emulation_prop)
+system_public_prop(telephony_status_prop)
+system_public_prop(timezone_prop)
+system_public_prop(usb_control_prop)
+system_public_prop(vold_post_fs_data_prop)
+system_public_prop(wifi_hal_prop)
+system_public_prop(wifi_log_prop)
+system_public_prop(wifi_prop)
+system_public_prop(zram_control_prop)
+
+# Properties which don't have entries on property_contexts
+system_internal_prop(default_prop)
+
+# Properties used in default HAL implementations
+vendor_internal_prop(rebootescrow_hal_prop)
+
+# Properties used in the default Face HAL implementations
+vendor_internal_prop(virtual_face_hal_prop)
+starting_at_board_api(202504, `
+ system_public_prop(virtual_face_prop)
+')
+
+# Properties used in the default Fingerprint HAL implementations
+vendor_internal_prop(virtual_fingerprint_hal_prop)
+starting_at_board_api(202504, `
+ system_public_prop(virtual_fingerprint_prop)
+')
+
+vendor_public_prop(persist_vendor_debug_wifi_prop)
+
+# Properties which are public for devices launching with Android O or earlier
+# This should not be used for any new properties.
+not_compatible_property(`
+ # DO NOT ADD ANY PROPERTIES HERE
+ system_public_prop(boottime_prop)
+ system_public_prop(charger_prop)
+ system_public_prop(cold_boot_done_prop)
+ system_public_prop(ctl_adbd_prop)
+ system_public_prop(ctl_apexd_prop)
+ system_public_prop(ctl_bootanim_prop)
+ system_public_prop(ctl_bugreport_prop)
+ system_public_prop(ctl_console_prop)
+ system_public_prop(ctl_dumpstate_prop)
+ system_public_prop(ctl_fuse_prop)
+ system_public_prop(ctl_gsid_prop)
+ system_public_prop(ctl_interface_restart_prop)
+ system_public_prop(ctl_interface_stop_prop)
+ system_public_prop(ctl_mdnsd_prop)
+ system_public_prop(ctl_restart_prop)
+ system_public_prop(ctl_rildaemon_prop)
+ system_public_prop(ctl_sigstop_prop)
+ system_public_prop(dynamic_system_prop)
+ system_public_prop(heapprofd_enabled_prop)
+ system_public_prop(llkd_prop)
+ system_public_prop(lpdumpd_prop)
+ system_public_prop(mmc_prop)
+ system_public_prop(mock_ota_prop)
+ system_public_prop(net_dns_prop)
+ system_public_prop(overlay_prop)
+ system_public_prop(persistent_properties_ready_prop)
+ system_public_prop(safemode_prop)
+ system_public_prop(system_lmk_prop)
+ system_public_prop(system_trace_prop)
+ system_public_prop(test_boot_reason_prop)
+ system_public_prop(time_prop)
+ system_public_prop(traced_enabled_prop)
+ system_public_prop(traced_lazy_prop)
+
+ system_public_prop(config_prop)
+ system_public_prop(cppreopt_prop)
+ system_public_prop(dalvik_prop)
+ system_public_prop(debuggerd_prop)
+ system_public_prop(device_logging_prop)
+ system_public_prop(dhcp_prop)
+ system_public_prop(dumpstate_prop)
+ system_public_prop(exported3_system_prop)
+ system_public_prop(exported_dumpstate_prop)
+ system_public_prop(exported_secure_prop)
+ system_public_prop(heapprofd_prop)
+ system_public_prop(net_radio_prop)
+ system_public_prop(pan_result_prop)
+ system_public_prop(persist_debug_prop)
+ system_public_prop(shell_prop)
+ system_public_prop(test_harness_prop)
+ system_public_prop(theme_prop)
+ system_public_prop(use_memfd_prop)
+ system_public_prop(vold_prop)
+')
+
+not_compatible_property(`
+ vendor_public_prop(vendor_default_prop)
+')
+
+compatible_property_only(`
+ vendor_internal_prop(vendor_default_prop)
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/radio.te b/prebuilts/api/202504/public/radio.te
new file mode 100644
index 0000000..3762486
--- /dev/null
+++ b/prebuilts/api/202504/public/radio.te
@@ -0,0 +1,6 @@
+# phone subsystem
+type radio, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/recovery.te b/prebuilts/api/202504/public/recovery.te
new file mode 100755
index 0000000..3d3425c
--- /dev/null
+++ b/prebuilts/api/202504/public/recovery.te
@@ -0,0 +1,9 @@
+# recovery console (used in recovery init.rc for /sbin/recovery)
+
+# Declare the domain unconditionally so we can always reference it
+# in neverallow rules.
+type recovery, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/recovery_persist.te b/prebuilts/api/202504/public/recovery_persist.te
new file mode 100644
index 0000000..329d714
--- /dev/null
+++ b/prebuilts/api/202504/public/recovery_persist.te
@@ -0,0 +1,7 @@
+# android recovery persistent log manager
+type recovery_persist, domain;
+type recovery_persist_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/recovery_refresh.te b/prebuilts/api/202504/public/recovery_refresh.te
new file mode 100644
index 0000000..10bb7be
--- /dev/null
+++ b/prebuilts/api/202504/public/recovery_refresh.te
@@ -0,0 +1,7 @@
+# android recovery refresh log manager
+type recovery_refresh, domain;
+type recovery_refresh_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/rkpd_app.te b/prebuilts/api/202504/public/rkpd_app.te
new file mode 100644
index 0000000..95b6d06
--- /dev/null
+++ b/prebuilts/api/202504/public/rkpd_app.te
@@ -0,0 +1,10 @@
+###
+### A domain for sandboxing the remote key provisioning daemon
+### app that is shipped via mainline.
+###
+
+type rkpdapp, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/roles b/prebuilts/api/202504/public/roles
new file mode 100644
index 0000000..ca92934
--- /dev/null
+++ b/prebuilts/api/202504/public/roles
@@ -0,0 +1 @@
+role r types domain;
diff --git a/prebuilts/api/202504/public/rs.te b/prebuilts/api/202504/public/rs.te
new file mode 100644
index 0000000..80ab39b
--- /dev/null
+++ b/prebuilts/api/202504/public/rs.te
@@ -0,0 +1,6 @@
+type rs, domain, coredomain;
+type rs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/rss_hwm_reset.te b/prebuilts/api/202504/public/rss_hwm_reset.te
new file mode 100644
index 0000000..7428a5b
--- /dev/null
+++ b/prebuilts/api/202504/public/rss_hwm_reset.te
@@ -0,0 +1,6 @@
+# rss_hwm_reset resets RSS high-water mark counters for all procesess.
+type rss_hwm_reset, domain, coredomain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/runas.te b/prebuilts/api/202504/public/runas.te
new file mode 100644
index 0000000..2ecf9b0
--- /dev/null
+++ b/prebuilts/api/202504/public/runas.te
@@ -0,0 +1,6 @@
+type runas, domain, mlstrustedsubject;
+type runas_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/runas_app.te b/prebuilts/api/202504/public/runas_app.te
new file mode 100644
index 0000000..b160a87
--- /dev/null
+++ b/prebuilts/api/202504/public/runas_app.te
@@ -0,0 +1,5 @@
+type runas_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/sdcardd.te b/prebuilts/api/202504/public/sdcardd.te
new file mode 100644
index 0000000..b7329ae
--- /dev/null
+++ b/prebuilts/api/202504/public/sdcardd.te
@@ -0,0 +1,6 @@
+type sdcardd, domain;
+type sdcardd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/secure_element.te b/prebuilts/api/202504/public/secure_element.te
new file mode 100644
index 0000000..26900cd
--- /dev/null
+++ b/prebuilts/api/202504/public/secure_element.te
@@ -0,0 +1,6 @@
+# secure_element subsystem
+type secure_element, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/service.te b/prebuilts/api/202504/public/service.te
new file mode 100644
index 0000000..db79fdf
--- /dev/null
+++ b/prebuilts/api/202504/public/service.te
@@ -0,0 +1,378 @@
+type aidl_lazy_test_service, service_manager_type;
+type apc_service, service_manager_type;
+type apex_service, service_manager_type;
+type artd_service, service_manager_type;
+type artd_pre_reboot_service, service_manager_type;
+type audioserver_service, service_manager_type, isolated_compute_allowed_service;
+type authorization_service, service_manager_type;
+type batteryproperties_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type bluetooth_service, service_manager_type;
+type cameraserver_service, service_manager_type, isolated_compute_allowed_service;
+type fwk_camera_service, service_manager_type;
+type default_android_service, service_manager_type;
+type device_config_updatable_service, system_api_service, system_server_service,service_manager_type;
+type dexopt_chroot_setup_service, service_manager_type;
+type dnsresolver_service, service_manager_type;
+type drmserver_service, service_manager_type;
+type dumpstate_service, service_manager_type;
+type evsmanagerd_service, service_manager_type;
+type fingerprintd_service, service_manager_type;
+type fwk_automotive_display_service, service_manager_type;
+type gatekeeper_service, app_api_service, service_manager_type;
+type gpu_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type idmap_service, service_manager_type;
+type incident_service, service_manager_type;
+type installd_service, service_manager_type;
+type credstore_service, app_api_service, service_manager_type;
+type keystore_compat_hal_service, service_manager_type;
+type keystore_maintenance_service, service_manager_type;
+type keystore_metrics_service, service_manager_type;
+type keystore_service, service_manager_type;
+type legacykeystore_service, service_manager_type;
+type lpdump_service, service_manager_type;
+type mdns_service, service_manager_type;
+type mediaserver_service, service_manager_type, isolated_compute_allowed_service;
+type mediametrics_service, service_manager_type;
+type mediaextractor_service, service_manager_type;
+type mediadrmserver_service, service_manager_type;
+type mediatranscoding_service, app_api_service, service_manager_type;
+type netd_service, service_manager_type;
+type nfc_service, service_manager_type;
+type ondevicepersonalization_system_service, system_api_service, system_server_service, service_manager_type;
+type ot_daemon_service, service_manager_type;
+type profiling_service, app_api_service, system_server_service, service_manager_type;
+type radio_service, service_manager_type;
+type secure_element_service, service_manager_type;
+type service_manager_service, service_manager_type;
+type storaged_service, service_manager_type;
+type surfaceflinger_service, app_api_service, ephemeral_app_api_service, service_manager_type;
+type system_app_service, service_manager_type;
+type system_net_netd_service, service_manager_type;
+type system_suspend_control_internal_service, service_manager_type;
+type system_suspend_control_service, service_manager_type;
+type update_engine_service, service_manager_type;
+type update_engine_stable_service, service_manager_type;
+type virtualization_service, service_manager_type;
+type virtual_camera_service, service_manager_type;
+type virtual_touchpad_service, service_manager_type;
+type vold_service, service_manager_type;
+type vr_hwc_service, service_manager_type;
+type vrflinger_vsync_service, service_manager_type;
+
+# system_server_services broken down
+type accessibility_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type account_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type activity_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type activity_task_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type adb_service, system_api_service, system_server_service, service_manager_type;
+type adservices_manager_service, system_api_service, system_server_service, service_manager_type;
+type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type app_binding_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+ type app_function_service, app_api_service, system_server_service, service_manager_type;
+')
+type app_hibernation_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type app_integrity_service, system_api_service, system_server_service, service_manager_type;
+type app_prediction_service, app_api_service, system_server_service, service_manager_type;
+type app_search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type appops_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type appwidget_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type archive_service, app_api_service, system_server_service, service_manager_type;
+type assetatlas_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type attestation_verification_service, app_api_service, system_server_service, service_manager_type;
+type audio_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type auth_service, app_api_service, system_server_service, service_manager_type;
+type autofill_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type backup_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type batterystats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type battery_service, system_server_service, service_manager_type;
+type binder_calls_stats_service, system_server_service, service_manager_type;
+type blob_store_service, app_api_service, system_server_service, service_manager_type;
+type bluetooth_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type broadcastradio_service, app_api_service, system_server_service, service_manager_type;
+type cacheinfo_service, system_api_service, system_server_service, service_manager_type;
+type cameraproxy_service, system_server_service, service_manager_type;
+type clipboard_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type cloudsearch_service, app_api_service, system_server_service, service_manager_type;
+type contexthub_service, app_api_service, system_server_service, service_manager_type;
+type contextual_search_service, app_api_service, system_server_service, service_manager_type;
+type crossprofileapps_service, app_api_service, system_server_service, service_manager_type;
+type IProxyService_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type companion_device_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connectivity_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connectivity_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type connmetrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type consumer_ir_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type content_capture_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type content_suggestions_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type content_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type country_detector_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+# Note: The coverage_service should only be enabled for userdebug / eng builds that were compiled
+# with EMMA_INSTRUMENT=true. We should consider locking this down in the future.
+type coverage_service, system_server_service, service_manager_type;
+type cpuinfo_service, system_api_service, system_server_service, service_manager_type;
+type cpu_monitor_service, system_server_service, service_manager_type;
+type credential_service, app_api_service, ephemeral_app_api_service, system_api_service, system_server_service, service_manager_type;
+type dataloader_manager_service, system_server_service, service_manager_type;
+type dbinfo_service, system_api_service, system_server_service, service_manager_type;
+type device_config_service, system_server_service, service_manager_type;
+type device_policy_service, app_api_service, system_server_service, service_manager_type;
+type device_state_service, app_api_service, system_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type deviceidle_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type device_identifiers_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type devicestoragemonitor_service, system_server_service, service_manager_type;
+type diskstats_service, system_api_service, system_server_service, service_manager_type;
+type display_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type domain_verification_service, app_api_service, system_server_service, service_manager_type;
+type color_display_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type ecm_enhanced_confirmation_service, app_api_service, system_server_service, service_manager_type;
+type external_vibrator_service, system_server_service, service_manager_type;
+type file_integrity_service, app_api_service, system_server_service, service_manager_type;
+type font_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type netd_listener_service, system_server_service, service_manager_type;
+type network_watchlist_service, system_server_service, service_manager_type;
+type devicelock_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type DockObserver_service, system_server_service, service_manager_type;
+type dreams_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type dropbox_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type ethernet_service, app_api_service, system_server_service, service_manager_type;
+type biometric_service, app_api_service, system_server_service, service_manager_type;
+type bugreport_service, app_api_service, system_server_service, service_manager_type;
+type platform_compat_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type face_service, app_api_service, system_server_service, service_manager_type;
+type fingerprint_service, app_api_service, system_server_service, service_manager_type;
+type fwk_altitude_service, system_server_service, service_manager_type;
+type fwk_stats_service, app_api_service, system_server_service, service_manager_type;
+type fwk_sensor_service, system_server_service, service_manager_type;
+type fwk_vibrator_control_service, system_server_service, service_manager_type;
+type game_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
+type gnss_time_update_service, system_server_service, service_manager_type;
+type grammatical_inflection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type graphicsstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type hardware_service, system_server_service, service_manager_type;
+type hardware_properties_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type hdmi_control_service, app_api_service, system_server_service, service_manager_type;
+type healthconnect_service, app_api_service, system_server_service, service_manager_type;
+type hint_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type imms_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type incremental_service, system_server_service, service_manager_type;
+type input_method_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+ type intrusion_detection_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+')
+type ipsec_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type iris_service, app_api_service, system_server_service, service_manager_type;
+type jobscheduler_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type launcherapps_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type legacy_permission_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type light_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type locale_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type location_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type location_time_zone_manager_service, system_server_service, service_manager_type;
+type lock_settings_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type looper_stats_service, system_server_service, service_manager_type;
+type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_projection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+ type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
+type media_router_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type media_session_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type meminfo_service, system_api_service, system_server_service, service_manager_type;
+type memtrackproxy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type midi_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type mount_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type music_recognition_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type nearby_service, app_api_service, system_server_service, service_manager_type;
+type netpolicy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type netstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type network_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type network_score_service, system_api_service, system_server_service, service_manager_type;
+type network_stack_service, system_server_service, service_manager_type;
+type network_time_update_service, system_server_service, service_manager_type;
+type notification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type oem_lock_service, system_api_service, system_server_service, service_manager_type;
+type otadexopt_service, system_server_service, service_manager_type;
+type overlay_service, system_api_service, system_server_service, service_manager_type;
+type pac_proxy_service, app_api_service, system_server_service, service_manager_type;
+type package_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type package_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type people_service, app_api_service, system_server_service, service_manager_type;
+type permission_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type permissionmgr_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type permission_checker_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type persistent_data_block_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type pinner_service, system_server_service, service_manager_type;
+type powerstats_service, app_api_service, system_server_service, service_manager_type;
+type power_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type print_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type processinfo_service, system_server_service, service_manager_type;
+type procstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type reboot_readiness_service, app_api_service, system_server_service, service_manager_type;
+type recovery_service, system_server_service, service_manager_type;
+type registry_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type remote_auth_service, app_api_service, system_server_service, service_manager_type;
+type remote_provisioning_service, system_server_service, service_manager_type;
+type resources_manager_service, system_api_service, system_server_service, service_manager_type;
+type restrictions_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type role_service, app_api_service, system_server_service, service_manager_type;
+type rollback_service, app_api_service, system_server_service, service_manager_type;
+type runtime_service, system_server_service, service_manager_type;
+type rttmanager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type samplingprofiler_service, system_server_service, service_manager_type;
+type scheduling_policy_service, system_server_service, service_manager_type;
+type search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type search_ui_service, app_api_service, system_server_service, service_manager_type;
+type sec_key_att_app_id_provider_service, app_api_service, system_server_service, service_manager_type;
+type security_state_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type selection_toolbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sensitive_content_protection_service, app_api_service, system_server_service, service_manager_type;
+type sensorservice_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sensor_privacy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type serial_service, system_api_service, system_server_service, service_manager_type;
+type servicediscovery_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type settings_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type shortcut_service, app_api_service, system_server_service, service_manager_type;
+type slice_service, app_api_service, system_server_service, service_manager_type;
+type smartspace_service, app_api_service, system_server_service, service_manager_type;
+type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type sdk_sandbox_service, app_api_service, system_server_service, service_manager_type;
+type system_config_service, system_api_service, system_server_service, service_manager_type;
+type system_server_dumper_service, system_api_service, system_server_service, service_manager_type;
+type system_update_service, system_server_service, service_manager_type;
+type soundtrigger_middleware_service, system_server_service, service_manager_type;
+type speech_recognition_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
+type tare_service, app_api_service, system_server_service, service_manager_type;
+type task_service, system_server_service, service_manager_type;
+type testharness_service, system_server_service, service_manager_type;
+type textclassification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type textservices_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type texttospeech_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type telecom_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type thermal_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type threadnetwork_service, app_api_service, system_server_service, service_manager_type;
+type timedetector_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type timezonedetector_service, app_api_service, system_server_service, service_manager_type;
+type translation_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type trust_service, app_api_service, system_server_service, service_manager_type;
+type tv_ad_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_iapp_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_tuner_resource_mgr_service, app_api_service, system_server_service, service_manager_type;
+type uimode_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type updatelock_service, system_api_service, system_server_service, service_manager_type;
+type uri_grants_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type usagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type usb_service, app_api_service, system_server_service, service_manager_type;
+type user_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type uwb_service, app_api_service, system_server_service, service_manager_type;
+type vcn_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vibrator_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type virtual_device_service, app_api_service, system_server_service, service_manager_type;
+type virtual_device_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type voiceinteraction_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vpn_management_service, app_api_service, system_server_service, service_manager_type;
+type vr_manager_service, system_server_service, service_manager_type;
+type wallpaper_service, app_api_service, system_server_service, service_manager_type;
+type wallpaper_effects_generation_service, app_api_service, system_server_service, service_manager_type;
+type webviewupdate_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type wifip2p_service, app_api_service, system_server_service, service_manager_type;
+type wifiscanner_service, app_api_service, system_server_service, service_manager_type;
+type wifi_service, app_api_service, system_server_service, service_manager_type;
+type wifinl80211_service, service_manager_type;
+type wifiaware_service, app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+ type wifi_usd_service, app_api_service, system_server_service, service_manager_type;
+')
+type window_service, system_api_service, system_server_service, service_manager_type;
+type inputflinger_service, system_api_service, system_server_service, service_manager_type;
+type tethering_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type emergency_affordance_service, system_server_service, service_manager_type;
+
+###
+### HAL Services
+###
+
+type hal_audio_service, protected_service, hal_service_type, service_manager_type;
+type hal_audiocontrol_service, hal_service_type, service_manager_type;
+type hal_authgraph_service, protected_service, hal_service_type, service_manager_type;
+type hal_authsecret_service, protected_service, hal_service_type, service_manager_type;
+type hal_bluetooth_service, protected_service, hal_service_type, service_manager_type;
+type hal_bootctl_service, protected_service, hal_service_type, service_manager_type;
+type hal_broadcastradio_service, protected_service, hal_service_type, service_manager_type;
+type hal_camera_service, protected_service, hal_service_type, service_manager_type;
+type hal_can_controller_service, protected_service, hal_service_type, service_manager_type;
+type hal_cas_service, hal_service_type, service_manager_type;
+type hal_codec2_service, hal_service_type, service_manager_type, isolated_compute_allowed_service;
+type hal_confirmationui_service, protected_service, hal_service_type, service_manager_type;
+type hal_contexthub_service, protected_service, hal_service_type, service_manager_type;
+type hal_drm_service, hal_service_type, service_manager_type;
+type hal_dumpstate_service, protected_service, hal_service_type, service_manager_type;
+type hal_evs_service, protected_service, hal_service_type, service_manager_type;
+type hal_face_service, protected_service, hal_service_type, service_manager_type;
+type hal_fastboot_service, protected_service, hal_service_type, service_manager_type;
+type hal_fingerprint_service, protected_service, hal_service_type, service_manager_type;
+type hal_gnss_service, protected_service, hal_service_type, service_manager_type;
+type hal_graphics_allocator_service, hal_service_type, service_manager_type;
+type hal_graphics_composer_service, protected_service, hal_service_type, service_manager_type;
+type hal_graphics_mapper_service, hal_service_type, service_manager_type;
+type hal_health_service, protected_service, hal_service_type, service_manager_type;
+type hal_health_storage_service, protected_service, hal_service_type, service_manager_type;
+type hal_identity_service, protected_service, hal_service_type, service_manager_type;
+type hal_input_processor_service, protected_service, hal_service_type, service_manager_type;
+type hal_ir_service, protected_service, hal_service_type, service_manager_type;
+type hal_ivn_service, protected_service, hal_service_type, service_manager_type;
+type hal_keymint_service, protected_service, hal_service_type, service_manager_type;
+type hal_light_service, protected_service, hal_service_type, service_manager_type;
+type hal_macsec_service, protected_service, hal_service_type, service_manager_type;
+starting_at_board_api(202504, `
+ type hal_mediaquality_service, protected_service, hal_service_type, service_manager_type;
+')
+type hal_memtrack_service, protected_service, hal_service_type, service_manager_type;
+type hal_neuralnetworks_service, hal_service_type, service_manager_type;
+type hal_nfc_service, protected_service, hal_service_type, service_manager_type;
+type hal_oemlock_service, protected_service, hal_service_type, service_manager_type;
+type hal_power_service, protected_service, hal_service_type, service_manager_type;
+type hal_power_stats_service, protected_service, hal_service_type, service_manager_type;
+type hal_radio_service, protected_service, hal_service_type, service_manager_type;
+type hal_rebootescrow_service, protected_service, hal_service_type, service_manager_type;
+type hal_remoteaccess_service, protected_service, hal_service_type, service_manager_type;
+type hal_remotelyprovisionedcomponent_avf_service, protected_service, hal_service_type, service_manager_type;
+type hal_remotelyprovisionedcomponent_service, protected_service, hal_service_type, service_manager_type;
+type hal_sensors_service, protected_service, hal_service_type, service_manager_type;
+type hal_secretkeeper_service, protected_service, hal_service_type, service_manager_type;
+type hal_secureclock_service, protected_service, hal_service_type, service_manager_type;
+type hal_secure_element_service, protected_service, hal_service_type, service_manager_type;
+type hal_sharedsecret_service, protected_service, hal_service_type, service_manager_type;
+type hal_system_suspend_service, protected_service, hal_service_type, service_manager_type;
+type hal_tetheroffload_service, protected_service, hal_service_type, service_manager_type;
+type hal_thermal_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_cec_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_connection_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_hdmi_earc_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_input_service, protected_service, hal_service_type, service_manager_type;
+type hal_threadnetwork_service, protected_service, hal_service_type, service_manager_type;
+type hal_tv_tuner_service, protected_service, hal_service_type, service_manager_type;
+type hal_usb_service, protected_service, hal_service_type, service_manager_type;
+type hal_usb_gadget_service, protected_service, hal_service_type, service_manager_type;
+type hal_uwb_service, protected_service, hal_service_type, service_manager_type;
+type hal_vehicle_service, protected_service, hal_service_type, service_manager_type;
+type hal_vibrator_service, protected_service, hal_service_type, service_manager_type;
+type hal_weaver_service, protected_service, hal_service_type, service_manager_type;
+type hal_nlinterceptor_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_hostapd_service, protected_service, hal_service_type, service_manager_type;
+type hal_wifi_supplicant_service, protected_service, hal_service_type, service_manager_type;
+type hal_gatekeeper_service, protected_service, hal_service_type, service_manager_type;
+starting_at_board_api(202504, `
+ type hal_vm_capabilities_service, protected_service, hal_service_type, service_manager_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/servicemanager.te b/prebuilts/api/202504/public/servicemanager.te
new file mode 100644
index 0000000..3409993
--- /dev/null
+++ b/prebuilts/api/202504/public/servicemanager.te
@@ -0,0 +1,7 @@
+# servicemanager - the Binder context manager
+type servicemanager, domain, mlstrustedsubject;
+type servicemanager_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/sgdisk.te b/prebuilts/api/202504/public/sgdisk.te
new file mode 100644
index 0000000..c4468e2
--- /dev/null
+++ b/prebuilts/api/202504/public/sgdisk.te
@@ -0,0 +1,7 @@
+# sgdisk called from vold
+type sgdisk, domain;
+type sgdisk_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/shared_relro.te b/prebuilts/api/202504/public/shared_relro.te
new file mode 100644
index 0000000..fdee99f
--- /dev/null
+++ b/prebuilts/api/202504/public/shared_relro.te
@@ -0,0 +1,6 @@
+# Process which creates/updates shared RELRO files to be used by other apps.
+type shared_relro, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/shell.te b/prebuilts/api/202504/public/shell.te
new file mode 100644
index 0000000..189976d
--- /dev/null
+++ b/prebuilts/api/202504/public/shell.te
@@ -0,0 +1,7 @@
+# Domain for shell processes spawned by ADB or console service.
+type shell, domain, mlstrustedsubject;
+type shell_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/simpleperf.te b/prebuilts/api/202504/public/simpleperf.te
new file mode 100644
index 0000000..c13d241
--- /dev/null
+++ b/prebuilts/api/202504/public/simpleperf.te
@@ -0,0 +1,5 @@
+type simpleperf, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/simpleperf_app_runner.te b/prebuilts/api/202504/public/simpleperf_app_runner.te
new file mode 100644
index 0000000..f2a6172
--- /dev/null
+++ b/prebuilts/api/202504/public/simpleperf_app_runner.te
@@ -0,0 +1,6 @@
+type simpleperf_app_runner, domain, mlstrustedsubject;
+type simpleperf_app_runner_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/slideshow.te b/prebuilts/api/202504/public/slideshow.te
new file mode 100644
index 0000000..4ead98c
--- /dev/null
+++ b/prebuilts/api/202504/public/slideshow.te
@@ -0,0 +1,7 @@
+# slideshow seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type slideshow, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/statsd.te b/prebuilts/api/202504/public/statsd.te
new file mode 100644
index 0000000..52f4132
--- /dev/null
+++ b/prebuilts/api/202504/public/statsd.te
@@ -0,0 +1,6 @@
+type statsd, domain, mlstrustedsubject;
+type statsd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/su.te b/prebuilts/api/202504/public/su.te
new file mode 100644
index 0000000..6936f67
--- /dev/null
+++ b/prebuilts/api/202504/public/su.te
@@ -0,0 +1,13 @@
+# Domain used for su processes, as well as for adbd and adb shell
+# after performing an adb root command.
+
+# All types must be defined regardless of build variant to ensure
+# policy compilation succeeds with userdebug/user combination at boot
+type su, domain;
+
+# File types must be defined for file_contexts.
+type su_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/surfaceflinger.te b/prebuilts/api/202504/public/surfaceflinger.te
new file mode 100644
index 0000000..531b3da
--- /dev/null
+++ b/prebuilts/api/202504/public/surfaceflinger.te
@@ -0,0 +1,7 @@
+# surfaceflinger - display compositor service
+type surfaceflinger, domain;
+type surfaceflinger_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/system_app.te b/prebuilts/api/202504/public/system_app.te
new file mode 100644
index 0000000..8e1d5dc
--- /dev/null
+++ b/prebuilts/api/202504/public/system_app.te
@@ -0,0 +1,11 @@
+###
+### Apps that run with the system UID, e.g. com.android.system.ui,
+### com.android.settings. These are not as privileged as the system
+### server.
+###
+
+type system_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/system_server.te b/prebuilts/api/202504/public/system_server.te
new file mode 100644
index 0000000..55b163b
--- /dev/null
+++ b/prebuilts/api/202504/public/system_server.te
@@ -0,0 +1,10 @@
+#
+# System Server aka system_server spawned by zygote.
+# Most of the framework services run in this process.
+#
+type system_server, domain;
+type system_server_tmpfs, file_type, mlstrustedobject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/te_macros b/prebuilts/api/202504/public/te_macros
new file mode 100644
index 0000000..2ba15b3
--- /dev/null
+++ b/prebuilts/api/202504/public/te_macros
@@ -0,0 +1,1100 @@
+#####################################
+# domain_trans(olddomain, type, newdomain)
+# Allow a transition from olddomain to newdomain
+# upon executing a file labeled with type.
+# This only allows the transition; it does not
+# cause it to occur automatically - use domain_auto_trans
+# if that is what you want.
+#
+define(`domain_trans', `
+# Old domain may exec the file and transition to the new domain.
+allow $1 $2:file { getattr open read execute map };
+allow $1 $3:process transition;
+# New domain is entered by executing the file.
+allow $3 $2:file { entrypoint open read execute getattr map };
+# New domain can send SIGCHLD to its caller.
+ifelse($1, `init', `', `allow $3 $1:process sigchld;')
+# Enable AT_SECURE, i.e. libc secure mode.
+dontaudit $1 $3:process noatsecure;
+# XXX dontaudit candidate but requires further study.
+allow $1 $3:process { siginh rlimitinh };
+')
+
+#####################################
+# domain_auto_trans(olddomain, type, newdomain)
+# Automatically transition from olddomain to newdomain
+# upon executing a file labeled with type.
+#
+define(`domain_auto_trans', `
+# Allow the necessary permissions.
+domain_trans($1,$2,$3)
+# Make the transition occur by default.
+type_transition $1 $2:process $3;
+')
+
+#####################################
+# file_type_trans(domain, dir_type, file_type)
+# Allow domain to create a file labeled file_type in a
+# directory labeled dir_type.
+# This only allows the transition; it does not
+# cause it to occur automatically - use file_type_auto_trans
+# if that is what you want.
+#
+define(`file_type_trans', `
+# Allow the domain to add entries to the directory.
+allow $1 $2:dir ra_dir_perms;
+# Allow the domain to create the file.
+allow $1 $3:notdevfile_class_set create_file_perms;
+allow $1 $3:dir create_dir_perms;
+')
+
+#####################################
+# file_type_auto_trans(domain, dir_type, file_type)
+# Automatically label new files with file_type when
+# they are created by domain in directories labeled dir_type.
+#
+define(`file_type_auto_trans', `
+# Allow the necessary permissions.
+file_type_trans($1, $2, $3)
+# Make the transition occur by default.
+type_transition $1 $2:dir $3;
+type_transition $1 $2:notdevfile_class_set $3;
+')
+
+#####################################
+# r_dir_file(domain, type)
+# Allow the specified domain to read directories, files
+# and symbolic links of the specified type.
+define(`r_dir_file', `
+allow $1 $2:dir r_dir_perms;
+allow $1 $2:{ file lnk_file } r_file_perms;
+')
+
+#####################################
+# tmpfs_domain(domain)
+# Allow access to a unique type for this domain when creating tmpfs / ashmem files.
+define(`tmpfs_domain', `
+type_transition $1 tmpfs:file $1_tmpfs;
+allow $1 $1_tmpfs:file { read write getattr map };
+')
+
+# pdx macros for IPC. pdx is a high-level name which contains transport-specific
+# rules from underlying transport (e.g. UDS-based implementation).
+
+#####################################
+# pdx_service_attributes(service)
+# Defines type attribute used to identify various service-related types.
+define(`pdx_service_attributes', `
+attribute pdx_$1_endpoint_dir_type;
+attribute pdx_$1_endpoint_socket_type;
+attribute pdx_$1_channel_socket_type;
+attribute pdx_$1_server_type;
+')
+
+#####################################
+# pdx_service_socket_types(service, endpoint_dir_t)
+# Define types for endpoint and channel sockets.
+define(`pdx_service_socket_types', `
+typeattribute $2 pdx_$1_endpoint_dir_type;
+type pdx_$1_endpoint_socket, pdx_$1_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject;
+type pdx_$1_channel_socket, pdx_$1_channel_socket_type, pdx_channel_socket_type, coredomain_socket;
+userdebug_or_eng(`
+dontaudit su pdx_$1_endpoint_socket:unix_stream_socket *;
+dontaudit su pdx_$1_channel_socket:unix_stream_socket *;
+')
+')
+
+#####################################
+# pdx_server(server_domain, service)
+define(`pdx_server', `
+# Mark the server domain as a PDX server.
+typeattribute $1 pdx_$2_server_type;
+# Allow the init process to create the initial endpoint socket.
+allow init pdx_$2_endpoint_socket_type:unix_stream_socket { create bind };
+# Allow the server domain to use the endpoint socket and accept connections on it.
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+# than we need (e.g. we don"t need "bind" or "connect").
+allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept };
+# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()).
+allow $1 self:process setsockcreate;
+# Allow the server domain to create a client channel socket.
+allow $1 pdx_$2_channel_socket_type:unix_stream_socket create_stream_socket_perms;
+# Prevent other processes from claiming to be a server for the same service.
+neverallow {domain -$1} pdx_$2_endpoint_socket_type:unix_stream_socket { listen accept };
+')
+
+#####################################
+# pdx_connect(client, service)
+define(`pdx_connect', `
+# Allow client to open the service endpoint file.
+allow $1 pdx_$2_endpoint_dir_type:dir r_dir_perms;
+allow $1 pdx_$2_endpoint_socket_type:sock_file rw_file_perms;
+# Allow the client to connect to endpoint socket.
+allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { connectto read write shutdown };
+')
+
+#####################################
+# pdx_use(client, service)
+define(`pdx_use', `
+# Allow the client to use the PDX channel socket.
+# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights
+# than we need (e.g. we don"t need "bind" or "connect").
+allow $1 pdx_$2_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown };
+# Client needs to use an channel event fd from the server.
+allow $1 pdx_$2_server_type:fd use;
+# Servers may receive sync fences, gralloc buffers, etc, from clients.
+# This could be tightened on a per-server basis, but keeping track of service
+# clients is error prone.
+allow pdx_$2_server_type $1:fd use;
+')
+
+#####################################
+# pdx_client(client, service)
+define(`pdx_client', `
+pdx_connect($1, $2)
+pdx_use($1, $2)
+')
+
+#####################################
+# init_daemon_domain(domain)
+# Set up a transition from init to the daemon domain
+# upon executing its binary.
+define(`init_daemon_domain', `
+domain_auto_trans(init, $1_exec, $1)
+')
+
+####################################
+# userfaultfd_use(domain)
+# Allow domain to create/use userfaultfd.
+define(`userfaultfd_use', `
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+type $1_userfaultfd;
+type_transition $1 $1:anon_inode $1_userfaultfd "[userfaultfd]";
+# Allow domain to create/use userfaultfd anon_inode.
+allow $1 $1_userfaultfd:anon_inode { create ioctl read };
+# Suppress errors generate during bugreport
+dontaudit su $1_userfaultfd:anon_inode *;
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+neverallow { domain -$1 } $1_userfaultfd:anon_inode *;
+')
+
+####################################
+# virtualizationservice_use(domain)
+# Allow domain to create and communicate with a virtual machine using
+# virtualizationservice and virtualizationmanager.
+define(`virtualizationservice_use', `
+# Transition to virtualizationmanager when the client executes it.
+domain_auto_trans($1, virtualizationmanager_exec, virtualizationmanager)
+# Allow virtualizationmanager to communicate over UDS with the client.
+allow { virtualizationmanager crosvm } $1:unix_stream_socket { ioctl getattr read write };
+# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
+allow { virtualizationmanager crosvm } $1:fd use;
+# Let the client use file descriptors created by virtualizationmanager.
+allow $1 virtualizationmanager:fd use;
+# Allow piping console log to the client
+allow { virtualizationmanager crosvm } $1:fifo_file { ioctl getattr read write };
+# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
+# that it created. Notice that we do not grant permission to create a vsock;
+# the client can only connect to VMs that it owns.
+allow $1 virtualizationmanager:vsock_socket { getattr getopt read write };
+# Allow client to inspect hypervisor capabilities
+get_prop($1, hypervisor_prop)
+# Allow client to read (but not open) the crashdump provided by virtualizationmanager
+allow $1 virtualizationservice_data_file:file { getattr read };
+# Allow virtualizationmanager to read the path of the client using /proc/{PID}/exe
+allow virtualizationmanager $1:dir search;
+allow virtualizationmanager $1:file read;
+allow virtualizationmanager $1:lnk_file read;
+')
+
+####################################
+# early_virtmgr_use(domain)
+# Allow domain to create and communicate with an early virtual machine using
+# early_virtmgr.
+define(`early_virtmgr_use', `
+# Transition to early_virtmgr when the client executes it.
+domain_auto_trans($1, early_virtmgr_exec, early_virtmgr)
+# Allow early_virtmgr to communicate over UDS with the client.
+allow { early_virtmgr crosvm } $1:unix_stream_socket { ioctl getattr read write };
+# Let the client pass file descriptors to early_virtmgr and on to crosvm.
+allow { early_virtmgr crosvm } $1:fd use;
+allow { early_virtmgr crosvm } $1_tmpfs:file rw_file_perms;
+# Let the client use file descriptors created by early_virtmgr.
+allow $1 early_virtmgr:fd use;
+# Allow piping console log to the client
+allow { early_virtmgr crosvm } $1:fifo_file { ioctl getattr read write };
+# Allow client to read/write vsock created by early_virtmgr to communicate with the VM
+# that it created. Notice that we do not grant permission to create a vsock;
+# the client can only connect to VMs that it owns.
+allow $1 early_virtmgr:vsock_socket { getattr getopt read write };
+# Allow client to inspect hypervisor capabilities
+get_prop($1, hypervisor_prop)
+# Allow early_virtmgr to read the path of the client using /proc/{PID}/exe
+allow early_virtmgr $1:dir search;
+allow early_virtmgr $1:file read;
+allow early_virtmgr $1:lnk_file read;
+')
+
+#####################################
+# app_domain(domain)
+# Allow a base set of permissions required for all apps.
+define(`app_domain', `
+typeattribute $1 appdomain;
+# Label tmpfs objects for all apps.
+type_transition $1 tmpfs:file appdomain_tmpfs;
+userfaultfd_use($1)
+allow $1 appdomain_tmpfs:file { execute getattr map read write };
+neverallow { $1 -runas_app -shell -simpleperf } { domain -$1 }:file no_rw_file_perms;
+neverallow { appdomain -runas_app -shell -simpleperf -$1 } $1:file no_rw_file_perms;
+# The Android security model guarantees the confidentiality and integrity
+# of application data and execution state. Ptrace bypasses those
+# confidentiality guarantees. Disallow ptrace access from system components to
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+# simpleperf is excluded, as it operates only on debuggable or profileable
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+# live lock conditions.
+neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app -simpleperf } $1:process ptrace;
+')
+
+#####################################
+# untrusted_app_domain(domain)
+# Allow a base set of permissions required for all untrusted apps.
+define(`untrusted_app_domain', `
+typeattribute $1 untrusted_app_all;
+')
+
+#####################################
+# isolated_app_domain(domain)
+# Allow a base set of permissions required for all isolated apps.
+define(`isolated_app_domain', `
+typeattribute $1 isolated_app_all;
+')
+
+#####################################
+# net_domain(domain)
+# Allow a base set of permissions required for network access.
+define(`net_domain', `
+typeattribute $1 netdomain;
+')
+
+#####################################
+# bluetooth_domain(domain)
+# Allow a base set of permissions required for bluetooth access.
+define(`bluetooth_domain', `
+typeattribute $1 bluetoothdomain;
+')
+
+#####################################
+# hal_attribute(hal_name)
+# Add an attribute for hal implementations along with necessary
+# restrictions.
+define(`hal_attribute', `
+attribute hal_$1;
+expandattribute hal_$1 true;
+attribute hal_$1_client;
+expandattribute hal_$1_client true;
+attribute hal_$1_server;
+expandattribute hal_$1_server false;
+
+neverallow { hal_$1_server -halserverdomain } domain:process fork;
+# hal_*_client and halclientdomain attributes are always expanded for
+# performance reasons. Neverallow rules targeting expanded attributes can not be
+# verified by CTS since these attributes are already expanded by that time.
+build_test_only(`
+neverallow { hal_$1_server -hal_$1 } domain:process fork;
+neverallow { hal_$1_client -halclientdomain } domain:process fork;
+')
+')
+
+#####################################
+# hal_server_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to offer a
+# HAL implementation of the specified type over HwBinder.
+#
+# For example, default implementation of Foo HAL:
+# type hal_foo_default, domain;
+# hal_server_domain(hal_foo_default, hal_foo)
+#
+define(`hal_server_domain', `
+typeattribute $1 halserverdomain;
+typeattribute $1 $2_server;
+typeattribute $1 $2;
+')
+
+#####################################
+# hal_client_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to be a
+# client of a HAL of the specified type.
+#
+# For example, make some_domain a client of Foo HAL:
+# hal_client_domain(some_domain, hal_foo)
+#
+define(`hal_client_domain', `
+typeattribute $1 halclientdomain;
+typeattribute $1 $2_client;
+
+# TODO(b/34170079): Make the inclusion of the rules below conditional also on
+# non-Treble devices. For now, on non-Treble device, always grant clients of a
+# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
+not_full_treble(`
+typeattribute $1 $2;
+# Find passthrough HAL implementations
+allow $2 system_file:dir r_dir_perms;
+allow $2 vendor_file:dir r_dir_perms;
+allow $2 vendor_file:file { read open getattr execute map };
+')
+')
+
+#####################################
+# passthrough_hal_client_domain(domain, hal_type)
+# Allow a base set of permissions required for a domain to be a
+# client of a passthrough HAL of the specified type.
+#
+# For example, make some_domain a client of passthrough Foo HAL:
+# passthrough_hal_client_domain(some_domain, hal_foo)
+#
+define(`passthrough_hal_client_domain', `
+typeattribute $1 halclientdomain;
+typeattribute $1 $2_client;
+typeattribute $1 $2;
+# Find passthrough HAL implementations
+allow $2 system_file:dir r_dir_perms;
+allow $2 vendor_file:dir r_dir_perms;
+allow $2 vendor_file:file { read open getattr execute map };
+')
+
+#####################################
+# unix_socket_connect(clientdomain, socket, serverdomain)
+# Allow a local socket connection from clientdomain via
+# socket to serverdomain.
+#
+# Note: If you see denial records that distill to the
+# following allow rules:
+# allow clientdomain property_socket:sock_file write;
+# allow clientdomain init:unix_stream_socket connectto;
+# allow clientdomain something_prop:property_service set;
+#
+# This sequence is indicative of attempting to set a property.
+# use set_prop(sourcedomain, targetproperty)
+#
+define(`unix_socket_connect', `
+allow $1 $2_socket:sock_file write;
+allow $1 $3:unix_stream_socket connectto;
+')
+
+#####################################
+# set_prop(sourcedomain, targetproperty)
+# Allows source domain to set the
+# targetproperty.
+#
+define(`set_prop', `
+unix_socket_connect($1, property, init)
+allow $1 $2:property_service set;
+get_prop($1, $2)
+')
+
+#####################################
+# get_prop(sourcedomain, targetproperty)
+# Allows source domain to read the
+# targetproperty.
+#
+define(`get_prop', `
+allow $1 $2:file { getattr open read map };
+')
+
+#####################################
+# unix_socket_send(clientdomain, socket, serverdomain)
+# Allow a local socket send from clientdomain via
+# socket to serverdomain.
+define(`unix_socket_send', `
+allow $1 $2_socket:sock_file write;
+allow $1 $3:unix_dgram_socket sendto;
+')
+
+#####################################
+# binder_use(domain)
+# Allow domain to use Binder IPC.
+define(`binder_use', `
+# Call the servicemanager and transfer references to it.
+allow $1 servicemanager:binder { call transfer };
+# Allow servicemanager to send out callbacks
+allow servicemanager $1:binder { call transfer };
+# servicemanager performs getpidcon on clients.
+allow servicemanager $1:dir search;
+allow servicemanager $1:file { read open };
+allow servicemanager $1:process getattr;
+# rw access to /dev/binder and /dev/ashmem is presently granted to
+# all domains in domain.te.
+')
+
+#####################################
+# hwbinder_use(domain)
+# Allow domain to use HwBinder IPC.
+define(`hwbinder_use', `
+# Call the hwservicemanager and transfer references to it.
+allow $1 hwservicemanager:binder { call transfer };
+# Allow hwservicemanager to send out callbacks
+allow hwservicemanager $1:binder { call transfer };
+# hwservicemanager performs getpidcon on clients.
+allow hwservicemanager $1:dir search;
+allow hwservicemanager $1:file { read open map };
+allow hwservicemanager $1:process getattr;
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+# all domains in domain.te.
+')
+
+#####################################
+# vndbinder_use(domain)
+# Allow domain to use Binder IPC.
+define(`vndbinder_use', `
+# Talk to the vndbinder device node
+allow $1 vndbinder_device:chr_file rw_file_perms;
+# Call the vndservicemanager and transfer references to it.
+allow $1 vndservicemanager:binder { call transfer };
+# vndservicemanager performs getpidcon on clients.
+allow vndservicemanager $1:dir search;
+allow vndservicemanager $1:file { read open map };
+allow vndservicemanager $1:process getattr;
+')
+
+#####################################
+# binder_call(clientdomain, serverdomain)
+# Allow clientdomain to perform binder IPC to serverdomain.
+define(`binder_call', `
+# Call the server domain and optionally transfer references to it.
+allow $1 $2:binder { call transfer };
+# Allow the serverdomain to transfer references to the client on the reply.
+allow $2 $1:binder transfer;
+# Receive and use open files from the server.
+allow $1 $2:fd use;
+')
+
+#####################################
+# binder_service(domain)
+# Deprecated. Consider granting the exact permissions required by your service.
+define(`binder_service', `
+typeattribute $1 binderservicedomain;
+')
+
+#####################################
+# wakelock_use(domain)
+# Allow domain to manage wake locks
+define(`wakelock_use', `
+# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is
+# deprecated.
+# Access /sys/power/wake_lock and /sys/power/wake_unlock
+allow $1 sysfs_wake_lock:file rw_file_perms;
+# Accessing these files requires CAP_BLOCK_SUSPEND
+allow $1 self:global_capability2_class_set block_suspend;
+# system_suspend permissions
+binder_call($1, system_suspend_server)
+allow $1 system_suspend_hwservice:hwservice_manager find;
+# halclientdomain permissions
+hwbinder_use($1)
+get_prop($1, hwservicemanager_prop)
+allow $1 hidl_manager_hwservice:hwservice_manager find;
+# AIDL suspend hal permissions
+allow $1 hal_system_suspend_service:service_manager find;
+binder_use($1)
+')
+
+#####################################
+# selinux_check_access(domain)
+# Allow domain to check SELinux permissions via selinuxfs.
+define(`selinux_check_access', `
+r_dir_file($1, selinuxfs)
+allow $1 selinuxfs:file w_file_perms;
+allow $1 kernel:security compute_av;
+allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
+')
+
+#####################################
+# selinux_check_context(domain)
+# Allow domain to check SELinux contexts via selinuxfs.
+define(`selinux_check_context', `
+r_dir_file($1, selinuxfs)
+allow $1 selinuxfs:file w_file_perms;
+allow $1 kernel:security check_context;
+')
+
+#####################################
+# create_pty(domain)
+# Allow domain to create and use a pty, isolated from any other domain ptys.
+define(`create_pty', `
+# Each domain gets a unique devpts type.
+type $1_devpts, fs_type;
+# Label the pty with the unique type when created.
+type_transition $1 devpts:chr_file $1_devpts;
+# Allow use of the pty after creation.
+allow $1 $1_devpts:chr_file { open getattr read write ioctl };
+allowxperm $1 $1_devpts:chr_file ioctl unpriv_tty_ioctls;
+# TIOCSTI is only ever used for exploits. Block it.
+# b/33073072, b/7530569
+# http://www.openwall.com/lists/oss-security/2016/09/26/14
+neverallowxperm * $1_devpts:chr_file ioctl TIOCSTI;
+# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
+# allowed to everyone via domain.te.
+')
+
+#####################################
+# Non system_app application set
+#
+define(`non_system_app_set', `{ appdomain -system_app }')
+
+#####################################
+# Recovery only
+# SELinux rules which apply only to recovery mode
+#
+define(`recovery_only', ifelse(target_recovery, `true', $1, ))
+
+#####################################
+# Not recovery
+# SELinux rules which apply only to non-recovery (normal) mode
+#
+define(`not_recovery', ifelse(target_recovery, `true', , $1))
+
+#####################################
+# Full TREBLE only
+# SELinux rules which apply only to full TREBLE devices
+#
+define(`full_treble_only', ifelse(target_full_treble, `true', $1,
+ifelse(target_full_treble, `cts',
+# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+#####################################
+# Not full TREBLE
+# SELinux rules which apply only to devices which are not full TREBLE devices
+#
+define(`not_full_treble', ifelse(target_full_treble, `true', , $1))
+
+#####################################
+# enforce_debugfs_restriction
+# SELinux rules which apply to devices that enable debugfs restrictions.
+# The keyword "cts" is used to insert markers to only CTS test the neverallows
+# added by the macro for S-launch devices and newer.
+define(`enforce_debugfs_restriction', ifelse(target_enforce_debugfs_restriction, `true', $1,
+ifelse(target_enforce_debugfs_restriction, `cts',
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+#####################################
+# no_debugfs_restriction
+# SELinux rules which apply to devices that do not have debugfs restrictions in non-user builds.
+define(`no_debugfs_restriction', ifelse(target_enforce_debugfs_restriction, `true', , $1))
+
+#####################################
+# Compatible property only
+# SELinux rules which apply only to devices with compatible property
+#
+define(`compatible_property_only', ifelse(target_compatible_property, `true', $1,
+ifelse(target_compatible_property, `cts',
+# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+#####################################
+# Not compatible property
+# SELinux rules which apply only to devices without compatible property
+#
+define(`not_compatible_property', ifelse(target_compatible_property, `true', , $1))
+
+#####################################
+# Userdebug or eng builds
+# SELinux rules which apply only to userdebug or eng builds
+#
+define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1)))
+
+#####################################
+# asan builds
+# SELinux rules which apply only to asan builds
+#
+define(`with_asan', ifelse(target_with_asan, `true', userdebug_or_eng(`$1'), ))
+
+#####################################
+# native coverage builds
+# SELinux rules which apply only to builds with native coverage
+#
+define(`with_native_coverage', ifelse(target_with_native_coverage, `true', userdebug_or_eng(`$1'), ))
+
+#####################################
+# Build-time-only test
+# SELinux rules which are verified during build, but not as part of *TS testing.
+#
+define(`build_test_only', ifelse(target_exclude_build_test, `true', , $1))
+
+####################################
+# Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp).
+#
+define(`crash_dump_fallback', `
+userdebug_or_eng(`
+ allow $1 su:fifo_file append;
+')
+allow $1 anr_data_file:file append;
+allow $1 dumpstate:fd use;
+allow $1 incidentd:fd use;
+# TODO: Figure out why write is needed.
+allow $1 dumpstate:fifo_file { append write };
+allow $1 incidentd:fifo_file { append write };
+allow $1 system_server:fifo_file { append write };
+allow $1 tombstoned:unix_stream_socket connectto;
+allow $1 tombstoned:fd use;
+allow $1 tombstoned_crash_socket:sock_file write;
+allow $1 tombstone_data_file:file append;
+')
+
+#####################################
+# WITH_DEXPREOPT builds
+# SELinux rules which apply only when pre-opting.
+#
+define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1))
+
+#####################################
+# write_logd(domain)
+# Ability to write to android log
+# daemon via sockets
+define(`write_logd', `
+unix_socket_send($1, logdw, logd)
+allow $1 pmsg_device:chr_file w_file_perms;
+')
+
+#####################################
+# read_logd(domain)
+# Ability to run logcat and read from android
+# log daemon via sockets
+define(`read_logd', `
+allow $1 logcat_exec:file rx_file_perms;
+unix_socket_connect($1, logdr, logd)
+')
+
+#####################################
+# read_runtime_log_tags(domain)
+# ability to directly map the runtime event log tags
+define(`read_runtime_log_tags', `
+allow $1 runtime_event_log_tags_file:file r_file_perms;
+')
+
+#####################################
+# control_logd(domain)
+# Ability to control
+# android log daemon via sockets
+define(`control_logd', `
+# Group AID_LOG checked by filesystem & logd
+# to permit control commands
+unix_socket_connect($1, logd, logd)
+')
+
+#####################################
+# use_keystore(domain)
+# Ability to use keystore.
+# Keystore is requires the following permissions
+# to call getpidcon.
+define(`use_keystore', `
+ allow keystore $1:dir search;
+ allow keystore $1:file { read open };
+ allow keystore $1:process getattr;
+ allow $1 apc_service:service_manager find;
+ allow $1 keystore_service:service_manager find;
+ allow $1 legacykeystore_service:service_manager find;
+ binder_call($1, keystore)
+ binder_call(keystore, $1)
+')
+
+#####################################
+# use_credstore(domain)
+# Ability to use credstore.
+define(`use_credstore', `
+ allow credstore $1:dir search;
+ allow credstore $1:file { read open };
+ allow credstore $1:process getattr;
+ allow $1 credstore_service:service_manager find;
+ binder_call($1, credstore)
+ binder_call(credstore, $1)
+')
+
+###########################################
+# use_drmservice(domain)
+# Ability to use DrmService which requires
+# DrmService to call getpidcon.
+define(`use_drmservice', `
+ allow drmserver $1:dir search;
+ allow drmserver $1:file { read open };
+ allow drmserver $1:process getattr;
+')
+
+###########################################
+# add_service(domain, service)
+# Ability for domain to add a service to service_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+define(`add_service', `
+ allow $1 $2:service_manager { add find };
+ neverallow { domain -$1 } $2:service_manager add;
+
+ # On debug builds with root, allow binder services to use binder over TCP.
+ # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions.
+ userdebug_or_eng(`
+ allow $1 su:tcp_socket { accept getopt read write };
+ ')
+')
+
+###########################################
+# add_hwservice(domain, service)
+# Ability for domain to add a service to hwservice_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+define(`add_hwservice', `
+ allow $1 $2:hwservice_manager { add find };
+ allow $1 hidl_base_hwservice:hwservice_manager add;
+ neverallow { domain -$1 } $2:hwservice_manager add;
+')
+
+###########################################
+# hal_attribute_hwservice(attribute, service)
+# Ability for domain to get a service to hwservice_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#
+# Used to pair hal_foo_client with hal_foo_hwservice
+define(`hal_attribute_hwservice', `
+ allow $1_client $2:hwservice_manager find;
+ add_hwservice($1_server, $2)
+
+ build_test_only(`
+ # if you are hitting this neverallow, try using:
+ # hal_client_domain(<your domain>, hal_<foo>)
+ # instead
+ neverallow { domain -$1_client -$1_server } $2:hwservice_manager find;
+ ')
+')
+
+###########################################
+# hal_attribute_service(attribute, service)
+# Ability for domain to get a service to service_manager
+# and find it. It also creates a neverallow preventing
+# others from adding it.
+#
+# Used to pair hal_foo_client with hal_foo_service
+define(`hal_attribute_service', `
+ allow $1_client $2:service_manager find;
+ add_service($1_server, $2)
+
+ build_test_only(`
+ # if you are hitting this neverallow, try using:
+ # hal_client_domain(<your domain>, hal_<foo>)
+ # instead
+ neverallow {
+ domain
+ -$1_client
+ -$1_server
+ # some services are allowed to find all services
+ -atrace
+ -shell
+ -system_app
+ -traceur_app
+ } $2:service_manager find;
+ ')
+')
+
+###################################
+# can_profile_heap(domain)
+# Allow processes within the domain to have their heap profiled by central
+# heapprofd.
+define(`can_profile_heap', `
+ # Allow central daemon to send signal for client initialization.
+ allow heapprofd $1:process signal;
+ # Allow connecting to the daemon.
+ unix_socket_connect($1, heapprofd, heapprofd)
+ # Allow daemon to use the passed fds.
+ allow heapprofd $1:fd use;
+ # Allow to read and write to heapprofd shmem.
+ # The client needs to read the read and write pointers in order to write.
+ allow $1 heapprofd_tmpfs:file { read write getattr map };
+ # Use shared memory received over the unix socket.
+ allow $1 heapprofd:fd use;
+
+ # To read and write from the received file descriptors.
+ # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the
+ # process they relate to.
+ # We need to write to /proc/$PID/page_idle to find idle allocations.
+ # The client only opens /proc/self/page_idle with RDWR, everything else
+ # with RDONLY.
+ # heapprofd cannot open /proc/$PID/mem itself, as it does not have
+ # sys_ptrace.
+ allow heapprofd $1:file rw_file_perms;
+ # Allow searching the /proc/[pid] directory for cmdline.
+ allow heapprofd $1:dir r_dir_perms;
+')
+
+###################################
+# never_profile_heap(domain)
+# Opt out of heap profiling by heapprofd.
+define(`never_profile_heap', `
+ neverallow heapprofd $1:file read;
+ neverallow heapprofd $1:process signal;
+')
+
+###################################
+# can_profile_perf(domain)
+# Allow processes within the domain to be profiled, and have their stacks
+# sampled, by traced_perf.
+define(`can_profile_perf', `
+ # Allow directory & file read to traced_perf, as it stat(2)s /proc/[pid], and
+ # reads /proc/[pid]/cmdline.
+ allow traced_perf $1:file r_file_perms;
+ allow traced_perf $1:dir r_dir_perms;
+
+ # Allow central daemon to send signal to request /proc/[pid]/maps and
+ # /proc/[pid]/mem fds from this process.
+ allow traced_perf $1:process signal;
+
+ # Allow connecting to the daemon.
+ unix_socket_connect($1, traced_perf, traced_perf)
+ # Allow daemon to use the passed fds.
+ allow traced_perf $1:fd use;
+')
+
+###################################
+# never_profile_perf(domain)
+# Opt out of profiling by traced_perf.
+define(`never_profile_perf', `
+ neverallow traced_perf $1:file read;
+ neverallow traced_perf $1:process signal;
+')
+
+###################################
+# perfetto_producer(domain)
+# Allow processes within the domain to write data to Perfetto.
+# When applying this macro, you might need to also allow traced to use the
+# producer tmpfs domain, if the producer will be the one creating the shared
+# memory.
+define(`perfetto_producer', `
+ allow $1 traced:fd use;
+ allow $1 traced_tmpfs:file { read write getattr map };
+ unix_socket_connect($1, traced_producer, traced)
+
+ # Also allow the service to use the producer file descriptors. This is
+ # necessary when the producer is creating the shared memory, as it will be
+ # passed to the service as a file descriptor (obtained from memfd_create).
+ allow traced $1:fd use;
+')
+
+###########################################
+# dump_hal(hal_type)
+# Ability to dump the hal debug info
+#
+define(`dump_hal', `
+ hal_client_domain(dumpstate, $1);
+ allow $1_server dumpstate:fifo_file write;
+ allow $1_server dumpstate:fd use;
+')
+
+#####################################
+# treble_sysprop_neverallow(rules)
+# SELinux neverallow rules which enforces the accessibility of each property
+# outside the owner.
+#
+# For devices launching with R or later, exported properties must be explicitly marked as
+# "restricted" or "public", depending on the accessibility outside the owner.
+# For devices launching with Q or eariler, this neverallow rules can be relaxed with defining
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true on BoardConfig.mk.
+# See {partition}_{accessibility}_prop macros below.
+#
+# CTS uses these rules only for devices launching with R or later.
+#
+# TODO(b/131162102): deprecate BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW
+#
+define(`treble_sysprop_neverallow', ifelse(target_treble_sysprop_neverallow, `true', $1,
+ifelse(target_treble_sysprop_neverallow, `cts',
+# BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+#####################################
+# enforce_sysprop_owner(rules)
+# SELinux neverallow rules which enforces the owner of each property.
+#
+# For devices launching with S or later, all properties must be explicitly marked as one of:
+# system_property_type, vendor_property_type, or product_property_type.
+# For devices launching with R or eariler, this neverallow rules can be relaxed with defining
+# BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true on BoardConfig.mk.
+# See {partition}_{accessibility}_prop macros below.
+#
+# CTS uses these ules only for devices launching with S or later.
+#
+define(`enforce_sysprop_owner', ifelse(target_enforce_sysprop_owner, `true', $1,
+ifelse(target_enforce_sysprop_owner, `cts',
+# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+###########################################
+# define_prop(name, owner, scope)
+# Define a property with given owner and scope
+#
+define(`define_prop', `
+ type $1, property_type, $2_property_type, $2_$3_property_type;
+')
+
+###########################################
+# system_internal_prop(name)
+# Define a /system-owned property used only in /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`system_internal_prop', `
+ define_prop($1, system, internal)
+ treble_sysprop_neverallow(`
+ neverallow { domain -coredomain } $1:file no_rw_file_perms;
+ ')
+')
+
+###########################################
+# system_restricted_prop(name)
+# Define a /system-owned property which can't be written outside /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`system_restricted_prop', `
+ define_prop($1, system, restricted)
+ treble_sysprop_neverallow(`
+ neverallow { domain -coredomain } $1:property_service set;
+ ')
+')
+
+###########################################
+# system_public_prop(name)
+# Define a /system-owned property with no restrictions
+#
+define(`system_public_prop', `define_prop($1, system, public)')
+
+###########################################
+# system_vendor_config_prop(name)
+# Define a /system-owned property which can only be written by vendor_init
+# This is a macro for vendor-specific configuration properties which is meant
+# to be set once from vendor_init.
+#
+define(`system_vendor_config_prop', `
+ system_public_prop($1)
+ set_prop(vendor_init, $1)
+ neverallow { domain -init -vendor_init } $1:property_service set;
+')
+
+###########################################
+# product_internal_prop(name)
+# Define a /product-owned property used only in /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`product_internal_prop', `
+ define_prop($1, product, internal)
+ treble_sysprop_neverallow(`
+ neverallow { domain -coredomain } $1:file no_rw_file_perms;
+ ')
+')
+
+###########################################
+# product_restricted_prop(name)
+# Define a /product-owned property which can't be written outside /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`product_restricted_prop', `
+ define_prop($1, product, restricted)
+ treble_sysprop_neverallow(`
+ neverallow { domain -coredomain } $1:property_service set;
+ ')
+')
+
+###########################################
+# product_public_prop(name)
+# Define a /product-owned property with no restrictions
+#
+define(`product_public_prop', `define_prop($1, product, public)')
+
+###########################################
+# vendor_internal_prop(name)
+# Define a /vendor-owned property used only in /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`vendor_internal_prop', `
+ define_prop($1, vendor, internal)
+ treble_sysprop_neverallow(`
+# init and dumpstate are in coredomain, but should be able to read all props.
+ neverallow { coredomain -init -dumpstate } $1:file no_rw_file_perms;
+ ')
+')
+
+###########################################
+# vendor_restricted_prop(name)
+# Define a /vendor-owned property which can't be written outside /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`vendor_restricted_prop', `
+ define_prop($1, vendor, restricted)
+ treble_sysprop_neverallow(`
+# init is in coredomain, but should be able to write all props.
+ neverallow { coredomain -init } $1:property_service set;
+ ')
+')
+
+###########################################
+# vendor_public_prop(name)
+# Define a /vendor-owned property with no restrictions
+#
+define(`vendor_public_prop', `define_prop($1, vendor, public)')
+
+#####################################
+# read_fstab(domain)
+# Ability to call ReadDefaultFstab() and ReadFstabFromFile().
+#
+define(`read_fstab', `
+ allow $1 { metadata_file gsi_metadata_file_type }:dir search;
+ allow $1 gsi_public_metadata_file:file r_file_perms;
+ allow $1 { proc_bootconfig proc_cmdline }:file r_file_perms;
+')
+
+######################################
+# use_bootstrap_libs(domain)
+# Allow domain to use bootstrap bionic libraries in system/lib[64]/bootstrap
+define(`use_bootstrap_libs', `
+ allow $1 system_bootstrap_lib_file:dir r_dir_perms;
+ allow $1 system_bootstrap_lib_file:file { execute read open getattr map };
+')
+
+######################################
+# use_apex_info(domain)
+# Allow access to apex information
+define(`use_apex_info', `
+ allow $1 apex_mnt_dir:dir r_dir_perms;
+ allow $1 apex_info_file:file r_file_perms;
+ r_dir_file($1, vendor_apex_metadata_file)
+')
+
+####################################
+# io_uring_use(domain)
+# Allow domain to create/use io_uring.
+define(`io_uring_use', `
+# Set up a type_transition to "io_uring" named anonymous inode object.
+type $1_iouring;
+type_transition $1 $1:anon_inode $1_iouring "[io_uring]";
+# Allow domain to create/use io_uring anon_inode.
+allow $1 $1_iouring:anon_inode { create map read write };
+allow $1 self:io_uring sqpoll;
+# Other domains may not use iouring anon_inodes created by this domain.
+neverallow { domain -$1 } $1_iouring:anon_inode *;
+# io_uring checks for CAP_IPC_LOCK to determine whether or not to track
+# memory usage per uid against RLIMIT_MEMLOCK. This can lead folks to
+# grant CAP_IPC_LOCK to silence avc denials, which is undesireable.
+dontaudit $1 self:global_capability_class_set ipc_lock;
+')
diff --git a/prebuilts/api/202504/public/tee.te b/prebuilts/api/202504/public/tee.te
new file mode 100644
index 0000000..a310d94
--- /dev/null
+++ b/prebuilts/api/202504/public/tee.te
@@ -0,0 +1,11 @@
+##
+# trusted execution environment (tee) daemon
+#
+type tee, domain;
+
+# Device(s) for communicating with the TEE
+type tee_device, dev_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/tombstoned.te b/prebuilts/api/202504/public/tombstoned.te
new file mode 100644
index 0000000..bc57219
--- /dev/null
+++ b/prebuilts/api/202504/public/tombstoned.te
@@ -0,0 +1,7 @@
+# debugger interface
+type tombstoned, domain, mlstrustedsubject;
+type tombstoned_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/toolbox.te b/prebuilts/api/202504/public/toolbox.te
new file mode 100644
index 0000000..47411bb
--- /dev/null
+++ b/prebuilts/api/202504/public/toolbox.te
@@ -0,0 +1,8 @@
+# Any toolbox command run by init.
+# Do NOT use this domain for toolbox when run by any other domain.
+type toolbox, domain;
+type toolbox_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/traced.te b/prebuilts/api/202504/public/traced.te
new file mode 100644
index 0000000..79c21ba
--- /dev/null
+++ b/prebuilts/api/202504/public/traced.te
@@ -0,0 +1,6 @@
+type traced, domain, coredomain, mlstrustedsubject;
+type traced_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/traced_perf.te b/prebuilts/api/202504/public/traced_perf.te
new file mode 100644
index 0000000..99d4a14
--- /dev/null
+++ b/prebuilts/api/202504/public/traced_perf.te
@@ -0,0 +1,5 @@
+type traced_perf, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/traced_probes.te b/prebuilts/api/202504/public/traced_probes.te
new file mode 100644
index 0000000..bc782a8
--- /dev/null
+++ b/prebuilts/api/202504/public/traced_probes.te
@@ -0,0 +1,5 @@
+type traced_probes, domain, coredomain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/traceur_app.te b/prebuilts/api/202504/public/traceur_app.te
new file mode 100644
index 0000000..04df12f
--- /dev/null
+++ b/prebuilts/api/202504/public/traceur_app.te
@@ -0,0 +1,5 @@
+type traceur_app, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/ueventd.te b/prebuilts/api/202504/public/ueventd.te
new file mode 100644
index 0000000..e0bd5ca
--- /dev/null
+++ b/prebuilts/api/202504/public/ueventd.te
@@ -0,0 +1,8 @@
+# ueventd seclabel is specified in init.rc since
+# it lives in the rootfs and has no unique file type.
+type ueventd, domain;
+type ueventd_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/uncrypt.te b/prebuilts/api/202504/public/uncrypt.te
new file mode 100644
index 0000000..55a2b36
--- /dev/null
+++ b/prebuilts/api/202504/public/uncrypt.te
@@ -0,0 +1,7 @@
+# uncrypt
+type uncrypt, domain, mlstrustedsubject;
+type uncrypt_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/untrusted_app.te b/prebuilts/api/202504/public/untrusted_app.te
new file mode 100644
index 0000000..af1ac27
--- /dev/null
+++ b/prebuilts/api/202504/public/untrusted_app.te
@@ -0,0 +1,40 @@
+###
+### Untrusted apps.
+###
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory). The untrusted_app domain is the default assignment in
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml. In current AOSP, this
+### domain is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key. To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
+###
+
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion >= 34.
+type untrusted_app, domain;
+# This file defines the rules for untrusted apps running with
+# 31 < targetSdkVersion <= 33.
+type untrusted_app_32, domain;
+# This file defines the rules for untrusted apps running with
+# 29 < targetSdkVersion <= 31.
+type untrusted_app_30, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion = 29.
+type untrusted_app_29, domain;
+# This file defines the rules for untrusted apps running with
+# 25 < targetSdkVersion <= 28.
+type untrusted_app_27, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion <= 25.
+type untrusted_app_25, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/update_engine.te b/prebuilts/api/202504/public/update_engine.te
new file mode 100644
index 0000000..3c6c0b0
--- /dev/null
+++ b/prebuilts/api/202504/public/update_engine.te
@@ -0,0 +1,7 @@
+# Domain for update_engine daemon.
+type update_engine, domain, update_engine_common;
+type update_engine_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/update_verifier.te b/prebuilts/api/202504/public/update_verifier.te
new file mode 100644
index 0000000..a8804ce
--- /dev/null
+++ b/prebuilts/api/202504/public/update_verifier.te
@@ -0,0 +1,7 @@
+# update_verifier
+type update_verifier, domain;
+type update_verifier_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/usbd.te b/prebuilts/api/202504/public/usbd.te
new file mode 100644
index 0000000..9ff08d2
--- /dev/null
+++ b/prebuilts/api/202504/public/usbd.te
@@ -0,0 +1,6 @@
+type usbd, domain;
+type usbd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vdc.te b/prebuilts/api/202504/public/vdc.te
new file mode 100644
index 0000000..04fc39e
--- /dev/null
+++ b/prebuilts/api/202504/public/vdc.te
@@ -0,0 +1,12 @@
+# vdc is a helper program for making Binder calls to vold. It is spawned from
+# init for various reasons, such as initializing file-based encryption and
+# metadata encryption, and managing userdata checkpointing.
+#
+# We also transition into this domain from dumpstate, when
+# collecting bug reports.
+type vdc, domain;
+type vdc_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vendor_init.te b/prebuilts/api/202504/public/vendor_init.te
new file mode 100644
index 0000000..ef1386e
--- /dev/null
+++ b/prebuilts/api/202504/public/vendor_init.te
@@ -0,0 +1,6 @@
+# vendor_init is its own domain.
+type vendor_init, domain, mlstrustedsubject;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vendor_misc_writer.te b/prebuilts/api/202504/public/vendor_misc_writer.te
new file mode 100644
index 0000000..a64eee5
--- /dev/null
+++ b/prebuilts/api/202504/public/vendor_misc_writer.te
@@ -0,0 +1,7 @@
+# vendor_misc_writer
+type vendor_misc_writer, domain;
+type vendor_misc_writer_exec, vendor_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vendor_modprobe.te b/prebuilts/api/202504/public/vendor_modprobe.te
new file mode 100644
index 0000000..8ec0aba
--- /dev/null
+++ b/prebuilts/api/202504/public/vendor_modprobe.te
@@ -0,0 +1,5 @@
+type vendor_modprobe, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vendor_shell.te b/prebuilts/api/202504/public/vendor_shell.te
new file mode 100644
index 0000000..1906d0e
--- /dev/null
+++ b/prebuilts/api/202504/public/vendor_shell.te
@@ -0,0 +1,6 @@
+type vendor_shell, domain;
+type vendor_shell_exec, exec_type, vendor_file_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vendor_toolbox.te b/prebuilts/api/202504/public/vendor_toolbox.te
new file mode 100644
index 0000000..13969b4
--- /dev/null
+++ b/prebuilts/api/202504/public/vendor_toolbox.te
@@ -0,0 +1,8 @@
+# Toolbox installation for vendor binaries / scripts
+# Non-vendor processes are not allowed to execute the binary
+# and is always executed without transition.
+type vendor_toolbox_exec, exec_type, vendor_file_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/virtual_camera.te b/prebuilts/api/202504/public/virtual_camera.te
new file mode 100644
index 0000000..1c9e9d6
--- /dev/null
+++ b/prebuilts/api/202504/public/virtual_camera.te
@@ -0,0 +1,10 @@
+# virtual_camera - virtual camera daemon
+
+starting_at_board_api(202504, `
+ type virtual_camera, domain, coredomain;
+ type virtual_camera_exec, system_file_type, exec_type, file_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/virtual_touchpad.te b/prebuilts/api/202504/public/virtual_touchpad.te
new file mode 100644
index 0000000..1e1c94e
--- /dev/null
+++ b/prebuilts/api/202504/public/virtual_touchpad.te
@@ -0,0 +1,6 @@
+type virtual_touchpad, domain;
+type virtual_touchpad_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/virtualizationmanager.te b/prebuilts/api/202504/public/virtualizationmanager.te
new file mode 100644
index 0000000..555bc23
--- /dev/null
+++ b/prebuilts/api/202504/public/virtualizationmanager.te
@@ -0,0 +1,9 @@
+# Domain for a child process that manages virtual machines on behalf of its parent.
+starting_at_board_api(202504, `
+ type virtualizationmanager, domain, coredomain;
+ type virtualizationmanager_exec, system_file_type, exec_type, file_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vndservice.te b/prebuilts/api/202504/public/vndservice.te
new file mode 100644
index 0000000..9f70d9b
--- /dev/null
+++ b/prebuilts/api/202504/public/vndservice.te
@@ -0,0 +1,6 @@
+type service_manager_vndservice, vndservice_manager_type;
+type default_android_vndservice, vndservice_manager_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vndservicemanager.te b/prebuilts/api/202504/public/vndservicemanager.te
new file mode 100644
index 0000000..60af16b
--- /dev/null
+++ b/prebuilts/api/202504/public/vndservicemanager.te
@@ -0,0 +1,6 @@
+# vndservicemanager - the Binder context manager for vendor processes
+type vndservicemanager, domain;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vold.te b/prebuilts/api/202504/public/vold.te
new file mode 100644
index 0000000..c05da12
--- /dev/null
+++ b/prebuilts/api/202504/public/vold.te
@@ -0,0 +1,7 @@
+# volume manager
+type vold, domain;
+type vold_exec, exec_type, file_type, system_file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/vold_prepare_subdirs.te b/prebuilts/api/202504/public/vold_prepare_subdirs.te
new file mode 100644
index 0000000..f659307
--- /dev/null
+++ b/prebuilts/api/202504/public/vold_prepare_subdirs.te
@@ -0,0 +1,7 @@
+# SELinux directory creation and labelling for vold-managed directories
+type vold_prepare_subdirs, domain;
+type vold_prepare_subdirs_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/watchdogd.te b/prebuilts/api/202504/public/watchdogd.te
new file mode 100644
index 0000000..2499b54
--- /dev/null
+++ b/prebuilts/api/202504/public/watchdogd.te
@@ -0,0 +1,7 @@
+# watchdogd seclabel is specified in init.<board>.rc
+type watchdogd, domain;
+type watchdogd_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/webview_zygote.te b/prebuilts/api/202504/public/webview_zygote.te
new file mode 100644
index 0000000..8142832
--- /dev/null
+++ b/prebuilts/api/202504/public/webview_zygote.te
@@ -0,0 +1,9 @@
+# webview_zygote is an auxiliary zygote process that is used to spawn
+# isolated_app processes for rendering untrusted web content.
+type webview_zygote, domain;
+type webview_zygote_exec, exec_type, file_type;
+type webview_zygote_tmpfs, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/wificond.te b/prebuilts/api/202504/public/wificond.te
new file mode 100644
index 0000000..934133c
--- /dev/null
+++ b/prebuilts/api/202504/public/wificond.te
@@ -0,0 +1,7 @@
+# wificond
+type wificond, domain;
+type wificond_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/prebuilts/api/202504/public/zygote.te b/prebuilts/api/202504/public/zygote.te
new file mode 100644
index 0000000..9f24337
--- /dev/null
+++ b/prebuilts/api/202504/public/zygote.te
@@ -0,0 +1,8 @@
+# zygote
+type zygote, domain;
+type zygote_tmpfs, file_type;
+type zygote_exec, system_file_type, exec_type, file_type;
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/private/adbd.te b/private/adbd.te
index b87b319..c8226f3 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -228,3 +228,6 @@
# Only init is allowed to enter the adbd domain via exec()
neverallow { domain -init } adbd:process transition;
neverallow * adbd:process dyntransition;
+
+# allow adbd to check if an app is frozen
+allow adbd cgroup_v2:file read;
diff --git a/private/app.te b/private/app.te
index b9a6d85..b359663 100644
--- a/private/app.te
+++ b/private/app.te
@@ -6,6 +6,7 @@
appdomain
-ephemeral_app
-isolated_app_all
+ -network_stack
-platform_app
-priv_app
-shell
@@ -19,6 +20,7 @@
appdomain
-ephemeral_app
-isolated_app_all
+ -network_stack
-platform_app
-priv_app
-shell
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 0e2b01c..434fb13 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -204,6 +204,7 @@
# Create a more specific label if needed
neverallow all_untrusted_apps {
proc
+ proc_allocinfo
proc_asound
proc_kmsg
proc_loadavg
diff --git a/private/attributes b/private/attributes
index 13479c9..4f59acf 100644
--- a/private/attributes
+++ b/private/attributes
@@ -16,6 +16,11 @@
hal_attribute(mediaquality);
')
+until_board_api(202504, `
+attribute unconstrained_vsock_violators;
+expandattribute unconstrained_vsock_violators false;
+')
+
# All SDK sandbox domains
attribute sdk_sandbox_all;
# The SDK sandbox domains for the current SDK level.
@@ -31,3 +36,7 @@
until_board_api(202504, `
attribute tee_service_type;
')
+
+until_board_api(202504, `
+ hal_attribute(vm_capabilities);
+')
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 4fe3843..7d8a706 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -54,7 +54,7 @@
neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
neverallow { domain -bpfloader } fs_bpf_loader:file *;
-neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
+neverallow { domain -bpfloader -init userdebug_or_eng(`-overlay_remounter') } bpfloader_exec:file { execute execute_no_trans };
neverallow { coredomain -bpfloader -netd -netutils_wrapper } fs_bpf_vendor:file *;
diff --git a/private/compat/202404/202404.cil b/private/compat/202404/202404.cil
index 85eb601..e9c97e5 100644
--- a/private/compat/202404/202404.cil
+++ b/private/compat/202404/202404.cil
@@ -1,8 +1,10 @@
;; This type may or may not already exist in vendor policy. Re-define it here (duplicate
;; definitions in CIL will be ignored) - so we can reference it in 202404.cil.
-(type virtual_fingerprint_hal_prop)
+(type cgroup_desc_api_file)
(type otapreopt_chroot)
+(type task_profiles_api_file)
(type vendor_hidraw_device)
+(type virtual_fingerprint_hal_prop)
(typeattributeset dev_type (vendor_hidraw_device))
;; mapping information from ToT policy's types to 202404 policy's types.
@@ -2473,7 +2475,7 @@
(typeattributeset surfaceflinger_tmpfs_202404 (surfaceflinger_tmpfs))
(typeattributeset suspend_prop_202404 (suspend_prop))
(typeattributeset swap_block_device_202404 (swap_block_device))
-(typeattributeset sysfs_202404 (sysfs))
+(typeattributeset sysfs_202404 (sysfs sysfs_mem_sleep sysfs_udc))
(typeattributeset sysfs_android_usb_202404 (sysfs_android_usb))
(typeattributeset sysfs_batteryinfo_202404 (sysfs_batteryinfo))
(typeattributeset sysfs_bluetooth_writable_202404 (sysfs_bluetooth_writable))
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index 2ddfec3..8007d6c 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -5,27 +5,37 @@
(typeattribute new_objects)
(typeattributeset new_objects
( new_objects
- bluetooth_finder_prop
- profcollectd_etr_prop
- fstype_prop
- binderfs_logs_transactions
- binderfs_logs_transaction_history
- proc_compaction_proactiveness
- proc_cgroups
- ranging_service
- supervision_service
app_function_service
- virtual_fingerprint
- virtual_fingerprint_exec
- virtual_face
- virtual_face_exec
- hal_mediaquality_service
- media_quality_service
- advanced_protection_service
- sysfs_firmware_acpi_tables
- intrusion_detection_service
- wifi_mainline_supplicant_service
+ binderfs_logs_transaction_history
+ binderfs_logs_transactions
+ bluetooth_finder_prop
crosvm
early_virtmgr
+ early_virtmgr_exec
+ enable_16k_pages_prop
+ forensic_service
+ fstype_prop
+ hal_mediaquality_service
+ hal_vm_capabilities_service
+ intrusion_detection_service
+ media_quality_service
+ proc_cgroups
+ proc_compaction_proactiveness
+ profcollectd_etr_prop
+ ranging_service
+ supervision_service
+ sysfs_cma
+ sysfs_firmware_acpi_tables
+ tee_service_contexts_file
+ trusty_security_vm_sys_vendor_prop
+ virtual_camera
+ virtual_camera_exec
+ virtual_face
+ virtual_face_exec
+ virtual_fingerprint
+ virtual_fingerprint_exec
virtualizationmanager
+ virtualizationmanager_exec
+ wifi_mainline_supplicant_service
+ wifi_usd_service
))
diff --git a/private/compat/202504/202504.cil b/private/compat/202504/202504.cil
new file mode 100644
index 0000000..0d6a010
--- /dev/null
+++ b/private/compat/202504/202504.cil
@@ -0,0 +1,2833 @@
+;; mapping information from ToT policy's types to 202504 policy's types.
+(expandtypeattribute (DockObserver_service_202504) true)
+(expandtypeattribute (IProxyService_service_202504) true)
+(expandtypeattribute (aac_drc_prop_202504) true)
+(expandtypeattribute (aaudio_config_prop_202504) true)
+(expandtypeattribute (ab_update_gki_prop_202504) true)
+(expandtypeattribute (accessibility_service_202504) true)
+(expandtypeattribute (account_service_202504) true)
+(expandtypeattribute (aconfig_storage_flags_metadata_file_202504) true)
+(expandtypeattribute (aconfig_storage_metadata_file_202504) true)
+(expandtypeattribute (activity_service_202504) true)
+(expandtypeattribute (activity_task_service_202504) true)
+(expandtypeattribute (adaptive_haptics_prop_202504) true)
+(expandtypeattribute (adb_data_file_202504) true)
+(expandtypeattribute (adb_keys_file_202504) true)
+(expandtypeattribute (adb_service_202504) true)
+(expandtypeattribute (adbd_202504) true)
+(expandtypeattribute (adbd_config_prop_202504) true)
+(expandtypeattribute (adbd_exec_202504) true)
+(expandtypeattribute (adbd_socket_202504) true)
+(expandtypeattribute (adservices_manager_service_202504) true)
+(expandtypeattribute (aidl_lazy_test_server_202504) true)
+(expandtypeattribute (aidl_lazy_test_server_exec_202504) true)
+(expandtypeattribute (aidl_lazy_test_service_202504) true)
+(expandtypeattribute (alarm_service_202504) true)
+(expandtypeattribute (anr_data_file_202504) true)
+(expandtypeattribute (apc_service_202504) true)
+(expandtypeattribute (apex_data_file_202504) true)
+(expandtypeattribute (apex_info_file_202504) true)
+(expandtypeattribute (apex_metadata_file_202504) true)
+(expandtypeattribute (apex_mnt_dir_202504) true)
+(expandtypeattribute (apex_module_data_file_202504) true)
+(expandtypeattribute (apex_ota_reserved_file_202504) true)
+(expandtypeattribute (apex_ready_prop_202504) true)
+(expandtypeattribute (apex_rollback_data_file_202504) true)
+(expandtypeattribute (apex_service_202504) true)
+(expandtypeattribute (apex_system_server_data_file_202504) true)
+(expandtypeattribute (apexd_202504) true)
+(expandtypeattribute (apexd_config_prop_202504) true)
+(expandtypeattribute (apexd_exec_202504) true)
+(expandtypeattribute (apexd_prop_202504) true)
+(expandtypeattribute (apexd_select_prop_202504) true)
+(expandtypeattribute (apk_data_file_202504) true)
+(expandtypeattribute (apk_private_data_file_202504) true)
+(expandtypeattribute (apk_private_tmp_file_202504) true)
+(expandtypeattribute (apk_tmp_file_202504) true)
+(expandtypeattribute (apk_verity_prop_202504) true)
+(expandtypeattribute (app_binding_service_202504) true)
+(expandtypeattribute (app_data_file_202504) true)
+(expandtypeattribute (app_function_service_202504) true)
+(expandtypeattribute (app_fuse_file_202504) true)
+(expandtypeattribute (app_fusefs_202504) true)
+(expandtypeattribute (app_hibernation_service_202504) true)
+(expandtypeattribute (app_integrity_service_202504) true)
+(expandtypeattribute (app_prediction_service_202504) true)
+(expandtypeattribute (app_search_service_202504) true)
+(expandtypeattribute (app_zygote_202504) true)
+(expandtypeattribute (app_zygote_tmpfs_202504) true)
+(expandtypeattribute (appcompat_data_file_202504) true)
+(expandtypeattribute (appdomain_tmpfs_202504) true)
+(expandtypeattribute (appops_service_202504) true)
+(expandtypeattribute (appwidget_service_202504) true)
+(expandtypeattribute (archive_service_202504) true)
+(expandtypeattribute (arm64_memtag_prop_202504) true)
+(expandtypeattribute (art_apex_dir_202504) true)
+(expandtypeattribute (artd_202504) true)
+(expandtypeattribute (artd_pre_reboot_service_202504) true)
+(expandtypeattribute (artd_service_202504) true)
+(expandtypeattribute (asec_apk_file_202504) true)
+(expandtypeattribute (asec_image_file_202504) true)
+(expandtypeattribute (asec_public_file_202504) true)
+(expandtypeattribute (ashmem_device_202504) true)
+(expandtypeattribute (ashmem_libcutils_device_202504) true)
+(expandtypeattribute (assetatlas_service_202504) true)
+(expandtypeattribute (atrace_202504) true)
+(expandtypeattribute (attestation_verification_service_202504) true)
+(expandtypeattribute (audio_config_prop_202504) true)
+(expandtypeattribute (audio_data_file_202504) true)
+(expandtypeattribute (audio_device_202504) true)
+(expandtypeattribute (audio_prop_202504) true)
+(expandtypeattribute (audio_service_202504) true)
+(expandtypeattribute (audiohal_data_file_202504) true)
+(expandtypeattribute (audioserver_202504) true)
+(expandtypeattribute (audioserver_data_file_202504) true)
+(expandtypeattribute (audioserver_service_202504) true)
+(expandtypeattribute (audioserver_tmpfs_202504) true)
+(expandtypeattribute (auth_service_202504) true)
+(expandtypeattribute (authorization_service_202504) true)
+(expandtypeattribute (autofill_service_202504) true)
+(expandtypeattribute (backup_data_file_202504) true)
+(expandtypeattribute (backup_service_202504) true)
+(expandtypeattribute (battery_service_202504) true)
+(expandtypeattribute (batteryproperties_service_202504) true)
+(expandtypeattribute (batterystats_service_202504) true)
+(expandtypeattribute (binder_cache_bluetooth_server_prop_202504) true)
+(expandtypeattribute (binder_cache_system_server_prop_202504) true)
+(expandtypeattribute (binder_cache_telephony_server_prop_202504) true)
+(expandtypeattribute (binder_calls_stats_service_202504) true)
+(expandtypeattribute (binder_device_202504) true)
+(expandtypeattribute (binderfs_202504) true)
+(expandtypeattribute (binderfs_features_202504) true)
+(expandtypeattribute (binderfs_logs_202504) true)
+(expandtypeattribute (binderfs_logs_proc_202504) true)
+(expandtypeattribute (binderfs_logs_stats_202504) true)
+(expandtypeattribute (binderfs_logs_transaction_history_202504) true)
+(expandtypeattribute (binderfs_logs_transactions_202504) true)
+(expandtypeattribute (binfmt_miscfs_202504) true)
+(expandtypeattribute (biometric_service_202504) true)
+(expandtypeattribute (blkid_202504) true)
+(expandtypeattribute (blkid_untrusted_202504) true)
+(expandtypeattribute (blob_store_service_202504) true)
+(expandtypeattribute (block_device_202504) true)
+(expandtypeattribute (bluetooth_202504) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_202504) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_202504) true)
+(expandtypeattribute (bluetooth_config_prop_202504) true)
+(expandtypeattribute (bluetooth_data_file_202504) true)
+(expandtypeattribute (bluetooth_efs_file_202504) true)
+(expandtypeattribute (bluetooth_finder_prop_202504) true)
+(expandtypeattribute (bluetooth_logs_data_file_202504) true)
+(expandtypeattribute (bluetooth_manager_service_202504) true)
+(expandtypeattribute (bluetooth_prop_202504) true)
+(expandtypeattribute (bluetooth_service_202504) true)
+(expandtypeattribute (bluetooth_socket_202504) true)
+(expandtypeattribute (boot_block_device_202504) true)
+(expandtypeattribute (boot_status_prop_202504) true)
+(expandtypeattribute (bootanim_202504) true)
+(expandtypeattribute (bootanim_config_prop_202504) true)
+(expandtypeattribute (bootanim_exec_202504) true)
+(expandtypeattribute (bootanim_oem_file_202504) true)
+(expandtypeattribute (bootanim_system_prop_202504) true)
+(expandtypeattribute (bootchart_data_file_202504) true)
+(expandtypeattribute (bootloader_boot_reason_prop_202504) true)
+(expandtypeattribute (bootloader_prop_202504) true)
+(expandtypeattribute (bootstat_202504) true)
+(expandtypeattribute (bootstat_data_file_202504) true)
+(expandtypeattribute (bootstat_exec_202504) true)
+(expandtypeattribute (boottime_prop_202504) true)
+(expandtypeattribute (boottime_public_prop_202504) true)
+(expandtypeattribute (boottrace_data_file_202504) true)
+(expandtypeattribute (bpf_progs_loaded_prop_202504) true)
+(expandtypeattribute (bpfloader_202504) true)
+(expandtypeattribute (bq_config_prop_202504) true)
+(expandtypeattribute (broadcastradio_service_202504) true)
+(expandtypeattribute (bt_device_202504) true)
+(expandtypeattribute (bufferhubd_202504) true)
+(expandtypeattribute (bufferhubd_exec_202504) true)
+(expandtypeattribute (bugreport_service_202504) true)
+(expandtypeattribute (build_attestation_prop_202504) true)
+(expandtypeattribute (build_bootimage_prop_202504) true)
+(expandtypeattribute (build_config_prop_202504) true)
+(expandtypeattribute (build_odm_prop_202504) true)
+(expandtypeattribute (build_prop_202504) true)
+(expandtypeattribute (build_vendor_prop_202504) true)
+(expandtypeattribute (cache_backup_file_202504) true)
+(expandtypeattribute (cache_block_device_202504) true)
+(expandtypeattribute (cache_file_202504) true)
+(expandtypeattribute (cache_private_backup_file_202504) true)
+(expandtypeattribute (cache_recovery_file_202504) true)
+(expandtypeattribute (cacheinfo_service_202504) true)
+(expandtypeattribute (camera2_extensions_prop_202504) true)
+(expandtypeattribute (camera_calibration_prop_202504) true)
+(expandtypeattribute (camera_config_prop_202504) true)
+(expandtypeattribute (camera_data_file_202504) true)
+(expandtypeattribute (camera_device_202504) true)
+(expandtypeattribute (cameraproxy_service_202504) true)
+(expandtypeattribute (cameraserver_202504) true)
+(expandtypeattribute (cameraserver_exec_202504) true)
+(expandtypeattribute (cameraserver_service_202504) true)
+(expandtypeattribute (cameraserver_tmpfs_202504) true)
+(expandtypeattribute (camerax_extensions_prop_202504) true)
+(expandtypeattribute (cgroup_202504) true)
+(expandtypeattribute (cgroup_desc_file_202504) true)
+(expandtypeattribute (cgroup_rc_file_202504) true)
+(expandtypeattribute (cgroup_v2_202504) true)
+(expandtypeattribute (charger_202504) true)
+(expandtypeattribute (charger_config_prop_202504) true)
+(expandtypeattribute (charger_exec_202504) true)
+(expandtypeattribute (charger_prop_202504) true)
+(expandtypeattribute (charger_status_prop_202504) true)
+(expandtypeattribute (charger_vendor_202504) true)
+(expandtypeattribute (clipboard_service_202504) true)
+(expandtypeattribute (cloudsearch_service_202504) true)
+(expandtypeattribute (codec2_config_prop_202504) true)
+(expandtypeattribute (cold_boot_done_prop_202504) true)
+(expandtypeattribute (color_display_service_202504) true)
+(expandtypeattribute (companion_device_service_202504) true)
+(expandtypeattribute (composd_vm_art_prop_202504) true)
+(expandtypeattribute (composd_vm_vendor_prop_202504) true)
+(expandtypeattribute (config_prop_202504) true)
+(expandtypeattribute (configfs_202504) true)
+(expandtypeattribute (connectivity_native_service_202504) true)
+(expandtypeattribute (connectivity_service_202504) true)
+(expandtypeattribute (connmetrics_service_202504) true)
+(expandtypeattribute (console_device_202504) true)
+(expandtypeattribute (consumer_ir_service_202504) true)
+(expandtypeattribute (content_capture_service_202504) true)
+(expandtypeattribute (content_service_202504) true)
+(expandtypeattribute (content_suggestions_service_202504) true)
+(expandtypeattribute (contexthub_service_202504) true)
+(expandtypeattribute (contextual_search_service_202504) true)
+(expandtypeattribute (coredump_file_202504) true)
+(expandtypeattribute (country_detector_service_202504) true)
+(expandtypeattribute (coverage_service_202504) true)
+(expandtypeattribute (cppreopt_prop_202504) true)
+(expandtypeattribute (cpu_monitor_service_202504) true)
+(expandtypeattribute (cpu_variant_prop_202504) true)
+(expandtypeattribute (cpuinfo_service_202504) true)
+(expandtypeattribute (crash_dump_202504) true)
+(expandtypeattribute (crash_dump_exec_202504) true)
+(expandtypeattribute (credential_service_202504) true)
+(expandtypeattribute (credstore_202504) true)
+(expandtypeattribute (credstore_data_file_202504) true)
+(expandtypeattribute (credstore_exec_202504) true)
+(expandtypeattribute (credstore_service_202504) true)
+(expandtypeattribute (crossprofileapps_service_202504) true)
+(expandtypeattribute (crosvm_202504) true)
+(expandtypeattribute (ctl_adbd_prop_202504) true)
+(expandtypeattribute (ctl_apexd_prop_202504) true)
+(expandtypeattribute (ctl_bootanim_prop_202504) true)
+(expandtypeattribute (ctl_bugreport_prop_202504) true)
+(expandtypeattribute (ctl_console_prop_202504) true)
+(expandtypeattribute (ctl_default_prop_202504) true)
+(expandtypeattribute (ctl_dumpstate_prop_202504) true)
+(expandtypeattribute (ctl_fuse_prop_202504) true)
+(expandtypeattribute (ctl_gsid_prop_202504) true)
+(expandtypeattribute (ctl_interface_restart_prop_202504) true)
+(expandtypeattribute (ctl_interface_start_prop_202504) true)
+(expandtypeattribute (ctl_interface_stop_prop_202504) true)
+(expandtypeattribute (ctl_mdnsd_prop_202504) true)
+(expandtypeattribute (ctl_restart_prop_202504) true)
+(expandtypeattribute (ctl_rildaemon_prop_202504) true)
+(expandtypeattribute (ctl_sigstop_prop_202504) true)
+(expandtypeattribute (ctl_start_prop_202504) true)
+(expandtypeattribute (ctl_stop_prop_202504) true)
+(expandtypeattribute (dalvik_config_prop_202504) true)
+(expandtypeattribute (dalvik_dynamic_config_prop_202504) true)
+(expandtypeattribute (dalvik_prop_202504) true)
+(expandtypeattribute (dalvik_runtime_prop_202504) true)
+(expandtypeattribute (dalvikcache_data_file_202504) true)
+(expandtypeattribute (dataloader_manager_service_202504) true)
+(expandtypeattribute (dbinfo_service_202504) true)
+(expandtypeattribute (dck_prop_202504) true)
+(expandtypeattribute (debug_prop_202504) true)
+(expandtypeattribute (debugfs_202504) true)
+(expandtypeattribute (debugfs_bootreceiver_tracing_202504) true)
+(expandtypeattribute (debugfs_kprobes_202504) true)
+(expandtypeattribute (debugfs_mm_events_tracing_202504) true)
+(expandtypeattribute (debugfs_mmc_202504) true)
+(expandtypeattribute (debugfs_restriction_prop_202504) true)
+(expandtypeattribute (debugfs_trace_marker_202504) true)
+(expandtypeattribute (debugfs_tracing_202504) true)
+(expandtypeattribute (debugfs_tracing_debug_202504) true)
+(expandtypeattribute (debugfs_tracing_instances_202504) true)
+(expandtypeattribute (debugfs_tracing_printk_formats_202504) true)
+(expandtypeattribute (debugfs_wakeup_sources_202504) true)
+(expandtypeattribute (debugfs_wifi_tracing_202504) true)
+(expandtypeattribute (debuggerd_prop_202504) true)
+(expandtypeattribute (default_android_hwservice_202504) true)
+(expandtypeattribute (default_android_service_202504) true)
+(expandtypeattribute (default_android_vndservice_202504) true)
+(expandtypeattribute (default_prop_202504) true)
+(expandtypeattribute (dev_cpu_variant_202504) true)
+(expandtypeattribute (device_202504) true)
+(expandtypeattribute (device_config_aconfig_flags_prop_202504) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_boot_count_prop_202504) true)
+(expandtypeattribute (device_config_camera_native_prop_202504) true)
+(expandtypeattribute (device_config_edgetpu_native_prop_202504) true)
+(expandtypeattribute (device_config_input_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_media_native_prop_202504) true)
+(expandtypeattribute (device_config_memory_safety_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_memory_safety_native_prop_202504) true)
+(expandtypeattribute (device_config_netd_native_prop_202504) true)
+(expandtypeattribute (device_config_nnapi_native_prop_202504) true)
+(expandtypeattribute (device_config_reset_performed_prop_202504) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_runtime_native_prop_202504) true)
+(expandtypeattribute (device_config_service_202504) true)
+(expandtypeattribute (device_config_surface_flinger_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_updatable_service_202504) true)
+(expandtypeattribute (device_config_vendor_system_native_boot_prop_202504) true)
+(expandtypeattribute (device_config_vendor_system_native_prop_202504) true)
+(expandtypeattribute (device_identifiers_service_202504) true)
+(expandtypeattribute (device_logging_prop_202504) true)
+(expandtypeattribute (device_policy_service_202504) true)
+(expandtypeattribute (device_state_service_202504) true)
+(expandtypeattribute (deviceidle_service_202504) true)
+(expandtypeattribute (devicelock_service_202504) true)
+(expandtypeattribute (devicestoragemonitor_service_202504) true)
+(expandtypeattribute (devpts_202504) true)
+(expandtypeattribute (dexopt_chroot_setup_service_202504) true)
+(expandtypeattribute (dhcp_202504) true)
+(expandtypeattribute (dhcp_data_file_202504) true)
+(expandtypeattribute (dhcp_exec_202504) true)
+(expandtypeattribute (dhcp_prop_202504) true)
+(expandtypeattribute (diskstats_service_202504) true)
+(expandtypeattribute (display_service_202504) true)
+(expandtypeattribute (dm_device_202504) true)
+(expandtypeattribute (dm_user_device_202504) true)
+(expandtypeattribute (dmabuf_heap_device_202504) true)
+(expandtypeattribute (dmabuf_system_heap_device_202504) true)
+(expandtypeattribute (dmabuf_system_secure_heap_device_202504) true)
+(expandtypeattribute (dnsmasq_202504) true)
+(expandtypeattribute (dnsmasq_exec_202504) true)
+(expandtypeattribute (dnsproxyd_socket_202504) true)
+(expandtypeattribute (dnsresolver_service_202504) true)
+(expandtypeattribute (domain_verification_service_202504) true)
+(expandtypeattribute (dreams_service_202504) true)
+(expandtypeattribute (drm_data_file_202504) true)
+(expandtypeattribute (drm_forcel3_prop_202504) true)
+(expandtypeattribute (drm_service_config_prop_202504) true)
+(expandtypeattribute (drmserver_202504) true)
+(expandtypeattribute (drmserver_exec_202504) true)
+(expandtypeattribute (drmserver_service_202504) true)
+(expandtypeattribute (drmserver_socket_202504) true)
+(expandtypeattribute (dropbox_data_file_202504) true)
+(expandtypeattribute (dropbox_service_202504) true)
+(expandtypeattribute (dtbo_block_device_202504) true)
+(expandtypeattribute (dumpstate_202504) true)
+(expandtypeattribute (dumpstate_exec_202504) true)
+(expandtypeattribute (dumpstate_options_prop_202504) true)
+(expandtypeattribute (dumpstate_prop_202504) true)
+(expandtypeattribute (dumpstate_service_202504) true)
+(expandtypeattribute (dumpstate_socket_202504) true)
+(expandtypeattribute (dynamic_system_prop_202504) true)
+(expandtypeattribute (e2fs_202504) true)
+(expandtypeattribute (e2fs_exec_202504) true)
+(expandtypeattribute (early_virtmgr_202504) true)
+(expandtypeattribute (early_virtmgr_exec_202504) true)
+(expandtypeattribute (ecm_enhanced_confirmation_service_202504) true)
+(expandtypeattribute (efs_file_202504) true)
+(expandtypeattribute (emergency_affordance_service_202504) true)
+(expandtypeattribute (enable_16k_pages_prop_202504) true)
+(expandtypeattribute (ephemeral_app_202504) true)
+(expandtypeattribute (ethernet_service_202504) true)
+(expandtypeattribute (evsmanagerd_202504) true)
+(expandtypeattribute (evsmanagerd_service_202504) true)
+(expandtypeattribute (exfat_202504) true)
+(expandtypeattribute (exported3_system_prop_202504) true)
+(expandtypeattribute (exported_bluetooth_prop_202504) true)
+(expandtypeattribute (exported_camera_prop_202504) true)
+(expandtypeattribute (exported_config_prop_202504) true)
+(expandtypeattribute (exported_default_prop_202504) true)
+(expandtypeattribute (exported_dumpstate_prop_202504) true)
+(expandtypeattribute (exported_overlay_prop_202504) true)
+(expandtypeattribute (exported_pm_prop_202504) true)
+(expandtypeattribute (exported_secure_prop_202504) true)
+(expandtypeattribute (exported_system_prop_202504) true)
+(expandtypeattribute (external_vibrator_service_202504) true)
+(expandtypeattribute (extra_free_kbytes_202504) true)
+(expandtypeattribute (extra_free_kbytes_exec_202504) true)
+(expandtypeattribute (face_service_202504) true)
+(expandtypeattribute (face_vendor_data_file_202504) true)
+(expandtypeattribute (fastbootd_202504) true)
+(expandtypeattribute (ffs_config_prop_202504) true)
+(expandtypeattribute (ffs_control_prop_202504) true)
+(expandtypeattribute (file_contexts_file_202504) true)
+(expandtypeattribute (file_integrity_service_202504) true)
+(expandtypeattribute (fingerprint_prop_202504) true)
+(expandtypeattribute (fingerprint_service_202504) true)
+(expandtypeattribute (fingerprint_vendor_data_file_202504) true)
+(expandtypeattribute (fingerprintd_202504) true)
+(expandtypeattribute (fingerprintd_data_file_202504) true)
+(expandtypeattribute (fingerprintd_exec_202504) true)
+(expandtypeattribute (fingerprintd_service_202504) true)
+(expandtypeattribute (firstboot_prop_202504) true)
+(expandtypeattribute (flags_health_check_202504) true)
+(expandtypeattribute (flags_health_check_exec_202504) true)
+(expandtypeattribute (font_service_202504) true)
+(expandtypeattribute (framework_status_prop_202504) true)
+(expandtypeattribute (framework_watchdog_config_prop_202504) true)
+(expandtypeattribute (frp_block_device_202504) true)
+(expandtypeattribute (fs_bpf_202504) true)
+(expandtypeattribute (fs_bpf_tethering_202504) true)
+(expandtypeattribute (fs_bpf_vendor_202504) true)
+(expandtypeattribute (fsck_202504) true)
+(expandtypeattribute (fsck_exec_202504) true)
+(expandtypeattribute (fsck_untrusted_202504) true)
+(expandtypeattribute (fscklogs_202504) true)
+(expandtypeattribute (functionfs_202504) true)
+(expandtypeattribute (fuse_202504) true)
+(expandtypeattribute (fuse_device_202504) true)
+(expandtypeattribute (fuseblk_202504) true)
+(expandtypeattribute (fusectlfs_202504) true)
+(expandtypeattribute (future_pm_prop_202504) true)
+(expandtypeattribute (fwk_altitude_service_202504) true)
+(expandtypeattribute (fwk_automotive_display_hwservice_202504) true)
+(expandtypeattribute (fwk_automotive_display_service_202504) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_202504) true)
+(expandtypeattribute (fwk_camera_hwservice_202504) true)
+(expandtypeattribute (fwk_camera_service_202504) true)
+(expandtypeattribute (fwk_display_hwservice_202504) true)
+(expandtypeattribute (fwk_scheduler_hwservice_202504) true)
+(expandtypeattribute (fwk_sensor_hwservice_202504) true)
+(expandtypeattribute (fwk_sensor_service_202504) true)
+(expandtypeattribute (fwk_stats_hwservice_202504) true)
+(expandtypeattribute (fwk_stats_service_202504) true)
+(expandtypeattribute (fwk_vibrator_control_service_202504) true)
+(expandtypeattribute (fwmarkd_socket_202504) true)
+(expandtypeattribute (game_mode_intervention_list_file_202504) true)
+(expandtypeattribute (game_service_202504) true)
+(expandtypeattribute (gatekeeper_data_file_202504) true)
+(expandtypeattribute (gatekeeper_service_202504) true)
+(expandtypeattribute (gatekeeperd_202504) true)
+(expandtypeattribute (gatekeeperd_exec_202504) true)
+(expandtypeattribute (gesture_prop_202504) true)
+(expandtypeattribute (gfxinfo_service_202504) true)
+(expandtypeattribute (gmscore_app_202504) true)
+(expandtypeattribute (gnss_device_202504) true)
+(expandtypeattribute (gnss_time_update_service_202504) true)
+(expandtypeattribute (gps_control_202504) true)
+(expandtypeattribute (gpu_device_202504) true)
+(expandtypeattribute (gpu_service_202504) true)
+(expandtypeattribute (gpuservice_202504) true)
+(expandtypeattribute (grammatical_inflection_service_202504) true)
+(expandtypeattribute (graphics_config_prop_202504) true)
+(expandtypeattribute (graphics_config_writable_prop_202504) true)
+(expandtypeattribute (graphics_device_202504) true)
+(expandtypeattribute (graphicsstats_service_202504) true)
+(expandtypeattribute (gsi_data_file_202504) true)
+(expandtypeattribute (gsi_metadata_file_202504) true)
+(expandtypeattribute (gsi_public_metadata_file_202504) true)
+(expandtypeattribute (gwp_asan_prop_202504) true)
+(expandtypeattribute (hal_atrace_hwservice_202504) true)
+(expandtypeattribute (hal_audio_hwservice_202504) true)
+(expandtypeattribute (hal_audio_service_202504) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_202504) true)
+(expandtypeattribute (hal_audiocontrol_service_202504) true)
+(expandtypeattribute (hal_authgraph_service_202504) true)
+(expandtypeattribute (hal_authsecret_hwservice_202504) true)
+(expandtypeattribute (hal_authsecret_service_202504) true)
+(expandtypeattribute (hal_bluetooth_hwservice_202504) true)
+(expandtypeattribute (hal_bluetooth_service_202504) true)
+(expandtypeattribute (hal_bootctl_hwservice_202504) true)
+(expandtypeattribute (hal_bootctl_service_202504) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_202504) true)
+(expandtypeattribute (hal_broadcastradio_service_202504) true)
+(expandtypeattribute (hal_camera_hwservice_202504) true)
+(expandtypeattribute (hal_camera_service_202504) true)
+(expandtypeattribute (hal_can_bus_hwservice_202504) true)
+(expandtypeattribute (hal_can_controller_hwservice_202504) true)
+(expandtypeattribute (hal_can_controller_service_202504) true)
+(expandtypeattribute (hal_cas_hwservice_202504) true)
+(expandtypeattribute (hal_cas_service_202504) true)
+(expandtypeattribute (hal_codec2_hwservice_202504) true)
+(expandtypeattribute (hal_codec2_service_202504) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_202504) true)
+(expandtypeattribute (hal_confirmationui_hwservice_202504) true)
+(expandtypeattribute (hal_confirmationui_service_202504) true)
+(expandtypeattribute (hal_contexthub_hwservice_202504) true)
+(expandtypeattribute (hal_contexthub_service_202504) true)
+(expandtypeattribute (hal_drm_hwservice_202504) true)
+(expandtypeattribute (hal_drm_service_202504) true)
+(expandtypeattribute (hal_dumpstate_config_prop_202504) true)
+(expandtypeattribute (hal_dumpstate_hwservice_202504) true)
+(expandtypeattribute (hal_dumpstate_service_202504) true)
+(expandtypeattribute (hal_evs_hwservice_202504) true)
+(expandtypeattribute (hal_evs_service_202504) true)
+(expandtypeattribute (hal_face_hwservice_202504) true)
+(expandtypeattribute (hal_face_service_202504) true)
+(expandtypeattribute (hal_fastboot_service_202504) true)
+(expandtypeattribute (hal_fingerprint_hwservice_202504) true)
+(expandtypeattribute (hal_fingerprint_service_202504) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_202504) true)
+(expandtypeattribute (hal_gatekeeper_service_202504) true)
+(expandtypeattribute (hal_gnss_hwservice_202504) true)
+(expandtypeattribute (hal_gnss_service_202504) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_202504) true)
+(expandtypeattribute (hal_graphics_allocator_service_202504) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_202504) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_202504) true)
+(expandtypeattribute (hal_graphics_composer_service_202504) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_202504) true)
+(expandtypeattribute (hal_graphics_mapper_service_202504) true)
+(expandtypeattribute (hal_health_hwservice_202504) true)
+(expandtypeattribute (hal_health_service_202504) true)
+(expandtypeattribute (hal_health_storage_hwservice_202504) true)
+(expandtypeattribute (hal_health_storage_service_202504) true)
+(expandtypeattribute (hal_identity_service_202504) true)
+(expandtypeattribute (hal_input_classifier_hwservice_202504) true)
+(expandtypeattribute (hal_input_processor_service_202504) true)
+(expandtypeattribute (hal_instrumentation_prop_202504) true)
+(expandtypeattribute (hal_ir_hwservice_202504) true)
+(expandtypeattribute (hal_ir_service_202504) true)
+(expandtypeattribute (hal_ivn_service_202504) true)
+(expandtypeattribute (hal_keymaster_hwservice_202504) true)
+(expandtypeattribute (hal_keymint_service_202504) true)
+(expandtypeattribute (hal_light_hwservice_202504) true)
+(expandtypeattribute (hal_light_service_202504) true)
+(expandtypeattribute (hal_lowpan_hwservice_202504) true)
+(expandtypeattribute (hal_macsec_service_202504) true)
+(expandtypeattribute (hal_mediaquality_service_202504) true)
+(expandtypeattribute (hal_memtrack_hwservice_202504) true)
+(expandtypeattribute (hal_memtrack_service_202504) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_202504) true)
+(expandtypeattribute (hal_neuralnetworks_service_202504) true)
+(expandtypeattribute (hal_nfc_hwservice_202504) true)
+(expandtypeattribute (hal_nfc_service_202504) true)
+(expandtypeattribute (hal_nlinterceptor_service_202504) true)
+(expandtypeattribute (hal_oemlock_hwservice_202504) true)
+(expandtypeattribute (hal_oemlock_service_202504) true)
+(expandtypeattribute (hal_omx_hwservice_202504) true)
+(expandtypeattribute (hal_power_hwservice_202504) true)
+(expandtypeattribute (hal_power_service_202504) true)
+(expandtypeattribute (hal_power_stats_hwservice_202504) true)
+(expandtypeattribute (hal_power_stats_service_202504) true)
+(expandtypeattribute (hal_radio_service_202504) true)
+(expandtypeattribute (hal_rebootescrow_service_202504) true)
+(expandtypeattribute (hal_remoteaccess_service_202504) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_avf_service_202504) true)
+(expandtypeattribute (hal_remotelyprovisionedcomponent_service_202504) true)
+(expandtypeattribute (hal_renderscript_hwservice_202504) true)
+(expandtypeattribute (hal_secretkeeper_service_202504) true)
+(expandtypeattribute (hal_secure_element_hwservice_202504) true)
+(expandtypeattribute (hal_secure_element_service_202504) true)
+(expandtypeattribute (hal_secureclock_service_202504) true)
+(expandtypeattribute (hal_sensors_hwservice_202504) true)
+(expandtypeattribute (hal_sensors_service_202504) true)
+(expandtypeattribute (hal_sharedsecret_service_202504) true)
+(expandtypeattribute (hal_system_suspend_service_202504) true)
+(expandtypeattribute (hal_telephony_hwservice_202504) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_202504) true)
+(expandtypeattribute (hal_tetheroffload_service_202504) true)
+(expandtypeattribute (hal_thermal_hwservice_202504) true)
+(expandtypeattribute (hal_thermal_service_202504) true)
+(expandtypeattribute (hal_threadnetwork_service_202504) true)
+(expandtypeattribute (hal_tv_cec_hwservice_202504) true)
+(expandtypeattribute (hal_tv_hdmi_cec_service_202504) true)
+(expandtypeattribute (hal_tv_hdmi_connection_service_202504) true)
+(expandtypeattribute (hal_tv_hdmi_earc_service_202504) true)
+(expandtypeattribute (hal_tv_input_hwservice_202504) true)
+(expandtypeattribute (hal_tv_input_service_202504) true)
+(expandtypeattribute (hal_tv_tuner_hwservice_202504) true)
+(expandtypeattribute (hal_tv_tuner_service_202504) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_202504) true)
+(expandtypeattribute (hal_usb_gadget_service_202504) true)
+(expandtypeattribute (hal_usb_hwservice_202504) true)
+(expandtypeattribute (hal_usb_service_202504) true)
+(expandtypeattribute (hal_uwb_service_202504) true)
+(expandtypeattribute (hal_vehicle_hwservice_202504) true)
+(expandtypeattribute (hal_vehicle_service_202504) true)
+(expandtypeattribute (hal_vibrator_hwservice_202504) true)
+(expandtypeattribute (hal_vibrator_service_202504) true)
+(expandtypeattribute (hal_vm_capabilities_service_202504) true)
+(expandtypeattribute (hal_vr_hwservice_202504) true)
+(expandtypeattribute (hal_weaver_hwservice_202504) true)
+(expandtypeattribute (hal_weaver_service_202504) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_202504) true)
+(expandtypeattribute (hal_wifi_hostapd_service_202504) true)
+(expandtypeattribute (hal_wifi_hwservice_202504) true)
+(expandtypeattribute (hal_wifi_service_202504) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_202504) true)
+(expandtypeattribute (hal_wifi_supplicant_service_202504) true)
+(expandtypeattribute (hardware_properties_service_202504) true)
+(expandtypeattribute (hardware_service_202504) true)
+(expandtypeattribute (hci_attach_dev_202504) true)
+(expandtypeattribute (hdmi_config_prop_202504) true)
+(expandtypeattribute (hdmi_control_service_202504) true)
+(expandtypeattribute (healthconnect_service_202504) true)
+(expandtypeattribute (healthd_202504) true)
+(expandtypeattribute (heapdump_data_file_202504) true)
+(expandtypeattribute (heapprofd_202504) true)
+(expandtypeattribute (heapprofd_enabled_prop_202504) true)
+(expandtypeattribute (heapprofd_prop_202504) true)
+(expandtypeattribute (heapprofd_socket_202504) true)
+(expandtypeattribute (hidl_allocator_hwservice_202504) true)
+(expandtypeattribute (hidl_base_hwservice_202504) true)
+(expandtypeattribute (hidl_manager_hwservice_202504) true)
+(expandtypeattribute (hidl_memory_hwservice_202504) true)
+(expandtypeattribute (hidl_token_hwservice_202504) true)
+(expandtypeattribute (hidraw_device_202504) true)
+(expandtypeattribute (hint_service_202504) true)
+(expandtypeattribute (hw_random_device_202504) true)
+(expandtypeattribute (hw_timeout_multiplier_prop_202504) true)
+(expandtypeattribute (hwbinder_device_202504) true)
+(expandtypeattribute (hwservice_contexts_file_202504) true)
+(expandtypeattribute (hwservicemanager_202504) true)
+(expandtypeattribute (hwservicemanager_exec_202504) true)
+(expandtypeattribute (hwservicemanager_prop_202504) true)
+(expandtypeattribute (hypervisor_prop_202504) true)
+(expandtypeattribute (hypervisor_restricted_prop_202504) true)
+(expandtypeattribute (icon_file_202504) true)
+(expandtypeattribute (idmap_202504) true)
+(expandtypeattribute (idmap_exec_202504) true)
+(expandtypeattribute (idmap_service_202504) true)
+(expandtypeattribute (iio_device_202504) true)
+(expandtypeattribute (imms_service_202504) true)
+(expandtypeattribute (incident_202504) true)
+(expandtypeattribute (incident_data_file_202504) true)
+(expandtypeattribute (incident_helper_202504) true)
+(expandtypeattribute (incident_service_202504) true)
+(expandtypeattribute (incidentd_202504) true)
+(expandtypeattribute (incremental_control_file_202504) true)
+(expandtypeattribute (incremental_prop_202504) true)
+(expandtypeattribute (incremental_service_202504) true)
+(expandtypeattribute (init_202504) true)
+(expandtypeattribute (init_exec_202504) true)
+(expandtypeattribute (init_service_status_prop_202504) true)
+(expandtypeattribute (init_tmpfs_202504) true)
+(expandtypeattribute (inotify_202504) true)
+(expandtypeattribute (input_device_202504) true)
+(expandtypeattribute (input_device_config_prop_202504) true)
+(expandtypeattribute (input_method_service_202504) true)
+(expandtypeattribute (input_service_202504) true)
+(expandtypeattribute (inputflinger_202504) true)
+(expandtypeattribute (inputflinger_exec_202504) true)
+(expandtypeattribute (inputflinger_service_202504) true)
+(expandtypeattribute (install_data_file_202504) true)
+(expandtypeattribute (installd_202504) true)
+(expandtypeattribute (installd_exec_202504) true)
+(expandtypeattribute (installd_service_202504) true)
+(expandtypeattribute (intrusion_detection_service_202504) true)
+(expandtypeattribute (ion_device_202504) true)
+(expandtypeattribute (ipsec_service_202504) true)
+(expandtypeattribute (iris_service_202504) true)
+(expandtypeattribute (iris_vendor_data_file_202504) true)
+(expandtypeattribute (isolated_app_202504) true)
+(expandtypeattribute (isolated_compute_app_202504) true)
+(expandtypeattribute (jobscheduler_service_202504) true)
+(expandtypeattribute (kernel_202504) true)
+(expandtypeattribute (keychain_data_file_202504) true)
+(expandtypeattribute (keychord_device_202504) true)
+(expandtypeattribute (keyguard_config_prop_202504) true)
+(expandtypeattribute (keystore2_key_contexts_file_202504) true)
+(expandtypeattribute (keystore_202504) true)
+(expandtypeattribute (keystore_compat_hal_service_202504) true)
+(expandtypeattribute (keystore_config_prop_202504) true)
+(expandtypeattribute (keystore_data_file_202504) true)
+(expandtypeattribute (keystore_exec_202504) true)
+(expandtypeattribute (keystore_maintenance_service_202504) true)
+(expandtypeattribute (keystore_metrics_service_202504) true)
+(expandtypeattribute (keystore_service_202504) true)
+(expandtypeattribute (kmsg_debug_device_202504) true)
+(expandtypeattribute (kmsg_device_202504) true)
+(expandtypeattribute (labeledfs_202504) true)
+(expandtypeattribute (launcherapps_service_202504) true)
+(expandtypeattribute (legacy_permission_service_202504) true)
+(expandtypeattribute (legacykeystore_service_202504) true)
+(expandtypeattribute (libc_debug_prop_202504) true)
+(expandtypeattribute (light_service_202504) true)
+(expandtypeattribute (linkerconfig_file_202504) true)
+(expandtypeattribute (llkd_202504) true)
+(expandtypeattribute (llkd_exec_202504) true)
+(expandtypeattribute (llkd_prop_202504) true)
+(expandtypeattribute (lmkd_202504) true)
+(expandtypeattribute (lmkd_config_prop_202504) true)
+(expandtypeattribute (lmkd_exec_202504) true)
+(expandtypeattribute (lmkd_prop_202504) true)
+(expandtypeattribute (lmkd_socket_202504) true)
+(expandtypeattribute (locale_prop_202504) true)
+(expandtypeattribute (locale_service_202504) true)
+(expandtypeattribute (location_service_202504) true)
+(expandtypeattribute (location_time_zone_manager_service_202504) true)
+(expandtypeattribute (lock_settings_service_202504) true)
+(expandtypeattribute (log_prop_202504) true)
+(expandtypeattribute (log_tag_prop_202504) true)
+(expandtypeattribute (logcat_exec_202504) true)
+(expandtypeattribute (logd_202504) true)
+(expandtypeattribute (logd_exec_202504) true)
+(expandtypeattribute (logd_prop_202504) true)
+(expandtypeattribute (logd_socket_202504) true)
+(expandtypeattribute (logdr_socket_202504) true)
+(expandtypeattribute (logdw_socket_202504) true)
+(expandtypeattribute (logpersist_202504) true)
+(expandtypeattribute (logpersistd_logging_prop_202504) true)
+(expandtypeattribute (loop_control_device_202504) true)
+(expandtypeattribute (loop_device_202504) true)
+(expandtypeattribute (looper_stats_service_202504) true)
+(expandtypeattribute (lowpan_device_202504) true)
+(expandtypeattribute (lowpan_prop_202504) true)
+(expandtypeattribute (lpdump_service_202504) true)
+(expandtypeattribute (lpdumpd_prop_202504) true)
+(expandtypeattribute (mac_perms_file_202504) true)
+(expandtypeattribute (mdns_service_202504) true)
+(expandtypeattribute (mdns_socket_202504) true)
+(expandtypeattribute (mdnsd_202504) true)
+(expandtypeattribute (mdnsd_socket_202504) true)
+(expandtypeattribute (media_communication_service_202504) true)
+(expandtypeattribute (media_config_prop_202504) true)
+(expandtypeattribute (media_data_file_202504) true)
+(expandtypeattribute (media_metrics_service_202504) true)
+(expandtypeattribute (media_projection_service_202504) true)
+(expandtypeattribute (media_quality_service_202504) true)
+(expandtypeattribute (media_router_service_202504) true)
+(expandtypeattribute (media_rw_data_file_202504) true)
+(expandtypeattribute (media_session_service_202504) true)
+(expandtypeattribute (media_userdir_file_202504) true)
+(expandtypeattribute (media_variant_prop_202504) true)
+(expandtypeattribute (mediadrm_config_prop_202504) true)
+(expandtypeattribute (mediadrmserver_202504) true)
+(expandtypeattribute (mediadrmserver_exec_202504) true)
+(expandtypeattribute (mediadrmserver_service_202504) true)
+(expandtypeattribute (mediaextractor_202504) true)
+(expandtypeattribute (mediaextractor_exec_202504) true)
+(expandtypeattribute (mediaextractor_service_202504) true)
+(expandtypeattribute (mediaextractor_tmpfs_202504) true)
+(expandtypeattribute (mediametrics_202504) true)
+(expandtypeattribute (mediametrics_exec_202504) true)
+(expandtypeattribute (mediametrics_service_202504) true)
+(expandtypeattribute (mediaprovider_202504) true)
+(expandtypeattribute (mediaserver_202504) true)
+(expandtypeattribute (mediaserver_exec_202504) true)
+(expandtypeattribute (mediaserver_service_202504) true)
+(expandtypeattribute (mediaserver_tmpfs_202504) true)
+(expandtypeattribute (mediaswcodec_202504) true)
+(expandtypeattribute (mediaswcodec_exec_202504) true)
+(expandtypeattribute (mediatranscoding_202504) true)
+(expandtypeattribute (mediatranscoding_service_202504) true)
+(expandtypeattribute (meminfo_service_202504) true)
+(expandtypeattribute (memtrackproxy_service_202504) true)
+(expandtypeattribute (metadata_block_device_202504) true)
+(expandtypeattribute (metadata_bootstat_file_202504) true)
+(expandtypeattribute (metadata_file_202504) true)
+(expandtypeattribute (method_trace_data_file_202504) true)
+(expandtypeattribute (midi_service_202504) true)
+(expandtypeattribute (mirror_data_file_202504) true)
+(expandtypeattribute (misc_block_device_202504) true)
+(expandtypeattribute (misc_logd_file_202504) true)
+(expandtypeattribute (misc_user_data_file_202504) true)
+(expandtypeattribute (mm_events_config_prop_202504) true)
+(expandtypeattribute (mmc_prop_202504) true)
+(expandtypeattribute (mnt_expand_file_202504) true)
+(expandtypeattribute (mnt_media_rw_file_202504) true)
+(expandtypeattribute (mnt_media_rw_stub_file_202504) true)
+(expandtypeattribute (mnt_pass_through_file_202504) true)
+(expandtypeattribute (mnt_product_file_202504) true)
+(expandtypeattribute (mnt_sdcard_file_202504) true)
+(expandtypeattribute (mnt_user_file_202504) true)
+(expandtypeattribute (mnt_vendor_file_202504) true)
+(expandtypeattribute (mock_ota_prop_202504) true)
+(expandtypeattribute (modprobe_202504) true)
+(expandtypeattribute (module_sdkextensions_prop_202504) true)
+(expandtypeattribute (mount_service_202504) true)
+(expandtypeattribute (mqueue_202504) true)
+(expandtypeattribute (mtp_202504) true)
+(expandtypeattribute (mtp_device_202504) true)
+(expandtypeattribute (mtpd_socket_202504) true)
+(expandtypeattribute (music_recognition_service_202504) true)
+(expandtypeattribute (nativetest_data_file_202504) true)
+(expandtypeattribute (nearby_service_202504) true)
+(expandtypeattribute (net_data_file_202504) true)
+(expandtypeattribute (net_dns_prop_202504) true)
+(expandtypeattribute (net_radio_prop_202504) true)
+(expandtypeattribute (netd_202504) true)
+(expandtypeattribute (netd_exec_202504) true)
+(expandtypeattribute (netd_listener_service_202504) true)
+(expandtypeattribute (netd_service_202504) true)
+(expandtypeattribute (netif_202504) true)
+(expandtypeattribute (netpolicy_service_202504) true)
+(expandtypeattribute (netstats_service_202504) true)
+(expandtypeattribute (netutils_wrapper_202504) true)
+(expandtypeattribute (netutils_wrapper_exec_202504) true)
+(expandtypeattribute (network_management_service_202504) true)
+(expandtypeattribute (network_score_service_202504) true)
+(expandtypeattribute (network_stack_202504) true)
+(expandtypeattribute (network_stack_service_202504) true)
+(expandtypeattribute (network_time_update_service_202504) true)
+(expandtypeattribute (network_watchlist_data_file_202504) true)
+(expandtypeattribute (network_watchlist_service_202504) true)
+(expandtypeattribute (nfc_202504) true)
+(expandtypeattribute (nfc_data_file_202504) true)
+(expandtypeattribute (nfc_device_202504) true)
+(expandtypeattribute (nfc_logs_data_file_202504) true)
+(expandtypeattribute (nfc_prop_202504) true)
+(expandtypeattribute (nfc_service_202504) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_202504) true)
+(expandtypeattribute (node_202504) true)
+(expandtypeattribute (notification_service_202504) true)
+(expandtypeattribute (null_device_202504) true)
+(expandtypeattribute (oem_lock_service_202504) true)
+(expandtypeattribute (oem_unlock_prop_202504) true)
+(expandtypeattribute (oemfs_202504) true)
+(expandtypeattribute (ondevicepersonalization_system_service_202504) true)
+(expandtypeattribute (ot_daemon_service_202504) true)
+(expandtypeattribute (ot_daemon_socket_202504) true)
+(expandtypeattribute (ota_build_prop_202504) true)
+(expandtypeattribute (ota_data_file_202504) true)
+(expandtypeattribute (ota_metadata_file_202504) true)
+(expandtypeattribute (ota_package_file_202504) true)
+(expandtypeattribute (ota_prop_202504) true)
+(expandtypeattribute (otadexopt_service_202504) true)
+(expandtypeattribute (overlay_prop_202504) true)
+(expandtypeattribute (overlay_service_202504) true)
+(expandtypeattribute (overlayfs_file_202504) true)
+(expandtypeattribute (owntty_device_202504) true)
+(expandtypeattribute (pac_proxy_service_202504) true)
+(expandtypeattribute (package_native_service_202504) true)
+(expandtypeattribute (package_service_202504) true)
+(expandtypeattribute (packagemanager_config_prop_202504) true)
+(expandtypeattribute (packages_list_file_202504) true)
+(expandtypeattribute (pan_result_prop_202504) true)
+(expandtypeattribute (password_slot_metadata_file_202504) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_202504) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_bufferhub_dir_202504) true)
+(expandtypeattribute (pdx_display_client_channel_socket_202504) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_display_dir_202504) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_202504) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_202504) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_202504) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_202504) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_202504) true)
+(expandtypeattribute (pdx_performance_dir_202504) true)
+(expandtypeattribute (people_service_202504) true)
+(expandtypeattribute (perfetto_202504) true)
+(expandtypeattribute (performanced_202504) true)
+(expandtypeattribute (performanced_exec_202504) true)
+(expandtypeattribute (permission_checker_service_202504) true)
+(expandtypeattribute (permission_service_202504) true)
+(expandtypeattribute (permissionmgr_service_202504) true)
+(expandtypeattribute (permissive_mte_prop_202504) true)
+(expandtypeattribute (persist_debug_prop_202504) true)
+(expandtypeattribute (persist_vendor_debug_wifi_prop_202504) true)
+(expandtypeattribute (persist_wm_debug_prop_202504) true)
+(expandtypeattribute (persistent_data_block_service_202504) true)
+(expandtypeattribute (persistent_properties_ready_prop_202504) true)
+(expandtypeattribute (pinner_service_202504) true)
+(expandtypeattribute (pipefs_202504) true)
+(expandtypeattribute (platform_app_202504) true)
+(expandtypeattribute (platform_compat_service_202504) true)
+(expandtypeattribute (pm_archiving_enabled_prop_202504) true)
+(expandtypeattribute (pmsg_device_202504) true)
+(expandtypeattribute (port_202504) true)
+(expandtypeattribute (port_device_202504) true)
+(expandtypeattribute (postinstall_202504) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_202504) true)
+(expandtypeattribute (postinstall_file_202504) true)
+(expandtypeattribute (postinstall_mnt_dir_202504) true)
+(expandtypeattribute (power_debug_prop_202504) true)
+(expandtypeattribute (power_service_202504) true)
+(expandtypeattribute (powerctl_prop_202504) true)
+(expandtypeattribute (powerstats_service_202504) true)
+(expandtypeattribute (ppp_202504) true)
+(expandtypeattribute (preloads_data_file_202504) true)
+(expandtypeattribute (preloads_media_file_202504) true)
+(expandtypeattribute (prereboot_data_file_202504) true)
+(expandtypeattribute (print_service_202504) true)
+(expandtypeattribute (priv_app_202504) true)
+(expandtypeattribute (privapp_data_file_202504) true)
+(expandtypeattribute (prng_seeder_202504) true)
+(expandtypeattribute (proc_202504) true)
+(expandtypeattribute (proc_abi_202504) true)
+(expandtypeattribute (proc_asound_202504) true)
+(expandtypeattribute (proc_bluetooth_writable_202504) true)
+(expandtypeattribute (proc_bootconfig_202504) true)
+(expandtypeattribute (proc_bpf_202504) true)
+(expandtypeattribute (proc_buddyinfo_202504) true)
+(expandtypeattribute (proc_cgroups_202504) true)
+(expandtypeattribute (proc_cmdline_202504) true)
+(expandtypeattribute (proc_cpu_alignment_202504) true)
+(expandtypeattribute (proc_cpuinfo_202504) true)
+(expandtypeattribute (proc_dirty_202504) true)
+(expandtypeattribute (proc_diskstats_202504) true)
+(expandtypeattribute (proc_drop_caches_202504) true)
+(expandtypeattribute (proc_extra_free_kbytes_202504) true)
+(expandtypeattribute (proc_filesystems_202504) true)
+(expandtypeattribute (proc_fs_verity_202504) true)
+(expandtypeattribute (proc_hostname_202504) true)
+(expandtypeattribute (proc_hung_task_202504) true)
+(expandtypeattribute (proc_interrupts_202504) true)
+(expandtypeattribute (proc_iomem_202504) true)
+(expandtypeattribute (proc_kallsyms_202504) true)
+(expandtypeattribute (proc_keys_202504) true)
+(expandtypeattribute (proc_kmsg_202504) true)
+(expandtypeattribute (proc_kpageflags_202504) true)
+(expandtypeattribute (proc_loadavg_202504) true)
+(expandtypeattribute (proc_locks_202504) true)
+(expandtypeattribute (proc_lowmemorykiller_202504) true)
+(expandtypeattribute (proc_max_map_count_202504) true)
+(expandtypeattribute (proc_meminfo_202504) true)
+(expandtypeattribute (proc_min_free_order_shift_202504) true)
+(expandtypeattribute (proc_misc_202504) true)
+(expandtypeattribute (proc_modules_202504) true)
+(expandtypeattribute (proc_mounts_202504) true)
+(expandtypeattribute (proc_net_202504) true)
+(expandtypeattribute (proc_net_tcp_udp_202504) true)
+(expandtypeattribute (proc_overcommit_memory_202504) true)
+(expandtypeattribute (proc_page_cluster_202504) true)
+(expandtypeattribute (proc_pagetypeinfo_202504) true)
+(expandtypeattribute (proc_panic_202504) true)
+(expandtypeattribute (proc_percpu_pagelist_high_fraction_202504) true)
+(expandtypeattribute (proc_perf_202504) true)
+(expandtypeattribute (proc_pid_max_202504) true)
+(expandtypeattribute (proc_pipe_conf_202504) true)
+(expandtypeattribute (proc_pressure_cpu_202504) true)
+(expandtypeattribute (proc_pressure_io_202504) true)
+(expandtypeattribute (proc_pressure_mem_202504) true)
+(expandtypeattribute (proc_qtaguid_ctrl_202504) true)
+(expandtypeattribute (proc_qtaguid_stat_202504) true)
+(expandtypeattribute (proc_random_202504) true)
+(expandtypeattribute (proc_sched_202504) true)
+(expandtypeattribute (proc_security_202504) true)
+(expandtypeattribute (proc_slabinfo_202504) true)
+(expandtypeattribute (proc_stat_202504) true)
+(expandtypeattribute (proc_swaps_202504) true)
+(expandtypeattribute (proc_sysrq_202504) true)
+(expandtypeattribute (proc_timer_202504) true)
+(expandtypeattribute (proc_tty_drivers_202504) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_202504) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_202504) true)
+(expandtypeattribute (proc_uid_cpupower_202504) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_202504) true)
+(expandtypeattribute (proc_uid_cputime_showstat_202504) true)
+(expandtypeattribute (proc_uid_io_stats_202504) true)
+(expandtypeattribute (proc_uid_procstat_set_202504) true)
+(expandtypeattribute (proc_uid_time_in_state_202504) true)
+(expandtypeattribute (proc_uptime_202504) true)
+(expandtypeattribute (proc_vendor_sched_202504) true)
+(expandtypeattribute (proc_version_202504) true)
+(expandtypeattribute (proc_vmallocinfo_202504) true)
+(expandtypeattribute (proc_vmstat_202504) true)
+(expandtypeattribute (proc_watermark_boost_factor_202504) true)
+(expandtypeattribute (proc_watermark_scale_factor_202504) true)
+(expandtypeattribute (proc_zoneinfo_202504) true)
+(expandtypeattribute (processinfo_service_202504) true)
+(expandtypeattribute (procstats_service_202504) true)
+(expandtypeattribute (profcollectd_etr_prop_202504) true)
+(expandtypeattribute (profiling_service_202504) true)
+(expandtypeattribute (profman_202504) true)
+(expandtypeattribute (profman_dump_data_file_202504) true)
+(expandtypeattribute (profman_exec_202504) true)
+(expandtypeattribute (properties_device_202504) true)
+(expandtypeattribute (properties_serial_202504) true)
+(expandtypeattribute (property_contexts_file_202504) true)
+(expandtypeattribute (property_data_file_202504) true)
+(expandtypeattribute (property_info_202504) true)
+(expandtypeattribute (property_service_version_prop_202504) true)
+(expandtypeattribute (property_socket_202504) true)
+(expandtypeattribute (provisioned_prop_202504) true)
+(expandtypeattribute (pstorefs_202504) true)
+(expandtypeattribute (ptmx_device_202504) true)
+(expandtypeattribute (qemu_hw_prop_202504) true)
+(expandtypeattribute (qemu_sf_lcd_density_prop_202504) true)
+(expandtypeattribute (qtaguid_device_202504) true)
+(expandtypeattribute (quick_start_prop_202504) true)
+(expandtypeattribute (racoon_socket_202504) true)
+(expandtypeattribute (radio_202504) true)
+(expandtypeattribute (radio_control_prop_202504) true)
+(expandtypeattribute (radio_core_data_file_202504) true)
+(expandtypeattribute (radio_data_file_202504) true)
+(expandtypeattribute (radio_device_202504) true)
+(expandtypeattribute (radio_prop_202504) true)
+(expandtypeattribute (radio_service_202504) true)
+(expandtypeattribute (ram_device_202504) true)
+(expandtypeattribute (random_device_202504) true)
+(expandtypeattribute (reboot_readiness_service_202504) true)
+(expandtypeattribute (rebootescrow_hal_prop_202504) true)
+(expandtypeattribute (recovery_202504) true)
+(expandtypeattribute (recovery_block_device_202504) true)
+(expandtypeattribute (recovery_config_prop_202504) true)
+(expandtypeattribute (recovery_data_file_202504) true)
+(expandtypeattribute (recovery_persist_202504) true)
+(expandtypeattribute (recovery_persist_exec_202504) true)
+(expandtypeattribute (recovery_refresh_202504) true)
+(expandtypeattribute (recovery_refresh_exec_202504) true)
+(expandtypeattribute (recovery_service_202504) true)
+(expandtypeattribute (recovery_socket_202504) true)
+(expandtypeattribute (recovery_usb_config_prop_202504) true)
+(expandtypeattribute (registry_service_202504) true)
+(expandtypeattribute (remote_auth_service_202504) true)
+(expandtypeattribute (remote_provisioning_service_202504) true)
+(expandtypeattribute (repair_mode_metadata_file_202504) true)
+(expandtypeattribute (resourcecache_data_file_202504) true)
+(expandtypeattribute (resources_manager_service_202504) true)
+(expandtypeattribute (restorecon_prop_202504) true)
+(expandtypeattribute (restrictions_service_202504) true)
+(expandtypeattribute (retaildemo_prop_202504) true)
+(expandtypeattribute (rild_debug_socket_202504) true)
+(expandtypeattribute (rild_socket_202504) true)
+(expandtypeattribute (ringtone_file_202504) true)
+(expandtypeattribute (rkpdapp_202504) true)
+(expandtypeattribute (role_service_202504) true)
+(expandtypeattribute (rollback_service_202504) true)
+(expandtypeattribute (root_block_device_202504) true)
+(expandtypeattribute (rootdisk_sysdev_202504) true)
+(expandtypeattribute (rootfs_202504) true)
+(expandtypeattribute (rpmsg_device_202504) true)
+(expandtypeattribute (rs_202504) true)
+(expandtypeattribute (rs_exec_202504) true)
+(expandtypeattribute (rss_hwm_reset_202504) true)
+(expandtypeattribute (rtc_device_202504) true)
+(expandtypeattribute (rttmanager_service_202504) true)
+(expandtypeattribute (runas_202504) true)
+(expandtypeattribute (runas_app_202504) true)
+(expandtypeattribute (runas_exec_202504) true)
+(expandtypeattribute (runtime_event_log_tags_file_202504) true)
+(expandtypeattribute (runtime_service_202504) true)
+(expandtypeattribute (safemode_prop_202504) true)
+(expandtypeattribute (same_process_hal_file_202504) true)
+(expandtypeattribute (samplingprofiler_service_202504) true)
+(expandtypeattribute (scheduling_policy_service_202504) true)
+(expandtypeattribute (sdcard_block_device_202504) true)
+(expandtypeattribute (sdcardd_202504) true)
+(expandtypeattribute (sdcardd_exec_202504) true)
+(expandtypeattribute (sdcardfs_202504) true)
+(expandtypeattribute (sdk_sandbox_service_202504) true)
+(expandtypeattribute (seapp_contexts_file_202504) true)
+(expandtypeattribute (search_service_202504) true)
+(expandtypeattribute (search_ui_service_202504) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_202504) true)
+(expandtypeattribute (secure_element_202504) true)
+(expandtypeattribute (secure_element_device_202504) true)
+(expandtypeattribute (secure_element_service_202504) true)
+(expandtypeattribute (security_state_service_202504) true)
+(expandtypeattribute (securityfs_202504) true)
+(expandtypeattribute (selection_toolbar_service_202504) true)
+(expandtypeattribute (selinuxfs_202504) true)
+(expandtypeattribute (sendbug_config_prop_202504) true)
+(expandtypeattribute (sensitive_content_protection_service_202504) true)
+(expandtypeattribute (sensor_privacy_service_202504) true)
+(expandtypeattribute (sensors_device_202504) true)
+(expandtypeattribute (sensorservice_service_202504) true)
+(expandtypeattribute (sepolicy_file_202504) true)
+(expandtypeattribute (serial_device_202504) true)
+(expandtypeattribute (serial_service_202504) true)
+(expandtypeattribute (serialno_prop_202504) true)
+(expandtypeattribute (server_configurable_flags_data_file_202504) true)
+(expandtypeattribute (service_contexts_file_202504) true)
+(expandtypeattribute (service_manager_service_202504) true)
+(expandtypeattribute (service_manager_vndservice_202504) true)
+(expandtypeattribute (servicediscovery_service_202504) true)
+(expandtypeattribute (servicemanager_202504) true)
+(expandtypeattribute (servicemanager_exec_202504) true)
+(expandtypeattribute (servicemanager_prop_202504) true)
+(expandtypeattribute (settings_service_202504) true)
+(expandtypeattribute (setupwizard_mode_prop_202504) true)
+(expandtypeattribute (sgdisk_202504) true)
+(expandtypeattribute (sgdisk_exec_202504) true)
+(expandtypeattribute (shared_relro_202504) true)
+(expandtypeattribute (shared_relro_file_202504) true)
+(expandtypeattribute (shell_202504) true)
+(expandtypeattribute (shell_data_file_202504) true)
+(expandtypeattribute (shell_exec_202504) true)
+(expandtypeattribute (shell_prop_202504) true)
+(expandtypeattribute (shell_test_data_file_202504) true)
+(expandtypeattribute (shm_202504) true)
+(expandtypeattribute (shortcut_manager_icons_202504) true)
+(expandtypeattribute (shortcut_service_202504) true)
+(expandtypeattribute (shutdown_checkpoints_system_data_file_202504) true)
+(expandtypeattribute (simpleperf_202504) true)
+(expandtypeattribute (simpleperf_app_runner_202504) true)
+(expandtypeattribute (simpleperf_app_runner_exec_202504) true)
+(expandtypeattribute (slice_service_202504) true)
+(expandtypeattribute (slideshow_202504) true)
+(expandtypeattribute (smart_idle_maint_enabled_prop_202504) true)
+(expandtypeattribute (smartspace_service_202504) true)
+(expandtypeattribute (snapshotctl_log_data_file_202504) true)
+(expandtypeattribute (snapuserd_log_data_file_202504) true)
+(expandtypeattribute (snapuserd_proxy_socket_202504) true)
+(expandtypeattribute (snapuserd_socket_202504) true)
+(expandtypeattribute (soc_prop_202504) true)
+(expandtypeattribute (socket_device_202504) true)
+(expandtypeattribute (socket_hook_prop_202504) true)
+(expandtypeattribute (sockfs_202504) true)
+(expandtypeattribute (sota_prop_202504) true)
+(expandtypeattribute (soundtrigger_middleware_service_202504) true)
+(expandtypeattribute (speech_recognition_service_202504) true)
+(expandtypeattribute (sqlite_log_prop_202504) true)
+(expandtypeattribute (staged_install_file_202504) true)
+(expandtypeattribute (staging_data_file_202504) true)
+(expandtypeattribute (stats_config_data_file_202504) true)
+(expandtypeattribute (stats_data_file_202504) true)
+(expandtypeattribute (statsd_202504) true)
+(expandtypeattribute (statsd_exec_202504) true)
+(expandtypeattribute (statsdw_socket_202504) true)
+(expandtypeattribute (statusbar_service_202504) true)
+(expandtypeattribute (storage_config_prop_202504) true)
+(expandtypeattribute (storage_file_202504) true)
+(expandtypeattribute (storage_stub_file_202504) true)
+(expandtypeattribute (storaged_service_202504) true)
+(expandtypeattribute (storagemanager_config_prop_202504) true)
+(expandtypeattribute (storagestats_service_202504) true)
+(expandtypeattribute (su_202504) true)
+(expandtypeattribute (su_exec_202504) true)
+(expandtypeattribute (super_block_device_202504) true)
+(expandtypeattribute (surfaceflinger_202504) true)
+(expandtypeattribute (surfaceflinger_color_prop_202504) true)
+(expandtypeattribute (surfaceflinger_display_prop_202504) true)
+(expandtypeattribute (surfaceflinger_prop_202504) true)
+(expandtypeattribute (surfaceflinger_service_202504) true)
+(expandtypeattribute (surfaceflinger_tmpfs_202504) true)
+(expandtypeattribute (suspend_prop_202504) true)
+(expandtypeattribute (swap_block_device_202504) true)
+(expandtypeattribute (sysfs_202504) true)
+(expandtypeattribute (sysfs_android_usb_202504) true)
+(expandtypeattribute (sysfs_batteryinfo_202504) true)
+(expandtypeattribute (sysfs_bluetooth_writable_202504) true)
+(expandtypeattribute (sysfs_cma_202504) true)
+(expandtypeattribute (sysfs_devfreq_cur_202504) true)
+(expandtypeattribute (sysfs_devfreq_dir_202504) true)
+(expandtypeattribute (sysfs_devices_block_202504) true)
+(expandtypeattribute (sysfs_devices_cs_etm_202504) true)
+(expandtypeattribute (sysfs_devices_system_cpu_202504) true)
+(expandtypeattribute (sysfs_dm_202504) true)
+(expandtypeattribute (sysfs_dm_verity_202504) true)
+(expandtypeattribute (sysfs_dma_heap_202504) true)
+(expandtypeattribute (sysfs_dmabuf_stats_202504) true)
+(expandtypeattribute (sysfs_dt_firmware_android_202504) true)
+(expandtypeattribute (sysfs_extcon_202504) true)
+(expandtypeattribute (sysfs_fs_ext4_features_202504) true)
+(expandtypeattribute (sysfs_fs_f2fs_202504) true)
+(expandtypeattribute (sysfs_fs_fuse_bpf_202504) true)
+(expandtypeattribute (sysfs_fs_fuse_features_202504) true)
+(expandtypeattribute (sysfs_fs_incfs_features_202504) true)
+(expandtypeattribute (sysfs_fs_incfs_metrics_202504) true)
+(expandtypeattribute (sysfs_gpu_202504) true)
+(expandtypeattribute (sysfs_hwrandom_202504) true)
+(expandtypeattribute (sysfs_ion_202504) true)
+(expandtypeattribute (sysfs_ipv4_202504) true)
+(expandtypeattribute (sysfs_kernel_notes_202504) true)
+(expandtypeattribute (sysfs_leds_202504) true)
+(expandtypeattribute (sysfs_loop_202504) true)
+(expandtypeattribute (sysfs_lowmemorykiller_202504) true)
+(expandtypeattribute (sysfs_lru_gen_enabled_202504) true)
+(expandtypeattribute (sysfs_mem_sleep_202504) true)
+(expandtypeattribute (sysfs_net_202504) true)
+(expandtypeattribute (sysfs_nfc_power_writable_202504) true)
+(expandtypeattribute (sysfs_power_202504) true)
+(expandtypeattribute (sysfs_rtc_202504) true)
+(expandtypeattribute (sysfs_suspend_stats_202504) true)
+(expandtypeattribute (sysfs_switch_202504) true)
+(expandtypeattribute (sysfs_sync_on_suspend_202504) true)
+(expandtypeattribute (sysfs_thermal_202504) true)
+(expandtypeattribute (sysfs_transparent_hugepage_202504) true)
+(expandtypeattribute (sysfs_udc_202504) true)
+(expandtypeattribute (sysfs_uhid_202504) true)
+(expandtypeattribute (sysfs_uio_202504) true)
+(expandtypeattribute (sysfs_usb_202504) true)
+(expandtypeattribute (sysfs_usermodehelper_202504) true)
+(expandtypeattribute (sysfs_vendor_sched_202504) true)
+(expandtypeattribute (sysfs_vibrator_202504) true)
+(expandtypeattribute (sysfs_wake_lock_202504) true)
+(expandtypeattribute (sysfs_wakeup_202504) true)
+(expandtypeattribute (sysfs_wakeup_reasons_202504) true)
+(expandtypeattribute (sysfs_wlan_fwpath_202504) true)
+(expandtypeattribute (sysfs_zram_202504) true)
+(expandtypeattribute (sysfs_zram_uevent_202504) true)
+(expandtypeattribute (system_app_202504) true)
+(expandtypeattribute (system_app_data_file_202504) true)
+(expandtypeattribute (system_app_service_202504) true)
+(expandtypeattribute (system_asan_options_file_202504) true)
+(expandtypeattribute (system_block_device_202504) true)
+(expandtypeattribute (system_boot_reason_prop_202504) true)
+(expandtypeattribute (system_bootstrap_lib_file_202504) true)
+(expandtypeattribute (system_config_service_202504) true)
+(expandtypeattribute (system_data_file_202504) true)
+(expandtypeattribute (system_data_root_file_202504) true)
+(expandtypeattribute (system_dlkm_file_202504) true)
+(expandtypeattribute (system_event_log_tags_file_202504) true)
+(expandtypeattribute (system_file_202504) true)
+(expandtypeattribute (system_group_file_202504) true)
+(expandtypeattribute (system_jvmti_agent_prop_202504) true)
+(expandtypeattribute (system_lib_file_202504) true)
+(expandtypeattribute (system_linker_config_file_202504) true)
+(expandtypeattribute (system_linker_exec_202504) true)
+(expandtypeattribute (system_lmk_prop_202504) true)
+(expandtypeattribute (system_ndebug_socket_202504) true)
+(expandtypeattribute (system_net_netd_hwservice_202504) true)
+(expandtypeattribute (system_net_netd_service_202504) true)
+(expandtypeattribute (system_passwd_file_202504) true)
+(expandtypeattribute (system_prop_202504) true)
+(expandtypeattribute (system_seccomp_policy_file_202504) true)
+(expandtypeattribute (system_security_cacerts_file_202504) true)
+(expandtypeattribute (system_server_202504) true)
+(expandtypeattribute (system_server_dumper_service_202504) true)
+(expandtypeattribute (system_server_tmpfs_202504) true)
+(expandtypeattribute (system_suspend_control_internal_service_202504) true)
+(expandtypeattribute (system_suspend_control_service_202504) true)
+(expandtypeattribute (system_suspend_hwservice_202504) true)
+(expandtypeattribute (system_trace_prop_202504) true)
+(expandtypeattribute (system_unsolzygote_socket_202504) true)
+(expandtypeattribute (system_update_service_202504) true)
+(expandtypeattribute (system_user_mode_emulation_prop_202504) true)
+(expandtypeattribute (system_userdir_file_202504) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_202504) true)
+(expandtypeattribute (system_wpa_socket_202504) true)
+(expandtypeattribute (system_zoneinfo_file_202504) true)
+(expandtypeattribute (systemkeys_data_file_202504) true)
+(expandtypeattribute (systemsound_config_prop_202504) true)
+(expandtypeattribute (tare_service_202504) true)
+(expandtypeattribute (task_profiles_file_202504) true)
+(expandtypeattribute (task_service_202504) true)
+(expandtypeattribute (tcpdump_exec_202504) true)
+(expandtypeattribute (tee_202504) true)
+(expandtypeattribute (tee_data_file_202504) true)
+(expandtypeattribute (tee_device_202504) true)
+(expandtypeattribute (tee_service_contexts_file_202504) true)
+(expandtypeattribute (telecom_service_202504) true)
+(expandtypeattribute (telephony_config_prop_202504) true)
+(expandtypeattribute (telephony_status_prop_202504) true)
+(expandtypeattribute (test_boot_reason_prop_202504) true)
+(expandtypeattribute (test_harness_prop_202504) true)
+(expandtypeattribute (testharness_service_202504) true)
+(expandtypeattribute (tethering_service_202504) true)
+(expandtypeattribute (textclassification_service_202504) true)
+(expandtypeattribute (textclassifier_data_file_202504) true)
+(expandtypeattribute (textservices_service_202504) true)
+(expandtypeattribute (texttospeech_service_202504) true)
+(expandtypeattribute (theme_prop_202504) true)
+(expandtypeattribute (thermal_service_202504) true)
+(expandtypeattribute (threadnetwork_config_prop_202504) true)
+(expandtypeattribute (threadnetwork_service_202504) true)
+(expandtypeattribute (time_prop_202504) true)
+(expandtypeattribute (timedetector_service_202504) true)
+(expandtypeattribute (timezone_prop_202504) true)
+(expandtypeattribute (timezonedetector_service_202504) true)
+(expandtypeattribute (tmpfs_202504) true)
+(expandtypeattribute (tombstone_config_prop_202504) true)
+(expandtypeattribute (tombstone_data_file_202504) true)
+(expandtypeattribute (tombstone_wifi_data_file_202504) true)
+(expandtypeattribute (tombstoned_202504) true)
+(expandtypeattribute (tombstoned_crash_socket_202504) true)
+(expandtypeattribute (tombstoned_exec_202504) true)
+(expandtypeattribute (tombstoned_intercept_socket_202504) true)
+(expandtypeattribute (tombstoned_java_trace_socket_202504) true)
+(expandtypeattribute (toolbox_202504) true)
+(expandtypeattribute (toolbox_exec_202504) true)
+(expandtypeattribute (trace_data_file_202504) true)
+(expandtypeattribute (traced_202504) true)
+(expandtypeattribute (traced_consumer_socket_202504) true)
+(expandtypeattribute (traced_enabled_prop_202504) true)
+(expandtypeattribute (traced_lazy_prop_202504) true)
+(expandtypeattribute (traced_oome_heap_session_count_prop_202504) true)
+(expandtypeattribute (traced_perf_202504) true)
+(expandtypeattribute (traced_perf_socket_202504) true)
+(expandtypeattribute (traced_probes_202504) true)
+(expandtypeattribute (traced_producer_socket_202504) true)
+(expandtypeattribute (traced_tmpfs_202504) true)
+(expandtypeattribute (traceur_app_202504) true)
+(expandtypeattribute (translation_service_202504) true)
+(expandtypeattribute (trust_service_202504) true)
+(expandtypeattribute (trusty_security_vm_sys_vendor_prop_202504) true)
+(expandtypeattribute (tty_device_202504) true)
+(expandtypeattribute (tun_device_202504) true)
+(expandtypeattribute (tuner_config_prop_202504) true)
+(expandtypeattribute (tv_ad_service_202504) true)
+(expandtypeattribute (tv_iapp_service_202504) true)
+(expandtypeattribute (tv_input_service_202504) true)
+(expandtypeattribute (tv_tuner_resource_mgr_service_202504) true)
+(expandtypeattribute (ublk_block_device_202504) true)
+(expandtypeattribute (ublk_control_device_202504) true)
+(expandtypeattribute (ueventd_202504) true)
+(expandtypeattribute (ueventd_tmpfs_202504) true)
+(expandtypeattribute (uhid_device_202504) true)
+(expandtypeattribute (uimode_service_202504) true)
+(expandtypeattribute (uio_device_202504) true)
+(expandtypeattribute (uncrypt_202504) true)
+(expandtypeattribute (uncrypt_exec_202504) true)
+(expandtypeattribute (uncrypt_socket_202504) true)
+(expandtypeattribute (unencrypted_data_file_202504) true)
+(expandtypeattribute (unlabeled_202504) true)
+(expandtypeattribute (untrusted_app_202504) true)
+(expandtypeattribute (untrusted_app_25_202504) true)
+(expandtypeattribute (untrusted_app_27_202504) true)
+(expandtypeattribute (untrusted_app_29_202504) true)
+(expandtypeattribute (untrusted_app_30_202504) true)
+(expandtypeattribute (untrusted_app_32_202504) true)
+(expandtypeattribute (update_engine_202504) true)
+(expandtypeattribute (update_engine_data_file_202504) true)
+(expandtypeattribute (update_engine_exec_202504) true)
+(expandtypeattribute (update_engine_log_data_file_202504) true)
+(expandtypeattribute (update_engine_service_202504) true)
+(expandtypeattribute (update_engine_stable_service_202504) true)
+(expandtypeattribute (update_verifier_202504) true)
+(expandtypeattribute (update_verifier_exec_202504) true)
+(expandtypeattribute (updatelock_service_202504) true)
+(expandtypeattribute (uri_grants_service_202504) true)
+(expandtypeattribute (usagestats_service_202504) true)
+(expandtypeattribute (usb_config_prop_202504) true)
+(expandtypeattribute (usb_control_prop_202504) true)
+(expandtypeattribute (usb_device_202504) true)
+(expandtypeattribute (usb_prop_202504) true)
+(expandtypeattribute (usb_serial_device_202504) true)
+(expandtypeattribute (usb_service_202504) true)
+(expandtypeattribute (usb_uvc_enabled_prop_202504) true)
+(expandtypeattribute (usbaccessory_device_202504) true)
+(expandtypeattribute (usbd_202504) true)
+(expandtypeattribute (usbd_exec_202504) true)
+(expandtypeattribute (usbfs_202504) true)
+(expandtypeattribute (use_memfd_prop_202504) true)
+(expandtypeattribute (user_profile_data_file_202504) true)
+(expandtypeattribute (user_profile_root_file_202504) true)
+(expandtypeattribute (user_service_202504) true)
+(expandtypeattribute (userdata_block_device_202504) true)
+(expandtypeattribute (userdata_sysdev_202504) true)
+(expandtypeattribute (userdebug_or_eng_prop_202504) true)
+(expandtypeattribute (usermodehelper_202504) true)
+(expandtypeattribute (userspace_reboot_config_prop_202504) true)
+(expandtypeattribute (userspace_reboot_exported_prop_202504) true)
+(expandtypeattribute (userspace_reboot_metadata_file_202504) true)
+(expandtypeattribute (uwb_service_202504) true)
+(expandtypeattribute (vcn_management_service_202504) true)
+(expandtypeattribute (vd_device_202504) true)
+(expandtypeattribute (vdc_202504) true)
+(expandtypeattribute (vdc_exec_202504) true)
+(expandtypeattribute (vehicle_hal_prop_202504) true)
+(expandtypeattribute (vendor_apex_file_202504) true)
+(expandtypeattribute (vendor_apex_metadata_file_202504) true)
+(expandtypeattribute (vendor_app_file_202504) true)
+(expandtypeattribute (vendor_boot_ota_file_202504) true)
+(expandtypeattribute (vendor_cgroup_desc_file_202504) true)
+(expandtypeattribute (vendor_configs_file_202504) true)
+(expandtypeattribute (vendor_data_file_202504) true)
+(expandtypeattribute (vendor_default_prop_202504) true)
+(expandtypeattribute (vendor_file_202504) true)
+(expandtypeattribute (vendor_framework_file_202504) true)
+(expandtypeattribute (vendor_hal_file_202504) true)
+(expandtypeattribute (vendor_idc_file_202504) true)
+(expandtypeattribute (vendor_init_202504) true)
+(expandtypeattribute (vendor_kernel_modules_202504) true)
+(expandtypeattribute (vendor_keychars_file_202504) true)
+(expandtypeattribute (vendor_keylayout_file_202504) true)
+(expandtypeattribute (vendor_microdroid_file_202504) true)
+(expandtypeattribute (vendor_misc_writer_202504) true)
+(expandtypeattribute (vendor_misc_writer_exec_202504) true)
+(expandtypeattribute (vendor_modprobe_202504) true)
+(expandtypeattribute (vendor_overlay_file_202504) true)
+(expandtypeattribute (vendor_public_framework_file_202504) true)
+(expandtypeattribute (vendor_public_lib_file_202504) true)
+(expandtypeattribute (vendor_security_patch_level_prop_202504) true)
+(expandtypeattribute (vendor_service_contexts_file_202504) true)
+(expandtypeattribute (vendor_shell_202504) true)
+(expandtypeattribute (vendor_shell_exec_202504) true)
+(expandtypeattribute (vendor_socket_hook_prop_202504) true)
+(expandtypeattribute (vendor_task_profiles_file_202504) true)
+(expandtypeattribute (vendor_toolbox_exec_202504) true)
+(expandtypeattribute (vendor_userdir_file_202504) true)
+(expandtypeattribute (vendor_uuid_mapping_config_file_202504) true)
+(expandtypeattribute (vendor_vm_data_file_202504) true)
+(expandtypeattribute (vendor_vm_file_202504) true)
+(expandtypeattribute (vfat_202504) true)
+(expandtypeattribute (vfio_device_202504) true)
+(expandtypeattribute (vibrator_manager_service_202504) true)
+(expandtypeattribute (vibrator_service_202504) true)
+(expandtypeattribute (video_device_202504) true)
+(expandtypeattribute (virtual_ab_prop_202504) true)
+(expandtypeattribute (virtual_camera_202504) true)
+(expandtypeattribute (virtual_camera_exec_202504) true)
+(expandtypeattribute (virtual_camera_service_202504) true)
+(expandtypeattribute (virtual_device_native_service_202504) true)
+(expandtypeattribute (virtual_device_service_202504) true)
+(expandtypeattribute (virtual_face_hal_prop_202504) true)
+(expandtypeattribute (virtual_face_prop_202504) true)
+(expandtypeattribute (virtual_fingerprint_hal_prop_202504) true)
+(expandtypeattribute (virtual_fingerprint_prop_202504) true)
+(expandtypeattribute (virtual_touchpad_202504) true)
+(expandtypeattribute (virtual_touchpad_exec_202504) true)
+(expandtypeattribute (virtual_touchpad_service_202504) true)
+(expandtypeattribute (virtualization_service_202504) true)
+(expandtypeattribute (virtualizationmanager_202504) true)
+(expandtypeattribute (virtualizationmanager_exec_202504) true)
+(expandtypeattribute (vndbinder_device_202504) true)
+(expandtypeattribute (vndk_prop_202504) true)
+(expandtypeattribute (vndk_sp_file_202504) true)
+(expandtypeattribute (vndservice_contexts_file_202504) true)
+(expandtypeattribute (vndservicemanager_202504) true)
+(expandtypeattribute (voiceinteraction_service_202504) true)
+(expandtypeattribute (vold_202504) true)
+(expandtypeattribute (vold_config_prop_202504) true)
+(expandtypeattribute (vold_data_file_202504) true)
+(expandtypeattribute (vold_device_202504) true)
+(expandtypeattribute (vold_exec_202504) true)
+(expandtypeattribute (vold_metadata_file_202504) true)
+(expandtypeattribute (vold_post_fs_data_prop_202504) true)
+(expandtypeattribute (vold_prepare_subdirs_202504) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_202504) true)
+(expandtypeattribute (vold_prop_202504) true)
+(expandtypeattribute (vold_service_202504) true)
+(expandtypeattribute (vold_status_prop_202504) true)
+(expandtypeattribute (vpn_data_file_202504) true)
+(expandtypeattribute (vpn_management_service_202504) true)
+(expandtypeattribute (vr_hwc_service_202504) true)
+(expandtypeattribute (vr_manager_service_202504) true)
+(expandtypeattribute (vrflinger_vsync_service_202504) true)
+(expandtypeattribute (vts_config_prop_202504) true)
+(expandtypeattribute (vts_status_prop_202504) true)
+(expandtypeattribute (wallpaper_effects_generation_service_202504) true)
+(expandtypeattribute (wallpaper_file_202504) true)
+(expandtypeattribute (wallpaper_service_202504) true)
+(expandtypeattribute (watchdog_device_202504) true)
+(expandtypeattribute (watchdog_metadata_file_202504) true)
+(expandtypeattribute (watchdogd_202504) true)
+(expandtypeattribute (watchdogd_exec_202504) true)
+(expandtypeattribute (webview_zygote_202504) true)
+(expandtypeattribute (webview_zygote_exec_202504) true)
+(expandtypeattribute (webview_zygote_tmpfs_202504) true)
+(expandtypeattribute (webviewupdate_service_202504) true)
+(expandtypeattribute (wifi_config_prop_202504) true)
+(expandtypeattribute (wifi_data_file_202504) true)
+(expandtypeattribute (wifi_hal_prop_202504) true)
+(expandtypeattribute (wifi_key_202504) true)
+(expandtypeattribute (wifi_log_prop_202504) true)
+(expandtypeattribute (wifi_prop_202504) true)
+(expandtypeattribute (wifi_service_202504) true)
+(expandtypeattribute (wifi_usd_service_202504) true)
+(expandtypeattribute (wifiaware_service_202504) true)
+(expandtypeattribute (wificond_202504) true)
+(expandtypeattribute (wificond_exec_202504) true)
+(expandtypeattribute (wifinl80211_service_202504) true)
+(expandtypeattribute (wifip2p_service_202504) true)
+(expandtypeattribute (wifiscanner_service_202504) true)
+(expandtypeattribute (window_service_202504) true)
+(expandtypeattribute (wpa_socket_202504) true)
+(expandtypeattribute (zero_device_202504) true)
+(expandtypeattribute (zoned_block_device_202504) true)
+(expandtypeattribute (zram_config_prop_202504) true)
+(expandtypeattribute (zram_control_prop_202504) true)
+(expandtypeattribute (zygote_202504) true)
+(expandtypeattribute (zygote_config_prop_202504) true)
+(expandtypeattribute (zygote_exec_202504) true)
+(expandtypeattribute (zygote_socket_202504) true)
+(expandtypeattribute (zygote_tmpfs_202504) true)
+(typeattributeset DockObserver_service_202504 (DockObserver_service))
+(typeattributeset IProxyService_service_202504 (IProxyService_service))
+(typeattributeset aac_drc_prop_202504 (aac_drc_prop))
+(typeattributeset aaudio_config_prop_202504 (aaudio_config_prop))
+(typeattributeset ab_update_gki_prop_202504 (ab_update_gki_prop))
+(typeattributeset accessibility_service_202504 (accessibility_service))
+(typeattributeset account_service_202504 (account_service))
+(typeattributeset aconfig_storage_flags_metadata_file_202504 (aconfig_storage_flags_metadata_file))
+(typeattributeset aconfig_storage_metadata_file_202504 (aconfig_storage_metadata_file))
+(typeattributeset activity_service_202504 (activity_service))
+(typeattributeset activity_task_service_202504 (activity_task_service))
+(typeattributeset adaptive_haptics_prop_202504 (adaptive_haptics_prop))
+(typeattributeset adb_data_file_202504 (adb_data_file))
+(typeattributeset adb_keys_file_202504 (adb_keys_file))
+(typeattributeset adb_service_202504 (adb_service))
+(typeattributeset adbd_202504 (adbd))
+(typeattributeset adbd_config_prop_202504 (adbd_config_prop))
+(typeattributeset adbd_exec_202504 (adbd_exec))
+(typeattributeset adbd_socket_202504 (adbd_socket))
+(typeattributeset adservices_manager_service_202504 (adservices_manager_service))
+(typeattributeset aidl_lazy_test_server_202504 (aidl_lazy_test_server))
+(typeattributeset aidl_lazy_test_server_exec_202504 (aidl_lazy_test_server_exec))
+(typeattributeset aidl_lazy_test_service_202504 (aidl_lazy_test_service))
+(typeattributeset alarm_service_202504 (alarm_service))
+(typeattributeset anr_data_file_202504 (anr_data_file))
+(typeattributeset apc_service_202504 (apc_service))
+(typeattributeset apex_data_file_202504 (apex_data_file))
+(typeattributeset apex_info_file_202504 (apex_info_file))
+(typeattributeset apex_metadata_file_202504 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_202504 (apex_mnt_dir))
+(typeattributeset apex_module_data_file_202504 (apex_module_data_file))
+(typeattributeset apex_ota_reserved_file_202504 (apex_ota_reserved_file))
+(typeattributeset apex_ready_prop_202504 (apex_ready_prop))
+(typeattributeset apex_rollback_data_file_202504 (apex_rollback_data_file))
+(typeattributeset apex_service_202504 (apex_service))
+(typeattributeset apex_system_server_data_file_202504 (apex_system_server_data_file))
+(typeattributeset apexd_202504 (apexd))
+(typeattributeset apexd_config_prop_202504 (apexd_config_prop))
+(typeattributeset apexd_exec_202504 (apexd_exec))
+(typeattributeset apexd_prop_202504 (apexd_prop))
+(typeattributeset apexd_select_prop_202504 (apexd_select_prop))
+(typeattributeset apk_data_file_202504 (apk_data_file))
+(typeattributeset apk_private_data_file_202504 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_202504 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_202504 (apk_tmp_file))
+(typeattributeset apk_verity_prop_202504 (apk_verity_prop))
+(typeattributeset app_binding_service_202504 (app_binding_service))
+(typeattributeset app_data_file_202504 (app_data_file))
+(typeattributeset app_function_service_202504 (app_function_service))
+(typeattributeset app_fuse_file_202504 (app_fuse_file))
+(typeattributeset app_fusefs_202504 (app_fusefs))
+(typeattributeset app_hibernation_service_202504 (app_hibernation_service))
+(typeattributeset app_integrity_service_202504 (app_integrity_service))
+(typeattributeset app_prediction_service_202504 (app_prediction_service))
+(typeattributeset app_search_service_202504 (app_search_service))
+(typeattributeset app_zygote_202504 (app_zygote))
+(typeattributeset app_zygote_tmpfs_202504 (app_zygote_tmpfs))
+(typeattributeset appcompat_data_file_202504 (appcompat_data_file))
+(typeattributeset appdomain_tmpfs_202504 (appdomain_tmpfs))
+(typeattributeset appops_service_202504 (appops_service))
+(typeattributeset appwidget_service_202504 (appwidget_service))
+(typeattributeset archive_service_202504 (archive_service))
+(typeattributeset arm64_memtag_prop_202504 (arm64_memtag_prop))
+(typeattributeset art_apex_dir_202504 (art_apex_dir))
+(typeattributeset artd_202504 (artd))
+(typeattributeset artd_pre_reboot_service_202504 (artd_pre_reboot_service))
+(typeattributeset artd_service_202504 (artd_service))
+(typeattributeset asec_apk_file_202504 (asec_apk_file))
+(typeattributeset asec_image_file_202504 (asec_image_file))
+(typeattributeset asec_public_file_202504 (asec_public_file))
+(typeattributeset ashmem_device_202504 (ashmem_device))
+(typeattributeset ashmem_libcutils_device_202504 (ashmem_libcutils_device))
+(typeattributeset assetatlas_service_202504 (assetatlas_service))
+(typeattributeset atrace_202504 (atrace))
+(typeattributeset attestation_verification_service_202504 (attestation_verification_service))
+(typeattributeset audio_config_prop_202504 (audio_config_prop))
+(typeattributeset audio_data_file_202504 (audio_data_file))
+(typeattributeset audio_device_202504 (audio_device))
+(typeattributeset audio_prop_202504 (audio_prop))
+(typeattributeset audio_service_202504 (audio_service))
+(typeattributeset audiohal_data_file_202504 (audiohal_data_file))
+(typeattributeset audioserver_202504 (audioserver))
+(typeattributeset audioserver_data_file_202504 (audioserver_data_file))
+(typeattributeset audioserver_service_202504 (audioserver_service))
+(typeattributeset audioserver_tmpfs_202504 (audioserver_tmpfs))
+(typeattributeset auth_service_202504 (auth_service))
+(typeattributeset authorization_service_202504 (authorization_service))
+(typeattributeset autofill_service_202504 (autofill_service))
+(typeattributeset backup_data_file_202504 (backup_data_file))
+(typeattributeset backup_service_202504 (backup_service))
+(typeattributeset battery_service_202504 (battery_service))
+(typeattributeset batteryproperties_service_202504 (batteryproperties_service))
+(typeattributeset batterystats_service_202504 (batterystats_service))
+(typeattributeset binder_cache_bluetooth_server_prop_202504 (binder_cache_bluetooth_server_prop))
+(typeattributeset binder_cache_system_server_prop_202504 (binder_cache_system_server_prop))
+(typeattributeset binder_cache_telephony_server_prop_202504 (binder_cache_telephony_server_prop))
+(typeattributeset binder_calls_stats_service_202504 (binder_calls_stats_service))
+(typeattributeset binder_device_202504 (binder_device))
+(typeattributeset binderfs_202504 (binderfs))
+(typeattributeset binderfs_features_202504 (binderfs_features))
+(typeattributeset binderfs_logs_202504 (binderfs_logs))
+(typeattributeset binderfs_logs_proc_202504 (binderfs_logs_proc))
+(typeattributeset binderfs_logs_stats_202504 (binderfs_logs_stats))
+(typeattributeset binderfs_logs_transaction_history_202504 (binderfs_logs_transaction_history))
+(typeattributeset binderfs_logs_transactions_202504 (binderfs_logs_transactions))
+(typeattributeset binfmt_miscfs_202504 (binfmt_miscfs))
+(typeattributeset biometric_service_202504 (biometric_service))
+(typeattributeset blkid_202504 (blkid))
+(typeattributeset blkid_untrusted_202504 (blkid_untrusted))
+(typeattributeset blob_store_service_202504 (blob_store_service))
+(typeattributeset block_device_202504 (block_device))
+(typeattributeset bluetooth_202504 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_202504 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_202504 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_config_prop_202504 (bluetooth_config_prop))
+(typeattributeset bluetooth_data_file_202504 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_202504 (bluetooth_efs_file))
+(typeattributeset bluetooth_finder_prop_202504 (bluetooth_finder_prop))
+(typeattributeset bluetooth_logs_data_file_202504 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_202504 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_202504 (bluetooth_prop))
+(typeattributeset bluetooth_service_202504 (bluetooth_service))
+(typeattributeset bluetooth_socket_202504 (bluetooth_socket))
+(typeattributeset boot_block_device_202504 (boot_block_device))
+(typeattributeset boot_status_prop_202504 (boot_status_prop))
+(typeattributeset bootanim_202504 (bootanim))
+(typeattributeset bootanim_config_prop_202504 (bootanim_config_prop))
+(typeattributeset bootanim_exec_202504 (bootanim_exec))
+(typeattributeset bootanim_oem_file_202504 (bootanim_oem_file))
+(typeattributeset bootanim_system_prop_202504 (bootanim_system_prop))
+(typeattributeset bootchart_data_file_202504 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_202504 (bootloader_boot_reason_prop))
+(typeattributeset bootloader_prop_202504 (bootloader_prop))
+(typeattributeset bootstat_202504 (bootstat))
+(typeattributeset bootstat_data_file_202504 (bootstat_data_file))
+(typeattributeset bootstat_exec_202504 (bootstat_exec))
+(typeattributeset boottime_prop_202504 (boottime_prop))
+(typeattributeset boottime_public_prop_202504 (boottime_public_prop))
+(typeattributeset boottrace_data_file_202504 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_202504 (bpf_progs_loaded_prop))
+(typeattributeset bpfloader_202504 (bpfloader))
+(typeattributeset bq_config_prop_202504 (bq_config_prop))
+(typeattributeset broadcastradio_service_202504 (broadcastradio_service))
+(typeattributeset bt_device_202504 (bt_device))
+(typeattributeset bufferhubd_202504 (bufferhubd))
+(typeattributeset bufferhubd_exec_202504 (bufferhubd_exec))
+(typeattributeset bugreport_service_202504 (bugreport_service))
+(typeattributeset build_attestation_prop_202504 (build_attestation_prop))
+(typeattributeset build_bootimage_prop_202504 (build_bootimage_prop))
+(typeattributeset build_config_prop_202504 (build_config_prop))
+(typeattributeset build_odm_prop_202504 (build_odm_prop))
+(typeattributeset build_prop_202504 (build_prop))
+(typeattributeset build_vendor_prop_202504 (build_vendor_prop))
+(typeattributeset cache_backup_file_202504 (cache_backup_file))
+(typeattributeset cache_block_device_202504 (cache_block_device))
+(typeattributeset cache_file_202504 (cache_file))
+(typeattributeset cache_private_backup_file_202504 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_202504 (cache_recovery_file))
+(typeattributeset cacheinfo_service_202504 (cacheinfo_service))
+(typeattributeset camera2_extensions_prop_202504 (camera2_extensions_prop))
+(typeattributeset camera_calibration_prop_202504 (camera_calibration_prop))
+(typeattributeset camera_config_prop_202504 (camera_config_prop))
+(typeattributeset camera_data_file_202504 (camera_data_file))
+(typeattributeset camera_device_202504 (camera_device))
+(typeattributeset cameraproxy_service_202504 (cameraproxy_service))
+(typeattributeset cameraserver_202504 (cameraserver))
+(typeattributeset cameraserver_exec_202504 (cameraserver_exec))
+(typeattributeset cameraserver_service_202504 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_202504 (cameraserver_tmpfs))
+(typeattributeset camerax_extensions_prop_202504 (camerax_extensions_prop))
+(typeattributeset cgroup_202504 (cgroup))
+(typeattributeset cgroup_desc_file_202504 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_202504 (cgroup_rc_file))
+(typeattributeset cgroup_v2_202504 (cgroup_v2))
+(typeattributeset charger_202504 (charger))
+(typeattributeset charger_config_prop_202504 (charger_config_prop))
+(typeattributeset charger_exec_202504 (charger_exec))
+(typeattributeset charger_prop_202504 (charger_prop))
+(typeattributeset charger_status_prop_202504 (charger_status_prop))
+(typeattributeset charger_vendor_202504 (charger_vendor))
+(typeattributeset clipboard_service_202504 (clipboard_service))
+(typeattributeset cloudsearch_service_202504 (cloudsearch_service))
+(typeattributeset codec2_config_prop_202504 (codec2_config_prop))
+(typeattributeset cold_boot_done_prop_202504 (cold_boot_done_prop))
+(typeattributeset color_display_service_202504 (color_display_service))
+(typeattributeset companion_device_service_202504 (companion_device_service))
+(typeattributeset composd_vm_art_prop_202504 (composd_vm_art_prop))
+(typeattributeset composd_vm_vendor_prop_202504 (composd_vm_vendor_prop))
+(typeattributeset config_prop_202504 (config_prop))
+(typeattributeset configfs_202504 (configfs))
+(typeattributeset connectivity_native_service_202504 (connectivity_native_service))
+(typeattributeset connectivity_service_202504 (connectivity_service))
+(typeattributeset connmetrics_service_202504 (connmetrics_service))
+(typeattributeset console_device_202504 (console_device))
+(typeattributeset consumer_ir_service_202504 (consumer_ir_service))
+(typeattributeset content_capture_service_202504 (content_capture_service))
+(typeattributeset content_service_202504 (content_service))
+(typeattributeset content_suggestions_service_202504 (content_suggestions_service))
+(typeattributeset contexthub_service_202504 (contexthub_service))
+(typeattributeset contextual_search_service_202504 (contextual_search_service))
+(typeattributeset coredump_file_202504 (coredump_file))
+(typeattributeset country_detector_service_202504 (country_detector_service))
+(typeattributeset coverage_service_202504 (coverage_service))
+(typeattributeset cppreopt_prop_202504 (cppreopt_prop))
+(typeattributeset cpu_monitor_service_202504 (cpu_monitor_service))
+(typeattributeset cpu_variant_prop_202504 (cpu_variant_prop))
+(typeattributeset cpuinfo_service_202504 (cpuinfo_service))
+(typeattributeset crash_dump_202504 (crash_dump))
+(typeattributeset crash_dump_exec_202504 (crash_dump_exec))
+(typeattributeset credential_service_202504 (credential_service))
+(typeattributeset credstore_202504 (credstore))
+(typeattributeset credstore_data_file_202504 (credstore_data_file))
+(typeattributeset credstore_exec_202504 (credstore_exec))
+(typeattributeset credstore_service_202504 (credstore_service))
+(typeattributeset crossprofileapps_service_202504 (crossprofileapps_service))
+(typeattributeset crosvm_202504 (crosvm))
+(typeattributeset ctl_adbd_prop_202504 (ctl_adbd_prop))
+(typeattributeset ctl_apexd_prop_202504 (ctl_apexd_prop))
+(typeattributeset ctl_bootanim_prop_202504 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_202504 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_202504 (ctl_console_prop))
+(typeattributeset ctl_default_prop_202504 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_202504 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_202504 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_202504 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_202504 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_202504 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_202504 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_202504 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_202504 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_202504 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_202504 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_202504 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_202504 (ctl_stop_prop))
+(typeattributeset dalvik_config_prop_202504 (dalvik_config_prop))
+(typeattributeset dalvik_dynamic_config_prop_202504 (dalvik_dynamic_config_prop))
+(typeattributeset dalvik_prop_202504 (dalvik_prop))
+(typeattributeset dalvik_runtime_prop_202504 (dalvik_runtime_prop))
+(typeattributeset dalvikcache_data_file_202504 (dalvikcache_data_file))
+(typeattributeset dataloader_manager_service_202504 (dataloader_manager_service))
+(typeattributeset dbinfo_service_202504 (dbinfo_service))
+(typeattributeset dck_prop_202504 (dck_prop))
+(typeattributeset debug_prop_202504 (debug_prop))
+(typeattributeset debugfs_202504 (debugfs))
+(typeattributeset debugfs_bootreceiver_tracing_202504 (debugfs_bootreceiver_tracing))
+(typeattributeset debugfs_kprobes_202504 (debugfs_kprobes))
+(typeattributeset debugfs_mm_events_tracing_202504 (debugfs_mm_events_tracing))
+(typeattributeset debugfs_mmc_202504 (debugfs_mmc))
+(typeattributeset debugfs_restriction_prop_202504 (debugfs_restriction_prop))
+(typeattributeset debugfs_trace_marker_202504 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_202504 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_202504 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_202504 (debugfs_tracing_instances))
+(typeattributeset debugfs_tracing_printk_formats_202504 (debugfs_tracing_printk_formats))
+(typeattributeset debugfs_wakeup_sources_202504 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_202504 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_202504 (debuggerd_prop))
+(typeattributeset default_android_hwservice_202504 (default_android_hwservice))
+(typeattributeset default_android_service_202504 (default_android_service))
+(typeattributeset default_android_vndservice_202504 (default_android_vndservice))
+(typeattributeset default_prop_202504 (default_prop))
+(typeattributeset dev_cpu_variant_202504 (dev_cpu_variant))
+(typeattributeset device_202504 (device))
+(typeattributeset device_config_aconfig_flags_prop_202504 (device_config_aconfig_flags_prop))
+(typeattributeset device_config_activity_manager_native_boot_prop_202504 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_202504 (device_config_boot_count_prop))
+(typeattributeset device_config_camera_native_prop_202504 (device_config_camera_native_prop))
+(typeattributeset device_config_edgetpu_native_prop_202504 (device_config_edgetpu_native_prop))
+(typeattributeset device_config_input_native_boot_prop_202504 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_202504 (device_config_media_native_prop))
+(typeattributeset device_config_memory_safety_native_boot_prop_202504 (device_config_memory_safety_native_boot_prop))
+(typeattributeset device_config_memory_safety_native_prop_202504 (device_config_memory_safety_native_prop))
+(typeattributeset device_config_netd_native_prop_202504 (device_config_netd_native_prop))
+(typeattributeset device_config_nnapi_native_prop_202504 (device_config_nnapi_native_prop))
+(typeattributeset device_config_reset_performed_prop_202504 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_202504 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_202504 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_202504 (device_config_service))
+(typeattributeset device_config_surface_flinger_native_boot_prop_202504 (device_config_surface_flinger_native_boot_prop))
+(typeattributeset device_config_updatable_service_202504 (device_config_updatable_service))
+(typeattributeset device_config_vendor_system_native_boot_prop_202504 (device_config_vendor_system_native_boot_prop))
+(typeattributeset device_config_vendor_system_native_prop_202504 (device_config_vendor_system_native_prop))
+(typeattributeset device_identifiers_service_202504 (device_identifiers_service))
+(typeattributeset device_logging_prop_202504 (device_logging_prop))
+(typeattributeset device_policy_service_202504 (device_policy_service))
+(typeattributeset device_state_service_202504 (device_state_service))
+(typeattributeset deviceidle_service_202504 (deviceidle_service))
+(typeattributeset devicelock_service_202504 (devicelock_service))
+(typeattributeset devicestoragemonitor_service_202504 (devicestoragemonitor_service))
+(typeattributeset devpts_202504 (devpts))
+(typeattributeset dexopt_chroot_setup_service_202504 (dexopt_chroot_setup_service))
+(typeattributeset dhcp_202504 (dhcp))
+(typeattributeset dhcp_data_file_202504 (dhcp_data_file))
+(typeattributeset dhcp_exec_202504 (dhcp_exec))
+(typeattributeset dhcp_prop_202504 (dhcp_prop))
+(typeattributeset diskstats_service_202504 (diskstats_service))
+(typeattributeset display_service_202504 (display_service))
+(typeattributeset dm_device_202504 (dm_device))
+(typeattributeset dm_user_device_202504 (dm_user_device))
+(typeattributeset dmabuf_heap_device_202504 (dmabuf_heap_device))
+(typeattributeset dmabuf_system_heap_device_202504 (dmabuf_system_heap_device))
+(typeattributeset dmabuf_system_secure_heap_device_202504 (dmabuf_system_secure_heap_device))
+(typeattributeset dnsmasq_202504 (dnsmasq))
+(typeattributeset dnsmasq_exec_202504 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_202504 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_202504 (dnsresolver_service))
+(typeattributeset domain_verification_service_202504 (domain_verification_service))
+(typeattributeset dreams_service_202504 (dreams_service))
+(typeattributeset drm_data_file_202504 (drm_data_file))
+(typeattributeset drm_forcel3_prop_202504 (drm_forcel3_prop))
+(typeattributeset drm_service_config_prop_202504 (drm_service_config_prop))
+(typeattributeset drmserver_202504 (drmserver))
+(typeattributeset drmserver_exec_202504 (drmserver_exec))
+(typeattributeset drmserver_service_202504 (drmserver_service))
+(typeattributeset drmserver_socket_202504 (drmserver_socket))
+(typeattributeset dropbox_data_file_202504 (dropbox_data_file))
+(typeattributeset dropbox_service_202504 (dropbox_service))
+(typeattributeset dtbo_block_device_202504 (dtbo_block_device))
+(typeattributeset dumpstate_202504 (dumpstate))
+(typeattributeset dumpstate_exec_202504 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_202504 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_202504 (dumpstate_prop))
+(typeattributeset dumpstate_service_202504 (dumpstate_service))
+(typeattributeset dumpstate_socket_202504 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_202504 (dynamic_system_prop))
+(typeattributeset e2fs_202504 (e2fs))
+(typeattributeset e2fs_exec_202504 (e2fs_exec))
+(typeattributeset early_virtmgr_202504 (early_virtmgr))
+(typeattributeset early_virtmgr_exec_202504 (early_virtmgr_exec))
+(typeattributeset ecm_enhanced_confirmation_service_202504 (ecm_enhanced_confirmation_service))
+(typeattributeset efs_file_202504 (efs_file))
+(typeattributeset emergency_affordance_service_202504 (emergency_affordance_service))
+(typeattributeset enable_16k_pages_prop_202504 (enable_16k_pages_prop))
+(typeattributeset ephemeral_app_202504 (ephemeral_app))
+(typeattributeset ethernet_service_202504 (ethernet_service))
+(typeattributeset evsmanagerd_202504 (evsmanagerd))
+(typeattributeset evsmanagerd_service_202504 (evsmanagerd_service))
+(typeattributeset exfat_202504 (exfat))
+(typeattributeset exported3_system_prop_202504 (exported3_system_prop))
+(typeattributeset exported_bluetooth_prop_202504 (exported_bluetooth_prop))
+(typeattributeset exported_camera_prop_202504 (exported_camera_prop))
+(typeattributeset exported_config_prop_202504 (exported_config_prop))
+(typeattributeset exported_default_prop_202504 (exported_default_prop))
+(typeattributeset exported_dumpstate_prop_202504 (exported_dumpstate_prop))
+(typeattributeset exported_overlay_prop_202504 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_202504 (exported_pm_prop))
+(typeattributeset exported_secure_prop_202504 (exported_secure_prop))
+(typeattributeset exported_system_prop_202504 (exported_system_prop))
+(typeattributeset external_vibrator_service_202504 (external_vibrator_service))
+(typeattributeset extra_free_kbytes_202504 (extra_free_kbytes))
+(typeattributeset extra_free_kbytes_exec_202504 (extra_free_kbytes_exec))
+(typeattributeset face_service_202504 (face_service))
+(typeattributeset face_vendor_data_file_202504 (face_vendor_data_file))
+(typeattributeset fastbootd_202504 (fastbootd))
+(typeattributeset ffs_config_prop_202504 (ffs_config_prop))
+(typeattributeset ffs_control_prop_202504 (ffs_control_prop))
+(typeattributeset file_contexts_file_202504 (file_contexts_file))
+(typeattributeset file_integrity_service_202504 (file_integrity_service))
+(typeattributeset fingerprint_prop_202504 (fingerprint_prop))
+(typeattributeset fingerprint_service_202504 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_202504 (fingerprint_vendor_data_file))
+(typeattributeset fingerprintd_202504 (fingerprintd))
+(typeattributeset fingerprintd_data_file_202504 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_202504 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_202504 (fingerprintd_service))
+(typeattributeset firstboot_prop_202504 (firstboot_prop))
+(typeattributeset flags_health_check_202504 (flags_health_check))
+(typeattributeset flags_health_check_exec_202504 (flags_health_check_exec))
+(typeattributeset font_service_202504 (font_service))
+(typeattributeset framework_status_prop_202504 (framework_status_prop))
+(typeattributeset framework_watchdog_config_prop_202504 (framework_watchdog_config_prop))
+(typeattributeset frp_block_device_202504 (frp_block_device))
+(typeattributeset fs_bpf_202504 (fs_bpf))
+(typeattributeset fs_bpf_tethering_202504 (fs_bpf_tethering))
+(typeattributeset fs_bpf_vendor_202504 (fs_bpf_vendor))
+(typeattributeset fsck_202504 (fsck))
+(typeattributeset fsck_exec_202504 (fsck_exec))
+(typeattributeset fsck_untrusted_202504 (fsck_untrusted))
+(typeattributeset fscklogs_202504 (fscklogs))
+(typeattributeset functionfs_202504 (functionfs))
+(typeattributeset fuse_202504 (fuse))
+(typeattributeset fuse_device_202504 (fuse_device))
+(typeattributeset fuseblk_202504 (fuseblk))
+(typeattributeset fusectlfs_202504 (fusectlfs))
+(typeattributeset future_pm_prop_202504 (future_pm_prop))
+(typeattributeset fwk_altitude_service_202504 (fwk_altitude_service))
+(typeattributeset fwk_automotive_display_hwservice_202504 (fwk_automotive_display_hwservice))
+(typeattributeset fwk_automotive_display_service_202504 (fwk_automotive_display_service))
+(typeattributeset fwk_bufferhub_hwservice_202504 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_202504 (fwk_camera_hwservice))
+(typeattributeset fwk_camera_service_202504 (fwk_camera_service))
+(typeattributeset fwk_display_hwservice_202504 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_202504 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_202504 (fwk_sensor_hwservice))
+(typeattributeset fwk_sensor_service_202504 (fwk_sensor_service))
+(typeattributeset fwk_stats_hwservice_202504 (fwk_stats_hwservice))
+(typeattributeset fwk_stats_service_202504 (fwk_stats_service))
+(typeattributeset fwk_vibrator_control_service_202504 (fwk_vibrator_control_service))
+(typeattributeset fwmarkd_socket_202504 (fwmarkd_socket))
+(typeattributeset game_mode_intervention_list_file_202504 (game_mode_intervention_list_file))
+(typeattributeset game_service_202504 (game_service))
+(typeattributeset gatekeeper_data_file_202504 (gatekeeper_data_file))
+(typeattributeset gatekeeper_service_202504 (gatekeeper_service))
+(typeattributeset gatekeeperd_202504 (gatekeeperd))
+(typeattributeset gatekeeperd_exec_202504 (gatekeeperd_exec))
+(typeattributeset gesture_prop_202504 (gesture_prop))
+(typeattributeset gfxinfo_service_202504 (gfxinfo_service))
+(typeattributeset gmscore_app_202504 (gmscore_app))
+(typeattributeset gnss_device_202504 (gnss_device))
+(typeattributeset gnss_time_update_service_202504 (gnss_time_update_service))
+(typeattributeset gps_control_202504 (gps_control))
+(typeattributeset gpu_device_202504 (gpu_device))
+(typeattributeset gpu_service_202504 (gpu_service))
+(typeattributeset gpuservice_202504 (gpuservice))
+(typeattributeset grammatical_inflection_service_202504 (grammatical_inflection_service))
+(typeattributeset graphics_config_prop_202504 (graphics_config_prop))
+(typeattributeset graphics_config_writable_prop_202504 (graphics_config_writable_prop))
+(typeattributeset graphics_device_202504 (graphics_device))
+(typeattributeset graphicsstats_service_202504 (graphicsstats_service))
+(typeattributeset gsi_data_file_202504 (gsi_data_file))
+(typeattributeset gsi_metadata_file_202504 (gsi_metadata_file))
+(typeattributeset gsi_public_metadata_file_202504 (gsi_public_metadata_file))
+(typeattributeset gwp_asan_prop_202504 (gwp_asan_prop))
+(typeattributeset hal_atrace_hwservice_202504 (hal_atrace_hwservice))
+(typeattributeset hal_audio_hwservice_202504 (hal_audio_hwservice))
+(typeattributeset hal_audio_service_202504 (hal_audio_service))
+(typeattributeset hal_audiocontrol_hwservice_202504 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audiocontrol_service_202504 (hal_audiocontrol_service))
+(typeattributeset hal_authgraph_service_202504 (hal_authgraph_service))
+(typeattributeset hal_authsecret_hwservice_202504 (hal_authsecret_hwservice))
+(typeattributeset hal_authsecret_service_202504 (hal_authsecret_service))
+(typeattributeset hal_bluetooth_hwservice_202504 (hal_bluetooth_hwservice))
+(typeattributeset hal_bluetooth_service_202504 (hal_bluetooth_service))
+(typeattributeset hal_bootctl_hwservice_202504 (hal_bootctl_hwservice))
+(typeattributeset hal_bootctl_service_202504 (hal_bootctl_service))
+(typeattributeset hal_broadcastradio_hwservice_202504 (hal_broadcastradio_hwservice))
+(typeattributeset hal_broadcastradio_service_202504 (hal_broadcastradio_service))
+(typeattributeset hal_camera_hwservice_202504 (hal_camera_hwservice))
+(typeattributeset hal_camera_service_202504 (hal_camera_service))
+(typeattributeset hal_can_bus_hwservice_202504 (hal_can_bus_hwservice))
+(typeattributeset hal_can_controller_hwservice_202504 (hal_can_controller_hwservice))
+(typeattributeset hal_can_controller_service_202504 (hal_can_controller_service))
+(typeattributeset hal_cas_hwservice_202504 (hal_cas_hwservice))
+(typeattributeset hal_cas_service_202504 (hal_cas_service))
+(typeattributeset hal_codec2_hwservice_202504 (hal_codec2_hwservice))
+(typeattributeset hal_codec2_service_202504 (hal_codec2_service))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_202504 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_202504 (hal_confirmationui_hwservice))
+(typeattributeset hal_confirmationui_service_202504 (hal_confirmationui_service))
+(typeattributeset hal_contexthub_hwservice_202504 (hal_contexthub_hwservice))
+(typeattributeset hal_contexthub_service_202504 (hal_contexthub_service))
+(typeattributeset hal_drm_hwservice_202504 (hal_drm_hwservice))
+(typeattributeset hal_drm_service_202504 (hal_drm_service))
+(typeattributeset hal_dumpstate_config_prop_202504 (hal_dumpstate_config_prop))
+(typeattributeset hal_dumpstate_hwservice_202504 (hal_dumpstate_hwservice))
+(typeattributeset hal_dumpstate_service_202504 (hal_dumpstate_service))
+(typeattributeset hal_evs_hwservice_202504 (hal_evs_hwservice))
+(typeattributeset hal_evs_service_202504 (hal_evs_service))
+(typeattributeset hal_face_hwservice_202504 (hal_face_hwservice))
+(typeattributeset hal_face_service_202504 (hal_face_service))
+(typeattributeset hal_fastboot_service_202504 (hal_fastboot_service))
+(typeattributeset hal_fingerprint_hwservice_202504 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_202504 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_202504 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gatekeeper_service_202504 (hal_gatekeeper_service))
+(typeattributeset hal_gnss_hwservice_202504 (hal_gnss_hwservice))
+(typeattributeset hal_gnss_service_202504 (hal_gnss_service))
+(typeattributeset hal_graphics_allocator_hwservice_202504 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_allocator_service_202504 (hal_graphics_allocator_service))
+(typeattributeset hal_graphics_composer_hwservice_202504 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_202504 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_composer_service_202504 (hal_graphics_composer_service))
+(typeattributeset hal_graphics_mapper_hwservice_202504 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_graphics_mapper_service_202504 (hal_graphics_mapper_service))
+(typeattributeset hal_health_hwservice_202504 (hal_health_hwservice))
+(typeattributeset hal_health_service_202504 (hal_health_service))
+(typeattributeset hal_health_storage_hwservice_202504 (hal_health_storage_hwservice))
+(typeattributeset hal_health_storage_service_202504 (hal_health_storage_service))
+(typeattributeset hal_identity_service_202504 (hal_identity_service))
+(typeattributeset hal_input_classifier_hwservice_202504 (hal_input_classifier_hwservice))
+(typeattributeset hal_input_processor_service_202504 (hal_input_processor_service))
+(typeattributeset hal_instrumentation_prop_202504 (hal_instrumentation_prop))
+(typeattributeset hal_ir_hwservice_202504 (hal_ir_hwservice))
+(typeattributeset hal_ir_service_202504 (hal_ir_service))
+(typeattributeset hal_ivn_service_202504 (hal_ivn_service))
+(typeattributeset hal_keymaster_hwservice_202504 (hal_keymaster_hwservice))
+(typeattributeset hal_keymint_service_202504 (hal_keymint_service))
+(typeattributeset hal_light_hwservice_202504 (hal_light_hwservice))
+(typeattributeset hal_light_service_202504 (hal_light_service))
+(typeattributeset hal_lowpan_hwservice_202504 (hal_lowpan_hwservice))
+(typeattributeset hal_macsec_service_202504 (hal_macsec_service))
+(typeattributeset hal_mediaquality_service_202504 (hal_mediaquality_service))
+(typeattributeset hal_memtrack_hwservice_202504 (hal_memtrack_hwservice))
+(typeattributeset hal_memtrack_service_202504 (hal_memtrack_service))
+(typeattributeset hal_neuralnetworks_hwservice_202504 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_neuralnetworks_service_202504 (hal_neuralnetworks_service))
+(typeattributeset hal_nfc_hwservice_202504 (hal_nfc_hwservice))
+(typeattributeset hal_nfc_service_202504 (hal_nfc_service))
+(typeattributeset hal_nlinterceptor_service_202504 (hal_nlinterceptor_service))
+(typeattributeset hal_oemlock_hwservice_202504 (hal_oemlock_hwservice))
+(typeattributeset hal_oemlock_service_202504 (hal_oemlock_service))
+(typeattributeset hal_omx_hwservice_202504 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_202504 (hal_power_hwservice))
+(typeattributeset hal_power_service_202504 (hal_power_service))
+(typeattributeset hal_power_stats_hwservice_202504 (hal_power_stats_hwservice))
+(typeattributeset hal_power_stats_service_202504 (hal_power_stats_service))
+(typeattributeset hal_radio_service_202504 (hal_radio_service))
+(typeattributeset hal_rebootescrow_service_202504 (hal_rebootescrow_service))
+(typeattributeset hal_remoteaccess_service_202504 (hal_remoteaccess_service))
+(typeattributeset hal_remotelyprovisionedcomponent_avf_service_202504 (hal_remotelyprovisionedcomponent_avf_service))
+(typeattributeset hal_remotelyprovisionedcomponent_service_202504 (hal_remotelyprovisionedcomponent_service))
+(typeattributeset hal_renderscript_hwservice_202504 (hal_renderscript_hwservice))
+(typeattributeset hal_secretkeeper_service_202504 (hal_secretkeeper_service))
+(typeattributeset hal_secure_element_hwservice_202504 (hal_secure_element_hwservice))
+(typeattributeset hal_secure_element_service_202504 (hal_secure_element_service))
+(typeattributeset hal_secureclock_service_202504 (hal_secureclock_service))
+(typeattributeset hal_sensors_hwservice_202504 (hal_sensors_hwservice))
+(typeattributeset hal_sensors_service_202504 (hal_sensors_service))
+(typeattributeset hal_sharedsecret_service_202504 (hal_sharedsecret_service))
+(typeattributeset hal_system_suspend_service_202504 (hal_system_suspend_service))
+(typeattributeset hal_telephony_hwservice_202504 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_202504 (hal_tetheroffload_hwservice))
+(typeattributeset hal_tetheroffload_service_202504 (hal_tetheroffload_service))
+(typeattributeset hal_thermal_hwservice_202504 (hal_thermal_hwservice))
+(typeattributeset hal_thermal_service_202504 (hal_thermal_service))
+(typeattributeset hal_threadnetwork_service_202504 (hal_threadnetwork_service))
+(typeattributeset hal_tv_cec_hwservice_202504 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_hdmi_cec_service_202504 (hal_tv_hdmi_cec_service))
+(typeattributeset hal_tv_hdmi_connection_service_202504 (hal_tv_hdmi_connection_service))
+(typeattributeset hal_tv_hdmi_earc_service_202504 (hal_tv_hdmi_earc_service))
+(typeattributeset hal_tv_input_hwservice_202504 (hal_tv_input_hwservice))
+(typeattributeset hal_tv_input_service_202504 (hal_tv_input_service))
+(typeattributeset hal_tv_tuner_hwservice_202504 (hal_tv_tuner_hwservice))
+(typeattributeset hal_tv_tuner_service_202504 (hal_tv_tuner_service))
+(typeattributeset hal_usb_gadget_hwservice_202504 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_gadget_service_202504 (hal_usb_gadget_service))
+(typeattributeset hal_usb_hwservice_202504 (hal_usb_hwservice))
+(typeattributeset hal_usb_service_202504 (hal_usb_service))
+(typeattributeset hal_uwb_service_202504 (hal_uwb_service))
+(typeattributeset hal_vehicle_hwservice_202504 (hal_vehicle_hwservice))
+(typeattributeset hal_vehicle_service_202504 (hal_vehicle_service))
+(typeattributeset hal_vibrator_hwservice_202504 (hal_vibrator_hwservice))
+(typeattributeset hal_vibrator_service_202504 (hal_vibrator_service))
+(typeattributeset hal_vm_capabilities_service_202504 (hal_vm_capabilities_service))
+(typeattributeset hal_vr_hwservice_202504 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_202504 (hal_weaver_hwservice))
+(typeattributeset hal_weaver_service_202504 (hal_weaver_service))
+(typeattributeset hal_wifi_hostapd_hwservice_202504 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hostapd_service_202504 (hal_wifi_hostapd_service))
+(typeattributeset hal_wifi_hwservice_202504 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_service_202504 (hal_wifi_service))
+(typeattributeset hal_wifi_supplicant_hwservice_202504 (hal_wifi_supplicant_hwservice))
+(typeattributeset hal_wifi_supplicant_service_202504 (hal_wifi_supplicant_service))
+(typeattributeset hardware_properties_service_202504 (hardware_properties_service))
+(typeattributeset hardware_service_202504 (hardware_service))
+(typeattributeset hci_attach_dev_202504 (hci_attach_dev))
+(typeattributeset hdmi_config_prop_202504 (hdmi_config_prop))
+(typeattributeset hdmi_control_service_202504 (hdmi_control_service))
+(typeattributeset healthconnect_service_202504 (healthconnect_service))
+(typeattributeset healthd_202504 (healthd))
+(typeattributeset heapdump_data_file_202504 (heapdump_data_file))
+(typeattributeset heapprofd_202504 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_202504 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_202504 (heapprofd_prop))
+(typeattributeset heapprofd_socket_202504 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_202504 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_202504 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_202504 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_202504 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_202504 (hidl_token_hwservice))
+(typeattributeset hidraw_device_202504 (hidraw_device))
+(typeattributeset hint_service_202504 (hint_service))
+(typeattributeset hw_random_device_202504 (hw_random_device))
+(typeattributeset hw_timeout_multiplier_prop_202504 (hw_timeout_multiplier_prop))
+(typeattributeset hwbinder_device_202504 (hwbinder_device))
+(typeattributeset hwservice_contexts_file_202504 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_202504 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_202504 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_202504 (hwservicemanager_prop))
+(typeattributeset hypervisor_prop_202504 (hypervisor_prop))
+(typeattributeset hypervisor_restricted_prop_202504 (hypervisor_restricted_prop))
+(typeattributeset icon_file_202504 (icon_file))
+(typeattributeset idmap_202504 (idmap))
+(typeattributeset idmap_exec_202504 (idmap_exec))
+(typeattributeset idmap_service_202504 (idmap_service))
+(typeattributeset iio_device_202504 (iio_device))
+(typeattributeset imms_service_202504 (imms_service))
+(typeattributeset incident_202504 (incident))
+(typeattributeset incident_data_file_202504 (incident_data_file))
+(typeattributeset incident_helper_202504 (incident_helper))
+(typeattributeset incident_service_202504 (incident_service))
+(typeattributeset incidentd_202504 (incidentd))
+(typeattributeset incremental_control_file_202504 (incremental_control_file))
+(typeattributeset incremental_prop_202504 (incremental_prop))
+(typeattributeset incremental_service_202504 (incremental_service))
+(typeattributeset init_202504 (init))
+(typeattributeset init_exec_202504 (init_exec))
+(typeattributeset init_service_status_prop_202504 (init_service_status_prop))
+(typeattributeset init_tmpfs_202504 (init_tmpfs))
+(typeattributeset inotify_202504 (inotify))
+(typeattributeset input_device_202504 (input_device))
+(typeattributeset input_device_config_prop_202504 (input_device_config_prop))
+(typeattributeset input_method_service_202504 (input_method_service))
+(typeattributeset input_service_202504 (input_service))
+(typeattributeset inputflinger_202504 (inputflinger))
+(typeattributeset inputflinger_exec_202504 (inputflinger_exec))
+(typeattributeset inputflinger_service_202504 (inputflinger_service))
+(typeattributeset install_data_file_202504 (install_data_file))
+(typeattributeset installd_202504 (installd))
+(typeattributeset installd_exec_202504 (installd_exec))
+(typeattributeset installd_service_202504 (installd_service))
+(typeattributeset intrusion_detection_service_202504 (intrusion_detection_service))
+(typeattributeset ion_device_202504 (ion_device))
+(typeattributeset ipsec_service_202504 (ipsec_service))
+(typeattributeset iris_service_202504 (iris_service))
+(typeattributeset iris_vendor_data_file_202504 (iris_vendor_data_file))
+(typeattributeset isolated_app_202504 (isolated_app))
+(typeattributeset isolated_compute_app_202504 (isolated_compute_app))
+(typeattributeset jobscheduler_service_202504 (jobscheduler_service))
+(typeattributeset kernel_202504 (kernel))
+(typeattributeset keychain_data_file_202504 (keychain_data_file))
+(typeattributeset keychord_device_202504 (keychord_device))
+(typeattributeset keyguard_config_prop_202504 (keyguard_config_prop))
+(typeattributeset keystore2_key_contexts_file_202504 (keystore2_key_contexts_file))
+(typeattributeset keystore_202504 (keystore))
+(typeattributeset keystore_compat_hal_service_202504 (keystore_compat_hal_service))
+(typeattributeset keystore_config_prop_202504 (keystore_config_prop))
+(typeattributeset keystore_data_file_202504 (keystore_data_file))
+(typeattributeset keystore_exec_202504 (keystore_exec))
+(typeattributeset keystore_maintenance_service_202504 (keystore_maintenance_service))
+(typeattributeset keystore_metrics_service_202504 (keystore_metrics_service))
+(typeattributeset keystore_service_202504 (keystore_service))
+(typeattributeset kmsg_debug_device_202504 (kmsg_debug_device))
+(typeattributeset kmsg_device_202504 (kmsg_device))
+(typeattributeset labeledfs_202504 (labeledfs))
+(typeattributeset launcherapps_service_202504 (launcherapps_service))
+(typeattributeset legacy_permission_service_202504 (legacy_permission_service))
+(typeattributeset legacykeystore_service_202504 (legacykeystore_service))
+(typeattributeset libc_debug_prop_202504 (libc_debug_prop))
+(typeattributeset light_service_202504 (light_service))
+(typeattributeset linkerconfig_file_202504 (linkerconfig_file))
+(typeattributeset llkd_202504 (llkd))
+(typeattributeset llkd_exec_202504 (llkd_exec))
+(typeattributeset llkd_prop_202504 (llkd_prop))
+(typeattributeset lmkd_202504 (lmkd))
+(typeattributeset lmkd_config_prop_202504 (lmkd_config_prop))
+(typeattributeset lmkd_exec_202504 (lmkd_exec))
+(typeattributeset lmkd_prop_202504 (lmkd_prop))
+(typeattributeset lmkd_socket_202504 (lmkd_socket))
+(typeattributeset locale_prop_202504 (locale_prop))
+(typeattributeset locale_service_202504 (locale_service))
+(typeattributeset location_service_202504 (location_service))
+(typeattributeset location_time_zone_manager_service_202504 (location_time_zone_manager_service))
+(typeattributeset lock_settings_service_202504 (lock_settings_service))
+(typeattributeset log_prop_202504 (log_prop))
+(typeattributeset log_tag_prop_202504 (log_tag_prop))
+(typeattributeset logcat_exec_202504 (logcat_exec))
+(typeattributeset logd_202504 (logd))
+(typeattributeset logd_exec_202504 (logd_exec))
+(typeattributeset logd_prop_202504 (logd_prop))
+(typeattributeset logd_socket_202504 (logd_socket))
+(typeattributeset logdr_socket_202504 (logdr_socket))
+(typeattributeset logdw_socket_202504 (logdw_socket))
+(typeattributeset logpersist_202504 (logpersist))
+(typeattributeset logpersistd_logging_prop_202504 (logpersistd_logging_prop))
+(typeattributeset loop_control_device_202504 (loop_control_device))
+(typeattributeset loop_device_202504 (loop_device))
+(typeattributeset looper_stats_service_202504 (looper_stats_service))
+(typeattributeset lowpan_device_202504 (lowpan_device))
+(typeattributeset lowpan_prop_202504 (lowpan_prop))
+(typeattributeset lpdump_service_202504 (lpdump_service))
+(typeattributeset lpdumpd_prop_202504 (lpdumpd_prop))
+(typeattributeset mac_perms_file_202504 (mac_perms_file))
+(typeattributeset mdns_service_202504 (mdns_service))
+(typeattributeset mdns_socket_202504 (mdns_socket))
+(typeattributeset mdnsd_202504 (mdnsd))
+(typeattributeset mdnsd_socket_202504 (mdnsd_socket))
+(typeattributeset media_communication_service_202504 (media_communication_service))
+(typeattributeset media_config_prop_202504 (media_config_prop))
+(typeattributeset media_data_file_202504 (media_data_file))
+(typeattributeset media_metrics_service_202504 (media_metrics_service))
+(typeattributeset media_projection_service_202504 (media_projection_service))
+(typeattributeset media_quality_service_202504 (media_quality_service))
+(typeattributeset media_router_service_202504 (media_router_service))
+(typeattributeset media_rw_data_file_202504 (media_rw_data_file))
+(typeattributeset media_session_service_202504 (media_session_service))
+(typeattributeset media_userdir_file_202504 (media_userdir_file))
+(typeattributeset media_variant_prop_202504 (media_variant_prop))
+(typeattributeset mediadrm_config_prop_202504 (mediadrm_config_prop))
+(typeattributeset mediadrmserver_202504 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_202504 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_202504 (mediadrmserver_service))
+(typeattributeset mediaextractor_202504 (mediaextractor))
+(typeattributeset mediaextractor_exec_202504 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_202504 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_202504 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_202504 (mediametrics))
+(typeattributeset mediametrics_exec_202504 (mediametrics_exec))
+(typeattributeset mediametrics_service_202504 (mediametrics_service))
+(typeattributeset mediaprovider_202504 (mediaprovider))
+(typeattributeset mediaserver_202504 (mediaserver))
+(typeattributeset mediaserver_exec_202504 (mediaserver_exec))
+(typeattributeset mediaserver_service_202504 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_202504 (mediaserver_tmpfs))
+(typeattributeset mediaswcodec_202504 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_202504 (mediaswcodec_exec))
+(typeattributeset mediatranscoding_202504 (mediatranscoding))
+(typeattributeset mediatranscoding_service_202504 (mediatranscoding_service))
+(typeattributeset meminfo_service_202504 (meminfo_service))
+(typeattributeset memtrackproxy_service_202504 (memtrackproxy_service))
+(typeattributeset metadata_block_device_202504 (metadata_block_device))
+(typeattributeset metadata_bootstat_file_202504 (metadata_bootstat_file))
+(typeattributeset metadata_file_202504 (metadata_file))
+(typeattributeset method_trace_data_file_202504 (method_trace_data_file))
+(typeattributeset midi_service_202504 (midi_service))
+(typeattributeset mirror_data_file_202504 (mirror_data_file))
+(typeattributeset misc_block_device_202504 (misc_block_device))
+(typeattributeset misc_logd_file_202504 (misc_logd_file))
+(typeattributeset misc_user_data_file_202504 (misc_user_data_file))
+(typeattributeset mm_events_config_prop_202504 (mm_events_config_prop))
+(typeattributeset mmc_prop_202504 (mmc_prop))
+(typeattributeset mnt_expand_file_202504 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_202504 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_202504 (mnt_media_rw_stub_file))
+(typeattributeset mnt_pass_through_file_202504 (mnt_pass_through_file))
+(typeattributeset mnt_product_file_202504 (mnt_product_file))
+(typeattributeset mnt_sdcard_file_202504 (mnt_sdcard_file))
+(typeattributeset mnt_user_file_202504 (mnt_user_file))
+(typeattributeset mnt_vendor_file_202504 (mnt_vendor_file))
+(typeattributeset mock_ota_prop_202504 (mock_ota_prop))
+(typeattributeset modprobe_202504 (modprobe))
+(typeattributeset module_sdkextensions_prop_202504 (module_sdkextensions_prop))
+(typeattributeset mount_service_202504 (mount_service))
+(typeattributeset mqueue_202504 (mqueue))
+(typeattributeset mtp_202504 (mtp))
+(typeattributeset mtp_device_202504 (mtp_device))
+(typeattributeset mtpd_socket_202504 (mtpd_socket))
+(typeattributeset music_recognition_service_202504 (music_recognition_service))
+(typeattributeset nativetest_data_file_202504 (nativetest_data_file))
+(typeattributeset nearby_service_202504 (nearby_service))
+(typeattributeset net_data_file_202504 (net_data_file))
+(typeattributeset net_dns_prop_202504 (net_dns_prop))
+(typeattributeset net_radio_prop_202504 (net_radio_prop))
+(typeattributeset netd_202504 (netd))
+(typeattributeset netd_exec_202504 (netd_exec))
+(typeattributeset netd_listener_service_202504 (netd_listener_service))
+(typeattributeset netd_service_202504 (netd_service))
+(typeattributeset netif_202504 (netif))
+(typeattributeset netpolicy_service_202504 (netpolicy_service))
+(typeattributeset netstats_service_202504 (netstats_service))
+(typeattributeset netutils_wrapper_202504 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_202504 (netutils_wrapper_exec))
+(typeattributeset network_management_service_202504 (network_management_service))
+(typeattributeset network_score_service_202504 (network_score_service))
+(typeattributeset network_stack_202504 (network_stack))
+(typeattributeset network_stack_service_202504 (network_stack_service))
+(typeattributeset network_time_update_service_202504 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_202504 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_202504 (network_watchlist_service))
+(typeattributeset nfc_202504 (nfc))
+(typeattributeset nfc_data_file_202504 (nfc_data_file))
+(typeattributeset nfc_device_202504 (nfc_device))
+(typeattributeset nfc_logs_data_file_202504 (nfc_logs_data_file))
+(typeattributeset nfc_prop_202504 (nfc_prop))
+(typeattributeset nfc_service_202504 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_202504 (nnapi_ext_deny_product_prop))
+(typeattributeset node_202504 (node))
+(typeattributeset notification_service_202504 (notification_service))
+(typeattributeset null_device_202504 (null_device))
+(typeattributeset oem_lock_service_202504 (oem_lock_service))
+(typeattributeset oem_unlock_prop_202504 (oem_unlock_prop))
+(typeattributeset oemfs_202504 (oemfs))
+(typeattributeset ondevicepersonalization_system_service_202504 (ondevicepersonalization_system_service))
+(typeattributeset ot_daemon_service_202504 (ot_daemon_service))
+(typeattributeset ot_daemon_socket_202504 (ot_daemon_socket))
+(typeattributeset ota_build_prop_202504 (ota_build_prop))
+(typeattributeset ota_data_file_202504 (ota_data_file))
+(typeattributeset ota_metadata_file_202504 (ota_metadata_file))
+(typeattributeset ota_package_file_202504 (ota_package_file))
+(typeattributeset ota_prop_202504 (ota_prop))
+(typeattributeset otadexopt_service_202504 (otadexopt_service))
+(typeattributeset overlay_prop_202504 (overlay_prop))
+(typeattributeset overlay_service_202504 (overlay_service))
+(typeattributeset overlayfs_file_202504 (overlayfs_file))
+(typeattributeset owntty_device_202504 (owntty_device))
+(typeattributeset pac_proxy_service_202504 (pac_proxy_service))
+(typeattributeset package_native_service_202504 (package_native_service))
+(typeattributeset package_service_202504 (package_service))
+(typeattributeset packagemanager_config_prop_202504 (packagemanager_config_prop))
+(typeattributeset packages_list_file_202504 (packages_list_file))
+(typeattributeset pan_result_prop_202504 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_202504 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_202504 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_202504 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_202504 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_202504 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_202504 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_202504 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_202504 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_202504 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_202504 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_202504 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_202504 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_202504 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_202504 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_202504 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_202504 (pdx_performance_dir))
+(typeattributeset people_service_202504 (people_service))
+(typeattributeset perfetto_202504 (perfetto))
+(typeattributeset performanced_202504 (performanced))
+(typeattributeset performanced_exec_202504 (performanced_exec))
+(typeattributeset permission_checker_service_202504 (permission_checker_service))
+(typeattributeset permission_service_202504 (permission_service))
+(typeattributeset permissionmgr_service_202504 (permissionmgr_service))
+(typeattributeset permissive_mte_prop_202504 (permissive_mte_prop))
+(typeattributeset persist_debug_prop_202504 (persist_debug_prop))
+(typeattributeset persist_vendor_debug_wifi_prop_202504 (persist_vendor_debug_wifi_prop))
+(typeattributeset persist_wm_debug_prop_202504 (persist_wm_debug_prop))
+(typeattributeset persistent_data_block_service_202504 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_202504 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_202504 (pinner_service))
+(typeattributeset pipefs_202504 (pipefs))
+(typeattributeset platform_app_202504 (platform_app))
+(typeattributeset platform_compat_service_202504 (platform_compat_service))
+(typeattributeset pm_archiving_enabled_prop_202504 (pm_archiving_enabled_prop))
+(typeattributeset pmsg_device_202504 (pmsg_device))
+(typeattributeset port_202504 (port))
+(typeattributeset port_device_202504 (port_device))
+(typeattributeset postinstall_202504 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_202504 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_202504 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_202504 (postinstall_mnt_dir))
+(typeattributeset power_debug_prop_202504 (power_debug_prop))
+(typeattributeset power_service_202504 (power_service))
+(typeattributeset powerctl_prop_202504 (powerctl_prop))
+(typeattributeset powerstats_service_202504 (powerstats_service))
+(typeattributeset ppp_202504 (ppp))
+(typeattributeset preloads_data_file_202504 (preloads_data_file))
+(typeattributeset preloads_media_file_202504 (preloads_media_file))
+(typeattributeset prereboot_data_file_202504 (prereboot_data_file))
+(typeattributeset print_service_202504 (print_service))
+(typeattributeset priv_app_202504 (priv_app))
+(typeattributeset privapp_data_file_202504 (privapp_data_file))
+(typeattributeset prng_seeder_202504 (prng_seeder))
+(typeattributeset proc_202504 (proc))
+(typeattributeset proc_abi_202504 (proc_abi))
+(typeattributeset proc_asound_202504 (proc_asound))
+(typeattributeset proc_bluetooth_writable_202504 (proc_bluetooth_writable))
+(typeattributeset proc_bootconfig_202504 (proc_bootconfig))
+(typeattributeset proc_bpf_202504 (proc_bpf))
+(typeattributeset proc_buddyinfo_202504 (proc_buddyinfo))
+(typeattributeset proc_cgroups_202504 (proc_cgroups))
+(typeattributeset proc_cmdline_202504 (proc_cmdline))
+(typeattributeset proc_cpu_alignment_202504 (proc_cpu_alignment))
+(typeattributeset proc_cpuinfo_202504 (proc_cpuinfo))
+(typeattributeset proc_dirty_202504 (proc_dirty))
+(typeattributeset proc_diskstats_202504 (proc_diskstats))
+(typeattributeset proc_drop_caches_202504 (proc_drop_caches))
+(typeattributeset proc_extra_free_kbytes_202504 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_202504 (proc_filesystems))
+(typeattributeset proc_fs_verity_202504 (proc_fs_verity))
+(typeattributeset proc_hostname_202504 (proc_hostname))
+(typeattributeset proc_hung_task_202504 (proc_hung_task))
+(typeattributeset proc_interrupts_202504 (proc_interrupts))
+(typeattributeset proc_iomem_202504 (proc_iomem))
+(typeattributeset proc_kallsyms_202504 (proc_kallsyms))
+(typeattributeset proc_keys_202504 (proc_keys))
+(typeattributeset proc_kmsg_202504 (proc_kmsg))
+(typeattributeset proc_kpageflags_202504 (proc_kpageflags))
+(typeattributeset proc_loadavg_202504 (proc_loadavg))
+(typeattributeset proc_locks_202504 (proc_locks))
+(typeattributeset proc_lowmemorykiller_202504 (proc_lowmemorykiller))
+(typeattributeset proc_max_map_count_202504 (proc_max_map_count))
+(typeattributeset proc_meminfo_202504 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_202504 (proc_min_free_order_shift))
+(typeattributeset proc_misc_202504 (proc_misc))
+(typeattributeset proc_modules_202504 (proc_modules))
+(typeattributeset proc_mounts_202504 (proc_mounts))
+(typeattributeset proc_net_202504 (proc_net))
+(typeattributeset proc_net_tcp_udp_202504 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_202504 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_202504 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_202504 (proc_pagetypeinfo))
+(typeattributeset proc_panic_202504 (proc_panic))
+(typeattributeset proc_percpu_pagelist_high_fraction_202504 (proc_percpu_pagelist_high_fraction))
+(typeattributeset proc_perf_202504 (proc_perf))
+(typeattributeset proc_pid_max_202504 (proc_pid_max))
+(typeattributeset proc_pipe_conf_202504 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_202504 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_202504 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_202504 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_202504 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_202504 (proc_qtaguid_stat))
+(typeattributeset proc_random_202504 (proc_random))
+(typeattributeset proc_sched_202504 (proc_sched))
+(typeattributeset proc_security_202504 (proc_security))
+(typeattributeset proc_slabinfo_202504 (proc_slabinfo))
+(typeattributeset proc_stat_202504 (proc_stat))
+(typeattributeset proc_swaps_202504 (proc_swaps))
+(typeattributeset proc_sysrq_202504 (proc_sysrq))
+(typeattributeset proc_timer_202504 (proc_timer))
+(typeattributeset proc_tty_drivers_202504 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_202504 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_202504 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_202504 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_202504 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_202504 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_202504 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_202504 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_202504 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_202504 (proc_uptime))
+(typeattributeset proc_vendor_sched_202504 (proc_vendor_sched))
+(typeattributeset proc_version_202504 (proc_version))
+(typeattributeset proc_vmallocinfo_202504 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_202504 (proc_vmstat))
+(typeattributeset proc_watermark_boost_factor_202504 (proc_watermark_boost_factor))
+(typeattributeset proc_watermark_scale_factor_202504 (proc_watermark_scale_factor))
+(typeattributeset proc_zoneinfo_202504 (proc_zoneinfo))
+(typeattributeset processinfo_service_202504 (processinfo_service))
+(typeattributeset procstats_service_202504 (procstats_service))
+(typeattributeset profcollectd_etr_prop_202504 (profcollectd_etr_prop))
+(typeattributeset profiling_service_202504 (profiling_service))
+(typeattributeset profman_202504 (profman))
+(typeattributeset profman_dump_data_file_202504 (profman_dump_data_file))
+(typeattributeset profman_exec_202504 (profman_exec))
+(typeattributeset properties_device_202504 (properties_device))
+(typeattributeset properties_serial_202504 (properties_serial))
+(typeattributeset property_contexts_file_202504 (property_contexts_file))
+(typeattributeset property_data_file_202504 (property_data_file))
+(typeattributeset property_info_202504 (property_info))
+(typeattributeset property_service_version_prop_202504 (property_service_version_prop))
+(typeattributeset property_socket_202504 (property_socket))
+(typeattributeset provisioned_prop_202504 (provisioned_prop))
+(typeattributeset pstorefs_202504 (pstorefs))
+(typeattributeset ptmx_device_202504 (ptmx_device))
+(typeattributeset qemu_hw_prop_202504 (qemu_hw_prop))
+(typeattributeset qemu_sf_lcd_density_prop_202504 (qemu_sf_lcd_density_prop))
+(typeattributeset qtaguid_device_202504 (qtaguid_device))
+(typeattributeset quick_start_prop_202504 (quick_start_prop))
+(typeattributeset racoon_socket_202504 (racoon_socket))
+(typeattributeset radio_202504 (radio))
+(typeattributeset radio_control_prop_202504 (radio_control_prop))
+(typeattributeset radio_core_data_file_202504 (radio_core_data_file))
+(typeattributeset radio_data_file_202504 (radio_data_file))
+(typeattributeset radio_device_202504 (radio_device))
+(typeattributeset radio_prop_202504 (radio_prop))
+(typeattributeset radio_service_202504 (radio_service))
+(typeattributeset ram_device_202504 (ram_device))
+(typeattributeset random_device_202504 (random_device))
+(typeattributeset reboot_readiness_service_202504 (reboot_readiness_service))
+(typeattributeset rebootescrow_hal_prop_202504 (rebootescrow_hal_prop))
+(typeattributeset recovery_202504 (recovery))
+(typeattributeset recovery_block_device_202504 (recovery_block_device))
+(typeattributeset recovery_config_prop_202504 (recovery_config_prop))
+(typeattributeset recovery_data_file_202504 (recovery_data_file))
+(typeattributeset recovery_persist_202504 (recovery_persist))
+(typeattributeset recovery_persist_exec_202504 (recovery_persist_exec))
+(typeattributeset recovery_refresh_202504 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_202504 (recovery_refresh_exec))
+(typeattributeset recovery_service_202504 (recovery_service))
+(typeattributeset recovery_socket_202504 (recovery_socket))
+(typeattributeset recovery_usb_config_prop_202504 (recovery_usb_config_prop))
+(typeattributeset registry_service_202504 (registry_service))
+(typeattributeset remote_auth_service_202504 (remote_auth_service))
+(typeattributeset remote_provisioning_service_202504 (remote_provisioning_service))
+(typeattributeset repair_mode_metadata_file_202504 (repair_mode_metadata_file))
+(typeattributeset resourcecache_data_file_202504 (resourcecache_data_file))
+(typeattributeset resources_manager_service_202504 (resources_manager_service))
+(typeattributeset restorecon_prop_202504 (restorecon_prop))
+(typeattributeset restrictions_service_202504 (restrictions_service))
+(typeattributeset retaildemo_prop_202504 (retaildemo_prop))
+(typeattributeset rild_debug_socket_202504 (rild_debug_socket))
+(typeattributeset rild_socket_202504 (rild_socket))
+(typeattributeset ringtone_file_202504 (ringtone_file))
+(typeattributeset rkpdapp_202504 (rkpdapp))
+(typeattributeset role_service_202504 (role_service))
+(typeattributeset rollback_service_202504 (rollback_service))
+(typeattributeset root_block_device_202504 (root_block_device))
+(typeattributeset rootdisk_sysdev_202504 (rootdisk_sysdev))
+(typeattributeset rootfs_202504 (rootfs))
+(typeattributeset rpmsg_device_202504 (rpmsg_device))
+(typeattributeset rs_202504 (rs))
+(typeattributeset rs_exec_202504 (rs_exec))
+(typeattributeset rss_hwm_reset_202504 (rss_hwm_reset))
+(typeattributeset rtc_device_202504 (rtc_device))
+(typeattributeset rttmanager_service_202504 (rttmanager_service))
+(typeattributeset runas_202504 (runas))
+(typeattributeset runas_app_202504 (runas_app))
+(typeattributeset runas_exec_202504 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_202504 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_202504 (runtime_service))
+(typeattributeset safemode_prop_202504 (safemode_prop))
+(typeattributeset same_process_hal_file_202504 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_202504 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_202504 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_202504 (sdcard_block_device))
+(typeattributeset sdcardd_202504 (sdcardd))
+(typeattributeset sdcardd_exec_202504 (sdcardd_exec))
+(typeattributeset sdcardfs_202504 (sdcardfs))
+(typeattributeset sdk_sandbox_service_202504 (sdk_sandbox_service))
+(typeattributeset seapp_contexts_file_202504 (seapp_contexts_file))
+(typeattributeset search_service_202504 (search_service))
+(typeattributeset search_ui_service_202504 (search_ui_service))
+(typeattributeset sec_key_att_app_id_provider_service_202504 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_202504 (secure_element))
+(typeattributeset secure_element_device_202504 (secure_element_device))
+(typeattributeset secure_element_service_202504 (secure_element_service))
+(typeattributeset security_state_service_202504 (security_state_service))
+(typeattributeset securityfs_202504 (securityfs))
+(typeattributeset selection_toolbar_service_202504 (selection_toolbar_service))
+(typeattributeset selinuxfs_202504 (selinuxfs))
+(typeattributeset sendbug_config_prop_202504 (sendbug_config_prop))
+(typeattributeset sensitive_content_protection_service_202504 (sensitive_content_protection_service))
+(typeattributeset sensor_privacy_service_202504 (sensor_privacy_service))
+(typeattributeset sensors_device_202504 (sensors_device))
+(typeattributeset sensorservice_service_202504 (sensorservice_service))
+(typeattributeset sepolicy_file_202504 (sepolicy_file))
+(typeattributeset serial_device_202504 (serial_device))
+(typeattributeset serial_service_202504 (serial_service))
+(typeattributeset serialno_prop_202504 (serialno_prop))
+(typeattributeset server_configurable_flags_data_file_202504 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_202504 (service_contexts_file))
+(typeattributeset service_manager_service_202504 (service_manager_service))
+(typeattributeset service_manager_vndservice_202504 (service_manager_vndservice))
+(typeattributeset servicediscovery_service_202504 (servicediscovery_service))
+(typeattributeset servicemanager_202504 (servicemanager))
+(typeattributeset servicemanager_exec_202504 (servicemanager_exec))
+(typeattributeset servicemanager_prop_202504 (servicemanager_prop))
+(typeattributeset settings_service_202504 (settings_service))
+(typeattributeset setupwizard_mode_prop_202504 (setupwizard_mode_prop))
+(typeattributeset sgdisk_202504 (sgdisk))
+(typeattributeset sgdisk_exec_202504 (sgdisk_exec))
+(typeattributeset shared_relro_202504 (shared_relro))
+(typeattributeset shared_relro_file_202504 (shared_relro_file))
+(typeattributeset shell_202504 (shell))
+(typeattributeset shell_data_file_202504 (shell_data_file))
+(typeattributeset shell_exec_202504 (shell_exec))
+(typeattributeset shell_prop_202504 (shell_prop))
+(typeattributeset shell_test_data_file_202504 (shell_test_data_file))
+(typeattributeset shm_202504 (shm))
+(typeattributeset shortcut_manager_icons_202504 (shortcut_manager_icons))
+(typeattributeset shortcut_service_202504 (shortcut_service))
+(typeattributeset shutdown_checkpoints_system_data_file_202504 (shutdown_checkpoints_system_data_file))
+(typeattributeset simpleperf_202504 (simpleperf))
+(typeattributeset simpleperf_app_runner_202504 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_202504 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_202504 (slice_service))
+(typeattributeset slideshow_202504 (slideshow))
+(typeattributeset smart_idle_maint_enabled_prop_202504 (smart_idle_maint_enabled_prop))
+(typeattributeset smartspace_service_202504 (smartspace_service))
+(typeattributeset snapshotctl_log_data_file_202504 (snapshotctl_log_data_file))
+(typeattributeset snapuserd_log_data_file_202504 (snapuserd_log_data_file))
+(typeattributeset snapuserd_proxy_socket_202504 (snapuserd_proxy_socket))
+(typeattributeset snapuserd_socket_202504 (snapuserd_socket))
+(typeattributeset soc_prop_202504 (soc_prop))
+(typeattributeset socket_device_202504 (socket_device))
+(typeattributeset socket_hook_prop_202504 (socket_hook_prop))
+(typeattributeset sockfs_202504 (sockfs))
+(typeattributeset sota_prop_202504 (sota_prop))
+(typeattributeset soundtrigger_middleware_service_202504 (soundtrigger_middleware_service))
+(typeattributeset speech_recognition_service_202504 (speech_recognition_service))
+(typeattributeset sqlite_log_prop_202504 (sqlite_log_prop))
+(typeattributeset staged_install_file_202504 (staged_install_file))
+(typeattributeset staging_data_file_202504 (staging_data_file))
+(typeattributeset stats_config_data_file_202504 (stats_config_data_file))
+(typeattributeset stats_data_file_202504 (stats_data_file))
+(typeattributeset statsd_202504 (statsd))
+(typeattributeset statsd_exec_202504 (statsd_exec))
+(typeattributeset statsdw_socket_202504 (statsdw_socket))
+(typeattributeset statusbar_service_202504 (statusbar_service))
+(typeattributeset storage_config_prop_202504 (storage_config_prop))
+(typeattributeset storage_file_202504 (storage_file))
+(typeattributeset storage_stub_file_202504 (storage_stub_file))
+(typeattributeset storaged_service_202504 (storaged_service))
+(typeattributeset storagemanager_config_prop_202504 (storagemanager_config_prop))
+(typeattributeset storagestats_service_202504 (storagestats_service))
+(typeattributeset su_202504 (su))
+(typeattributeset su_exec_202504 (su_exec))
+(typeattributeset super_block_device_202504 (super_block_device))
+(typeattributeset surfaceflinger_202504 (surfaceflinger))
+(typeattributeset surfaceflinger_color_prop_202504 (surfaceflinger_color_prop))
+(typeattributeset surfaceflinger_display_prop_202504 (surfaceflinger_display_prop))
+(typeattributeset surfaceflinger_prop_202504 (surfaceflinger_prop))
+(typeattributeset surfaceflinger_service_202504 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_202504 (surfaceflinger_tmpfs))
+(typeattributeset suspend_prop_202504 (suspend_prop))
+(typeattributeset swap_block_device_202504 (swap_block_device))
+(typeattributeset sysfs_202504 (sysfs))
+(typeattributeset sysfs_android_usb_202504 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_202504 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_202504 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_cma_202504 (sysfs_cma))
+(typeattributeset sysfs_devfreq_cur_202504 (sysfs_devfreq_cur))
+(typeattributeset sysfs_devfreq_dir_202504 (sysfs_devfreq_dir))
+(typeattributeset sysfs_devices_block_202504 (sysfs_devices_block))
+(typeattributeset sysfs_devices_cs_etm_202504 (sysfs_devices_cs_etm))
+(typeattributeset sysfs_devices_system_cpu_202504 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_202504 (sysfs_dm))
+(typeattributeset sysfs_dm_verity_202504 (sysfs_dm_verity))
+(typeattributeset sysfs_dma_heap_202504 (sysfs_dma_heap))
+(typeattributeset sysfs_dmabuf_stats_202504 (sysfs_dmabuf_stats))
+(typeattributeset sysfs_dt_firmware_android_202504 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_202504 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_202504 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_202504 (sysfs_fs_f2fs))
+(typeattributeset sysfs_fs_fuse_bpf_202504 (sysfs_fs_fuse_bpf))
+(typeattributeset sysfs_fs_fuse_features_202504 (sysfs_fs_fuse_features))
+(typeattributeset sysfs_fs_incfs_features_202504 (sysfs_fs_incfs_features))
+(typeattributeset sysfs_fs_incfs_metrics_202504 (sysfs_fs_incfs_metrics))
+(typeattributeset sysfs_gpu_202504 (sysfs_gpu))
+(typeattributeset sysfs_hwrandom_202504 (sysfs_hwrandom))
+(typeattributeset sysfs_ion_202504 (sysfs_ion))
+(typeattributeset sysfs_ipv4_202504 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_202504 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_202504 (sysfs_leds))
+(typeattributeset sysfs_loop_202504 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_202504 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_lru_gen_enabled_202504 (sysfs_lru_gen_enabled))
+(typeattributeset sysfs_mem_sleep_202504 (sysfs_mem_sleep))
+(typeattributeset sysfs_net_202504 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_202504 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_202504 (sysfs_power))
+(typeattributeset sysfs_rtc_202504 (sysfs_rtc))
+(typeattributeset sysfs_suspend_stats_202504 (sysfs_suspend_stats))
+(typeattributeset sysfs_switch_202504 (sysfs_switch))
+(typeattributeset sysfs_sync_on_suspend_202504 (sysfs_sync_on_suspend))
+(typeattributeset sysfs_thermal_202504 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_202504 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_udc_202504 (sysfs_udc))
+(typeattributeset sysfs_uhid_202504 (sysfs_uhid))
+(typeattributeset sysfs_uio_202504 (sysfs_uio))
+(typeattributeset sysfs_usb_202504 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_202504 (sysfs_usermodehelper))
+(typeattributeset sysfs_vendor_sched_202504 (sysfs_vendor_sched))
+(typeattributeset sysfs_vibrator_202504 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_202504 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_202504 (sysfs_wakeup))
+(typeattributeset sysfs_wakeup_reasons_202504 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_202504 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_202504 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_202504 (sysfs_zram_uevent))
+(typeattributeset system_app_202504 (system_app))
+(typeattributeset system_app_data_file_202504 (system_app_data_file))
+(typeattributeset system_app_service_202504 (system_app_service))
+(typeattributeset system_asan_options_file_202504 (system_asan_options_file))
+(typeattributeset system_block_device_202504 (system_block_device))
+(typeattributeset system_boot_reason_prop_202504 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_202504 (system_bootstrap_lib_file))
+(typeattributeset system_config_service_202504 (system_config_service))
+(typeattributeset system_data_file_202504 (system_data_file))
+(typeattributeset system_data_root_file_202504 (system_data_root_file))
+(typeattributeset system_dlkm_file_202504 (system_dlkm_file))
+(typeattributeset system_event_log_tags_file_202504 (system_event_log_tags_file))
+(typeattributeset system_file_202504 (system_file))
+(typeattributeset system_group_file_202504 (system_group_file))
+(typeattributeset system_jvmti_agent_prop_202504 (system_jvmti_agent_prop))
+(typeattributeset system_lib_file_202504 (system_lib_file))
+(typeattributeset system_linker_config_file_202504 (system_linker_config_file))
+(typeattributeset system_linker_exec_202504 (system_linker_exec))
+(typeattributeset system_lmk_prop_202504 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_202504 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_202504 (system_net_netd_hwservice))
+(typeattributeset system_net_netd_service_202504 (system_net_netd_service))
+(typeattributeset system_passwd_file_202504 (system_passwd_file))
+(typeattributeset system_prop_202504 (system_prop))
+(typeattributeset system_seccomp_policy_file_202504 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_202504 (system_security_cacerts_file))
+(typeattributeset system_server_202504 (system_server))
+(typeattributeset system_server_dumper_service_202504 (system_server_dumper_service))
+(typeattributeset system_server_tmpfs_202504 (system_server_tmpfs))
+(typeattributeset system_suspend_control_internal_service_202504 (system_suspend_control_internal_service))
+(typeattributeset system_suspend_control_service_202504 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_202504 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_202504 (system_trace_prop))
+(typeattributeset system_unsolzygote_socket_202504 (system_unsolzygote_socket))
+(typeattributeset system_update_service_202504 (system_update_service))
+(typeattributeset system_user_mode_emulation_prop_202504 (system_user_mode_emulation_prop))
+(typeattributeset system_userdir_file_202504 (system_userdir_file))
+(typeattributeset system_wifi_keystore_hwservice_202504 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_202504 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_202504 (system_zoneinfo_file))
+(typeattributeset systemkeys_data_file_202504 (systemkeys_data_file))
+(typeattributeset systemsound_config_prop_202504 (systemsound_config_prop))
+(typeattributeset tare_service_202504 (tare_service))
+(typeattributeset task_profiles_file_202504 (task_profiles_file))
+(typeattributeset task_service_202504 (task_service))
+(typeattributeset tcpdump_exec_202504 (tcpdump_exec))
+(typeattributeset tee_202504 (tee))
+(typeattributeset tee_data_file_202504 (tee_data_file))
+(typeattributeset tee_device_202504 (tee_device))
+(typeattributeset tee_service_contexts_file_202504 (tee_service_contexts_file))
+(typeattributeset telecom_service_202504 (telecom_service))
+(typeattributeset telephony_config_prop_202504 (telephony_config_prop))
+(typeattributeset telephony_status_prop_202504 (telephony_status_prop))
+(typeattributeset test_boot_reason_prop_202504 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_202504 (test_harness_prop))
+(typeattributeset testharness_service_202504 (testharness_service))
+(typeattributeset tethering_service_202504 (tethering_service))
+(typeattributeset textclassification_service_202504 (textclassification_service))
+(typeattributeset textclassifier_data_file_202504 (textclassifier_data_file))
+(typeattributeset textservices_service_202504 (textservices_service))
+(typeattributeset texttospeech_service_202504 (texttospeech_service))
+(typeattributeset theme_prop_202504 (theme_prop))
+(typeattributeset thermal_service_202504 (thermal_service))
+(typeattributeset threadnetwork_config_prop_202504 (threadnetwork_config_prop))
+(typeattributeset threadnetwork_service_202504 (threadnetwork_service))
+(typeattributeset time_prop_202504 (time_prop))
+(typeattributeset timedetector_service_202504 (timedetector_service))
+(typeattributeset timezone_prop_202504 (timezone_prop))
+(typeattributeset timezonedetector_service_202504 (timezonedetector_service))
+(typeattributeset tmpfs_202504 (tmpfs))
+(typeattributeset tombstone_config_prop_202504 (tombstone_config_prop))
+(typeattributeset tombstone_data_file_202504 (tombstone_data_file))
+(typeattributeset tombstone_wifi_data_file_202504 (tombstone_wifi_data_file))
+(typeattributeset tombstoned_202504 (tombstoned))
+(typeattributeset tombstoned_crash_socket_202504 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_202504 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_202504 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_202504 (tombstoned_java_trace_socket))
+(typeattributeset toolbox_202504 (toolbox))
+(typeattributeset toolbox_exec_202504 (toolbox_exec))
+(typeattributeset trace_data_file_202504 (trace_data_file))
+(typeattributeset traced_202504 (traced))
+(typeattributeset traced_consumer_socket_202504 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_202504 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_202504 (traced_lazy_prop))
+(typeattributeset traced_oome_heap_session_count_prop_202504 (traced_oome_heap_session_count_prop))
+(typeattributeset traced_perf_202504 (traced_perf))
+(typeattributeset traced_perf_socket_202504 (traced_perf_socket))
+(typeattributeset traced_probes_202504 (traced_probes))
+(typeattributeset traced_producer_socket_202504 (traced_producer_socket))
+(typeattributeset traced_tmpfs_202504 (traced_tmpfs))
+(typeattributeset traceur_app_202504 (traceur_app))
+(typeattributeset translation_service_202504 (translation_service))
+(typeattributeset trust_service_202504 (trust_service))
+(typeattributeset trusty_security_vm_sys_vendor_prop_202504 (trusty_security_vm_sys_vendor_prop))
+(typeattributeset tty_device_202504 (tty_device))
+(typeattributeset tun_device_202504 (tun_device))
+(typeattributeset tuner_config_prop_202504 (tuner_config_prop))
+(typeattributeset tv_ad_service_202504 (tv_ad_service))
+(typeattributeset tv_iapp_service_202504 (tv_iapp_service))
+(typeattributeset tv_input_service_202504 (tv_input_service))
+(typeattributeset tv_tuner_resource_mgr_service_202504 (tv_tuner_resource_mgr_service))
+(typeattributeset ublk_block_device_202504 (ublk_block_device))
+(typeattributeset ublk_control_device_202504 (ublk_control_device))
+(typeattributeset ueventd_202504 (ueventd))
+(typeattributeset ueventd_tmpfs_202504 (ueventd_tmpfs))
+(typeattributeset uhid_device_202504 (uhid_device))
+(typeattributeset uimode_service_202504 (uimode_service))
+(typeattributeset uio_device_202504 (uio_device))
+(typeattributeset uncrypt_202504 (uncrypt))
+(typeattributeset uncrypt_exec_202504 (uncrypt_exec))
+(typeattributeset uncrypt_socket_202504 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_202504 (unencrypted_data_file))
+(typeattributeset unlabeled_202504 (unlabeled))
+(typeattributeset untrusted_app_202504 (untrusted_app))
+(typeattributeset untrusted_app_25_202504 (untrusted_app_25))
+(typeattributeset untrusted_app_27_202504 (untrusted_app_27))
+(typeattributeset untrusted_app_29_202504 (untrusted_app_29))
+(typeattributeset untrusted_app_30_202504 (untrusted_app_30))
+(typeattributeset untrusted_app_32_202504 (untrusted_app_32))
+(typeattributeset update_engine_202504 (update_engine))
+(typeattributeset update_engine_data_file_202504 (update_engine_data_file))
+(typeattributeset update_engine_exec_202504 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_202504 (update_engine_log_data_file))
+(typeattributeset update_engine_service_202504 (update_engine_service))
+(typeattributeset update_engine_stable_service_202504 (update_engine_stable_service))
+(typeattributeset update_verifier_202504 (update_verifier))
+(typeattributeset update_verifier_exec_202504 (update_verifier_exec))
+(typeattributeset updatelock_service_202504 (updatelock_service))
+(typeattributeset uri_grants_service_202504 (uri_grants_service))
+(typeattributeset usagestats_service_202504 (usagestats_service))
+(typeattributeset usb_config_prop_202504 (usb_config_prop))
+(typeattributeset usb_control_prop_202504 (usb_control_prop))
+(typeattributeset usb_device_202504 (usb_device))
+(typeattributeset usb_prop_202504 (usb_prop))
+(typeattributeset usb_serial_device_202504 (usb_serial_device))
+(typeattributeset usb_service_202504 (usb_service))
+(typeattributeset usb_uvc_enabled_prop_202504 (usb_uvc_enabled_prop))
+(typeattributeset usbaccessory_device_202504 (usbaccessory_device))
+(typeattributeset usbd_202504 (usbd))
+(typeattributeset usbd_exec_202504 (usbd_exec))
+(typeattributeset usbfs_202504 (usbfs))
+(typeattributeset use_memfd_prop_202504 (use_memfd_prop))
+(typeattributeset user_profile_data_file_202504 (user_profile_data_file))
+(typeattributeset user_profile_root_file_202504 (user_profile_root_file))
+(typeattributeset user_service_202504 (user_service))
+(typeattributeset userdata_block_device_202504 (userdata_block_device))
+(typeattributeset userdata_sysdev_202504 (userdata_sysdev))
+(typeattributeset userdebug_or_eng_prop_202504 (userdebug_or_eng_prop))
+(typeattributeset usermodehelper_202504 (usermodehelper))
+(typeattributeset userspace_reboot_config_prop_202504 (userspace_reboot_config_prop))
+(typeattributeset userspace_reboot_exported_prop_202504 (userspace_reboot_exported_prop))
+(typeattributeset userspace_reboot_metadata_file_202504 (userspace_reboot_metadata_file))
+(typeattributeset uwb_service_202504 (uwb_service))
+(typeattributeset vcn_management_service_202504 (vcn_management_service))
+(typeattributeset vd_device_202504 (vd_device))
+(typeattributeset vdc_202504 (vdc))
+(typeattributeset vdc_exec_202504 (vdc_exec))
+(typeattributeset vehicle_hal_prop_202504 (vehicle_hal_prop))
+(typeattributeset vendor_apex_file_202504 (vendor_apex_file))
+(typeattributeset vendor_apex_metadata_file_202504 (vendor_apex_metadata_file))
+(typeattributeset vendor_app_file_202504 (vendor_app_file))
+(typeattributeset vendor_boot_ota_file_202504 (vendor_boot_ota_file))
+(typeattributeset vendor_cgroup_desc_file_202504 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_202504 (vendor_configs_file))
+(typeattributeset vendor_data_file_202504 (vendor_data_file))
+(typeattributeset vendor_default_prop_202504 (vendor_default_prop))
+(typeattributeset vendor_file_202504 (vendor_file))
+(typeattributeset vendor_framework_file_202504 (vendor_framework_file))
+(typeattributeset vendor_hal_file_202504 (vendor_hal_file))
+(typeattributeset vendor_idc_file_202504 (vendor_idc_file))
+(typeattributeset vendor_init_202504 (vendor_init))
+(typeattributeset vendor_kernel_modules_202504 (vendor_kernel_modules))
+(typeattributeset vendor_keychars_file_202504 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_202504 (vendor_keylayout_file))
+(typeattributeset vendor_microdroid_file_202504 (vendor_microdroid_file))
+(typeattributeset vendor_misc_writer_202504 (vendor_misc_writer))
+(typeattributeset vendor_misc_writer_exec_202504 (vendor_misc_writer_exec))
+(typeattributeset vendor_modprobe_202504 (vendor_modprobe))
+(typeattributeset vendor_overlay_file_202504 (vendor_overlay_file))
+(typeattributeset vendor_public_framework_file_202504 (vendor_public_framework_file))
+(typeattributeset vendor_public_lib_file_202504 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_202504 (vendor_security_patch_level_prop))
+(typeattributeset vendor_service_contexts_file_202504 (vendor_service_contexts_file))
+(typeattributeset vendor_shell_202504 (vendor_shell))
+(typeattributeset vendor_shell_exec_202504 (vendor_shell_exec))
+(typeattributeset vendor_socket_hook_prop_202504 (vendor_socket_hook_prop))
+(typeattributeset vendor_task_profiles_file_202504 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_202504 (vendor_toolbox_exec))
+(typeattributeset vendor_userdir_file_202504 (vendor_userdir_file))
+(typeattributeset vendor_uuid_mapping_config_file_202504 (vendor_uuid_mapping_config_file))
+(typeattributeset vendor_vm_data_file_202504 (vendor_vm_data_file))
+(typeattributeset vendor_vm_file_202504 (vendor_vm_file))
+(typeattributeset vfat_202504 (vfat))
+(typeattributeset vfio_device_202504 (vfio_device))
+(typeattributeset vibrator_manager_service_202504 (vibrator_manager_service))
+(typeattributeset vibrator_service_202504 (vibrator_service))
+(typeattributeset video_device_202504 (video_device))
+(typeattributeset virtual_ab_prop_202504 (virtual_ab_prop))
+(typeattributeset virtual_camera_202504 (virtual_camera))
+(typeattributeset virtual_camera_exec_202504 (virtual_camera_exec))
+(typeattributeset virtual_camera_service_202504 (virtual_camera_service))
+(typeattributeset virtual_device_native_service_202504 (virtual_device_native_service))
+(typeattributeset virtual_device_service_202504 (virtual_device_service))
+(typeattributeset virtual_face_hal_prop_202504 (virtual_face_hal_prop))
+(typeattributeset virtual_face_prop_202504 (virtual_face_prop))
+(typeattributeset virtual_fingerprint_hal_prop_202504 (virtual_fingerprint_hal_prop))
+(typeattributeset virtual_fingerprint_prop_202504 (virtual_fingerprint_prop))
+(typeattributeset virtual_touchpad_202504 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_202504 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_202504 (virtual_touchpad_service))
+(typeattributeset virtualization_service_202504 (virtualization_service))
+(typeattributeset virtualizationmanager_202504 (virtualizationmanager))
+(typeattributeset virtualizationmanager_exec_202504 (virtualizationmanager_exec))
+(typeattributeset vndbinder_device_202504 (vndbinder_device))
+(typeattributeset vndk_prop_202504 (vndk_prop))
+(typeattributeset vndk_sp_file_202504 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_202504 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_202504 (vndservicemanager))
+(typeattributeset voiceinteraction_service_202504 (voiceinteraction_service))
+(typeattributeset vold_202504 (vold))
+(typeattributeset vold_config_prop_202504 (vold_config_prop))
+(typeattributeset vold_data_file_202504 (vold_data_file))
+(typeattributeset vold_device_202504 (vold_device))
+(typeattributeset vold_exec_202504 (vold_exec))
+(typeattributeset vold_metadata_file_202504 (vold_metadata_file))
+(typeattributeset vold_post_fs_data_prop_202504 (vold_post_fs_data_prop))
+(typeattributeset vold_prepare_subdirs_202504 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_202504 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_202504 (vold_prop))
+(typeattributeset vold_service_202504 (vold_service))
+(typeattributeset vold_status_prop_202504 (vold_status_prop))
+(typeattributeset vpn_data_file_202504 (vpn_data_file))
+(typeattributeset vpn_management_service_202504 (vpn_management_service))
+(typeattributeset vr_hwc_service_202504 (vr_hwc_service))
+(typeattributeset vr_manager_service_202504 (vr_manager_service))
+(typeattributeset vrflinger_vsync_service_202504 (vrflinger_vsync_service))
+(typeattributeset vts_config_prop_202504 (vts_config_prop))
+(typeattributeset vts_status_prop_202504 (vts_status_prop))
+(typeattributeset wallpaper_effects_generation_service_202504 (wallpaper_effects_generation_service))
+(typeattributeset wallpaper_file_202504 (wallpaper_file))
+(typeattributeset wallpaper_service_202504 (wallpaper_service))
+(typeattributeset watchdog_device_202504 (watchdog_device))
+(typeattributeset watchdog_metadata_file_202504 (watchdog_metadata_file))
+(typeattributeset watchdogd_202504 (watchdogd))
+(typeattributeset watchdogd_exec_202504 (watchdogd_exec))
+(typeattributeset webview_zygote_202504 (webview_zygote))
+(typeattributeset webview_zygote_exec_202504 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_202504 (webview_zygote_tmpfs))
+(typeattributeset webviewupdate_service_202504 (webviewupdate_service))
+(typeattributeset wifi_config_prop_202504 (wifi_config_prop))
+(typeattributeset wifi_data_file_202504 (wifi_data_file))
+(typeattributeset wifi_hal_prop_202504 (wifi_hal_prop))
+(typeattributeset wifi_key_202504 (wifi_key))
+(typeattributeset wifi_log_prop_202504 (wifi_log_prop))
+(typeattributeset wifi_prop_202504 (wifi_prop))
+(typeattributeset wifi_service_202504 (wifi_service))
+(typeattributeset wifi_usd_service_202504 (wifi_usd_service))
+(typeattributeset wifiaware_service_202504 (wifiaware_service))
+(typeattributeset wificond_202504 (wificond))
+(typeattributeset wificond_exec_202504 (wificond_exec))
+(typeattributeset wifinl80211_service_202504 (wifinl80211_service))
+(typeattributeset wifip2p_service_202504 (wifip2p_service))
+(typeattributeset wifiscanner_service_202504 (wifiscanner_service))
+(typeattributeset window_service_202504 (window_service))
+(typeattributeset wpa_socket_202504 (wpa_socket))
+(typeattributeset zero_device_202504 (zero_device))
+(typeattributeset zoned_block_device_202504 (zoned_block_device))
+(typeattributeset zram_config_prop_202504 (zram_config_prop))
+(typeattributeset zram_control_prop_202504 (zram_control_prop))
+(typeattributeset zygote_202504 (zygote))
+(typeattributeset zygote_config_prop_202504 (zygote_config_prop))
+(typeattributeset zygote_exec_202504 (zygote_exec))
+(typeattributeset zygote_socket_202504 (zygote_socket))
+(typeattributeset zygote_tmpfs_202504 (zygote_tmpfs))
diff --git a/private/compat/202504/202504.compat.cil b/private/compat/202504/202504.compat.cil
new file mode 100644
index 0000000..061ea04
--- /dev/null
+++ b/private/compat/202504/202504.compat.cil
@@ -0,0 +1,3 @@
+;; complement CIL file for compatibility between ToT policy and 202504 vendors.
+;; will be compiled along with other normal policy files, on 202504 vendors.
+;;
diff --git a/private/compat/202504/202504.ignore.cil b/private/compat/202504/202504.ignore.cil
new file mode 100644
index 0000000..04d9387
--- /dev/null
+++ b/private/compat/202504/202504.ignore.cil
@@ -0,0 +1,9 @@
+;; new_objects - a collection of types that have been introduced with ToT policy
+;; that have no analogue in 202504 policy. Thus, we do not need to map these types to
+;; previous ones. Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+ ( new_objects
+ pbtombstone_exec
+ ))
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 0a3d2e9..1d3b389 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -22,6 +22,7 @@
artd
artd_exec
artd_service
+ atrace
authorization_service
bootanim_config_prop
camerax_extensions_prop
@@ -95,6 +96,7 @@
odsign
odsign_data_file
odsign_exec
+ otapreopt_chroot
pac_proxy_service
permission_checker_service
people_service
@@ -138,6 +140,7 @@
system_suspend_control_internal_service
task_profiles_api_file
texttospeech_service
+ traced_tmpfs
translation_service
update_engine_stable_service
userdata_sysdev
diff --git a/private/compat/32.0/32.0.ignore.cil b/private/compat/32.0/32.0.ignore.cil
index 43ce0a1..dd74cd8 100644
--- a/private/compat/32.0/32.0.ignore.cil
+++ b/private/compat/32.0/32.0.ignore.cil
@@ -12,6 +12,7 @@
attestation_verification_service
bluetooth_config_prop
binderfs_features
+ bpfloader
charger_vendor
cloudsearch
cloudsearch_service
@@ -58,6 +59,7 @@
hal_wifi_supplicant_service
locale_service
mdns_service
+ mediatranscoding
nearby_service
persist_wm_debug_prop
proc_watermark_boost_factor
diff --git a/private/compat/33.0/33.0.cil b/private/compat/33.0/33.0.cil
index 204048e..16babe7 100644
--- a/private/compat/33.0/33.0.cil
+++ b/private/compat/33.0/33.0.cil
@@ -2083,7 +2083,7 @@
(typeattributeset permission_checker_service_33_0 (permission_checker_service))
(typeattributeset permission_service_33_0 (permission_service))
(typeattributeset permissionmgr_service_33_0 (permissionmgr_service))
-(typeattributeset persist_debug_prop_33_0 (persist_debug_prop))
+(typeattributeset persist_debug_prop_33_0 (persist_debug_prop system_user_mode_emulation_prop))
(typeattributeset persist_vendor_debug_wifi_prop_33_0 (persist_vendor_debug_wifi_prop))
(typeattributeset persist_wm_debug_prop_33_0 (persist_wm_debug_prop))
(typeattributeset persistent_data_block_service_33_0 (persistent_data_block_service))
diff --git a/private/coredomain.te b/private/coredomain.te
index 23ad43a..7f0ca9d 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -63,6 +63,7 @@
-rs # spawned by appdomain, so carryover the exception above
-system_server
-traced_perf
+ userdebug_or_eng(`-overlay_remounter')
} vendor_app_file:dir { open read getattr search };
')
@@ -84,6 +85,7 @@
-system_server
-traced_perf
-mediaserver
+ userdebug_or_eng(`-overlay_remounter')
} vendor_app_file:file r_file_perms;
')
@@ -105,6 +107,7 @@
-webview_zygote
-zygote
-heapprofd
+ userdebug_or_eng(`-overlay_remounter')
} vendor_overlay_file:dir { getattr open read search };
')
@@ -127,6 +130,7 @@
-heapprofd
userdebug_or_eng(`-profcollectd')
userdebug_or_eng(`-simpleperf_boot')
+ userdebug_or_eng(`-overlay_remounter')
} vendor_overlay_file:file open;
')
diff --git a/private/crash_dump.te b/private/crash_dump.te
index a9a802c..4bd1d38 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -118,7 +118,10 @@
# A domain transition must occur for crash_dump to get the privileges needed to trace the process.
# Do not allow the execution of crash_dump without a domain transition.
-neverallow domain crash_dump_exec:file execute_no_trans;
+neverallow {
+ domain
+ userdebug_or_eng(`-overlay_remounter')
+} crash_dump_exec:file execute_no_trans;
# sigchld not explicitly forbidden since it's part of the
# domain-transition-on-exec macros, and is by itself not sensitive
diff --git a/private/crosvm.te b/private/crosvm.te
index a377e7a..6051992 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -223,6 +223,7 @@
-crosvm
-virtualizationmanager
-vmlauncher_app
+ userdebug_or_eng(`-overlay_remounter')
is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr')
} crosvm_exec:file no_x_file_perms;
diff --git a/private/dexopt_chroot_setup.te b/private/dexopt_chroot_setup.te
index 9e98bae..b4b35dd 100644
--- a/private/dexopt_chroot_setup.te
+++ b/private/dexopt_chroot_setup.te
@@ -76,6 +76,7 @@
system_file
system_lib_file
tmpfs
+ vendor_configs_file
vendor_file
}:dir mounton;
diff --git a/private/domain.te b/private/domain.te
index 684cc9e..8db40a5 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -430,6 +430,8 @@
allow domain task_profiles_file:file r_file_perms;
allow domain vendor_cgroup_desc_file:file r_file_perms;
allow domain vendor_task_profiles_file:file r_file_perms;
+allow domain libprocessgroup_metadata_file:dir r_dir_perms;
+allow domain libprocessgroup_metadata_file:file r_file_perms;
# Allow all domains to read sys.use_memfd to determine
# if memfd support can be used if device supports it
@@ -526,14 +528,9 @@
# still contains global information about the system.
neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_transaction_history:file no_rw_file_perms;
-# Allow access to fsverity keyring.
+# Needed for loading kernel modules.
+# TODO(384942085): Reduce the scope.
allow domain kernel:key search;
-# Allow access to keys in the fsverity keyring that were installed at boot.
-allow domain fsverity_init:key search;
-# For testing purposes, allow access to keys installed with su.
-userdebug_or_eng(`
- allow domain su:key search;
-')
# Allow access to linkerconfig file
allow domain linkerconfig_file:dir search;
@@ -592,6 +589,11 @@
# permission on /metadata dir
allow domain metadata_file:dir search;
+# overlayfs performs all file operations as the mounter, being overlay_remounter.
+# It thus opens files as overlay_remounter, and then uses those files in the context of
+# the caller, which is anyone accessing a file on a overlaid read-only partition
+userdebug_or_eng(`allow domain overlay_remounter:fd use');
+
###
### neverallow rules
###
@@ -702,7 +704,7 @@
# Do not allow renaming of block files or character files
# Ability to do so can lead to possible use in an exploit chain
# e.g. https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html
-neverallow * *:{ blk_file chr_file } rename;
+neverallow { domain userdebug_or_eng(`-overlay_remounter') } *:{ blk_file chr_file } rename;
# Don't allow raw read/write/open access to generic devices.
# Rather force a relabel to a more specific type.
@@ -737,16 +739,21 @@
domain
with_asan(`-asan_extract')
recovery_only(`userdebug_or_eng(`-fastbootd')')
+ userdebug_or_eng(`-kernel')
+ userdebug_or_eng(`-overlay_remounter')
} {
system_file_type
vendor_file_type
exec_type
}:dir_file_class_set { create write setattr relabelfrom append unlink link rename };
-neverallow { domain -kernel with_asan(`-asan_extract') } { system_file_type vendor_file_type exec_type }:dir_file_class_set relabelto;
+neverallow { domain -kernel with_asan(`-asan_extract') userdebug_or_eng(`-overlay_remounter') } { system_file_type vendor_file_type exec_type }:dir_file_class_set relabelto;
# Don't allow mounting on top of /system files or directories
-neverallow * exec_type:dir_file_class_set mounton;
+neverallow {
+ domain
+ userdebug_or_eng(`-overlay_remounter')
+} exec_type:dir_file_class_set mounton;
# Nothing should be writing to files in the rootfs.
neverallow * rootfs:file { create write setattr relabelto append unlink link rename };
@@ -758,9 +765,9 @@
# Ensure that context mount types are not writable, to ensure that
# the write to /system restriction above is not bypassed via context=
# mount to another type.
-neverallow * contextmount_type:dir_file_class_set
+neverallow { domain userdebug_or_eng(`-overlay_remounter') } contextmount_type:dir_file_class_set
{ create setattr relabelfrom relabelto append link rename };
-neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } contextmount_type:dir_file_class_set { write unlink };
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') userdebug_or_eng(`-overlay_remounter') } contextmount_type:dir_file_class_set { write unlink };
# Do not allow service_manager add for default service labels.
# Instead domains should use a more specific type such as
@@ -1147,6 +1154,7 @@
-init
-shell
-ueventd
+ userdebug_or_eng(`-overlay_remounter')
} vendor_shell_exec:file { execute execute_no_trans };
')
@@ -1201,6 +1209,7 @@
-shell
-system_executes_vendor_violators
-ueventd
+ userdebug_or_eng(`-overlay_remounter')
} {
vendor_file_type
-same_process_hal_file
@@ -1216,6 +1225,7 @@
coredomain
-shell
-system_executes_vendor_violators
+ userdebug_or_eng(`-overlay_remounter')
} {
vendor_file_type
-same_process_hal_file
@@ -1299,19 +1309,25 @@
# Do not mount on top of symlinks, fifos, or sockets.
# Feature parity with Chromium LSM.
-neverallow * { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
+neverallow {
+ domain
+ userdebug_or_eng(`-overlay_remounter')
+} { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
# Nobody should be able to execute su on user builds.
# On userdebug/eng builds, only dumpstate, shell, and
# su itself execute su.
-neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
+neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -overlay_remounter') } su_exec:file no_x_file_perms;
# Do not allow the introduction of new execmod rules. Text relocations
# and modification of executable pages are unsafe.
# The only exceptions are for NDK text relocations associated with
# https://code.google.com/p/android/issues/detail?id=23203
# which, long term, need to go away.
-neverallow * {
+neverallow {
+ domain
+ userdebug_or_eng(`-overlay_remounter')
+} {
file_type
-apk_data_file
-app_data_file
@@ -1325,7 +1341,12 @@
# Do not allow the introduction of new execmod rules. Text relocations
# and modification of executable pages are unsafe.
-neverallow { domain -untrusted_app_25 -untrusted_app_27 } file_type:file execmod;
+neverallow {
+ domain
+ -untrusted_app_25
+ -untrusted_app_27
+ userdebug_or_eng(`-overlay_remounter')
+} file_type:file execmod;
# Ensure that all types assigned to processes are included
# in the domain attribute, so that all allow and neverallow rules
@@ -1450,6 +1471,7 @@
-installd
-profman
-artd
+ userdebug_or_eng(`-overlay_remounter')
} profman_exec:file no_x_file_perms;
# Enforce restrictions on kernel module origin.
@@ -1517,6 +1539,7 @@
neverallow {
coredomain
-appdomain
+ userdebug_or_eng(`-overlay_remounter')
} {vendor_public_framework_file vendor_public_lib_file}:file { execute execute_no_trans };
')
@@ -1831,6 +1854,7 @@
-zygote
userdebug_or_eng(`-mediaextractor')
userdebug_or_eng(`-mediaswcodec')
+ userdebug_or_eng(`-overlay_remounter')
} {
file_type
-system_file_type
@@ -1906,6 +1930,7 @@
neverallow {
domain
-appdomain
+ userdebug_or_eng(`-overlay_remounter')
} {
data_file_type
-apex_art_data_file
@@ -1939,6 +1964,7 @@
vold
vold_prepare_subdirs
zygote
+ userdebug_or_eng(`overlay_remounter')
}')
neverallow ~dac_override_allowed self:global_capability_class_set dac_override;
# Since the kernel checks dac_read_search before dac_override, domains that
@@ -1967,6 +1993,7 @@
-update_engine
-vold
-zygote
+ userdebug_or_eng(`-overlay_remounter')
} { fs_type
-sdcard_type
-fusefs_type
@@ -2035,6 +2062,7 @@
userdebug_or_eng(`-simpleperf_boot')
-traced_perf
-ueventd
+ userdebug_or_eng(`-overlay_remounter')
} vendor_file:file { no_w_file_perms no_x_file_perms open };
')
@@ -2078,6 +2106,7 @@
-traced_perf # library/binary access for symbolization
-ueventd # reads /vendor/ueventd.rc
-vold # loads incremental fs driver
+ userdebug_or_eng(`-overlay_remounter')
} {
vendor_file_type
-same_process_hal_file
@@ -2111,7 +2140,16 @@
# Only init and otapreopt_chroot should be mounting filesystems on locations
# labeled system or vendor (/product and /vendor respectively).
-neverallow { domain -dexopt_chroot_setup -init -otapreopt_chroot } { system_file_type vendor_file_type }:dir_file_class_set mounton;
+neverallow {
+ domain
+ -dexopt_chroot_setup
+ -init
+ -otapreopt_chroot
+ userdebug_or_eng(`-overlay_remounter')
+} {
+ system_file_type
+ vendor_file_type
+}:dir_file_class_set mounton;
# Only allow init and vendor_init to read/write mm_events properties
# NOTE: dumpstate is allowed to read any system property
@@ -2122,18 +2160,24 @@
-dumpstate
} mm_events_config_prop:file no_rw_file_perms;
-# Allow the tracing daemon and callstack sampler to use kallsyms to symbolize
-# kernel traces. Addresses are not disclosed, they are repalced with symbol
-# names (if available). Traces don't disclose KASLR.
+# Allow init to open /proc/kallsyms while kernel address mappings are still
+# visible, and later share it with tracing daemons (traced_probes,
+# traced_perf). These daemons are allowed to read from the shared fd, but also
+# to separately open the file (which will always have zeroed out addresses due
+# to init raising kptr_restrict) for locking to coordinate access to the shared
+# fd. The performance traces contain only the referenced kernel symbols, and
+# never the raw addresses (i.e. KASLR is not disclosed).
+# On debuggable builds, performance tools are allowed to open and read the file
+# directly because init is allowed to temporarily unrestrict systemwide address
+# visibility.
neverallow {
domain
-init
- userdebug_or_eng(`-profcollectd')
- -vendor_init
- userdebug_or_eng(`-simpleperf_boot')
-traced_probes
-traced_perf
-} proc_kallsyms:file { open read };
+ userdebug_or_eng(`-profcollectd')
+ userdebug_or_eng(`-simpleperf_boot')
+} proc_kallsyms:file *;
# debugfs_kcov type is not included in this neverallow statement since the KCOV
# tool uses it for kernel fuzzing.
@@ -2265,5 +2309,26 @@
# ueventd needs write access to all sysfs files.
neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file no_w_file_perms;
-# We need to be able to rely on vsock labels, so disallow changing them.
-neverallow domain *:vsock_socket { relabelfrom relabelto };
+# virtmanager enforces access policy for which components can connect
+# to which VMs. If you have permissions to make direct connections, you
+# can talk to anything.
+starting_at_board_api(202504, `
+neverallow {
+ domain
+
+ # these are expected
+ -early_virtmgr
+ -virtualizationmanager
+ -virtualizationservice
+ -adbd_common # maybe should move to emulator/virtual device specific policy
+
+ # not expected, and defined outside of system/sepolicy.
+ # Note: this attribute is strongly recommended to be empty if not required.
+ -unconstrained_vsock_violators
+
+ # these are permissions that should be removed, and they are here for visibility.
+ -compos_fd_server # TODO: get connections from virtmanager
+ -hal_keymint_system # TODO: get connections from virtmanager
+ -vmlauncher_app # TODO: get connections from virtmanager
+} *:vsock_socket { connect create accept bind };
+')
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 5e3bce5..501d829 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -347,6 +347,7 @@
dump_hal(hal_sensors)
dump_hal(hal_thermal)
dump_hal(hal_vehicle)
+dump_hal(hal_vm_capabilities)
dump_hal(hal_weaver)
dump_hal(hal_wifi)
@@ -394,6 +395,7 @@
# Read files in /proc
allow dumpstate {
+ proc_allocinfo
proc_bootconfig
proc_buddyinfo
proc_cmdline
@@ -461,6 +463,7 @@
-hal_service_type
-virtual_touchpad_service
-vold_service
+ -fwk_vold_service
-default_android_service
}:service_manager find;
# suppress denials for services dumpstate should not be accessing.
@@ -471,6 +474,7 @@
hal_service_type
virtual_touchpad_service
vold_service
+ fwk_vold_service
}:service_manager find;
# Most of these are neverallowed.
@@ -539,6 +543,9 @@
vm_data_file
}:dir getattr;
+#suppress denials for dumpstate to call vitualizationservice.
+dontaudit dumpstate virtualizationservice:binder { call };
+
# Allow dumpstate to talk to bufferhubd over binder
binder_call(dumpstate, bufferhubd);
diff --git a/private/file.te b/private/file.te
index 189fb47..6bdcc39 100644
--- a/private/file.te
+++ b/private/file.te
@@ -1,3 +1,6 @@
+# /proc/allocinfo
+type proc_allocinfo, fs_type, proc_type;
+
# /proc/config.gz
type config_gz, fs_type, proc_type;
@@ -189,6 +192,9 @@
# /sys/firmware/acpi/tables
type sysfs_firmware_acpi_tables, fs_type, sysfs_type;
+# Type for /system/bin/pbtombstone.
+type pbtombstone_exec, system_file_type, exec_type, file_type;
+
# Allow files to be created in their appropriate filesystems.
allow fs_type self:filesystem associate;
allow cgroup tmpfs:filesystem associate;
@@ -228,6 +234,9 @@
# /metadata/prefetch files
type prefetch_metadata_file, file_type;
+# /metadata/libprocessgroup files
+type libprocessgroup_metadata_file, file_type;
+
# Types added in 202504 in public/file.te
until_board_api(202504, `
type binderfs_logs_transactions, fs_type;
@@ -256,5 +265,8 @@
type tee_service_contexts_file, system_file_type, file_type;
')
-## END Types added in 202504 in public/file.te
+until_board_api(202504, `
+ type sysfs_mem_sleep, fs_type, sysfs_type;
+')
+## END Types added in 202504 in public/file.te
diff --git a/private/file_contexts b/private/file_contexts
index d6f7113..0b3e7f4 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -256,7 +256,6 @@
/system/bin/init u:object_r:init_exec:s0
# TODO(/123600489): merge mini-keyctl into toybox
/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
-/system/bin/fsverity_init u:object_r:fsverity_init_exec:s0
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
@@ -354,6 +353,7 @@
/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
/system/bin/blkid u:object_r:blkid_exec:s0
+/system/bin/pbtombstone u:object_r:pbtombstone_exec:s0
/system/bin/flags_health_check -- u:object_r:flags_health_check_exec:s0
/system/bin/idmap2(d)? u:object_r:idmap_exec:s0
/system/bin/update_engine u:object_r:update_engine_exec:s0
@@ -365,6 +365,7 @@
/system/bin/virtual_camera u:object_r:virtual_camera_exec:s0
/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
/system/bin/hw/android\.system\.suspend-service u:object_r:system_suspend_exec:s0
+/system/bin/memcgv2_activation_depth\.sh u:object_r:memcgv2_activation_depth_exec:s0
/system/etc/aconfig(/.*)? u:object_r:system_aconfig_storage_file:s0
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
/system/etc/task_profiles/cgroups_[0-9]+\.json u:object_r:cgroup_desc_file:s0
@@ -902,6 +903,7 @@
/metadata/aconfig/flags(/.*)? u:object_r:aconfig_storage_flags_metadata_file:s0
/metadata/tradeinmode(/.*)? u:object_r:tradeinmode_metadata_file:s0
/metadata/prefetch(/.*)? u:object_r:prefetch_metadata_file:s0
+/metadata/libprocessgroup(/.*)? u:object_r:libprocessgroup_metadata_file:s0
############################
# mount point for ota metadata
@@ -951,3 +953,7 @@
#############################
# For early boot VM
/mnt/vm u:object_r:vm_data_file:s0
+
+#############################
+# For overlays
+/second_stage_resources/overlay_remounter u:object_r:overlay_remounter_exec:s0
diff --git a/private/fsverity_init.te b/private/fsverity_init.te
deleted file mode 100644
index a3765ec..0000000
--- a/private/fsverity_init.te
+++ /dev/null
@@ -1,16 +0,0 @@
-type fsverity_init, domain, coredomain;
-type fsverity_init_exec, exec_type, file_type, system_file_type;
-
-init_daemon_domain(fsverity_init)
-
-# Allow to read /proc/keys for searching key id.
-allow fsverity_init proc_keys:file r_file_perms;
-
-# Ignore denials to access irrelevant keys, as a side effect to access /proc/keys.
-dontaudit fsverity_init domain:key view;
-allow fsverity_init kernel:key { view search write setattr };
-allow fsverity_init fsverity_init:key { view search write };
-
-# Read the on-device signing certificate, to be able to add it to the keyring
-allow fsverity_init odsign:fd use;
-allow fsverity_init odsign_data_file:file { getattr read };
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 3ff1012..a872a04 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -2,6 +2,7 @@
genfscon rootfs / u:object_r:rootfs:s0
# proc labeling can be further refined (longest matching prefix).
genfscon proc / u:object_r:proc:s0
+genfscon proc /allocinfo u:object_r:proc_allocinfo:s0
genfscon proc /asound u:object_r:proc_asound:s0
genfscon proc /bootconfig u:object_r:proc_bootconfig:s0
genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
@@ -168,6 +169,9 @@
genfscon sysfs /kernel/dma_heap u:object_r:sysfs_dma_heap:s0
genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0
genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
+starting_at_board_api(202504, `
+genfscon sysfs /kernel/mm/cma u:object_r:sysfs_cma:s0
+')
genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0
genfscon sysfs /kernel/mm/lru_gen/enabled u:object_r:sysfs_lru_gen_enabled:s0
genfscon sysfs /kernel/mm/pgsize_migration/enabled u:object_r:sysfs_pgsize_migration:s0
diff --git a/private/hal_vm_capabilities.te b/private/hal_vm_capabilities.te
new file mode 100644
index 0000000..3197784
--- /dev/null
+++ b/private/hal_vm_capabilities.te
@@ -0,0 +1,9 @@
+# Domain for the VM capability HAL, which is used to allow some pVMs to issue
+# vendor-specific SMCs.
+
+binder_call(hal_vm_capabilities_client, hal_vm_capabilities_server)
+
+hal_attribute_service(hal_vm_capabilities, hal_vm_capabilities_service)
+
+binder_use(hal_vm_capabilities_client)
+binder_use(hal_vm_capabilities_server)
diff --git a/private/incident.te b/private/incident.te
index db9ae86..19db7d7 100644
--- a/private/incident.te
+++ b/private/incident.te
@@ -34,4 +34,14 @@
allow incident incidentd:fifo_file write;
# only allow incident being called by shell or dumpstate
-neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };
+neverallow {
+ domain
+ -su
+ -shell
+ -incident
+ -dumpstate
+ userdebug_or_eng(`-overlay_remounter')
+} incident_exec:file {
+ execute
+ execute_no_trans
+};
diff --git a/private/incident_helper.te b/private/incident_helper.te
index b453855..cdaf144 100644
--- a/private/incident_helper.te
+++ b/private/incident_helper.te
@@ -11,4 +11,13 @@
allow incident_helper incidentd:unix_stream_socket { read write };
# only allow incidentd and shell to call incident_helper
-neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };
+neverallow {
+ domain
+ -incidentd
+ -incident_helper
+ -shell
+ userdebug_or_eng(`-overlay_remounter')
+} incident_helper_exec:file {
+ execute
+ execute_no_trans
+};
diff --git a/private/incidentd.te b/private/incidentd.te
index bf98d31..11da9ea 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -25,6 +25,9 @@
# section id 1116, allow accessing statsd socket
unix_socket_send(incidentd, statsdw, statsd)
+# section id 1116, allow using userfaultfd
+userfaultfd_use(incidentd)
+
# section id 2001, allow reading /proc/pagetypeinfo
allow incidentd proc_pagetypeinfo:file r_file_perms;
diff --git a/private/init.te b/private/init.te
index 012ef0b..6f0ee80 100644
--- a/private/init.te
+++ b/private/init.te
@@ -68,6 +68,12 @@
allow init self:perf_event { open cpu };
allow init self:global_capability2_class_set perfmon;
+# Allow opening /proc/kallsyms so that on boot, init can create and retain an
+# fd with the full address visibility (which is evaluated on open and persists
+# for the lifetime of the open file description). This fd can then be shared
+# with other privileged processes.
+allow init proc_kallsyms:file r_file_perms;
+
# Allow init to communicate with snapuserd to transition Virtual A/B devices
# from the first-stage daemon to the second-stage.
allow init snapuserd_socket:sock_file write;
@@ -533,6 +539,7 @@
allow init {
proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
+ proc_allocinfo
proc_bootconfig
proc_cmdline
proc_diskstats
@@ -568,6 +575,7 @@
# init chmod/chown access to /proc files.
allow init {
+ proc_allocinfo
proc_cmdline
proc_bootconfig
proc_kmsg
@@ -806,7 +814,7 @@
# The init domain is only entered via an exec based transition from the
# kernel domain, never via setcon().
neverallow domain init:process dyntransition;
-neverallow { domain -kernel } init:process transition;
+neverallow { domain -kernel userdebug_or_eng(`-overlay_remounter') } init:process transition;
neverallow init { file_type fs_type -init_exec }:file entrypoint;
# Never read/follow symlinks created by shell or untrusted apps.
diff --git a/private/kernel.te b/private/kernel.te
index 1b82c66..0d3aa77 100644
--- a/private/kernel.te
+++ b/private/kernel.te
@@ -2,6 +2,9 @@
domain_auto_trans(kernel, init_exec, init)
domain_auto_trans(kernel, snapuserd_exec, snapuserd)
+userdebug_or_eng(`
+ domain_auto_trans(kernel, overlay_remounter_exec, overlay_remounter)
+')
# Allow the kernel to read otapreopt_chroot's file descriptors and files under
# /postinstall, as it uses apexd logic to mount APEX packages in /postinstall/apex.
@@ -150,6 +153,15 @@
# required by VTS lidbm unit test
allow kernel appdomain_tmpfs:file { read write };
+# Allow first stage init to copy and then launch overlay_remounter
+userdebug_or_eng(`
+ allow kernel tmpfs:dir rw_dir_perms;
+ allow kernel tmpfs:file { create_file_perms relabelfrom };
+ allow kernel overlay_remounter_exec:file { relabelto unlink };
+ allow kernel overlay_remounter:process2 nosuid_transition;
+ allow kernel overlay_remounter:process share;
+')
+
dontaudit kernel metadata_file:dir search;
dontaudit kernel ota_metadata_file:dir rw_dir_perms;
dontaudit kernel sysfs:dir r_dir_perms;
diff --git a/private/keystore.te b/private/keystore.te
index 014903e..41c29db 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -39,7 +39,7 @@
# can call keystore methods on those references.
allow keystore vold:binder transfer;
-set_prop(keystore, keystore_crash_prop)
+set_prop(keystore, keystore_diagnostics_prop)
# Allow keystore to monitor the `apexd.status` property.
get_prop(keystore, apexd_prop)
@@ -102,6 +102,6 @@
neverallow * keystore:process ptrace;
-# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
-# system property, an exception is added for init as well.
-neverallow { domain -keystore -init } keystore_crash_prop:property_service set;
+# Only keystore can set keystore_diagnostics_prop system properties. Since init is allowed to set
+# any system property, an exception is added for init as well.
+neverallow { domain -keystore -init } keystore_diagnostics_prop:property_service set;
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
index ce26fd2..5459c1d 100644
--- a/private/linkerconfig.te
+++ b/private/linkerconfig.te
@@ -36,4 +36,5 @@
-init
-linkerconfig
-otapreopt_chroot
+ userdebug_or_eng(`-overlay_remounter')
} linkerconfig_exec:file no_x_file_perms;
diff --git a/private/memcgv2_activation_depth.te b/private/memcgv2_activation_depth.te
new file mode 100644
index 0000000..80378d3
--- /dev/null
+++ b/private/memcgv2_activation_depth.te
@@ -0,0 +1,26 @@
+# The memcgv2_activation_depth.sh script run by init.
+
+type memcgv2_activation_depth, domain, coredomain;
+type memcgv2_activation_depth_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(memcgv2_activation_depth)
+
+# required permissions to run the script from init
+allow memcgv2_activation_depth shell_exec:file rx_file_perms;
+allow memcgv2_activation_depth system_file:file x_file_perms;
+allow memcgv2_activation_depth toolbox_exec:file rx_file_perms;
+
+# for system default max activation depth
+allow memcgv2_activation_depth cgroup_desc_file:file r_file_perms;
+
+# /metadata/libprocessgroup/*
+allow memcgv2_activation_depth libprocessgroup_metadata_file:dir rw_dir_perms;
+allow memcgv2_activation_depth libprocessgroup_metadata_file:file create_file_perms;
+
+# /sys/fs/cgroup/cgroup.controllers
+# /sys/fs/cgroup/**/cgroup.subtree_control
+allow memcgv2_activation_depth cgroup_v2:dir r_dir_perms;
+allow memcgv2_activation_depth cgroup_v2:file rw_file_perms;
+
+# For reboot, when reducing the depth override
+set_prop(memcgv2_activation_depth, powerctl_prop)
diff --git a/private/mmd.te b/private/mmd.te
index 90510f1..fec356e 100644
--- a/private/mmd.te
+++ b/private/mmd.te
@@ -6,7 +6,8 @@
init_daemon_domain(mmd)
# Set mmd.enabled_aconfig properties.
-set_prop(mmd, mmd_prop)
+set_prop(mmd, mmd_status_prop)
+get_prop(mmd, mmd_prop)
get_prop(mmd, device_config_mmd_native_prop)
# mmd binder setup
@@ -29,3 +30,6 @@
# swapon syscall
allow mmd self:capability sys_admin;
+
+# Allow mmd to write to statsd socket.
+unix_socket_send(mmd, statsdw, statsd)
diff --git a/private/netd.te b/private/netd.te
index 8b6ea4c..3b3c697 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -48,7 +48,7 @@
allow netd system_server:fd use;
-allow netd self:global_capability_class_set { net_admin net_raw kill };
+allow netd self:global_capability_class_set { net_admin net_raw net_bind_service kill };
# Note: fsetid is deliberately not included above. fsetid checks are
# triggered by chmod on a directory or file owned by a group other
# than one of the groups assigned to the current process to see if
diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
index 37a2c47..28766dd 100644
--- a/private/netutils_wrapper.te
+++ b/private/netutils_wrapper.te
@@ -50,4 +50,4 @@
# netutils wrapper may only use the following capabilities.
neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
-neverallow domain netutils_wrapper_exec:file execute_no_trans;
+neverallow { domain userdebug_or_eng(`-overlay_remounter') } netutils_wrapper_exec:file execute_no_trans;
diff --git a/private/network_stack.te b/private/network_stack.te
index 4450e02..8a07245 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -51,6 +51,10 @@
# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
dontaudit network_stack self:key_socket getopt;
+# Allow network_stack to open/read/getattr various /proc/net files
+# (includes /proc/net/{anycast6,igmp,psched} /proc/sys/net/ipv4/ip_default_ttl)
+r_dir_file(network_stack, proc_net_type)
+
# Grant read permission of connectivity namespace system property prefix.
get_prop(network_stack, device_config_connectivity_prop)
diff --git a/private/odsign.te b/private/odsign.te
index f06795c..4af0708 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -51,9 +51,6 @@
# Run odrefresh to refresh ART artifacts
domain_auto_trans(odsign, odrefresh_exec, odrefresh)
-# Run fsverity_init to add key to fsverity keyring
-domain_auto_trans(odsign, fsverity_init_exec, fsverity_init)
-
# Run compos_verify to verify CompOs signatures
domain_auto_trans(odsign, compos_verify_exec, compos_verify)
@@ -65,5 +62,5 @@
set_prop(odsign, ctl_odsign_prop)
# Neverallows
-neverallow { domain -odsign -init -fsverity_init} odsign_data_file:dir ~search;
-neverallow { domain -odsign -init -fsverity_init} odsign_data_file:file *;
+neverallow { domain -odsign -init} odsign_data_file:dir ~search;
+neverallow { domain -odsign -init} odsign_data_file:file *;
diff --git a/private/overlay_remounter.te b/private/overlay_remounter.te
new file mode 100644
index 0000000..12f7b0d
--- /dev/null
+++ b/private/overlay_remounter.te
@@ -0,0 +1,47 @@
+# Domain used for overlay_remounter process
+
+# All types must be defined regardless of build variant to ensure
+# policy compilation succeeds with userdebug/user combination at boot
+type overlay_remounter, domain, coredomain;
+
+# File types must be defined for file_contexts.
+type overlay_remounter_exec, system_file_type, exec_type, file_type;
+
+userdebug_or_eng(`
+ domain_auto_trans(overlay_remounter, init_exec, init)
+
+ allow overlay_remounter init:process share;
+ allow overlay_remounter init:process2 nosuid_transition;
+ allow overlay_remounter kernel:fd use;
+ allow overlay_remounter tmpfs:chr_file { open read write };
+ allow overlay_remounter labeledfs:filesystem { mount unmount };
+ allow overlay_remounter overlayfs_file:chr_file { unlink create link rename };
+ allow overlay_remounter overlayfs_file:dir create_dir_perms;
+ allow overlay_remounter overlayfs_file:file { create open rename unlink write };
+ allow overlay_remounter self:capability { chown fowner sys_admin dac_override dac_read_search };
+ allow overlay_remounter unlabeled:dir { rmdir search };
+ use_bootstrap_libs(overlay_remounter)
+
+ # overlay_remounter must be able to perform all possible operations
+ # on the overlaid partitions
+ allow overlay_remounter {
+ system_dlkm_file_type
+ vendor_file_type
+ system_file_type
+ adb_keys_file
+ }:{ file } ~{ entrypoint };
+
+ allow overlay_remounter {
+ system_dlkm_file_type
+ vendor_file_type
+ system_file_type
+ adb_keys_file
+ }:chr_file unlink;
+
+ allow overlay_remounter {
+ system_dlkm_file_type
+ vendor_file_type
+ system_file_type
+ adb_keys_file
+ }:{ dir lnk_file } *;
+')
diff --git a/private/platform_app.te b/private/platform_app.te
index e60dcdd..38339da 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -43,7 +43,7 @@
userdebug_or_eng(`
set_prop(platform_app, persist_wm_debug_prop)
')
-neverallow { domain -init -dumpstate userdebug_or_eng(`-domain') } persist_wm_debug_prop:property_service set;
+neverallow { domain -init -dumpstate -system_server userdebug_or_eng(`-domain') } persist_wm_debug_prop:property_service set;
userdebug_or_eng(`
set_prop(platform_app, persist_sysui_builder_extras_prop)
@@ -144,6 +144,9 @@
# Allow platform apps to create VMs
virtualizationservice_use(platform_app)
+# Allow platform apps to read files and directories under /data/system/shutdown-checkpoints/
+r_dir_file(platform_app, shutdown_checkpoints_system_data_file)
+
###
### Neverallow rules
###
diff --git a/private/property.te b/private/property.te
index 92e244d..cd87e7a 100644
--- a/private/property.te
+++ b/private/property.te
@@ -30,13 +30,13 @@
system_internal_prop(init_storage_prop)
system_internal_prop(init_svc_debug_prop)
system_internal_prop(kcmdline_prop)
-system_internal_prop(keystore_crash_prop)
+system_internal_prop(keystore_diagnostics_prop)
system_internal_prop(keystore_listen_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(localization_prop)
system_internal_prop(logd_auditrate_prop)
system_internal_prop(lower_kptr_restrict_prop)
-system_internal_prop(mmd_prop)
+system_internal_prop(mmd_status_prop)
system_internal_prop(net_464xlat_fromvendor_prop)
system_internal_prop(net_connectivity_prop)
system_internal_prop(netd_stable_secret_prop)
@@ -57,7 +57,9 @@
system_internal_prop(system_adbd_prop)
system_internal_prop(system_audio_config_prop)
system_internal_prop(timezone_metadata_prop)
+system_internal_prop(traced_config_prop)
system_internal_prop(traced_perf_enabled_prop)
+system_internal_prop(traced_relay_relay_port_prop)
system_internal_prop(uprobestats_start_with_config_prop)
system_internal_prop(tuner_server_ctl_prop)
system_internal_prop(userspace_reboot_log_prop)
@@ -77,7 +79,7 @@
system_internal_prop(system_service_enable_prop)
system_internal_prop(ctl_artd_pre_reboot_prop)
system_internal_prop(trusty_security_vm_sys_prop)
-
+system_internal_prop(hint_manager_config_prop)
# Properties which can't be written outside system
system_restricted_prop(bionic_linker_16kb_app_compat_prop)
@@ -111,6 +113,8 @@
# Properties which should only be written by vendor_init
system_vendor_config_prop(avf_virtualizationservice_prop)
system_vendor_config_prop(high_barometer_quality_prop)
+system_vendor_config_prop(mmd_prop)
+system_vendor_config_prop(mmd_shared_prop)
system_vendor_config_prop(prefetch_boot_prop)
system_vendor_config_prop(widevine_sys_vendor_prop)
diff --git a/private/property_contexts b/private/property_contexts
index ace1470..56d9127 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -52,6 +52,7 @@
service.adb.root u:object_r:shell_prop:s0
service.adb.tls.port u:object_r:adbd_prop:s0
persist.adb.tradeinmode u:object_r:adbd_tradeinmode_prop:s0
+persist.adb.test_tradeinmode u:object_r:adbd_tradeinmode_prop:s0
persist.adb.wifi. u:object_r:adbd_prop:s0
persist.adb.tls_server.enable u:object_r:system_adbd_prop:s0
@@ -87,6 +88,9 @@
persist.security. u:object_r:system_prop:s0
persist.traced.enable u:object_r:traced_enabled_prop:s0
traced.lazy. u:object_r:traced_lazy_prop:s0
+traced_relay.relay_port u:object_r:traced_relay_relay_port_prop:s0
+ro.traced. u:object_r:traced_config_prop:s0
+traced.relay_producer_port u:object_r:traced_config_prop:s0
persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
persist.traced_perf.enable u:object_r:traced_perf_enabled_prop:s0
uprobestats.start_with_config u:object_r:uprobestats_start_with_config_prop:s0
@@ -250,7 +254,8 @@
traced.oome_heap_session.count u:object_r:traced_oome_heap_session_count_prop:s0 exact uint
# servicemanager properties
-servicemanager.ready u:object_r:servicemanager_prop:s0 exact bool
+servicemanager.ready u:object_r:servicemanager_prop:s0 exact bool
+servicemanager.installed u:object_r:servicemanager_prop:s0 exact bool
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
@@ -367,9 +372,9 @@
ro.prefetch_boot.duration_s u:object_r:prefetch_boot_prop:s0 exact int
ro.prefetch_boot.io_depth u:object_r:prefetch_boot_prop:s0 exact int
ro.prefetch_boot.max_fds u:object_r:prefetch_boot_prop:s0 exact int
-ro.prefetch_boot.record_stop u:object_r:prefetch_boot_prop:s0 exact bool
# Prefetch property to start and stop the record/replay
prefetch_boot.record u:object_r:prefetch_service_prop:s0 exact bool
+prefetch_boot.record_stop u:object_r:prefetch_boot_prop:s0 exact bool
prefetch_boot.replay u:object_r:prefetch_service_prop:s0 exact bool
# Virtual A/B and snapuserd properties
@@ -621,6 +626,7 @@
persist.bluetooth.btsnoopdefaultmode u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
persist.bluetooth.btsnooplogmode u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
persist.bluetooth.finder.supported u:object_r:bluetooth_finder_prop:s0 exact bool
+persist.bluetooth.sniff_offload.enabled u:object_r:bluetooth_config_prop:s0 exact bool
persist.bluetooth.snooplogfilter.headers.enabled u:object_r:bluetooth_prop:s0 exact bool
persist.bluetooth.snooplogfilter.profiles.a2dp.enabled u:object_r:bluetooth_prop:s0 exact bool
persist.bluetooth.snooplogfilter.profiles.map u:object_r:bluetooth_prop:s0 exact enum empty disabled fullfilter header magic
@@ -715,6 +721,7 @@
bluetooth.core.le.connection_scan_window_slow u:object_r:bluetooth_config_prop:s0 exact uint
bluetooth.core.le.inquiry_scan_interval u:object_r:bluetooth_config_prop:s0 exact uint
bluetooth.core.le.inquiry_scan_window u:object_r:bluetooth_config_prop:s0 exact uint
+bluetooth.core.le.msft_vendor_opcode u:object_r:bluetooth_config_prop:s0 exact uint
bluetooth.core.le.vendor_capabilities.enabled u:object_r:bluetooth_config_prop:s0 exact bool
bluetooth.hfp.software_datapath.enabled u:object_r:bluetooth_config_prop:s0 exact bool
@@ -776,6 +783,7 @@
ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+ro.bluetooth.leaudio_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
@@ -800,6 +808,7 @@
ro.crypto.dm_default_key.options_format.version u:object_r:vold_config_prop:s0 exact int
ro.crypto.fde_algorithm u:object_r:vold_config_prop:s0 exact string
ro.crypto.fde_sector_size u:object_r:vold_config_prop:s0 exact int
+ro.crypto.hw_wrapped_keys.kdf u:object_r:vold_config_prop:s0 exact string
ro.crypto.metadata_init_delete_all_keys.enabled u:object_r:vold_config_prop:s0 exact bool
ro.crypto.scrypt_params u:object_r:vold_config_prop:s0 exact string
ro.crypto.set_dun u:object_r:vold_config_prop:s0 exact bool
@@ -1604,8 +1613,11 @@
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
-# Property that tracks keystore crash counts during a boot cycle.
-keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
+# Tracks keystore crash counts during a boot cycle.
+keystore.crash_count u:object_r:keystore_diagnostics_prop:s0 exact int
+
+# Tracks whether Keystore has successfully sent the module info hash to (V4+) KeyMints.
+keystore.module_hash.sent u:object_r:keystore_diagnostics_prop:s0 exact bool
# Configure the means by which we protect the L0 key from the future
ro.keystore.boot_level_key.strategy u:object_r:keystore_config_prop:s0 exact string
@@ -1717,7 +1729,7 @@
persist.vendor.fingerprint.virtual.sensor_id u:object_r:virtual_fingerprint_prop:s0 exact int
persist.vendor.fingerprint.virtual.sensor_strength u:object_r:virtual_fingerprint_prop:s0 exact int
persist.vendor.fingerprint.virtual.max_enrollments u:object_r:virtual_fingerprint_prop:s0 exact int
-persist.vendor.fingerprint.virtual.navigation_guesture u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.navigation_gesture u:object_r:virtual_fingerprint_prop:s0 exact bool
persist.vendor.fingerprint.virtual.detect_interaction u:object_r:virtual_fingerprint_prop:s0 exact bool
persist.vendor.fingerprint.virtual.udfps.display_touch u:object_r:virtual_fingerprint_prop:s0 exact bool
persist.vendor.fingerprint.virtual.udfps.control_illumination u:object_r:virtual_fingerprint_prop:s0 exact bool
@@ -1764,6 +1776,13 @@
# Properties for game manager service
persist.graphics.game_default_frame_rate.enabled u:object_r:game_manager_config_prop:s0 exact bool
+# Properties for the HintManagerService
+persist.hms.use_hal_headrooms u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_tid u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_affinity u:object_r:hint_manager_config_prop:s0 exact bool
+persist.hms.check_headroom_proc_stat_min_millis u:object_r:hint_manager_config_prop:s0 exact int
+persist.hms.cpu_headroom_tid_max_cnt u:object_r:hint_manager_config_prop:s0 exact int
+
# Properties for ThreadNetworkService
threadnetwork.country_code u:object_r:threadnetwork_config_prop:s0 exact string
@@ -1803,4 +1822,5 @@
# Properties for mmd
mmd. u:object_r:mmd_prop:s0
-mmd.enabled_aconfig u:object_r:mmd_prop:s0 exact bool
+mmd.zram.enabled u:object_r:mmd_shared_prop:s0 exact bool
+mmd.enabled_aconfig u:object_r:mmd_status_prop:s0 exact bool
diff --git a/private/runas_app.te b/private/runas_app.te
index 9142a19..88b4abb 100644
--- a/private/runas_app.te
+++ b/private/runas_app.te
@@ -17,9 +17,6 @@
allow runas_app untrusted_app_all:process { ptrace sigkill signal sigstop };
allow runas_app untrusted_app_all:unix_stream_socket connectto;
-# Allow executing system image simpleperf without a domain transition.
-allow runas_app simpleperf_exec:file rx_file_perms;
-
# Suppress denial logspam when simpleperf is trying to find a matching process
# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
# the same domain as their respective process, most of which this domain is not
@@ -28,8 +25,8 @@
# Allow runas_app to call perf_event_open for profiling debuggable app
# processes, but not the whole system.
-allow runas_app self:perf_event { open read write kernel };
-neverallow runas_app self:perf_event ~{ open read write kernel };
+allow runas_app self:perf_event { open read write };
+neverallow runas_app self:perf_event ~{ open read write };
# Suppress bionic loader denial /data/local/tests directories.
dontaudit runas_app shell_test_data_file:dir search;
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 25ed1ba..1a4d944 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -221,6 +221,4 @@
user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
user=_app fromRunAs=true domain=runas_app levelFrom=user
-user=_app isPrivApp=true name=com.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
-user=_app isPrivApp=true name=com.google.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
user=_app isPrivApp=true name=com.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
diff --git a/private/service.te b/private/service.te
index a90b3ba..ab9351c 100644
--- a/private/service.te
+++ b/private/service.te
@@ -20,7 +20,7 @@
type mmd_service, service_manager_type;
type on_device_intelligence_service, app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
type profcollectd_service, service_manager_type;
-type protolog_configuration_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type protolog_configuration_service, app_api_service, system_api_service, system_server_service, service_manager_type, ephemeral_app_api_service;
type resolver_service, system_server_service, service_manager_type;
type rkpd_registrar_service, service_manager_type;
type rkpd_refresh_service, service_manager_type;
@@ -60,14 +60,20 @@
')
type uce_service, service_manager_type;
+type fwk_vold_service, service_manager_type;
type wearable_sensing_service, app_api_service, system_server_service, service_manager_type;
type wifi_mainline_supplicant_service, service_manager_type;
type dynamic_instrumentation_service, app_api_service, system_server_service, service_manager_type;
+type advanced_protection_service, app_api_service, system_server_service, service_manager_type;
is_flag_enabled(RELEASE_RANGING_STACK, `
type ranging_service, app_api_service, system_server_service, service_manager_type;
')
+until_board_api(202504, `
+ type hal_vm_capabilities_service, protected_service, hal_service_type, service_manager_type;
+')
+
###
### Neverallow rules
###
diff --git a/private/service_contexts b/private/service_contexts
index 2e050eb..dec8f6b 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -32,6 +32,7 @@
android.hardware.biometrics.fingerprint.IFingerprint/virtual u:object_r:hal_fingerprint_service:s0
android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual u:object_r:hal_fingerprint_service:s0
android.hardware.bluetooth.IBluetoothHci/default u:object_r:hal_bluetooth_service:s0
+android.hardware.bluetooth.offload.leaudio.IHciProxy/default u:object_r:hal_bluetooth_service:s0
android.hardware.bluetooth.finder.IBluetoothFinder/default u:object_r:hal_bluetooth_service:s0
is_flag_enabled(RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE, `
android.hardware.bluetooth.ranging.IBluetoothChannelSounding/default u:object_r:hal_bluetooth_service:s0
@@ -138,9 +139,12 @@
android.hardware.secure_element.ISecureElement/SIM3 u:object_r:hal_secure_element_service:s0
android.hardware.security.secretkeeper.ISecretkeeper/default u:object_r:hal_secretkeeper_service:s0
android.hardware.security.secretkeeper.ISecretkeeper/nonsecure u:object_r:hal_secretkeeper_service:s0
+android.hardware.virtualization.capabilities.IVmCapabilitiesService/default u:object_r:hal_vm_capabilities_service:s0
+android.hardware.virtualization.capabilities.IVmCapabilitiesService/noop u:object_r:hal_vm_capabilities_service:s0
android.system.keystore2.IKeystoreService/default u:object_r:keystore_service:s0
android.system.net.netd.INetd/default u:object_r:system_net_netd_service:s0
android.system.suspend.ISystemSuspend/default u:object_r:hal_system_suspend_service:s0
+android.system.vold.IVold/default u:object_r:fwk_vold_service:s0
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
@@ -148,9 +152,7 @@
activity_task u:object_r:activity_task_service:s0
adb u:object_r:adb_service:s0
adservices_manager u:object_r:adservices_manager_service:s0
-starting_at_board_api(202504, `
- advanced_protection u:object_r:advanced_protection_service:s0
-')
+advanced_protection u:object_r:advanced_protection_service:s0
aidl_lazy_test_1 u:object_r:aidl_lazy_test_service:s0
aidl_lazy_test_2 u:object_r:aidl_lazy_test_service:s0
aidl_lazy_test_quit u:object_r:aidl_lazy_test_service:s0
@@ -278,9 +280,6 @@
file_integrity u:object_r:file_integrity_service:s0
fingerprint u:object_r:fingerprint_service:s0
font u:object_r:font_service:s0
-starting_at_board_api(202504, `
- forensic u:object_r:forensic_service:s0
-')
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
game u:object_r:game_service:s0
gfxinfo u:object_r:gfxinfo_service:s0
diff --git a/private/shell.te b/private/shell.te
index 890d6f4..3e45e1f 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -142,7 +142,7 @@
# Allow shell to call perf_event_open for profiling other shell processes, but
# not the whole system.
-allow shell self:perf_event { open read write kernel };
+allow shell self:perf_event { open read write };
# Allow shell to read microdroid vendor image
r_dir_file(shell, vendor_microdroid_file)
@@ -444,6 +444,9 @@
# Allow reads (but not writes) of the MGLRU state
allow shell sysfs_lru_gen_enabled:file r_file_perms;
+# Allow reads (but not writes) of mem_sleep to determine suspend mechanism
+allow shell sysfs_mem_sleep:file r_file_perms;
+
# Allow communicating with the VM terminal.
userdebug_or_eng(`
allow shell vmlauncher_app_devpts:chr_file rw_file_perms;
diff --git a/private/simpleperf.te b/private/simpleperf.te
index 9c70060..46769cb 100644
--- a/private/simpleperf.te
+++ b/private/simpleperf.te
@@ -14,14 +14,13 @@
untrusted_app_all
}')
-domain_auto_trans({ simpleperf_profileable_apps -runas_app }, simpleperf_exec, simpleperf)
+domain_auto_trans(simpleperf_profileable_apps, simpleperf_exec, simpleperf)
# When running in this domain, simpleperf is scoped to profiling an individual
# app. The necessary MAC permissions for profiling are more maintainable and
# consistent if simpleperf is marked as an app domain as well (as, for example,
# it will then see the same set of system libraries as the app).
app_domain(simpleperf)
-untrusted_app_domain(simpleperf)
# Allow ptrace attach to the target app, for reading JIT debug info (using
# process_vm_readv) during unwinding and symbolization.
@@ -45,7 +44,23 @@
# not allowed to see.
dontaudit simpleperf domain:dir search;
+# Allow simpleperf to read apk files and libraries executed by the app.
+r_dir_file(simpleperf, privapp_data_file);
+r_dir_file(simpleperf, app_data_file);
+allow simpleperf { apk_tmp_file apk_private_tmp_file }:file { getattr read };
+allow simpleperf system_linker_exec:file r_file_perms;
+allow simpleperf app_exec_data_file:file r_file_perms;
+allow simpleperf asec_public_file:file r_file_perms;
+r_dir_file(simpleperf, vendor_app_file);
+
+# Allow simpleperf to read input files passed from adb shell.
+allow simpleperf shell_data_file:file r_file_perms;
+allow simpleperf shell_data_file:dir r_dir_perms;
+
# Neverallows:
# Profiling must be confined to the scope of an individual app.
neverallow simpleperf self:perf_event ~{ open read write kernel };
+# Never allow other processes to ptrace simpleperf, as this could leak sensitive infomation from
+# raw samples.
+neverallow { domain -crash_dump -llkd } simpleperf:process ptrace;
diff --git a/private/simpleperf_app_runner.te b/private/simpleperf_app_runner.te
index 184a80a..e4871ac 100644
--- a/private/simpleperf_app_runner.te
+++ b/private/simpleperf_app_runner.te
@@ -4,6 +4,7 @@
# run simpleperf_app_runner in adb shell.
allow simpleperf_app_runner adbd:fd use;
+allow simpleperf_app_runner adbd:unix_stream_socket { read write };
allow simpleperf_app_runner shell:fd use;
allow simpleperf_app_runner devpts:chr_file { read write ioctl };
@@ -29,7 +30,7 @@
# simpleperf_app_runner passes pipe fds.
# simpleperf_app_runner writes app type (debuggable or profileable) to pipe fds.
-allow simpleperf_app_runner shell:fifo_file { read write };
+allow simpleperf_app_runner shell:fifo_file { getattr read write };
# simpleperf_app_runner checks shell data paths.
# simpleperf_app_runner passes shell data fds.
diff --git a/private/su.te b/private/su.te
index 1e2adef..247fd0b 100644
--- a/private/su.te
+++ b/private/su.te
@@ -127,6 +127,7 @@
typeattribute su hal_tv_tuner_client;
typeattribute su hal_usb_client;
typeattribute su hal_vibrator_client;
+ typeattribute su hal_vm_capabilities_client;
typeattribute su hal_vr_client;
typeattribute su hal_weaver_client;
typeattribute su hal_wifi_client;
diff --git a/private/system_app.te b/private/system_app.te
index 93be46f..9a70375 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -70,6 +70,9 @@
# Allow developer settings to check 16k pages boot option status
get_prop(system_app, enable_16k_pages_prop)
+# Allow developer settings to check virtualization capabilities
+get_prop(system_app, hypervisor_prop)
+
# Create /data/anr/traces.txt.
allow system_app anr_data_file:dir ra_dir_perms;
allow system_app anr_data_file:file create_file_perms;
diff --git a/private/system_server.te b/private/system_server.te
index 01097f2..92caa60 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -243,6 +243,11 @@
# Read /sys/kernel/dma_heap/*.
allow system_server sysfs_dma_heap:file r_file_perms;
+# Read /sys/kernel/mm/cma/*.
+starting_at_board_api(202504, `
+allow system_server sysfs_cma:file r_file_perms;
+')
+
# Allow reading DMA-BUF sysfs stats from /sys/kernel/dmabuf.
allow system_server sysfs_dmabuf_stats:dir r_dir_perms;
allow system_server sysfs_dmabuf_stats:file r_file_perms;
@@ -424,6 +429,9 @@
hal_sensors_server
hal_vibrator_server
hal_vr_server
+ hal_wifi_hostapd_server
+ hal_wifi_server
+ hal_wifi_supplicant_server
system_suspend_server
}:process { signal };
@@ -893,6 +901,7 @@
# Read persist.wm.debug. properties
get_prop(system_server, persist_wm_debug_prop)
+set_prop(system_server, persist_wm_debug_prop)
# Read persist.sysui.notification.builder_extras_override property
get_prop(system_server, persist_sysui_builder_extras_prop)
@@ -914,6 +923,9 @@
# Allow system server to determine if system services are enabled
get_prop(system_server, system_service_enable_prop)
+# Allow system server to read shared mmd properties
+get_prop(system_server, mmd_shared_prop)
+
# Create a socket for connections from debuggerd.
allow system_server system_ndebug_socket:sock_file create_file_perms;
@@ -1162,6 +1174,9 @@
# Allow invoking tools like "timeout"
allow system_server toolbox_exec:file rx_file_perms;
+# Allow invoking pbtombstone
+allow system_server pbtombstone_exec:file rx_file_perms;
+
# Allow system process to setup fs-verity
allowxperm system_server { apk_data_file apk_tmp_file system_data_file apex_system_server_data_file }:file ioctl FS_IOC_ENABLE_VERITY;
@@ -1354,6 +1369,7 @@
file_type
-toolbox_exec
-logcat_exec
+ -pbtombstone_exec
with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
}:file execute_no_trans;
@@ -1651,6 +1667,16 @@
# Allow GameManagerService to read and write persist.graphics.game_default_frame_rate.enabled
set_prop(system_server, game_manager_config_prop)
+# Allow system server to write HintManagerService properties
+set_prop(system_server, hint_manager_config_prop)
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -system_server
+ userdebug_or_eng(`-shell')
+} hint_manager_config_prop:property_service set;
+
# ThreadNetworkService reads Thread Network properties
get_prop(system_server, threadnetwork_config_prop)
diff --git a/private/system_suspend_internal_server.te b/private/system_suspend_internal_server.te
index 67bff77..8ff9da9 100644
--- a/private/system_suspend_internal_server.te
+++ b/private/system_suspend_internal_server.te
@@ -7,5 +7,6 @@
-dumpstate # bug reports
-system_suspend_internal_server # implements system_suspend_control_internal_service
-system_server # configures system_suspend via ISuspendControlServiceInternal
+ -traced_probes # tracing
-traceur_app # tracing
} system_suspend_control_internal_service:service_manager find;
diff --git a/private/traced.te b/private/traced.te
index 8a29541..619a55b 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -56,6 +56,11 @@
# Allow traced to detect if a process is frozen (b/381089063).
allow traced cgroup_v2:file r_file_perms;
+# Allow traced/traced_relay to read the traced config properties.
+get_prop(traced, traced_config_prop)
+# Allow traced_relay to read the relay port being used
+get_prop(traced, traced_relay_relay_port_prop)
+
# Allow setting debug properties which guard initialization of the Perfetto SDK
# in SurfaceFlinger and HWUI's copy of Skia.
# Required for the android.sdk_sysprop_guard data source.
diff --git a/private/traced_perf.te b/private/traced_perf.te
index c7e81cd..8bd7ad3 100644
--- a/private/traced_perf.te
+++ b/private/traced_perf.te
@@ -35,10 +35,13 @@
r_dir_file(traced_perf, apex_art_data_file)
allow traced_perf apex_module_data_file:dir { getattr search };
-# Allow to temporarily lift the kptr_restrict setting and build a symbolization
-# map reading /proc/kallsyms.
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
userdebug_or_eng(`set_prop(traced_perf, lower_kptr_restrict_prop)')
-allow traced_perf proc_kallsyms:file r_file_perms;
+allow traced_perf proc_kallsyms:file { open read lock };
# Allow reading tracefs files to get the format and numeric ids of tracepoints.
allow traced_perf debugfs_tracing:dir r_dir_perms;
diff --git a/private/traced_probes.te b/private/traced_probes.te
index 6540420..6a42eb2 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -35,10 +35,13 @@
# Allow procfs access
r_dir_file(traced_probes, domain)
-# Allow to temporarily lift the kptr_restrict setting and build a symbolization
-# map reading /proc/kallsyms.
+# For kernel address symbolisation. Allow reading from /proc/kallsyms inherited
+# from init, as well as separately opening and locking the file for
+# coordinating the use of that shared fd.
+# On debuggable builds, allow using lower_kptr_restrict_prop to temporarily
+# lift kptr_restrict systemwide.
userdebug_or_eng(`set_prop(traced_probes, lower_kptr_restrict_prop)')
-allow traced_probes proc_kallsyms:file r_file_perms;
+allow traced_probes proc_kallsyms:file { open read lock };
# Allow to read packages.list file.
allow traced_probes packages_list_file:file r_file_perms;
@@ -111,6 +114,10 @@
binder_call(traced_probes, statsd)
allow traced_probes stats_service:service_manager find;
+# Allow traced_probes to talk to suspend control service to read details of kernel wakelocks.
+allow traced_probes system_suspend_control_internal_service:service_manager find;
+allow traced_probes system_suspend:binder call;
+
# Allow reading the system property representing number of desktop windows to
# set the initial value for the counter in traces.
get_prop(traced_probes, debug_tracing_desktop_mode_visible_tasks_prop)
diff --git a/private/tradeinmode.te b/private/tradeinmode.te
index 99035f8..18cf452 100644
--- a/private/tradeinmode.te
+++ b/private/tradeinmode.te
@@ -6,6 +6,9 @@
allow tradeinmode adbd_tradeinmode:fd use;
allow tradeinmode adbd_tradeinmode:unix_stream_socket { read write ioctl };
+# Needed to enable trade-in mode for testing.
+set_prop(tradeinmode, adbd_tradeinmode_prop)
+
# Allow running from normal shell.
allow tradeinmode { adbd shell }:fd use;
allow tradeinmode adbd:unix_stream_socket { read write ioctl };
diff --git a/private/ueventd.te b/private/ueventd.te
index 7effa6d..654f861 100644
--- a/private/ueventd.te
+++ b/private/ueventd.te
@@ -75,6 +75,9 @@
# Allow ueventd to read apexd property
get_prop(ueventd, apexd_prop)
+# Allow ueventd to correctly label the symlinks it creates
+allow ueventd block_device:lnk_file relabelfrom;
+
#####
##### neverallow rules
#####
diff --git a/private/vendor_init.te b/private/vendor_init.te
index a50bc27..60962d4 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -116,6 +116,7 @@
-aconfig_storage_metadata_file
-aconfig_storage_flags_metadata_file
-tradeinmode_metadata_file
+ -proc_kallsyms
enforce_debugfs_restriction(`-debugfs_type')
}:file { create getattr open read write setattr relabelfrom unlink map };
@@ -195,6 +196,7 @@
-proc_uid_time_in_state
-proc_uid_concurrent_active_time
-proc_uid_concurrent_policy_time
+ -proc_kallsyms
enforce_debugfs_restriction(`-debugfs_type')
}:file { open read setattr map };
diff --git a/private/vendor_toolbox.te b/private/vendor_toolbox.te
index 178fa8f..5421dd5 100644
--- a/private/vendor_toolbox.te
+++ b/private/vendor_toolbox.te
@@ -7,5 +7,6 @@
coredomain
-init
-modprobe
+ userdebug_or_eng(`-overlay_remounter')
} vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
')
diff --git a/private/virtual_camera.te b/private/virtual_camera.te
index 31eadb2..86174b1 100644
--- a/private/virtual_camera.te
+++ b/private/virtual_camera.te
@@ -1,7 +1,10 @@
# virtual_camera - virtual camera daemon
-type virtual_camera, domain, coredomain;
-type virtual_camera_exec, system_file_type, exec_type, file_type;
+# The types are moved to public starting at 202502
+until_board_api(202504, `
+ type virtual_camera, domain, coredomain;
+ type virtual_camera_exec, system_file_type, exec_type, file_type;
+')
init_daemon_domain(virtual_camera)
@@ -41,6 +44,10 @@
allow virtual_camera gpu_device:dir r_dir_perms;
r_dir_file(virtual_camera, sysfs_gpu)
+# ION And DMABUF are used by vendor to allocate graphic buffers needed by virtual_camera
+allow cameraserver ion_device:chr_file rw_file_perms;
+allow cameraserver dmabuf_system_heap_device:chr_file r_file_perms;
+
# Allow virtual camera to use graphics composer fd-s (fences).
allow virtual_camera hal_graphics_composer:fd use;
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 259c402..95bdd1c 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -115,8 +115,16 @@
r_dir_file(virtualizationmanager, vendor_microdroid_file)
# Do not allow writing vendor_microdroid_file from any process.
-neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms;
-neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms;
+neverallow {
+ domain
+ recovery_only(`userdebug_or_eng(`-fastbootd')')
+ userdebug_or_eng(`-overlay_remounter')
+} vendor_microdroid_file:dir no_w_dir_perms;
+neverallow {
+ domain
+ recovery_only(`userdebug_or_eng(`-fastbootd')')
+ userdebug_or_eng(`-overlay_remounter')
+} vendor_microdroid_file:file no_w_file_perms;
# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
r_dir_file(virtualizationmanager, crosvm);
diff --git a/private/vold.te b/private/vold.te
index c242040..8fe8518 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -291,9 +291,10 @@
# Allow vold to use wake locks. Needed for idle maintenance and moving storage.
wakelock_use(vold)
-# Allow vold to publish a binder service and make binder calls.
+# Allow vold to make binder calls and publish binder services.
binder_use(vold)
add_service(vold, vold_service)
+add_service(vold, fwk_vold_service)
# Allow vold to call into the system server so it can check permissions.
binder_call(vold, system_server)
diff --git a/private/wifi_mainline_supplicant.te b/private/wifi_mainline_supplicant.te
index d6c7998..c18cef6 100644
--- a/private/wifi_mainline_supplicant.te
+++ b/private/wifi_mainline_supplicant.te
@@ -5,7 +5,7 @@
init_daemon_domain(wifi_mainline_supplicant)
add_service(wifi_mainline_supplicant, wifi_mainline_supplicant_service)
-allow wifi_mainline_supplicant self:global_capability_class_set { setuid setgid net_admin net_raw };
+allow wifi_mainline_supplicant self:global_capability_class_set { net_admin net_raw };
allow wifi_mainline_supplicant proc_net:file rw_file_perms;
allow wifi_mainline_supplicant sysfs_net:dir search;
diff --git a/public/attributes b/public/attributes
index 6e11b86..bc58e40 100644
--- a/public/attributes
+++ b/public/attributes
@@ -250,6 +250,16 @@
attribute socket_between_core_and_vendor_violators;
expandattribute socket_between_core_and_vendor_violators false;
+starting_at_board_api(202504, `
+# All vsock communication is required to go through AVF so that we can
+# have a consistent permission model for which is allowed to talk to
+# which. This breaks Treble as well as updatability of VMs and
+# other components.
+# TODO(b/347661724): Remove this once there are no violations.
+attribute unconstrained_vsock_violators;
+expandattribute unconstrained_vsock_violators false;
+')
+
# All vendor domains which violate the requirement of not executing
# system processes
# TODO(b/36463595)
@@ -457,3 +467,8 @@
starting_at_board_api(202504, `
attribute tee_service_type;
')
+
+# HAL service used for custom smc filtering project
+starting_at_board_api(202504, `
+ hal_attribute(vm_capabilities);
+')
diff --git a/public/file.te b/public/file.te
index 94483a3..7a8e3af 100644
--- a/public/file.te
+++ b/public/file.te
@@ -103,6 +103,11 @@
type sysfs_uio, sysfs_type, fs_type;
type sysfs_batteryinfo, fs_type, sysfs_type;
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
+
+starting_at_board_api(202504, `
+ type sysfs_cma, fs_type, sysfs_type;
+')
+
type sysfs_devfreq_cur, fs_type, sysfs_type;
type sysfs_devfreq_dir, fs_type, sysfs_type;
type sysfs_devices_block, fs_type, sysfs_type;
@@ -124,6 +129,11 @@
type sysfs_net, fs_type, sysfs_type;
type sysfs_power, fs_type, sysfs_type;
type sysfs_rtc, fs_type, sysfs_type;
+
+starting_at_board_api(202504, `
+ type sysfs_mem_sleep, fs_type, sysfs_type;
+')
+
type sysfs_suspend_stats, fs_type, sysfs_type;
type sysfs_switch, fs_type, sysfs_type;
type sysfs_sync_on_suspend, fs_type, sysfs_type;
diff --git a/public/service.te b/public/service.te
index 68f4ea0..db79fdf 100644
--- a/public/service.te
+++ b/public/service.te
@@ -66,9 +66,6 @@
type activity_task_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type adb_service, system_api_service, system_server_service, service_manager_type;
type adservices_manager_service, system_api_service, system_server_service, service_manager_type;
-starting_at_board_api(202504, `
- type advanced_protection_service, app_api_service, system_server_service, service_manager_type;
-')
type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type app_binding_service, system_server_service, service_manager_type;
starting_at_board_api(202504, `
@@ -144,9 +141,6 @@
type platform_compat_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type face_service, app_api_service, system_server_service, service_manager_type;
type fingerprint_service, app_api_service, system_server_service, service_manager_type;
-starting_at_board_api(202504, `
- type forensic_service, app_api_service, system_api_service, system_server_service, service_manager_type;
-')
type fwk_altitude_service, system_server_service, service_manager_type;
type fwk_stats_service, app_api_service, system_server_service, service_manager_type;
type fwk_sensor_service, system_server_service, service_manager_type;
@@ -375,6 +369,9 @@
type hal_wifi_hostapd_service, protected_service, hal_service_type, service_manager_type;
type hal_wifi_supplicant_service, protected_service, hal_service_type, service_manager_type;
type hal_gatekeeper_service, protected_service, hal_service_type, service_manager_type;
+starting_at_board_api(202504, `
+ type hal_vm_capabilities_service, protected_service, hal_service_type, service_manager_type;
+')
# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
diff --git a/public/virtual_camera.te b/public/virtual_camera.te
new file mode 100644
index 0000000..1c9e9d6
--- /dev/null
+++ b/public/virtual_camera.te
@@ -0,0 +1,10 @@
+# virtual_camera - virtual camera daemon
+
+starting_at_board_api(202504, `
+ type virtual_camera, domain, coredomain;
+ type virtual_camera_exec, system_file_type, exec_type, file_type;
+')
+
+# system/sepolicy/public is for vendor-facing type and attribute definitions.
+# DO NOT ADD allow, neverallow, or dontaudit statements here.
+# Instead, add such policy rules to system/sepolicy/private/*.te.
diff --git a/tests/Android.bp b/tests/Android.bp
index 81e7927..8671fae 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -187,6 +187,9 @@
// prebuilt files to be included to CTS
filegroup {
name: "prebuilt_sepolicy_cts_data",
- srcs: [":202404_sepolicy_cts_data"],
+ srcs: [
+ ":202404_sepolicy_cts_data",
+ ":202504_sepolicy_cts_data",
+ ],
visibility: ["//cts/hostsidetests/security"],
}
diff --git a/tests/apex_sepolicy_tests.py b/tests/apex_sepolicy_tests.py
index 26082cb..d8c5c2b 100644
--- a/tests/apex_sepolicy_tests.py
+++ b/tests/apex_sepolicy_tests.py
@@ -29,7 +29,7 @@
import sys
import tempfile
from dataclasses import dataclass
-from typing import List
+from typing import Callable, List
import policy
@@ -61,7 +61,12 @@
pass
-Matcher = Is | Glob | Regex | BinaryFile
+@dataclass
+class MatchPred:
+ pred: Callable[[str], bool]
+
+
+Matcher = Is | Glob | Regex | BinaryFile | MatchPred
# predicate functions for Func matcher
@@ -87,7 +92,13 @@
labels: set[str]
-Rule = AllowPerm | ResolveType | NotAnyOf
+@dataclass
+class HasAttr:
+ """Rule checking if the context has the specified attribute"""
+ attr: str
+
+
+Rule = AllowPerm | ResolveType | NotAnyOf | HasAttr
# Helper for 'read'
@@ -104,8 +115,10 @@
return pathlib.PurePath(path).match(pattern)
case Regex(pattern):
return re.match(pattern, path)
- case BinaryFile:
+ case BinaryFile():
return path.startswith('./bin/') and not path.endswith('/')
+ case MatchPred(pred):
+ return pred(path)
def check_rule(pol, path: str, tcontext: str, rule: Rule) -> List[str]:
@@ -129,6 +142,9 @@
case NotAnyOf(labels):
if tcontext in labels:
errors.append(f"Error: {path}: can't be labelled as '{tcontext}'")
+ case HasAttr(attr):
+ if tcontext not in pol.QueryTypeAttribute(attr, True):
+ errors.append(f"Error: {path}: tcontext({tcontext}) must be associated with {attr}")
return errors
@@ -139,7 +155,7 @@
generic_rules = [
# binaries should be executable
- (BinaryFile, NotAnyOf({'vendor_file'})),
+ (BinaryFile(), NotAnyOf({'vendor_file'})),
# permissions
(Is('./etc/permissions/'), AllowRead('dir', {'system_server'})),
(Glob('./etc/permissions/*.xml'), AllowRead('file', {'system_server'})),
@@ -159,6 +175,25 @@
all_rules = target_specific_rules + generic_rules
+def base_attr_for(partition):
+ if partition in ['system', 'system_ext', 'product']:
+ return 'system_file_type'
+ elif partition in ['vendor', 'odm']:
+ return 'vendor_file_type'
+ else:
+ sys.exit(f"Error: invalid partition: {partition}\n")
+
+
+def system_vendor_rule(partition):
+ exceptions = [
+ "./etc/linkerconfig.pb"
+ ]
+ def pred(path):
+ return path not in exceptions
+
+ return pred, HasAttr(base_attr_for(partition))
+
+
def check_line(pol: policy.Policy, line: str, rules) -> List[str]:
"""Parses a file_contexts line and runs checks"""
# skip empty/comment line
@@ -197,7 +232,8 @@
"""Do testing"""
parser = argparse.ArgumentParser()
parser.add_argument('--all', action='store_true', help='tests ALL aspects')
- parser.add_argument('-f', '--file_contexts', help='output of "deapexer list -Z"')
+ parser.add_argument('-f', '--file_contexts', required=True, help='output of "deapexer list -Z"')
+ parser.add_argument('-p', '--partition', help='partition to check Treble violations')
args = parser.parse_args()
lib_path = extract_data(LIBSEPOLWRAP, work_dir)
@@ -209,6 +245,9 @@
else:
rules = generic_rules
+ if args.partition:
+ rules.append(system_vendor_rule(args.partition))
+
errors = []
with open(args.file_contexts, 'rt', encoding='utf-8') as file_contexts:
for line in file_contexts:
diff --git a/tests/apex_sepolicy_tests_test.py b/tests/apex_sepolicy_tests_test.py
index 727a023..2a92aee 100644
--- a/tests/apex_sepolicy_tests_test.py
+++ b/tests/apex_sepolicy_tests_test.py
@@ -106,7 +106,7 @@
self.assert_ok('./bin/init u:object_r:init_exec:s0')
self.assert_ok('./bin/hw/svc u:object_r:init_exec:s0')
self.assert_error('./bin/hw/svc u:object_r:vendor_file:s0',
- r"Error: .*svc: can\'t be labelled as \'vendor_file\'")
+ r'Error: .*svc: can\'t be labelled as \'vendor_file\'')
if __name__ == '__main__':
unittest.main(verbosity=2)
diff --git a/tests/policy.py b/tests/policy.py
index 98133b7..cf93ed7 100644
--- a/tests/policy.py
+++ b/tests/policy.py
@@ -589,7 +589,7 @@
vendor = any(MatchPathPrefix(path, prefix) for prefix in
["/vendor", "/odm"])
system = any(MatchPathPrefix(path, prefix) for prefix in
- ["/init", "/system_ext", "/product" ])
+ ["/init", "/system_ext", "/product", "/second_stage_resources" ])
# only mark entrypoint as system if it is not in legacy /system/vendor
if MatchPathPrefix(path, "/system/vendor"):
diff --git a/tools/finalize-vintf-resources.sh b/tools/finalize-vintf-resources.sh
index 3f3def6..11de637 100755
--- a/tools/finalize-vintf-resources.sh
+++ b/tools/finalize-vintf-resources.sh
@@ -130,7 +130,7 @@
# Build general_sepolicy.conf, plat_sepolicy.cil, and mapping file for CTS
DIST_DIR=out/dist $top/build/soong/soong_ui.bash --make-mode dist sepolicy_finalize bpmodify
-cp "$top/out/dist/plat_sepolicy.cil" "$prebuilt_dir/${ver}_plat_sepolicy.cil"
+cp "$top/out/dist/base_plat_sepolicy.cil" "$prebuilt_dir/${ver}_plat_sepolicy.cil"
cp "$top/out/dist/general_sepolicy.conf" "$prebuilt_dir/${ver}_general_sepolicy.conf"
cp "$top/out/dist/$ver.cil" "$prebuilt_dir/${ver}_mapping.cil"
@@ -149,3 +149,5 @@
bpmodify="$top/out/host/linux-x86/bin/bpmodify"
$bpmodify -a ":${ver}_sepolicy_cts_data" -m prebuilt_sepolicy_cts_data -property srcs -w \
$top/system/sepolicy/tests/Android.bp
+sed -i "s/FREEZE_TEST_BOARD_API_LEVEL = \".\{6\}\"/FREEZE_TEST_BOARD_API_LEVEL = \"${ver}\"/" \
+ $top/system/sepolicy/Android.bp
diff --git a/tools/sepolicy_generate_compat.py b/tools/sepolicy_generate_compat.py
index a941d6f..1287670 100644
--- a/tools/sepolicy_generate_compat.py
+++ b/tools/sepolicy_generate_compat.py
@@ -20,6 +20,7 @@
import logging
import mini_parser
import os
+import pkgutil
import policy
import shutil
import subprocess
@@ -91,30 +92,34 @@
check_run(cmd)
-def extract_mapping_file_from_img(img_path, ver, destination='.'):
- """ Extracts system/etc/selinux/mapping/{ver}.cil from system.img file.
+def extract_mapping_file_from_img_zip(zip_path, ver, destination='.'):
+ """ Extracts system/etc/selinux/mapping/{ver}.cil from img.zip file.
Args:
- img_path: string, path to system.img file
+ zip_path: string, path to img.zip file
ver: string, version of designated mapping file
destination: string, destination to pull the mapping file to
Returns:
string, path to extracted mapping file
"""
+ with zipfile.ZipFile(zip_path) as zip_file:
+ logging.debug(f'Extracting system.img to {temp_dir}')
+ zip_file.extract('system.img', temp_dir)
+ system_img_path = os.path.join(temp_dir, 'system.img')
+ mapping_file_path = os.path.join(destination, f'{ver}.cil')
cmd = [
'debugfs', '-R',
- 'cat system/etc/selinux/mapping/10000.0.cil', img_path
+ f'dump system/etc/selinux/mapping/{ver}.cil {mapping_file_path}',
+ system_img_path
]
- path = os.path.join(destination, '%s.cil' % ver)
- with open(path, 'wb') as f:
- logging.debug('Extracting %s.cil to %s' % (ver, destination))
- f.write(check_output(cmd).stdout.replace(b'10000_0', ver.replace('.', '_').encode()))
- return path
+ logging.debug(f'Extracting {ver}.cil to {destination}')
+ check_run(cmd)
+ return mapping_file_path
-def download_mapping_file(branch, build, ver, destination='.'):
+def download_img_zip(branch, build, destination='.'):
""" Downloads system/etc/selinux/mapping/{ver}.cil from Android Build server.
Args:
@@ -124,7 +129,7 @@
destination: string, destination to pull build artifact to
Returns:
- string, path to extracted mapping file
+ string, path to img.zip file
"""
logging.info('Downloading %s mapping file from branch %s build %s...' %
(ver, branch, build))
@@ -132,13 +137,7 @@
fetch_artifact(branch, build, artifact_pattern, temp_dir)
# glob must succeed
- zip_path = glob.glob(os.path.join(temp_dir, artifact_pattern))[0]
- with zipfile.ZipFile(zip_path) as zip_file:
- logging.debug('Extracting system.img to %s' % temp_dir)
- zip_file.extract('system.img', temp_dir)
-
- system_img_path = os.path.join(temp_dir, 'system.img')
- return extract_mapping_file_from_img(system_img_path, ver, destination)
+ return glob.glob(os.path.join(temp_dir, artifact_pattern))[0]
def build_base_files(target_version):
@@ -167,7 +166,7 @@
dist_dir = os.path.join(build_top, 'out', 'dist')
base_policy_path = os.path.join(dist_dir, 'base_plat_sepolicy')
old_policy_path = os.path.join(dist_dir,
- '%s_plat_sepolicy' % target_version)
+ '%s_plat_policy' % target_version)
pub_policy_cil_path = os.path.join(dist_dir, 'base_plat_pub_policy.cil')
return base_policy_path, old_policy_path, pub_policy_cil_path
@@ -176,8 +175,8 @@
def change_api_level(versioned_type, api_from, api_to):
""" Verifies the API version of versioned_type, and changes it to new API level.
- For example, change_api_level("foo_32_0", "32.0", "31.0") will return
- "foo_31_0".
+ For example, change_api_level("foo_202404", "202404", "202504") will return
+ "foo_202504".
Args:
versioned_type: string, type with version suffix
@@ -187,12 +186,10 @@
Returns:
string, a new versioned type
"""
- old_suffix = api_from.replace('.', '_')
- new_suffix = api_to.replace('.', '_')
- if not versioned_type.endswith(old_suffix):
+ if not versioned_type.endswith(api_from):
raise ValueError('Version of type %s is different from %s' %
(versioned_type, api_from))
- return versioned_type.removesuffix(old_suffix) + new_suffix
+ return versioned_type.removesuffix(api_from) + api_to
def create_target_compat_modules(bp_path, target_ver):
@@ -323,17 +320,21 @@
parser = argparse.ArgumentParser()
parser.add_argument(
'--branch',
- required=True,
help='Branch to pull build from. e.g. "sc-v2-dev"')
- parser.add_argument('--build', required=True, help='Build ID, or "latest"')
+ parser.add_argument('--build',
+ default='latest',
+ help='Build ID, or "latest"')
parser.add_argument(
'--target-version',
required=True,
- help='Target version of designated mapping file. e.g. "32.0"')
+ help='Target version of designated mapping file. e.g. "202504"')
parser.add_argument(
'--latest-version',
required=True,
- help='Latest version for mapping of newer types. e.g. "31.0"')
+ help='Latest version for mapping of newer types. e.g. "202404"')
+ parser.add_argument(
+ '--img-zip',
+ help='Pre-downloaded img.zip. e.g. "aosp_arm64-img-xxxxxxxx.zip"')
parser.add_argument(
'-v',
'--verbose',
@@ -355,12 +356,13 @@
temp_dir = tempfile.mkdtemp()
try:
- libpath = os.path.join(
- os.path.dirname(os.path.realpath(__file__)), 'libsepolwrap' + SHARED_LIB_EXTENSION)
- if not os.path.exists(libpath):
- sys.exit(
- 'Error: libsepolwrap does not exist. Is this binary corrupted?\n'
- )
+ libname = "libsepolwrap" + SHARED_LIB_EXTENSION
+ libpath = os.path.join(temp_dir, libname)
+ with open(libpath, "wb") as f:
+ blob = pkgutil.get_data("sepolicy_generate_compat", libname)
+ if not blob:
+ sys.exit("Error: libsepolwrap does not exist. Is this binary corrupted?\n")
+ f.write(blob)
build_top = get_android_build_top()
sepolicy_path = os.path.join(build_top, 'system', 'sepolicy')
@@ -386,8 +388,16 @@
Path(target_ignore_file).touch()
# Step 1. Download system/etc/selinux/mapping/{ver}.cil, and remove types/typeattributes
- mapping_file = download_mapping_file(
- args.branch, args.build, args.target_version, destination=temp_dir)
+ if args.img_zip and args.branch:
+ sys.exit('Error: only one of --img-zip and --branch can be set')
+ elif args.img_zip:
+ img_zip = args.img_zip
+ elif args.branch:
+ img_zip = download_img_zip(args.branch, args.build, destination=temp_dir)
+ else:
+ sys.exit('Error: either one of --img-zip and --branch must be set')
+ mapping_file = extract_mapping_file_from_img_zip(img_zip, args.target_version,
+ destination=temp_dir)
mapping_file_cil = mini_parser.MiniCilParser(mapping_file)
mapping_file_cil.types = set()
mapping_file_cil.typeattributes = set()
@@ -507,6 +517,9 @@
logging.info('writing %s' % target_ignore_file)
f.write(ignore_cil_template %
(args.target_version, '\n '.join(sorted(target_ignored_types))))
+
+ # TODO(b/391513934): add treble tests
+ # TODO(b/391513934): add mapping files to phony modules like selinux_policy_system
finally:
logging.info('Deleting temporary dir: {}'.format(temp_dir))
shutil.rmtree(temp_dir)
diff --git a/treble_sepolicy_tests_for_release/Android.bp b/treble_sepolicy_tests_for_release/Android.bp
index 7756cbb..2d19a42 100644
--- a/treble_sepolicy_tests_for_release/Android.bp
+++ b/treble_sepolicy_tests_for_release/Android.bp
@@ -36,16 +36,16 @@
java_genrule {
name: "treble_sepolicy_tests_29.0",
srcs: [
- ":29.0_plat_policy.cil",
- ":29.0_mapping.combined.cil",
":29.0_plat_pub_policy.cil",
+ ":29.0_mapping.combined.cil",
+ ":base_plat_pub_policy.cil",
],
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_29.0"],
cmd: "$(location treble_sepolicy_tests) " +
- "-b $(location :29.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :29.0_mapping.combined.cil) " +
- "-o $(location :29.0_plat_policy.cil) && " +
+ "-o $(location :29.0_plat_pub_policy.cil) && " +
"touch $(out)",
}
@@ -86,14 +86,14 @@
java_genrule {
name: "treble_sepolicy_tests_30.0",
srcs: [
- ":30.0_plat_policy.cil",
+ ":30.0_plat_pub_policy.cil",
":30.0_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":30.0_plat_pub_policy.cil"],
- (default, default): [":30.0_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_30.0"],
@@ -102,14 +102,14 @@
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
(false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :30.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :30.0_mapping.combined.cil) " +
- "-o $(location :30.0_plat_policy.cil) && " +
+ "-o $(location :30.0_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :30.0_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :30.0_mapping.combined.cil) " +
- "-o $(location :30.0_plat_policy.cil) && " +
+ "-o $(location :30.0_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
@@ -151,14 +151,14 @@
java_genrule {
name: "treble_sepolicy_tests_31.0",
srcs: [
- ":31.0_plat_policy.cil",
+ ":31.0_plat_pub_policy.cil",
":31.0_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":31.0_plat_pub_policy.cil"],
- (default, default): [":31.0_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_31.0"],
@@ -167,14 +167,14 @@
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
(false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :31.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :31.0_mapping.combined.cil) " +
- "-o $(location :31.0_plat_policy.cil) && " +
+ "-o $(location :31.0_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :31.0_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :31.0_mapping.combined.cil) " +
- "-o $(location :31.0_plat_policy.cil) && " +
+ "-o $(location :31.0_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
@@ -216,14 +216,14 @@
java_genrule {
name: "treble_sepolicy_tests_32.0",
srcs: [
- ":32.0_plat_policy.cil",
+ ":32.0_plat_pub_policy.cil",
":32.0_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":32.0_plat_pub_policy.cil"],
- (default, default): [":32.0_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_32.0"],
@@ -232,14 +232,14 @@
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
(false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :32.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :32.0_mapping.combined.cil) " +
- "-o $(location :32.0_plat_policy.cil) && " +
+ "-o $(location :32.0_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :32.0_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :32.0_mapping.combined.cil) " +
- "-o $(location :32.0_plat_policy.cil) && " +
+ "-o $(location :32.0_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
@@ -281,14 +281,14 @@
java_genrule {
name: "treble_sepolicy_tests_33.0",
srcs: [
- ":33.0_plat_policy.cil",
+ ":33.0_plat_pub_policy.cil",
":33.0_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":33.0_plat_pub_policy.cil"],
- (default, default): [":33.0_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_33.0"],
@@ -297,14 +297,14 @@
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
(false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :33.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :33.0_mapping.combined.cil) " +
- "-o $(location :33.0_plat_policy.cil) && " +
+ "-o $(location :33.0_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :33.0_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :33.0_mapping.combined.cil) " +
- "-o $(location :33.0_plat_policy.cil) && " +
+ "-o $(location :33.0_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
@@ -346,14 +346,14 @@
java_genrule {
name: "treble_sepolicy_tests_34.0",
srcs: [
- ":34.0_plat_policy.cil",
+ ":34.0_plat_pub_policy.cil",
":34.0_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":34.0_plat_pub_policy.cil"],
- (default, default): [":34.0_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_34.0"],
@@ -362,18 +362,19 @@
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
(false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :34.0_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :34.0_mapping.combined.cil) " +
- "-o $(location :34.0_plat_policy.cil) && " +
+ "-o $(location :34.0_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :34.0_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :34.0_mapping.combined.cil) " +
- "-o $(location :34.0_plat_policy.cil) && " +
+ "-o $(location :34.0_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
+// TODO(b/391513934): clean up once we can simplify complex select statements.
java_genrule {
name: "202404_mapping.combined.cil",
srcs: select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
@@ -413,17 +414,18 @@
}),
}
+// TODO(b/391513934): clean up once we can simplify complex select statements.
java_genrule {
name: "treble_sepolicy_tests_202404",
srcs: [
- ":202404_plat_policy.cil",
+ ":202404_plat_pub_policy.cil",
":202404_mapping.combined.cil",
] + select((
soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
), {
- (false, false): [":202404_plat_pub_policy.cil"],
- (default, default): [":202404_product_pub_policy.cil"],
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
}),
tools: ["treble_sepolicy_tests"],
out: ["treble_sepolicy_tests_202404"],
@@ -435,14 +437,90 @@
("202404", false, false): "touch $(out)",
("202404", default, default): "touch $(out)",
(default, false, false): "$(location treble_sepolicy_tests) " +
- "-b $(location :202404_plat_pub_policy.cil) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
"-m $(location :202404_mapping.combined.cil) " +
- "-o $(location :202404_plat_policy.cil) && " +
+ "-o $(location :202404_plat_pub_policy.cil) && " +
"touch $(out)",
(default, default, default): "$(location treble_sepolicy_tests) " +
- "-b $(location :202404_product_pub_policy.cil) " +
+ "-b $(location :base_product_pub_policy.cil) " +
"-m $(location :202404_mapping.combined.cil) " +
- "-o $(location :202404_plat_policy.cil) && " +
+ "-o $(location :202404_plat_pub_policy.cil) && " +
+ "touch $(out)",
+ }),
+}
+
+// TODO(b/391513934): clean up once we can simplify complex select statements.
+java_genrule {
+ name: "202504_mapping.combined.cil",
+ srcs: select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ "202404": [],
+ "202504": [],
+ default: [
+ ":plat_202504.cil",
+ ":202504.ignore.cil",
+ ],
+ }) + select((
+ soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+ soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+ ), {
+ ("202404", default): [],
+ ("202504", default): [],
+ (default, true): [
+ ":system_ext_202504.cil",
+ ":system_ext_202504.ignore.cil",
+ ],
+ (default, default): [],
+ }) + select((
+ soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+ soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+ ), {
+ ("202404", default): [],
+ ("202504", default): [],
+ (default, true): [
+ ":product_202504.cil",
+ ":product_202504.ignore.cil",
+ ],
+ (default, default): [],
+ }),
+ out: ["202504_mapping.combined.cil"],
+ cmd: select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+ "202404": "touch $(out)",
+ "202504": "touch $(out)",
+ default: "cat $(in) > $(out)",
+ }),
+}
+
+// TODO(b/391513934): clean up once we can simplify complex select statements.
+java_genrule {
+ name: "treble_sepolicy_tests_202504",
+ srcs: [
+ ":202504_plat_pub_policy.cil",
+ ":202504_mapping.combined.cil",
+ ] + select((
+ soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+ soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+ ), {
+ (false, false): [":base_plat_pub_policy.cil"],
+ (default, default): [":base_product_pub_policy.cil"],
+ }),
+ tools: ["treble_sepolicy_tests"],
+ out: ["treble_sepolicy_tests_202504"],
+ cmd: select((
+ soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+ soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+ soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+ ), {
+ ("202404", default, default): "touch $(out)",
+ ("202504", default, default): "touch $(out)",
+ (default, false, false): "$(location treble_sepolicy_tests) " +
+ "-b $(location :base_plat_pub_policy.cil) " +
+ "-m $(location :202504_mapping.combined.cil) " +
+ "-o $(location :202504_plat_pub_policy.cil) && " +
+ "touch $(out)",
+ (default, default, default): "$(location treble_sepolicy_tests) " +
+ "-b $(location :base_product_pub_policy.cil) " +
+ "-m $(location :202504_mapping.combined.cil) " +
+ "-o $(location :202504_plat_pub_policy.cil) && " +
"touch $(out)",
}),
}
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 220fbd2..b0c7a37 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -207,3 +207,4 @@
/(vendor|system/vendor)/lib(64)?/libutils\.so u:object_r:same_process_hal_file:s0
/(vendor|system/vendor)/lib(64)?/libutilscallstack\.so u:object_r:same_process_hal_file:s0
/(vendor|system/vendor)/lib(64)?/libz\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.virtualization\.capabilities\.capabilities_service-noop u:object_r:hal_vm_capabilities_default_exec:s0
diff --git a/vendor/hal_bluetooth_default.te b/vendor/hal_bluetooth_default.te
index efa75a7..2b3729d 100644
--- a/vendor/hal_bluetooth_default.te
+++ b/vendor/hal_bluetooth_default.te
@@ -1,7 +1,7 @@
type hal_bluetooth_default, domain;
hal_server_domain(hal_bluetooth_default, hal_bluetooth)
-allow hal_bluetooth_default bt_device:chr_file { open read write };
+allow hal_bluetooth_default bt_device:chr_file { open read write ioctl };
allow hal_bluetooth_default self:bluetooth_socket { create bind read write };
type hal_bluetooth_default_exec, exec_type, vendor_file_type, file_type;
diff --git a/vendor/hal_vm_capabilities_default.te b/vendor/hal_vm_capabilities_default.te
new file mode 100644
index 0000000..82aaf41
--- /dev/null
+++ b/vendor/hal_vm_capabilities_default.te
@@ -0,0 +1,10 @@
+type hal_vm_capabilities_default, domain;
+
+starting_at_board_api(202504, `
+ hal_server_domain(hal_vm_capabilities_default, hal_vm_capabilities);
+')
+
+type hal_vm_capabilities_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_vm_capabilities_default);
+
+# TODO(b/360102915): add more rules around vm_fd passed to the HAL